Introduction
For every fixed k ≥ 3 k \ge3 k ≥ 3 , k k k -SAT is the canonical NP-complete problem [25 ] , and its exponential-time complexity underlies the Exponential Time Hypothesis (ETH) and the Strong Exponential Time Hypothesis (SETH) [38 , 39 ] . In this paper, we refute ETH by giving, for every fixed k ≥ 2 k \ge2 k ≥ 2 , a deterministic algorithm that counts the satisfying assignments of a k k k -CNF in subexponential time and polynomial space.
Write the input k k k -CNF on n n n declared variables with m m m input clauses as
F ( x 1 , … , x n ) = ⋀ e = 1 m [ ( x i e , 1 ⊕ b e , 1 ) ∨ ⋯ ∨ ( x i e , k ⊕ b e , k ) ] . F(x_1,\ldots,x_n)=\bigwedge_{e=1}^{m}\left[(x_{i_{e,1}}\oplus b_{e,1})\vee\cdots\vee(x_{i_{e,k}}\oplus b_{e,k})\right]. F ( x 1 , … , x n ) = e = 1 ⋀ m [ ( x i e , 1 ⊕ b e , 1 ) ∨ ⋯ ∨ ( x i e , k ⊕ b e , k ) ] .
where i e , j ∈ { 1 , … , n } i_{e,j}\in\{1,\ldots,n\} i e , j ∈ { 1 , … , n } and b e , j ∈ { 0 , 1 } b_{e,j}\in\{0,1\} b e , j ∈ { 0 , 1 } are the variable index and negation bit of the j j j th literal in clause e e e , and ⊕ \oplus ⊕ denotes addition modulo two. Repeating a literal permits clauses with fewer than k k k literals. The indices i e , j i_{e,j} i e , j and bits b e , j b_{e,j} b e , j are fixed by F F F ; only x 1 , … , x n x_1,\ldots,x_n x 1 , … , x n vary over assignments. Our aim is to compute the quantity
# F = ∣ { x ∈ { 0 , 1 } n : F ( x ) = 1 } ∣ . (1) \#F=\left|\left\{x\in\{0,1\}^{n}:F(x)=1\right\}\right|. \tag*{(1)} # F = ∣ { x ∈ { 0 , 1 } n : F ( x ) = 1 } ∣ . (1)
Testing # F > 0 \#F>0 # F > 0 also decides satisfiability. We keep k k k fixed as n n n grows. Throughout, log \log log denotes the natural logarithm.
Theorem 1.1. For each fixed k ≥ 2 k \ge2 k ≥ 2 , there exists a deterministic algorithm that, given a k k k -CNF F F F on n ≥ 20 n \ge20 n ≥ 20 declared variables with m m m clauses, computes # F \#F # F as defined in (1) in
( n + m ) O k ( 1 ) 2 O k ( n log log n / log n ) (n+m)^{O_k(1)}2^{O_k(n\log\log n/\sqrt{\log n})} ( n + m ) O k ( 1 ) 2 O k ( n l o g l o g n / l o g n ) bit operations and ( n + m ) O k ( 1 ) (n+m)^{O_k(1)} ( n + m ) O k ( 1 ) bits of space. For each fixed D > 0 D>0 D > 0 , its running time on inputs with m ≤ D n m \le Dn m ≤ D n is
( n + m ) O k , D ( 1 ) 2 O k , D ( n / log n ) . (n+m)^{O_{k,D}(1)}2^{O_{k,D}(n/\sqrt{\log n})}. ( n + m ) O k , D ( 1 ) 2 O k , D ( n / l o g n ) . The rational interpolation argument in § 6.4 gives the weaker exponent O k ( ρ ( n ) ) O_k(\rho(n)) O k ( ρ ( n )) , where
ρ ( n ) = n ( log log n ) 2 log n = n ( log n ) 1 / 2 + o ( 1 ) . \rho(n)=\frac{n(\log\log n)^2}{\sqrt{\log n}}=\frac{n}{(\log n)^{1/2+o(1)}}. ρ ( n ) = log n n ( log log n ) 2 = ( log n ) 1/2 + o ( 1 ) n . Appendix § 10 proves both bounds in Theorem 1.1 by tensor contraction. When # F > 0 \#F>0 # F > 0 , the standard self-reduction finds a satisfying assignment by fixing one variable at a time and checking that the remaining count is positive. Choosing each bit according to the two conditional counts instead gives an exactly uniform random satisfying assignment, with poly k ( n , m ) \operatorname{poly}_k(n,m) poly k ( n , m ) expected overhead [41 Theorem 3.3(1)] .
The theorem also yields arbitrarily accurate subexponential-time approximation algorithms for Max-k k k -SAT. The Unique Games Theorem [53 Section 8.1] implies NP-hardness bounds for Max-k k k -SAT that match, up to arbitrarily small error in the approximation ratio, the guarantees of the semidefinite-programming algorithm of [56 ] . Write OPT ( F ) \operatorname{OPT}(F) OPT ( F ) for the maximum number of clauses of F F F simultaneously satisfied by an assignment.
Corollary 1.2. For every fixed k ≥ 2 k \ge2 k ≥ 2 and ε > 0 \varepsilon>0 ε > 0 , there exists a randomized algorithm that, given a k k k -CNF F F F on n ≥ 20 n \ge20 n ≥ 20 variables with m m m clauses, finds an assignment satisfying at least OPT ( F ) − ε m \operatorname{OPT}(F)-\varepsilon m OPT ( F ) − ε m clauses with probability 1 − 2 − Ω ( n ) 1-2^{-\Omega(n)} 1 − 2 − Ω ( n ) , in
( n + m ) O k , ε ( 1 ) 2 O k , ε ( ρ ( n ) ) (n+m)^{O_{k,\varepsilon}(1)}2^{O_{k,\varepsilon}(\rho(n))} ( n + m ) O k , ε ( 1 ) 2 O k , ε ( ρ ( n )) time and ( n + m ) O k , ε ( 1 ) (n+m)^{O_{k,\varepsilon}(1)} ( n + m ) O k , ε ( 1 ) space.
Proof. We may assume m > 0 m>0 m > 0 . Let f ( x ) f(x) f ( x ) be the fraction of clauses satisfied by x x x , and let f ^ ( x ) \widehat{f}(x) f ( x ) be that fraction in a sample of O ( n / ε 2 ) O(n/\varepsilon^2) O ( n / ε 2 ) clauses chosen independently and uniformly with replacement. Hoeffding’s inequality and a union bound over all 2 n 2^n 2 n assignments give, with probability 1 − 2 − Ω ( n ) 1-2^{-\Omega(n)} 1 − 2 − Ω ( n ) ,
∣ f ^ ( x ) − f ( x ) ∣ ≤ ε / 2 for every x ∈ { 0 , 1 } n . \left|\widehat{f}(x)-f(x)\right|\le\varepsilon/2\qquad\text{for every }x\in\{0,1\}^n. f ( x ) − f ( x ) ≤ ε /2 for every x ∈ { 0 , 1 } n .
Thus, if x ^ \widehat{x} x maximizes f ^ \widehat{f} f , then f ( x ^ ) ≥ max x f ( x ) − ε f(\widehat{x})\ge\max_x f(x)-\varepsilon f ( x ) ≥ max x f ( x ) − ε . Given an integer threshold b b b , a Boolean circuit with at most two inputs per gate and size O k , ε ( n ) O_{k,\varepsilon}(n) O k , ε ( n ) tests whether an assignment satisfies at least b b b sampled clauses. The standard circuit-to-3-CNF reduction [9 Lemmas 15.9–15.10] produces a formula with O k , ε ( n ) O_{k,\varepsilon}(n) O k , ε ( n ) variables and clauses that is satisfiable exactly when this threshold can be attained. Theorem 1.1 , binary search on the threshold, and self-reduction then find an exact sample optimizer within the stated bounds. Truncating rejection sampling after O ( n + log ( n / ε 2 ) ) O(n+\log(n/\varepsilon^2)) O ( n + log ( n / ε 2 )) trials per sample gives worst-case poly ( n , m , ε − 1 ) \operatorname{poly}(n,m,\varepsilon^{-1}) poly ( n , m , ε − 1 ) sampling time and adds at most 2 − Ω ( n ) 2^{-\Omega(n)} 2 − Ω ( n ) to the failure probability. □
Note that runtime bounds of the form 2 o ( n ) 2^{o(n)} 2 o ( n ) do not transfer under general polynomial-time reductions (2 n o ( 1 ) 2^{n^{o(1)}} 2 n o ( 1 ) would be needed for this), so our result does not imply that general NP problems admit subexponential time algorithms. However we do obtain subexponential time algorithms for counting graph colorings and perfect matchings.
Corollary 1.3. On simple graphs with v v v vertices and e e e edges, the number of independent sets and, for each fixed q ≥ 2 q\ge2 q ≥ 2 , the number of proper q q q -colorings can be computed deterministically in 2 o ( v ) 2^{o(v)} 2 o ( v ) time and poly q ( v , e ) \operatorname{poly}_q(v,e) poly q ( v , e ) space. The number of perfect matchings can be computed deterministically in 2 o ( v + e ) 2^{o(v+e)} 2 o ( v + e ) time and poly ( v , e ) \operatorname{poly}(v,e) poly ( v , e ) space.
Proof. For G = ( V , E ) G=(V,E) G = ( V , E ) , introduce a Boolean variable x u x_u x u for each u ∈ V u \in V u ∈ V . Satisfying assignments of
⋀ { u , w } ∈ E ( ¬ x u ∨ ¬ x w ) \bigwedge_{\{u,w\}\in E}(\neg x_u \lor\neg x_w) { u , w } ∈ E ⋀ ( ¬ x u ∨ ¬ x w )
correspond bijectively to the independent sets { u ∈ V : x u = 1 } \{u \in V : x_u = 1\} { u ∈ V : x u = 1 } . For proper q q q -colorings, use one Boolean variable per vertex and color, require exactly one color at each vertex, and forbid equal colors at adjacent vertices. This gives a counting-preserving q q q -CNF encoding with q v qv q v variables and O q ( v + e ) O_q(v+e) O q ( v + e ) clauses.
For perfect matchings, use one Boolean variable per edge and a linear-size circuit checking that exactly one selected edge meets each vertex. The standard circuit-to-3-CNF reduction [9 Lemmas 15.9–15.10] gives O ( v + e ) O(v+e) O ( v + e ) variables and clauses. The gate variables have unique values once the edge bits are fixed, so this encoding also preserves the count. Theorem 1.1 gives the stated time and space bounds. □
The fixed-density case of Theorem 1.1 gives a circuit lower bound for E N P \mathrm{E}^{\mathrm{NP}} E NP , the class of languages decidable in deterministic time 2 O ( n ) 2^{O(n)} 2 O ( n ) with an NP oracle.
Corollary 1.4. Let C L ( n ) C_L(n) C L ( n ) be the minimum number of noninput gates in a circuit computing L L L on { 0 , 1 } n \{0,1\}^n { 0 , 1 } n , allowing arbitrary Boolean gates of fan-in at most two and unrestricted fan-out. There exist a language L ∈ E N P L \in\mathrm{E}^{\mathrm{NP}} L ∈ E NP and a constant c > 0 c > 0 c > 0 such that
C L ( n ) > c n log n (2) C_L(n) > cn\sqrt{\log n} \tag*{(2)} C L ( n ) > c n log n (2) for infinitely many n n n .
Appendix C.1 proves the corollary. Appendix C.2 gives algorithms for inversion and exact preimage counting of Boolean maps with constant output locality.
Related work
We first discuss earlier SAT and counting algorithms and the complexity hypotheses contradicted by Theorem 1.1. We then compare our approach with earlier algebraic algorithms and identify the existing constructions used in our proof, whose roles are developed in the roadmap in Section 2.
SAT algorithms and the exponential-time hypotheses
Schöning’s local-search algorithm and PPSZ are landmarks in the development of exponential-time algorithms for k k k -SAT [59 , 54 ] . Schöning’s randomized algorithm starts from a random assignment and repeatedly flips a uniformly chosen variable in an unsatisfied clause. Its bounded-error decision time is
( n + m ) O ( 1 ) ( 2 − 2 / k ) n (n+m)^{O(1)}(2-2/k)^n ( n + m ) O ( 1 ) ( 2 − 2/ k ) n
for each fixed k ≥ 3 k \ge3 k ≥ 3 [59 Section 2] . In particular, this gives ( n + m ) O ( 1 ) ( 4 / 3 ) n (n+m)^{O(1)}(4/3)^n ( n + m ) O ( 1 ) ( 4/3 ) n time for 3-SAT.
The PPSZ algorithm [54 ] uses a different mechanism: bounded resolution derives additional clauses, after which variables are assigned in a random order, taking forced values when available and guessing otherwise. For k = 3 , 4 k=3,4 k = 3 , 4 , its original analysis gave stronger bounds for uniquely satisfiable formulas than for general ones. The unique-SAT guarantees were later extended to general 3-SAT and 4-SAT; for 3-SAT this gave a randomized O ( 1.308 n ) O(1.308^n) O ( 1.30 8 n ) bound [35 ] . Hansen, Kaplan, Zamir, and Zwick improved the PPSZ bound for every fixed k ≥ 3 k \ge3 k ≥ 3 by biasing the algorithm’s guesses [34 ] . Scheder obtained an improvement for the same range of k k k by sharpening the analysis of the original PPSZ algorithm [58 Theorem 1.5] . For general 3-SAT, a preprint by Jiang and Cai gives a randomized O ∗ ( 1.307031578 n ) O^*(1.307031578^n) O ∗ ( 1.30703157 8 n ) bound [42 Corollary 1.2] , where O ∗ O^* O ∗ suppresses factors polynomial in the input size. Lius’ deterministic algorithm combines branching with derandomized local search and solves 3-SAT in O ( 1.32793 n ) O(1.32793^n) O ( 1.3279 3 n ) time [48 Theorem 21] .
Randomized local search has also produced effective heuristics. The WalkSAT heuristic chooses an unsatisfied clause and flips one of its variables, combining random choices with greedy moves [61 ] . Experiments on formulas from circuit synthesis and diagnosis demonstrated the practical value of this approach [61 pp. 340–342, Tables 4–5] .
Among uniformly random k k k -CNFs, instances at the satisfiability threshold were conjectured to be the hardest for deciding satisfiability [68 Section 1] ; for fixed k ≥ 3 k \ge3 k ≥ 3 and lower clause densities m / n ≤ 2 k / k C m/n \le2^k/k^C m / n ≤ 2 k / k C , where C C C is a universal constant, polynomial-time almost-uniform sampling of satisfying assignments is known with high probability over the formula [CLWYY25, Theorem 1.2]. For a uniformly random formula with polynomially many clauses, conditioned on satisfiability, Vyas and Williams [68 Theorem 3] give a PPZ-based algorithm that finds a solution in 2 n ( 1 − Ω ( log k / k ) ) 2^{n(1-\Omega(\log k/k))} 2 n ( 1 − Ω ( l o g k / k )) time with high probability over both the formula and the algorithm’s random choices.
The Exponential Time Hypothesis (ETH) asserted that 3-SAT requires 2 Ω ( n ) 2^{\Omega(n)} 2 Ω ( n ) deterministic time in the worst case, and hence so does k k k -SAT for every fixed k ≥ 3 k \ge3 k ≥ 3 [IP01, Theorem 1]. The Strong Exponential Time Hypothesis (SETH) made the sharper prediction that k k k -SAT requires 2 n ( 1 − o k ( 1 ) ) 2^{n(1-o_k(1))} 2 n ( 1 − o k ( 1 )) time as k k k grows. Precisely, for every ϵ ∈ ( 0 , 1 ) \epsilon\in(0, 1) ϵ ∈ ( 0 , 1 ) , there is a fixed k k k for which no deterministic algorithm solves k k k -SAT in 2 ( 1 − ϵ ) n ( n + m ) O ( 1 ) 2^{(1-\epsilon)n}(n+m)^{O(1)} 2 ( 1 − ϵ ) n ( n + m ) O ( 1 ) time. The running-time bounds for Schöning’s algorithm and PPSZ helped motivate this prediction: their improvements over exhaustive search diminish as k k k grows [IP01, Open Problems, item 2].
The Gap Exponential Time Hypothesis (Gap-ETH) strengthens ETH by postulating constants δ , γ > 0 \delta, \gamma> 0 δ , γ > 0 for which no O ( 2 γ n ) O(2^{\gamma n}) O ( 2 γ n ) -time algorithm can distinguish a satisfiable 3-CNF from one in which every assignment violates at least a δ \delta δ fraction of the clauses, even when m = O ( n ) m=O(n) m = O ( n ) [Din16, MR17]. The randomized version rules out an algorithm with the same running time that distinguishes the two cases with probability at least 2 / 3 2/3 2/3 on every promised input [CCK+20, Conjecture 2.5]. It has been used to prove hardness of approximating Label Cover [29 ] and dense constraint satisfaction problems [MR17]. It also rules out nontrivial fixed-parameter approximations for Clique and Dominating Set. For Clique, the excluded ratios are o ( O P T ) o(\mathrm{OPT}) o ( OPT ) , where O P T \mathrm{OPT} OPT is the maximum clique size [CCK+20, Corollaries 5.3 and 5.6].
The Nondeterministic Strong Exponential Time Hypothesis (NSETH) asserts that, for every ϵ > 0 \epsilon> 0 ϵ > 0 , some fixed k k k admits no nondeterministic 2 ( 1 − ϵ ) n ( n + m ) O ( 1 ) 2^{(1-\epsilon)n}(n+m)^{O(1)} 2 ( 1 − ϵ ) n ( n + m ) O ( 1 ) -time algorithm for deciding whether a k k k -CNF is unsatisfiable , or equivalently whether a k k k -DNF is a tautology [CGI+16]. NSETH has been used to establish barriers to deterministic fine-grained reductions from SAT to problems such as 3SUM and All-Pairs Shortest Paths [CGI+16], and to delineate SETH-based lower bounds for approximating directed graph diameter [Li21].
Theorem 1.1 refutes ETH, SETH, Gap-ETH, and NSETH. Indeed, testing whether the exact count is positive or zero decides both satisfiability and unsatisfiability in deterministic 2 o ( n ) ( n + m ) O k ( 1 ) 2^{o(n)}(n+m)^{O_k(1)} 2 o ( n ) ( n + m ) O k ( 1 ) time for every fixed k k k ; deciding satisfiability also solves the Gap-ETH promise problem. The deterministic algorithm also refutes the bounded-error randomized versions of ETH [28 Section 1] and SETH [27 Definition 2.1] , and of Gap-ETH. It does not conflict with unconditional exponential lower bounds for restricted proof systems such as regular resolution [BI13]. In 2016, Ryan Williams refuted the Merlin–Arthur version of SETH (MA-SETH) by giving a protocol that certifies k k k -CNF unsatisfiability in 2 n / 2 poly ( n , m ) 2^{n/2}\operatorname{poly}(n,m) 2 n /2 poly ( n , m ) time [Wil16, Theorem 3.3].
Exact counting and counting complexity
In Valiant’s framework, #SAT and #3-SAT are #P-complete under parsimonious reductions [Val79, Section 3, Facts 1–2]. For fixed k ≥ 3 k \ge3 k ≥ 3 , previous exact-counting algorithms achieve poly k ( n , m ) 2 n − Ω ( n / k ) \operatorname{poly}_k(n,m)2^{n-\Omega(n/k)} poly k ( n , m ) 2 n − Ω ( n / k ) time, with a Las Vegas expected-time bound in [37 Lemma 3.5] and a deterministic bound in [CW21, Theorem 1.6]. For #2-SAT, Wahlström’s algorithm counts satisfying assignments in O ∗ ( 1.2377 n ) O^*(1.2377^n) O ∗ ( 1.237 7 n ) time [Wah08]. For #3-SAT, Kutzkov uses complementary branching to count satisfying assignments in O ∗ ( 1.637 n ) O^*(1.637^n) O ∗ ( 1.63 7 n ) time [Kut26]. Both algorithms are deterministic.
The counting Exponential Time Hypothesis (#ETH) asserted that exactly counting the satisfying assignments of a 3-CNF requires 2 Ω ( n ) 2^{\Omega(n)} 2 Ω ( n ) deterministic time [DHM+14, Section 1]. Under #ETH, Curticapean [26 ] rules out deterministic 2 o ( v ) 2^{o(v)} 2 o ( v ) -time algorithms for counting perfect matchings even in unweighted bipartite graphs with v v v vertices and O ( v ) O(v) O ( v ) edges. The perfect-matching algorithm in Corollary 1.3 applies in particular to these graphs. Our algorithm (Theorem 1.1) solves #3-SAT deterministically in 2 o ( n ) poly ( n , m ) 2^{o(n)} \operatorname{poly}(n,m) 2 o ( n ) poly ( n , m ) time and therefore refutes #ETH.
Implications for fine-grained complexity
ETH and SETH became standard assumptions for parameterized and fine-grained complexity [39 , 67 ] . ETH-based reductions yielded lower bounds for the dependence on solution size in Clique [CHKX06], and on treewidth in constraint satisfaction and partitioned subgraph isomorphism [51 ] . SETH supported sharp exponential bounds for Hitting Set and Set Splitting [27 ] , and for Independent Set and Dominating Set parameterized by treewidth [49 ] . It also gave bounds on possible speedups of pseudopolynomial algorithms for Subset Sum and Bicriteria Path [1 ] .
For problems in P, SETH was used to rule out polynomial-factor speedups over quadratic running times for edit distance [8 ] , longest common subsequence and dynamic time warping [17 ] , Fréchet distance [16 ] , and regular-expression matching [7 ] . Other applications concerned approximating graph diameter [57 ] and maintaining reachability counts or the size of the largest strongly connected component under graph updates [2 ] . Together these results made SETH a common basis for explaining the apparent optimality of algorithms across quite different problems.
Our refutation of ETH and SETH removes one basis for the hardness claims above. Some of the same lower bounds follow from weaker hypotheses that may still hold. For example, the lower bounds for longest common subsequence and regular-expression matching follow from the Orthogonal Vectors Conjecture (OVC) [17 , 7 ] . OVC asserts that for every fixed ε > 0 \varepsilon> 0 ε > 0 , no O ( N 2 − ε poly ( d ) ) O(N^{2-\varepsilon}\operatorname{poly}(d)) O ( N 2 − ε poly ( d )) -time algorithm can decide whether two sets of N N N Boolean vectors of dimension d d d contain an orthogonal pair, one vector from each set. The reduction from SAT to Orthogonal Vectors shows that SETH implies OVC [70 , 67 ] . The lower bounds for Fréchet distance, graph diameter approximation, and the treewidth dependence of Independent Set and Dominating Set also follow from the hypothesis that unrestricted CNF-SAT admits no 2 ( 1 − δ ) n poly ( n , m ) 2^{(1-\delta)n}\operatorname{poly}(n,m) 2 ( 1 − δ ) n poly ( n , m ) -time algorithm for any constant δ > 0 \delta> 0 δ > 0 [16 , 57 , 49 ] . Theorem 1.1 gives a running-time guarantee for each fixed clause width k k k , while this hypothesis allows the width to grow with n n n .
To obtain a faster algorithm for a target problem from our SAT algorithm, we need a reduction in the other direction, from that problem to fixed-width SAT, that controls the number of variables. Set Splitting with sets of size at most k k k has such a reduction [27 Observation 3.6] : use one Boolean variable per element to specify its side of the split. For each set, one clause requires at least one of its variables to be true, and a second requires at least one to be false. The resulting k k k -CNF has one variable per universe element, so for fixed k k k Theorem 1.1 gives subexponential time in the universe size, up to a polynomial input-size factor.
Prior work on algebraic algorithms for combinatorial problems
Our algorithm is algebraic, based on polynomial interpolation of carefully chosen auxiliary variables. Below we discuss prior work on using algebraic methods to design algorithm for combinatorial problems. For broader background, see the surveys of Koutis and Williams [45 ] on algebraic fingerprints, Williams [72 ] on the polynomial method in algorithm design, and Husfeldt [36 ] on algorithmic inclusion–exclusion.
Williams’s split-and-list algorithm [70 ] partitions the variables of a 2-CSP into three groups, enumerates partial assignments, and combines them using fast matrix multiplication. Koivisto [43 ] gives a direct sum–product formulation. The algorithm of Sections 3–6 likewise enumerates assignments within groups. Fixing the shared measurements y ˉ \bar{y} y ˉ makes their contributions multiply independently. Scott and Sorkin [60 Section 6] extend split-and-list to polynomial-valued weights and arbitrary rings. Our summation routine similarly uses truncated polynomial rings to retain several coefficients in one computation.
Björklund [14 Sections 2–3] uses inclusion–exclusion and polynomial interpolation to reduce permanent and directed Hamiltonian-cycle counting to a weighted sum over smaller instances. He adds the weights of identical instances in a table, then solves each distinct instance with nonzero total weight once. Björklund, Kaski, and Williams [BKW19] use low-degree curves and generalized Kakeya sets to recover polynomial values from evaluations on a small structured set, yielding faster algorithms for fermionants, including the permanent of integer matrices whose entries are bounded in absolute value by a fixed constant. Our polynomial replacements serve a similar purpose: they connect the desired count to structured evaluations from which it can be reconstructed. Here the useful structure is separation into groups after fixing a few shared measurements.
Bhargava, Ghosh, Kumar, and Mohapatra [13 Sections 3.1–3.2] evaluate multivariate polynomials over finite fields along low-degree curves, using Hasse derivatives and Hermite interpolation when values alone do not suffice. For a univariate restriction g g g , the order-j j j Hasse derivative at t t t is the coefficient of z j z^j z j in g ( t + z ) g(t+z) g ( t + z ) . We use the same recovery principle: compute several Taylor coefficients at each point admitting fast summation, then recover the original count by Hermite interpolation.
Woodruff and Yekhanin [74 ] use values and first derivatives along a line to recover a target value in private information retrieval. Kopparty, Saraf, and Yekhanin [KSY14] use higher-order Hasse derivatives for local correction of multiplicity codes, extending the line-based recovery of Reed–Muller codes. In our algorithm, the matrix construction supplies low-degree replacement forms that let us compute the Taylor coefficients at the interpolation points by fast summation after fixing a few shared measurements.
Antecedents of the matrix construction
Our counting algorithm evaluates sums of products of polynomials over Boolean assignments. The polynomials share variables, so these sums do not factor into independent smaller sums. We introduce linear substitutions, depending polynomially on an interpolation parameter, that make such a factorization possible after fixing a few integer linear measurements. An auxiliary square rational matrix M 0 M_0 M 0 underlies these substitutions: a bound on rank ( I − M 0 ) \operatorname{rank}(I-M_0) rank ( I − M 0 ) limits the number of measurements, while restrictions on the nonzero entries of M 0 M_0 M 0 keep the substitution degrees small. § 2.7 explains this connection.
Related interpolation methods have been used to obtain low-rank approximations to structured matrices. In [5 Section 3] , a low-degree polynomial matches ( − 1 ) j (-1)^j ( − 1 ) j on an interval of integer inner products j j j , using the interpolation lemma of [4 Lemma 3.1] . This gives low-rank matrices agreeing with Walsh–Hadamard matrices in most entries, a result in the study of matrix rigidity [65 ] . Related interpolation gives rigidity bounds for Kronecker powers in [3 Theorem 6.1] . Dvir and Liu [30 Claim 2.20 and Lemmas 3.3–3.4] use a spectral approach: sparse changes to a function invariant under permutations of its coordinates make many Fourier coefficients vanish, reducing the rank of its group-circulant matrix.
Our construction also interpolates ( − 1 ) j (-1)^j ( − 1 ) j on a short interval, now to obtain a polynomial in commuting permutation matrices. The same polynomial gives both the rank bound for I − M 0 I-M_0 I − M 0 and the restrictions on the nonzero entries of M 0 M_0 M 0 . We prove these properties and their quantitative bounds directly in § 4 .
Sparsification and parity tests
We use the counting-preserving version [28 Appendix A] of the sparsification lemma [39 ] , with quantitative bounds from [19 Section 6] and [18 Lemma 5.14 and equation (5.4)] . This partitions the satisfying assignments among sparse formulas on the same Boolean variables. Appendix § 7 records the disjoint branching argument and the bounds needed when its parameter varies with the input size.
The initial parity tests are the constraints of a Tanner code [63 Section II] , applied to the binary vector recording which clauses an assignment violates. We use the edge-based expander-code construction of [62 Sections IV and VI] : each graph edge carries one bit, and each vertex requires its incident bits to belong to a fixed binary linear code. The local code’s minimum distance, together with graph expansion, forces every nonzero vector satisfying all these constraints to have large support. This construction and distance argument are standard. Lemma 6.1 supplies the parameter choices needed here, including the bounds on the number and support size of the tests, and constructs the graph and local code by deterministic exhaustive searches. The graph is the bipartite double cover of a Cayley multigraph. The shifts defining that multigraph nearly balance every nonconstant parity on the base group: this is the small-bias condition [52 , 6 ] , stated explicitly in (63) . Fixing unused edge bits to zero gives a code on exactly m m m coordinates. Additional parity tests exclude the remaining nonzero violation vectors. We choose these tests by the averaging principle underlying the method of conditional expectations [55 ] , using exact counts to evaluate each candidate. Section 6 gives the constructions and quantitative bounds needed here.
Theorem 1.1 invites a renewed search for algorithms for problems whose known hardness results relied on ETH or SETH. The examples in § 1.1.3 suggest both immediate consequences and problems for which new algorithmic ideas are needed.
Notation
For an integer s ≥ 0 s \ge0 s ≥ 0 , write [ s ] = { 1 , … , s } [s] = \{1,\ldots,s\} [ s ] = { 1 , … , s } , with [ 0 ] = ∅ [0] = \varnothing [ 0 ] = ∅ . For a condition E E E , the scalar 1 { E } \mathbf{1}\{E\} 1 { E } equals one if E E E holds and zero otherwise. We use natural logarithms, writing log 2 \log_2 log 2 when the base is two. For complexity bounds, poly ( t 1 , … , t s ) \operatorname{poly}(t_1,\ldots,t_s) poly ( t 1 , … , t s ) denotes a bound of the form ( 1 + t 1 + ⋯ + t s ) O ( 1 ) (1+t_1+\cdots+t_s)^{O(1)} ( 1 + t 1 + ⋯ + t s ) O ( 1 ) , with absolute implicit constants. Subscripts, as in poly k , c ( t 1 , … , t s ) \operatorname{poly}_{k,c}(t_1,\ldots,t_s) poly k , c ( t 1 , … , t s ) , allow those constants to depend on the indicated fixed parameters. Integers are stored in signed binary notation, so an integer z z z uses O ( log ( ∣ z ∣ + 2 ) ) O(\log(|z|+2)) O ( log ( ∣ z ∣ + 2 )) bits. Rational numbers are stored as an integer numerator and a positive integer denominator; stated bit-length bounds apply to each of them. Space is measured in bits. Arithmetic-operation counts are distinguished from bit-operation counts.
For a finite set S S S , vectors in Q S \mathbb{Q}^{S} Q S have coordinates indexed by S S S and are column vectors unless indicated otherwise. For U ⊆ S U \subseteq S U ⊆ S , the indicator vector 1 U ∈ { 0 , 1 } S \mathbf{1}_U \in\{0,1\}^{S} 1 U ∈ { 0 , 1 } S has entries ( 1 U ) v = 1 { v ∈ U } (\mathbf{1}_U)_v = \mathbf{1}\{v\in U\} ( 1 U ) v = 1 { v ∈ U } for v ∈ S v \in S v ∈ S . We write 0 ⃗ \vec{0} 0 for the zero vector. For v ∈ S v \in S v ∈ S , the row δ v ∈ Q 1 × S \delta_v \in\mathbb{Q}^{1\times S} δ v ∈ Q 1 × S selects coordinate v v v , so δ v x = x v \delta_v x = x_v δ v x = x v . A vector indexed by U ⊆ S U \subseteq S U ⊆ S is extended to S S S by putting zero in each coordinate of S ∖ U S \setminus U S ∖ U .
We write X ⃗ = ( X 1 , … , X n ) \vec{X} = (X_1,\ldots,X_n) X = ( X 1 , … , X n ) for the vector of formal variables and use arrows for polynomial coefficient vectors such as P ⃗ f , v ( T ) \vec{P}_{f,v}(T) P f , v ( T ) . For a coefficient row p ⃗ = ( p i ) i ∈ S \vec{p} = (p_i)_{i\in S} p = ( p i ) i ∈ S and a vector z = ( z i ) i ∈ S z = (z_i)_{i\in S} z = ( z i ) i ∈ S , we write their scalar pairing as ⟨ p ⃗ , z ⟩ = ∑ i ∈ S p i z i \langle\vec{p},z\rangle= \sum_{i\in S} p_i z_i ⟨ p , z ⟩ = ∑ i ∈ S p i z i . In particular, ⟨ P ⃗ f , v ( T ) , X ⃗ ⟩ \langle\vec{P}_{f,v}(T),\vec{X}\rangle ⟨ P f , v ( T ) , X ⟩ is a scalar linear form in the variables X i X_i X i .
For a polynomial P ( X ⃗ , z ) P(\vec{X},z) P ( X , z ) in the variables X ⃗ \vec{X} X and a variable z z z , [ z j ] P [z^j]P [ z j ] P denotes the coefficient of z j z^j z j , viewed as a polynomial in X ⃗ \vec{X} X , and deg X ⃗ P \deg_{\vec{X}} P deg X P denotes total degree in X ⃗ \vec{X} X . The degree of a row of polynomials is the largest degree of any entry. Unless otherwise specified, polynomial coefficients are rational and matrix kernels are taken over Q \mathbb{Q} Q .
Technique overview
We first count satisfying assignments of a 3-CNF in which each variable occurs in at most three clauses. The product of its clause polynomials has degree at most 3 n 3n 3 n , so we can use interpolation to recover the exact count from sums over small groups of variables. § 2.8 then uses disjoint sparsification and variable copying to count the satisfying assignments of an arbitrary k k k -CNF in ( n + m ) O k ( 1 ) 2 o ( n ) (n+m)^{O_k(1)}2^{o(n)} ( n + m ) O k ( 1 ) 2 o ( n ) time for every fixed k ≥ 2 k \ge2 k ≥ 2 . Taking k = 3 k=3 k = 3 already refutes ETH. § 2.9 explains how counting on the original variables gives the exponent O k ( ρ ( n ) ) O_k(\rho(n)) O k ( ρ ( n )) of Proposition 6.4 .
The bounded-occurrence setting
Let F F F have n n n declared Boolean variables. Each clause contains at most three literals, and each variable appears in at most three clauses, counting positive and negative occurrences together. Our task is to count the satisfying assignments of F F F exactly.
We remove tautological clauses and repeated literals within a clause. An empty clause gives count zero immediately. These operations preserve the occurrence bound. For each remaining clause e e e , let I e ⊆ [ n ] I_e \subseteq[n] I e ⊆ [ n ] be its variable set. For each variable that occurs in no clause, add a factor equal to one with scope { v } \{v\} { v } . Such a factor leaves the count unchanged and ensures that every variable has an assigned position in the construction. We call these constant-one terms dummy clauses. Let F \mathcal{F} F index all clauses, including the dummy clauses. Then
∣ I e ∣ ≤ 3 , # { e ∈ F : v ∈ I e } ≤ 3 , n ≤ M : = ∑ e ∈ F ∣ I e ∣ ≤ 3 n . (3) |I_e| \le3,\qquad\#\{e \in\mathcal{F}: v \in I_e\} \le3,\qquad n \le M := \sum_{e \in\mathcal{F}} |I_e| \le3n. \tag*{(3)} ∣ I e ∣ ≤ 3 , # { e ∈ F : v ∈ I e } ≤ 3 , n ≤ M := e ∈ F ∑ ∣ I e ∣ ≤ 3 n . (3)
All sums below still range over the original n n n Boolean variables.
A direct polynomial for the count
Write L e , v ( X v ) = X v L_{e,v}(X_v) = X_v L e , v ( X v ) = X v for a positive literal and L e , v ( X v ) = 1 − X v L_{e,v}(X_v) = 1 - X_v L e , v ( X v ) = 1 − X v for a negative literal. The satisfaction polynomial of clause e e e is
Φ e ( ( X v ) v ∈ I e ) = 1 − ∏ v ∈ I e ( 1 − L e , v ( X v ) ) . \Phi_e((X_v)_{v \in I_e}) = 1 - \prod_{v \in I_e}(1 - L_{e,v}(X_v)). Φ e (( X v ) v ∈ I e ) = 1 − v ∈ I e ∏ ( 1 − L e , v ( X v )) .
For example, x a ∨ ¬ x b ∨ x c x_a \lor\lnot x_b \lor x_c x a ∨ ¬ x b ∨ x c gives
Φ e ( X a , X b , X c ) = 1 − ( 1 − X a ) X b ( 1 − X c ) . \Phi_e(X_a, X_b, X_c) = 1 - (1 - X_a)X_b(1 - X_c). Φ e ( X a , X b , X c ) = 1 − ( 1 − X a ) X b ( 1 − X c ) .
On Boolean inputs this polynomial is one when the clause is satisfied and zero otherwise. For a dummy clause e e e , put Φ e = 1 \Phi_e = 1 Φ e = 1 . Therefore
# F = ∑ x ∈ { 0 , 1 } n ∏ e ∈ F Φ e ( ( x v ) v ∈ I e ) . (4) \#F = \sum_{x \in\{0,1\}^n} \prod_{e \in\mathcal{F}} \Phi_e((x_v)_{v \in I_e}). \tag*{(4)} # F = x ∈ { 0 , 1 } n ∑ e ∈ F ∏ Φ e (( x v ) v ∈ I e ) . (4)
The product has total degree at most M ≤ 3 n M \le3n M ≤ 3 n . This linear degree bound is the useful consequence of the three-occurrence assumption.
Equation (4) is an exact expression for the count, but evaluating its 2 n 2^n 2 n summands would be exhaustive search. To motivate the algorithm, suppose we were given a partition of the variables into r r r groups S 1 , … , S r S_1,\ldots,S_r S 1 , … , S r satisfying both of the following conditions:
Each group contains at most 2 n / r 2n/r 2 n / r variables.
For every clause, all of its variables belong to a single group.
This is a hypothetical, very restrictive assumption; we do not assume that the input formula admits such a partition.
Under this assumption, we could count satisfying assignments in each group independently. Let N g N_g N g be the number of assignments to the variables in S g S_g S g that satisfy all clauses in that group. Any such assignment can be combined with any satisfying assignments in the other groups, because no clause connects different groups. Every global satisfying assignment arises in exactly one such way. Consequently,
# F = ∏ g = 1 r N g . \#F = \prod_{g=1}^{r} N_g. # F = g = 1 ∏ r N g .
Computing each N g N_g N g by exhaustive search within its group examines a total of at most
∑ g = 1 r 2 ∣ S g ∣ ≤ r 2 2 n / r \sum_{g=1}^{r} 2^{|S_g|} \le r2^{2n/r} g = 1 ∑ r 2 ∣ S g ∣ ≤ r 2 2 n / r
local assignments, with polynomial work per assignment. For large r r r , this is much faster than enumerating all 2 n 2^n 2 n global assignments.
We will replace the clause inputs so that different groups interact only through a small collection of shared linear summaries. Once the values of those summaries are fixed, we can again sum over each group separately.
A polynomial family with easier evaluation points
We introduce a parameter T T T . At T = 0 T = 0 T = 0 , the replacements must restore the original clause inputs. At selected nonzero points T = 1 , … , Q T = 1, \ldots, Q T = 1 , … , Q , they should let us separate the groups by fixing shared linear summaries. Here Q Q Q is the number of selected points, and R R R will bound the degree of the replacement coefficients. We choose both parameters later.
Write X ⃗ = ( X 1 , … , X n ) \vec{X} = (X_1, \ldots, X_n) X = ( X 1 , … , X n ) for the vector of formal variables. For each occurrence v ∈ I e v \in I_e v ∈ I e , use the polynomial coefficient vector P ⃗ e , v ( T ) = ( p e , v , 1 ( T ) , … , p e , v , n ( T ) ) \vec{P}_{e,v}(T) = (p_{e,v,1}(T), \ldots, p_{e,v,n}(T)) P e , v ( T ) = ( p e , v , 1 ( T ) , … , p e , v , n ( T )) to replace X v X_v X v in clause e e e by the scalar inner product
⟨ P ⃗ e , v ( T ) , X ⃗ ⟩ = ∑ i = 1 n p e , v , i ( T ) X i . \langle\vec{P}_{e,v}(T), \vec{X}\rangle= \sum_{i=1}^{n} p_{e,v,i}(T)X_i. ⟨ P e , v ( T ) , X ⟩ = i = 1 ∑ n p e , v , i ( T ) X i .
We call this expression the replacement linear form for the occurrence of variable v v v in clause e e e . It replaces the input X v X_v X v in the clause polynomial Φ e \Phi_e Φ e . We require
⟨ P ⃗ e , v ( 0 ) , X ⃗ ⟩ = X v , deg P ⃗ e , v ≤ R . \langle\vec{P}_{e,v}(0), \vec{X}\rangle= X_v,\qquad\deg\vec{P}_{e,v} \le R. ⟨ P e , v ( 0 ) , X ⟩ = X v , deg P e , v ≤ R .
Different clauses may use different replacement linear forms for the same variable. Define
H ( T ) = ∑ x ∈ { 0 , 1 } n ∏ e ∈ F Φ e ( ( ⟨ P ⃗ e , v ( T ) , x ⟩ ) v ∈ I e ) ∈ Q [ T ] . (5) H(T) = \sum_{x\in\{0,1\}^{n}} \prod_{e\in F} \Phi_e\left(\left(\left\langle\vec{P}_{e,v}(T),x\right\rangle\right)_{v\in I_e}\right) \in\mathbb{Q}[T]. \tag*{(5)} H ( T ) = x ∈ { 0 , 1 } n ∑ e ∈ F ∏ Φ e ( ( ⟨ P e , v ( T ) , x ⟩ ) v ∈ I e ) ∈ Q [ T ] . (5)
At zero every replacement restores the original variable, while the degree of each clause polynomial grows by at most a factor of R R R . Hence
H ( 0 ) = # F , deg H ≤ M R ≤ 3 n R . (6) H(0) = \#F,\qquad\deg H \le MR \le3nR. \tag*{(6)} H ( 0 ) = # F , deg H ≤ M R ≤ 3 n R . (6)
We will recover H ( 0 ) H(0) H ( 0 ) from Taylor coefficients at t = 1 , … , Q t = 1, \ldots, Q t = 1 , … , Q . The degree bound means that O ( 1 + n R / Q ) O(1 + nR/Q) O ( 1 + n R / Q ) coefficients per point suffice, as § 2.5 explains. Our goal is therefore to make R R R small relative to Q Q Q : many points with low-degree replacements require fewer coefficients at each point.
At a nonzero t t t , the value ⟨ P ⃗ e , v ( t ) , x ⟩ \langle\vec{P}_{e,v}(t),x\rangle ⟨ P e , v ( t ) , x ⟩ of a replacement linear form need not lie in { 0 , 1 } \{0,1\} { 0 , 1 } , even when x x x is Boolean. The transformed clause polynomials therefore need not act as satisfaction indicators.
Separating the sum by fixing measurements
Fix t ∈ [ Q ] t \in[Q] t ∈ [ Q ] . We are given the coefficient vectors P ⃗ e , v ( t ) \vec{P}_{e,v}(t) P e , v ( t ) , whose entries are now constants. We explain what structure lets us compute H ( t ) H(t) H ( t ) quickly, and how to use it. Throughout this subsection, write S g = S t , g S_g = S_{t,g} S g = S t , g and C g = C t , g C_g = C_{t,g} C g = C t , g .
Definition 2.1 (( r , τ , D ) (r,\tau,D) ( r , τ , D ) -design). For the given coefficient vectors P ⃗ e , v ( t ) \vec{P}_{e,v}(t) P e , v ( t ) , an ( r , τ , D ) (r,\tau,D) ( r , τ , D ) -design at t t t consists of groups S g S_g S g , clause assignments σ e ( t ) \sigma_e(t) σ e ( t ) , and measurement matrices C g C_g C g satisfying the following four conditions:
(1) Small groups. Partition the variables into disjoint groups [ n ] = S 1 ⊔ ⋯ ⊔ S r [n] = S_1 \sqcup\cdots\sqcup S_r [ n ] = S 1 ⊔ ⋯ ⊔ S r , with ∣ S g ∣ ≤ 2 n / r |S_g| \le2n/r ∣ S g ∣ ≤ 2 n / r .
(2) One assigned group per clause. Assign each clause e e e to one group σ e ( t ) ∈ [ r ] \sigma_e(t) \in[r] σ e ( t ) ∈ [ r ] . Condition 4 must hold with this same group for every replacement linear form of clause e e e .
(3) Few bounded measurements. Each group g g g has an integer matrix C g C_g C g with columns indexed by S g S_g S g and c g c_g c g rows. Each row specifies one linear measurement of the variables in S g S_g S g . There are at most 2 n 2n 2 n rows in total, and the sum of absolute values of the coefficients in each row is at most D D D . For an assignment x x x , write
x g = x ∣ S g , y g = C g x g , y ⃗ = ( y 1 , … , y r ) . x_g = x|_{S_g},\qquad y_g = C_gx_g,\qquad\vec{y} = (y_1,\ldots,y_r). x g = x ∣ S g , y g = C g x g , y = ( y 1 , … , y r ) . (4) Dependence on other groups only through measurements. Suppose clause e e e is assigned to group g = σ e ( t ) g = \sigma_e(t) g = σ e ( t ) . Each replacement linear form of this clause may depend freely on the variables in S g S_g S g . Its dependence on any other group S h S_h S h must be a linear combination of
that group’s measurements y h y_h y h . Precisely, for every v ∈ I e v \in I_e v ∈ I e , there must be coefficient vectors λ ⃗ e , v , h ∈ Q c h \vec{\lambda}_{e,v,h} \in\mathbb{Q}^{c_h} λ e , v , h ∈ Q c h , for h ≠ g h \ne g h = g , such that, for every x ∈ Q n x \in\mathbb{Q}^n x ∈ Q n ,
⟨ P ⃗ e , v ( t ) , x ⟩ = ⟨ P ⃗ e , v ( t ) ∣ S g , x g ⟩ + ∑ h ≠ g ⟨ λ ⃗ e , v , h , y h ⟩ . (7) \langle\vec{P}_{e,v}(t),x\rangle= \langle\vec{P}_{e,v}(t)|_{S_g},x_g\rangle+ \sum_{h\ne g}\langle\vec{\lambda}_{e,v,h},y_h\rangle. \tag*{(7)} ⟨ P e , v ( t ) , x ⟩ = ⟨ P e , v ( t ) ∣ S g , x g ⟩ + h = g ∑ ⟨ λ e , v , h , y h ⟩ . (7)
Equivalently, P ⃗ e , v ( t ) ∣ S h \vec{P}_{e,v}(t)|_{S_h} P e , v ( t ) ∣ S h lies in the row space of C h C_h C h for every h ≠ g h \ne g h = g .
The matrices C h C_h C h are shared by all clauses. A clause’s assigned group need not contain its original variables. Once y ⃗ \vec{y} y is fixed, however, the entire transformed clause polynomial depends only on the variables in its assigned group.
The algorithm. Given an ( r , τ , D ) (r,\tau,D) ( r , τ , D ) -design at t t t , first find the coefficient vectors λ ⃗ e , v , h \vec{\lambda}_{e,v,h} λ e , v , h by solving the linear systems guaranteed by condition 4. For fixed y ⃗ \vec{y} y , let X t , g ( y g ) \mathcal{X}_{t,g}(y_g) X t , g ( y g ) be the assignments to the variables in S g S_g S g whose measurements equal y g y_g y g :
X t , g ( y g ) = { u ∈ { 0 , 1 } S g : C g u = y g } . \mathcal{X}_{t,g}(y_g)=\{u\in\{0,1\}^{S_g}:C_g u=y_g\}. X t , g ( y g ) = { u ∈ { 0 , 1 } S g : C g u = y g } .
For such an assignment u u u , compute the contribution of group g g g as follows. For each clause e e e assigned to g g g , first use (7) to compute the values of its replacement linear forms from u u u and the fixed measurements. Next evaluate the clause polynomial Φ e \Phi_e Φ e on these values. Finally, multiply the values obtained from all clauses assigned to g g g . Denote this product by A t , g ( u ; y ⃗ ) A_{t,g}(u;\vec{y}) A t , g ( u ; y ) . No assignments to the other groups are needed for this calculation.
