SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Table 19. VERDE's performance on LWE problems with  $n = 256$  and 350, Gaussian secrets, varying  $q$  and  $h$ . Preprocessing time: hours to process one matrix. Total attack time: sum of preprocessing time (assuming full parallelization) and training time (number of epochs multiplied by hours per epoch, see §2).
LWE parameters	VERDE attack time
n	log2q	h	Preprocessing (hrs)	Training	hrs/epoch	Total (hrs)
256	12	5-6	1.5	2-9 epochs	4.5-15
14	5-6	2.5	2-21 epochs	5.5-34
16	9	8.0	2 epochs	1.5	11
18	9	7.0	3 epochs	11.5
20	10	7.5	5 epochs	15
350	21	5	16	1-5 epochs	1.6	18-24
27	10	216	2-13 epochs	219-237
Table 20. LWE Estimator: best classical attack on Gaussian secrets on various  $q$ .  $n = 256$  and 350. For VERDE's highest  $h$ , we show the best classical attack, the attack cost (rop), and predicted block size  $\beta$  from the LWE Estimator.
n	log2q	h	best attack	rop	β
256	12	6	bdd / bdd_hybrid	291.0	214
14	6	bdd / bdd_hybrid	277.7	166
16	9	bdd / bdd_hybrid	267.1	128
18	9	bdd	257.7	93
20	10	bdd / bdd_hybrid	251.9	72
350	21	5	bdd	265.2	120
27	10	bdd / bdd_hybrid	250.2	68