Small MLWE instances encode as QUBO so secret and error recover together from the ground state, with noise stability fixed by a convex polytope and the energy gap.

Referee: The central uniqueness and stability claims require that the modular residual be realized inside a pure quadratic binary objective without introducing spurious lower-energy states. The manuscript must state explicitly the precise penalty schedule used, prove or bound that the planted (secret, discretized-error) pair remains the unique ground state for that schedule, and show that the same schedule does not flatten or reorder the energy gaps that the stability analysis equates to the geometric polytope. Low-dimensional exact recovery alone does not establish this for general q and error bounds.

Authors: We agree that the uniqueness claim is incomplete without an explicit penalty schedule and a supporting bound. In the revised construction section we will write the full QUBO objective with the modular residual expanded via binary (or one-hot) coefficient encodings and the standard quadratic penalty terms for equality constraints and for out-of-range expansions, and we will state the concrete coefficient hierarchy used in all experiments (residual weight, modular-slack penalties, and validity penalties). We will add a sufficient-condition lemma: if the penalty coefficients dominate the residual objective by a factor depending on q and the bit-widths of secret and error, then every infeasible binary string has energy strictly above the planted feasible pair, so the unconstrained ground state coincides with the planted (secret, discretized-error) pair. We will also verify, for the same schedule, that the optimal-to-second-best gap among feasible solutions is unchanged by the penalties (penalties only lift infeasible states), which is the regime in which our polytope–gap equivalence is claimed. We do not claim a parameter-free uniqueness proof for arbitrary q and unbounded error alphabets; the lemma will give explicit sufficient ranges, and we will note that outside those ranges uniqueness must be checked instance-wise. Low-dimensional exact recovery will be retained as numerical confirmation inside the proven regime, not as a substitute for the bound. revision: yes

Referee: Stability analysis (polytope defined by competing candidate secrets; equivalence to optimal-to-second-best energy gap): clarify whether the competing candidates are taken over the full feasible binary encoding (including invalid expansions and modular images) or only over valid secret/error pairs. If the former, the polytope description must incorporate the penalty-induced barriers; if the latter, the claimed equivalence holds only after the encoding constraints have already been enforced. A concrete statement of the feasible set over which the second-best solution is defined is needed.

Authors: The referee is right that the feasible set was not stated sharply enough. In the manuscript the geometric polytope is defined by competing candidate secrets (and their associated residual-minimizing discretized errors) that are valid under the chosen binary expansions and that satisfy the modular equation after decoding; invalid expansions and modular images are not vertices of that polytope. The energy-gap side of the equivalence is likewise the gap between the optimal and second-best solutions restricted to the feasible set after the encoding constraints are enforced. Under the penalty schedule of the revised construction (Comment 1), infeasible strings lie strictly above this gap, so the unconstrained QUBO second-best coincides with the second-best feasible solution and the polytope–gap equivalence is load-bearing. We will add an explicit definition of the feasible set F (valid secret/error bit-strings whose decoded residual is 0 mod q), restate the polytope as the set of additive perturbations that preserve the ordering of energies over F, and state the equivalence theorem only for the second-best element of F. We will also note that if penalties are set too weakly, spurious infeasible minima can appear and the geometric description no longer matches the unconstrained landscape; that failure mode is excluded by the sufficient conditions of Comment 1. revision: yes

Referee: Error discretization and coefficient bounds appear as free modeling parameters. The recovery and uniqueness claims are stated for the discretized alphabet used in the experiments. The manuscript should make precise the conditions under which the true continuous (or larger-alphabet) error remains the unique ground state after discretization, and whether the polytope/gap characterization is invariant under refinement of the error alphabet.

Authors: We agree that discretization is a modeling choice and that the joint-recovery claim must be scoped to it. The QUBO recovers the planted secret together with the discretized error that was encoded; it does not automatically recover a continuous or finer-alphabet error unless that error lies in the chosen alphabet (or is the unique nearest representative under the residual objective). In the revision we will (i) state the error alphabet E and coefficient bounds as part of the instance definition, (ii) give the elementary condition that if the true error e* belongs to E and the residual objective plus penalties make (s*,e*) the unique minimizer over valid pairs, then the ground state recovers e* exactly, and (iii) note that refining E (e.g., finer quantization of a continuous error) enlarges the variable set and can only shrink or preserve the stability polytope relative to the coarser alphabet, so the polytope/gap characterization is not automatically invariant under refinement. When the true error lies outside E, recovery is of the best residual-minimizing representative in E; we will state this limitation clearly and restrict the uniqueness theorems to the discretized problem actually solved. The experimental section will list the alphabets used and will not claim continuous-error recovery beyond those alphabets. revision: yes

Referee: Scaling and embedding-overhead quantification: report whether the growth figures are purely combinatorial (logical qubits vs. dimension/modulus/error range) or include measured chain-strength and success-probability effects under minor embedding. If only logical counts are given, the feasibility assessment for annealing architectures is incomplete; if embedding statistics are included, state the annealer model and chain-break handling so that the overhead numbers can be reproduced.

Authors: The growth figures in the present manuscript are combinatorial: counts of logical binary variables as functions of module rank, dimension, modulus bit-width, and error-alphabet size, together with standard minor-embedding overhead estimates (chain-length / physical-qubit upper bounds) obtained from the connectivity pattern of the QUBO graph, not from hardware runs that measure chain strength or success probability. We did not report annealer-model-specific chain-break statistics or empirical success rates, and the recovery experiments themselves use exact classical simulation of the QUBO, not a physical annealer. We will revise the scaling section to state this scope explicitly, separate logical-variable scaling from embedding-overhead estimates, and label the latter as graph-theoretic upper bounds rather than measured hardware overhead. We will not add unsubstantiated success-probability claims. If space permits we will include a short note on how chain-strength heuristics would enter a hardware study, while reiterating that current annealers remain far from cryptographically relevant MLWE sizes—the same disclaimer already present in the abstract and conclusion. revision: yes