Each measurement of a Boolean assignment is an integer in [ − D , D ] [-D,D] [ − D , D ] . Initialize Z = 0 Z=0 Z = 0 and perform the following steps:
Try every measurement tuple y ⃗ ∈ Y : = ∏ g = 1 r { − D , … , D } c g \vec{y}\in\mathcal{Y}:=\prod_{g=1}^{r}\{-D,\ldots,D\}^{c_g} y ∈ Y := ∏ g = 1 r { − D , … , D } c g . For each tuple, perform steps 2 and 3.
For each group g g g , try every Boolean assignment u u u to its variables. Keep it only if C g u = y g C_g u=y_g C g u = y g . Add the corresponding products A t , g ( u ; y ⃗ ) A_{t,g}(u;\vec{y}) A t , g ( u ; y ) to obtain the group sum
B t , g ( y ⃗ ) = ∑ u ∈ X t , g ( y g ) A t , g ( u ; y ⃗ ) . B_{t,g}(\vec{y})=\sum_{u\in\mathcal{X}_{t,g}(y_g)}A_{t,g}(u;\vec{y}). B t , g ( y ) = u ∈ X t , g ( y g ) ∑ A t , g ( u ; y ) .
If no assignment satisfies C g u = y g C_g u=y_g C g u = y g , set B t , g ( y ⃗ ) = 0 B_{t,g}(\vec{y})=0 B t , g ( y ) = 0 .
Multiply the group sums and add the result ∏ g = 1 r B t , g ( y ⃗ ) \prod_{g=1}^{r}B_{t,g}(\vec{y}) ∏ g = 1 r B t , g ( y ) to Z Z Z .
After all measurement tuples have been processed, return Z Z Z .
To see why this returns H ( t ) H(t) H ( t ) , fix y ⃗ \vec{y} y and choose one assignment from each set X t , g ( y g ) \mathcal{X}_{t,g}(y_g) X t , g ( y g ) . Since the groups contain disjoint sets of variables, these choices combine into one full assignment. Every full assignment with measurements y ⃗ \vec{y} y arises in exactly one such way. Its product of clause polynomials is the product of the group contributions A t , g A_{t,g} A t , g . Multiplying out the group sums and then summing over y ⃗ \vec{y} y therefore gives
H ( t ) = ∑ y ⃗ ∈ Y ∏ g = 1 r ( ∑ u ∈ X t , g ( y g ) A t , g ( u ; y ⃗ ) ) . (8) H(t)=\sum_{\vec{y}\in\mathcal{Y}}\prod_{g=1}^{r}\left(\sum_{u\in\mathcal{X}_{t,g}(y_g)}A_{t,g}(u;\vec{y})\right). \tag*{(8)} H ( t ) = y ∈ Y ∑ g = 1 ∏ r u ∈ X t , g ( y g ) ∑ A t , g ( u ; y ) . (8)
Every Boolean assignment has exactly one measurement tuple, so this sum counts each assignment’s contribution exactly once.
There are at most ( 2 D + 1 ) 2 τ n (2D+1)^{2\tau n} ( 2 D + 1 ) 2 τ n measurement tuples. For each tuple, the algorithm tries at most ∑ g 2 ∣ S g ∣ ≤ r 2 n / r \sum_g 2^{|S_g|}\le r2^{n/r} ∑ g 2 ∣ S g ∣ ≤ r 2 n / r assignments to individual groups. Consequently, the running time is
( 2 D + 1 ) 2 τ n 2 2 n / r (2D+1)^{2\tau n}2^{2n/r} ( 2 D + 1 ) 2 τ n 2 2 n / r
up to polynomial factors. The first factor bounds the number of measurement tuples; the second bounds the number of assignments within one group. The algorithm scans one group at a time and keeps only the current measurement tuple, the current assignment, and running sums and products; see Lemma 3.2 .
For the parameter choices in § 2.6 , we can construct replacement forms of degree at most R R R that restore the original variables at zero and admit an ( r , τ , D ) (r,\tau,D) ( r , τ , D ) -design at every t ∈ [ Q ] t \in[Q] t ∈ [ Q ] . § 2.7 gives the construction. We first explain how these properties let us recover the count efficiently.
Recovering the count from Taylor coefficients
Our goal is to recover H ( 0 ) = # F H(0)=\# F H ( 0 ) = # F from information at the points t = 1 , … , Q t=1,\ldots,Q t = 1 , … , Q . Since deg H ≤ 3 n R \deg H \le3nR deg H ≤ 3 n R , the Q Q Q values H ( t ) H(t) H ( t ) alone may not determine H H H . We instead compute several Taylor coefficients at each point. Choose
q = ⌊ 3 n R Q ⌋ , J = q + 1. q=\left\lfloor\frac{3nR}{Q}\right\rfloor,\qquad J=q+1. q = ⌊ Q 3 n R ⌋ , J = q + 1.
Suppose we know the coefficients of z 0 , … , z q z^0,\ldots,z^q z 0 , … , z q in H ( t + z ) H(t+z) H ( t + z ) for every t ∈ [ Q ] t\in[Q] t ∈ [ Q ] . These data determine H H H uniquely: if two polynomials of degree at most 3 n R 3nR 3 n R have the same data, their difference is divisible by ( T − t ) J (T-t)^J ( T − t ) J for every t ∈ [ Q ] t\in[Q] t ∈ [ Q ] , hence by ∏ t = 1 Q ( T − t ) J \prod_{t=1}^{Q}(T-t)^J ∏ t = 1 Q ( T − t ) J . This product has degree Q J > 3 n R QJ>3nR Q J > 3 n R , so the difference must be zero. Each Taylor coefficient gives a linear equation in the coefficients of H H H . Solving this rational linear system recovers H H H , and its constant coefficient is the desired count H ( 0 ) H(0) H ( 0 ) .
It remains to compute these Taylor coefficients. Fix t ∈ [ Q ] t\in[Q] t ∈ [ Q ] ; we want H ( t + z ) H(t+z) H ( t + z ) through degree q q q in z z z . The design controls the replacement forms at t t t , but need not control their changes from t t t to t + z t+z t + z . We first give those changes a separate input, so that fixing this input preserves the separation of groups.
Keeping the shifted inputs separate. Write
Δ P ⃗ e , v ( z ) = P ⃗ e , v ( t + z ) − P ⃗ e , v ( t ) . \Delta\vec{P}_{e,v}(z)=\vec{P}_{e,v}(t+z)-\vec{P}_{e,v}(t). Δ P e , v ( z ) = P e , v ( t + z ) − P e , v ( t ) .
Keep x x x as the Boolean assignment being summed over, and introduce a separate formal vector X ⃗ \vec{X} X for the changes. Define
G x ( X ⃗ , z ) = ∏ e ∈ F Φ e ( ( ⟨ P ⃗ e , v ( t ) , x ⟩ + ⟨ Δ P ⃗ e , v ( z ) , X ⃗ ⟩ ) v ∈ I e ) . (9) G_x(\vec{X},z)=\prod_{e\in F}\Phi_e\left(\left(\langle\vec{P}_{e,v}(t),x\rangle+\langle\Delta\vec{P}_{e,v}(z),\vec{X}\rangle\right)_{v\in I_e}\right). \tag*{(9)} G x ( X , z ) = e ∈ F ∏ Φ e ( ( ⟨ P e , v ( t ) , x ⟩ + ⟨ Δ P e , v ( z ) , X ⟩ ) v ∈ I e ) . (9)
Here x x x indexes the polynomial, while X ⃗ \vec{X} X and z z z are its formal variables. Setting X ⃗ = x \vec{X}=x X = x restores each shifted input ⟨ P ⃗ e , v ( t + z ) , x ⟩ \langle\vec{P}_{e,v}(t+z),x\rangle ⟨ P e , v ( t + z ) , x ⟩ , so
H ( t + z ) = ∑ x ∈ { 0 , 1 } n G x ( x , z ) . H(t+z)=\sum_{x\in\{0,1\}^n}G_x(x,z). H ( t + z ) = x ∈ { 0 , 1 } n ∑ G x ( x , z ) .
On the other hand, fixing X ⃗ = 1 U \vec{X}=\mathbf{1}_U X = 1 U for some U ⊆ [ n ] U\subseteq[n] U ⊆ [ n ] makes every correction ⟨ Δ P ⃗ e , v ( z ) , 1 U ⟩ \langle\Delta\vec{P}_{e,v}(z),\mathbf{1}_U\rangle ⟨ Δ P e , v ( z ) , 1 U ⟩ independent of x x x . All dependence on x x x then remains through ⟨ P ⃗ e , v ( t ) , x ⟩ \langle\vec{P}_{e,v}(t),x\rangle ⟨ P e , v ( t ) , x ⟩ , where the design applies. Our task is therefore to recover the sum with X ⃗ = x \vec{X}=x X = x from sums with X ⃗ \vec{X} X fixed.
The degree bound makes this possible with few fixed substitutions. Every entry of Δ P ⃗ e , v ( z ) \Delta\vec{P}_{e,v}(z) Δ P e , v ( z ) is divisible by z z z , so each occurrence of an X i X_i X i in an expanded term contributes at least one factor of z z z . Thus
deg X ⃗ ( [ z j ] G x ( X ⃗ , z ) ) ≤ j . \deg_{\vec{X}}\left([z^j]G_x(\vec{X},z)\right)\le j. deg X ( [ z j ] G x ( X , z ) ) ≤ j .
Thus, after discarding powers of z z z above q q q , every monomial involves at most q q q distinct variables from X ⃗ \vec{X} X .
Recovering the shifted sum by inclusion–exclusion. Work modulo z J z^J z J , so that only the coefficients through z q z^q z q are retained. Replace every positive power of X i X_i X i in G x G_x G x by X i X_i X i . This preserves its values on Boolean inputs. The degree bound above gives, for Boolean X ⃗ \vec{X} X ,
G x ( X ⃗ , z ) ≡ ∑ E ⊆ [ n ] ∣ E ∣ ≤ q a E ( x , z ) ∏ i ∈ E X i ( m o d z J ) . G_x(\vec{X},z)\equiv\sum_{\substack{E\subseteq[n]\\ |E|\le q}}a_E(x,z)\prod_{i\in E}X_i\pmod{z^J}. G x ( X , z ) ≡ E ⊆ [ n ] ∣ E ∣ ≤ q ∑ a E ( x , z ) i ∈ E ∏ X i ( mod z J ) .
where a E ( x , z ) a_E(x,z) a E ( x , z ) is the coefficient of the indicated monomial after this replacement. Evaluating at 1 U 1_U 1 U , the vector with ones precisely in U U U , sums the coefficients indexed by subsets of U U U . Inclusion–exclusion extracts each one:
a E ( x , z ) ≡ ∑ U ⊆ E ( − 1 ) ∣ E ∣ − ∣ U ∣ G x ( 1 U , z ) ( m o d z J ) . a_E(x,z) \equiv\sum_{U\subseteq E}(-1)^{|E|-|U|}G_x(1_U,z) \pmod{z^J}. a E ( x , z ) ≡ U ⊆ E ∑ ( − 1 ) ∣ E ∣ − ∣ U ∣ G x ( 1 U , z ) ( mod z J ) .
When we set X ⃗ = x \vec{X}=x X = x , the monomial ∏ i ∈ E x i \prod_{i\in E}x_i ∏ i ∈ E x i equals one exactly when all the bits in E E E are one. Its contribution to the sum over x x x is therefore ∑ x : x i = 1 ( i ∈ E ) a E ( x , z ) \sum_{x:x_i=1\ (i\in E)}a_E(x,z) ∑ x : x i = 1 ( i ∈ E ) a E ( x , z ) , with x x x Boolean. Substituting the coefficient formula above reduces this to sums with the formal input fixed.
Computing the restricted sums. For U ⊆ E ⊆ [ n ] U\subseteq E\subseteq[n] U ⊆ E ⊆ [ n ] with ∣ E ∣ ≤ q |E|\le q ∣ E ∣ ≤ q , define
Z t , E , U ( z ) = ∑ x ∈ { 0 , 1 } n x i = 1 ( i ∈ E ) G x ( 1 U , z ) in Q [ z ] / ( z J ) . (10) \mathcal{Z}_{t,E,U}(z)=\sum_{\substack{x\in\{0,1\}^n\\x_i=1\ (i\in E)}}G_x(1_U,z)\quad\text{in }\mathbb{Q}[z]/(z^J). \tag*{(10)} Z t , E , U ( z ) = x ∈ { 0 , 1 } n x i = 1 ( i ∈ E ) ∑ G x ( 1 U , z ) in Q [ z ] / ( z J ) . (10)
Here U U U fixes the formal input X ⃗ = 1 U \vec{X}=1_U X = 1 U , while E E E fixes bits of the summation variable x x x to one. Summing the monomial contributions gives
H ( t + z ) ≡ ∑ E ⊆ [ n ] ∣ E ∣ ≤ q ∑ U ⊆ E ( − 1 ) ∣ E ∣ − ∣ U ∣ Z t , E , U ( z ) ( m o d z J ) . (11) H(t+z)\equiv\sum_{\substack{E\subseteq[n]\\|E|\le q}}\sum_{U\subseteq E}(-1)^{|E|-|U|}\mathcal{Z}_{t,E,U}(z)\pmod{z^J}. \tag*{(11)} H ( t + z ) ≡ E ⊆ [ n ] ∣ E ∣ ≤ q ∑ U ⊆ E ∑ ( − 1 ) ∣ E ∣ − ∣ U ∣ Z t , E , U ( z ) ( mod z J ) . (11)
This recovers all J = q + 1 J=q+1 J = q + 1 Taylor coefficients together. Lemma 3.3 states the general identity used here.
Each sum Z t , E , U \mathcal{Z}_{t,E,U} Z t , E , U can be evaluated by the algorithm of § 2.4 . With X ⃗ = 1 U \vec{X}=1_U X = 1 U fixed, each correction ⟨ Δ P ⃗ e , v ( z ) , 1 U ⟩ \langle\Delta\vec{P}_{e,v}(z),1_U\rangle ⟨ Δ P e , v ( z ) , 1 U ⟩ is independent of x x x . All dependence on x x x comes through the forms ⟨ P ⃗ e , v ( t ) , x ⟩ \langle\vec{P}_{e,v}(t),x\rangle ⟨ P e , v ( t ) , x ⟩ , so fixing y ⃗ \vec{y} y still separates the clause polynomials. The restrictions x i = 1 x_i=1 x i = 1 are local to each group. The separation identity uses only addition, multiplication, and distributivity, so it also applies to these truncated polynomial values. Each clause is evaluated after substituting X ⃗ = 1 U \vec{X}=1_U X = 1 U , using only univariate polynomials in z z z of degree less than J J J and discarding higher powers after each multiplication. The multivariate expansion and its coefficients a E ( x , z ) a_E(x,z) a E ( x , z ) are used only to justify the identity; the algorithm never constructs them.
Repeating this calculation at t = 1 , … , Q t=1,\ldots,Q t = 1 , … , Q provides all the Taylor coefficients needed for the interpolation above, and therefore recovers H ( 0 ) = # F H(0)=\#F H ( 0 ) = # F .
The three costs and the running time
Jumping ahead, § 2.7 will construct replacement forms that restore the original variables at zero, have degree at most R R R , and admit an ( r , τ , D ) (r,\tau,D) ( r , τ , D ) -design at every t ∈ [ Q ] t\in[Q] t ∈ [ Q ] . For sufficiently large n n n , the construction takes polynomial time and achieves the following parameter bounds:
r = Θ ( log n ( log log n ) 2 ) , Q = Θ ( log n log log n ) , r=\Theta\left(\frac{\sqrt{\log n}}{(\log\log n)^2}\right),\qquad Q=\Theta\left(\frac{\log n}{\log\log n}\right), r = Θ ( ( log log n ) 2 log n ) , Q = Θ ( log log n log n ) ,
R = Θ ( log n ) , τ = Θ ( 1 r log n ) , D = r 2 Q ≤ ( 2 n ) 1 / 128 . (12) R=\Theta(\sqrt{\log n}),\qquad\tau=\Theta\left(\frac{1}{r\log n}\right),\qquad D=r^{2Q}\le(2n)^{1/128}. \tag*{(12)} R = Θ ( log n ) , τ = Θ ( r log n 1 ) , D = r 2 Q ≤ ( 2 n ) 1/128 . (12)
We first show how these bounds give a fast counting algorithm; the next subsection will justify that they can all be achieved simultaneously.
Recall that q = J − 1 = ⌊ 3 n R / Q ⌋ q=J-1=\lfloor3nR/Q\rfloor q = J − 1 = ⌊ 3 n R / Q ⌋ . For each evaluation point t t t , § 2.5 computes one restricted sum for each pair U ⊆ E U\subseteq E U ⊆ E with ∣ E ∣ ≤ q |E|\le q ∣ E ∣ ≤ q . There are ( n j ) \binom{n}{j} ( j n ) choices of an E E E of size j j j , and then 2 j 2^j 2 j choices of U U U . Each restricted sum enumerates measurement tuples and assignments within individual groups.
Thus the three costs multiply to give, up to polynomial factors,
∑ j = 0 min ( q , n ) 2 j ( n j ) ⋅ ( 2 D + 1 ) 2 τ n ⋅ 2 2 n / r . (13) \sum_{j=0}^{\min(q,n)} 2^j \binom{n}{j} \cdot(2D+1)^{2\tau n} \cdot2^{2n/r}. \tag*{(13)} j = 0 ∑ m i n ( q , n ) 2 j ( j n ) ⋅ ( 2 D + 1 ) 2 τ n ⋅ 2 2 n / r . (13)
To bound the first cost, note that 1 ≤ q ≤ n / 2 1 \le q \le n/2 1 ≤ q ≤ n /2 for sufficiently large n n n , since R / Q → 0 R/Q \to0 R / Q → 0 . Using ( n j ) ≤ ( e n / j ) j \binom{n}{j} \le(en/j)^j ( j n ) ≤ ( e n / j ) j and the fact that ( 2 e n / j ) j (2en/j)^j ( 2 e n / j ) j increases for 1 ≤ j ≤ n 1 \le j \le n 1 ≤ j ≤ n , we obtain
∑ j = 0 q 2 j ( n j ) ≤ ( q + 1 ) ( 2 e n q ) q . \sum_{j=0}^{q} 2^j \binom{n}{j} \le(q+1)\left(\frac{2en}{q}\right)^q. j = 0 ∑ q 2 j ( j n ) ≤ ( q + 1 ) ( q 2 e n ) q .
Since q = Θ ( n R / Q ) q = \Theta(nR/Q) q = Θ ( n R / Q ) , the logarithm of this cost is O ( n ( R / Q ) log ( 2 Q / R ) ) O(n(R/Q)\log(2Q/R)) O ( n ( R / Q ) log ( 2 Q / R )) . Taking logarithms of all three costs in (13) therefore gives
O ( n [ R Q log 2 Q R + τ log ( 2 D + 1 ) + 1 r ] ) . O\left(n\left[\frac{R}{Q}\log\frac{2Q}{R}+\tau\log(2D+1)+\frac{1}{r}\right]\right). O ( n [ Q R log R 2 Q + τ log ( 2 D + 1 ) + r 1 ] ) .
Each term is small under (12) :
R Q log 2 Q R = O ( log log n log n ⋅ log log n ) , \frac{R}{Q}\log\frac{2Q}{R}
=O\left(\frac{\log\log n}{\sqrt{\log n}}\cdot\log\log n\right), Q R log R 2 Q = O ( log n log log n ⋅ log log n ) ,
τ log ( 2 D + 1 ) = O ( 1 r log n ⋅ log n ) = O ( 1 / r ) , \tau\log(2D+1)=O\left(\frac{1}{r\log n}\cdot\log n\right)=O(1/r), τ log ( 2 D + 1 ) = O ( r log n 1 ⋅ log n ) = O ( 1/ r ) ,
1 r = O ( ( log log n ) 2 log n ) . \frac{1}{r}=O\left(\frac{(\log\log n)^2}{\sqrt{\log n}}\right). r 1 = O ( log n ( log log n ) 2 ) .
Thus the bounded-occurrence instance can be counted in
n O ( 1 ) 2 O ( n ( log log n ) 2 / log n ) (14) n^{O(1)}2^{O\left(n(\log\log n)^2/\sqrt{\log n}\right)} \tag*{(14)} n O ( 1 ) 2 O ( n ( l o g l o g n ) 2 / l o g n ) (14)
bit operations and polynomial space. The finitely many smaller inputs are handled by exhaustive search.
The number of points Q Q Q , the number of groups r r r , and the truncation order J = O ( 1 + n R / Q ) J=O(1+nR/Q) J = O ( 1 + n R / Q ) are polynomial in n n n . Hence the loops over points and groups, arithmetic on polynomials of degree less than J J J , and the final interpolation add only polynomially many operations per iteration of the three enumerations above.
For the bit-complexity and space bounds, see Appendix § 8 .§ 4 .
Constructing the low-degree replacement linear forms
Consider one occurrence of X v X_v X v in a clause. At T = 0 T=0 T = 0 its replacement must equal X v X_v X v . At each t = 1 , … , Q t=1,\ldots,Q t = 1 , … , Q , the clause must be able to evaluate that same replacement using only its assigned group and a few shared measurements. Choosing a different linear form at each point and interpolating would generally cost degree Q Q Q . To keep Taylor recovery cheap, we need degree R R R much smaller than Q Q Q .
Suppose a term in the replacement uses a variable outside the clause’s assigned group only at t = 2 t=2 t = 2 . Multiplying the term by 1 − T / 2 1-T/2 1 − T /2 leaves it unchanged at zero and removes it at t = 2 t=2 t = 2 . At every other evaluation point the clause can read the variable from its own group. The same trick works for several such points: one factor per point, at a cost of one degree each. The challenge is therefore to write each input as a sum in which the shared measurements determine one part, and each remaining term uses a variable outside the assigned group at only a few points. We first construct such a decomposition on auxiliary coordinates that record the group choices, then substitute the variables of the formula.
Step 1: Set up the auxiliary coordinates.
At each evaluation point, an occurrence ( e , v ) (e,v) ( e , v ) has two group choices: the group containing variable v v v , and the group assigned to clause e e e . Across the Q Q Q points, these choices form a sequence of Q Q Q pairs. We therefore use the coordinate set
B = ( [ r ] × [ r ] ) Q , D = ∣ B ∣ = r 2 Q . \mathcal{B} = ([r] \times[r])^{Q}, \qquad D = |\mathcal{B}| = r^{2Q}. B = ([ r ] × [ r ] ) Q , D = ∣ B ∣ = r 2 Q .
Write an index as
u = ( ( a u ( 1 ) , d u ( 1 ) ) , … , ( a u ( Q ) , d u ( Q ) ) ) . u = \bigl((a_u(1),d_u(1)),\ldots,(a_u(Q),d_u(Q))\bigr). u = ( ( a u ( 1 ) , d u ( 1 )) , … , ( a u ( Q ) , d u ( Q )) ) .
We will construct one replacement row for every such index, so it will be available whatever group choices we later make for the formula.
Let ζ ⃗ = ( ζ w ) w ∈ B \vec{\zeta} = (\zeta_w)_{w\in\mathcal{B}} ζ = ( ζ w ) w ∈ B be formal placeholders for the original variables that we will insert in Step 4. At point t t t , coordinate ζ w \zeta_w ζ w belongs to group a w ( t ) a_w(t) a w ( t ) , whereas the replacement for ζ u \zeta_u ζ u is assigned to group d u ( t ) d_u(t) d u ( t ) . Thus the coordinates that this replacement may use freely are
S t , d u ( t ) , S t , g : = { w ∈ B : a w ( t ) = g } . S_{t,d_u(t)}, \qquad S_{t,g} := \{w \in\mathcal{B} : a_w(t) = g\}. S t , d u ( t ) , S t , g := { w ∈ B : a w ( t ) = g } .
In particular, ζ w \zeta_w ζ w belongs to the assigned group exactly when a w ( t ) = d u ( t ) a_w(t)=d_u(t) a w ( t ) = d u ( t ) . The sets S t , g S_{t,g} S t , g partition B \mathcal{B} B , with D / r D/r D / r coordinates in each group.
Our auxiliary goal is to construct coefficient rows P ⃗ u ( T ) ∈ Q [ T ] D \vec{P}_u(T) \in\mathbb{Q}[T]^D P u ( T ) ∈ Q [ T ] D and one matrix
C ∈ { 0 , 1 , − 1 } c × D , c ≤ D τ 3 r , C \in\{0,1,-1\}^{c\times D}, \qquad c \le\frac{D\tau}{3r}, C ∈ { 0 , 1 , − 1 } c × D , c ≤ 3 r D τ ,
such that
⟨ P ⃗ u ( 0 ) , ζ ⃗ ⟩ = ζ u , deg P ⃗ u ≤ R − 1 , \langle\vec{P}_u(0),\vec{\zeta}\rangle= \zeta_u, \qquad\deg\vec{P}_u \le R-1, ⟨ P u ( 0 ) , ζ ⟩ = ζ u , deg P u ≤ R − 1 ,
and, at every t ∈ [ Q ] t \in[Q] t ∈ [ Q ] , the replacement linear form ⟨ P ⃗ u ( t ) , ζ ⃗ ⟩ \langle\vec{P}_u(t),\vec{\zeta}\rangle ⟨ P u ( t ) , ζ ⟩ is a linear combination of the available data
ζ ⃗ ∣ S t , d u ( t ) and C ζ ⃗ . (15) \vec{\zeta}\big|_{S_{t,d_u(t)}} \quad\text{and}\quad C\vec{\zeta}. \tag*{(15)} ζ S t , d u ( t ) and C ζ . (15)
The same measurements C ζ ⃗ C\vec{\zeta} C ζ serve every row and every evaluation point. This is the auxiliary counterpart of the dependence condition in the design from § 2.4 .
Step 2: Construct the constant matrix.
We start from the identity
ζ u = ( ( I D − M 0 ) ζ ⃗ ) u + ∑ w ∈ B M 0 [ u , w ] ζ w . \zeta_u = \bigl((I_D-M_0)\vec{\zeta}\bigr)_u + \sum_{w\in\mathcal{B}} M_0[u,w]\zeta_w. ζ u = ( ( I D − M 0 ) ζ ) u + w ∈ B ∑ M 0 [ u , w ] ζ w .
We want the first term to be determined by C ζ ⃗ C\vec{\zeta} C ζ . In the sum, each nonzero coefficient should connect incompatible groups at only a few points, so that a low-degree polynomial can remove those dependencies. Define these points by
E u , w = { t ∈ [ Q ] : a w ( t ) ≠ d u ( t ) } . E_{u,w} = \{t \in[Q] : a_w(t) \ne d_u(t)\}. E u , w = { t ∈ [ Q ] : a w ( t ) = d u ( t )} .
The two requirements on M 0 ∈ Q D × D M_0 \in\mathbb{Q}^{D\times D} M 0 ∈ Q D × D are
M 0 ξ ⃗ = ξ ⃗ for every ξ ⃗ ∈ ker C , M_0\vec{\xi} = \vec{\xi}\quad\text{for every }\vec{\xi}\in\ker C, M 0 ξ = ξ for every ξ ∈ ker C ,
M 0 [ u , w ] ≠ 0 ⟹ ∣ E u , w ∣ ≤ R − 1. (16) M_0[u,w] \ne0 \quad\Longrightarrow\quad|E_{u,w}| \le R-1. \tag*{(16)} M 0 [ u , w ] = 0 ⟹ ∣ E u , w ∣ ≤ R − 1. (16)
The first says that I D − M 0 I_D-M_0 I D − M 0 vanishes on ker C \ker C ker C . Equivalently, each of its rows lies in the row space of C C C , so ( I D − M 0 ) ζ ⃗ (I_D-M_0)\vec{\zeta} ( I D − M 0 ) ζ is a linear function of the measurements C ζ ⃗ C\vec{\zeta} C ζ . The second will bound the degrees of the polynomials used in Step 3.
Restricting the support by keeping f f f low-degree. Let Π s \Pi_s Π s be the permutation matrix that swaps the two entries of pair s s s in every index, leaving all other pairs unchanged. These matrices commute and satisfy Π s 2 = I D \Pi_s^2=I_D Π s 2 = I D . Put
V 0 = ∏ s = 1 Q Π s , W 0 = 1 2 ∑ s = 1 Q ( I D − Π s ) , M 0 = V 0 f ( W 0 ) , V_0=\prod_{s=1}^{Q}\Pi_s,\qquad W_0=\frac{1}{2}\sum_{s=1}^{Q}(I_D-\Pi_s),\qquad M_0=V_0f(W_0), V 0 = s = 1 ∏ Q Π s , W 0 = 2 1 s = 1 ∑ Q ( I D − Π s ) , M 0 = V 0 f ( W 0 ) ,
where we will choose a polynomial f f f of degree at most R − 1 R-1 R − 1 . The complete swap V 0 V_0 V 0 already respects every group: its nonzero entry in row u u u is at the column w w w satisfying
( a w ( s ) , d w ( s ) ) = ( d u ( s ) , a u ( s ) ) for every s . (a_w(s),d_w(s))=(d_u(s),a_u(s))\quad\text{for every }s. ( a w ( s ) , d w ( s )) = ( d u ( s ) , a u ( s )) for every s .
In particular, E u , w E_{u,w} E u , w is empty.
Multiplying by f ( W 0 ) f(W_0) f ( W 0 ) can undo swaps, but the degree of f f f limits how many. Expanding f ( W 0 ) f(W_0) f ( W 0 ) gives products of at most R − 1 R-1 R − 1 swaps. Repeated swaps cancel because Π s 2 = I D \Pi_s^2=I_D Π s 2 = I D . Multiplying by V 0 V_0 V 0 therefore gives
M 0 = ∑ S ⊆ [ Q ] ∣ S ∣ ≤ R − 1 γ S ∏ s ∉ S Π s for some γ S ∈ Q . (17) M_0=\sum_{\substack{S\subseteq[Q]\\ |S|\leq R-1}}\gamma_S\prod_{s\notin S}\Pi_s\quad\text{for some }\gamma_S\in\mathbb{Q}. \tag*{(17)} M 0 = S ⊆ [ Q ] ∣ S ∣ ≤ R − 1 ∑ γ S s ∈ / S ∏ Π s for some γ S ∈ Q . (17)
The permutation in the summand indexed by S S S swaps every pair outside S S S . Its nonzero entries therefore satisfy a w ( s ) = d u ( s ) a_w(s)=d_u(s) a w ( s ) = d u ( s ) for every s ∉ S s\notin S s ∈ / S , so E u , w ⊆ S E_{u,w}\subseteq S E u , w ⊆ S . Every summand is zero whenever ∣ E u , w ∣ > R − 1 |E_{u,w}|>R-1 ∣ E u , w ∣ > R − 1 , and hence so is their sum. This proves the second condition in (16) for any polynomial f f f of degree at most $R-1.
Choosing f f f to fix most basis directions. We now choose f f f so that M 0 M_0 M 0 fixes most basis directions. First consider one position, with coordinates indexed by [ r ] × [ r ] [r]\times[r] [ r ] × [ r ] . Let e ⃗ a b \vec e_{ab} e ab be the vector that is one at ( a , b ) (a,b) ( a , b ) and zero elsewhere. Swapping the pair has the orthogonal eigenbasis
e ⃗ a a ( a ∈ [ r ] ) , e ⃗ a b + e ⃗ b a ( a < b ) , eigenvalue + 1 , \vec e_{aa}\quad(a\in[r]),\qquad\vec e_{ab}+\vec e_{ba}\quad(a<b),\qquad\text{eigenvalue }+1, e aa ( a ∈ [ r ]) , e ab + e ba ( a < b ) , eigenvalue + 1 ,
e ⃗ a b − e ⃗ b a ( a < b ) , eigenvalue − 1. \vec e_{ab}-\vec e_{ba}\quad(a<b),\qquad\text{eigenvalue }-1. e ab − e ba ( a < b ) , eigenvalue − 1.
There are r ( r + 1 ) / 2 r(r+1)/2 r ( r + 1 ) /2 vectors with eigenvalue + 1 +1 + 1 and r ( r − 1 ) / 2 r(r-1)/2 r ( r − 1 ) /2 with eigenvalue − 1 -1 − 1 . All entries are in { 0 , 1 , − 1 } \{0,1,-1\} { 0 , 1 , − 1 } .
For each position s ∈ [ Q ] s\in[Q] s ∈ [ Q ] , choose one such vector ψ ⃗ s \vec\psi_s ψ s , and define ψ ⃗ ∈ Q B \vec\psi\in\mathbb{Q}^{B} ψ ∈ Q B coordinatewise by
ψ u = ∏ s = 1 Q ψ s ( a u ( s ) , d u ( s ) ) . \psi_u=\prod_{s=1}^{Q}\psi_s(a_u(s),d_u(s)). ψ u = s = 1 ∏ Q ψ s ( a u ( s ) , d u ( s )) .
These D = ( r 2 ) Q D=(r^2)^Q D = ( r 2 ) Q choices give an orthogonal basis: inner products factor into the inner products at the Q Q Q positions. The swap Π s \Pi_s Π s acts on ψ ⃗ \vec\psi ψ by the eigenvalue of ψ ⃗ s \vec\psi_s ψ s . If exactly j j j of the choices have eigenvalue − 1 -1 − 1 , then
W 0 ψ ⃗ = j ψ ⃗ , V 0 ψ ⃗ = ( − 1 ) j ψ ⃗ , M 0 ψ ⃗ = ( − 1 ) j f ( j ) ψ ⃗ . W_0\vec\psi=j\vec\psi,\qquad V_0\vec\psi=(-1)^j\vec\psi,\qquad M_0\vec\psi=(-1)^jf(j)\vec\psi. W 0 ψ = j ψ , V 0 ψ = ( − 1 ) j ψ , M 0 ψ = ( − 1 ) j f ( j ) ψ .
Thus we make M 0 M_0 M 0 fix these vectors by setting f ( j ) = ( − 1 ) j f(j)=(-1)^j f ( j ) = ( − 1 ) j .
For a uniformly chosen basis vector, the number j j j has distribution
W ∼ Bin ( Q , p ) , p = r − 1 2 r , W\sim\operatorname{Bin}(Q,p),\qquad p=\frac{r-1}{2r}, W ∼ Bin ( Q , p ) , p = 2 r r − 1 ,
because at each position a fraction p p p of the r 2 r^2 r 2 choices have eigenvalue − 1 -1 − 1 . Most basis vectors therefore have j j j near Q p Qp Qp . Choose an interval I \mathcal I I of R R R consecutive integers near Q p Qp Qp , and interpolate f ( j ) = ( − 1 ) j f(j)=(-1)^j f ( j ) = ( − 1 ) j for j ∈ I j\in\mathcal I j ∈ I . This gives deg f ≤ R − 1 \deg f\leq R-1 deg f ≤ R − 1 and makes M 0 M_0 M 0 fix every basis vector with j ∈ I j\in\mathcal I j ∈ I . Step 5 specifies the endpoints and checks that the interval lies in { 0 , … , Q } \{0,\ldots,Q\} { 0 , … , Q } .
Measuring the exceptional directions. Use the transposes of the remaining basis vectors as the rows of C C C . Their entries are in { 0 , 1 , − 1 } \{0,1,-1\} { 0 , 1 , − 1 } , and by orthogonality, ker C \ker C ker C is spanned by the basis vectors fixed above. This proves the first condition in (16) .
We can now see how to choose R R R . The standard deviation of W W W is Q p ( 1 − p ) = Θ ( Q ) \sqrt{Qp(1-p)}=\Theta(\sqrt{Q}) Qp ( 1 − p ) = Θ ( Q ) . Taking R R R much larger than Q \sqrt{Q} Q puts most basis vectors inside the interval, so only a small fraction need to be measured. We can still take R R R much smaller than Q Q Q , so that Taylor recovery needs only 1 + ⌊ 3 n R / Q ⌋ = o ( n ) 1+\lfloor3nR/Q\rfloor=o(n) 1 + ⌊ 3 n R / Q ⌋ = o ( n ) coefficients per point. For the choices in Step 5, the binomial tail bound gives
c = D Pr [ W ∉ I ] ≤ 2 D exp ( − R 2 8 Q ) ≤ D τ 3 r , c=D\Pr[W\notin I]\le2D\exp\left(-\frac{R^2}{8Q}\right)\le\frac{D\tau}{3r}, c = D Pr [ W ∈ / I ] ≤ 2 D exp ( − 8 Q R 2 ) ≤ 3 r D τ ,
as required. Thus low degree gives restricted support, while interpolation makes the correction I D − M 0 I_D-M_0 I D − M 0 depend on only these few measurements.
Step 3: Define the auxiliary replacement rows.
We now turn the decomposition of ζ u \zeta_u ζ u from Step 2 into its replacement. Keep the term determined by measurements unchanged. For each M 0 [ u , w ] ≠ 0 M_0[u,w]\ne0 M 0 [ u , w ] = 0 , multiply its coefficient in the other term by
φ u , w ( T ) = ∏ s ∈ E u , w ( 1 − T / s ) . \varphi_{u,w}(T)=\prod_{s\in E_{u,w}}(1-T/s). φ u , w ( T ) = s ∈ E u , w ∏ ( 1 − T / s ) .
This polynomial equals one at zero and vanishes at every point where ζ w \zeta_w ζ w lies outside the assigned group. Define the coefficient row P ⃗ u ( T ) \vec{P}_u(T) P u ( T ) by the identity
⟨ P ⃗ u ( T ) , ζ ⃗ ⟩ = ( ( I D − M 0 ) ζ ⃗ ) u + ∑ w ∈ B M 0 [ u , w ] ≠ 0 M 0 [ u , w ] φ u , w ( T ) ζ w . (18) \langle\vec{P}_u(T),\vec{\zeta}\rangle=((I_D-M_0)\vec{\zeta})_u+\sum_{\substack{w\in B\\M_0[u,w]\ne0}}M_0[u,w]\varphi_{u,w}(T)\zeta_w. \tag*{(18)} ⟨ P u ( T ) , ζ ⟩ = (( I D − M 0 ) ζ ) u + w ∈ B M 0 [ u , w ] = 0 ∑ M 0 [ u , w ] φ u , w ( T ) ζ w . (18)
This directly gives all three required properties:
At T = 0 T=0 T = 0 , every multiplier is one, so the two terms sum to ζ u \zeta_u ζ u .
Each multiplier has degree ∣ E u , w ∣ ≤ R − 1 |E_{u,w}|\le R-1 ∣ E u , w ∣ ≤ R − 1 , so deg P ⃗ u ≤ R − 1 \deg\vec{P}_u\le R-1 deg P u ≤ R − 1 .
At T = t T=t T = t , the first term is a linear function of C ζ ⃗ C\vec{\zeta} C ζ . In the sum, a coefficient can survive only if a w ( t ) = d u ( t ) a_w(t)=d_u(t) a w ( t ) = d u ( t ) , so only coordinates in S t , d u ( t ) S_{t,d_u(t)} S t , d u ( t ) remain.
Thus the replacement uses exactly the kinds of data allowed in (15) .
Step 4: Substitute the original variables.
The auxiliary rows are now constructed. To use them for the formula, choose schedules
a v ∈ [ r ] Q ( v ∈ [ n ] ) , d e ∈ [ r ] Q ( e ∈ F ) . a_v\in[r]^Q\quad(v\in[n]),\qquad d_e\in[r]^Q\quad(e\in\mathcal{F}). a v ∈ [ r ] Q ( v ∈ [ n ]) , d e ∈ [ r ] Q ( e ∈ F ) .
At point t t t , put variable v v v in group a v ( t ) a_v(t) a v ( t ) and assign clause e e e to group d e ( t ) d_e(t) d e ( t ) :
S t , g = { v : a v ( t ) = g } , σ e ( t ) = d e ( t ) . S_{t,g}=\{v:a_v(t)=g\},\qquad\sigma_e(t)=d_e(t). S t , g = { v : a v ( t ) = g } , σ e ( t ) = d e ( t ) .
The occurrence ( e , v ) (e,v) ( e , v ) uses the auxiliary label
u ( e , v ) = ( ( a v ( s ) , d e ( s ) ) ) s ∈ [ Q ] ∈ B . u(e,v)=\bigl((a_v(s),d_e(s))\bigr)_{s\in[Q]}\in\mathcal{B}. u ( e , v ) = ( ( a v ( s ) , d e ( s )) ) s ∈ [ Q ] ∈ B .
Let h h h be the largest number of occurrences receiving any one label. We need both small variable groups and small h h h . For our three-occurrence, width-three formula, Lemma 4.5 chooses the schedules deterministically in polynomial time so that
∣ S t , g ∣ ≤ 2 n / r , h ≤ 2 M / D , |S_{t,g}|\le2n/r,\qquad h\le2M/D, ∣ S t , g ∣ ≤ 2 n / r , h ≤ 2 M / D ,
provided
12 D 2 ≤ M , 2 Q r 2 ≤ n . (19) 12D^2\le M,\qquad2Qr^2\le n. \tag*{(19)} 12 D 2 ≤ M , 2 Q r 2 ≤ n . (19)
The idea is to derandomize a random choice of schedules. If all a v a_v a v and d e d_e d e are chosen independently and uniformly from [ r ] Q [r]^Q [ r ] Q , each label has expected multiplicity M / D M/D M / D , and each group S t , g S_{t,g} S t , g has expected size n / r n/r n / r . Under the assumptions in (19) , the standard method of conditional expectations derandomizes this choice in polynomial time, ensuring that every label has multiplicity at most 2 M / D 2M/D 2 M / D and every group has size at most 2 n / r 2n/r 2 n / r . Step 5 verifies these assumptions for our parameter choices.
Different occurrences can receive the same label while requiring different original variables at that coordinate. Use h h h copies of B B B , placing occurrences with the same label in different copies. Let j ( e , v ) ∈ [ h ] j(e,v) \in[h] j ( e , v ) ∈ [ h ] denote the copy used by ( e , v ) (e,v) ( e , v ) ; put X v X_v X v at its coordinate u ( e , v ) u(e,v) u ( e , v ) and zero in unused positions. Write ζ ⃗ ( j ) ( X ⃗ ) \vec{\zeta}^{(j)}(\vec{X}) ζ ( j ) ( X ) for the resulting filled vector in copy j j j . Every entry is zero or an original variable. Repeated appearances of X v X_v X v use the same value, so these copies introduce no new Boolean variables.
Apply the auxiliary row to the copy containing the occurrence:
⟨ P ⃗ e , v ( T ) , X ⃗ ⟩ = ⟨ P ⃗ u ( e , v ) ( T ) , ζ ⃗ ( j ( e , v ) ) ( X ⃗ ) ⟩ . (20) \langle\vec{P}_{e,v}(T),\vec{X}\rangle=\langle\vec{P}_{u(e,v)}(T),\vec{\zeta}^{(j(e,v))}(\vec{X})\rangle. \tag*{(20)} ⟨ P e , v ( T ) , X ⟩ = ⟨ P u ( e , v ) ( T ) , ζ ( j ( e , v )) ( X )⟩ . (20)
At zero the right side reads the coordinate containing X v X_v X v , and substituting variables preserves the degree bound R − 1 R-1 R − 1 . At point t t t , its freely used coordinates contain only variables v ′ v' v ′ with a v ′ ( t ) = d e ( t ) a_{v'}(t)=d_e(t) a v ′ ( t ) = d e ( t ) . These are precisely the variables in the clause’s assigned group S t , d e ( t ) S_{t,d_e(t)} S t , d e ( t ) . All occurrences of clause e e e use this same assigned group.
The remaining dependence is through the h c hc h c linear measurements C ζ ⃗ ( j ) ( X ⃗ ) C\vec{\zeta}^{(j)}(\vec{X}) C ζ ( j ) ( X ) , over the h h h copies. These may involve several original groups. Fixing a total such as x 1 + x 2 x_1+x_2 x 1 + x 2 would still couple two groups containing x 1 x_1 x 1 and x 2 x_2 x 2 . We therefore split each measurement into its contributions from individual groups. For each measurement ℓ ( X ⃗ ) \ell(\vec{X}) ℓ ( X ) , write
ℓ ( X ⃗ ) = ∑ g = 1 r ℓ ∣ S t , g ( X ⃗ ∣ S t , g ) . \ell(\vec{X})=\sum_{g=1}^{r}\ell|_{S_{t,g}}(\vec{X}|_{S_{t,g}}). ℓ ( X ) = g = 1 ∑ r ℓ ∣ S t , g ( X ∣ S t , g ) .
and collect the coefficient rows of these restrictions into C t , g C_{t,g} C t , g . Every auxiliary measurement is now a sum of group measurements. For a clause assigned to group g g g , the part from S t , g S_{t,g} S t , g is a local linear form, and every other part is a linear combination of the corresponding group’s measurements. This is the condition in (7) .
There are r h c rhc r h c rows in total. Since h D ≤ 2 M ≤ 6 n hD\le2M\le6n h D ≤ 2 M ≤ 6 n ,
∑ g = 1 r c t , g = r h c ≤ r h D τ 3 r ≤ 2 τ n . \sum_{g=1}^{r}c_{t,g}=rhc\le rh\frac{D\tau}{3r}\le2\tau n. g = 1 ∑ r c t , g = r h c ≤ r h 3 r D τ ≤ 2 τ n .
Each row of C C C has D D D entries in { 0 , 1 , − 1 } \{0,1,-1\} { 0 , 1 , − 1 } . Substituting variables, combining repeated copies, and restricting to a group cannot increase the sum of absolute coefficients. Hence every row of C t , g C_{t,g} C t , g is integral with absolute coefficient sum at most D D D . Together with the group-size bound, this proves that the replacement forms admit an ( r , τ , D ) (r,\tau,D) ( r , τ , D ) -design at every point.
Step 5: Verify the promised parameter bounds.
The construction needs the two balancing inequalities (19) and the tail bound 2 e − R 2 / ( 8 Q ) ≤ τ / ( 3 r ) 2e^{-R^2/(8Q)}\le\tau/(3r) 2 e − R 2 / ( 8 Q ) ≤ τ / ( 3 r ) . We now choose parameters of the orders stated in (12) and verify these requirements.
Put λ = ⌈ log 2 n ⌉ \lambda=\lceil\log_2 n\rceil λ = ⌈ log 2 n ⌉ and ν = ⌈ log 2 λ ⌉ \nu=\lceil\log_2\lambda\rceil ν = ⌈ log 2 λ ⌉ , and choose
r = ⌈ λ ν 2 ⌉ , Q = ⌈ λ 128 ν ⌉ , R = 4 ⌈ λ ⌉ , τ = 1 r λ , D = r 2 Q . (21) \begin{aligned}
r&=\left\lceil\frac{\sqrt{\lambda}}{\nu^2}\right\rceil,\qquad Q=\left\lceil\frac{\lambda}{128\nu}\right\rceil,\qquad R=4\lceil\sqrt{\lambda}\rceil,\\
\tau&=\frac{1}{r\lambda},\qquad D=r^2Q. \tag*{(21)}
\end{aligned} r τ = ⌈ ν 2 λ ⌉ , Q = ⌈ 128 ν λ ⌉ , R = 4 ⌈ λ ⌉ , = r λ 1 , D = r 2 Q . (21)
These have the orders stated in (12) . For sufficiently large n n n , we have r ≥ 2 r\ge2 r ≥ 2 , R ≥ 32 R\ge32 R ≥ 32 , and 6 R ≤ Q 6R\le Q 6 R ≤ Q , since R / Q = O ( ν / λ ) → 0 R/Q=O(\nu/\sqrt{\lambda})\to0 R / Q = O ( ν / λ ) → 0 . We check the remaining requirements in turn:
A 0 = ⌈ Q p − R − 1 2 ⌉ , I = { A 0 , … , A 0 + R − 1 } . A_0=\left\lceil Qp-\frac{R-1}{2}\right\rceil,\qquad\mathcal{I}=\{A_0,\ldots,A_0+R-1\}. A 0 = ⌈ Qp − 2 R − 1 ⌉ , I = { A 0 , … , A 0 + R − 1 } .
Since Q / 4 ≤ Q p ≤ Q / 2 Q/4 \le Qp \le Q/2 Q /4 ≤ Qp ≤ Q /2 and 6 R ≤ Q 6R \le Q 6 R ≤ Q , this interval lies in { 0 , … , Q } \{0,\ldots,Q\} { 0 , … , Q } . Moreover, R ≥ 32 R \ge32 R ≥ 32 ensures that it contains every integer within R / 4 R/4 R /4 of Q p Qp Qp . The binomial tail bound therefore gives the estimate Pr [ W ∉ I ] ≤ 2 e − R 2 / ( 8 Q ) \Pr[W \notin I] \le2e^{-R^2/(8Q)} Pr [ W ∈ / I ] ≤ 2 e − R 2 / ( 8 Q ) used in Step 2.
log 2 D = 2 Q log 2 r ≤ λ / 128 , D ≤ ( 2 n ) 1 / 128 . \log_2 D = 2Q\log_2 r \le\lambda/128,\qquad D \le(2n)^{1/128}. log 2 D = 2 Q log 2 r ≤ λ /128 , D ≤ ( 2 n ) 1/128 .
