A lattice L = {x·b₁ + y·b₂ : x,y ∈ ℤ} is the same infinite set of points no matter which basis (b₁,b₂) is used to generate it — any two bases related by an integer matrix of determinant ±1 (a unimodular transform) span the identical lattice. Encryption hides a message bit m ∈ {0,1} as
c = L_point + v_m + e
v_0, v_1 : two fixed offset vectors ("deep holes")
e : small random noise, ‖e‖ < ‖v_1 − v_0‖ / 2
Decryption is the Closest Vector Problem (CVP): find the lattice point nearest c. Babai's rounding algorithm solves it by re-expressing the target in basis coordinates and rounding:
x̂ = round( B⁻¹ c ) (B = [b₁ b₂] as columns)
Bx̂ = nearest lattice point (Babai's estimate)
decoded m = argmin_m ‖ (c − Bx̂) − v_m ‖
Rounding in basis coordinates only finds the true nearest point when the basis is short and near-orthogonal (a "reduced" basis) — its Voronoi cell is close to a square, so ‖e‖ stays inside it. A basis produced by an integer skew transform
b₁' = b₁ + k·b₂
b₂' = k·b₁ + (k²+1)·b₂ (det = 1, same lattice)
spans the exact same points but has long, near-parallel vectors — its Voronoi cell is a thin sliver, so the same noise e now rounds to the wrong lattice point and decryption fails. This is the trapdoor at the heart of lattice-based systems (GGH, NTRU, and — via the closely related Learning-With-Errors problem — CRYSTALS-Kyber/ML-KEM): the private key is a short reduced basis that makes CVP trivial via Babai's algorithm, while the public key is a computationally-equivalent but badly-skewed basis for which finding the closest vector is believed to be hard even for a quantum computer.
- Channel noise slider — the error vector's length; push it near the private basis's decoding radius and even the correct key starts to fail.
- Public basis skew k — how far the exposed basis is skewed from the reduced one; higher k means longer, more parallel public vectors.
- Private vs Public buttons — switch which basis Babai's algorithm rounds with, using the identical ciphertext.