For sufficiently large n n n , this gives
12 D 2 ≤ 12 ( 2 n ) 1 / 64 ≤ n ≤ M , 2 Q r 2 = O ( λ 2 ) ≤ n , 12D^2 \le12(2n)^{1/64} \le n \le M,\qquad2Qr^2 = O(\lambda^2) \le n, 12 D 2 ≤ 12 ( 2 n ) 1/64 ≤ n ≤ M , 2 Q r 2 = O ( λ 2 ) ≤ n ,
as required for Step 4.
2 e − R 2 / ( 8 Q ) ≤ 2 e − 256 ν ≤ 1 3 λ 2 ≤ 1 3 r 2 λ = τ 3 r . 2e^{-R^2/(8Q)} \le2e^{-256\nu} \le\frac{1}{3\lambda^2} \le\frac{1}{3r^2\lambda} = \frac{\tau}{3r}. 2 e − R 2 / ( 8 Q ) ≤ 2 e − 256 ν ≤ 3 λ 2 1 ≤ 3 r 2 λ 1 = 3 r τ .
Thus Step 2 supplies the auxiliary measurement bound used in Step 4.
Finally, all construction dimensions are polynomially bounded in n n n . Lemma 4.6 gives polynomial construction time for the matrices and rows in Steps 2–3, and Lemma 4.5 does so for the schedules in Step 4. The transfer uses only h D ≤ 6 n hD \le6n h D ≤ 6 n coordinate positions. We have therefore constructed, in polynomial time, replacement forms that restore every original input at zero, have degree at most R − 1 ≤ R R-1 \le R R − 1 ≤ R , and admit the promised ( r , τ , D ) (r,\tau,D) ( r , τ , D ) -designs at every t ∈ [ Q ] t \in[Q] t ∈ [ Q ] . This supplies the bounds used in § 2.6 ; Lemma 4.8 records the parameter check for the more general setting of the full proof.
A weaker algorithm for general #k-SAT
The algorithm above already gives a subexponential algorithm for general #k k k -SAT: after disjoint sparsification, we reduce each instance directly to a 3-CNF in which every variable occurs at most three times. Both steps preserve the count, as follows.
Fix k ≥ 2 k \ge2 k ≥ 2 . We use the counting-preserving version [28 Appendix A] of sparsification [39 ] , with quantitative bounds from [19 Section 6] and [18 Lemma 5.14 and equation (5.4)] . As recorded in Lemma 6.3, this expresses the input count as the sum of the counts of at most poly k ( n , σ − 1 ) 2 σ n \operatorname{poly}_k(n,\sigma^{-1})2^{\sigma n} poly k ( n , σ − 1 ) 2 σ n formulas G G G . Each G G G has the same n n n declared variables, with at most
B = O k ( ( σ − 1 log ( 2 / σ ) ) k − 1 ) B = O_k\left((\sigma^{-1}\log(2/\sigma))^{k-1}\right) B = O k ( ( σ − 1 log ( 2/ σ ) ) k − 1 )
occurrences per variable, and hence at most B n Bn B n nonempty clauses. An empty clause gives count zero immediately.
First turn G G G into a 3-CNF without changing its count. Keep clauses of size at most three. For each longer clause, compute its disjunction with binary OR gates and require the final output to be one. For a gate z = u ∨ v z=u\lor v z = u ∨ v , impose
( ¬ u ∨ z ) ∧ ( ¬ v ∨ z ) ∧ ( u ∨ v ∨ ¬ z ) . (\neg u \lor z) \land(\neg v \lor z) \land(u \lor v \lor\neg z). ( ¬ u ∨ z ) ∧ ( ¬ v ∨ z ) ∧ ( u ∨ v ∨ ¬ z ) .
Here u , v u,v u , v are input literals or earlier gate outputs, and z z z is fresh. These clauses enforce equality with the OR, so the gate values are uniquely determined by the original assignment. Consequently, a satisfying assignment of G G G has exactly one extension to the new formula, and an assignment not satisfying G G G has none. This uses O ( k ) O(k) O ( k ) gates per clause.
Next reduce the occurrences. If a variable x x x occurs s ≥ 2 s \ge2 s ≥ 2 times in this 3-CNF, replace its occurrences by distinct copies x 1 , … , x s x_1,\ldots,x_s x 1 , … , x s , preserving their signs, and add Tovey’s implication cycle [64 p. 86] :
( ¬ x 1 ∨ x 2 ) ∧ ⋯ ∧ ( ¬ x s − 1 ∨ x s ) ∧ ( ¬ x s ∨ x 1 ) . (\neg x_1 \lor x_2) \land\cdots\land(\neg x_{s-1} \lor x_s) \land(\neg x_s \lor x_1). ( ¬ x 1 ∨ x 2 ) ∧ ⋯ ∧ ( ¬ x s − 1 ∨ x s ) ∧ ( ¬ x s ∨ x 1 ) .
The cycle forces all copies to agree. Each copy appears in one clause inherited from the 3-CNF and two cycle clauses, hence in exactly three clauses. Variables with at most one occurrence are kept unchanged, including unused declared variables. This standard variable-copy reduction [Gol08, Proposition 4.7] therefore also gives a bijection between satisfying assignments. The final formula G ^ \widehat{G} G has # G ^ = # G \#\widehat{G}=\#G # G = # G and
n ≤ N : = # { variables of G ^ } = O k ( B n ) . n \le N := \#\{\text{variables of }\widehat{G}\}=O_k(Bn). n ≤ N := # { variables of G } = O k ( B n ) .
All its clauses have size at most three, including the two-literal cycle clauses, and every variable occurs at most three times. Thus it is exactly an instance of the setting of this overview.
Apply (14) to each G ^ \widehat{G} G and add the counts. When σ − 1 \sigma^{-1} σ − 1 is bounded by a fixed power of log n \log n log n , so is B B B , and the resulting time is
( n + m ) O k ( 1 ) 2 O k ( σ n + B n ( log log n ) 2 / log n ) . (n+m)^{O_k(1)}2^{O_k(\sigma n+Bn(\log\log n)^2/\sqrt{\log n})}. ( n + m ) O k ( 1 ) 2 O k ( σ n + B n ( l o g l o g n ) 2 / l o g n ) .
For example, choosing σ \sigma σ within a constant factor of ( log n ) − 1 / ( 2 k ) (\log n)^{-1/(2k)} ( log n ) − 1/ ( 2 k ) yields
( n + m ) O k ( 1 ) 2 O k ( n ( log log n ) k + 1 / ( log n ) 1 / ( 2 k ) ) = ( n + m ) O k ( 1 ) 2 o ( n ) (n+m)^{O_k(1)}2^{O_k(n(\log\log n)^{k+1}/(\log n)^{1/(2k)})}=(n+m)^{O_k(1)}2^{o(n)} ( n + m ) O k ( 1 ) 2 O k ( n ( l o g l o g n ) k + 1 / ( l o g n ) 1/ ( 2 k ) ) = ( n + m ) O k ( 1 ) 2 o ( n )
with polynomial space, processing the sparsification tree and the reduced instances one at a time. The parameter σ \sigma σ may be chosen rational.
A faster algorithm for # k \#k # k -SAT via counting solutions to sparse low-degree polynomial equations over F 2 \mathbb{F}_2 F 2
The running-time exponent in § 2.8 is O k ( σ n + B ρ ( n ) ) O_k(\sigma n+B\rho(n)) O k ( σ n + B ρ ( n )) , where
ρ ( n ) = n ( log log n ) 2 log n . \rho(n)=\frac{n(\log\log n)^2}{\sqrt{\log n}}. ρ ( n ) = log n n ( log log n ) 2 .
If sparsification gave B = O k ( 1 ) B=O_k(1) B = O k ( 1 ) at σ = Θ ( ρ ( n ) / n ) \sigma=\Theta(\rho(n)/n) σ = Θ ( ρ ( n ) / n ) , we would already have a 2 O k ( ρ ( n ) ) 2^{O_k(\rho(n))} 2 O k ( ρ ( n )) -time algorithm for general # k \#k # k -SAT up to polynomial factors: copying would use only O k ( n ) O_k(n) O k ( n ) variables per leaf, and the number of leaves would fit within the same bound. At this choice of σ \sigma σ , however, the guarantee is only B = ( log n ) O k ( 1 ) B=(\log n)^{O_k(1)} B = ( log n ) O k ( 1 ) .
We obtain the 2 O k ( ρ ( n ) ) 2^{O_k(\rho(n))} 2 O k ( ρ ( n )) bound in two steps. First, the counting algorithm of this overview extends to systems of O ( n ) O(n) O ( n ) polynomial equations over F 2 \mathbb{F}_2 F 2 , each of degree at most k k k with polylogarithmically many monomials (Theorem 2.2 ). Second, even if a leaf G G G has B n Bn B n clauses, we can construct such a system on the original n n n variables whose common zeros are exactly the satisfying assignments of G G G . We illustrate the reduction first with a self-contained randomized construction, then explain the counting algorithm.
A randomized reduction to sparse polynomial equations. Write v e ( x ) = 1 v_e(x)=1 v e ( x ) = 1 if x x x violates clause e e e , and 0 0 0 otherwise. A parity test on a set S S S of clauses is the polynomial equation ∑ e ∈ S v e ( x ) = 0 \sum_{e\in S}v_e(x)=0 ∑ e ∈ S v e ( x ) = 0 over F 2 \mathbb{F}_2 F 2 : it accepts if x x x violates an even number of clauses in S S S . Every satisfying assignment passes, so we need only catch every nonsatisfying one. If G G G has m G ≤ n m_G\le n m G ≤ n clauses, one test per clause suffices. Suppose m G > n m_G>n m G > n .
A short test can easily miss a single violated clause, but all assignments that violate only that clause give identical answers. Thus there are only m G m_G m G singleton patterns to catch. Use 8 n 8n 8 n independent tests. For each, draw L = 2 B ⌈ log 2 ( 2 m G ) ⌉ L=2B\lceil\log_2(2m_G)\rceil L = 2 B ⌈ log 2 ( 2 m G )⌉ clauses uniformly with replacement. For each draw, independently add its violation bit to the parity sum with probability 1 / 2 1/2 1/2 ; two included copies cancel. Since m G ≤ B n m_G\le Bn m G ≤ B n , each clause is drawn at least logarithmically often in expectation overall. For a fixed set of w ≥ 1 w\ge1 w ≥ 1 violated clauses, let u = L w / m G u=Lw/m_G u = L w / m G be the expected number of hits per test. If the sample hits the set, the coin on the first hit makes the parity odd with probability 1 / 2 1/2 1/2 , even with all other coins fixed. Thus the rejection probability is
p w = 1 2 ( 1 − ( 1 − w m G ) L ) ≥ 1 2 ( 1 − e − u ) . p_w=\frac{1}{2}\left(1-\left(1-\frac{w}{m_G}\right)^L\right)\ge\frac{1}{2}(1-e^{-u}). p w = 2 1 ( 1 − ( 1 − m G w ) L ) ≥ 2 1 ( 1 − e − u ) .
We count sets for few violations and assignments for many:
If u ≤ 1 u\le1 u ≤ 1 , then p w ≥ u / 4 p_w\ge u/4 p w ≥ u /4 . There are at most m G w m_G^w m G w sets of size w w w , so the chance that at least one escapes all tests is at most m G w e − 8 n p w ≤ m G w e − 2 n L w / m G ≤ 16 − w m_G^w e^{-8np_w}\le m_G^w e^{-2nLw/m_G}\le16^{-w} m G w e − 8 n p w ≤ m G w e − 2 n L w / m G ≤ 1 6 − w . Summing over w ≥ 1 w\ge1 w ≥ 1 gives failure probability at most 1 / 15 1/15 1/15 .
If u > 1 u>1 u > 1 , then p w > 1 / 4 p_w>1/4 p w > 1/4 . A union bound over the 2 n 2^n 2 n assignments bounds the chance that any assignment in this case escapes by 2 n ( 3 / 4 ) 8 n < 1 / 4 2^n(3/4)^{8n}<1/4 2 n ( 3/4 ) 8 n < 1/4 .
Thus with probability greater than 2 / 3 2/3 2/3 , the common zeros are exactly the satisfying assignments of G G G . Each v e v_e v e is a product of at most k k k factors of the form x j x_j x j or 1 + x j 1+x_j 1 + x j , so each test has degree at most k k k and at most 2 k L 2^kL 2 k L monomials, polylogarithmic in n n n . § 6 constructs short tests with the same solution set deterministically. We first use parity checks from an expander code to ensure that any nonsatisfying assignment still passing must violate many clauses. A random short test then catches each such assignment with probability at least 1 / 4 1/4 1/4 . For each candidate test, we count the assignments that pass both that test and all tests chosen so far. We append a candidate that minimizes this count: every satisfying assignment passes every candidate, so this eliminates at least a quarter of the remaining nonsatisfying assignments.
Counting the common zeros. Recall from § 2.2 that Φ e ( x ) \Phi_e(x) Φ e ( x ) is 1 if x x x satisfies clause e e e and 0 otherwise. What should replace this factor when we test a whole set S i S_i S i of clauses at once? First count how many clauses in this test are violated, using ordinary integer addition:
L i ( x ) = ∑ e ∈ S i v e ( x ) = ∑ e ∈ S i ( 1 − Φ e ( x ) ) . L_i(x)=\sum_{e\in S_i}v_e(x)=\sum_{e\in S_i}(1-\Phi_e(x)). L i ( x ) = e ∈ S i ∑ v e ( x ) = e ∈ S i ∑ ( 1 − Φ e ( x )) .
The test passes exactly when L i ( x ) L_i(x) L i ( x ) is even. Choose ℓ = n + 1 \ell=n+1 ℓ = n + 1 , so that a count of at most 2 n 2^n 2 n is determined by its residue modulo 2 ℓ 2^\ell 2 ℓ . The complemented Beigel–Tarui polynomial p ℓ p_\ell p ℓ (Lemma 5.1) is 1 modulo 2 ℓ 2^\ell 2 ℓ on even integers and 0 on odd integers. For example, violating two clauses in S i S_i S i still passes the test: p ℓ ( 2 ) ≡ 1 ( m o d 2 ℓ ) p_\ell(2)\equiv1\pmod{2^\ell} p ℓ ( 2 ) ≡ 1 ( mod 2 ℓ ) . Writing m t e s t m_{\mathrm{test}} m test for the number of tests, our counting expression becomes
∑ x ∏ e ∈ G Φ e ( x ) ⟶ ∑ x ∏ i = 1 m t e s t p ℓ ( L i ( x ) ) . \sum_{x}\prod_{e\in G}\Phi_e(x)\longrightarrow\sum_x\prod_{i=1}^{m_{\mathrm{test}}}p_\ell(L_i(x)). x ∑ e ∈ G ∏ Φ e ( x ) ⟶ x ∑ i = 1 ∏ m test p ℓ ( L i ( x )) .
The left side is # G \#G # G . The least nonnegative residue of the right side modulo 2 ℓ 2^\ell 2 ℓ is the number of assignments passing every test. When the tests catch every nonsatisfying assignment, this is exactly # G \#G # G . The same encoding works for any sparse polynomial equation P i ( x ) = 0 P_i(x)=0 P i ( x ) = 0 over F 2 \mathbb{F}_2 F 2 : take L i ( x ) L_i(x) L i ( x ) to be the integer sum of its listed monomials. Again the equation holds exactly when this sum is even.
To reuse the Taylor step, we need a product of input degree O ( n ) O(n) O ( n ) . Multiplying the m t e s t m_{\mathrm{test}} m test test factors directly gives only the bound O ( k m t e s t ℓ ) O(km_{\mathrm{test}}\ell) O ( k m test ℓ ) , potentially quadratic in n n n . The key is to truncate the product across all tests together . § 5.1 writes p ℓ ( y ) p_\ell(y) p ℓ ( y ) as a sum of terms e j ( y ) h ( y ) j e_j(y)h(y)^j e j ( y ) h ( y ) j , where e j e_j e j has degree at most one and h ( y ) = y ( y − 1 ) h(y)=y(y-1) h ( y ) = y ( y − 1 ) is even at every integer. A product term containing ℓ \ell ℓ or more copies of h h h is therefore zero modulo 2 ℓ 2^\ell 2 ℓ on Boolean assignments, even if those copies come from different tests. We keep just the terms with fewer than ℓ \ell ℓ copies in total, tracking that number as we multiply. Each retained term has at most m t e s t m_{\mathrm{test}} m test linear factors and ℓ − 1 \ell-1 ℓ − 1 quadratic factors in the L i L_i L i 's. Since deg L i ≤ k \deg L_i\leq k deg L i ≤ k , its input degree is at most k ( m t e s t + 2 ( ℓ − 1 ) ) = O ( n ) k(m_{\mathrm{test}}+2(\ell-1))=O(n) k ( m test + 2 ( ℓ − 1 )) = O ( n ) .
For the replacement forms, what matters is which variables each factor reads. Where § 2.3 used one form for each variable in a clause, we now use one for each variable in a test, reusing it throughout that test. Each sparse equation reads only polylogarithmically many variables. Branching on the values of O ( n / log n ) O(n/\sqrt{\log n}) O ( n / log n ) most frequent variables leaves each remaining variable in only polylogarithmically many tests, as required by § 4 . On each branch, fixing the shared measurements again lets us sum one group at a time. Because the truncated product has input degree O ( n ) O(n) O ( n ) , the degree-R R R replacements give deg T H = O ( n R ) \deg_T H=O(nR) deg T H = O ( n R ) : the same O ( 1 + n R / Q ) O(1+nR/Q) O ( 1 + n R / Q ) Taylor coefficients per point recover the contributions at T = 0 T=0 T = 0 with 0 , 1 , … , ℓ − 1 0,1,\ldots,\ell-1 0 , 1 , … , ℓ − 1 copies of h h h . Their sum modulo 2 ℓ 2^\ell 2 ℓ , taken as the least nonnegative residue, is the exact branch count. Adding the branch counts gives the number of common zeros.
Theorem 2.2 (Counting common zeros of sparse polynomials). Fix integers k ≥ 2 k\geq2 k ≥ 2 and c ≥ 1 c\geq1 c ≥ 1 . Let P 1 , … , P m t e s t P_1,\ldots,P_{m_{\mathrm{test}}} P 1 , … , P m test be polynomials over F 2 \mathbb{F}_2 F 2 in n ≥ 20 n\geq20 n ≥ 20 Boolean variables, with m t e s t ≤ c n m_{\mathrm{test}}\leq cn m test ≤ c n . Each P i P_i P i is given
as a list of at most ( log n ) c (\log n)^c ( log n ) c monomials of degree at most k k k . The exact number of common zeros in { 0 , 1 } n \{0,1\}^n { 0 , 1 } n can be computed deterministically in 2 O k , c ( n ( log log n ) 2 / log n ) 2^{O_{k,c}(n(\log\log n)^2/\sqrt{\log n})} 2 O k , c ( n ( l o g l o g n ) 2 / l o g n ) bit operations and n O k , c ( 1 ) n^{O_{k,c}(1)} n O k , c ( 1 ) space.
Sections 3 and 4 supply the counting routine and the replacement forms; Section 5 uses them to prove the theorem directly for polynomial equations.
For the final system constructed for G G G , the number of common zeros is # G \#G # G . Section 6 uses only 2 ( log n ) O k ( 1 ) 2^{(\log n)^{O_k(1)}} 2 ( l o g n ) O k ( 1 ) calls to the counter per leaf, which preserves the running-time exponent in Theorem 2.2. Finally, choosing σ \sigma σ of order ( log log n ) 2 / log n (\log\log n)^2/\sqrt{\log n} ( log log n ) 2 / log n in Section 6.4 keeps B B B polylogarithmic and the number of leaves within 2 O k ( n ( log log n ) 2 / log n ) 2^{O_k(n(\log\log n)^2/\sqrt{\log n})} 2 O k ( n ( l o g l o g n ) 2 / l o g n ) . Their satisfying assignments are disjoint, so adding their counts gives the bound in Proposition 6.4.
A fast counting algorithm via shared linear summaries
Sections 3–5 prove Theorem 2.2. We begin with the sum from Section 2.2: for each Boolean assignment, multiply the factors, then add the products over all assignments. Here the factors can be any rational polynomials. We show how to compute the sum when the replacement forms and measurements are given. Section 4 constructs them using only the variables read by each factor. Section 5 supplies one factor per sparse polynomial equation.
Polynomial factors and the value to recover
Let F \mathcal{F} F index the factors, and let I f ⊆ [ n ] I_f \subseteq[n] I f ⊆ [ n ] be the variables read by Φ f \Phi_f Φ f . With rational coefficients our target is
Z = ∑ x ∈ { 0 , 1 } n ∏ f ∈ F Φ f ( ( x v ) v ∈ I f ) . (22) Z = \sum_{x\in\{0,1\}^n}\prod_{f\in\mathcal{F}}\Phi_f((x_v)_{v\in I_f}). \tag*{(22)} Z = x ∈ { 0 , 1 } n ∑ f ∈ F ∏ Φ f (( x v ) v ∈ I f ) . (22)
For clause satisfaction indicators, Z Z Z is the number of satisfying assignments. The proof also works with coefficients in any commutative Q \mathbb{Q} Q -algebra A \mathcal{A} A : sums and products then take place in A \mathcal{A} A , and interpolation uses only rational scalars. Readers may take A = Q \mathcal{A}=\mathbb{Q} A = Q throughout this section.
Different factors may use different replacements for the same variable. Give each incidence ( f , v ) (f,v) ( f , v ) its own indeterminate Y f , v Y_{f,v} Y f , v and suppose
deg { Y f , v } ( ∏ f ∈ F Φ f ( ( Y f , v ) v ∈ I f ) ) ≤ d . (23) \deg_{\{Y_{f,v}\}}\left(\prod_{f\in\mathcal{F}}\Phi_f((Y_{f,v})_{v\in I_f})\right)\le d. \tag*{(23)} deg { Y f , v } f ∈ F ∏ Φ f (( Y f , v ) v ∈ I f ) ≤ d . (23)
This is the degree of the whole product computed over A \mathcal{A} A . Choose replacement rows P ⃗ f , v ( T ) \vec{P}_{f,v}(T) P f , v ( T ) of degree at most R R R with P ⃗ f , v ( 0 ) = δ v \vec{P}_{f,v}(0)=\delta_v P f , v ( 0 ) = δ v , and form
H ( T ) = ∑ x ∈ { 0 , 1 } n ∏ f ∈ F Φ f ( ( ⟨ P ⃗ f , v ( T ) , x ⟩ ) v ∈ I f ) ∈ A [ T ] . (24) H(T)=\sum_{x\in\{0,1\}^n}\prod_{f\in\mathcal{F}}\Phi_f((\langle\vec{P}_{f,v}(T),x\rangle)_{v\in I_f})\in\mathcal{A}[T]. \tag*{(24)} H ( T ) = x ∈ { 0 , 1 } n ∑ f ∈ F ∏ Φ f ((⟨ P f , v ( T ) , x ⟩ ) v ∈ I f ) ∈ A [ T ] . (24)
The replacements restore the inputs at zero and multiply the degree by at most R R R . Thus H ( 0 ) = Z H(0)=Z H ( 0 ) = Z and deg T H ≤ d H : = d R \deg_T H\le d_H:=dR deg T H ≤ d H := d R . Our application will have d = O ( n ) d=O(n) d = O ( n ) , as in the bounded-occurrence example.
The required rows, partitions, and measurements
We use the same design as in Section 2.4, with a group assignment for each factor in place of each clause. The final condition below records the coefficient bound needed for exact arithmetic. Here ξ ~ \widetilde{\xi} ξ denotes extension by zero from a group to all n n n coordinates.
Definition 3.1. For the factor scopes ( I f ) f ∈ F (I_f)_{f\in\mathcal{F}} ( I f ) f ∈ F , let r ≥ 2 r\ge2 r ≥ 2 , D ≥ 1 D\ge1 D ≥ 1 , and 1 ≤ R < Q 1\le R<Q 1 ≤ R < Q be integers, and let 0 < τ ≤ 1 / 2 0<\tau\le1/2 0 < τ ≤ 1/2 . We require the following data and properties.
For each t ∈ [ Q ] t\in[Q] t ∈ [ Q ] , a partition [ n ] = S t , 1 ∪ ⋯ ∪ S t , r [n]=S_{t,1}\cup\cdots\cup S_{t,r} [ n ] = S t , 1 ∪ ⋯ ∪ S t , r , allowing empty parts, with ∣ S t , g ∣ ≤ 2 n / r |S_{t,g}|\le2n/r ∣ S t , g ∣ ≤ 2 n / r .
For every factor f ∈ F f\in\mathcal{F} f ∈ F , a sequence σ f ∈ [ r ] Q \sigma_f\in[r]^Q σ f ∈ [ r ] Q . The value σ f ( t ) \sigma_f(t) σ f ( t ) assigns factor f f f to a group at point t t t .
(3) For every t ∈ [ Q ] t \in[Q] t ∈ [ Q ] and g ∈ [ r ] g \in[r] g ∈ [ r ] , an integer matrix C t , g ∈ Z [ c t , g ] × S t , g C_{t,g} \in\mathbb{Z}^{[c_{t,g}] \times S_{t,g}} C t , g ∈ Z [ c t , g ] × S t , g , where c t , g c_{t,g} c t , g is a nonnegative integer. Each row has sum of absolute values at most D D D , and
∑ g = 1 r c t , g ≤ 2 τ n . \sum_{g=1}^{r} c_{t,g} \le2\tau n. g = 1 ∑ r c t , g ≤ 2 τ n .
For an assignment x x x , the entries of C t , g ( x ∣ S t , g ) C_{t,g}(x|_{S_{t,g}}) C t , g ( x ∣ S t , g ) are the measurements on group g g g .
(4) For every f ∈ F f \in\mathcal{F} f ∈ F and v ∈ I f v \in I_f v ∈ I f , a row P ⃗ f , v ( T ) ∈ Q [ T ] 1 × n \vec{P}_{f,v}(T) \in\mathbb{Q}[T]^{1 \times n} P f , v ( T ) ∈ Q [ T ] 1 × n with P ⃗ f , v ( 0 ) = δ v \vec{P}_{f,v}(0) = \delta_v P f , v ( 0 ) = δ v and deg P ⃗ f , v ≤ R \deg\vec{P}_{f,v} \le R deg P f , v ≤ R . For every t ∈ [ Q ] t \in[Q] t ∈ [ Q ] , g ∈ [ r ] ∖ { σ f ( t ) } g \in[r] \setminus\{\sigma_f(t)\} g ∈ [ r ] ∖ { σ f ( t )} , and ξ ~ ∈ Q S t , g \tilde{\xi} \in\mathbb{Q}^{S_{t,g}} ξ ~ ∈ Q S t , g , require
C t , g ξ ~ = 0 ⃗ ⟹ ⟨ P ⃗ f , v ( t ) , ξ ~ ⟩ = 0. C_{t,g}\tilde{\xi} = \vec{0} \quad\Longrightarrow\quad\langle\vec{P}_{f,v}(t),\tilde{\xi}\rangle= 0. C t , g ξ ~ = 0 ⟹ ⟨ P f , v ( t ) , ξ ~ ⟩ = 0.
where ξ ~ ∈ Q n \tilde{\xi} \in\mathbb{Q}^n ξ ~ ∈ Q n is the extension of ξ ~ \tilde{\xi} ξ ~ by zero.
(5) With d d e n = ( R − 1 ) ! Q ! d_{\mathrm{den}} = (R-1)!Q! d den = ( R − 1 )! Q ! , every coefficient of d d e n P ⃗ f , v d_{\mathrm{den}}\vec{P}_{f,v} d den P f , v is an integer with O ( Q log Q + log D ) O(Q\log Q+\log D) O ( Q log Q + log D ) bits, with an absolute implied constant.
To interpret the kernel condition, fix t t t , f f f , and v ∈ I f v \in I_f v ∈ I f , and put g = σ f ( t ) g=\sigma_f(t) g = σ f ( t ) . Write x h = x ∣ S t , h x_h=x|_{S_{t,h}} x h = x ∣ S t , h . If x , x ′ ∈ Q n x,x' \in\mathbb{Q}^n x , x ′ ∈ Q n agree outside S t , h S_{t,h} S t , h for some h ≠ g h\ne g h = g and satisfy C t , h x h = C t , h x h ′ C_{t,h}x_h=C_{t,h}x'_h C t , h x h = C t , h x h ′ , then x h ′ − x h ∈ ker C t , h x'_h-x_h\in\ker C_{t,h} x h ′ − x h ∈ ker C t , h . The condition gives
⟨ P ⃗ f , v ( t ) , x ′ ⟩ = ⟨ P ⃗ f , v ( t ) , x ⟩ . \langle\vec{P}_{f,v}(t),x'\rangle=\langle\vec{P}_{f,v}(t),x\rangle. ⟨ P f , v ( t ) , x ′ ⟩ = ⟨ P f , v ( t ) , x ⟩ .
Applying this one group at a time shows that the tuple ( ⟨ P ⃗ f , v ( t ) , x ⟩ ) v ∈ I f (\langle\vec{P}_{f,v}(t),x\rangle)_{v\in I_f} (⟨ P f , v ( t ) , x ⟩ ) v ∈ I f is determined by x g x_g x g and ( C t , h x h ) h ≠ g (C_{t,h}x_h)_{h\ne g} ( C t , h x h ) h = g . Fixing all the measurement vectors therefore makes the entire factor a function of x g x_g x g . This applies to every polynomial factor Φ f \Phi_f Φ f , including factors with coefficients in A A A .
Each measurement of a Boolean vector lies in [ − D , D ] ∩ Z [-D,D]\cap\mathbb{Z} [ − D , D ] ∩ Z . We bound the sum of absolute values of the matrix entries because the construction can place the same Boolean coordinate in several auxiliary positions. After those positions are identified, entries of C t , g C_{t,g} C t , g need not belong to { 0 , 1 , − 1 } \{0,1,-1\} { 0 , 1 , − 1 } . A rank bound alone would not control the number of possible measurements: the single row ( 1 , 2 , 4 , … , 2 n − 1 ) (1,2,4,\ldots,2^{n-1}) ( 1 , 2 , 4 , … , 2 n − 1 ) distinguishes all 2 n 2^n 2 n Boolean vectors.
Separating the sum by fixing measurements
Fixing the measurements makes every factor depend on only its assigned group. The following lemma states the resulting calculation over a commutative ring, so it applies equally to rational-valued factors and to factors in A A A . The restrictions x i = 1 x_i=1 x i = 1 will be needed for Taylor coefficients and are local to individual groups.
Lemma 3.2. Let [ n ] = S 1 ⊔ ⋯ ⊔ S r [n]=S_1\sqcup\cdots\sqcup S_r [ n ] = S 1 ⊔ ⋯ ⊔ S r be a partition, allowing empty parts. For each g ∈ [ r ] g\in[r] g ∈ [ r ] , let C g C_g C g be an integer matrix with c g c_g c g rows and columns indexed by S g S_g S g . Suppose each row has sum of absolute values at most an integer D ≥ 0 D\ge0 D ≥ 0 , and write c = ∑ g c g c=\sum_g c_g c = ∑ g c g . Let A A A be a commutative ring with identity, and let A g : Q n → A A_g:\mathbb{Q}^n\to A A g : Q n → A satisfy
A g ( x + ξ ) = A g ( x ) ( x ∈ Q n , ξ ∈ ker C h , h ≠ g ) , A_g(x+\xi)=A_g(x)\qquad(x\in\mathbb{Q}^n,\ \xi\in\ker C_h,\ h\ne g), A g ( x + ξ ) = A g ( x ) ( x ∈ Q n , ξ ∈ ker C h , h = g ) , where ξ \xi ξ is extended by zero outside S h S_h S h . For any E ⊆ [ n ] E\subseteq[n] E ⊆ [ n ] , the sum
Z E = ∑ x ∈ { 0 , 1 } n x i = 1 ( i ∈ E ) ∏ g = 1 r A g ( x ) Z_E=\sum_{\substack{x\in\{0,1\}^n\\x_i=1\ (i\in E)}}\prod_{g=1}^{r}A_g(x) Z E = x ∈ { 0 , 1 } n x i = 1 ( i ∈ E ) ∑ g = 1 ∏ r A g ( x ) can be evaluated by examining at most
2 ( 2 D + 1 ) c ∑ g = 1 r 2 ∣ S g ∣ 2(2D+1)^c\sum_{g=1}^{r}2^{|S_g|} 2 ( 2 D + 1 ) c g = 1 ∑ r 2 ∣ S g ∣ Boolean vectors, with at most one A g A_g A g evaluation, poly ( n , r , c , log ( D + 2 ) ) \operatorname{poly}(n,r,c,\log(D+2)) poly ( n , r , c , log ( D + 2 )) additional bit operations, and O ( 1 ) O(1) O ( 1 ) ring operations per vector. Apart from the evaluators’ own storage and O ( 1 ) O(1) O ( 1 ) ring elements, the procedure uses poly ( n , r , c , log ( D + 2 ) ) \operatorname{poly}(n,r,c,\log(D+2)) poly ( n , r , c , log ( D + 2 )) bits of space.
Proof. For y g ∈ Z c g y_g \in\mathbb{Z}^{c_g} y g ∈ Z c g , define
X g ( y g ) = { u ∈ { 0 , 1 } S g : C g u = y g } , Y = ∏ g = 1 r { − D , … , D } c g . \mathcal{X}_g(y_g) = \{u \in\{0,1\}^{S_g}: C_g u = y_g\}, \qquad\mathcal{Y} = \prod_{g=1}^{r} \{-D,\ldots,D\}^{c_g}. X g ( y g ) = { u ∈ { 0 , 1 } S g : C g u = y g } , Y = g = 1 ∏ r { − D , … , D } c g .
Every tuple of measurements of a Boolean assignment belongs to Y \mathcal{Y} Y , and ∣ Y ∣ = ( 2 D + 1 ) c |\mathcal{Y}| = (2D+1)^c ∣ Y ∣ = ( 2 D + 1 ) c . We first identify the contribution of a fixed measurement tuple y ⃗ = ( y 1 , … , y r ) \vec{y} = (y_1,\ldots,y_r) y = ( y 1 , … , y r ) . If every X g ( y g ) \mathcal{X}_g(y_g) X g ( y g ) is nonempty, let x ˉ g ∈ X g ( y g ) \bar{x}_g \in\mathcal{X}_g(y_g) x ˉ g ∈ X g ( y g ) be a representative for each g g g , and put
X g , E ( y g ) = { u ∈ X g ( y g ) : u i = 1 for all i ∈ E ∩ S g } . \mathcal{X}_{g,E}(y_g) = \{u \in\mathcal{X}_g(y_g): u_i = 1 \text{ for all } i \in E \cap S_g\}. X g , E ( y g ) = { u ∈ X g ( y g ) : u i = 1 for all i ∈ E ∩ S g } .
If x h ∈ X h ( y h ) x_h \in\mathcal{X}_h(y_h) x h ∈ X h ( y h ) for every h h h , then x h − x ˉ h ∈ ker C h x_h-\bar{x}_h \in\ker C_h x h − x ˉ h ∈ ker C h . Applying the invariance hypothesis successively for h ≠ g h \ne g h = g gives
A g ( ∑ h = 1 r x h ) = A g ( x g + ∑ h ≠ g x ˉ h ) . A_g\left(\sum_{h=1}^{r}x_h\right) = A_g\left(x_g+\sum_{h\ne g}\bar{x}_h\right). A g ( h = 1 ∑ r x h ) = A g x g + h = g ∑ x ˉ h .
The assignments with measurement tuple y ⃗ \vec{y} y and fixed bits indexed by E E E form ∏ g X g , E ( y g ) \prod_g \mathcal{X}_{g,E}(y_g) ∏ g X g , E ( y g ) . Define
Σ g ( y ⃗ ) = ∑ x g ∈ X g , E ( y g ) A g ( x g + ∑ h ≠ g x ˉ h ) . (25) \Sigma_g(\vec{y}) = \sum_{x_g \in\mathcal{X}_{g,E}(y_g)} A_g\left(x_g+\sum_{h\ne g}\bar{x}_h\right). \tag*{(25)} Σ g ( y ) = x g ∈ X g , E ( y g ) ∑ A g x g + h = g ∑ x ˉ h . (25)
Distributivity shows that these assignments contribute ∏ g Σ g ( y ⃗ ) \prod_g \Sigma_g(\vec{y}) ∏ g Σ g ( y ) to Z E Z_E Z E . If X g , E ( y g ) \mathcal{X}_{g,E}(y_g) X g , E ( y g ) is empty, then Σ g ( y ⃗ ) = 0 \Sigma_g(\vec{y})=0 Σ g ( y ) = 0 . The representatives x ˉ g \bar{x}_g x ˉ g themselves need not satisfy the fixed-bit conditions indexed by E E E . Every Boolean assignment has a unique measurement tuple, so
Z E = ∑ y ⃗ ∈ Y ∏ g = 1 r Σ g ( y ⃗ ) , Z_E = \sum_{\vec{y}\in\mathcal{Y}}\prod_{g=1}^{r}\Sigma_g(\vec{y}), Z E = y ∈ Y ∑ g = 1 ∏ r Σ g ( y ) ,
where the product is taken to be zero if any X g ( y g ) \mathcal{X}_g(y_g) X g ( y g ) is empty.
The algorithm evaluates this identity one measurement tuple at a time, starting with Z = 0 A Z=0_A Z = 0 A . For each y ⃗ ∈ Y \vec{y}\in\mathcal{Y} y ∈ Y , a first scan of each { 0 , 1 } S g \{0,1\}^{S_g} { 0 , 1 } S g finds a representative x ˉ g ∈ X g ( y g ) \bar{x}_g\in\mathcal{X}_g(y_g) x ˉ g ∈ X g ( y g ) ; if any such set is empty, the algorithm skips this tuple. Otherwise it initializes p = 1 A p=1_A p = 1 A . To compute Σ g ( y ⃗ ) \Sigma_g(\vec{y}) Σ g ( y ) , it initializes s = 0 A s=0_A s = 0 A and scans u ∈ { 0 , 1 } S g u\in\{0,1\}^{S_g} u ∈ { 0 , 1 } S g again. Whenever
C g u = y g , u i = 1 ( i ∈ E ∩ S g ) , C_g u = y_g,\qquad u_i=1\quad(i\in E\cap S_g), C g u = y g , u i = 1 ( i ∈ E ∩ S g ) ,
the algorithm performs the update
s ← s + A g ( u + ∑ h ≠ g x ˉ h ) . s \leftarrow s+A_g\left(u+\sum_{h\ne g}\bar{x}_h\right). s ← s + A g u + h = g ∑ x ˉ h .
At the end of this scan, s = Σ g ( y ⃗ ) s=\Sigma_g(\vec{y}) s = Σ g ( y ) , and the algorithm sets p ← p s p\leftarrow ps p ← p s . After all groups, it sets Z ← Z + p Z\leftarrow Z+p Z ← Z + p . After all tuples y ⃗ \vec{y} y have been processed, Z = Z E Z=Z_E Z = Z E .
For each y ⃗ \vec{y} y , the scan finding the representatives and the scan computing the Σ g ( y ⃗ ) \Sigma_g(\vec{y}) Σ g ( y ) each examine at most ∑ g 2 ∣ S g ∣ \sum_g 2^{|S_g|} ∑ g 2 ∣ S g ∣ Boolean vectors. This gives the stated bound. Checking a vector’s measurements and fixed bits uses poly ( n , r , c , log ( D + 2 ) ) \operatorname{poly}(n,r,c,\log(D+2)) poly ( n , r , c , log ( D + 2 )) bit operations: each matrix row has sum of absolute values at most D D D , so its partial sums have O ( log ( D + 2 ) ) O(\log(D+2)) O ( log ( D + 2 )) bits. There is at most one factor evaluation per vector. The retained state is y ⃗ \vec{y} y , ( x ˉ 1 , … , x ˉ r ) (\bar{x}_1,\ldots,\bar{x}_r) ( x ˉ 1 , … , x ˉ r ) , g g g , u u u , s s s , p p p , and Z Z Z . The tuple y ⃗ \vec{y} y contains c c c integers in [ − D , D ] [-D,D] [ − D , D ] , the representatives contain n n n bits in total, and s , p , Z ∈ A s,p,Z\in A s , p , Z ∈ A . □
To evaluate (24) at a fixed t t t , group the transformed factors by σ f ( t ) \sigma_f(t) σ f ( t ) and apply the lemma in A A A with E = ∅ E=\varnothing E = ∅ . Definition 3.1 gives its invariance hypothesis, so the sum is H ( t ) H(t) H ( t ) . As in the overview, the two exponential costs are the measurement choices and the Boolean assignments in one group.
Taylor coefficients from fixed Boolean substitutions
The Q Q Q values H ( 1 ) , … , H ( Q ) H(1),\ldots,H(Q) H ( 1 ) , … , H ( Q ) need not determine H H H . Set
q = ⌊ d H Q ⌋ , J = q + 1. (26) q=\left\lfloor\frac{d_H}{Q}\right\rfloor,\qquad J=q+1. \tag*{(26)} q = ⌊ Q d H ⌋ , J = q + 1. (26)
Since Q J > d H QJ>d_H Q J > d H , it suffices to compute
H t ( z ) = ∑ j = 0 J − 1 ( [ z j ] H ( t + z ) ) z j ( t ∈ [ Q ] ) . (27) \mathcal{H}_t(z)=\sum_{j=0}^{J-1}([z^j]H(t+z))z^j\qquad(t\in[Q]). \tag*{(27)} H t ( z ) = j = 0 ∑ J − 1 ([ z j ] H ( t + z )) z j ( t ∈ [ Q ]) . (27)
Hermite interpolation recovers H H H , and hence Z = H ( 0 ) Z=H(0) Z = H ( 0 ) , from these Q J QJ Q J coefficients in A \mathcal{A} A . Indeed, the rational Hermite matrix for polynomials of degree less than Q J QJ Q J is invertible over Q \mathbb{Q} Q . Its inverse acts on elements of A \mathcal{A} A by rational linear combinations.
Fix t t t . The replacement forms at t + z t+z t + z need not respect the design at t t t . Write
Δ P ⃗ f , v ( z ) = P ⃗ f , v ( t + z ) − P ⃗ f , v ( t ) . \Delta\vec{P}_{f,v}(z)=\vec{P}_{f,v}(t+z)-\vec{P}_{f,v}(t). Δ P f , v ( z ) = P f , v ( t + z ) − P f , v ( t ) .
Every entry is divisible by z z z . For fixed x ∈ Q n x\in\mathbb{Q}^n x ∈ Q n , introduce independent indeterminates X ⃗ \vec{X} X and replace each input by
⟨ P ⃗ f , v ( t ) , x ⟩ + ⟨ Δ P ⃗ f , v ( z ) , X ⃗ ⟩ . (28) \langle\vec{P}_{f,v}(t),x\rangle+\langle\Delta\vec{P}_{f,v}(z),\vec{X}\rangle. \tag*{(28)} ⟨ P f , v ( t ) , x ⟩ + ⟨ Δ P f , v ( z ) , X ⟩ . (28)
Let
G x ( X ⃗ , z ) = ∏ f ∈ F Φ f ( ( ⟨ P ⃗ f , v ( t ) , x ⟩ + ⟨ Δ P ⃗ f , v ( z ) , X ⃗ ⟩ ) v ∈ I f ) . (29) G_x(\vec{X},z)=\prod_{f\in\mathcal{F}}\Phi_f\left(\left(\langle\vec{P}_{f,v}(t),x\rangle+\langle\Delta\vec{P}_{f,v}(z),\vec{X}\rangle\right)_{v\in I_f}\right). \tag*{(29)} G x ( X , z ) = f ∈ F ∏ Φ f ( ( ⟨ P f , v ( t ) , x ⟩ + ⟨ Δ P f , v ( z ) , X ⟩ ) v ∈ I f ) . (29)
Setting X ⃗ = x \vec{X}=x X = x gives ∑ x G x ( x , z ) = H ( t + z ) \sum_xG_x(x,z)=H(t+z) ∑ x G x ( x , z ) = H ( t + z ) . Holding X ⃗ \vec{X} X fixed instead makes every correction independent of x x x , so the design at t t t still separates the factors. Moreover, each occurrence of X ⃗ \vec{X} X carries a factor of z z z , giving
deg X ⃗ ( [ z j ] G x ( X ⃗ , z ) ) ≤ j . (30) \deg_{\vec{X}}([z^j]G_x(\vec{X},z))\le j. \tag*{(30)} deg X ([ z j ] G x ( X , z )) ≤ j . (30)
The next identity recovers the substitution X ⃗ = x \vec{X}=x X = x from fixed Boolean substitutions and restrictions on the assignments being summed.
Lemma 3.3. Let q ≥ 0 q\ge0 q ≥ 0 be an integer and let A \mathcal{A} A be a commutative ring with identity. For each x ∈ { 0 , 1 } n x\in\{0,1\}^n x ∈ { 0 , 1 } n , let p x ( X 1 , … , X n ) p_x(X_1,\ldots,X_n) p x ( X 1 , … , X n ) be a polynomial over A \mathcal{A} A of degree at most q q q . Then
∑ x ∈ { 0 , 1 } n p x ( x ) = ∑ E ⊆ [ n ] ∣ E ∣ ≤ q ∑ U ⊆ E ( − 1 ) ∣ E ∣ − ∣ U ∣ ∑ x ∈ { 0 , 1 } n x i = 1 ( i ∈ E ) p x ( 1 U ) . (31) \sum_{x\in\{0,1\}^n}p_x(x)=\sum_{\substack{E\subseteq[n]\\|E|\le q}}\sum_{U\subseteq E}(-1)^{|E|-|U|}\sum_{\substack{x\in\{0,1\}^n\\x_i=1\ (i\in E)}}p_x(\mathbf{1}_U). \tag*{(31)} x ∈ { 0 , 1 } n ∑ p x ( x ) = E ⊆ [ n ] ∣ E ∣ ≤ q ∑ U ⊆ E ∑ ( − 1 ) ∣ E ∣ − ∣ U ∣ x ∈ { 0 , 1 } n x i = 1 ( i ∈ E ) ∑ p x ( 1 U ) . (31) Here 1 U \mathbf{1}_U 1 U is the indicator vector of U U U .
Proof. For fixed x x x , we replace every positive power of X i X_i X i by X i X_i X i . This leaves Boolean evaluations unchanged and does not increase the degree. By Möbius inversion on subsets, the resulting multilinear polynomial has the expansion
p ~ x ( X ⃗ ) = ∑ E ⊆ [ n ] c x , E ∏ i ∈ E X i , c x , E = ∑ U ⊆ E ( − 1 ) ∣ E ∣ − ∣ U ∣ p x ( 1 U ) . \widetilde{p}_x(\vec{X})=\sum_{E\subseteq[n]}c_{x,E}\prod_{i\in E}X_i,\qquad c_{x,E}=\sum_{U\subseteq E}(-1)^{|E|-|U|}p_x(\mathbf{1}_U). p x ( X ) = E ⊆ [ n ] ∑ c x , E i ∈ E ∏ X i , c x , E = U ⊆ E ∑ ( − 1 ) ∣ E ∣ − ∣ U ∣ p x ( 1 U ) . The degree bound gives c x , E = 0 c_{x,E}=0 c x , E = 0 whenever ∣ E ∣ > q |E|>q ∣ E ∣ > q . Setting X ⃗ = x \vec{X}=x X = x and summing over x x x now gives the claimed identity: the monomial ∏ i ∈ E x i \prod_{i\in E}x_i ∏ i ∈ E x i selects exactly the assignments with x i = 1 x_i=1 x i = 1 for every i ∈ E i\in E i ∈ E . □
Apply Lemma 3.3 to [ z j ] G x [z^j]G_x [ z j ] G x over A \mathcal{A} A for each j < J j<J j < J . All coefficients can use the same pairs U ⊆ E U\subseteq E U ⊆ E , ∣ E ∣ ≤ q |E|\le q ∣ E ∣ ≤ q , so compute them together in
R = A [ z ] / ( z J ) . \mathcal{R}=\mathcal{A}[z]/(z^J). R = A [ z ] / ( z J ) .
For a fixed pair ( E , U ) (E,U) ( E , U ) , let Φ f , U ( x ; z ) \Phi_{f,U}(x;z) Φ f , U ( x ; z ) be factor f f f in (29) after setting X ⃗ = 1 U \vec{X}=\mathbf{1}_U X = 1 U . Group these factors by their assignments:
A g , U ( x ; z ) = ∏ f : σ f ( t ) = g Φ f , U ( x ; z ) . (32) A_{g,U}(x;z)=\prod_{f:\sigma_f(t)=g}\Phi_{f,U}(x;z). \tag*{(32)} A g , U ( x ; z ) = f : σ f ( t ) = g ∏ Φ f , U ( x ; z ) . (32)
Their product is G x ( 1 U , z ) \mathcal{G}_x(\mathbf{1}_U,z) G x ( 1 U , z ) . For h ≠ g h\ne g h = g , changing x x x by a vector in ker C t , h \ker C_{t,h} ker C t , h changes neither the original inputs of these factors nor their fixed corrections. Lemma 3.2 therefore computes the restricted sum with x i = 1 x_i=1 x i = 1 for i ∈ E i\in E i ∈ E by examining at most
2 r ( 2 D + 1 ) 2 τ n 2 2 n / r (33) 2r(2D+1)^{2\tau n}2^{2n/r} \tag*{(33)} 2 r ( 2 D + 1 ) 2 τ n 2 2 n / r (33)
Boolean vectors. Combining all the pairs gives
H ( t + z ) ≡ ∑ E ⊆ [ n ] ∣ E ∣ ≤ q ∑ U ⊆ E ( − 1 ) ∣ E ∣ − ∣ U ∣ ∑ x ∈ { 0 , 1 } n x i = 1 ( i ∈ E ) G x ( 1 U , z ) ( m o d z J ) . (34) H(t+z)\equiv\sum_{\substack{E\subseteq[n]\\|E|\le q}}\sum_{U\subseteq E}(-1)^{|E|-|U|}\sum_{\substack{x\in\{0,1\}^n\\x_i=1\ (i\in E)}}\mathcal{G}_x(\mathbf{1}_U,z)\pmod{z^J}. \tag*{(34)} H ( t + z ) ≡ E ⊆ [ n ] ∣ E ∣ ≤ q ∑ U ⊆ E ∑ ( − 1 ) ∣ E ∣ − ∣ U ∣ x ∈ { 0 , 1 } n x i = 1 ( i ∈ E ) ∑ G x ( 1 U , z ) ( mod z J ) . (34)
The group products and sums are formed in R \mathcal{R} R . The result is H t ( z ) H_t(z) H t ( z ) ; repeating at all t t t supplies the interpolation data. The algorithm never stores a polynomial in all n n n indeterminates: it sets X ⃗ = 1 U \vec{X}=\mathbf{1}_U X = 1 U first and stores only the J J J coefficients in A \mathcal{A} A .
The three exponential costs
For each t ∈ [ Q ] t\in[Q] t ∈ [ Q ] , the number of pairs U ⊆ E ⊆ [ n ] U\subseteq E\subseteq[n] U ⊆ E ⊆ [ n ] with ∣ E ∣ ≤ q |E|\le q ∣ E ∣ ≤ q is
C q = ∑ s = 0 min ( q , n ) 2 s ( n s ) . (35) C_q=\sum_{s=0}^{\min(q,n)}2^s\binom{n}{s}. \tag*{(35)} C q = s = 0 ∑ m i n ( q , n ) 2 s ( s n ) . (35)
In particular, C 0 = 1 C_0=1 C 0 = 1 and C q = 3 n C_q=3^n C q = 3 n for q ≥ n q\ge n q ≥ n . For every 0 < η ≤ 1 0<\eta\le1 0 < η ≤ 1 ,
η q C q ≤ ∑ s = 0 n ( n s ) ( 2 η ) s = ( 1 + 2 η ) n , (36) \eta^qC_q\le\sum_{s=0}^{n}\binom{n}{s}(2\eta)^s=(1+2\eta)^n, \tag*{(36)} η q C q ≤ s = 0 ∑ n ( s n ) ( 2 η ) s = ( 1 + 2 η ) n , (36)
because η q ≤ η s \eta^q\le\eta^s η q ≤ η s for every retained index s ≤ q s\le q s ≤ q .
Proposition 3.4 (Common counting routine). Let A \mathcal{A} A be a commutative Q \mathbb{Q} Q -algebra. Suppose the product of the factors in (22) , computed over A \mathcal{A} A , satisfies the degree bound (23) , and that the replacement rows, partitions, and measurements satisfy Definition 3.1. With q , J q,J q , J as in (26) , the routine computes Z Z Z by examining at most
2 Q r C q ( 2 D + 1 ) 2 τ n 2 2 n / r 2QrC_q(2D+1)^{2\tau n}2^{2n/r} 2 Q r C q ( 2 D + 1 ) 2 τ n 2 2 n / r Boolean vectors. For each vector it evaluates at most ∣ F ∣ |\mathcal{F}| ∣ F ∣ factors in A [ z ] / ( z J ) \mathcal{A}[z]/(z^J) A [ z ] / ( z J ) . The additional operations per vector and the final interpolation take polynomially many operations in A \mathcal{A} A and over Q \mathbb{Q} Q , in the parameters n n n , ∣ F ∣ |\mathcal{F}| ∣ F ∣ , D D D , Q Q Q , R R R , J J J , r r r and the total scope length. Apart from the factor evaluators’ own storage, the routine retains only polynomially many algebra elements, rational numbers and index bits.
Proof. There are Q Q Q points, C q C_q C q pairs per point, and at most (33) Boolean vectors per pair. Forming each group product uses at most ∣ F ∣ |\mathcal{F}| ∣ F ∣ factor evaluations. Addition and multiplication modulo z J z^J z J cost O ( J 2 ) O(J^2) O ( J 2 ) operations on coefficients in A \mathcal{A} A . The preceding Taylor identity and interpolation prove correctness. Process the points, pairs, measurement tuples, and local assignments sequentially, retaining their current indices and accumulators. Together with the Q J QJ Q J interpolation coefficients, this gives the stated storage bound. Bit complexity additionally depends on the cost of evaluating the factors and on coefficient sizes; these are verified for the sparse polynomial application in § 5.4 .
When d = O ( n ) d=O(n) d = O ( n ) , we have d H = O ( n R ) d_H=O(nR) d H = O ( n R ) and q = O ( n R / Q ) q=O(nR/Q) q = O ( n R / Q ) . Taking η = R / Q \eta=R/Q η = R / Q in (36) gives
log C q ≤ q log ( Q / R ) + n log ( 1 + 2 R / Q ) = O ( n R Q log 2 Q R ) . \log C_q \leq q\log(Q/R)+n\log(1+2R/Q)=O\left(n\frac{R}{Q}\log\frac{2Q}{R}\right). log C q ≤ q log ( Q / R ) + n log ( 1 + 2 R / Q ) = O ( n Q R log R 2 Q ) .
Consequently, if factor evaluation and coefficient arithmetic have polynomial bit cost, the running time is a polynomial factor times
2 O ( n [ R Q log 2 Q R + log ( 2 D + 1 ) + 1 r ] ) (37) 2^{O\left(n\left[\frac{R}{Q}\log\frac{2Q}{R}+\log(2D+1)+\frac{1}{r}\right]\right)} \tag*{(37)} 2 O ( n [ Q R l o g R 2 Q + l o g ( 2 D + 1 ) + r 1 ] ) (37)
These are exactly the three costs from the overview. The parameter choice in Lemma 4.8 makes their sum O ( ( log log n ) 2 / log n ) O((\log\log n)^2/\sqrt{\log n}) O (( log log n ) 2 / log n ) when factor scopes and their maximum incidence are bounded by a fixed power of log n \log n log n . The routine also applies when d d d is larger; then one keeps the actual value q = ⌊ d R / Q ⌋ q=\lfloor dR/Q\rfloor q = ⌊ d R / Q ⌋ in the bound of Proposition 3.4.
We have so far assumed that the design is supplied. The next section constructs it from the factor scopes. The remaining two sections use the resulting routine first to count the zeros of a supplied polynomial system and then to choose such a system for a formula.
Constructing low-degree replacement forms
The counting routine needs one replacement form for each pair ( f , v ) (f,v) ( f , v ) where factor f f f reads variable v v v . For the application in § 5 , f f f is a polynomial equation and its scope is the union of the variable sets of its monomials. This section uses only those scopes. We construct the rows P ⃗ f , v ( T ) \vec{P}_{f,v}(T) P f , v ( T ) and measurement matrices C t , g C_{t,g} C t , g in Definition 3.1 , together with the partitions S t , g S_{t,g} S t , g and factor assignments σ f \sigma_f σ f . The main difficulty is to keep deg P ⃗ f , v ≤ R \deg\vec{P}_{f,v}\leq R deg P f , v ≤ R with R R R much smaller than Q Q Q . The degree bound for H H H grows linearly with R R R , so a small R / Q R/Q R / Q reduces the number of Taylor coefficients needed at each point. Choosing the rows independently at T = 0 , 1 , … , Q T=0,1,\ldots,Q T = 0 , 1 , … , Q and interpolating would generally give degree Q Q Q . We instead construct their values at all these points together.
The construction first gives polynomial rows on a complete array of auxiliary coordinates. We then place each factor–variable pair in a copy of that array. Several positions can contain the same Boolean variable x v x_v x v ; their values are always equal, and they do not become independent variables in the counting sum.
The auxiliary coordinates
We first specify the larger coordinate set B \mathcal{B} B on which the auxiliary rows P ⃗ u ( T ) \vec{P}_u(T) P u ( T ) will act, together with the incidence bounds needed to place the actual pairs ( f , v ) (f,v) ( f , v ) into copies of it. Let ( I f ) f ∈ F (I_f)_{f\in\mathcal{F}} ( I f ) f ∈ F be the factor scopes, with I f ⊆ [ n ] I_f\subseteq[n] I f ⊆ [ n ] , and write
A = { ( f , v ) : f ∈ F , v ∈ I f } , M = ∣ A ∣ , \mathcal{A}=\{(f,v):f\in\mathcal{F},\ v\in I_f\},\qquad M=|\mathcal{A}|, A = {( f , v ) : f ∈ F , v ∈ I f } , M = ∣ A ∣ ,
∣ I f ∣ ≤ w ( f ∈ F ) , # { f : v ∈ I f } ≤ b ( v ∈ [ n ] ) . (38) |I_f|\leq w\quad(f\in\mathcal{F}),\qquad\#\{f:v\in I_f\}\leq b\quad(v\in[n]). \tag*{(38)} ∣ I f ∣ ≤ w ( f ∈ F ) , # { f : v ∈ I f } ≤ b ( v ∈ [ n ]) . (38)
Thus w w w bounds the number of variables in a factor’s scope, and b b b bounds the number of factors containing one variable. The scope bound w w w need not bound the degree of the factor polynomial. A factor with empty scope is constant and needs no auxiliary position; assign such a factor to group one at every point. If necessary, adjoin a distinct constant-one factor with scope { v } \{v\} { v } for every $v\in[n]. This changes neither the product nor the count, and increases the maximum incidence by at most one. With b b b denoting the bound after this addition, we assume
n ≥ 1 , b , w ≥ 1 , n ≤ M ≤ b n . n\geq1,\qquad b,w\geq1,\qquad n\leq M\leq bn. n ≥ 1 , b , w ≥ 1 , n ≤ M ≤ bn .
Throughout this section, r ≥ 2 r\geq2 r ≥ 2 and 1 ≤ R < Q 1\leq R<Q 1 ≤ R < Q are integers and 0 < τ ≤ 1 / 2 0<\tau\leq1/2 0 < τ ≤ 1/2 .
At each point t ∈ [ Q ] t\in[Q] t ∈ [ Q ] , the variable x v x_v x v will belong to one group, while a factor containing v v v may be assigned to another. We will choose
a v ∈ [ r ] Q ( v ∈ [ n ] ) , d f ∈ [ r ] Q ( f ∈ F ) , a_v\in[r]^Q\quad(v\in[n]),\qquad d_f\in[r]^Q\quad(f\in\mathcal{F}), a v ∈ [ r ] Q ( v ∈ [ n ]) , d f ∈ [ r ] Q ( f ∈ F ) ,
where a v ( t ) a_v(t) a v ( t ) specifies the group containing x v x_v x v and d f ( t ) d_f(t) d f ( t ) specifies the group assigned to factor f f f . The position for ( f , v ) (f,v) ( f , v ) will have label ( a v , d f ) (a_v,d_f) ( a v , d f ) . In particular, all positions containing x v x_v x v will have the same first sequence a v a_v a v .
Before choosing a v a_v a v and d f d_f d f , take the complete set of possible labels:
B = ( [ r ] Q ) 2 , u = ( a u , d u ) , D = ∣ B ∣ = r 2 Q . (39) \mathcal{B} = ([r]^{Q})^2,\qquad u=(a_u,d_u),\qquad D=|\mathcal{B}|=r^{2Q}. \tag*{(39)} B = ([ r ] Q ) 2 , u = ( a u , d u ) , D = ∣ B ∣ = r 2 Q . (39)
An auxiliary vector ζ ∈ Q B \zeta\in\mathbb{Q}^{\mathcal{B}} ζ ∈ Q B has one rational coordinate ζ u \zeta_u ζ u for each pair u u u . The label u u u stays fixed as ζ \zeta ζ varies. For t ∈ [ Q ] t\in[Q] t ∈ [ Q ] and g ∈ [ r ] g\in[r] g ∈ [ r ] , define
S t , g B = { u ∈ B : a u ( t ) = g } . (40) S^{\mathcal{B}}_{t,g}=\{u\in\mathcal{B}:a_u(t)=g\}. \tag*{(40)} S t , g B = { u ∈ B : a u ( t ) = g } . (40)
For fixed t t t , these sets partition B \mathcal{B} B into r r r sets of size D / r D/r D / r .
For each u ∈ B u\in\mathcal{B} u ∈ B , we seek a polynomial row P ⃗ u ( T ) ∈ Q [ T ] 1 × B \vec{P}_u(T)\in\mathbb{Q}[T]^{1\times\mathcal{B}} P u ( T ) ∈ Q [ T ] 1 × B of degree at most R − 1 R-1 R − 1 with P ⃗ u ( 0 ) = δ u \vec{P}_u(0)=\delta_u P u ( 0 ) = δ u . At T = t T=t T = t , the value ⟨ P ⃗ u ( t ) , ζ ⟩ \langle\vec{P}_u(t),\zeta\rangle ⟨ P u ( t ) , ζ ⟩ should be determined by
ζ ∣ S t , d u ( t ) B and C B ζ , \zeta|_{S^{\mathcal{B}}_{t,d_u(t)}}\qquad\text{and}\qquad C^{\mathcal{B}}\zeta, ζ ∣ S t , d u ( t ) B and C B ζ ,
where C B C^{\mathcal{B}} C B is one integer matrix, independent of u , t u,t u , t , with entries in { 0 , 1 , − 1 } \{0,1,-1\} { 0 , 1 , − 1 } and few rows. Later, using u f , v = ( a v , d f ) u_{f,v}=(a_v,d_f) u f , v = ( a v , d f ) will make every input of factor f f f use the group d f ( t ) d_f(t) d f ( t ) . The choices of a v , d f a_v,d_f a v , d f and the placement into copies are deferred to § 4.4 and § 4.5 , respectively.
The matrices M 0 M_0 M 0 and C B C^{\mathcal{B}} C B
To construct the rows P ⃗ u ( T ) \vec{P}_u(T) P u ( T ) , we seek a matrix M 0 ∈ Q B × B M_0\in\mathbb{Q}^{\mathcal{B}\times\mathcal{B}} M 0 ∈ Q B × B that fixes ker C B \ker C^{\mathcal{B}} ker C B and satisfies
M 0 [ u , y ] ≠ 0 ⟹ ∣ { s ∈ [ Q ] : a y ( s ) ≠ d u ( s ) } ∣ ≤ R − 1. (41) M_0[u,y]\ne0\quad\Longrightarrow\quad\left|\{s\in[Q]:a_y(s)\ne d_u(s)\}\right|\le R-1. \tag*{(41)} M 0 [ u , y ] = 0 ⟹ ∣ { s ∈ [ Q ] : a y ( s ) = d u ( s )} ∣ ≤ R − 1. (41)
The identity
ζ u = ( ( I − M 0 ) ζ ) u + ∑ y ∈ B M 0 [ u , y ] ζ y (42) \zeta_u=((I-M_0)\zeta)_u+\sum_{y\in\mathcal{B}}M_0[u,y]\zeta_y \tag*{(42)} ζ u = (( I − M 0 ) ζ ) u + y ∈ B ∑ M 0 [ u , y ] ζ y (42)
explains both requirements. If M 0 M_0 M 0 fixes ker C B \ker C^{\mathcal{B}} ker C B , the first term is determined by C B ζ C^{\mathcal{B}}\zeta C B ζ ; we will leave it independent of T T T . In the sum, multiply each nonzero M 0 [ u , y ] M_0[u,y] M 0 [ u , y ] by a polynomial that is one at zero and vanishes at every t t t with a y ( t ) ≠ d u ( t ) a_y(t)\ne d_u(t) a y ( t ) = d u ( t ) . The bound (41) permits degree at most R − 1 R-1 R − 1 . At T = t T=t T = t , the sum will then use only the coordinates y ∈ S t , d u ( t ) B y\in S^{\mathcal{B}}_{t,d_u(t)} y ∈ S t , d u ( t ) B .
For s ∈ [ Q ] s\in[Q] s ∈ [ Q ] , let ϑ s : B → B \vartheta_s:\mathcal{B}\to\mathcal{B} ϑ s : B → B exchange the entries a u ( s ) a_u(s) a u ( s ) and d u ( s ) d_u(s) d u ( s ) , leaving every other entry unchanged. Define its permutation matrix Π s \Pi_s Π s by
( Π s ζ ) u = ζ ϑ s ( u ) . (\Pi_s\zeta)_u=\zeta_{\vartheta_s(u)}. ( Π s ζ ) u = ζ ϑ s ( u ) .
The exchanged pair ϑ s ( u ) \vartheta_s(u) ϑ s ( u ) belongs to B \mathcal{B} B because this set contains every pair of sequences in [ r ] Q [r]^Q [ r ] Q . The matrices Π s \Pi_s Π s commute and satisfy Π s 2 = I \Pi_s^2=I Π s 2 = I . Their product
V 0 = ∏ s = 1 Q Π s V_0=\prod_{s=1}^{Q}\Pi_s V 0 = s = 1 ∏ Q Π s
exchanges the complete sequences a u a_u a u and d u d_u d u . Thus V 0 [ u , y ] ≠ 0 V_0[u,y]\ne0 V 0 [ u , y ] = 0 implies a y ( s ) = d u ( s ) a_y(s)=d_u(s) a y ( s ) = d u ( s ) for every s s s ; it satisfies (41) with no mismatches. We will modify V 0 V_0 V 0 so that the resulting matrix also fixes the kernel of a short list of integer measurements.
Define
W 0 = 1 2 ∑ s = 1 Q ( I − Π s ) . (43) W_0=\frac{1}{2}\sum_{s=1}^{Q}(I-\Pi_s). \tag*{(43)} W 0 = 2 1 s = 1 ∑ Q ( I − Π s ) . (43)
On a common eigenvector ψ \psi ψ of the Π s \Pi_s Π s , let j j j be the number of indices s s s for which Π s ψ = − ψ \Pi_s\psi=-\psi Π s ψ = − ψ . Then
W 0 ψ = j ψ , V 0 ψ = ( − 1 ) j ψ , V 0 p ( W 0 ) ψ = ( − 1 ) j p ( j ) ψ W_0\psi=j\psi,\qquad V_0\psi=(-1)^j\psi,\qquad V_0p(W_0)\psi=(-1)^jp(j)\psi W 0 ψ = j ψ , V 0 ψ = ( − 1 ) j ψ , V 0 p ( W 0 ) ψ = ( − 1 ) j p ( j ) ψ
for every polynomial p p p . Therefore V 0 p ( W 0 ) V_0p(W_0) V 0 p ( W 0 ) fixes ψ \psi ψ whenever p ( j ) = ( − 1 ) j p(j)=(-1)^j p ( j ) = ( − 1 ) j . We will construct an explicit common eigenbasis in which the proportion of vectors with a given j j j is Pr [ W = j ] \Pr[W=j] Pr [ W = j ] for W ∼ Bin ( Q , ( r − 1 ) / ( 2 r ) ) W\sim\operatorname{Bin}(Q,(r-1)/(2r)) W ∼ Bin ( Q , ( r − 1 ) / ( 2 r )) .
For an interval I = { A 0 , … , A 0 + R − 1 } ⊆ { 0 , … , Q } \mathcal{I}=\{A_0,\ldots,A_0+R-1\}\subseteq\{0,\ldots,Q\} I = { A 0 , … , A 0 + R − 1 } ⊆ { 0 , … , Q } , we can enforce the equalities f I ( j ) = ( − 1 ) j f_{\mathcal{I}}(j)=(-1)^j f I ( j ) = ( − 1 ) j for j ∈ I j\in\mathcal{I} j ∈ I with a polynomial of degree at most R − 1 R-1 R − 1 . We use the explicit interpolation formula
f I ( z ) = ( − 1 ) A 0 ∑ j = 0 R − 1 ( − 2 ) j ( z − A 0 j ) , M 0 = V 0 f I ( W 0 ) , (44) f_{\mathcal{I}}(z)=(-1)^{A_0}\sum_{j=0}^{R-1}(-2)^j\binom{z-A_0}{j},\qquad M_0=V_0f_{\mathcal{I}}(W_0), \tag*{(44)} f I ( z ) = ( − 1 ) A 0 j = 0 ∑ R − 1 ( − 2 ) j ( j z − A 0 ) , M 0 = V 0 f I ( W 0 ) , (44)
where
( z − A 0 j ) = 1 j ! ∏ a = 0 j − 1 ( z − A 0 − a ) . \binom{z-A_0}{j}=\frac{1}{j!}\prod_{a=0}^{j-1}(z-A_0-a). ( j z − A 0 ) = j ! 1 a = 0 ∏ j − 1 ( z − A 0 − a ) .
and the empty product is one. For 0 ≤ q < R 0\leq q<R 0 ≤ q < R , the binomial theorem gives f I ( A 0 + q ) = ( − 1 ) A 0 ( 1 − 2 ) q = ( − 1 ) A 0 + q f_{\mathcal{I}}(A_0+q)=(-1)^{A_0}(1-2)^q=(-1)^{A_0+q} f I ( A 0 + q ) = ( − 1 ) A 0 ( 1 − 2 ) q = ( − 1 ) A 0 + q .
Lemma 4.1. For B \mathcal{B} B , I \mathcal{I} I and M 0 M_0 M 0 as above, there is a matrix C B ∈ { 0 , 1 , − 1 } [ c B ] × B C^{\mathcal{B}}\in\{0,1,-1\}^{[c_{\mathcal{B}}]\times\mathcal{B}} C B ∈ { 0 , 1 , − 1 } [ c B ] × B such that
c B ≤ D Pr [ W ∉ I ] , W ∼ Bin ( Q , r − 1 2 r ) , c_{\mathcal{B}}\leq D\Pr[W\notin\mathcal{I}],\qquad W\sim\operatorname{Bin}\left(Q,\frac{r-1}{2r}\right), c B ≤ D Pr [ W ∈ / I ] , W ∼ Bin ( Q , 2 r r − 1 ) , and M 0 ξ = ξ M_0\xi=\xi M 0 ξ = ξ for every ξ ∈ ker C B \xi\in\ker C^{\mathcal{B}} ξ ∈ ker C B .
Proof. For ( α , δ ) ∈ [ r ] 2 (\alpha,\delta)\in[r]^2 ( α , δ ) ∈ [ r ] 2 , let e α δ e_{\alpha\delta} e α δ be the indicator function of that ordered pair. Exchanging its two entries has the orthogonal eigenbasis
e α α ( α ∈ [ r ] ) , e α δ + e δ α , e α δ − e δ α ( 1 ≤ α < δ ≤ r ) . e_{\alpha\alpha}\quad(\alpha\in[r]),\qquad e_{\alpha\delta}+e_{\delta\alpha},\qquad e_{\alpha\delta}-e_{\delta\alpha}\quad(1\leq\alpha<\delta\leq r). e α α ( α ∈ [ r ]) , e α δ + e δ α , e α δ − e δ α ( 1 ≤ α < δ ≤ r ) .
The first two types have eigenvalue + 1 +1 + 1 , and the third has eigenvalue − 1 -1 − 1 . There are r ( r + 1 ) / 2 r(r+1)/2 r ( r + 1 ) /2 vectors with eigenvalue + 1 +1 + 1 and r ( r − 1 ) / 2 r(r-1)/2 r ( r − 1 ) /2 with eigenvalue − 1 -1 − 1 .
For each s ∈ [ Q ] s\in[Q] s ∈ [ Q ] , choose one of these functions ψ s : [ r ] 2 → { 0 , 1 , − 1 } \psi_s:[r]^2\to\{0,1,-1\} ψ s : [ r ] 2 → { 0 , 1 , − 1 } , and define
ψ ( u ) = ∏ s = 1 Q ψ s ( a u ( s ) , d u ( s ) ) ( u ∈ B ) . \psi(u)=\prod_{s=1}^{Q}\psi_s(a_u(s),d_u(s))\qquad(u\in\mathcal{B}). ψ ( u ) = s = 1 ∏ Q ψ s ( a u ( s ) , d u ( s )) ( u ∈ B ) .
The D = r 2 Q D=r^{2Q} D = r 2 Q choices give nonzero orthogonal vectors: their inner products factor into the inner products of the functions ψ s \psi_s ψ s . They form a basis of Q B \mathbb{Q}^{\mathcal{B}} Q B with entries in { 0 , 1 , − 1 } \{0,1,-1\} { 0 , 1 , − 1 } . If exactly j j j of the chosen ψ s \psi_s ψ s have eigenvalue − 1 -1 − 1 , then W 0 ψ = j ψ W_0\psi=j\psi W 0 ψ = j ψ and V 0 ψ = ( − 1 ) j ψ V_0\psi=(-1)^j\psi V 0 ψ = ( − 1 ) j ψ . Hence M 0 M_0 M 0 fixes ψ \psi ψ whenever j ∈ I j\in\mathcal{I} j ∈ I .
To make ker C B \ker C^{\mathcal{B}} ker C B a space fixed by M 0 M_0 M 0 , we define the rows of C B C^{\mathcal{B}} C B to be the transposes of the basis vectors with j ∉ I j\notin\mathcal{I} j ∈ / I . A fraction ( r − 1 ) / ( 2 r ) (r-1)/(2r) ( r − 1 ) / ( 2 r ) of the choices at each position have eigenvalue − 1 -1 − 1 , independently across positions. The fraction of the D D D basis vectors retained as rows is therefore Pr [ W ∉ I ] \Pr[W\notin\mathcal{I}] Pr [ W ∈ / I ] , proving the row bound. If C B ξ = 0 ⃗ C^{\mathcal{B}}\xi=\vec{0} C B ξ = 0 , then ξ \xi ξ is orthogonal to every retained basis vector. It is a linear combination of the basis vectors with j ∈ I j\in\mathcal{I} j ∈ I , all of which M 0 M_0 M 0 fixes. □ \square □
For a bound ϵ > 0 \epsilon>0 ϵ > 0 , the condition
Pr [ Bin ( Q , r − 1 2 r ) ∉ I ] ≤ ϵ (45) \Pr\left[\operatorname{Bin}\left(Q,\frac{r-1}{2r}\right)\notin\mathcal{I}\right]\leq\epsilon \tag*{(45)} Pr [ Bin ( Q , 2 r r − 1 ) ∈ / I ] ≤ ϵ (45)
thus gives c B ≤ ϵ D c_{\mathcal{B}}\leq\epsilon D c B ≤ ϵD . After placing the factor inputs, we will use ϵ = τ / ( r b ) \epsilon=\tau/(rb) ϵ = τ / ( r b ) . We next prove the other requirement on M 0 M_0 M 0 .
Lemma 4.2. For all u , y ∈ B u,y\in\mathcal{B} u , y ∈ B , if M 0 [ u , y ] ≠ 0 M_0[u,y]\neq0 M 0 [ u , y ] = 0 , then
∣ { s ∈ [ Q ] : a y ( s ) ≠ d u ( s ) } ∣ ≤ R − 1. \left|\{s\in[Q]:a_y(s)\neq d_u(s)\}\right|\leq R-1. ∣ { s ∈ [ Q ] : a y ( s ) = d u ( s )} ∣ ≤ R − 1.
Proof. Expand f I ( W 0 ) f_I(W_0) f I ( W 0 ) in the commuting matrices Π s \Pi_s Π s . Since deg f I ≤ R − 1 \deg f_I \le R-1 deg f I ≤ R − 1 and Π s 2 = I \Pi_s^2=I Π s 2 = I , each resulting monomial is a scalar multiple of ∏ s ∈ J Π s \prod_{s\in J}\Pi_s ∏ s ∈ J Π s for some J ⊆ [ Q ] J\subseteq[Q] J ⊆ [ Q ] with ∣ J ∣ ≤ R − 1 |J|\le R-1 ∣ J ∣ ≤ R − 1 . Multiplication by V 0 V_0 V 0 gives
V 0 ∏ s ∈ J Π s = ∏ s ∉ J Π s . V_0\prod_{s\in J}\Pi_s=\prod_{s\notin J}\Pi_s. V 0 s ∈ J ∏ Π s = s ∈ / J ∏ Π s .
A nonzero ( u , y ) (u,y) ( u , y ) entry of this permutation matrix requires a y ( s ) = d u ( s ) a_y(s)=d_u(s) a y ( s ) = d u ( s ) for every s ∉ J s\notin J s ∈ / J . There are at most R − 1 R-1 R − 1 other positions. If more than R − 1 R-1 R − 1 positions disagree, every summand has zero ( u , y ) (u,y) ( u , y ) entry, so M 0 [ u , y ] = 0 M_0[u,y]=0 M 0 [ u , y ] = 0 as well.
The polynomial rows
We now use M 0 M_0 M 0 to construct the auxiliary rows P ⃗ u ( T ) \vec{P}_u(T) P u ( T ) sought in § 4.1 . Lemma 4.1 makes ( I − M 0 ) ζ (I-M_0)\zeta ( I − M 0 ) ζ a function of C B ζ C^{\mathcal B}\zeta C B ζ . Lemma 4.2 bounds the number of points at which a nonzero term M 0 [ u , y ] ζ y M_0[u,y]\zeta_y M 0 [ u , y ] ζ y uses a coordinate outside S t , d u ( t ) B S^{\mathcal B}_{t,d_u(t)} S t , d u ( t ) B . We now multiply that term by a polynomial vanishing at those points and equal to one at zero.
For M 0 [ u , y ] ≠ 0 M_0[u,y]\ne0 M 0 [ u , y ] = 0 , define
E u , y = { s ∈ [ Q ] : a y ( s ) ≠ d u ( s ) } , φ u , y ( T ) = ∏ s ∈ E u , y ( 1 − T s ) . (46) E_{u,y}=\{s\in[Q]:a_y(s)\ne d_u(s)\},\qquad
\varphi_{u,y}(T)=\prod_{s\in E_{u,y}}\left(1-\frac{T}{s}\right). \tag*{(46)} E u , y = { s ∈ [ Q ] : a y ( s ) = d u ( s )} , φ u , y ( T ) = s ∈ E u , y ∏ ( 1 − s T ) . (46)
The empty product is one. Then deg φ u , y ≤ R − 1 \deg\varphi_{u,y}\le R-1 deg φ u , y ≤ R − 1 , φ u , y ( 0 ) = 1 \varphi_{u,y}(0)=1 φ u , y ( 0 ) = 1 , and φ u , y ( t ) = 0 \varphi_{u,y}(t)=0 φ u , y ( t ) = 0 whenever a y ( t ) ≠ d u ( t ) a_y(t)\ne d_u(t) a y ( t ) = d u ( t ) . Define
P ⃗ u ( T ) = δ u ( I − M 0 ) + ∑ y ∈ B M 0 [ u , y ] ≠ 0 M 0 [ u , y ] φ u , y ( T ) δ y . (47) \vec{P}_u(T)=\delta_u(I-M_0)+\sum_{\substack{y\in\mathcal B\\M_0[u,y]\ne0}}M_0[u,y]\varphi_{u,y}(T)\delta_y. \tag*{(47)} P u ( T ) = δ u ( I − M 0 ) + y ∈ B M 0 [ u , y ] = 0 ∑ M 0 [ u , y ] φ u , y ( T ) δ y . (47)
This row acts as a linear form in ζ \zeta ζ , with coefficients that are polynomials in the single parameter T T T .
Lemma 4.3. The rows in (47) have degree at most R − 1 R-1 R − 1 and satisfy P ⃗ u ( 0 ) = δ u \vec{P}_u(0)=\delta_u P u ( 0 ) = δ u for every u ∈ B u\in\mathcal B u ∈ B .
For t ∈ [ Q ] t\in[Q] t ∈ [ Q ] and g ∈ [ r ] g\in[r] g ∈ [ r ] , let C t , g B C^{\mathcal B}_{t,g} C t , g B be the restriction of C B C^{\mathcal B} C B to the columns S t , g B S^{\mathcal B}_{t,g} S t , g B . For every u , t , g u,t,g u , t , g with g ≠ d u ( t ) g\ne d_u(t) g = d u ( t ) and every ξ ∈ Q S t , g B \xi\in\mathbb Q^{S^{\mathcal B}_{t,g}} ξ ∈ Q S t , g B , its extension ξ ~ \widetilde{\xi} ξ by zero to B \mathcal B B satisfies
C t , g B ξ = 0 ⃗ ⟹ ⟨ P ⃗ u ( t ) , ξ ~ ⟩ = 0. C^{\mathcal B}_{t,g}\xi=\vec{0}\quad\Longrightarrow\quad
\langle\vec{P}_u(t),\widetilde{\xi}\rangle=0. C t , g B ξ = 0 ⟹ ⟨ P u ( t ) , ξ ⟩ = 0. More generally, ⟨ P ⃗ u ( t ) , ζ ⟩ \langle\vec{P}_u(t),\zeta\rangle ⟨ P u ( t ) , ζ ⟩ is determined by ζ ∣ S t , d u ( t ) B \zeta|_{S^{\mathcal B}_{t,d_u(t)}} ζ ∣ S t , d u ( t ) B and C B ζ C^{\mathcal B}\zeta C B ζ .
Proof. The degree bound follows from that of φ u , y \varphi_{u,y} φ u , y . At zero,
P ⃗ u ( 0 ) = δ u ( I − M 0 ) + δ u M 0 = δ u . \vec{P}_u(0)=\delta_u(I-M_0)+\delta_uM_0=\delta_u. P u ( 0 ) = δ u ( I − M 0 ) + δ u M 0 = δ u .
Applying (47) to ζ \zeta ζ gives
⟨ P ⃗ u ( T ) , ζ ⟩ = ( ( I − M 0 ) ζ ) u + ∑ y ∈ B M 0 [ u , y ] ≠ 0 M 0 [ u , y ] φ u , y ( T ) ζ y . (48) \langle\vec{P}_u(T),\zeta\rangle=((I-M_0)\zeta)_u+
\sum_{\substack{y\in\mathcal B\\M_0[u,y]\ne0}}M_0[u,y]\varphi_{u,y}(T)\zeta_y. \tag*{(48)} ⟨ P u ( T ) , ζ ⟩ = (( I − M 0 ) ζ ) u + y ∈ B M 0 [ u , y ] = 0 ∑ M 0 [ u , y ] φ u , y ( T ) ζ y . (48)
At T = t T=t T = t , all summands with a y ( t ) ≠ d u ( t ) a_y(t)\ne d_u(t) a y ( t ) = d u ( t ) vanish. If ξ ~ \widetilde{\xi} ξ is supported on S t , g B S^{\mathcal B}_{t,g} S t , g B with g ≠ d u ( t ) g\ne d_u(t) g = d u ( t ) , each remaining summand is zero on ξ ~ \widetilde{\xi} ξ . The hypothesis C t , g B ξ = 0 ⃗ C^{\mathcal B}_{t,g}\xi=\vec{0} C t , g B ξ = 0 also gives C B ξ ~ = 0 ⃗ C^{\mathcal B}\widetilde{\xi}=\vec{0} C B ξ = 0 , so ( I − M 0 ) ξ ~ = 0 ⃗ (I-M_0)\widetilde{\xi}=\vec{0} ( I − M 0 ) ξ = 0 by Lemma 4.1 . This proves the implication.
For the final assertion, two vectors with the same measurements under C B C^{\mathcal B} C B differ by an element of its kernel. Thus ( I − M 0 ) ζ (I-M_0)\zeta ( I − M 0 ) ζ is determined by C B ζ C^{\mathcal B}\zeta C B ζ . The remaining terms in (48) at T = t T=t T = t use only ζ ∣ S t , d u ( t ) B \zeta|_{S^{\mathcal B}_{t,d_u(t)}} ζ ∣ S t , d u ( t ) B .
Fix t t t and write ζ g = ζ ∣ S t , g B \zeta_g=\zeta|_{S^{\mathcal B}_{t,g}} ζ g = ζ ∣ S t , g B . The restrictions of C B C^{\mathcal B} C B satisfy
C B ζ = ∑ g = 1 r C t , g B ζ g . (49) C^{\mathcal B}\zeta=\sum_{g=1}^{r}C^{\mathcal B}_{t,g}\zeta_g. \tag*{(49)} C B ζ = g = 1 ∑ r C t , g B ζ g . (49)
Fixing each vector C t , g B ζ C^{B}_{t,g}\zeta C t , g B ζ therefore fixes C B B ζ C^{B}_{B}\zeta C B B ζ while imposing separate conditions on the r r r auxiliary coordinate groups. When all vectors C t , g B ζ C^{B}_{t,g}\zeta C t , g B ζ are fixed, ⟨ P ⃗ u ( t ) , ζ ⟩ \langle\vec{P}_{u}(t),\zeta\rangle ⟨ P u ( t ) , ζ ⟩ is determined by ζ ∣ S t , d u ( t ) B \left.\zeta\right|_{S^{B}_{t,d_{u}(t)}} ζ ∣ S t , d u ( t ) B . We will obtain the corresponding separation on the actual Boolean variables by placing ( f , v ) (f,v) ( f , v ) at a coordinate labeled ( a v , d f ) (a_v,d_f) ( a v , d f ) .
Remark 4.4. We illustrate how (47) confines dependence outside the assigned group to one linear measurement. Take Q = R = 2 Q=R=2 Q = R = 2 , outside the regime R < Q R<Q R < Q used for the running-time bound, and r = 2 r=2 r = 2 . Use { 0 , 1 } \{0,1\} { 0 , 1 } as the group indices and I = { 0 , 1 } I=\{0,1\} I = { 0 , 1 } , so f I ( z ) = 1 − 2 z f_I(z)=1-2z f I ( z ) = 1 − 2 z . Starting with the label ( 00 , 11 ) (00,11) ( 00 , 11 ) , the two exchanges generate four coordinates:
ζ 0 = ζ ( 00 , 11 ) , ζ 1 = ζ ( 10 , 01 ) , ζ 2 = ζ ( 01 , 10 ) , ζ 12 = ζ ( 11 , 00 ) . \zeta_0=\zeta_{(00,11)},\qquad\zeta_1=\zeta_{(10,01)},\qquad\zeta_2=\zeta_{(01,10)},\qquad\zeta_{12}=\zeta_{(11,00)}. ζ 0 = ζ ( 00 , 11 ) , ζ 1 = ζ ( 10 , 01 ) , ζ 2 = ζ ( 01 , 10 ) , ζ 12 = ζ ( 11 , 00 ) .
Both exchanges preserve this set of four coordinates, so we can restrict the calculation to it. On this restriction, M 0 = Π 1 + Π 2 − Π 1 Π 2 M_0=\Pi_1+\Pi_2-\Pi_1\Pi_2 M 0 = Π 1 + Π 2 − Π 1 Π 2 fixes the kernel of
c ( ζ ) = ζ 0 − ζ 1 − ζ 2 + ζ 12 . c(\zeta)=\zeta_0-\zeta_1-\zeta_2+\zeta_{12}. c ( ζ ) = ζ 0 − ζ 1 − ζ 2 + ζ 12 .
The row indexed by u = ( 00 , 11 ) u=(00,11) u = ( 00 , 11 ) gives
⟨ P ⃗ u ( T ) , ζ ⟩ = ζ 0 − T 2 ζ 1 − T ζ 2 . \langle\vec{P}_{u}(T),\zeta\rangle=\zeta_0-\frac{T}{2}\zeta_1-T\zeta_2. ⟨ P u ( T ) , ζ ⟩ = ζ 0 − 2 T ζ 1 − T ζ 2 .
It equals ζ 0 \zeta_0 ζ 0 at zero, while
⟨ P ⃗ u ( 1 ) , ζ ⟩ = c ( ζ ) + 1 2 ζ 1 − ζ 12 , ⟨ P ⃗ u ( 2 ) , ζ ⟩ = c ( ζ ) − ζ 2 − ζ 12 . \langle\vec{P}_{u}(1),\zeta\rangle=c(\zeta)+\frac{1}{2}\zeta_1-\zeta_{12},\qquad\langle\vec{P}_{u}(2),\zeta\rangle=c(\zeta)-\zeta_2-\zeta_{12}. ⟨ P u ( 1 ) , ζ ⟩ = c ( ζ ) + 2 1 ζ 1 − ζ 12 , ⟨ P u ( 2 ) , ζ ⟩ = c ( ζ ) − ζ 2 − ζ 12 .
At t = 1 t=1 t = 1 , the labels of ζ 1 , ζ 12 \zeta_1,\zeta_{12} ζ 1 , ζ 12 satisfy a y ( 1 ) = 1 = d u ( 1 ) a_y(1)=1=d_u(1) a y ( 1 ) = 1 = d u ( 1 ) . At t = 2 t=2 t = 2 , the labels of ζ 2 , ζ 12 \zeta_2,\zeta_{12} ζ 2 , ζ 12 satisfy a y ( 2 ) = 1 = d u ( 2 ) a_y(2)=1=d_u(2) a y ( 2 ) = 1 = d u ( 2 ) . Fixing c ( ζ ) c(\zeta) c ( ζ ) therefore leaves ⟨ P ⃗ u ( t ) , ζ ⟩ \langle\vec{P}_{u}(t),\zeta\rangle ⟨ P u ( t ) , ζ ⟩ dependent only on coordinates in its assigned group. Here c ( ζ ) c(\zeta) c ( ζ ) plays the role of C B B ζ C^{B}_{B}\zeta C B B ζ on the four-coordinate restriction. The full construction must give this property for every u ∈ B u\in B u ∈ B with at most ϵ D \epsilon D ϵD measurement rows.
Choosing the variable and factor groups
We now choose the families ( a v ) v ∈ [ n ] (a_v)_{v\in[n]} ( a v ) v ∈ [ n ] and ( d f ) f ∈ F (d_f)_{f\in\mathcal{F}} ( d f ) f ∈ F from § 4.1 , and set
u f , v = ( a v , d f ) ( ( f , v ) ∈ A ) . u_{f,v}=(a_v,d_f)\qquad((f,v)\in\mathcal{A}). u f , v = ( a v , d f ) (( f , v ) ∈ A ) .
These choices have two requirements. First, if a label occurs c u c_u c u times, its incidences need c u c_u c u different positions in copies of the auxiliary array. Thus the number of copies needed is
c u = # { ( f , v ) ∈ A : u f , v = u } , h = max u ∈ B c u . c_u=\#\{(f,v)\in\mathcal{A}:u_{f,v}=u\},\qquad h=\max_{u\in\mathcal{B}}c_u. c u = # {( f , v ) ∈ A : u f , v = u } , h = u ∈ B max c u .
Second, the actual variable group { v : a v ( t ) = g } \{v:a_v(t)=g\} { v : a v ( t ) = g } must be small. Bounding h h h alone would bound the number of incidences in a group, not give the required bound on its number of Boolean variables. The next lemma controls both quantities.
Lemma 4.5. Let ( I f ) f ∈ F (I_f)_{f\in\mathcal{F}} ( I f ) f ∈ F satisfy (38) , with n ≤ M ≤ b n n\le M\le bn n ≤ M ≤ bn , and put D = r 2 Q D=r^{2Q} D = r 2 Q for integers r ≥ 2 r\ge2 r ≥ 2 and Q ≥ 1 Q\ge1 Q ≥ 1 . Suppose
2 ( b + w ) D 2 ≤ M , 2 Q r 2 ≤ n . (50) 2(b+w)D^2\le M,\qquad2Qr^2\le n. \tag*{(50)} 2 ( b + w ) D 2 ≤ M , 2 Q r 2 ≤ n . (50) One can deterministically choose a v , d f ∈ [ r ] Q a_v,d_f\in[r]^Q a v , d f ∈ [ r ] Q , with d f ( t ) = 1 d_f(t)=1 d f ( t ) = 1 for factors of empty scope, so that
max u ∈ B # { ( f , v ) ∈ A : ( a v , d f ) = u } ≤ 2 M D , \max_{u\in\mathcal{B}}\#\{(f,v)\in\mathcal{A}:(a_v,d_f)=u\}\le\frac{2M}{D}, u ∈ B max # {( f , v ) ∈ A : ( a v , d f ) = u } ≤ D 2 M , # { v ∈ [ n ] : a v ( t ) = g } ≤ 2 n r ( t ∈ [ Q ] , g ∈ [ r ] ) . \#\{v\in[n]:a_v(t)=g\}\le\frac{2n}{r}\qquad(t\in[Q],\ g\in[r]). # { v ∈ [ n ] : a v ( t ) = g } ≤ r 2 n ( t ∈ [ Q ] , g ∈ [ r ]) . The construction takes poly ( n , M , ∣ F ∣ , D , Q , r , b , w ) \operatorname{poly}(n,M,|\mathcal{F}|,D,Q,r,b,w) poly ( n , M , ∣ F ∣ , D , Q , r , b , w ) bit operations.
Proof. We first estimate the effect of random labels; we will then fix their values deterministically. For this estimate, all a v a_v a v and all d f d_f d f with nonempty I f I_f I f are independent and uniform on [ r ] Q [r]^Q [ r ] Q . For empty I f I_f I f , we set d f d_f d f identically one. Each incidence label u f , v = ( a v , d f ) u_{f,v}=(a_v,d_f) u f , v = ( a v , d f ) is uniform on B \mathcal{B} B . Put n t , g = # { v : a v ( t ) = g } n_{t,g}=\#\{v:a_v(t)=g\} n t , g = # { v : a v ( t ) = g } , and consider
Φ = ∑ u ∈ B ( c u − M / D ) 2 , Ξ = ∑ t = 1 Q ∑ g = 1 r ( n t , g − n / r ) 2 . \Phi=\sum_{u\in\mathcal{B}}(c_u-M/D)^2,\qquad\Xi=\sum_{t=1}^{Q}\sum_{g=1}^{r}(n_{t,g}-n/r)^2. Φ = u ∈ B ∑ ( c u − M / D ) 2 , Ξ = t = 1 ∑ Q g = 1 ∑ r ( n t , g − n / r ) 2 .
Their expansions as sums of indicators are
Φ = ∑ ( f , v ) , ( f ′ , v ′ ) ∈ A 1 { ( a v , d f ) = ( a v ′ , d f ′ ) } − M 2 D , \Phi=\sum_{(f,v),(f',v')\in\mathcal{A}}\mathbf{1}_{\{(a_v,d_f)=(a_{v'},d_{f'})\}}-\frac{M^2}{D}, Φ = ( f , v ) , ( f ′ , v ′ ) ∈ A ∑ 1 {( a v , d f ) = ( a v ′ , d f ′ )} − D M 2 ,
Ξ = ∑ t = 1 Q ∑ v , v ′ ∈ [ n ] 1 { a v ( t ) = a v ′ ( t ) } − Q n 2 r . \Xi=\sum_{t=1}^{Q}\sum_{v,v'\in[n]}\mathbf{1}_{\{a_v(t)=a_{v'}(t)\}}-\frac{Qn^2}{r}. Ξ = t = 1 ∑ Q v , v ′ ∈ [ n ] ∑ 1 { a v ( t ) = a v ′ ( t )} − r Q n 2 .
Two incidence labels are independent unless they share a factor or a variable. For each ( f , v ) (f,v) ( f , v ) , there are at most b + w b+w b + w incidences sharing f f f or v v v , including ( f , v ) (f,v) ( f , v ) itself. Independent pairs have equality probability 1 / D 1/D 1/ D ; the other pairs have probability at most one. Hence
E Φ ≤ M ( b + w ) . \mathbb{E}\Phi\leq M(b+w). E Φ ≤ M ( b + w ) .
For each t t t and v ≠ v ′ v\ne v' v = v ′ , the values a v ( t ) , a v ′ ( t ) a_v(t),a_{v'}(t) a v ( t ) , a v ′ ( t ) are independent and uniform on [ r ] [r] [ r ] . The second expansion therefore gives
E Ξ = Q n ( 1 − 1 / r ) ≤ Q n . \mathbb{E}\Xi=Qn(1-1/r)\leq Qn. E Ξ = Q n ( 1 − 1/ r ) ≤ Q n .
To obtain the labels deterministically, we fix the a v a_v a v and the d f d_f d f for nonempty I f I_f I f one at a time. At each step we choose a value that does not increase the conditional expectation of
Φ M ( b + w ) + Ξ Q n . \frac{\Phi}{M(b+w)}+\frac{\Xi}{Qn}. M ( b + w ) Φ + Q n Ξ .
Such a choice exists because the current expectation is the average over the possible values of the next a v a_v a v or d f d_f d f . The final value is at most two. Since both summands are nonnegative,
c u ≤ M D + 2 M ( b + w ) , n t , g ≤ n r + 2 Q n . c_u\leq\frac{M}{D}+\sqrt{2M(b+w)},\qquad n_{t,g}\leq\frac{n}{r}+\sqrt{2Qn}. c u ≤ D M + 2 M ( b + w ) , n t , g ≤ r n + 2 Q n .
The two inequalities in (50) make the square-root terms at most M / D M/D M / D and n / r n/r n / r , respectively. The following enumeration computes the conditional expectations in poly ( n , M , ∣ F ∣ , D , Q , r , b , w ) \operatorname{poly}(n,M,|\mathcal{F}|,D,Q,r,b,w) poly ( n , M , ∣ F ∣ , D , Q , r , b , w ) bit operations. Put K = r Q K=r^Q K = r Q , so D = K 2 D=K^2 D = K 2 . Each indicator in the expansion of Φ \Phi Φ depends on at most the four independent choices a v , d f , a v ′ , d f ′ a_v,d_f,a_{v'},d_{f'} a v , d f , a v ′ , d f ′ ; repeated indices contribute just one choice. Each indicator in Ξ \Xi Ξ depends on at most a v , a v ′ a_v,a_{v'} a v , a v ′ . After any partial fixing, enumerate at most K 4 = D 2 K^4=D^2 K 4 = D 2 assignments to the remaining choices in one indicator. Its conditional probability has denominator dividing K 4 K^4 K 4 . Summing the M 2 + Q n 2 M^2+Qn^2 M 2 + Q n 2 indicators computes both expectations. Including the normalizations M ( b + w ) M(b+w) M ( b + w ) and Q n Qn Q n , all rational values in these calculations have numerators and denominators with
O ( log ( 2 D ) + log ( 2 M ) + log ( 2 n ) + log ( 2 Q ) + log ( 2 + b + w ) ) O(\log(2D)+\log(2M)+\log(2n)+\log(2Q)+\log(2+b+w)) O ( log ( 2 D ) + log ( 2 M ) + log ( 2 n ) + log ( 2 Q ) + log ( 2 + b + w ))
bits. There are at most n + ∣ F ∣ n+|\mathcal{F}| n + ∣ F ∣ choices to fix, each with K K K candidate values. Since K 4 = D 2 K^4=D^2 K 4 = D 2 , the entire construction takes poly ( n , M , ∣ F ∣ , D , Q , r , b , w ) \operatorname{poly}(n,M,|\mathcal{F}|,D,Q,r,b,w) poly ( n , M , ∣ F ∣ , D , Q , r , b , w ) bit operations. □ \square □
Placing copies of the variables in the auxiliary arrays
We now transfer the auxiliary rows P ⃗ u ( T ) \vec{P}_u(T) P u ( T ) and matrix C B \mathcal{C}^{B} C B to the rows P ⃗ f , v ( T ) \vec{P}_{f,v}(T) P f , v ( T ) and matrices C t , g C_{t,g} C t , g on the original variables required by Definition 3.1 . Assume (50) and apply Lemma 4.5 . With h = max u c u h=\max_u c_u h = max u c u , index h h h copies of the auxiliary coordinates by [ h ] × B [h]\times\mathcal{B} [ h ] × B . For each ( f , v ) ∈ A (f,v)\in\mathcal{A} ( f , v ) ∈ A , we assign c ( f , v ) ∈ [ h ] c(f,v)\in[h] c ( f , v ) ∈ [ h ] so that all pairs ( c ( f , v ) , u f , v ) (c(f,v),u_{f,v}) ( c ( f , v ) , u f , v ) are distinct. This is possible because no label occurs more than h h h times, and
h D ≤ 2 M ≤ 2 b n . hD\le2M\le2bn. h D ≤ 2 M ≤ 2 bn .
Define the linear map ι : Q n ⟶ Q [ h ] × B \iota:\mathbb{Q}^{n}\longrightarrow\mathbb{Q}^{[h]\times\mathcal{B}} ι : Q n ⟶ Q [ h ] × B by
( ι x ) c , u = { x v , ( c , u ) = ( c ( f , v ) , u f , v ) for some ( f , v ) ∈ A , 0 , otherwise . (\iota x)_{c,u}=
\begin{cases}
x_v, & (c,u)=(c(f,v),u_{f,v})\text{ for some }(f,v)\in\mathcal{A},\\
0, & \text{otherwise}.
\end{cases} ( ι x ) c , u = { x v , 0 , ( c , u ) = ( c ( f , v ) , u f , v ) for some ( f , v ) ∈ A , otherwise .
The occupied positions are distinct, so this definition is unambiguous. Different positions can contain the same x v x_v x v , and unused positions are fixed at zero. For c ∈ [ h ] c\in[h] c ∈ [ h ] , define the projection
π c : Q [ h ] × B ⟶ Q B , ( π c η ) u = η c , u . \pi_c:\mathbb{Q}^{[h]\times\mathcal{B}}\longrightarrow\mathbb{Q}^{\mathcal{B}},\qquad
(\pi_c\eta)_u=\eta_{c,u}. π c : Q [ h ] × B ⟶ Q B , ( π c η ) u = η c , u .
Now put
P ⃗ f , v ( T ) = P ⃗ u f , v ( T ) π c ( f , v ) , v , \vec{P}_{f,v}(T)=\vec{P}_{u_{f,v}}(T)\pi_{c(f,v),v}, P f , v ( T ) = P u f , v ( T ) π c ( f , v ) , v ,
S t , g = { v ∈ [ n ] : a v ( t ) = g } , σ f ( t ) = d f ( t ) . (51) S_{t,g}=\{v\in[n]:a_v(t)=g\},\qquad\sigma_f(t)=d_f(t). \tag*{(51)} S t , g = { v ∈ [ n ] : a v ( t ) = g } , σ f ( t ) = d f ( t ) . (51)
The row P ⃗ f , v ( T ) \vec{P}_{f,v}(T) P f , v ( T ) acts on the actual variables x ∈ Q n x\in\mathbb{Q}^{n} x ∈ Q n . At T = 0 T=0 T = 0 , it extracts the value in position ( c ( f , v ) , u f , v ) (c(f,v),u_{f,v}) ( c ( f , v ) , u f , v ) , which is x v x_v x v . Thus P ⃗ f , v ( 0 ) = δ v \vec{P}_{f,v}(0)=\delta_v P f , v ( 0 ) = δ v , and its degree is at most R − 1 R-1 R − 1 . Lemma 4.5 gives ∣ S t , g ∣ ≤ 2 n / r |S_{t,g}|\le2n/r ∣ S t , g ∣ ≤ 2 n / r .
Define the measurement matrices by
C ~ = diag ( C B , … , C B ⏟ h copies ) , C ^ = C ~ ι , C t , g = C ^ ∣ S t , g . (52) \widetilde{C}=\operatorname{diag}(\underbrace{\mathcal{C}^{B},\ldots,\mathcal{C}^{B}}_{h\ \text{copies}}),\qquad
\widehat{C}=\widetilde{C}_{\iota},\qquad
C_{t,g}=\widehat{C}\big|_{S_{t,g}}. \tag*{(52)} C = diag ( h copies C B , … , C B ) , C = C ι , C t , g = C S t , g . (52)
The restriction keeps the columns in S t , g S_{t,g} S t , g and all rows, including zero rows. Thus C ^ x \widehat{C}x C x records the auxiliary measurements in each copy after its coordinates have been filled from x x x . The matrices C t , g C_{t,g} C t , g are integral. Their entries need not belong to { 0 , 1 , − 1 } \{0,1,-1\} { 0 , 1 , − 1 } , because coefficients at several positions containing the same x v x_v x v are added. Each row of C ~ \widetilde{C} C has at most D D D nonzero entries, all equal to 1 1 1 or − 1 -1 − 1 . Multiplication by ι \iota ι adds entries in a common column and discards unused positions, so it cannot increase the sum of their absolute values. Consequently every row of C t , g C_{t,g} C t , g has absolute row sum at most D D D , and its value on a Boolean assignment lies in [ − D , D ] ∩ Z [-D,D]\cap\mathbb{Z} [ − D , D ] ∩ Z .
If (45) holds, each C t , g C_{t,g} C t , g has c t , g = h c B c_{t,g}=hc_B c t , g = h c B rows. Hence
∑ g = 1 r c t , g = r h c B ≤ r h ϵ D ≤ 2 r ϵ M ≤ 2 r ϵ b n . (53) \sum_{g=1}^{r}c_{t,g}=rhc_B\le rh\epsilon D\le2r\epsilon M\le2r\epsilon bn. \tag*{(53)} g = 1 ∑ r c t , g = r h c B ≤ r h ϵD ≤ 2 r ϵ M ≤ 2 r ϵ bn . (53)
Setting ϵ = τ / ( r b ) \epsilon=\tau/(rb) ϵ = τ / ( r b ) makes this at most 2 τ n 2\tau n 2 τ n .
To verify separation, fix t ∈ [ Q ] t\in[Q] t ∈ [ Q ] , g ∈ [ r ] g\in[r] g ∈ [ r ] and ( f , v ) ∈ A (f,v)\in\mathcal{A} ( f , v ) ∈ A with g ≠ σ f ( t ) g\ne\sigma_f(t) g = σ f ( t ) . Suppose ξ ∈ Q S t , g \xi\in\mathbb{Q}^{S_{t,g}} ξ ∈ Q S t , g satisfies C t , g ξ = 0 ⃗ C_{t,g}\xi=\vec{0} C t , g ξ = 0 , and extend it by zero to ξ ~ ∈ Q n \widetilde{\xi}\in\mathbb{Q}^{n} ξ ∈ Q n . Equation (52) gives C ^ ι ξ ~ = 0 ⃗ \widehat{C}\iota\widetilde{\xi}=\vec{0} C ι ξ = 0 . Thus, for every c ∈ [ h ] c\in[h] c ∈ [ h ] ,
C B π c ι ξ ~ = 0 ⃗ . \mathcal{C}^{B}\pi_c\iota\widetilde{\xi}=\vec{0}. C B π c ι ξ = 0 .
Every nonzero coordinate of π c ι ξ ~ \pi_c\iota\widetilde{\xi} π c ι ξ contains a variable v ′ v' v ′ with a v ′ ( t ) = g a_{v'}(t)=g a v ′ ( t ) = g . Its auxiliary label has first sequence a v ′ a_{v'} a v ′ , so this vector is supported on S t , g B S^B_{t,g} S t , g B . Lemma 4.3 , applied in copy c ( f , v ) c(f,v) c ( f , v ) with d u f , v ( t ) = d f ( t ) = σ f ( t ) d_{u_{f,v}}(t)=d_f(t)=\sigma_f(t) d u f , v ( t ) = d f ( t ) = σ f ( t ) , gives
⟨ P ⃗ f , v ( t ) , ξ ~ ⟩ = ⟨ P ⃗ u f , v ( t ) , π c ( f , v ) ι ξ ~ ⟩ = 0. \langle\vec{P}_{f,v}(t),\widetilde{\xi}\rangle
=
\langle\vec{P}_{u_{f,v}}(t),\pi_{c(f,v)}\iota\widetilde{\xi}\rangle=0. ⟨ P f , v ( t ) , ξ ⟩ = ⟨ P u f , v ( t ) , π c ( f , v ) ι ξ ⟩ = 0.
This is the kernel condition in Definition 3.1 . All inputs of factor f f f use the same assigned group d f ( t ) d_f(t) d f ( t ) , and the counting sum still ranges over exactly the n n n Boolean bits.
Coefficient bounds and the completed construction
The substitution rows P ⃗ f , v ( T ) ∈ Q [ T ] 1 × n \vec{P}_{f,v}(T) \in\mathbb{Q}[T]^{1\times n} P f , v ( T ) ∈ Q [ T ] 1 × n in (51) have polynomial entries with rational coefficients. We now bound the bits needed to store those coefficients; these bounds will control exact arithmetic in § 5.4 . We first give a common denominator and coefficient bounds for the auxiliary rows P ⃗ u ( T ) \vec{P}_u(T) P u ( T ) defined in (47) . Passing from P ⃗ u ( T ) \vec{P}_u(T) P u ( T ) to P ⃗ f , v ( T ) \vec{P}_{f,v}(T) P f , v ( T ) by (51) only adds coefficients in common columns or discards unused columns, so the same denominator and bound on the sum of absolute values apply.
Lemma 4.6. Let d d e n = ( R − 1 ) ! Q ! d_{\mathrm{den}}=(R-1)!Q! d den = ( R − 1 )! Q ! . Then d d e n P ⃗ u ( T ) ∈ Z [ T ] 1 × D d_{\mathrm{den}}\vec{P}_u(T)\in\mathbb{Z}[T]^{1\times D} d den P u ( T ) ∈ Z [ T ] 1 × D for every u ∈ B u\in B u ∈ B . The sum of the absolute values of all coefficients in each row d d e n P ⃗ u ( T ) d_{\mathrm{den}}\vec{P}_u(T) d den P u ( T ) is at most 2 O ( Q log Q ) 2^{O(Q\log Q)} 2 O ( Q l o g Q ) . The same bound holds for d d e n P ⃗ f , v ( T ) d_{\mathrm{den}}\vec{P}_{f,v}(T) d den P f , v ( T ) . The matrices M 0 M_0 M 0 , C B C^B C B and the rows P ⃗ u ( T ) \vec{P}_u(T) P u ( T ) can be constructed in poly ( D , Q , r ) \operatorname{poly}(D,Q,r) poly ( D , Q , r ) bit operations.
Proof. For 0 ≤ j < R 0\le j<R 0 ≤ j < R , the corresponding summand of f I ( W 0 ) f_I(W_0) f I ( W 0 ) equals
( − 1 ) A 0 ( − 2 ) j ( W 0 − A 0 I j ) = ( − 1 ) A 0 + j j ! ∏ a = 0 j − 1 ( 2 W 0 − 2 ( A 0 + a ) I ) . (-1)^{A_0}(-2)^j\binom{W_0-A_0I}{j}
=
\frac{(-1)^{A_0+j}}{j!}\prod_{a=0}^{j-1}\bigl(2W_0-2(A_0+a)I\bigr). ( − 1 ) A 0 ( − 2 ) j ( j W 0 − A 0 I ) = j ! ( − 1 ) A 0 + j a = 0 ∏ j − 1 ( 2 W 0 − 2 ( A 0 + a ) I ) .
Each matrix factor on the right is integral because 2 W 0 = Q I − ∑ s Π s 2W_0=QI-\sum_s\Pi_s 2 W 0 = Q I − ∑ s Π s . Also j ! j! j ! divides ( R − 1 ) ! (R-1)! ( R − 1 )! . Multiplication by the permutation matrix V 0 V_0 V 0 therefore shows that ( R − 1 ) ! M 0 (R-1)!M_0 ( R − 1 )! M 0 is integral. The coefficients of φ u , y \varphi_{u,y} φ u , y have denominators dividing ∏ s ∈ E u , y s \prod_{s\in E_{u,y}}s ∏ s ∈ E u , y s , which divides Q ! Q! Q ! . Equation (47) proves the asserted common denominator.
For the coefficient estimates, we use the matrix norm ∥ A ∥ ∞ = max i ∑ j ∣ A [ i , j ] ∣ \lVert A\rVert_\infty=\max_i\sum_j|A[i,j]| ∥ A ∥ ∞ = max i ∑ j ∣ A [ i , j ] ∣ and the polynomial norm ∥ ∑ j a j T j ∥ 1 = ∑ j ∣ a j ∣ \lVert\sum_j a_jT^j\rVert_1=\sum_j|a_j| ∥ ∑ j a j T j ∥ 1 = ∑ j ∣ a j ∣ . Since ∥ W 0 ∥ ∞ ≤ Q \lVert W_0\rVert_\infty\le Q ∥ W 0 ∥ ∞ ≤ Q and 0 ≤ A 0 + a ≤ Q 0\le A_0+a\le Q 0 ≤ A 0 + a ≤ Q for all factors above, each 2 W 0 − 2 ( A 0 + a ) I 2W_0-2(A_0+a)I 2 W 0 − 2 ( A 0 + a ) I has norm at most 4 Q 4Q 4 Q . It follows that
∥ M 0 ∥ ∞ ≤ R ( 4 Q ) R − 1 , ∥ φ u , y ∥ 1 ≤ ∏ s ∈ E u , y ( 1 + 1 / s ) ≤ 2 Q . \lVert M_0\rVert_\infty\le R(4Q)^{R-1},\qquad
\lVert\varphi_{u,y}\rVert_1\le\prod_{s\in E_{u,y}}(1+1/s)\le2^Q. ∥ M 0 ∥ ∞ ≤ R ( 4 Q ) R − 1 , ∥ φ u , y ∥ 1 ≤ s ∈ E u , y ∏ ( 1 + 1/ s ) ≤ 2 Q .
The sum of the absolute values of all coefficients in the row d d e n P ⃗ u d_{\mathrm{den}}\vec{P}_u d den P u is therefore at most
d d e n ( 1 + ( 1 + 2 Q ) R ( 4 Q ) R − 1 ) . d_{\mathrm{den}}\bigl(1+(1+2^Q)R(4Q)^{R-1}\bigr). d den ( 1 + ( 1 + 2 Q ) R ( 4 Q ) R − 1 ) .
Its logarithm is O ( Q log Q ) O(Q\log Q) O ( Q log Q ) because R < Q R<Q R < Q . For u = u f , v u=u_{f,v} u = u f , v , multiplication of d d e n P ⃗ u ( T ) d_{\mathrm{den}}\vec{P}_u(T) d den P u ( T ) by π c ( f , v ) \pi_{c(f,v)} π c ( f , v ) adds coefficients in common columns and discards unused columns. By (51) , the resulting row is d d e n P ⃗ f , v ( T ) d_{\mathrm{den}}\vec{P}_{f,v}(T) d den P f , v ( T ) , so it satisfies the same bound.
Enumerating the eigenbasis in Lemma 4.1 , evaluating f I ( W 0 ) f_I(W_0) f I ( W 0 ) , and forming the polynomials φ u , y \varphi_{u,y} φ u , y require poly ( D , Q , r ) \operatorname{poly}(D,Q,r) poly ( D , Q , r ) arithmetic operations. Using the common denominators above, the coefficients stored during these matrix and polynomial calculations have numerators and denominators with O ( Q log Q ) O(Q\log Q) O ( Q log Q ) bits. Thus the construction takes poly ( D , Q , r ) \operatorname{poly}(D,Q,r) poly ( D , Q , r ) bit operations. □
The construction has three quantitative requirements. The two inequalities in (50) bound the number of auxiliary copies and the number of actual variables in each group. The tail bound with ϵ = τ / ( r b ) \epsilon=\tau/(rb) ϵ = τ / ( r b ) gives the total measurement bound through (53) . We collect the result for use in the counting algorithm.
Lemma 4.7. Let n , b , w ≥ 1 n,b,w\ge1 n , b , w ≥ 1 be integers, and let ( I f ) f ∈ F (I_f)_{f\in\mathcal{F}} ( I f ) f ∈ F be subsets of [ n ] [n] [ n ] of size at most w w w , with each v ∈ [ n ] v\in[n] v ∈ [ n ] belonging to at most b b b sets. Put M = ∑ f ∣ I f ∣ M=\sum_f|I_f| M = ∑ f ∣ I f ∣ and assume n ≤ M ≤ b n n\le M\le bn n ≤ M ≤ bn . Let r ≥ 2 r\ge2 r ≥ 2 and 1 ≤ R < Q 1\le R<Q 1 ≤ R < Q be integers, let 0 < τ ≤ 1 / 2 0<\tau\le1/2 0 < τ ≤ 1/2 , and put D = r 2 Q D=r^{2Q} D = r 2 Q . Suppose
2 ( b + w ) D 2 ≤ M , 2 Q r 2 ≤ n , 2(b+w)D^2\le M,\qquad2Qr^2\le n, 2 ( b + w ) D 2 ≤ M , 2 Q r 2 ≤ n , and an interval I = { A 0 , … , A 0 + R − 1 } ⊆ { 0 , … , Q } \mathcal{I}=\{A_0,\ldots,A_0+R-1\}\subseteq\{0,\ldots,Q\} I = { A 0 , … , A 0 + R − 1 } ⊆ { 0 , … , Q } satisfies
Pr [ W ∉ I ] ≤ τ r b , W ∼ Bin ( Q , r − 1 2 r ) . \Pr[W\notin\mathcal{I}]\le\frac{\tau}{rb},\qquad W\sim\operatorname{Bin}\left(Q,\frac{r-1}{2r}\right). Pr [ W ∈ / I ] ≤ r b τ , W ∼ Bin ( Q , 2 r r − 1 ) .
One can deterministically construct all the data in Definition 3.1 in poly ( n , M , ∣ F ∣ , D , Q , r , b , w ) \operatorname{poly}(n, M, |\mathcal{F}|, D, Q, r, b, w) poly ( n , M , ∣ F ∣ , D , Q , r , b , w ) bit operations.
Proof. Lemma 4.1 constructs C B C^{B} C B with c B ≤ τ D / ( r b ) c_{B} \le\tau D/(rb) c B ≤ τ D / ( r b ) . Lemmas 4.2 and 4.3 give the auxiliary polynomial rows. Lemma 4.5 chooses the variable and factor groups with h D ≤ 2 M hD \le2M h D ≤ 2 M and ∣ S t , g ∣ ≤ 2 n / r |S_{t,g}| \le2n/r ∣ S t , g ∣ ≤ 2 n / r . The maps in (51) and (52) then give rows with P ⃗ f , v ( 0 ) = δ v \vec{P}_{f,v}(0)=\delta_{v} P f , v ( 0 ) = δ v , degree at most R − 1 ≤ R R-1\le R R − 1 ≤ R , and the required kernel implication. Every row of C t , g C_{t,g} C t , g has absolute row sum at most D D D , and (53) gives ∑ g = 1 r c t , g ≤ 2 τ n \sum_{g=1}^{r}c_{t,g}\le2\tau n ∑ g = 1 r c t , g ≤ 2 τ n for each t ∈ [ Q ] t\in[Q] t ∈ [ Q ] . Lemma 4.6 supplies the common denominator and coefficient bounds. Together, the constructions take poly ( n , M , ∣ F ∣ , D , Q , r , b , w ) \operatorname{poly}(n, M, |\mathcal{F}|, D, Q, r, b, w) poly ( n , M , ∣ F ∣ , D , Q , r , b , w ) bit operations, and the resulting arrays occupy poly ( n , M , ∣ F ∣ , D , Q , r , b , w ) \operatorname{poly}(n, M, |\mathcal{F}|, D, Q, r, b, w) poly ( n , M , ∣ F ∣ , D , Q , r , b , w ) bits. □
Choosing the parameters
In the application, both the largest scope w w w and the maximum number b b b of factors containing a variable will be bounded by a fixed power of log n \log n log n . We now choose parameters satisfying Lemma 4.7 in that regime. The exponent of the counting cost depends on the three quantities
R Q log 2 Q R , τ log ( 2 D + 1 ) , 1 r . \frac{R}{Q}\log\frac{2Q}{R},\qquad\tau\log(2D+1),\qquad\frac{1}{r}. Q R log R 2 Q , τ log ( 2 D + 1 ) , r 1 .
They account respectively for recovering Taylor coefficients, enumerating measurement values, and enumerating assignments in one group. The following choices bound all three at once.
Lemma 4.8. Fix an integer β ≥ 1 \beta\ge1 β ≥ 1 . Let n ≥ 20 n\ge20 n ≥ 20 , put λ = ⌈ log 2 n ⌉ \lambda=\lceil\log_{2}n\rceil λ = ⌈ log 2 n ⌉ and ν = ⌈ log 2 λ ⌉ \nu=\lceil\log_{2}\lambda\rceil ν = ⌈ log 2 λ ⌉ , and suppose b , w ≤ λ β b,w\le\lambda^{\beta} b , w ≤ λ β and n ≤ M ≤ b n n\le M\le bn n ≤ M ≤ bn . For all sufficiently large n n n , the parameters
r = ⌈ λ ν 2 ⌉ , Q = ⌈ λ 128 ν ⌉ , R = ( β + 3 ) ⌈ λ ⌉ , (54) r=\left\lceil\frac{\sqrt{\lambda}}{\nu^{2}}\right\rceil,\qquad
Q=\left\lceil\frac{\lambda}{128\nu}\right\rceil,\qquad
R=(\beta+3)\lceil\sqrt{\lambda}\rceil, \tag*{(54)} r = ⌈ ν 2 λ ⌉ , Q = ⌈ 128 ν λ ⌉ , R = ( β + 3 ) ⌈ λ ⌉ , (54) τ = 1 r λ , ϵ = 1 b r 2 λ , D = r 2 Q , \tau=\frac{1}{r\lambda},\qquad
\epsilon=\frac{1}{br^{2}\lambda},\qquad
D=r^{2Q}, τ = r λ 1 , ϵ = b r 2 λ 1 , D = r 2 Q , together with the interval specified in the proof, satisfy all numerical hypotheses of Lemma 4.7. They also satisfy
R ≥ 32 , 6 R ≤ Q , D ≤ 2 λ / 128 , R\ge32,\qquad6R\le Q,\qquad D\le2^{\lambda/128}, R ≥ 32 , 6 R ≤ Q , D ≤ 2 λ /128 , and
R Q log 2 Q R + τ log ( 2 D + 1 ) + 1 r = O β ( ν 2 λ ) . (55) \frac{R}{Q}\log\frac{2Q}{R}+\tau\log(2D+1)+\frac{1}{r}
=O_{\beta}\left(\frac{\nu^{2}}{\sqrt{\lambda}}\right). \tag*{(55)} Q R log R 2 Q + τ log ( 2 D + 1 ) + r 1 = O β ( λ ν 2 ) . (55) Given the numerical values n , M , b , w n,M,b,w n , M , b , w , the parameters and numerical hypotheses can be computed and checked exactly in poly β ( log n ) \operatorname{poly}_{\beta}(\log n) poly β ( log n ) bit operations. For fixed β \beta β , only finitely many n n n fail these checks.
Proof. For sufficiently large n n n , the parameters have orders
r = Θ ( λ ν 2 ) , Q = Θ ( λ ν ) , R = Θ β ( λ ) . r=\Theta\left(\frac{\sqrt{\lambda}}{\nu^{2}}\right),\qquad
Q=\Theta\left(\frac{\lambda}{\nu}\right),\qquad
R=\Theta_{\beta}(\sqrt{\lambda}). r = Θ ( ν 2 λ ) , Q = Θ ( ν λ ) , R = Θ β ( λ ) .
In particular, eventually r ≥ 2 r\ge2 r ≥ 2 , R ≥ 32 R\ge32 R ≥ 32 , and 6 R ≤ Q 6R\le Q 6 R ≤ Q . Since log 2 r ≤ ν / 2 \log_{2}r\le\nu/2 log 2 r ≤ ν /2 ,
log 2 D = 2 Q log 2 r ≤ 2 λ 128 ν ν 2 = λ 128 . \log_{2}D=2Q\log_{2}r\le2\frac{\lambda}{128\nu}\frac{\nu}{2}=\frac{\lambda}{128}. log 2 D = 2 Q log 2 r ≤ 2 128 ν λ 2 ν = 128 λ .
The two balance inequalities follow for sufficiently large n n n :
2 ( b + w ) D 2 ≤ 4 λ β 2 λ / 64 ≤ n ≤ M , 2 Q r 2 ≤ n . 2(b+w)D^{2}\le4\lambda^{\beta}2^{\lambda/64}\le n\le M,\qquad2Qr^{2}\le n. 2 ( b + w ) D 2 ≤ 4 λ β 2 λ /64 ≤ n ≤ M , 2 Q r 2 ≤ n .
For the second, Q , r Q,r Q , r are bounded by fixed powers of λ \lambda λ , whereas n > 2 λ − 1 n>2^{\lambda-1} n > 2 λ − 1 . The first follows from the same comparison.
Put
μ = Q ( r − 1 ) 2 r , A 0 = ⌈ μ − R − 1 2 ⌉ , I = { A 0 , … , A 0 + R − 1 } . \mu=\frac{Q(r-1)}{2r},\qquad
A_{0}=\left\lceil\mu-\frac{R-1}{2}\right\rceil,\qquad
\mathcal{I}=\{A_{0},\ldots,A_{0}+R-1\}. μ = 2 r Q ( r − 1 ) , A 0 = ⌈ μ − 2 R − 1 ⌉ , I = { A 0 , … , A 0 + R − 1 } .
Here Q / 4 ≤ μ ≤ Q / 2 Q/4 \le\mu\le Q/2 Q /4 ≤ μ ≤ Q /2 . Since R ≤ Q / 6 R \le Q/6 R ≤ Q /6 , the interval lies in { 0 , … , Q } \{0,\ldots,Q\} { 0 , … , Q } . Its center differs from μ \mu μ by less than one, and R ≥ 32 R \ge32 R ≥ 32 ensures that it contains every integer within R / 4 R/4 R /4 of μ \mu μ . For W ∼ Bin ( Q , ( r − 1 ) / ( 2 r ) ) W \sim\operatorname{Bin}(Q,(r-1)/(2r)) W ∼ Bin ( Q , ( r − 1 ) / ( 2 r )) , Hoeffding’s inequality gives
Pr [ W ∉ I ] ≤ 2 e − R 2 / ( 8 Q ) ≤ 2 e − 16 ( β + 3 ) 2 ν ≤ 2 − ( β + 2 ) ν ≤ λ − ( β + 2 ) ≤ 1 b r 2 λ . \Pr[W \notin\mathcal{I}] \le2e^{-R^2/(8Q)} \le2e^{-16(\beta+3)^2\nu} \le2^{-(\beta+2)\nu} \le\lambda^{-(\beta+2)} \le\frac{1}{br^2\lambda}. Pr [ W ∈ / I ] ≤ 2 e − R 2 / ( 8 Q ) ≤ 2 e − 16 ( β + 3 ) 2 ν ≤ 2 − ( β + 2 ) ν ≤ λ − ( β + 2 ) ≤ b r 2 λ 1 .
The last inequality uses b ≤ λ β b \le\lambda^\beta b ≤ λ β and r 2 ≤ λ r^2 \le\lambda r 2 ≤ λ . This proves (45) with ϵ = τ / ( r b ) \epsilon=\tau/(rb) ϵ = τ / ( r b ) . Also 0 < τ ≤ 1 / 2 0<\tau\le1/2 0 < τ ≤ 1/2 once r ≥ 2 r\ge2 r ≥ 2 .
Finally,
R Q = O β ( ν / λ ) , log ( 2 Q / R ) = O ( ν ) , τ log ( 2 D + 1 ) = O ( 1 / r ) . \frac{R}{Q}=O_\beta(\nu/\sqrt{\lambda}),\qquad\log(2Q/R)=O(\nu),\qquad\tau\log(2D+1)=O(1/r). Q R = O β ( ν / λ ) , log ( 2 Q / R ) = O ( ν ) , τ log ( 2 D + 1 ) = O ( 1/ r ) .
Together with 1 / r = O ( ν 2 / λ ) 1/r=O(\nu^2/\sqrt{\lambda}) 1/ r = O ( ν 2 / λ ) , these prove (55) .
We finish by showing that the parameters in (54) can be constructed exactly within the stated bit bound. The algorithm finds λ = ⌈ log 2 n ⌉ \lambda=\lceil\log_2 n\rceil λ = ⌈ log 2 n ⌉ as the least integer with n ≤ 2 λ n\le2^\lambda n ≤ 2 λ , and then finds ν = ⌈ log 2 λ ⌉ \nu=\lceil\log_2\lambda\rceil ν = ⌈ log 2 λ ⌉ in the same way. It obtains r r r as the largest integer satisfying r 2 ν 4 ≤ λ r^2\nu^4\le\lambda r 2 ν 4 ≤ λ , computes Q Q Q by integer division, and finds ⌈ λ ⌉ \lceil\sqrt{\lambda}\rceil ⌈ λ ⌉ by an integer square-root search to obtain R R R . If r < 2 r<2 r < 2 or Q ≤ R Q\le R Q ≤ R , the algorithm reports failure at this stage. Otherwise it constructs τ , ϵ , D \tau,\epsilon,D τ , ϵ , D and the endpoints of I \mathcal{I} I using integer or rational arithmetic. It then checks I ⊆ { 0 , … , Q } \mathcal{I}\subseteq\{0,\ldots,Q\} I ⊆ { 0 , … , Q } , the two balance inequalities, R ≥ 32 R\ge32 R ≥ 32 , and 6 R ≤ Q 6R\le Q 6 R ≤ Q . The tail probability in (45) has denominator ( 2 r ) Q (2r)^Q ( 2 r ) Q , so its required bound can also be checked by integer arithmetic. These computations take poly β ( log n ) \operatorname{poly}_\beta(\log n) poly β ( log n ) bit operations. The preceding estimates show that all checks pass for sufficiently large n n n . □
Counting common zeros of sparse polynomial equations
We now prove Theorem 2.2. The input is a system P \mathcal{P} P of m t e s t ≤ c n m_{\mathrm{test}}\le cn m test ≤ c n polynomial equations P i ( x ) = 0 P_i(x)=0 P i ( x ) = 0 over F 2 \mathbb{F}_2 F 2 in n n n Boolean variables. Each P i P_i P i is a list of at most ( log n ) c (\log n)^c ( log n ) c monomials of degree at most k k k , for fixed k , c k,c k , c . Our target is the integer
N ( P ) = # { x ∈ { 0 , 1 } n : P i ( x ) = 0 for every i } . (56) N(\mathcal{P})=\#\{x\in\{0,1\}^n:P_i(x)=0\text{ for every }i\}. \tag*{(56)} N ( P ) = # { x ∈ { 0 , 1 } n : P i ( x ) = 0 for every i } . (56)
First we build a product with one factor per equation whose value on the Boolean cube records the common-zero indicator. The difficulty is keeping its total input degree linear in n n n . Next we construct the replacement forms for these factors and use § 3 to sum the product. § 6 uses the resulting algorithm for arbitrary supplied systems, including systems that still accept nonsatisfying assignments of a formula.
An integer polynomial for one equation
On Boolean inputs we may replace each positive power x v j x_v^j x v j by x v x_v x v . Combine duplicate monomials modulo two. If M i \mathcal{M}_i M i is the resulting list of variable sets for P i P_i P i , define its integer lift by
L i ( X ⃗ ) = ∑ M ∈ M i ∏ v ∈ M X v . L_i(\vec{X})=\sum_{M\in\mathcal{M}_i}\prod_{v\in M}X_v. L i ( X ) = M ∈ M i ∑ v ∈ M ∏ X v .
The empty monomial is 1 1 1 and the empty sum is 0 0 0 . The value L i ( x ) L_i(x) L i ( x ) counts the monomials equal to one, so P i ( x ) = 0 P_i(x)=0 P i ( x ) = 0 precisely when L i ( x ) L_i(x) L i ( x ) is even. Write I i = ⋃ M ∈ M i M I_i=\bigcup_{M\in\mathcal{M}_i}M I i = ⋃ M ∈ M i M . Although L i L_i L i can read k ( log n ) c k(\log n)^c k ( log n ) c variables, it still has degree at most k k k .
Set ℓ = n + 1 \ell=n+1 ℓ = n + 1 . Since 0 ≤ N ( P ) ≤ 2 n < 2 ℓ 0\le N(\mathcal{P})\le2^n<2^\ell 0 ≤ N ( P ) ≤ 2 n < 2 ℓ , it suffices to obtain its residue modulo 2 ℓ 2^\ell 2 ℓ . We first represent the evenness indicator by an integer polynomial modulo this power of two. Multiplying m t e s t m_{\mathrm{test}} m test such indicators directly would give only a quadratic degree bound; the form of the next lemma will let us control the degree across all equations together.
Put h ( Y ) = Y ( Y − 1 ) h(Y)=Y(Y-1) h ( Y ) = Y ( Y − 1 ) . Its value is even at every integer Y Y Y . Writing the indicator in powers of h h h exposes one factor of two for each copy of h h h in the product.
Lemma 5.1. For every integer ℓ ≥ 1 \ell\ge1 ℓ ≥ 1 , one can construct polynomials e 0 , … , e ℓ − 1 ∈ Z [ Y ] e_0,\ldots,e_{\ell-1} \in\mathbb{Z}[Y] e 0 , … , e ℓ − 1 ∈ Z [ Y ] , each of degree at most one, such that
p ℓ ( Y ) = ∑ j = 0 ℓ − 1 e j ( Y ) h ( Y ) j , p ℓ ( y ) ≡ 1 { 2 ∣ y } ( m o d 2 ℓ ) ( y ∈ Z ) . (57) p_{\ell}(Y)=\sum_{j=0}^{\ell-1}e_j(Y)h(Y)^j,\qquad p_{\ell}(y)\equiv1_{\{2\mid y\}}\pmod{2^\ell}\quad(y\in\mathbb{Z}). \tag*{(57)} p ℓ ( Y ) = j = 0 ∑ ℓ − 1 e j ( Y ) h ( Y ) j , p ℓ ( y ) ≡ 1 { 2 ∣ y } ( mod 2 ℓ ) ( y ∈ Z ) . (57) The coefficients of the e j e_j e j have poly ( ℓ ) \operatorname{poly}(\ell) poly ( ℓ ) bits, and the construction uses poly ( ℓ ) \operatorname{poly}(\ell) poly ( ℓ ) bit operations and poly ( ℓ ) \operatorname{poly}(\ell) poly ( ℓ ) bits of space.
Proof. Let F ℓ F_\ell F ℓ be the modulus-amplifying polynomial of Beigel and Tarui [12 Section 2.3] . Chan and Williams apply F ℓ F_\ell F ℓ to sums of clause-violation indicators to count satisfying assignments deterministically [22 Theorem 2.5 and proof of Theorem 1.6] . We need the indicator of even parity, so we take its complement:
p ℓ ( Y ) = 1 − F ℓ ( Y ) = ( 1 − Y ) ℓ ∑ j = 0 ℓ − 1 ( ℓ + j − 1 j ) Y j . (58) p_{\ell}(Y)=1-F_{\ell}(Y)=(1-Y)^\ell\sum_{j=0}^{\ell-1}\binom{\ell+j-1}{j}Y^j. \tag*{(58)} p ℓ ( Y ) = 1 − F ℓ ( Y ) = ( 1 − Y ) ℓ j = 0 ∑ ℓ − 1 ( j ℓ + j − 1 ) Y j . (58) The finite sum is the inverse of ( 1 − Y ) ℓ (1-Y)^\ell ( 1 − Y ) ℓ modulo Y ℓ Y^\ell Y ℓ . Indeed, the coefficient of Y j Y^j Y j in ( 1 + Y + Y 2 + ⋯ ) ℓ (1+Y+Y^2+\cdots)^\ell ( 1 + Y + Y 2 + ⋯ ) ℓ counts weak compositions of j j j into ℓ \ell ℓ parts and equals ( ℓ + j − 1 j ) \binom{\ell+j-1}{j} ( j ℓ + j − 1 ) . Therefore
p ℓ ( Y ) ≡ 1 ( m o d Y ℓ ) , p ℓ ( Y ) ≡ 0 ( m o d ( 1 − Y ) ℓ ) . p_{\ell}(Y)\equiv1\pmod{Y^\ell},\qquad p_{\ell}(Y)\equiv0\pmod{(1-Y)^\ell}. p ℓ ( Y ) ≡ 1 ( mod Y ℓ ) , p ℓ ( Y ) ≡ 0 ( mod ( 1 − Y ) ℓ ) . For even y y y , the first congruence gives p ℓ ( y ) ≡ 1 ( m o d 2 ℓ ) p_{\ell}(y)\equiv1\pmod{2^\ell} p ℓ ( y ) ≡ 1 ( mod 2 ℓ ) . For odd y y y , the second gives p ℓ ( y ) ≡ 0 ( m o d 2 ℓ ) p_{\ell}(y)\equiv0\pmod{2^\ell} p ℓ ( y ) ≡ 0 ( mod 2 ℓ ) .
The polynomial p ℓ p_{\ell} p ℓ has integer coefficients and degree less than 2 ℓ 2\ell 2 ℓ . Successive division by the monic quadratic h = Y 2 − Y h=Y^2-Y h = Y 2 − Y writes it uniquely as ∑ j < ℓ e j h j \sum_{j<\ell}e_jh^j ∑ j < ℓ e j h j , with integer remainders e j e_j e j of degree less than two. Lemma B.1 in Appendix B bounds their coefficients and proves the poly ( ℓ ) \operatorname{poly}(\ell) poly ( ℓ ) bit-operation bound for this construction. □
Keeping the product degree linear
The full product ∏ i = 1 m t e s t p ℓ ( L i ( X ⃗ ) ) \prod_{i=1}^{m_{\mathrm{test}}}p_{\ell}(L_i(\vec{X})) ∏ i = 1 m test p ℓ ( L i ( X )) has degree at most k m t e s t ( 2 ℓ − 1 ) km_{\mathrm{test}}(2\ell-1) k m test ( 2 ℓ − 1 ) . Each factor h ( y ) h(y) h ( y ) contributes a factor of two at integer arguments, so a term containing at least ℓ \ell ℓ such factors can be discarded modulo 2 ℓ 2^\ell 2 ℓ . This lets us retain only terms whose total power of h h h is less than ℓ \ell ℓ , across all equations together. Introduce a formal variable V V V to record that power, using the same V V V for every equation. Its exponent records a guaranteed power of two dividing the corresponding term at integer arguments. It is not an additional Boolean variable to be summed over. This is where we choose the coefficient algebra of § 3.1 :
A ℓ = Q [ V ] / ( V ℓ ) . \mathcal{A}_{\ell}=\mathbb{Q}[V]/(V^\ell). A ℓ = Q [ V ] / ( V ℓ ) .
In this algebra every multiplication discards powers V s V^s V s with s ≥ ℓ s\ge\ell s ≥ ℓ . Once the product is formed, we add its retained coefficients using the linear map
S ℓ ( ∑ s = 0 ℓ − 1 b s V s ) = ∑ s = 0 ℓ − 1 b s . S_{\ell}\left(\sum_{s=0}^{\ell-1}b_sV^s\right)=\sum_{s=0}^{\ell-1}b_s. S ℓ ( s = 0 ∑ ℓ − 1 b s V s ) = s = 0 ∑ ℓ − 1 b s .
This map need not preserve products, so it is applied only after the factors have been multiplied. We use the same notation for polynomial coefficients b s b_s b s .
Lemma 5.2. Let m t e s t ≥ 0 m_{\mathrm{test}}\ge0 m test ≥ 0 and ℓ ≥ 1 \ell\ge1 ℓ ≥ 1 be integers. For integers y 1 , … , y m t e s t y_1,\ldots,y_{m_{\mathrm{test}}} y 1 , … , y m test , put
B i ( V ) = ∑ j = 0 ℓ − 1 e j ( y i ) h ( y i ) j V j . B_i(V)=\sum_{j=0}^{\ell-1}e_j(y_i)h(y_i)^jV^j. B i ( V ) = j = 0 ∑ ℓ − 1 e j ( y i ) h ( y i ) j V j . Then
S ℓ ( ∏ i = 1 m t e s t B i ( V ) m o d V ℓ ) ≡ ∏ i = 1 m t e s t 1 { 2 ∣ y i } ( m o d 2 ℓ ) . S_{\ell}\left(\prod_{i=1}^{m_{\mathrm{test}}}B_i(V)\bmod V^\ell\right)\equiv\prod_{i=1}^{m_{\mathrm{test}}}1_{\{2\mid y_i\}}\pmod{2^\ell}. S ℓ ( i = 1 ∏ m test B i ( V ) mod V ℓ ) ≡ i = 1 ∏ m test 1 { 2 ∣ y i } ( mod 2 ℓ ) .
For any nonnegative integer d ∗ d_* d ∗ , if the y i y_i y i are instead polynomials over Q \mathbb{Q} Q of total degree at most d ∗ d_* d ∗ , then each retained coefficient of V s V^s V s , and hence their sum, has total input degree at most d ∗ ( m t e s t + 2 ( ℓ − 1 ) ) d_*(m_{\mathrm{test}}+2(\ell-1)) d ∗ ( m test + 2 ( ℓ − 1 )) .
Proof. Before truncation, a term contributing to the coefficient of V s V^s V s has the form
∏ i = 1 m t e s t e j i ( y i ) h ( y i ) j i , ∑ i = 1 m t e s t j i = s . \prod_{i=1}^{m_{\mathrm{test}}}e_{j_i}(y_i)h(y_i)^{j_i},\qquad\sum_{i=1}^{m_{\mathrm{test}}}j_i=s. i = 1 ∏ m test e j i ( y i ) h ( y i ) j i , i = 1 ∑ m test j i = s .
At integer arguments it is divisible by 2 s 2^s 2 s . Dropping every coefficient with s ≥ ℓ s\geq\ell s ≥ ℓ therefore leaves the sum of coefficients unchanged modulo 2 ℓ 2^\ell 2 ℓ . Without truncation, that sum is ∏ i p ℓ ( y i ) \prod_i p_\ell(y_i) ∏ i p ℓ ( y i ) , which has the required congruence by Lemma 5.1. For polynomial arguments, every retained term has ∑ i j i ≤ ℓ − 1 \sum_i j_i\leq\ell-1 ∑ i j i ≤ ℓ − 1 . Since deg e j i ≤ 1 \deg e_{j_i}\leq1 deg e j i ≤ 1 and deg h = 2 \deg h=2 deg h = 2 , its degree is at most
∑ i = 1 m t e s t d ∗ ( 1 + 2 j i ) ≤ d ∗ ( m t e s t + 2 ( ℓ − 1 ) ) . \sum_{i=1}^{m_{\mathrm{test}}}d_*(1+2j_i)\leq d_*(m_{\mathrm{test}}+2(\ell-1)). i = 1 ∑ m test d ∗ ( 1 + 2 j i ) ≤ d ∗ ( m test + 2 ( ℓ − 1 )) .
The bound holds coefficient by coefficient, as well as for their sum. □
To see why the truncation uses the total order across all equations, take ℓ = 2 \ell=2 ℓ = 2 . Then
p 2 ( Y ) = 1 − 3 Y 2 + 2 Y 3 = ( 1 − Y ) + ( 2 Y − 1 ) h ( Y ) . p_2(Y)=1-3Y^2+2Y^3=(1-Y)+(2Y-1)h(Y). p 2 ( Y ) = 1 − 3 Y 2 + 2 Y 3 = ( 1 − Y ) + ( 2 Y − 1 ) h ( Y ) .
For two equations, multiplication modulo V 2 V^2 V 2 , followed by S 2 S_2 S 2 , retains
( 1 − y 1 ) ( 1 − y 2 ) + ( 2 y 1 − 1 ) h ( y 1 ) ( 1 − y 2 ) + ( 1 − y 1 ) ( 2 y 2 − 1 ) h ( y 2 ) . (1-y_1)(1-y_2)+(2y_1-1)h(y_1)(1-y_2)+(1-y_1)(2y_2-1)h(y_2). ( 1 − y 1 ) ( 1 − y 2 ) + ( 2 y 1 − 1 ) h ( y 1 ) ( 1 − y 2 ) + ( 1 − y 1 ) ( 2 y 2 − 1 ) h ( y 2 ) .
Its degree is at most four. The omitted term ( 2 y 1 − 1 ) ( 2 y 2 − 1 ) h ( y 1 ) h ( y 2 ) (2y_1-1)(2y_2-1)h(y_1)h(y_2) ( 2 y 1 − 1 ) ( 2 y 2 − 1 ) h ( y 1 ) h ( y 2 ) has degree six, but is divisible by four at integer inputs.
Counting with supplied replacement forms
For equation i i i supply § 3 with the factor
B i ( ( X v ) v ∈ I i , V ) = ∑ j = 0 ℓ − 1 e j ( L i ( X ⃗ ) ) h ( L i ( X ⃗ ) ) j V j in A ℓ [ ( X v ) v ∈ I i ] . (59) B_i((X_v)_{v\in I_i},V)=\sum_{j=0}^{\ell-1}e_j(L_i(\vec{X}))h(L_i(\vec{X}))^jV^j\quad\text{in }A_\ell[(X_v)_{v\in I_i}]. \tag*{(59)} B i (( X v ) v ∈ I i , V ) = j = 0 ∑ ℓ − 1 e j ( L i ( X )) h ( L i ( X ) ) j V j in A ℓ [( X v ) v ∈ I i ] . (59)
Within a factor, every occurrence of X v X_v X v uses the same replacement form; different factors may use different forms for X v X_v X v . Even if each factor receives its own independent inputs, L i L_i L i has degree at most k k k in those inputs. Lemma 5.2 bounds the input degree of the product in A ℓ A_\ell A ℓ by d = k ( m t e s t + 2 ( ℓ − 1 ) ) d=k(m_{\mathrm{test}}+2(\ell-1)) d = k ( m test + 2 ( ℓ − 1 )) . Thus the product satisfies precisely the degree hypothesis (23) of the common routine. Adding factors equal to one with scope { v } \{v\} { v } ensures that all declared variables occur in the construction.
Let H ( T ) ∈ A ℓ [ T ] H(T)\in A_\ell[T] H ( T ) ∈ A ℓ [ T ] be (24) for these factors. Its V V V -coefficients at T = 0 T=0 T = 0 are integers because all replacements restore their Boolean inputs at zero. By the same lemma, summing their values gives
deg T H ≤ d H : = k R ( m t e s t + 2 ( ℓ − 1 ) ) , S ℓ ( H ( 0 ) ) ≡ N ( P ) ( m o d 2 ℓ ) . (60) \deg_T H\leq d_H:=kR(m_{\mathrm{test}}+2(\ell-1)),\qquad S_\ell(H(0))\equiv N(\mathcal{P})\pmod{2^\ell}. \tag*{(60)} deg T H ≤ d H := k R ( m test + 2 ( ℓ − 1 )) , S ℓ ( H ( 0 )) ≡ N ( P ) ( mod 2 ℓ ) . (60)
Consequently the least nonnegative residue of S ℓ ( H ( 0 ) ) S_\ell(H(0)) S ℓ ( H ( 0 )) is the exact count. Interpolation takes place over the rationals; the congruence is needed only on Boolean inputs at T = 0 T=0 T = 0 .
Cost of evaluating the factors
Proposition 5.3. Let a list of degree-at-most-k k k polynomial equations on n n n variables and a design satisfying Definition 3.1 for their factors be given. Let S ≥ 1 S\geq1 S ≥ 1 bound the total length of the monomial lists and factor scopes, and use any ℓ \ell ℓ with 2 ℓ > 2 n 2^\ell>2^n 2 ℓ > 2 n . With d H d_H d H from (60) and q , J q,J q , J from (26) , N ( P ) N(\mathcal{P}) N ( P ) can be computed deterministically in
poly ( n , m t e s t , ℓ , D , Q , R , J , r , k , S ) C q ( 2 D + 1 ) 2 r n 2 n / r \operatorname{poly}(n,m_{\mathrm{test}},\ell,D,Q,R,J,r,k,S)\,C_q(2D+1)^{2^r n}2^{n/r} poly ( n , m test , ℓ , D , Q , R , J , r , k , S ) C q ( 2 D + 1 ) 2 r n 2 n / r bit operations and poly ( n , m t e s t , ℓ , D , Q , R , J , r , k , S ) \operatorname{poly}(n,m_{\mathrm{test}},\ell,D,Q,R,J,r,k,S) poly ( n , m test , ℓ , D , Q , R , J , r , k , S ) bits of working space.
Proof. Apply Proposition 3.4 with coefficients in A ℓ \mathcal{A}_{\ell} A ℓ . At an evaluation point t t t , the routine uses A ℓ [ z ] / ( z ℓ ) \mathcal{A}_{\ell}[z]/(z^{\ell}) A ℓ [ z ] / ( z ℓ ) , so a stored element has just J ℓ J\ell J ℓ rational coefficients. To evaluate factor i i i at a fixed Boolean substitution X ⃗ = 1 U \vec{X} = \mathbf{1}_{U} X = 1 U in (28) , first evaluate each listed monomial by multiplying its at most k k k substituted inputs, then add the results to get L i L_i L i . Use this value in (59) , successively multiplying by h ( L i ) h(L_i) h ( L i ) to obtain its powers. This takes polynomially many rational operations in the displayed parameters and never enumerates assignments to the entire scope I i I_i I i . The polynomials e j e_j e j are computed once by Lemma 5.1.
For bit complexity, the rows have common denominator d d e n = ( R − 1 ) ! Q ! d_{\mathrm{den}}=(R-1)!Q! d den = ( R − 1 )! Q ! . Each substituted monomial has denominator dividing Δ = d d e n k \Delta=d_{\mathrm{den}}^k Δ = d den k , every lifted factor has denominator dividing Γ = Δ 2 ℓ − 1 \Gamma=\Delta^{2\ell-1} Γ = Δ 2 ℓ − 1 , and their product has denominator dividing Ω = Γ m t e s t \Omega=\Gamma^{m_{\mathrm{test}}} Ω = Γ m test . Thus exponentially many summands can be accumulated over one denominator. Appendix § 8 bounds the bit lengths in these sums by
B s u m = poly ( n , m t e s t , ℓ , k , Q , log ( D + 2 ) , log ( S + 2 ) ) . (61) B_{\mathrm{sum}}=\operatorname{poly}(n,m_{\mathrm{test}},\ell,k,Q,\log(D+2),\log(S+2)). \tag*{(61)} B sum = poly ( n , m test , ℓ , k , Q , log ( D + 2 ) , log ( S + 2 )) . (61)
For each 0 ≤ s < ℓ 0\le s<\ell 0 ≤ s < ℓ we interpolate the rational polynomial [ V s ] H ( T ) [V^s]H(T) [ V s ] H ( T ) from its Q J QJ Q J Taylor coefficients. The appendix verifies polynomial bit cost for this interpolation and the final integer remainder in (60) . The O ( Q J ℓ ) O(QJ\ell) O ( Q J ℓ ) stored coefficients, the design and the sequential enumerations in Proposition 3.4 give the stated space bound. □
Constructing the forms and completing the proof
Each sparse polynomial reads few variables, but one variable might occur in many equations. We first fix the values of the few variables with the largest numbers of occurrences. On each resulting branch we can construct the design required by Proposition 5.3.
Proof of Theorem 2.2 . Let P P P be the supplied polynomial system. An empty list of equations gives 2 n 2^n 2 n common zeros; a constant equation 1 = 0 1=0 1 = 0 gives none. Discard equations 0 = 0 0=0 0 = 0 . Include a neutral factor equal to one with scope { v } \{v\} { v } for each declared variable v v v , and write
M = ∑ f ∈ F ∣ I f ∣ M=\sum_{f\in\mathcal{F}} |I_f| M = f ∈ F ∑ ∣ I f ∣
for the total number of factor–variable incidences. The input bounds imply M = n ( log n ) O k , c ( 1 ) M=n(\log n)^{O_{k,c}(1)} M = n ( log n ) O k , c ( 1 ) , and every scope has ( log n ) O k , c ( 1 ) (\log n)^{O_{k,c}(1)} ( log n ) O k , c ( 1 ) variables. A particular variable, however, may occur in many of these scopes.
Put λ = ⌈ log 2 n ⌉ \lambda=\lceil\log_2 n\rceil λ = ⌈ log 2 n ⌉ and
b 0 = ⌈ M n ⌉ ⌈ λ ⌉ . b_0=\left\lceil\frac{M}{n}\right\rceil\left\lceil\sqrt{\lambda}\right\rceil. b 0 = ⌈ n M ⌉ ⌈ λ ⌉ .
Let S ⊆ [ n ] S\subseteq[n] S ⊆ [ n ] be the variables belonging to more than b 0 b_0 b 0 scopes. For each b ∈ { 0 , 1 } S b\in\{0,1\}^{S} b ∈ { 0 , 1 } S , we fix x ∣ S = b x|_{S}=b x ∣ S = b and count the completions on [ n ] ∖ S [n]\setminus S [ n ] ∖ S ; we call this restricted problem a branch. Since ∣ S ∣ ≤ M / b 0 ≤ n / λ |S|\le M/b_0\le n/\sqrt{\lambda} ∣ S ∣ ≤ M / b 0 ≤ n / λ , there are at most 2 n / λ 2^{n/\sqrt{\lambda}} 2 n / λ branches. Each branch has the same number n ′ n' n ′ of free variables, with
n ′ ≥ n − n λ ≥ n 2 ( n ≥ 20 ) . n'\ge n-\frac{n}{\sqrt{\lambda}}\ge\frac{n}{2}\qquad(n\ge20). n ′ ≥ n − λ n ≥ 2 n ( n ≥ 20 ) .
Substitute the fixed bits in every P i P_i P i over F 2 \mathbb{F}_2 F 2 and combine duplicate monomials modulo two before forming its integer lift. Neither degree nor the number of monomials increases. A constant equation can again be handled immediately. The branches partition the Boolean cube, so their common-zero counts add to N ( P ) \mathcal{N}(P) N ( P ) .
To apply § 4 , remove the fixed variables from the scopes and relabel the free variables by [ n ′ ] [n'] [ n ′ ] . Write I f ′ ⊆ [ n ′ ] I'_f\subseteq[n'] I f ′ ⊆ [ n ′ ] for the restricted scopes and M ′ = ∑ f ∣ I f ′ ∣ M'=\sum_f|I'_f| M ′ = ∑ f ∣ I f ′ ∣ for their total incidence count. Let b b b be the maximum factor incidence of a free variable and let w = max f ∣ I f ′ ∣ w=\max_f|I'_f| w = max f ∣ I f ′ ∣ . Then b ≤ b 0 b\le b_0 b ≤ b 0 , and both b b b and w w w are bounded by a fixed power of log n ′ \log n' log n ′ . The remaining neutral factors ensure M ′ ≥ n ′ M'\ge n' M ′ ≥ n ′ . Set
λ ′ = ⌈ log 2 n ′ ⌉ , ν ′ = ⌈ log 2 λ ′ ⌉ , \lambda'=\lceil\log_2 n'\rceil,\qquad\nu'=\lceil\log_2\lambda'\rceil, λ ′ = ⌈ log 2 n ′ ⌉ , ν ′ = ⌈ log 2 λ ′ ⌉ ,
and choose the smallest integer β ≥ 1 \beta\ge1 β ≥ 1 with b , w ≤ ( λ ′ ) β b,w \le(\lambda')^\beta b , w ≤ ( λ ′ ) β . For fixed k , c k,c k , c , the possible values of β \beta β are bounded by a constant for all sufficiently large n n n . We apply Lemma 4.8 to the restricted scopes ( I f ′ ) (I'_f) ( I f ′ ) on [ n ′ ] [n'] [ n ′ ] , with incidence count M ′ M' M ′ , using
r = ⌈ λ ′ ( ν ′ ) 2 ⌉ , Q = ⌈ λ ′ 128 ν ′ ⌉ , R = ( β + 3 ) ⌈ λ ′ ⌉ . r=\left\lceil\frac{\sqrt{\lambda'}}{(\nu')^2}\right\rceil,\qquad Q=\left\lceil\frac{\lambda'}{128\nu'}\right\rceil,\qquad R=(\beta+3)\lceil\sqrt{\lambda'}\rceil. r = ⌈ ( ν ′ ) 2 λ ′ ⌉ , Q = ⌈ 128 ν ′ λ ′ ⌉ , R = ( β + 3 ) ⌈ λ ′ ⌉ .
If r < 2 r<2 r < 2 or Q ≤ R Q\le R Q ≤ R , use the exhaustive-search fallback below before forming τ \tau τ , ϵ \epsilon ϵ , or the parity interpolation interval I \mathcal{I} I . Otherwise set
τ = 1 r λ ′ , ϵ = 1 b r 2 λ ′ , D = r 2 Q , \tau=\frac{1}{r\lambda'},\qquad\epsilon=\frac{1}{br^2\lambda'},\qquad D=r^{2Q}, τ = r λ ′ 1 , ϵ = b r 2 λ ′ 1 , D = r 2 Q ,
and carry out the remaining feasibility checks from that lemma. For all sufficiently large n n n , Lemma 4.7 supplies the required rows and measurement matrices, with
r = Θ ( log n ′ ( log log n ′ ) 2 ) , Q = Θ ( log n ′ log log n ′ ) , R = O k , c ( log n ′ ) , D ≤ ( 2 n ′ ) 1 / 128 . r=\Theta\left(\frac{\sqrt{\log n'}}{(\log\log n')^2}\right),\qquad Q=\Theta\left(\frac{\log n'}{\log\log n'}\right),\qquad R=O_{k,c}(\sqrt{\log n'}),\qquad D\le(2n')^{1/128}. r = Θ ( ( log log n ′ ) 2 log n ′ ) , Q = Θ ( log log n ′ log n ′ ) , R = O k , c ( log n ′ ) , D ≤ ( 2 n ′ ) 1/128 .
On every branch we may use the original precision ℓ = n + 1 \ell=n+1 ℓ = n + 1 , since even the unrestricted count is smaller than 2 ℓ 2^\ell 2 ℓ . As n ′ ≥ n / 2 n'\ge n/2 n ′ ≥ n /2 , both ℓ \ell ℓ and m t e s t m_{\mathrm{test}} m test are O c ( n ′ ) O_c(n') O c ( n ′ ) . Thus d H = O k , c ( n ′ R ) d_H=O_{k,c}(n'R) d H = O k , c ( n ′ R ) , J = O k , c ( n ′ R / Q ) + 1 J=O_{k,c}(n'R/Q)+1 J = O k , c ( n ′ R / Q ) + 1 , and (37) , in dimension n ′ n' n ′ , has exponent
O k , c ( n ′ ( log log n ′ ) 2 log n ′ ) = O k , c ( n ( log log n ) 2 log n ) . O_{k,c}\left(\frac{n'(\log\log n')^2}{\sqrt{\log n'}}\right)=O_{k,c}\left(\frac{n(\log\log n)^2}{\sqrt{\log n}}\right). O k , c ( log n ′ n ′ ( log log n ′ ) 2 ) = O k , c ( log n n ( log log n ) 2 ) .
All substitution data, coefficient arrays, and interpolation systems have total representation length n O k , c ( 1 ) n^{O_{k,c}(1)} n O k , c ( 1 ) bits. Multiplying the per-branch running time by at most 2 n / λ 2^{n/\sqrt{\lambda}} 2 n / λ leaves the displayed exponential bound unchanged, so summing the branch answers gives the required running time.
To implement the construction for every input size, the algorithm checks its numerical hypotheses using integer arithmetic. In addition to the preliminary guards above, it checks 2 ( b + w ) D 2 ≤ M ′ 2(b+w)D^2\le M' 2 ( b + w ) D 2 ≤ M ′ and 2 Q r 2 ≤ n ′ 2Qr^2\le n' 2 Q r 2 ≤ n ′ from Lemma 4.5 , the endpoints of I \mathcal{I} I , R ≥ 32 R\ge32 R ≥ 32 , 6 R ≤ Q 6R\le Q 6 R ≤ Q , and the binomial tail bound in (45) , which can be tested exactly. If any check fails, the algorithm abandons the branched computation and checks the original equations directly on all 2 n 2^n 2 n assignments. For fixed k , c k,c k , c , the bounds just proved and Lemma 4.8 show that a failure can occur only for finitely many n n n . This fallback is therefore absorbed in the theorem’s constants.
To combine the branch counts within the stated space bound, we process the branches one at a time. We initialize an integer accumulator Z = 0 Z=0 Z = 0 and add each branch’s answer to it. The construction and Proposition 5.3 use n O k , c ( 1 ) n^{O_{k,c}(1)} n O k , c ( 1 ) bits of space on each branch. Disjointness gives 0 ≤ Z ≤ 2 n 0\le Z\le2^n 0 ≤ Z ≤ 2 n throughout, and the final value is N ( P ) N(P) N ( P ) , as claimed. □
Reducing #k-SAT to counting common zeros
Given a sparse k k k -CNF F F F with at most B n Bn B n clauses, where B B B is polylogarithmic in n n n , we construct O ( n ) O(n) O ( n ) sparse polynomial equations on its original n n n variables whose common zeros are exactly its satisfying assignments. One equation per clause could require B n Bn B n equations. Instead, each equation will test the parity of the violations of a short list of clauses. We use Theorem 2.2 both to choose these equations and to obtain the final count.
Let m m m be the number of indexed clauses and v e ( x ) v_e(x) v e ( x ) the violation bit of clause e e e . As a polynomial over F 2 \mathbb{F}_2 F 2 , v e v_e v e is a product of the factors 1 + x v 1+x_v 1 + x v for positive literals and x v x_v x v for negative literals. A tautological clause has v e = 0 v_e=0 v e = 0 and an empty clause has v e = 1 v_e=1 v e = 1 . After removing repeated literals, deg v e ≤ k \deg v_e\le k deg v e ≤ k and v e v_e v e expands to at most 2 k 2^k 2 k monomials. Put v ( x ) = ( v 1 ( x ) , … , v m ( x ) ) v(x)=(v_1(x),\ldots,v_m(x)) v ( x ) = ( v 1 ( x ) , … , v m ( x )) . For a binary matrix A A A with m m m columns, row i i i specifies the equation
P i ( x ) : = ∑ e : A i e = 1 v e ( x ) = 0 over F 2 . (62) P_i(x):=\sum_{e:A_{ie}=1}v_e(x)=0\quad\text{over }\mathbb{F}_2. \tag*{(62)} P i ( x ) := e : A i e = 1 ∑ v e ( x ) = 0 over F 2 . (62)
Write P A \mathcal{P}_A P A for this system and N ( A ) = N ( P A ) N(A)=N(\mathcal{P}_A) N ( A ) = N ( P A ) for its number of common zeros. Every satisfying assignment passes every row. Hence N ( A ) = # F + D ( A ) N(A)=\#F+D(A) N ( A ) = # F + D ( A ) , where D ( A ) D(A) D ( A ) counts the nonsatisfying assignments still passing. We do not know # F \#F # F , but it is the same for every candidate next row: the row minimizing N N N also minimizes D D D .
We represent a test row by a list of pairs ( e , c ) (e,c) ( e , c ) with e ∈ [ m ] e\in[m] e ∈ [ m ] and c ∈ { 0 , 1 } c\in\{0,1\} c ∈ { 0 , 1 } , summing coefficients modulo 2 if a clause index is repeated. The length of this list counts all pairs, including repeated indices and pairs with coefficient zero. A row of list length s s s thus reads at most k s ks k s variables before cancellation.
Initial tests that exclude small violation sets
If an assignment violates only one of many clauses, a test sampling a short list of clauses is unlikely to notice it. We therefore first construct a matrix A ( 0 ) A^{(0)} A ( 0 ) that rejects every nonzero violation vector with small support. Every nonsatisfying assignment that passes these initial tests must violate many clauses. A further test that samples a short list of clauses can then reject each such assignment with constant probability.
We use the standard edge-based Tanner code: bits are assigned to the edges of an expander, and the bits incident to each vertex must form a word of a prescribed local linear code (see Tanner [63 Section II] for the local constraints and Sipser and Spielman [62 Sections IV and VI] for the expander construction). The usual local-distance and expansion argument gives the needed lower bound on the weight of a nonzero codeword. The proof below constructs the graph and local code deterministically, with parameters that meet our bounds on the number and length of the tests.
Lemma 6.1. Let n n n , m m m , B B B be positive integers with m ≤ B n m\le Bn m ≤ B n , and put
μ = ⌊ log 2 m ⌋ + 1 , P = 20000 B 2 μ 2 , D 0 = 320000 B 2 μ 3 . \mu=\lfloor\log_{2}m\rfloor+1,\qquad P=20000B^{2}\mu^{2},\qquad D_{0}=320000B^{2}\mu^{3}. μ = ⌊ log 2 m ⌋ + 1 , P = 20000 B 2 μ 2 , D 0 = 320000 B 2 μ 3 . There is a deterministic construction of a binary matrix A ( 0 ) A^{(0)} A ( 0 ) with m m m columns and at most 3 n 3n 3 n rows such that every row has at most D 0 D_{0} D 0 nonzero entries and
z ∈ { 0 , 1 } m ∖ { 0 ⃗ } , A ( 0 ) z = 0 ⃗ ( m o d 2 ) ⟹ ∣ supp z ∣ ≥ m / P . z\in\{0,1\}^{m}\setminus\{\vec{0}\},\qquad A^{(0)}z=\vec{0}\pmod2\quad\Longrightarrow\quad|\operatorname{supp}z|\ge m/P. z ∈ { 0 , 1 } m ∖ { 0 } , A ( 0 ) z = 0 ( mod 2 ) ⟹ ∣ supp z ∣ ≥ m / P . The construction uses exp ( poly ( B , log ( m + 2 ) ) ) \exp(\operatorname{poly}(B,\log(m+2))) exp ( poly ( B , log ( m + 2 ))) bit operations and poly ( n , m , B ) \operatorname{poly}(n,m,B) poly ( n , m , B ) bits of working space.
Proof. We construct a bipartite graph with between m m m and 2 m 2m 2 m edges, using its edges as temporary binary coordinates. Checks at each vertex will force every vertex touched by a nonzero edge to have many nonzero incident edges; a mixing bound will then force large total weight. At the end, we keep m m m edge coordinates and fix the rest to zero. Let
d G = min ( m , D 0 ) , q G = min { 2 a : a ∈ Z ≥ 0 , 2 a d G ≥ m } . d_G=\min(m,D_0),\qquad q_G=\min\{2^a:a\in\mathbb{Z}_{\ge0},\ 2^a d_G\ge m\}. d G = min ( m , D 0 ) , q G = min { 2 a : a ∈ Z ≥ 0 , 2 a d G ≥ m } .
Then m ≤ q G d G < 2 m m\le q_Gd_G<2m m ≤ q G d G < 2 m . Write q G = 2 ℓ G q_G=2^{\ell_G} q G = 2 ℓ G and take two copies of { 0 , 1 } ℓ G \{0,1\}^{\ell_G} { 0 , 1 } ℓ G as the vertex sets. For each left vertex u u u and each port j ∈ [ d G ] j\in[d_G] j ∈ [ d G ] , put an edge from u u u to u ⊕ s j u\oplus s_j u ⊕ s j , where ⊕ \oplus ⊕ denotes bitwise addition modulo 2 and the shifts s 1 , … , s d G ∈ { 0 , 1 } ℓ G s_1,\ldots,s_{d_G}\in\{0,1\}^{\ell_G} s 1 , … , s d G ∈ { 0 , 1 } ℓ G will be chosen below. Edges are indexed by the pairs ( u , j ) (u,j) ( u , j ) ; parallel edges remain distinct. Every vertex on either side has one incident edge at each port j j j , so the graph is d G d_G d G -regular.
To obtain the mixing estimate (64) , we choose the shifts so that every parity of a nonempty set of coordinates is nearly balanced. For a nonzero vector b ∈ { 0 , 1 } ℓ G b\in\{0,1\}^{\ell_G} b ∈ { 0 , 1 } ℓ G , the bit b ⋅ s j b\cdot s_j b ⋅ s j mod 2 is the parity of those coordinates of s j s_j s j where b b b equals 1. With ε = 1 / ( 200 B μ ) \varepsilon=1/(200B\mu) ε = 1/ ( 200 B μ ) , we require
∣ ∑ j = 1 d G ( − 1 ) b ⋅ s j ∣ ≤ ε d G ( b ∈ { 0 , 1 } ℓ G ∖ { 0 ⃗ } ) . (63) \left|\sum_{j=1}^{d_G}(-1)^{b\cdot s_j}\right|\le\varepsilon d_G\qquad\left(b\in\{0,1\}^{\ell_G}\setminus\{\vec{0}\}\right). \tag*{(63)} j = 1 ∑ d G ( − 1 ) b ⋅ s j ≤ ε d G ( b ∈ { 0 , 1 } ℓ G ∖ { 0 } ) . (63)
The sum in (63) is the number of indices j j j with even parity minus the number with odd parity. Thus, for every nonzero b b b , each parity occurs at a fraction of indices between ( 1 − ε ) / 2 (1-\varepsilon)/2 ( 1 − ε ) /2 and $(1+\varepsilon)/2. A list of shifts with this property is called ε \varepsilon ε -biased [52 Definitions 2.1–2.2] .
If q G = 1 q_G=1 q G = 1 , there is no condition to check. Otherwise d G = D 0 d_G=D_0 d G = D 0 . To show that suitable shifts exist, we choose them independently and uniformly at random. For each fixed nonzero b b b , the signs ( − 1 ) b ⋅ s j (-1)^{b\cdot s_j} ( − 1 ) b ⋅ s j are independent and uniform in { − 1 , 1 } \{-1,1\} { − 1 , 1 } . Hoeffding’s inequality bounds the probability of violating (63) for this b b b by 2 exp ( − ε 2 d G / 2 ) 2\exp(-\varepsilon^2d_G/2) 2 exp ( − ε 2 d G /2 ) . A union bound over b b b gives total failure probability at most
2 q G exp ( − ε 2 d G / 2 ) = 2 q G exp ( − 4 μ ) < 1 , 2q_G\exp(-\varepsilon^2d_G/2)=2q_G\exp(-4\mu)<1, 2 q G exp ( − ε 2 d G /2 ) = 2 q G exp ( − 4 μ ) < 1 ,
where q G < 2 m < 2 μ + 1 q_G<2m<2^{\mu+1} q G < 2 m < 2 μ + 1 . Exhaustively enumerating the shift tuples and checking (63) therefore finds a valid tuple in exp ( O ( d G log ( m + 2 ) ) ) \exp(O(d_G\log(m+2))) exp ( O ( d G log ( m + 2 ))) time.
We next derive the mixing estimate from (63) . Let A G A_G A G be the q G × q G q_G\times q_G q G × q G matrix with A G [ u , v ] = ∣ { j ∈ [ d G ] : u ⊕ s j = v } ∣ A_G[u,v]=|\{j\in[d_G]:u\oplus s_j=v\}| A G [ u , v ] = ∣ { j ∈ [ d G ] : u ⊕ s j = v } ∣ ; its entries count edges from left vertices u u u to right vertices v v v . Both sides have the same index set { 0 , 1 } ℓ G \{0,1\}^{\ell_G} { 0 , 1 } ℓ G , on which the functions χ b ( u ) = ( − 1 ) b ⋅ u \chi_b(u)=(-1)^{b\cdot u} χ b ( u ) = ( − 1 ) b ⋅ u form an orthogonal basis. For every b , u ∈ { 0 , 1 } ℓ G b,u\in\{0,1\}^{\ell_G} b , u ∈ { 0 , 1 } ℓ G ,
( A G χ b ) ( u ) = ∑ j = 1 d G χ b ( u ⊕ s j ) = χ b ( u ) ∑ j = 1 d G ( − 1 ) b ⋅ s j . (A_G\chi_b)(u)=\sum_{j=1}^{d_G}\chi_b(u\oplus s_j)=\chi_b(u)\sum_{j=1}^{d_G}(-1)^{b\cdot s_j}. ( A G χ b ) ( u ) = j = 1 ∑ d G χ b ( u ⊕ s j ) = χ b ( u ) j = 1 ∑ d G ( − 1 ) b ⋅ s j .
Thus each χ b \chi_b χ b is an eigenvector: the constant function χ 0 ⃗ \chi_{\vec0} χ 0 has eigenvalue d G d_G d G , while (63) bounds all other eigenvalues in absolute value by ε d G \varepsilon d_G ε d G . For sets U U U of left vertices and V V V of right vertices, let e G ( U , V ) e_G(U,V) e G ( U , V ) count the edges between them, including multiplicity. Decomposing the indicator vectors of U , V U,V U , V into their constant and orthogonal parts and applying Cauchy–Schwarz gives
e G ( U , V ) ≤ d G ∣ U ∣ ∣ V ∣ q G + ε d G ∣ U ∣ ∣ V ∣ . (64) e_G(U,V)\le\frac{d_G|U||V|}{q_G}+\varepsilon d_G\sqrt{|U||V|}. \tag*{(64)} e G ( U , V ) ≤ q G d G ∣ U ∣∣ V ∣ + ε d G ∣ U ∣∣ V ∣ . (64)
To specify the local code, we put
c G = ⌈ d G 8 B ⌉ , δ = 1 100 B μ . c_G=\left\lceil\frac{d_G}{8B}\right\rceil,\qquad\delta=\frac{1}{100B\mu}. c G = ⌈ 8 B d G ⌉ , δ = 100 B μ 1 .
We need a binary matrix A l o c A_{\mathrm{loc}} A loc with c G c_G c G rows and d G d_G d G columns such that every nonzero word in its kernel modulo 2 2 2 has weight at least δ d G \delta d_G δ d G . To prove that such a matrix exists, we consider a matrix whose entries are independent uniform bits. For each fixed nonzero word, one of its nonzero coordinates makes the parity in each row uniform; independence of the rows therefore gives probability 2 − c G 2^{-c_G} 2 − c G that the word lies in the kernel. Set h = ⌈ δ d G ⌉ − 1 h=\lceil\delta d_G\rceil-1 h = ⌈ δ d G ⌉ − 1 . If h = 0 h=0 h = 0 , there are no nonzero words of weight less than δ d G \delta d_G δ d G . Otherwise their number is at most
∑ j = 1 h ( d G j ) ≤ ( h + 1 ) ( 2 d G ) h ≤ ( 2 d G ) 2 h < 2 d G / ( 25 B ) . \sum_{j=1}^{h}\binom{d_G}{j}\le(h+1)(2d_G)^h\le(2d_G)^{2h}<2^{d_G/(25B)}. j = 1 ∑ h ( j d G ) ≤ ( h + 1 ) ( 2 d G ) h ≤ ( 2 d G ) 2 h < 2 d G / ( 25 B ) .
For the last inequality, use h < δ d G h<\delta d_G h < δ d G , d G ≤ m < 2 μ d_G\le m<2^\mu d G ≤ m < 2 μ , and μ + 1 ≤ 2 μ \mu+1\le2\mu μ + 1 ≤ 2 μ . Since c G ≥ d G / ( 8 B ) c_G\ge d_G/(8B) c G ≥ d G / ( 8 B ) , a union bound shows that a suitable A l o c A_{\mathrm{loc}} A loc exists. Enumerating the 2 c G d G 2^{c_Gd_G} 2 c G d G binary matrices and testing all words of weight less than δ d G \delta d_G δ d G finds one in exp ( poly ( B , log ( m + 2 ) ) ) \exp(\operatorname{poly}(B,\log(m+2))) exp ( poly ( B , log ( m + 2 ))) bit operations.
At every vertex on both sides, impose the c G c_G c G rows of A l o c A_{\mathrm{loc}} A loc on its incident edge coordinates, ordered by their ports. These constraints define a Tanner code with local code C l o c = ker F 2 A l o c C_{\mathrm{loc}}=\ker_{\mathbb{F}_2}A_{\mathrm{loc}} C loc = ker F 2 A loc . Its incidence graph has one bit node for every edge of our graph and one local-code node for every vertex; each bit participates in the constraints at its two endpoints. Consider a nonzero edge word accepted by all these checks. Let U , V U,V U , V be the vertices touched by its nonzero edges on the two sides, and let h ′ h' h ′ be its weight. Each vertex in U ∪ V U\cup V U ∪ V is incident to at least δ d G \delta d_G δ d G nonzero edges, so h ′ ≥ δ d G max ( ∣ U ∣ , ∣ V ∣ ) h'\ge\delta d_G\max(|U|,|V|) h ′ ≥ δ d G max ( ∣ U ∣ , ∣ V ∣ ) . Therefore
δ d G ∣ U ∣ ∣ V ∣ ≤ h ′ ≤ e G ( U , V ) ≤ d G ∣ U ∣ ∣ V ∣ q G + ε d G ∣ U ∣ ∣ V ∣ . \delta d_G\sqrt{|U||V|}\le h'\le e_G(U,V)\le\frac{d_G|U||V|}{q_G}+\varepsilon d_G\sqrt{|U||V|}. δ d G ∣ U ∣∣ V ∣ ≤ h ′ ≤ e G ( U , V ) ≤ q G d G ∣ U ∣∣ V ∣ + ε d G ∣ U ∣∣ V ∣ .
Both U U U and V V V are nonempty. Dividing by d G ∣ U ∣ ∣ V ∣ d_G\sqrt{|U||V|} d G ∣ U ∣∣ V ∣ yields ∣ U ∣ ∣ V ∣ ≥ ( δ − ε ) q G \sqrt{|U||V|}\ge(\delta-\varepsilon)q_G ∣ U ∣∣ V ∣ ≥ ( δ − ε ) q G , and hence
h ′ ≥ δ ( δ − ε ) q G d G = q G d G 20000 B 2 μ 2 ≥ m P . h'\ge\delta(\delta-\varepsilon)q_Gd_G=\frac{q_Gd_G}{20000B^2\mu^2}\ge\frac{m}{P}. h ′ ≥ δ ( δ − ε ) q G d G = 20000 B 2 μ 2 q G d G ≥ P m .
Shorten this Tanner code by keeping any m m m of the q G d G q_Gd_G q G d G edge coordinates, identifying them with [ m ] [m] [ m ] , and setting the remaining coordinates to zero. Restricting all the vertex checks to the retained coordinates gives A ( 0 ) A^{(0)} A ( 0 ) . Any word accepted by A ( 0 ) A^{(0)} A ( 0 ) extends by zeros to an accepted edge word, so it has the required weight. Every row has at most d G ≤ D 0 d_G \le D_0 d G ≤ D 0 nonzero entries. There are 2 q G c G 2q_Gc_G 2 q G c G rows. If q G = 1 q_G=1 q G = 1 , then d G = m d_G=m d G = m and
2 c G ≤ m 4 B + 2 ≤ n 4 + 2 ≤ 3 n . 2c_G \le\frac{m}{4B}+2 \le\frac{n}{4}+2 \le3n. 2 c G ≤ 4 B m + 2 ≤ 4 n + 2 ≤ 3 n .
If q G > 1 q_G>1 q G > 1 , then d G = D 0 ≥ 8 B d_G=D_0\ge8B d G = D 0 ≥ 8 B , and
2 q G c G ≤ q G d G 4 B + 2 q G ≤ q G d G 2 B < m B ≤ n . 2q_Gc_G \le\frac{q_Gd_G}{4B}+2q_G \le\frac{q_Gd_G}{2B}<\frac{m}{B}\le n. 2 q G c G ≤ 4 B q G d G + 2 q G ≤ 2 B q G d G < B m ≤ n .
The searches over shifts, local matrices, and test words are sequential. Storing the current choices and the final rows uses poly ( n , m , B ) \operatorname{poly}(n,m,B) poly ( n , m , B ) bits of working space. □
Choosing additional equations by counting common zeros
After the initial checks, every nonsatisfying assignment still passing violates at least m / P m/P m / P clauses. This lets a short random test catch each such assignment with constant probability. To make the choice deterministic we use the averaging principle underlying conditional expectations [55 ] .
Lemma 6.2. With P P P , D 0 D_0 D 0 and A ( 0 ) A^{(0)} A ( 0 ) from Lemma 6.1 , a deterministic procedure appends 3 n 3n 3 n rows of list length P P P and obtains a matrix A A A with N ( A ) = # F N(A)=\#F N ( A ) = # F . It uses at most 3 n ( 2 m ) P 3n(2m)^P 3 n ( 2 m ) P common-zero counts. Every candidate system has at most 6 n 6n 6 n equations, each involving at most 2 k max ( D 0 , P ) 2^k\max(D_0,P) 2 k max ( D 0 , P ) monomials of degree at most k k k .
Proof. At a stage with current matrix A A A , enumerate the ordered lists
γ = ( ( e 1 , c 1 ) , … , ( e P , c P ) ) ∈ C : = ( [ m ] × { 0 , 1 } ) P . \gamma=((e_1,c_1),\ldots,(e_P,c_P))\in C:=([m]\times\{0,1\})^P. γ = (( e 1 , c 1 ) , … , ( e P , c P )) ∈ C := ([ m ] × { 0 , 1 } ) P .
The list γ \gamma γ represents the binary row h γ h_\gamma h γ with
( h γ ) e = ( ∑ j : e j = e c j ) m o d 2 ( e ∈ [ m ] ) . (h_\gamma)_e=\left(\sum_{j:e_j=e}c_j\right)\bmod2 \qquad(e\in[m]). ( h γ ) e = j : e j = e ∑ c j mod 2 ( e ∈ [ m ]) .
There are ( 2 m ) P (2m)^P ( 2 m ) P lists; distinct lists are still counted separately when they represent the same row. Write A ; h γ A;h_\gamma A ; h γ for the matrix obtained by appending h γ h_\gamma h γ to A A A .
Fix a nonsatisfying assignment x x x accepted by A A A . The initial rows remain in A A A , so ∣ supp v ( x ) ∣ ≥ m / P |\operatorname{supp}v(x)|\ge m/P ∣ supp v ( x ) ∣ ≥ m / P . For a uniform list γ \gamma γ , the probability that none of e 1 , … , e P e_1,\ldots,e_P e 1 , … , e P belongs to this support is at most
( 1 − 1 / P ) P ≤ e − 1 < 1 / 2. (1-1/P)^P\le e^{-1}<1/2. ( 1 − 1/ P ) P ≤ e − 1 < 1/2.
Conditional on the indices hitting the support, choose one hit position j j j . After fixing every coefficient except c j c_j c j , the uniform bit c j c_j c j makes h γ ⋅ v ( x ) h_\gamma\cdot v(x) h γ ⋅ v ( x ) uniform modulo 2 2 2 . This remains true when some clause indices are repeated. Thus, for each such x x x , at least a quarter of the candidate lists give a row that rejects x x x .
Summing this bound over the nonsatisfying assignments still passing, we find
E γ D ( A ; h γ ) ≤ 3 4 D ( A ) . \mathbb{E}_{\gamma}D(A;h_\gamma)\le\frac{3}{4}D(A). E γ D ( A ; h γ ) ≤ 4 3 D ( A ) .
For every candidate, compute N ( A ; h γ ) N(A;h_\gamma) N ( A ; h γ ) by counting the common zeros of its polynomial system. Append a candidate attaining the minimum, breaking ties by enumeration order. Since N ( A ; h γ ) = # F + D ( A ; h γ ) N(A;h_\gamma)=\#F+D(A;h_\gamma) N ( A ; h γ ) = # F + D ( A ; h γ ) for every γ \gamma γ , the chosen row leaves at most 3 4 D ( A ) \frac{3}{4}D(A) 4 3 D ( A ) nonsatisfying assignments. After 3 n 3n 3 n rounds at most ( 3 / 4 ) 3 n 2 n = ( 27 / 32 ) n < 1 (3/4)^{3n}2^n=(27/32)^n<1 ( 3/4 ) 3 n 2 n = ( 27/32 ) n < 1 remain; their number is an integer, so it is zero. The procedure runs for a fixed number of rounds and never needs to know D ( A ) D(A) D ( A ) or # F \#F # F .
The initial matrix has at most 3 n 3n 3 n rows, and every candidate is evaluated with at most 3 n 3n 3 n additional rows. A row listing s s s clauses expands, by (62) , to at most 2 k s 2^ks 2 k s monomials on the original variables; duplicates cancel over F 2 \mathbb{F}_2 F 2 . These observations give the claimed size and query bounds. □
Counting one sparse formula
Suppose n ≥ 20 n \ge20 n ≥ 20 and 1 ≤ m ≤ B n 1 \le m \le Bn 1 ≤ m ≤ B n , where B B B is bounded by a fixed power of log n \log n log n depending only on k k k . Construct the initial matrix by Lemma 6.1 . This uses exp ( ( log n ) O k ( 1 ) ) \exp((\log n)^{O_k(1)}) exp (( log n ) O k ( 1 ) ) bit operations and polynomial space. Both P P P and D 0 D_0 D 0 are ( log n ) O k ( 1 ) (\log n)^{O_k(1)} ( log n ) O k ( 1 ) , so every candidate in Lemma 6.2 is an instance of Theorem 2.2 with a single fixed c = c ( k ) c=c(k) c = c ( k ) . This applies to discarded candidates as well as the final system: the counter requires only the number, degree and sparsity of the equations. Expanding each row and combining monomials costs polynomial time and space for fixed k k k .
At most 3 n ( 2 m ) P + 1 = exp ( ( log n ) O k ( 1 ) ) 3n(2m)^P+1=\exp((\log n)^{O_k(1)}) 3 n ( 2 m ) P + 1 = exp (( log n ) O k ( 1 ) ) calls suffice, including one final count. Each call takes 2 O k ( n ( log log n ) 2 / log n ) 2^{O_k(n(\log\log n)^2/\sqrt{\log n})} 2 O k ( n ( l o g l o g n ) 2 / l o g n ) bit operations. Since any fixed power of log n \log n log n is o ( n ( log log n ) 2 / log n ) o(n(\log\log n)^2/\sqrt{\log n}) o ( n ( log log n ) 2 / log n ) , the total time, including construction and candidate comparisons, is
( n + m ) O k ( 1 ) 2 O k ( n ( log log n ) 2 / log n ) . (65) (n+m)^{O_k(1)}2^{O_k(n(\log\log n)^2/\sqrt{\log n})}. \tag*{(65)} ( n + m ) O k ( 1 ) 2 O k ( n ( l o g l o g n ) 2 / l o g n ) . (65)
The final count is # F \#F # F by the greedy lemma. A formula with no clauses or containing an empty clause is handled directly. Candidates are examined sequentially; only the current rows, a candidate, the best row and its count need be kept in addition to the counter’s polynomial working space.
Returning to a general formula
We use disjoint sparsification to partition the satisfying assignments among sparse formulas on the same n n n declared variables. The preceding algorithm counts each of these formulas. The parameter σ \sigma σ controls a tradeoff: making it smaller reduces the number of formulas but increases their occurrence bound B B B . Our solver permits B B B to grow as a fixed power of log n \log n log n , so we can let σ \sigma σ tend to zero while keeping both the number of formulas and the cost per formula within the desired time bound.
Lemma 6.3. Fix k ≥ 2 k \ge2 k ≥ 2 . Given a k k k -CNF on n n n declared variables with m m m clauses and a rational 0 < σ ≤ 1 0<\sigma\le1 0 < σ ≤ 1 , a deterministic algorithm constructs a tree of k k k -CNFs on the same variables. Let L σ L_\sigma L σ be the total binary encoding length of the supplied numerator and denominator of σ \sigma σ . An assignment satisfies the input exactly when it satisfies one leaf formula, and it cannot satisfy two distinct leaves. The tree has
poly k ( n , σ − 1 ) 2 σ n \operatorname{poly}_k(n,\sigma^{-1})\,2^{\sigma n} poly k ( n , σ − 1 ) 2 σ n nodes and depth poly k ( n , σ − 1 ) \operatorname{poly}_k(n,\sigma^{-1}) poly k ( n , σ − 1 ) . In every leaf, each variable occurs at most B B B times, where B B B is an explicitly computed integer satisfying
B = O k ( [ σ − 1 log ( 2 / σ ) ] k − 1 ) . B=O_k\left(\left[\sigma^{-1}\log(2/\sigma)\right]^{k-1}\right). B = O k ( [ σ − 1 log ( 2/ σ ) ] k − 1 ) . Input normalization uses poly k ( n , m ) \operatorname{poly}_k(n,m) poly k ( n , m ) bit operations. Constructing the numerical parameters uses poly k ( L σ ) \operatorname{poly}_k(L_\sigma) poly k ( L σ ) bit operations. Thereafter, processing each node uses poly k ( n , log ( 2 / σ ) ) \operatorname{poly}_k(n,\log(2/\sigma)) poly k ( n , log ( 2/ σ )) bit operations. The input count is the sum of the leaf counts.
Appendix § 7 proves the lemma, including the disjointness that justifies adding the leaf counts.
Proposition 6.4. For each fixed k ≥ 2 k\ge2 k ≥ 2 , the interpolation algorithm counts the satisfying assignments of a k k k -CNF on n ≥ 20 n\ge20 n ≥ 20 declared variables with m m m clauses in ( n + m ) O k ( 1 ) 2 O k ( ρ ( n ) ) (n+m)^{O_k(1)}2^{O_k(\rho(n))} ( n + m ) O k ( 1 ) 2 O k ( ρ ( n )) bit operations and ( n + m ) O k ( 1 ) (n+m)^{O_k(1)} ( n + m ) O k ( 1 ) bits of space.
Proof. We first normalize the input in ( n + m ) O k ( 1 ) (n+m)^{O_k(1)} ( n + m ) O k ( 1 ) time by deleting repeated literals, tautological clauses, duplicate clauses, and clauses containing another clause. We retain all n n n declared variables. An empty clause gives count zero, and a formula with no clauses gives count 2 n 2^n 2 n . We handle n < 20 n<20 n < 20 by exhaustive search. For n ≥ 20 n\ge20 n ≥ 20 , we next select the sparsification parameter. Define
λ n = ⌈ log 2 n ⌉ , ν n = ⌈ log 2 λ n ⌉ , s = ⌊ λ n ν n 2 ⌋ . \lambda_n=\lceil\log_2 n\rceil,\qquad\nu_n=\lceil\log_2\lambda_n\rceil,\qquad s=\left\lfloor\frac{\sqrt{\lambda_n}}{\nu_n^2}\right\rfloor. λ n = ⌈ log 2 n ⌉ , ν n = ⌈ log 2 λ n ⌉ , s = ⌊ ν n 2 λ n ⌋ .
We compute s s s by integer comparisons, taking the largest nonnegative integer satisfying s 2 ν n 4 ≤ λ n s^2\nu_n^4\le\lambda_n s 2 ν n 4 ≤ λ n . If s < 2 s<2 s < 2 , we use exhaustive search; λ n / ν n 2 \sqrt{\lambda_n}/\nu_n^2 λ n / ν n 2 tends to infinity, so there are only finitely many such sizes. Otherwise we apply Lemma 6.3 with σ = 1 / s \sigma= 1/s σ = 1/ s . The tree has at most 2 n / s poly k ( n , s ) 2^{n/s}\operatorname{poly}_k(n,s) 2 n / s poly k ( n , s ) nodes, and its leaves have occurrence bound
B = O k ( ( s log s ) k − 1 ) = ( log n ) O k ( 1 ) . B = O_k\left((s\log s)^{k-1}\right) = (\log n)^{O_k(1)}. B = O k ( ( s log s ) k − 1 ) = ( log n ) O k ( 1 ) .
Each leaf uses the original n n n variables and has at most B n Bn B n nonempty clauses. We count each leaf by the sparse-formula algorithm of § 6.3 , whose running time is given by (65) . Leaves with no clauses or containing an empty clause are handled directly. The clause count in that application is the number of clauses in the leaf; m m m in the final bound remains the input clause count.
For s ≥ 2 s \ge2 s ≥ 2 , the floor in its definition gives
n s = O ( n n λ 2 λ n ) = O ( ρ ( n ) ) . \frac{n}{s} = O\left(\frac{n\sqrt{n_\lambda^2}}{\sqrt{\lambda_n}}\right) = O(\rho(n)). s n = O ( λ n n n λ 2 ) = O ( ρ ( n )) .
Thus both the number of leaves and the time to count each leaf have exponent O k ( ρ ( n ) ) O_k(\rho(n)) O k ( ρ ( n )) . Their polynomial factors, together with normalization and the work at the tree nodes, are bounded by ( n + m ) O k ( 1 ) (n+m)^{O_k(1)} ( n + m ) O k ( 1 ) . The total number of bit operations is therefore
( n + m ) O k ( 1 ) 2 O k ( ρ ( n ) ) . (n+m)^{O_k(1)}2^{O_k(\rho(n))}. ( n + m ) O k ( 1 ) 2 O k ( ρ ( n )) .
The finite exhaustive-search cases are absorbed in the constants. All parameters, initial checks, and additional rows are computed by the deterministic procedures above; every counting query uses the common-zero algorithm of Theorem 2.2.
To bound the space used by the full algorithm, we traverse the sparsification tree depth first and count one leaf at a time. The current path has poly k ( n , s ) \operatorname{poly}_k(n,s) poly k ( n , s ) nodes, and each normalized formula has a poly k ( n ) \operatorname{poly}_k(n) poly k ( n ) -bit encoding. Since s ≤ ⌈ log 2 n ⌉ s \le\lceil\sqrt{\log_2 n}\rceil s ≤ ⌈ log 2 n ⌉ , storing this path and counting one leaf use poly k ( n , m ) \operatorname{poly}_k(n,m) poly k ( n , m ) bits. Disjointness keeps the sum of the processed leaf counts between zero and 2 n 2^n 2 n , so its accumulator uses at most n + 1 n+1 n + 1 bits. Thus the total space is poly k ( n , m ) \operatorname{poly}_k(n,m) poly k ( n , m ) bits. □
Appendix A. Partitioning the satisfying assignments
Fix k ≥ 2 k \ge2 k ≥ 2 and a rational 0 < σ ≤ 1 0 < \sigma\le1 0 < σ ≤ 1 . We prove Lemma 6.3 by repeatedly splitting a formula into two cases. Both children use the same n n n variables, and every satisfying assignment of the parent satisfies exactly one child. We follow the rule for choosing a shared set of literals and the insertion accounting of [19 Section 6] . The refinement that makes the two cases disjoint is standard in exact counting [28 Appendix A] .
Throughout this appendix, a clause is a set of literals and denotes their disjunction. Its width is the number of literals it contains. We delete tautological clauses, repeated clauses, and clauses containing another clause. Thus the remaining clauses form an antichain under inclusion. We keep all n n n declared variables and do not propagate unit clauses. An empty clause gives count zero, and the empty formula gives count 2 n 2^n 2 n .
A.1. The branching rule. Fix an integer M ≥ 2 M \ge2 M ≥ 2 . We will obtain an occurrence bound B = O k ( M k − 1 ) B = O_k(M^{k-1}) B = O k ( M k − 1 ) at every leaf, then choose M M M so that the tree has at most poly k ( n , σ − 1 ) 2 σ n \operatorname{poly}_k(n,\sigma^{-1})2^{\sigma n} poly k ( n , σ − 1 ) 2 σ n nodes. Put
θ j = M j ( 0 ≤ j < k ) . \theta_j = M^j \qquad(0 \le j < k). θ j = M j ( 0 ≤ j < k ) .
Writing F F F for the current family of clauses, define
deg c ( H ) = # { C ∈ F : ∣ C ∣ = c , H ⊆ C } \operatorname{deg}_c(H) = \#\{C \in F : |C| = c,\ H \subseteq C\} deg c ( H ) = # { C ∈ F : ∣ C ∣ = c , H ⊆ C }
for each literal set H H H . We branch whenever a nonempty proper subset H H H of a width-c c c clause satisfies
deg c ( H ) ≥ θ c − ∣ H ∣ . (66) \operatorname{deg}_c(H) \ge\theta_{c-|H|}. \tag*{(66)} deg c ( H ) ≥ θ c − ∣ H ∣ . (66)
The algorithm chooses the smallest possible c c c , and then the largest possible ∣ H ∣ |H| ∣ H ∣ ; break any remaining ties deterministically. Thus a nonempty shared literal set H H H leaving j = c − ∣ H ∣ j = c - |H| j = c − ∣ H ∣ other literals must occur in at least M j M^j M j clauses before we branch on it. Let H ∪ P 1 , … , H ∪ P z H \cup P_1,\ldots,H \cup P_z H ∪ P 1 , … , H ∪ P z be all the width-c c c clauses containing the chosen H H H , and let G G G consist of the other clauses. Put j = c − ∣ H ∣ j=c-|H| j = c − ∣ H ∣ . Here P a P_a P a is the set of literals left after removing H H H from the a a a th selected clause, so each P a P_a P a has width j j j and z ≥ θ j z \ge\theta_j z ≥ θ j . The two children are
F A = G ∧ H , F B = G ∧ ⋀ a = 1 z P a ∧ ⋀ ℓ ∈ H { ¬ ℓ } . (67) F_A=G\wedge H,\qquad F_B=G\wedge\bigwedge_{a=1}^{z}P_a\wedge\bigwedge_{\ell\in H}\{\neg\ell\}. \tag*{(67)} F A = G ∧ H , F B = G ∧ a = 1 ⋀ z P a ∧ ℓ ∈ H ⋀ { ¬ ℓ } . (67)
We restore the antichain condition in each child by removing clauses made redundant by its new clauses. The sets P a P_a P a may overlap. The satisfying assignments of the children are disjoint: F A F_A F A requires some literal of H H H to be true, whereas F B F_B F B requires every literal of H H H to be false.
Lemma A.1. The children in (A.2) partition the satisfying assignments of their parent. Every new clause has width less than c c c . The A A A -child inserts one new clause, and the B B B -child inserts at least θ j \theta_j θ j new clauses of width j j j . All newly inserted clauses survive the immediate normalization. Every old clause removed in either child contains a newly inserted strict subset.
Proof. Every assignment satisfies exactly one of the conditions some literal of H H H is true and every literal of H H H is false. In the first case, all selected clauses are satisfied, leaving G ∧ H G\wedge H G ∧ H . In the second, each selected clause reduces to P a P_a P a , and the unit clauses { ¬ ℓ } \{\neg\ell\} { ¬ ℓ } enforce this case. Thus the two children partition the parent’s satisfying assignments.
The old antichain contains no clause included in H H H or in any P a P_a P a : such a clause would be a strict subset of H ∪ P a H\cup P_a H ∪ P a . Thus H H H and the distinct equal-width clauses P a P_a P a are new. No P a P_a P a contains a variable of H H H , since its parent is nontautological. Consequently, none of the unit clauses { ¬ ℓ } \{\neg\ell\} { ¬ ℓ } , ℓ ∈ H \ell\in H ℓ ∈ H , is a subset of any P a P_a P a . Any unit clause { ¬ ℓ } \{\neg\ell\} { ¬ ℓ } already present is retained and is not counted as a new insertion. The remaining new unit clauses and the clauses P a P_a P a all survive. Each selected old clause contains the newly inserted clause H H H for child A A A , or its newly inserted subset P a P_a P a for child B B B . Every other removed clause contains a newly inserted strict subset by the normalization rule. □
A.2. Counting insertions. To bound the tree, we count every clause introduced along one path, including clauses later deleted. Clauses present in the input are excluded from this count. By Lemma A.1 , each step inserts a clause, so bounding the total number of insertions also bounds the path length.
For this accounting, a clause is marked when a branch introduces it. First we bound how many marked clauses can still be present and contain a given literal set. The smallest-width priority controls those present before a branch; the largest-∣ H ∣ |H| ∣ H ∣ priority controls those introduced by that branch.
Lemma A.2. At every node, for 1 ≤ i < j < k 1\le i<j<k 1 ≤ i < j < k and every literal set S S S of size i i i , fewer than 2 θ j − i 2\theta_{j-i} 2 θ j − i marked clauses of width j j j that are still present contain S S S .
Proof. Initially there are no marked clauses. It suffices to consider a branch that inserts clauses of width j j j . Its selected width c c c is larger than j j j . Before insertion, fewer than θ j − i \theta_{j-i} θ j − i current width-j j j clauses contain S S S : otherwise the smallest-width priority would select a width at most j j j .
Choosing child A A A inserts only one clause. Suppose child B B B inserts clauses P a P_a P a of width j j j . If none of the P a P_a P a contains S S S , the number of new width-j j j clauses containing S S S is zero. Otherwise S S S lies in a petal and is therefore disjoint from H H H . In this case P a P_a P a contains S S S exactly when the selected clause H ∪ P a H\cup P_a H ∪ P a contains H ∪ S H\cup S H ∪ S . Since 0 < i < j 0<i<j 0 < i < j , H ∪ S H\cup S H ∪ S is larger than H H H and is a proper subset of a selected width-c c c clause. The priority for the largest shared set therefore gives
# { a : S ⊆ P a } = deg c ( H ∪ S ) < θ c − ∣ H ∪ S ∣ = θ j − i . \#\{a:S\subseteq P_a\}=\deg_c(H\cup S)<\theta_{c-|H\cup S|}=\theta_{j-i}. # { a : S ⊆ P a } = deg c ( H ∪ S ) < θ c − ∣ H ∪ S ∣ = θ j − i .
The other new clauses { ¬ ℓ } \{\neg\ell\} { ¬ ℓ } have width one. Thus the old and new clauses of width j j j together satisfy the asserted bound. Deletion cannot increase it. □
Lemma A.3. Along any path or path prefix, the total number T j T_j T j of width-j j j insertions satisfies T j ≤ 4 ( 3 M ) j − 1 n T_j \le4(3M)^{j-1}n T j ≤ 4 ( 3 M ) j − 1 n for 1 ≤ j < k 1 \le j < k 1 ≤ j < k .
Proof. The case n = 0 n=0 n = 0 is immediate, so assume n ≥ 1 n \ge1 n ≥ 1 . For the current path prefix, let L j L_j L j be the number of marked width-j j j clauses still present, and let D j D_j D j be the number of width-j j j insertions whose clauses have since been deleted. Then T j = L j + D j T_j=L_j+D_j T j = L j + D j . Units are never deleted, so T 1 ≤ 2 n ≤ 4 n T_1 \le2n \le4n T 1 ≤ 2 n ≤ 4 n . For j ≥ 2 j \ge2 j ≥ 2 , sum Lemma A.2 over the 2 n 2n 2 n single literals. This gives L j ≤ 4 n θ j − 1 L_j \le4n\theta_{j-1} L j ≤ 4 n θ j − 1 .
Whenever a marked clause of width j j j is deleted, assign that deletion to one newly introduced strict subset contained in it; Lemma A.1 guarantees such a subset. If the new clause has width i < j i<j i < j , Lemma A.2 shows that it was contained in fewer than 2 θ j − i 2\theta_{j-i} 2 θ j − i marked clauses of width j j j immediately before the branch. Thus one insertion of a width-i i i clause receives at most that many deletions. Summing over the widths i i i of the new clauses gives D j ≤ 2 ∑ i = 1 j − 1 θ j − i T i D_j \le2\sum_{i=1}^{j-1}\theta_{j-i}T_i D j ≤ 2 ∑ i = 1 j − 1 θ j − i T i . Therefore
T j = L j + D j ≤ 4 n θ j − 1 + 2 ∑ i = 1 j − 1 θ j − i T i . (68) T_j=L_j+D_j \le4n\theta_{j-1}+2\sum_{i=1}^{j-1}\theta_{j-i}T_i. \tag*{(68)} T j = L j + D j ≤ 4 n θ j − 1 + 2 i = 1 ∑ j − 1 θ j − i T i . (68)
The first term counts clauses still present; the sum counts those that were deleted. Dividing by n M j − 1 nM^{j-1} n M j − 1 and applying induction gives
T j n M j − 1 ≤ 4 + 2 ∑ i = 1 j − 1 4 ⋅ 3 i − 1 = 4 ⋅ 3 j − 1 . \frac{T_j}{nM^{j-1}} \le4+2\sum_{i=1}^{j-1}4\cdot3^{i-1}=4\cdot3^{j-1}. n M j − 1 T j ≤ 4 + 2 i = 1 ∑ j − 1 4 ⋅ 3 i − 1 = 4 ⋅ 3 j − 1 .
as required.
The size of the tree
We now convert Lemma A.3 into a bound on the number of tree nodes. It controls both the length of a path and the number of times that path chooses the B B B -child in (A.2). Write these bounds as C n Cn C n and Γ n / M \Gamma n/M Γ n / M , respectively, where
C = 4 ∑ j = 0 k − 2 ( 3 M ) j , Γ = 4 ∑ j = 0 k − 2 3 j = 2 ( 3 k − 1 − 1 ) . C=4\sum_{j=0}^{k-2}(3M)^j,\qquad\Gamma=4\sum_{j=0}^{k-2}3^j=2(3^{k-1}-1). C = 4 j = 0 ∑ k − 2 ( 3 M ) j , Γ = 4 j = 0 ∑ k − 2 3 j = 2 ( 3 k − 1 − 1 ) .
Lemma A.3 gives depth at most C n Cn C n . A choice of child B B B with ∣ P a ∣ = j |P_a|=j ∣ P a ∣ = j inserts at least M j M^j M j clauses of width j j j , so a path contains at most 4 ⋅ 3 j − 1 n / M 4\cdot3^{j-1}n/M 4 ⋅ 3 j − 1 n / M such choices. In total, a path chooses B B B at most Γ n / M \Gamma n/M Γ n / M times.
A path with few choices of B B B has a short description. Because the branching rule is deterministic, a node is determined by its depth and the positions at which its path chooses B B B ; every other position chooses A A A . For M ≥ Γ M\ge\Gamma M ≥ Γ , this bounds the number of nodes by
( C n + 1 ) ∑ a ≤ ⌊ Γ n / M ⌋ ( C n a ) ≤ ( C n + 1 ) 2 ( Γ n / M ) log 2 ( 4 C M ) . (Cn+1)\sum_{a\le\lfloor\Gamma n/M\rfloor}\binom{Cn}{a}\le(Cn+1)2^{(\Gamma n/M)\log_2(4CM)}. ( C n + 1 ) a ≤ ⌊ Γ n / M ⌋ ∑ ( a C n ) ≤ ( C n + 1 ) 2 ( Γ n / M ) l o g 2 ( 4 C M ) .
Here Γ n / M ≤ n ≤ C n / 4 \Gamma n/M\le n\le Cn/4 Γ n / M ≤ n ≤ C n /4 . For a positive integer a a a , use ( C n a ) ≤ ( 4 C n / a ) a \binom{Cn}{a}\le(4Cn/a)^a ( a C n ) ≤ ( 4 C n / a ) a ; this upper bound increases for a ≤ C n / 4 a\le Cn/4 a ≤ C n /4 . There are at most C n + 1 Cn+1 C n + 1 summands. The case Γ n / M < 1 \Gamma n/M<1 Γ n / M < 1 is immediate.
We choose M M M to make the exponent in this bound at most σ n \sigma n σ n . Test powers of two M ≥ Γ M\ge\Gamma M ≥ Γ in increasing order. For each choice, compute C C C and h = ⌈ log 2 ( 4 C M ) ⌉ h=\lceil\log_2(4CM)\rceil h = ⌈ log 2 ( 4 C M )⌉ , and stop when
Γ h ≤ σ M . \Gamma h\le\sigma M. Γ h ≤ σ M .
All comparisons are exact. Since C = O k ( M k − 2 ) C=O_k(M^{k-2}) C = O k ( M k − 2 ) and Γ \Gamma Γ depends only on k k k , the first successful choice satisfies
M = O k ( σ − 1 log ( 2 / σ ) ) . M=O_k\left(\sigma^{-1}\log(2/\sigma)\right). M = O k ( σ − 1 log ( 2/ σ ) ) .
The tree therefore has at most ( C n + 1 ) 2 2 σ n (Cn+1)2^{2\sigma n} ( C n + 1 ) 2 2 σ n nodes.
At a leaf, (A.1) fails for every nonempty proper subset of a clause. A fixed literal belongs to fewer than θ c − 1 \theta_{c-1} θ c − 1 width-c c c clauses when c ≥ 2 c \ge2 c ≥ 2 , and to at most one unit clause. Hence each variable occurs at most
B = 2 ∑ j = 0 k − 1 M j ≤ 4 M k − 1 = O k ( [ σ − 1 log ( 2 / σ ) ] k − 1 ) . B = 2\sum_{j=0}^{k-1} M^j \le4M^{k-1} = O_k\left(\left[\sigma^{-1}\log(2/\sigma)\right]^{k-1}\right). B = 2 j = 0 ∑ k − 1 M j ≤ 4 M k − 1 = O k ( [ σ − 1 log ( 2/ σ ) ] k − 1 ) .
Thus every leaf has the required bound on occurrences per variable. The repeated two-case partition also shows that each original satisfying assignment occurs at exactly one leaf, so summing the leaf counts gives the original count.
To implement the branching rule at a node, we compute deg c ( H ) \deg_c(H) deg c ( H ) for its current formula. For each width-c c c clause, we enumerate its nonempty proper subsets H H H and increment the counter indexed by ( c , H ) (c,H) ( c , H ) . There are O k ( n k ) O_k(n^k) O k ( n k ) possible nonempty normalized clauses, each with at most 2 k 2^k 2 k subsets. The clause counters use O k ( log ( n + 2 ) ) O_k(\log(n+2)) O k ( log ( n + 2 )) bits, and the thresholds use O k ( log M ) O_k(\log M) O k ( log M ) bits. Computing the counts, choosing a branch, and normalizing its children therefore use poly k ( n , log M ) \operatorname{poly}_k(n,\log M) poly k ( n , log M ) bit operations and bits of working space per node. The bound on M M M gives log M = O k ( log ( 2 / σ ) ) \log M=O_k(\log(2/\sigma)) log M = O k ( log ( 2/ σ )) .
With L σ L_\sigma L σ as in Lemma 6.3, the parameter search examines O k ( L σ ) O_k(L_\sigma) O k ( L σ ) powers of two. Its integer operands have O k ( L σ ) O_k(L_\sigma) O k ( L σ ) bits, so constructing the numerical parameters uses poly k ( L σ ) \operatorname{poly}_k(L_\sigma) poly k ( L σ ) bit operations and bits of working space.
Exact arithmetic and space
Section 4 bounds the rational coefficients of the substitution rows P ⃗ f , v ( T ) \vec{P}_{f,v}(T) P f , v ( T ) . We complete the bit-cost and space estimates in Proposition 5.3 by bounding the lifted factors, the sums used to compute the Taylor polynomials of H H H , and the final interpolation. The essential point is that each sum uses a fixed denominator. Its numerator grows with the number of summands, so its bit length grows only with the logarithm of that number. For any polynomial G = ∑ α c α X ⃗ α G=\sum_\alpha c_\alpha\vec{X}^{\alpha} G = ∑ α c α X α in finitely many indeterminates, write ∥ G ∥ 1 = ∑ α ∣ c α ∣ \|G\|_1=\sum_\alpha|c_\alpha| ∥ G ∥ 1 = ∑ α ∣ c α ∣ for its coefficient norm.
Integer coefficients of the lifted indicator
We first bound the coefficients of the parity polynomials supplied by Lemma 5.1. They occur in every equation factor B i B_i B i in (59) , so their sizes enter the bit-cost bounds for evaluating those factors. For an integer ℓ ≥ 1 \ell\ge1 ℓ ≥ 1 , recall h ( Y ) = Y ( Y − 1 ) h(Y)=Y(Y-1) h ( Y ) = Y ( Y − 1 ) and the polynomials from Lemma 5.1:
p ℓ ( Y ) = ( 1 − Y ) ℓ ∑ j = 0 ℓ − 1 ( ℓ + j − 1 j ) Y j = ∑ j = 0 ℓ − 1 e j ( Y ) h ( Y ) j , deg e j ≤ 1. p_\ell(Y)=(1-Y)^\ell\sum_{j=0}^{\ell-1}\binom{\ell+j-1}{j}Y^j=\sum_{j=0}^{\ell-1}e_j(Y)h(Y)^j,\qquad\deg e_j\le1. p ℓ ( Y ) = ( 1 − Y ) ℓ j = 0 ∑ ℓ − 1 ( j ℓ + j − 1 ) Y j = j = 0 ∑ ℓ − 1 e j ( Y ) h ( Y ) j , deg e j ≤ 1.
That lemma proves the parity congruence and constructs the e j e_j e j by successive monic division by h h h . Here we bound the integers occurring in this construction.
Lemma B.1. Write e j ( Y ) = a j + b j Y e_j(Y)=a_j+b_jY e j ( Y ) = a j + b j Y for 0 ≤ j < ℓ 0\le j<\ell 0 ≤ j < ℓ . Then a j , b j ∈ Z a_j,b_j\in\mathbb{Z} a j , b j ∈ Z and
∣ a j ∣ , ∣ b j ∣ ≤ 2 C ℓ 2 ( 0 ≤ j < ℓ ) |a_j|,|b_j|\le2^{C\ell^2}\qquad(0\le j<\ell) ∣ a j ∣ , ∣ b j ∣ ≤ 2 C ℓ 2 ( 0 ≤ j < ℓ ) for an absolute constant C C C . Successive division of p ℓ p_\ell p ℓ by h h h constructs these polynomials using poly ( ℓ ) \operatorname{poly}(\ell) poly ( ℓ ) bit operations and bits of working space.
Proof. The coefficient-norm inequality ∥ f g ∥ 1 ≤ ∥ f ∥ 1 ∥ g ∥ 1 \|fg\|_1\le\|f\|_1\|g\|_1 ∥ f g ∥ 1 ≤ ∥ f ∥ 1 ∥ g ∥ 1 , together with the binomial identity
∑ j = 0 ℓ − 1 ( ℓ + j − 1 j ) = ( 2 ℓ − 1 ℓ − 1 ) \sum_{j=0}^{\ell-1}\binom{\ell+j-1}{j}=\binom{2\ell-1}{\ell-1} j = 0 ∑ ℓ − 1 ( j ℓ + j − 1 ) = ( ℓ − 1 2 ℓ − 1 )
gives
∥ p ℓ ∥ 1 ≤ 2 ℓ ( 2 ℓ − 1 ℓ − 1 ) ≤ 2 3 ℓ . \|p_\ell\|_1\le2^\ell\binom{2\ell-1}{\ell-1}\le2^{3\ell}. ∥ p ℓ ∥ 1 ≤ 2 ℓ ( ℓ − 1 2 ℓ − 1 ) ≤ 2 3 ℓ .
Monic division by h = Y 2 − Y h=Y^{2}-Y h = Y 2 − Y preserves integer coefficients. Each leading-term elimination increases the sum of the coefficient norms of the current quotient and remainder by at most a factor of three. There are O ( ℓ 2 ) O(\ell^{2}) O ( ℓ 2 ) eliminations in all the successive divisions. Thus every intermediate coefficient has absolute value at most 2 O ( ℓ 2 ) 2^{O(\ell^{2})} 2 O ( ℓ 2 ) , which proves the stated bound for a j , b j a_j,b_j a j , b j . Its signed binary encoding consequently uses O ( ℓ 2 ) O(\ell^{2}) O ( ℓ 2 ) bits. Each coefficient vector has O ( ℓ ) O(\ell) O ( ℓ ) entries. The successive divisions use O ( ℓ 2 ) O(\ell^{2}) O ( ℓ 2 ) integer arithmetic operations on integers of O ( ℓ 2 ) O(\ell^{2}) O ( ℓ 2 ) bits, giving the claimed poly ( ℓ ) \operatorname{poly}(\ell) poly ( ℓ ) bit-operation and space bounds. □
Bit complexity of the sums over Boolean assignments
We now bound every intermediate value in the computation of H t ( z ) = H ( t + z ) m o d z J \mathcal{H}_t(z)=H(t+z)\bmod z^J H t ( z ) = H ( t + z ) mod z J from (34) . Starting with the substitution rows P ⃗ f , v ( T ) \vec{P}_{f,v}(T) P f , v ( T ) , we bound the substituted factors, their sums over each group of Boolean variables, and the accumulator T t T_t T t for the Taylor data in Proposition 5.3. Fix a polynomial system P \mathcal{P} P in n n n Boolean variables, with m t e s t m_{\mathrm{test}} m test equations of degree at most k k k , precision ℓ \ell ℓ such that 2 ℓ > 2 n 2^\ell>2^n 2 ℓ > 2 n , and a replacement design for its equation factors. Suppose the rows P ⃗ f , v \vec{P}_{f,v} P f , v , partitions S t , g S_{t,g} S t , g , and matrices C t , g C_{t,g} C t , g satisfy Definition 3.1 , with parameters Q Q Q , R R R , r r r , D D D , τ \tau τ . Recall the degree bound for H H H and the number of Taylor coefficients retained at each node:
d H = k R ( m t e s t + 2 ( ℓ − 1 ) ) , J = ⌊ d H Q ⌋ + 1. d_H=kR(m_{\mathrm{test}}+2(\ell-1)),\qquad J=\left\lfloor\frac{d_H}{Q}\right\rfloor+1. d H = k R ( m test + 2 ( ℓ − 1 )) , J = ⌊ Q d H ⌋ + 1.
All polynomials in the Taylor variable z z z and the shared truncation marker V V V are stored in their unique representative modulo ( z J , V ℓ ) (z^J,V^\ell) ( z J , V ℓ ) . Removing terms outside these degree ranges cannot increase the coefficient norm.
The substitution rows have common denominator
d d e n = ( R − 1 ) ! Q ! . d_{\mathrm{den}}=(R-1)!Q!. d den = ( R − 1 )! Q ! .
We use an integer B P ≥ 1 B_P\geq1 B P ≥ 1 such that every integer coefficient of every row d d e n P ⃗ f , v ( T ) d_{\mathrm{den}}\vec{P}_{f,v}(T) d den P f , v ( T ) has absolute value at most 2 B P 2^{B_P} 2 B P . Definition 3.1 gives B P = O ( Q log Q + log D ) B_P=O(Q\log Q+\log D) B P = O ( Q log Q + log D ) . At a fixed node t ∈ [ Q ] t\in[Q] t ∈ [ Q ] and for a fixed correction set U ⊆ [ n ] U\subseteq[n] U ⊆ [ n ] , the input to factor f f f at variable v v v is
θ f , v ( z ; x ) = ⟨ P ⃗ f , v ( t ) , x ⟩ + ⟨ P ⃗ f , v ( t + z ) − P ⃗ f , v ( t ) , 1 U ⟩ , x ∈ { 0 , 1 } n . \theta_{f,v}(z;x)=\langle\vec{P}_{f,v}(t),x\rangle+\left\langle\vec{P}_{f,v}(t+z)-\vec{P}_{f,v}(t),\mathbf{1}_U\right\rangle,\qquad x\in\{0,1\}^{n}. θ f , v ( z ; x ) = ⟨ P f , v ( t ) , x ⟩ + ⟨ P f , v ( t + z ) − P f , v ( t ) , 1 U ⟩ , x ∈ { 0 , 1 } n .
Let L i ( z ; x ) L_i(z;x) L i ( z ; x ) be the sum of the listed monomials of equation i i i after these substitutions. Each d d e n θ i , v ( z ; x ) d_{\mathrm{den}}\theta_{i,v}(z;x) d den θ i , v ( z ; x ) is an integer polynomial of coefficient norm at most
B 0 = d d e n + 3 n ( R + 1 ) 2 B P ( Q + 1 ) R . B_0=d_{\mathrm{den}}+3n(R+1)2^{B_P}(Q+1)^R. B 0 = d den + 3 n ( R + 1 ) 2 B P ( Q + 1 ) R .
Indeed, each of the three row evaluations in θ i , v \theta_{i,v} θ i , v contributes at most n ( R + 1 ) 2 B P ( Q + 1 ) R n(R+1)2^{B_P}(Q+1)^R n ( R + 1 ) 2 B P ( Q + 1 ) R after denominators are cleared. The bound holds also for the representatives in the group sums.
Put Δ = d d e n k \Delta=d_{\mathrm{den}}^k Δ = d den k . For a monomial of degree u ≤ k u\leq k u ≤ k , multiplying its substituted value by Δ \Delta Δ gives an integer polynomial of norm at most d d e n k − u B 0 u ≤ B 0 k d_{\mathrm{den}}^{k-u}B_0^u\leq B_0^k d den k − u B 0 u ≤ B 0 k , including the constant monomial. As S S S bounds the total list length,
B = max { Δ , S B 0 k } satisfies ∥ Δ L i ( z ; x ) ∥ 1 ≤ B . B=\max\{\Delta,SB_0^k\}\quad\text{satisfies}\quad\|\Delta L_i(z;x)\|_1\leq B. B = max { Δ , S B 0 k } satisfies ∥Δ L i ( z ; x ) ∥ 1 ≤ B .
Consequently log d d e n = O ( Q log ( Q + 2 ) ) \log d_{\mathrm{den}}=O(Q\log(Q+2)) log d den = O ( Q log ( Q + 2 )) , log B 0 = O ( Q log ( Q + 2 ) + log ( n D + 2 ) ) \log B_0=O(Q\log(Q+2)+\log(nD+2)) log B 0 = O ( Q log ( Q + 2 ) + log ( n D + 2 )) , and log B = O ( k log B 0 + log ( S + 2 ) ) \log B=O(k\log B_0+\log(S+2)) log B = O ( k log B 0 + log ( S + 2 )) .
The substituted factor of equation i i i is
B i ( z , V ; x ) = ∑ j = 0 ℓ − 1 e j ( L i ( z ; x ) ) h ( L i ( z ; x ) ) j V j ( m o d ( z J , V ℓ ) ) . \mathcal{B}_i(z,V;x)=\sum_{j=0}^{\ell-1}e_j(L_i(z;x))h(L_i(z;x))^jV^j\pmod{(z^J,V^\ell)}. B i ( z , V ; x ) = j = 0 ∑ ℓ − 1 e j ( L i ( z ; x )) h ( L i ( z ; x ) ) j V j ( mod ( z J , V ℓ )) .
Since e j e_j e j is integral and has degree at most one, its substitution has denominator dividing Δ \Delta Δ ; the denominator of h ( L i ) j h(L_i)^j h ( L i ) j divides Δ j \Delta^j Δ j . Thus, with
Γ = Δ 2 ℓ − 1 , \Gamma=\Delta^{2\ell-1}, Γ = Δ 2 ℓ − 1 ,
every coefficient of Γ B i ( z , V ; x ) \Gamma B_i(z,V;x) Γ B i ( z , V ; x ) is an integer. To bound the resulting integer numerators, put
E ℓ = max { 1 , ∥ e 0 ∥ 1 , … , ∥ e ℓ − 1 ∥ 1 } , B 1 = ℓ E ℓ ( B + Δ + 2 ) 2 ℓ − 1 . E_{\ell}=\max\{1,\lVert e_0\rVert_1,\ldots,\lVert e_{\ell-1}\rVert_1\},\qquad B_1=\ell E_{\ell}(B+\Delta+2)^{2\ell-1}. E ℓ = max { 1 , ∥ e 0 ∥ 1 , … , ∥ e ℓ − 1 ∥ 1 } , B 1 = ℓ E ℓ ( B + Δ + 2 ) 2 ℓ − 1 .
For A i = Δ L i A_i=\Delta L_i A i = Δ L i , the two substituted factors have integer numerators Δ e j ( L i ) \Delta e_j(L_i) Δ e j ( L i ) and A i ( A i − Δ ) A_i(A_i-\Delta) A i ( A i − Δ ) , with norms at most E ℓ ( B + Δ ) E_{\ell}(B+\Delta) E ℓ ( B + Δ ) and B ( B + Δ ) B(B+\Delta) B ( B + Δ ) , respectively. Padding each term to denominator Γ \Gamma Γ therefore gives
∥ Γ B i ∥ 1 ≤ B 1 , B 1 ≥ Γ , log B 1 = O ( ℓ 2 + ℓ log ( B + Δ + 2 ) + log ( ℓ + 1 ) ) . \lVert\Gamma B_i\rVert_1\le B_1,\qquad B_1\ge\Gamma,\qquad\log B_1=O\left(\ell^2+\ell\log(B+\Delta+2)+\log(\ell+1)\right). ∥ Γ B i ∥ 1 ≤ B 1 , B 1 ≥ Γ , log B 1 = O ( ℓ 2 + ℓ log ( B + Δ + 2 ) + log ( ℓ + 1 ) ) .
We next apply these estimates to the actual group sums. Write S g = S t , g S_g=S_{t,g} S g = S t , g and C g = C t , g C_g=C_{t,g} C g = C t , g , and let c g c_g c g be the number of rows of C g C_g C g . Thus c = ∑ g c g ≤ 2 τ n c=\sum_g c_g\le2\tau n c = ∑ g c g ≤ 2 τ n , and every coordinate of a Boolean measurement C g x g C_gx_g C g x g lies in [ − D , D ] ∩ Z [-D,D]\cap\mathbb{Z} [ − D , D ] ∩ Z . Let m t e s t , g m_{\mathrm{test},g} m test , g be the number of equation factors assigned to group g g g at t t t , so ∑ g m t e s t , g = m t e s t \sum_gm_{\mathrm{test},g}=m_{\mathrm{test}} ∑ g m test , g = m test . Their product A g , U ( x ; z ) A_{g,U}(x;z) A g , U ( x ; z ) from (32) is represented in Q [ z , V ] / ( z J , V ℓ ) \mathbb{Q}[z,V]/(z^J,V^\ell) Q [ z , V ] / ( z J , V ℓ ) . It has denominator dividing Γ m t e s t , g \Gamma^{m_{\mathrm{test},g}} Γ m test , g and numerator norm, over that denominator, at most B 1 m t e s t , g B_1^{m_{\mathrm{test},g}} B 1 m test , g . The neutral constant-one factors do not affect this bound.
For a pair U ⊆ E ⊆ [ n ] U\subseteq E\subseteq[n] U ⊆ E ⊆ [ n ] with ∣ E ∣ < J |E|<J ∣ E ∣ < J and an attainable measurement tuple y ⃗ = ( y 1 , … , y r ) \vec{y}=(y_1,\ldots,y_r) y = ( y 1 , … , y r ) , choose Boolean representatives x ˉ h \bar{x}_h x ˉ h with C h x ˉ h = y h C_h\bar{x}_h=y_h C h x ˉ h = y h . The group sum in (25) is
Σ g ( y ⃗ ) = ∑ x g ∈ { 0 , 1 } S g C g x g = y g ( x g ) v = 1 ( v ∈ E ∩ S g ) A g , U ( x g + ∑ h ≠ g x ˉ h ; z ) . \Sigma_g(\vec{y})=
\sum_{\substack{x_g\in\{0,1\}^{S_g}\\ C_gx_g=y_g\\
(x_g)_v=1\ (v\in E\cap S_g)}}
A_{g,U}\left(x_g+\sum_{h\ne g}\bar{x}_h;z\right). Σ g ( y ) = x g ∈ { 0 , 1 } S g C g x g = y g ( x g ) v = 1 ( v ∈ E ∩ S g ) ∑ A g , U x g + h = g ∑ x ˉ h ; z .
Here vectors on individual groups are extended by zero. The sum has at most 2 ∣ S g ∣ 2^{|S_g|} 2 ∣ S g ∣ terms, all over the same denominator, so
∥ Γ m t e s t , g Σ g ( y ⃗ ) ∥ 1 ≤ 2 ∣ S g ∣ B 1 m t e s t , g . \left\lVert\Gamma^{m_{\mathrm{test},g}}\Sigma_g(\vec{y})\right\rVert_1\le2^{|S_g|}B_1^{m_{\mathrm{test},g}}. ∥ Γ m test , g Σ g ( y ) ∥ 1 ≤ 2 ∣ S g ∣ B 1 m test , g .
For 1 ≤ g ≤ r 1\le g\le r 1 ≤ g ≤ r , define the partial product Π g ( y ⃗ ) = ∏ h = 1 g Σ h ( y ⃗ ) \Pi_g(\vec{y})=\prod_{h=1}^{g}\Sigma_h(\vec{y}) Π g ( y ) = ∏ h = 1 g Σ h ( y ) , with truncation after each multiplication. Its denominator divides
Γ ∑ h ≤ g m t e s t , h . \Gamma^{\sum_{h\le g}m_{\mathrm{test},h}}. Γ ∑ h ≤ g m test , h .
Consequently every full contribution Π r ( y ⃗ ) \Pi_r(\vec{y}) Π r ( y ) can be placed over the fixed denominator
Ω = Γ m t e s t , \Omega=\Gamma^{m_{\mathrm{test}}}, Ω = Γ m test ,
and it satisfies
∥ Ω Π r ( y ⃗ ) ∥ 1 ≤ 2 n B 1 m t e s t . \left\lVert\Omega\Pi_r(\vec{y})\right\rVert_1\le2^nB_1^{m_{\mathrm{test}}}. ∥ Ω Π r ( y ) ∥ 1 ≤ 2 n B 1 m test .
Let T t ( z , V ) T_t(z,V) T t ( z , V ) be the accumulator that adds these full contributions with sign ( − 1 ) ∣ E ∣ − ∣ U ∣ (-1)^{|E|-|U|} ( − 1 ) ∣ E ∣ − ∣ U ∣ over all pairs and measurement tuples. By (34) , its final value is the A ℓ A_{\ell} A ℓ -valued Taylor polynomial H t ( z ) H_t(z) H t ( z ) . The number M ∗ M_* M ∗ of signed updates at one node is bounded by
M ∗ ≤ ( ∑ s = 0 min ( J − 1 , n ) 2 s ( n s ) ) ( 2 D + 1 ) c ≤ 3 n ( 2 D + 1 ) c . M_*\le\left(\sum_{s=0}^{\min(J-1,n)}2^s\binom{n}{s}\right)(2D+1)^c\le3^n(2D+1)^c. M ∗ ≤ s = 0 ∑ m i n ( J − 1 , n ) 2 s ( s n ) ( 2 D + 1 ) c ≤ 3 n ( 2 D + 1 ) c .
Every intermediate value of T t T_t T t , not just its final value, therefore satisfies
∥ Ω T t ∥ 1 ≤ M ∗ 2 n B 1 m t e s t . \left\lVert\Omega T_t\right\rVert_1\le M_*2^nB_1^{m_{\mathrm{test}}}. ∥ Ω T t ∥ 1 ≤ M ∗ 2 n B 1 m test .
Each coefficient of the integer polynomial Ω T t \Omega T_t Ω T t has
O ( log ( M ∗ + 1 ) + n + m t e s t log B 1 ) O\left(\log(M_*+1)+n+m_{\mathrm{test}}\log B_1\right) O ( log ( M ∗ + 1 ) + n + m test log B 1 )
bits. This estimate also bounds the integer numerators of all group sums and partial products with the fixed denominators given above. The denominator satisfies
log Ω = k m t e s t ( 2 ℓ − 1 ) log d d e n = O ( k ( m t e s t ℓ + 1 ) Q log ( Q + 2 ) ) . \log\Omega=km_{\mathrm{test}}(2\ell-1)\log d_{\mathrm{den}}=O\left(k(m_{\mathrm{test}}\ell+1)Q\log(Q+2)\right). log Ω = k m test ( 2 ℓ − 1 ) log d den = O ( k ( m test ℓ + 1 ) Q log ( Q + 2 ) ) .
Each contribution multiplies at most m t e s t m_{\mathrm{test}} m test lifted equation factors. Processing further pairs or measurement tuples adds new contributions; it does not multiply them into the previous ones.
This is why exponentially many iterations contribute only log ( M ∗ + 1 ) \log(M_*+1) log ( M ∗ + 1 ) to the bit estimate. Each stored polynomial has at most J ℓ ≤ ( d H + 1 ) ℓ J\ell\le(d_H+1)\ell J ℓ ≤ ( d H + 1 ) ℓ coefficients. The enumeration retains its current indices and Boolean representatives, one group sum, one partial product, and the accumulator T t T_t T t , without storing a table of all assignments or all measurement tuples. These estimates give (61) and polynomial bit cost per rational operation. The Q J ℓ QJ\ell Q J ℓ Taylor coefficients and the working state fit in poly ( n , m t e s t , ℓ , D , Q , R , J , r , k , S ) \operatorname{poly}(n,m_{\mathrm{test}},\ell,D,Q,R,J,r,k,S) poly ( n , m test , ℓ , D , Q , R , J , r , k , S ) bits.
Interpolation and the integer answer
For 0 ≤ s < ℓ 0 \le s < \ell 0 ≤ s < ℓ , let H s ( T ) = [ V s ] H ( T ) ∈ Q [ T ] H_s(T)=[V^s]H(T)\in\mathbb{Q}[T] H s ( T ) = [ V s ] H ( T ) ∈ Q [ T ] . Section B.2 bounds the computed data [ z j V s ] H t ( z ) = [ z j ] H s ( t + z ) [z^jV^s]H_t(z)=[z^j]H_s(t+z) [ z j V s ] H t ( z ) = [ z j ] H s ( t + z ) for t ∈ [ Q ] t\in[Q] t ∈ [ Q ] , 0 ≤ j < J 0\le j<J 0 ≤ j < J . Fix s s s . We interpolate this coordinate, using the same rational Hermite matrix for all ℓ \ell ℓ coordinates. Put M H = Q J > d H M_H=QJ>d_H M H = Q J > d H . In the monomial basis 1 , T , … , T M H − 1 1,T,\ldots,T^{M_H-1} 1 , T , … , T M H − 1 , the Hermite interpolation matrix is the integer matrix
V ( t , j ) , u = { ( u j ) t u − j , u ≥ j , 0 , u < j , t ∈ [ Q ] , 0 ≤ j < J , 0 ≤ u < M H . V_{(t,j),u}=
\begin{cases}
\binom{u}{j}t^{u-j}, & u\ge j,\\
0, & u<j,
\end{cases}
\qquad t\in[Q],\quad0\le j<J,\quad0\le u<M_H. V ( t , j ) , u = { ( j u ) t u − j , 0 , u ≥ j , u < j , t ∈ [ Q ] , 0 ≤ j < J , 0 ≤ u < M H .
It is nonsingular by the Hermite interpolation statement in Section 3. Its entries have O ( M H log ( Q + 2 ) ) O(M_H\log(Q+2)) O ( M H log ( Q + 2 )) bits. Let y \mathbf{y} y be the vector of computed coefficients [ z j V s ] H t ( z ) [z^jV^s]H_t(z) [ z j V s ] H t ( z ) , ordered by ( t , j ) (t,j) ( t , j ) , and let h \mathbf{h} h be the monomial coefficient vector of H s H_s H s , padded with zeros to length M H M_H M H . Thus V h = y V\mathbf{h}=\mathbf{y} V h = y . The vector b = Ω y \mathbf{b}=\Omega\mathbf{y} b = Ω y is integral; write B d a t a B_{\mathrm{data}} B data for a bound on its entries’ bit lengths. The bounds in Section B.2 give
B d a t a ≤ poly ( n , m t e s t , ℓ , k , Q , log ( D + 2 ) , log ( S + 2 ) ) . B_{\mathrm{data}}\le\operatorname{poly}(n,m_{\mathrm{test}},\ell,k,Q,\log(D+2),\log(S+2)). B data ≤ poly ( n , m test , ℓ , k , Q , log ( D + 2 ) , log ( S + 2 )) .
Only the constant coefficient h 0 = H s ( 0 ) h_0=H_s(0) h 0 = H s ( 0 ) is needed. Let V ( 0 ) V^{(0)} V ( 0 ) be obtained from V V V by replacing its column indexed by u = 0 u=0 u = 0 with b \mathbf{b} b , and put
N H = det V ( 0 ) , D H = det V ≠ 0. N_H=\det V^{(0)},\qquad D_H=\det V\ne0. N H = det V ( 0 ) , D H = det V = 0.
Cramer’s rule for V ( Ω h ) = b V(\Omega\mathbf{h})=\mathbf{b} V ( Ω h ) = b gives
H s ( 0 ) = h 0 = N H Ω D H . (69) H_s(0)=h_0=\frac{N_H}{\Omega D_H}. \tag*{(69)} H s ( 0 ) = h 0 = Ω D H N H . (69)
We compute these two determinants by fraction-free Gaussian elimination [10 Sections I–II and IV–V] . For an M H × M H M_H\times M_H M H × M H integer matrix, this algorithm uses O ( M H 3 ) O(M_H^3) O ( M H 3 ) integer arithmetic operations; pivoting allows it to handle singular matrices as well. The retained elimination entries are signed minors of the input matrix. Each update forms products and a difference of such entries, followed by an exact integer division. Consequently, bounds on the minors of V V V and V ( 0 ) V^{(0)} V ( 0 ) also bound the intermediate integers used to compute D H D_H D H and N H N_H N H . Every minor of ( V ∣ b ) (V\mid\mathbf{b}) ( V ∣ b ) has absolute value at most
2 O ( M H ( B d a t a + M H log ( Q + 2 ) + log ( M H + 1 ) ) ) . 2^{O\left(M_H\left(B_{\mathrm{data}}+M_H\log(Q+2)+\log(M_H+1)\right)\right)}. 2 O ( M H ( B data + M H l o g ( Q + 2 ) + l o g ( M H + 1 ) ) ) .
Indeed, its determinant is a sum of at most M H ! M_H! M H ! products of at most M H M_H M H entries. The intermediate integers in fraction-free elimination therefore have
O ( M H ( B d a t a + M H log ( Q + 2 ) + log ( M H + 1 ) ) ) O\left(M_H\left(B_{\mathrm{data}}+M_H\log(Q+2)+\log(M_H+1)\right)\right) O ( M H ( B data + M H log ( Q + 2 ) + log ( M H + 1 ) ) )
bits in signed binary notation. Computing N H , D H N_H,D_H N H , D H thus uses poly ( M H , B d a t a ) \operatorname{poly}(M_H,B_{\mathrm{data}}) poly ( M H , B data ) bit operations and bits of working space.
At T = 0 T=0 T = 0 every H s ( 0 ) H_s(0) H s ( 0 ) is an integer by construction, so the division in (B.1) is exact for each s s s . After computing these ℓ \ell ℓ integers, put u = ∑ s = 0 ℓ − 1 H s ( 0 ) u=\sum_{s=0}^{\ell-1}H_s(0) u = ∑ s = 0 ℓ − 1 H s ( 0 ) . By (60) , the least nonnegative residue
u − 2 ℓ ⌊ u 2 ℓ ⌋ = N ( P ) u-2^\ell\left\lfloor\frac{u}{2^\ell}\right\rfloor=N(\mathcal{P}) u − 2 ℓ ⌊ 2 ℓ u ⌋ = N ( P )
is the exact count. Reusing the same workspace for successive coordinates, all ℓ \ell ℓ interpolations, the sum and the remainder use poly ( M H , B d a t a , log ( Ω + 1 ) , ℓ ) \operatorname{poly}(M_H,B_{\mathrm{data}},\log(\Omega+1),\ell) poly ( M H , B data , log ( Ω + 1 ) , ℓ ) bit operations and polynomially many bits of working space.
B.4. Arithmetic for the technique overview. We also justify the bit-complexity and space bounds for the bounded-occurrence algorithm in § 2 . Lemma 4.6 bounds the bit lengths of the replacement coefficients by a polynomial in n n n . Solving the polynomial-size rational linear systems in § 2.4 gives measurement coefficients λ ⃗ e , v , h \vec{\lambda}_{e,v,h} λ e , v , h of polynomial bit length as well. Let δ \delta δ be the product of the denominators of all these coefficients and all replacement coefficients, over all evaluation points. There are only polynomially many, so δ \delta δ also has polynomial bit length. Every clause product uses at most M ≤ 3 n M \le3n M ≤ 3 n linear inputs; consequently, all coefficients in the restricted sums can be accumulated with common denominator δ 3 n \delta^{3n} δ 3 n . Products of polynomially many input coefficients of polynomial bit length, and sums of exponentially many such terms over this common denominator, still have polynomial bit length. The exact Hermite interpolation above therefore has polynomial bit cost for these Taylor data as well. Finally, the enumerations can be performed sequentially, retaining only the construction, current indices, coefficient arrays, running sums, and the polynomially many Taylor coefficients needed for interpolation. This gives polynomial space and only polynomial bit-operation overhead.
Appendix C. Additional Consequences of Refuting ETH
Theorem 1.1 gives a circuit lower bound and subexponential-time algorithms for inverting Boolean maps with constant output locality. The fixed-density case gives the quantitative circuit lower bound in Corollary 1.4 . Both circuit arguments use only the decision version of our 3-SAT algorithm. Exact preimage counting uses its full counting guarantee.
Circuit lower bounds for EN P ^{\mathrm{NP}} NP
For the qualitative bound below, write SIZE ( O ( n ) ) \operatorname{SIZE}(O(n)) SIZE ( O ( n )) for the languages having nonuniform circuits with O ( n ) O(n) O ( n ) bounded-fan-in AND, OR, and NOT gates.
Corollary C.1. We have
E N P ⊈ SIZE ( O ( n ) ) . \mathrm{E}^{\mathrm{NP}} \not\subseteq\operatorname{SIZE}(O(n)). E NP ⊆ SIZE ( O ( n )) . Proof. Williams proved that if ETH is false, then EN P ^{\mathrm{NP}} NP does not have linear-size circuits [71 Theorem 6.1] . Apply this implication to the deterministic subexponential-time 3-SAT algorithm supplied by Theorem 1.1 . □
The connection is an instance of deriving circuit lower bounds from faster satisfiability algorithms. To encode a Boolean circuit with s s s gates and n n n inputs, introduce a variable for each gate, enforce its value from its inputs, and add a unit clause requiring the output bit to equal 1. The resulting 3-CNF has O ( n + s ) O(n+s) O ( n + s ) variables and clauses and is satisfiable exactly when the circuit is. Our theorem therefore decides satisfiability of linear-size circuits in 2 o ( n ) 2^{o(n)} 2 o ( n ) time. Williams’s argument combines such a speedup with hypothetical small circuits for witnesses to contradict a nondeterministic time hierarchy. The corollary gives a language in EN P ^{\mathrm{NP}} NP without a linear-size circuit family; it does not assert a superpolynomial circuit lower bound for NP.
Proof of Corollary 1.4. We use Williams’s witness-circuit argument [71 Theorem 6.1] with the local reduction of Jahanjou, Miles, and Viola [40 Theorem 1 and Section 6] .
By Žák’s nondeterministic time hierarchy [75 ] , in the form stated in [71 Theorem 2.1 in the full version] , fix a unary language H ∈ NTIME ( 2 n ) ∖ NTIME ( 2 n / 2 ) H \in\operatorname{NTIME}(2^n) \setminus\operatorname{NTIME}(2^{n/2}) H ∈ NTIME ( 2 n ) ∖ NTIME ( 2 n /2 ) on multitape Turing machines. For all sufficiently large n n n apply the local reduction to its fixed machine on 1 n 1^n 1 n with locality parameter r = 2 r=2 r = 2 . A time allowance T = 2 n n O ( 1 ) T=2^n n^{O(1)} T = 2 n n O ( 1 ) includes the polylogarithmic overhead of simulating the machine in the reduction and gives q = n + O ( log n ) q=n+O(\log n) q = n + O ( log n ) clause-index bits. In polynomial time the reduction constructs a decoder giving three variable labels and their signs on each index. Let φ n \varphi_n φ n consist of the clauses decoded on all 2 q 2^q 2 q indices. It is satisfiable exactly when 1 n ∈ H 1^n \in H 1 n ∈ H .
Each of the decoder’s O ( n ) O(n) O ( n ) output bits has a constant-depth decision tree, so it depends on at most a fixed number w w w of index bits. Evaluating the decoder on all strings of Hamming weight at most w w w recovers each support. Indeed, two strings witnessing dependence on one coordinate can be set to zero off the support while retaining their differing outputs. The same evaluations give the truth table on each support. This constructs a decoder of O ( n ) O(n) O ( n ) fan-in-two gates in polynomial time.
Pad each variable label to d n dn d n bits for a fixed positive integer d d d and declare all 2 d n 2^{dn} 2 d n variables. If ∣ i ∣ = d n |i|=dn ∣ i ∣ = d n for such an n n n and φ n \varphi_n φ n is satisfiable, let W ( i ) W(i) W ( i ) be bit i i i of its lexicographically first satisfying assignment, ordering variables by their labels. Set W ( i ) = 0 W(i)=0 W ( i ) = 0 in all other cases. The length of i i i determines n n n . To decide W W W , write out the 2 q 2^q 2 q clauses, ask an NP oracle whether the formula is satisfiable, and, if so, recover the first assignment by asking whether its current prefix followed by zero has a satisfying extension. At most 2 d n 2^{dn} 2 d n prefix queries of length 2 O ( n ) 2^{O(n)} 2 O ( n ) suffice, so W ∈ E N P W\in\mathrm{E}^{\mathrm{NP}} W ∈ E NP .
Put a ( t ) = log 2 t a(t)=\sqrt{\log_2 t} a ( t ) = log 2 t . Testing whether the count in the constant-density part of Theorem 1.1 is positive decides 3-SAT with V V V variables and at most 5 V 5V 5 V clauses in time V b 2 A V / a ( V ) V^{b2^{AV/a(V)}} V b 2 A V / a ( V ) for fixed A , b > 0 A,b>0 A , b > 0 . We absorb the change of logarithm base in A A A . The solver uses polynomial space, so a multitape simulation can scan its workspace for each bit access at a cost V O ( 1 ) V^{O(1)} V O ( 1 ) , absorbed in b b b .
Fix a positive rational η < 1 / ( 12 A ) \eta<1/(12A) η < 1/ ( 12 A ) and put s n = ⌊ η n ⌊ a ( n ) ⌋ ⌋ s_n=\lfloor\eta n\lfloor a(n)\rfloor\rfloor s n = ⌊ η n ⌊ a ( n )⌋⌋ for n ≥ 2 n\ge2 n ≥ 2 . The threshold is computable using the binary length of n n n and the integer square root of ⌊ log 2 n ⌋ \lfloor\log_2 n\rfloor ⌊ log 2 n ⌋ . Suppose that C W ( d n ) ≤ s n C_W(dn)\le s_n C W ( d n ) ≤ s n for all sufficiently large n n n . To decide H H H , reject nonunary inputs. On 1 n 1^n 1 n , guess a circuit on d n dn d n index bits with at most s n s_n s n gates. Feed the decoder’s three variable labels to three copies of this circuit and test whether the indexed clause is violated. Accept if the test circuit is unsatisfiable. When 1 n ∈ H 1^n\in H 1 n ∈ H , a circuit computing W W W at length d n dn d n gives an accepting guess. When 1 n ∉ H 1^n\notin H 1 n ∈ / H , every guess violates a clause.
The test circuit has q q q inputs and at most 3 s n + O ( n ) 3s_n+O(n) 3 s n + O ( n ) gates. The encoding above uses one variable per input and gate, at most four clauses of width at most three per gate to enforce its truth table, and one unit clause to pin the output. Padding with unused variables gives U n = 3 s n + B n U_n=3s_n+Bn U n = 3 s n + B n variables and at most 5 U n 5U_n 5 U n clauses for a fixed integer B B B . Since U n = ( 3 η + o ( 1 ) ) n a ( n ) U_n=(3\eta+o(1))n a(n) U n = ( 3 η + o ( 1 )) na ( n ) and a ( U n ) ∼ a ( n ) a(U_n)\sim a(n) a ( U n ) ∼ a ( n ) , the test takes 2 ( 3 A η + o ( 1 ) ) n 2^{(3A\eta+o(1))n} 2 ( 3 A η + o ( 1 )) n time. Guessing and building the circuits take polynomial time, so H H H is decidable nondeterministically in time 2 n / 2 2^{n/2} 2 n /2 for all sufficiently large n n n . The finitely many exceptional lengths can be hardwired, contradicting the choice of H H H . Thus C W ( d n ) > s n C_W(dn)>s_n C W ( d n ) > s n for infinitely many n n n . Since s n ∼ η n log 2 n s_n\sim\eta n\sqrt{\log_2 n} s n ∼ η n log 2 n and d d d is fixed, taking L = W L=W L = W and any 0 < c < η / ( d log 2 ) 0<c<\eta/(d\sqrt{\log2}) 0 < c < η / ( d log 2 ) proves (2) . □
Inverting Boolean maps with constant output locality
Fix a constant d d d . Consider a Boolean map G : { 0 , 1 } n → { 0 , 1 } m G:\{0,1\}^n\to\{0,1\}^m G : { 0 , 1 } n → { 0 , 1 } m whose i i i th output bit has the form
G ( x ⃗ ) i = g i ( x ⃗ ∣ S i ) , S i ⊆ [ n ] , ∣ S i ∣ ≤ d . G(\vec{x})_i=g_i(\vec{x}|_{S_i}),\qquad S_i\subseteq[n],\quad|S_i|\le d. G ( x ) i = g i ( x ∣ S i ) , S i ⊆ [ n ] , ∣ S i ∣ ≤ d .
The input description of G G G lists the sets S i S_i S i and the truth tables of the Boolean functions g i g_i g i . Thus each output inspects only constantly many input bits, although the sets S i S_i S i may overlap arbitrarily. Given a target b ⃗ ∈ { 0 , 1 } m \vec{b}\in\{0,1\}^m b ∈ { 0 , 1 } m , inversion asks for any x ⃗ \vec{x} x with G ( x ⃗ ) = b ⃗ G(\vec{x})=\vec{b} G ( x ) = b .
Corollary C.2. For every fixed d d d and n ≥ 20 n\ge20 n ≥ 20 , the number ∣ G − 1 ( b ⃗ ) ∣ |G^{-1}(\vec{b})| ∣ G − 1 ( b ) ∣ can be computed exactly, and a preimage can be found whenever one exists, in deterministic time
( n + m ) O d ( 1 ) 2 d O d ( ρ ( n ) ) (n+m)^{O_d(1)}2^{d\,O_d(\rho(n))} ( n + m ) O d ( 1 ) 2 d O d ( ρ ( n )) and space ( n + m ) O d ( 1 ) (n+m)^{O_d(1)} ( n + m ) O d ( 1 ) .
Proof. For each i i i and each local assignment α ⃗ ∈ { 0 , 1 } S i \vec{\alpha}\in\{0,1\}^{S_i} α ∈ { 0 , 1 } S i with g i ( α ⃗ ) ≠ b i g_i(\vec{\alpha})\ne b_i g i ( α ) = b i , include the clause
⋁ j ∈ S i ℓ j , α j , ℓ j , 0 = X j , ℓ j , 1 = ¬ X j . \bigvee_{j\in S_i}\ell_{j,\alpha_j},\qquad\ell_{j,0}=X_j,\quad\ell_{j,1}=\neg X_j. j ∈ S i ⋁ ℓ j , α j , ℓ j , 0 = X j , ℓ j , 1 = ¬ X j .
This clause forbids exactly the local assignment α ⃗ \vec{\alpha} α . If S i S_i S i is empty, its constraint is constant and can be checked directly. The conjunction of the remaining clauses is a CNF on the original n n n declared variables, with width at most d d d and at most 2 d m 2^d m 2 d m clauses. Its satisfying assignments are exactly G − 1 ( b ⃗ ) G^{-1}(\vec{b}) G − 1 ( b ) ; no auxiliary variables or multiplicity corrections are needed. Apply Theorem 1.1 with k = max { 2 , d } k=\max\{2,d\} k = max { 2 , d } . The usual variable-by-variable self-reduction finds a preimage using at most n n n further counting queries, which only changes the polynomial factor. Each query may be discarded before the next, preserving polynomial space.
Conditional counts also allow an exactly uniform preimage to be sampled, when the preimage set is nonempty, with the same bound in expected time up to polynomial factors [41 ] . In particular, the corollary applies to constant-locality versions of Goldreich’s candidate one-way functions, which evaluate local predicates on overlapping subsets of input bits [32 ] . For polynomially many output bits, it gives a 2 o ( n ) 2^{o(n)} 2 o ( n ) -time inversion algorithm for every output in the image, ruling out 2 Ω ( n ) 2^{\Omega(n)} 2 Ω ( n ) inversion hardness for these families. This does not rule out one-wayness against polynomial-time algorithms.
A sharper bound for exact counting
We prove Theorem 1.1 by contracting Boolean tensor networks. The two running times reflect the number of wires in the networks. A formula with m ≤ D n m \le Dn m ≤ D n clauses gives a network with O k , D ( n ) O_{k,D}(n) O k , D ( n ) wires. For arbitrary formulas, we use the parity tests of § 6 . The degree bound of Lemma 5.2 lets us index a monomial retained in the product of their polynomial lifts with O k ( n log log n ) O_k(n \log\log n) O k ( n log log n ) wires. We give both encodings before proving the contraction theorem they use.
Boolean tensor contraction
A Boolean tensor network is a bipartite multigraph G G G in which each edge carries a single bit. Each vertex v v v has an ordered list δ ( v ) \delta(v) δ ( v ) of incident edges and a tensor T v T_v T v assigning a ring element to each Boolean assignment to those edges. Parallel edges have distinct ports. The contraction of the network is
Z = ∑ x ∈ { 0 , 1 } E ( G ) ∏ v ∈ V ( G ) T v ( x ∣ δ ( v ) ) . Z = \sum_{x \in\{0,1\}^{E(G)}} \prod_{v \in V(G)} T_v(x|_{\delta(v)}). Z = x ∈ { 0 , 1 } E ( G ) ∑ v ∈ V ( G ) ∏ T v ( x ∣ δ ( v ) ) .
An isolated vertex contributes its scalar entry. We measure the size of the network by its number of edges.
Theorem D.1 (Boolean tensor contraction). Fix positive constants C C C , A A A , b b b . Let s ≥ 2 s \ge2 s ≥ 2 be an integer, and let L \mathcal{L} L be the total length of the graph and tensor descriptions of a bipartite tensor network with at most C s Cs C s edges and maximum degree at most ⌈ s 9 / 10 ⌉ \lceil s^{9/10} \rceil ⌈ s 9/10 ⌉ . Suppose that the number of vertices is bounded by a fixed polynomial in s s s , and that the entries belong to
B P 0 , ℓ = ( Z / 2 P 0 Z ) [ V ] / ( V ℓ ) , 1 ≤ P 0 , ℓ ≤ C s . \mathcal{B}_{P_0,\ell} = (\mathbb{Z}/2^{P_0}\mathbb{Z})[V]/(V^\ell), \qquad1 \le P_0,\ell\le Cs. B P 0 , ℓ = ( Z / 2 P 0 Z ) [ V ] / ( V ℓ ) , 1 ≤ P 0 , ℓ ≤ C s . Suppose, uniformly for every vertex and Boolean choice of its ports, that its entry can be computed from the description in time ( s + L ) b 2 A s 9 / 10 (s+\mathcal{L})^{b}2^{As^{9/10}} ( s + L ) b 2 A s 9/10 and space ( s + L ) b (s+\mathcal{L})^b ( s + L ) b . Then the contraction can be computed deterministically in
( s + L ) O ( 1 ) 2 O ( s / log s ) (s+\mathcal{L})^{O(1)}2^{O(s/\sqrt{\log s})} ( s + L ) O ( 1 ) 2 O ( s / l o g s ) bit operations and ( s + L ) O ( 1 ) (s+\mathcal{L})^{O(1)} ( s + L ) O ( 1 ) bits of space. Constants depend only on the fixed bounds in the hypotheses. In particular, ℓ = 1 \ell=1 ℓ = 1 is permitted.
The algorithm in Section D.4 replaces a single global Taylor expansion by recursion on the wires. At each call it deforms the wire identifications so that, at a chosen interpolation node, only ports in the same group interact. Near that node, interactions between groups expand in variables called modes. A mode of weight j j j has coefficient divisible by 2 j 2^j 2 j , so only monomials of total weight below the working precision can contribute. Tapering the Hermite multiplicities with the two-adic valuation of the node bounds that precision. With M M M wires and u u u retained valuation levels, the number of mode monomials is 2 O ( M / u ) 2^{O(M/\sqrt{u})} 2 O ( M / u ) , and each monomial factors into contractions with at most M / 8 M/8 M /8 wires. At recursion depth d d d , M = O ( s 8 − d ) M = O(s8^{-d}) M = O ( s 8 − d ) and u = Θ ( ( log s ) / 2 d ) u = \Theta((\log s)/2^d) u = Θ (( log s ) / 2 d ) . The exponents therefore sum geometrically to O ( s / log s ) O(s/\sqrt{\log s}) O ( s / log s ) .
Fixed clause density
Proof. of the fixed-density bound in Theorem 1.1 . Give each clause a vertex carrying its Boolean satisfaction table, with one port for each distinct variable in the clause. A tautology may be dropped, and an empty clause gives count zero. For a variable with d ≥ 1 d \ge1 d ≥ 1 ports, require their bits to agree. For d = 1 d = 1 d = 1 attach the unary tensor ( 1 , 1 ) (1,1) ( 1 , 1 ) , and for d = 2 d = 2 d = 2 attach a binary equality tensor. For d ≥ 3 d \ge3 d ≥ 3 take a tree with d d d external ports and trivalent equality tensors at its internal vertices. Such a tree has d − 2 d-2 d − 2 internal vertices, and each common value on its ports extends uniquely to all its internal edges.
There are at most k m km k m clause ports. The graph has O k ( n + m ) O_k(n+m) O k ( n + m ) edges and vertices, and maximum degree at most max { k , 3 } \max\{k,3\} max { k , 3 } . Subdivide every edge once by a binary equality tensor. The old vertices and the new vertices form the two sides of a bipartite network. The two bits on a subdivided edge must be equal, so this preserves the contraction. Every satisfying assignment on the occurring variables contributes one and every other assignment contributes zero.
With s = n + m s=n+m s = n + m , apply Theorem D.1 over Z / 2 n + 1 Z \mathbb{Z}/2^{n+1}\mathbb{Z} Z / 2 n + 1 Z , taking P 0 = n + 1 P_0=n+1 P 0 = n + 1 and ℓ = 1 \ell=1 ℓ = 1 . The local tables have bounded size for fixed k k k . The degree and precision bounds hold for all sufficiently large s s s , and bounded instances can be enumerated directly. If u u u declared variables are unused, multiply the contraction by 2 u 2^u 2 u modulo 2 n + 1 2^{n+1} 2 n + 1 . Its least nonnegative residue is # F \#F # F , since 0 ≤ # F ≤ 2 n 0 \le\#F \le2^n 0 ≤ # F ≤ 2 n . This includes the empty formula, for which the empty network has contraction one. The time is s O k ( 1 ) 2 O k ( s / log s ) s^{O_k(1)}2^{O_k(s/\sqrt{\log s})} s O k ( 1 ) 2 O k ( s / l o g s ) and the space is polynomial. When m ≤ D n m \le Dn m ≤ D n , we have n ≤ s ≤ ( 1 + D ) n n \le s \le(1+D)n n ≤ s ≤ ( 1 + D ) n , giving exponent O k , D ( n / log n ) O_{k,D}(n/\sqrt{\log n}) O k , D ( n / log n ) . □
Arbitrary clause density
The sparsification and greedy row selection in § 6 reduce this case to counting common zeros of sparse polynomial equations. We retain the parity lift of § 5 . Its degree bound lets us encode a monomial by a subset of test–variable incidences using O ( n log log n ) O(n\log\log n) O ( n log log n ) Boolean wires.
Lemma D.2 (Counting sparse polynomial systems by contraction). Fix integers k , c ≥ 1 k,c \ge1 k , c ≥ 1 . Let P 1 , … , P a P_1,\ldots,P_a P 1 , … , P a be polynomials over F 2 \mathbb{F}_2 F 2 on n ≥ 20 n \ge20 n ≥ 20 declared Boolean variables. Suppose a ≤ c n a \le cn a ≤ c n and each P i P_i P i is listed as at most ⌈ log 2 n ⌉ c \lceil\log_2 n\rceil^c ⌈ log 2 n ⌉ c monomials of degree at most k k k . The number of common zeros is computable deterministically in n O k , c ( 1 ) 2 O k , c ( n log log n / log n ) n^{O_{k,c}(1)}2^{O_{k,c}(n\log\log n/\sqrt{\log n})} n O k , c ( 1 ) 2 O k , c ( n l o g l o g n / l o g n ) bit operations and n O k , c ( 1 ) n^{O_{k,c}(1)} n O k , c ( 1 ) bits of space.
Proof. Put λ = ⌈ log 2 n ⌉ \lambda=\lceil\log_2 n\rceil λ = ⌈ log 2 n ⌉ and ν = ⌈ log 2 λ ⌉ \nu=\lceil\log_2\lambda\rceil ν = ⌈ log 2 λ ⌉ . Within each monomial replace positive powers of a variable by its first power, and combine duplicate monomials modulo two. The scope of test i i i consists of the variables in its remaining monomials. It has size at most k λ c k\lambda^c k λ c . Let N 0 N_0 N 0 be the sum of the scope sizes, counting a pair ( i , v ) (i,v) ( i , v ) once if variable v v v belongs to test i i i . Thus N 0 ≤ a k λ c N_0 \le ak\lambda^c N 0 ≤ ak λ c . Fix, in all possible ways, the variables belonging to more than
D ∗ = max { 1 , ⌊ N 0 / n ⌋ } ⌈ λ ⌉ D_*=\max\{1,\lfloor N_0/n\rfloor\}\lceil\sqrt{\lambda}\rceil D ∗ = max { 1 , ⌊ N 0 / n ⌋} ⌈ λ ⌉ scopes. There are at most n / λ n/\sqrt{\lambda} n / λ such variables. Their assignments partition the original count into at most 2 n / λ 2^{n/\sqrt{\lambda}} 2 n / λ branch counts. On each branch substitute the fixed bits and combine duplicate monomials again. The free scope I i I_i I i of test i i i still has size at most k λ c k\lambda^c k λ c , and each free variable appears in at most D ∗ = λ O k , c ( 1 ) D_*=\lambda^{O_{k,c}(1)} D ∗ = λ O k , c ( 1 ) scopes. Free variables absent from every scope remain declared. A constant-one equation makes the branch count zero. We may discard constant-zero equations, and if none remain the answer for the branch is two to the power of its number of free variables. Below a a a denotes the number of remaining equations and n n n the original variable count. The polynomial on the incidences. Give each pair ( i , v ) (i,v) ( i , v ) with v ∈ I i v\in I_i v ∈ I i its own indeterminate z i v z_{iv} z i v . Write z i = ( z i v ) v ∈ I i z_i=(z_{iv})_{v\in I_i} z i = ( z i v ) v ∈ I i . Form L ~ i ( z i ) \widetilde L_i(z_i) L i ( z i ) by summing the remaining monomials of the normalized branch polynomial with integer coefficients, using z i v z_{iv} z i v for x v x_v x v . We use the ring
B = ( Z / 2 p Z ) [ V ] / ( V ℓ ) , p = ℓ = n + 1. \mathcal{B}=(\mathbb{Z}/2^p\mathbb{Z})[V]/(V^\ell), \qquad p=\ell=n+1. B = ( Z / 2 p Z ) [ V ] / ( V ℓ ) , p = ℓ = n + 1.
Take h ( Y ) = Y ( Y − 1 ) h(Y)=Y(Y-1) h ( Y ) = Y ( Y − 1 ) and the integer polynomials e j e_j e j from Lemma 5.1. Reduce their coefficients modulo 2 p 2^p 2 p , and form the factor
B i ( z i , V ) = ∑ j = 0 ℓ − 1 e j ( L ~ i ( z i ) ) h ( L ~ i ( z i ) ) j V j . B_i(z_i,V)=\sum_{j=0}^{\ell-1}e_j(\widetilde{L}_i(z_i))h(\widetilde{L}_i(z_i))^jV^j. B i ( z i , V ) = j = 0 ∑ ℓ − 1 e j ( L i ( z i )) h ( L i ( z i ) ) j V j .
Let B ‾ i \overline{B}_i B i be its multilinear representative in the z i z_i z i , obtained in each coefficient of V V V by replacing each positive power of an incidence indeterminate by its first power. It agrees with B i B_i B i on every Boolean assignment to z i z_i z i . Define F ( z , V ) = ∏ i B ‾ i ( z i , V ) F(z,V)=\prod_i\overline{B}_i(z_i,V) F ( z , V ) = ∏ i B i ( z i , V ) in B [ z ] \mathcal{B}[z] B [ z ] . The incidence indeterminates for different tests are disjoint, so F F F is multilinear even before substituting the same Boolean x v x_v x v for all copies of variable v v v .
The coefficient of V j V^j V j in B ‾ i \overline{B}_i B i has incidence degree at most k ( 1 + 2 j ) k(1+2j) k ( 1 + 2 j ) , since deg e j ≤ 1 \deg e_j\leq1 deg e j ≤ 1 , deg h = 2 \deg h=2 deg h = 2 , and multilinearization only lowers monomial degrees. Multiplication in B \mathcal{B} B retains only terms with ∑ i j i ≤ ℓ − 1 \sum_i j_i\leq\ell-1 ∑ i j i ≤ ℓ − 1 . Consequently every incidence monomial in F F F has degree at most
K = k ( a + 2 ( ℓ − 1 ) ) = O k , c ( n ) . (70) K=k\bigl(a+2(\ell-1)\bigr)=O_{k,c}(n). \tag*{(70)} K = k ( a + 2 ( ℓ − 1 ) ) = O k , c ( n ) . (70)
Let S ℓ S_\ell S ℓ sum the coefficients of 1 , V , … , V ℓ − 1 1,V,\ldots,V^{\ell-1} 1 , V , … , V ℓ − 1 in B \mathcal{B} B . At z i v = x v z_{iv}=x_v z i v = x v , the multilinearized factor B ‾ i \overline{B}_i B i agrees with B i B_i B i for the normalized branch polynomial. The integer L ~ i ( ( x v ) v ∈ I i ) \widetilde{L}_i((x_v)_{v\in I_i}) L i (( x v ) v ∈ I i ) has the same parity as the original P i P_i P i evaluated at x x x and the fixed bits. Applying Lemma 5.2 to these integers shows that the branch count is congruent modulo 2 p 2^p 2 p to
S ℓ ( ∑ x F ( ( z i v = x v ) i v , V ) ) , (71) S_\ell\left(\sum_x F\bigl((z_{iv}=x_v)_{iv},V\bigr)\right), \tag*{(71)} S ℓ ( x ∑ F ( ( z i v = x v ) i v , V ) ) , (71)
where x x x runs over all free Boolean assignments. We apply the coefficient-sum map after multiplying the test factors in the truncated ring.
Indexing the monomials. Partition the tests and the free variables separately into J = ⌈ n 1 / 4 ⌉ J=\lceil n^{1/4}\rceil J = ⌈ n 1/4 ⌉ groups of sizes differing by at most one on each side. Write T g T_g T g for a test group and X h X_h X h for a variable group. A group contains O ( n 3 / 4 ) O(n^{3/4}) O ( n 3/4 ) objects, so the number of its incidences is at most n 3 / 4 λ O k , c ( 1 ) n^{3/4\lambda}O_{k,c}(1) n 3/4 λ O k , c ( 1 ) on either side. Let N g h N_{gh} N g h be the number of incidences from T g T_g T g to X h X_h X h and let N = ∑ g , h N g h ≤ N 0 N=\sum_{g,h}N_{gh}\leq N_0 N = ∑ g , h N g h ≤ N 0 .
For an incidence monomial let d g h d_{gh} d g h be the number of its selected incidences joining groups g , h g,h g , h . Enumerate arrays of integers ( d g h ) (d_{gh}) ( d g h ) with 0 ≤ d g h ≤ N g h 0\leq d_{gh}\leq N_{gh} 0 ≤ d g h ≤ N g h and ∑ g , h d g h ≤ K \sum_{g,h}d_{gh}\leq K ∑ g , h d g h ≤ K . There are at most
( K + 1 ) J 2 = 2 O k , c ( n log n ) (K+1)^{J^2}=2^{O_{k,c}(\sqrt{n}\log n)} ( K + 1 ) J 2 = 2 O k , c ( n l o g n )
arrays, which can be enumerated using J 2 J^2 J 2 counters. For a fixed array there are
C g h = ( N g h d g h ) C_{gh}=\binom{N_{gh}}{d_{gh}} C g h = ( d g h N g h )
subsets of the specified size for this pair. Draw ⌈ log 2 C g h ⌉ \lceil\log_2 C_{gh}\rceil ⌈ log 2 C g h ⌉ Boolean wires between the two group vertices to index them in lexicographic order. For C g h = 1 C_{gh}=1 C g h = 1 both endpoints use the unique subset (possibly the entire incidence set) with no wires. Any unused bit string gives tensor entry zero. To decode a valid index, take the incidences in order and count the possible completions with or without each incidence using binomial coefficients. These have polynomial bit length, so decoding uses polynomial time and space.
The union of the subsets over all pairs specifies a squarefree monomial of degree at most K K K in N N N indeterminates. Including all monomials of this degree bound gives the upper bound ( N + K K ) \binom{N+K}{K} ( K N + K ) by stars and bars. Thus the number of wires M M M in the network for this array satisfies
M ≤ J 2 + log 2 ∏ g , h C g h ≤ J 2 + log 2 ( N + K K ) ≤ J 2 + K log 2 ( e ( N + K ) K ) = O k , c ( n ν ) . (72) \begin{aligned}
M &\le J^{2}+\log_{2}\prod_{g,h} C_{gh}\le J^{2}+\log_{2}\binom{N+K}{K}\\
&\le J^{2}+K\log_{2}\left(\frac{e(N+K)}{K}\right)=O_{k,c}(n\nu). \tag*{(72)}
\end{aligned} M ≤ J 2 + log 2 g , h ∏ C g h ≤ J 2 + log 2 ( K N + K ) ≤ J 2 + K log 2 ( K e ( N + K ) ) = O k , c ( n ν ) . (72)
Here K = Θ k , c ( n ) K=\Theta_{k,c}(n) K = Θ k , c ( n ) and N ≤ n λ O k , c ( 1 ) N\le n^{\lambda}O_{k,c}(1) N ≤ n λ O k , c ( 1 ) . Also ⌈ log 2 C g h ⌉ ≤ N g h \lceil\log_{2}C_{gh}\rceil\le N_{gh} ⌈ log 2 C g h ⌉ ≤ N g h , so the degree of each vertex is at most its number of incidences, n 3 / 4 λ O k , c ( 1 ) n^{3/4\lambda}O_{k,c}(1) n 3/4 λ O k , c ( 1 ) .
Tensor entries and contraction. A valid assignment of wire bits determines a subset S i ⊆ I i S_i\subseteq I_i S i ⊆ I i at each test. Write z i , S i = ∏ v ∈ S i z i v z_{i,S_i}=\prod_{v\in S_i}z_{iv} z i , S i = ∏ v ∈ S i z i v . The entry at a test group g g g is the coefficient of its indicated monomial in ∏ i ∈ T g B i ‾ ( z i , V ) \prod_{i\in T_g}\overline{B_i}(z_i,V) ∏ i ∈ T g B i ( z i , V ) . Since the z i z_i z i are disjoint, this is
∏ i ∈ T g [ z i , S i ] B i ‾ ( z i , V ) in B . \prod_{i\in T_g}[z_i,S_i]\overline{B_i}(z_i,V)\qquad\text{in }\mathcal{B}. i ∈ T g ∏ [ z i , S i ] B i ( z i , V ) in B .
For a variable group h h h , put b v = ∣ { i : v ∈ S i } ∣ b_v=\lvert\{i:v\in S_i\}\rvert b v = ∣{ i : v ∈ S i }∣ for v ∈ X h v\in\mathcal{X}_h v ∈ X h . Its entry is
∑ x ∈ { 0 , 1 } X h ∏ v ∈ X h x v b v = 2 ∣ { v ∈ X h : b v = 0 } ∣ ( m o d 2 p ) . \sum_{x\in\{0,1\}^{\mathcal{X}_h}}\prod_{v\in\mathcal{X}_h}x_v^{b_v}=2^{\lvert\{v\in\mathcal{X}_h:b_v=0\}\rvert}\pmod{2^p}. x ∈ { 0 , 1 } X h ∑ v ∈ X h ∏ x v b v = 2 ∣{ v ∈ X h : b v = 0 }∣ ( mod 2 p ) .
Indeed a positive exponent requires x v = 1 x_v=1 x v = 1 and a zero exponent leaves x v x_v x v free. This includes variables outside all test scopes.
Each monomial of F F F occurs in exactly one array and has exactly one valid index at each group pair. Its coefficient in F F F is the product of the test-group coefficients. After the incidences with the same v v v are set equal, its sum over Boolean assignments is the product of the variable-group entries. By (D.1), summing over these arrays exhausts all monomials. Consequently the element of B \mathcal{B} B inside S ℓ S_{\ell} S ℓ in (D.2) is the sum of the contractions of these bipartite networks.
To evaluate one test-side coefficient, let 1 T \mathbf{1}_T 1 T be the Boolean vector on I i I_i I i with support T ⊆ S i T\subseteq S_i T ⊆ S i . At 1 T \mathbf{1}_T 1 T , the multilinear polynomial evaluates to the sum of its coefficients indexed by subsets of T T T , and it agrees there with B i B_i B i . Inverting this subset sum gives
[ z i , S i ] B i ‾ ( z i , V ) = ∑ T ⊆ S i ( − 1 ) ∣ S i ∣ − ∣ T ∣ B i ( 1 T , V ) in B . [z_i,S_i]\overline{B_i}(z_i,V)=\sum_{T\subseteq S_i}(-1)^{\lvert S_i\rvert-\lvert T\rvert}B_i(\mathbf{1}_T,V)\qquad\text{in }\mathcal{B}. [ z i , S i ] B i ( z i , V ) = T ⊆ S i ∑ ( − 1 ) ∣ S i ∣ − ∣ T ∣ B i ( 1 T , V ) in B .
Each term costs polynomially many bit operations. Evaluate L ~ i ( 1 T ) \widetilde{L}_i(\mathbf{1}_T) L i ( 1 T ) from the listed monomials and use the polynomials e j e_j e j of Lemma 5.1, which are constructible in polynomial time. Store the ℓ \ell ℓ coefficients of B i ( 1 T , V ) B_i(\mathbf{1}_T,V) B i ( 1 T , V ) modulo 2 p 2^p 2 p . There are at most 2 ∣ S i ∣ ≤ 2 k λ c 2^{\lvert S_i\rvert}\le2^{k\lambda c} 2 ∣ S i ∣ ≤ 2 k λ c subsets to process. Sum one test at a time and multiply the resulting coefficients in B \mathcal{B} B over the group. This evaluates a test-group entry in 2 λ O k , c ( 1 ) 2^{\lambda O_{k,c}(1)} 2 λ O k , c ( 1 ) bit operations and polynomial space. The variable-side entries and checks for invalid wire indices take polynomial time. The graph, degree array, and entry procedures have polynomial-size descriptions.
Apply Theorem D.1 with size parameter s = n ν s=n^\nu s = n ν , root precision p = n + 1 p=n+1 p = n + 1 , and truncation order ℓ = n + 1 \ell=n+1 ℓ = n + 1 . The graph has 2 J 2J 2 J vertices and O k , c ( s ) O_{k,c}(s) O k , c ( s ) wires by (D.3). For all sufficiently large n n n its maximum degree is at most ⌈ s 9 / 10 ⌉ \lceil s^{9/10}\rceil ⌈ s 9/10 ⌉ , its precision and truncation order are O ( s ) O(s) O ( s ) , and its entry-evaluation time is at most 2 O k , c ( s 9 / 10 ) 2^{O_{k,c}(s^{9/10})} 2 O k , c ( s 9/10 ) . Each contraction then takes n O k , c ( 1 ) 2 O k , c ( s / log s ) n^{O_{k,c}(1)}2^{O_{k,c}(s/\sqrt{\log s})} n O k , c ( 1 ) 2 O k , c ( s / l o g s ) bit operations and polynomial space. Here s / log s = O ( n ν / λ ) s/\sqrt{\log s}=O(n^\nu/\sqrt{\lambda}) s / log s = O ( n ν / λ ) . The high-incidence branches and degree arrays multiply the running time by at most
2 n ν / λ + O k , c ( n log n ) . 2^{n^\nu/\sqrt{\lambda}+O_{k,c}(\sqrt{n}\log n)}. 2 n ν / λ + O k , c ( n l o g n ) .
Both terms in this exponent are O k , c ( n ν / λ ) O_{k,c}(n^\nu/\sqrt{\lambda}) O k , c ( n ν / λ ) . Process the branches and arrays sequentially. On each branch, sum the contractions in B \mathcal{B} B and apply S ℓ S_{\ell} S ℓ . Adding the branch residues modulo 2 n + 1 2^{n+1} 2 n + 1 gives the original count, since it lies between 0 and 2 n 2^n 2 n . This proves the claimed bounds, using direct enumeration for bounded exceptional sizes. □
Proof of the arbitrary-density bound in Theorem 1.1 . Normalize the formula on its original n n n declared variables as in § 6.4 . Empty clauses and formulas with no clauses have immediate answers. For n ≥ 20 n \ge20 n ≥ 20 apply Lemma 6.3 with σ = 1 / λ \sigma= 1/\sqrt{\lambda} σ = 1/ λ , where λ = ⌈ log 2 n ⌉ \lambda= \lceil\log_2 n \rceil λ = ⌈ log 2 n ⌉ . The tree has n O k ( 1 ) 2 O k ( n / λ ) n^{O_k(1)}2^{O_k(n/\sqrt{\lambda})} n O k ( 1 ) 2 O k ( n / λ ) nodes and polynomial depth. Every leaf has occurrence bound B = O k ( ( σ − 1 log ( 2 / σ ) ) k − 1 ) = λ O k ( 1 ) B = O_k((\sigma^{-1}\log(2/\sigma))^{k-1}) = \lambda^{O_k(1)} B = O k (( σ − 1 log ( 2/ σ ) ) k − 1 ) = λ O k ( 1 ) and at most B n Bn B n nonempty clauses.
For a nontrivial leaf with m G m_G m G clauses, use the initial parity checks of Lemma 6.1 and the greedy procedure of Lemma 6.2 . Each initial row has support size at most D 0 D_0 D 0 , and each additional row has list length P P P . Both bounds are λ O k ( 1 ) \lambda^{O_k(1)} λ O k ( 1 ) . By (62) , every row gives a degree-at-most-k k k equation with at most 2 k max { P , D 0 } 2^k\max\{P,D_0\} 2 k max { P , D 0 } monomials, and every queried system has at most 6 n 6n 6 n equations. A single constant c = c ( k ) c=c(k) c = c ( k ) bounds both the ratio of equations to variables and the exponent of λ \lambda λ in the monomial bound for all sufficiently large n n n . At each greedy step, use Lemma D.2 to compute N ( A ; h γ ) N(A;h_\gamma) N ( A ; h γ ) for every candidate row h γ h_\gamma h γ and append one attaining the minimum. The evaluator applies also to discarded candidates whose systems still accept nonsatisfying assignments. One final call gives N ( A ) N(A) N ( A ) for the selected matrix, which equals the leaf count by Lemma 6.2 .
Constructing the initial checks and enumerating candidates costs 2 λ O k ( 1 ) 2^{\lambda^{O_k(1)}} 2 λ O k ( 1 ) bit operations apart from the evaluations. There are at most 3 n ( 2 m G ) P + 1 = 2 λ O k ( 1 ) 3n(2m_G)^P+1=2^{\lambda^{O_k(1)}} 3 n ( 2 m G ) P + 1 = 2 λ O k ( 1 ) evaluations per leaf. Since every fixed power of λ \lambda λ is o ( n log log n / log n ) o(n\log\log n/\sqrt{\log n}) o ( n log log n / log n ) , these costs and the number of leaves are absorbed in the claimed time bound
( n + m ) O k ( 1 ) 2 O k ( n log log n / log n ) . (n+m)^{O_k(1)}2^{O_k(n\log\log n/\sqrt{\log n})}. ( n + m ) O k ( 1 ) 2 O k ( n l o g l o g n / l o g n ) .
Here m m m counts the input clauses. Traverse the tree depth first and process one query at a time. The leaf solution sets are disjoint, so their exact counts add with an ( n + 1 ) (n+1) ( n + 1 ) -bit accumulator. Together with polynomial space per query and per tree path, this gives the asserted polynomial-space bound. □
A single algorithm attains both bounds. With λ = ⌈ log 2 n ⌉ \lambda=\lceil\log_2 n\rceil λ = ⌈ log 2 n ⌉ and ν = ⌈ log 2 λ ⌉ \nu=\lceil\log_2\lambda\rceil ν = ⌈ log 2 λ ⌉ , use the clause network when m ≤ n ν m\le n\nu m ≤ n ν and the parity queries otherwise. In the first branch n ≤ s = n + m = O ( n log log n ) n\le s=n+m=O(n\log\log n) n ≤ s = n + m = O ( n log log n ) , so its exponent is O k ( n log log n / log n ) O_k(n\log\log n/\sqrt{\log n}) O k ( n log log n / log n ) even at growing density. For each fixed D D D and all sufficiently large n n n , every input with m ≤ D n m\le Dn m ≤ D n takes that branch with s = O D ( n ) s=O_D(n) s = O D ( n ) .
Proof of the contraction theorem
Throughout the proof of Theorem D.1 , log \log log denotes a base-two logarithm and ln \ln ln denotes a natural logarithm.
The coefficient ring and exact arithmetic
Write λ = ⌈ log 2 s ⌉ \lambda=\lceil\log_2 s\rceil λ = ⌈ log 2 s ⌉ and e = 4 λ e=4\lambda e = 4 λ . Choose a monic polynomial f ∈ Z [ U ] f\in\mathbb{Z}[U] f ∈ Z [ U ] of degree e e e , with coefficients in { 0 , 1 } \{0,1\} { 0 , 1 } below its leading coefficient, whose reduction modulo two is irreducible. This can be done deterministically in polynomial time in s s s by enumerating the 2 e 2^e 2 e candidates and testing divisibility over F 2 \mathbb{F}_2 F 2 by every monic polynomial of positive degree at most e / 2 e/2 e /2 . Finite fields admit an irreducible polynomial of every positive degree [vZGG13]. Put
O = Z ( 2 ) [ U ] / ( f ) , K = Q [ U ] / ( f ) , A = O [ V ] / ( V ℓ ) , A p = A / ( 2 p ) . \mathcal{O}=\mathbb{Z}_{(2)}[U]/(f),\qquad
\mathcal{K}=\mathbb{Q}[U]/(f),\qquad
\mathcal{A}=\mathcal{O}[V]/(V^\ell),\qquad
\mathcal{A}_p=\mathcal{A}/(2^p). O = Z ( 2 ) [ U ] / ( f ) , K = Q [ U ] / ( f ) , A = O [ V ] / ( V ℓ ) , A p = A / ( 2 p ) .
Here Z ( 2 ) \mathbb{Z}_{(2)} Z ( 2 ) consists of rational numbers with odd denominator. Irreducibility modulo two implies irreducibility over Q \mathbb{Q} Q , so K \mathcal{K} K is a field. For a nonzero element of K \mathcal{K} K , let v 2 v_2 v 2 be the minimum of the ordinary two-adic valuations of its coordinates in 1 , U , … , U e − 1 1,U,\ldots,U^{e-1} 1 , U , … , U e − 1 . Reduction of O \mathcal{O} O modulo two is the field F 2 e \mathbb{F}_{2^e} F 2 e . Factoring out the minimum coordinate valuation therefore shows that
v 2 ( x y ) = v 2 ( x ) + v 2 ( y ) ( x , y ≠ 0 ) . v_2(xy)=v_2(x)+v_2(y)\qquad(x,y\ne0). v 2 ( x y ) = v 2 ( x ) + v 2 ( y ) ( x , y = 0 ) .
Every element of O \mathcal{O} O that is nonzero modulo two is a unit because the determinant of its multiplication matrix is invertible in Z ( 2 ) \mathbb{Z}_{(2)} Z ( 2 ) , so the inverse matrix has entries in that ring.
Arithmetic in A p \mathcal{A}_p A p takes polynomial time and space in s , p , ℓ s,p,\ell s , p , ℓ . We use the bases 1 , U , … , U e − 1 1,U,\ldots,U^{e-1} 1 , U , … , U e − 1 and 1 , V , … , V ℓ − 1 1,V,\ldots,V^{\ell-1} 1 , V , … , V ℓ − 1 , and represent each coordinate by its integer residue between zero and 2 p − 1 2^p-1 2 p − 1 . Inverting a scalar unit can be done by inversion modulo two followed by Newton lifting, or by its multiplication matrix, using exact polynomial and integer operations [31 ] . Divisibility and precision for elements of A \mathcal{A} A are always coordinatewise.
The binary-coordinate lifts of the 2 e 2^e 2 e residue-field elements give interpolation points with pairwise unit differences. Lagrange interpolation at any required number of these points is therefore valid over A p \mathcal{A}_p A p . We will use fewer than s 4 s^4 s 4 points. A contraction whose initial entries belong to B P 0 , ℓ \mathcal{B}_{P_0,\ell} B P 0 , ℓ belongs to that subring after computation in A P 0 \mathcal{A}_{P_0} A P 0 , because it is a polynomial in those entries.
When the precision increases, we lift each tensor entry separately. For an entry originally specified modulo 2 p 2^p 2 p , its canonical lift is the element of A \mathcal{A} A obtained from the integer representatives of all its coordinates. Canonical lifting need not preserve addition or multiplication. Each recursive call contracts its specified tensors modulo the precision of that call. To define its deformation, it first makes this entrywise choice of lifts. All subsequent evaluations in that call refer to these same lifts. More explicitly, each tensor description is tagged with its creation precision p c p_c p c (P 0 P_0 P 0 for an original tensor). At every later precision, its entry is evaluated modulo 2 p c 2^{p_c} 2 p c and those same integer representatives are used. Precisions strictly increase along a recursive path, so these representatives are also the canonical representatives at every later precision. In particular, a packet tensor retains its creation-time representatives throughout the recursion.
Parameters and collision packing
All estimates below hold for sufficiently large s s s , with the threshold depending only on the fixed constants. A fixed finite range of smaller sizes is handled by direct summation. The parameter inequalities can be tested directly. Set
H = ⌈ s ∣ λ ∣ ⌉ , r = 64 , ε = 1 128 ⋅ 1024 , Δ = ⌈ s 9 / 10 ⌉ . H = \left\lceil\frac{s}{\lvert\sqrt{\lambda}\rvert} \right\rceil,\qquad r=64,\qquad\varepsilon=\frac{1}{128\cdot1024},\qquad\Delta=\left\lceil s^{9/10}\right\rceil. H = ⌈ ∣ λ ∣ s ⌉ , r = 64 , ε = 128 ⋅ 1024 1 , Δ = ⌈ s 9/10 ⌉ .
A call with M ≤ H M \le H M ≤ H edges is a leaf and is evaluated directly. At an active call at depth d d d , with the root at depth zero, use
u = u d = ⌈ ε λ 2 d ⌉ , a = a d = 2 ∑ j = 0 d u j , a − 1 = 0 , L = 2 a , D a r r = r 2 a . (73) u=u_d=\left\lceil\frac{\varepsilon\lambda}{2^d}\right\rceil,\qquad a=a_d=2\sum_{j=0}^{d}u_j,\qquad a_{-1}=0,\qquad L=2^a,\qquad D_{\mathrm{arr}}=r^{2a}. \tag*{(73)} u = u d = ⌈ 2 d ε λ ⌉ , a = a d = 2 j = 0 ∑ d u j , a − 1 = 0 , L = 2 a , D arr = r 2 a . (73)
We will arrange that every child has at most M / 8 M/8 M /8 edges and maximum degree at most Δ \Delta Δ . These assertions imply, on every active path,
H < M ≤ C s 8 2 − d , d ≤ log 2 λ 6 + O C ( 1 ) . H<M\le Cs^8 2^{-d},\qquad d\le\frac{\log_2\lambda}{6}+O_C(1). H < M ≤ C s 8 2 − d , d ≤ 6 log 2 λ + O C ( 1 ) .
Consequently
u = Θ C ( λ / 2 d ) , λ 4 / 5 ≤ u ≤ M , a ≤ 4 ε λ , L , D a r r ≤ s 1 / 1000 (74) u=\Theta_C(\lambda/2^d),\qquad\lambda^{4/5}\le u\le M,\qquad a\le4\varepsilon\lambda,\qquad L,D_{\mathrm{arr}}\le s^{1/1000} \tag*{(74)} u = Θ C ( λ / 2 d ) , λ 4/5 ≤ u ≤ M , a ≤ 4 ε λ , L , D arr ≤ s 1/1000 (74)
for all sufficiently large s s s . In particular, at each active call
M ≥ 2 D a r r 2 Δ , M ≥ L D a r r , 2 L ≤ Δ . (75) M\ge2D_{\mathrm{arr}}^2\Delta,\qquad M\ge LD_{\mathrm{arr}},\qquad2L\le\Delta. \tag*{(75)} M ≥ 2 D arr 2 Δ , M ≥ L D arr , 2 L ≤ Δ. (75)
For example, the right side of the first inequality is O ( s 9 / 10 + 2 / 1000 ) = o ( H ) O(s^{9/10+2/1000})=o(H) O ( s 9/10 + 2/1000 ) = o ( H ) . The other inequalities follow in the same way.
Lemma D.3 (Packing into packets). Under (D.6), label the vertices on each side of the network by elements of [ r ] a [r]^a [ r ] a . There is a deterministically constructible labeling and an embedding of the edges into packets of L L L slots with the following properties.
(1) There are at most 3 M / L 3M/L 3 M / L packets. Each edge occupies the same slot at its row and column ends. Unused slots have no ports.
(2) In every packet and every coordinate, the unordered pair of row and column symbols is fixed. When these symbols differ, bit i i i of the slot number specifies their orientation in coordinate i i i , for $0\le i\le a.
(3) For every coordinate and every symbol, at most 3 M / r 3M/r 3 M / r real ports on each side belong to vertices with that symbol.
The construction uses polynomial time and space in s + L s+L s + L .
Proof. For each pair of labels let X γ X_\gamma X γ be the number of edges with that pair. Independent uniform vertex labels give
E ∑ γ ( X γ − M D a r r ) 2 ≤ 2 M Δ . \mathbb{E}\sum_{\gamma}\left(X_\gamma-\frac{M}{D_{\mathrm{arr}}}\right)^2\leq2M\Delta. E γ ∑ ( X γ − D arr M ) 2 ≤ 2 M Δ.
Indeed, expansion expresses this expectation as a sum over ordered pairs of edges of their label-agreement probability minus 1 / D a r r 1/D_{\mathrm{arr}} 1/ D arr . Pairs with disjoint endpoints contribute zero. At most 2 M Δ 2M\Delta 2 M Δ ordered pairs share an endpoint, including equal edges, and each contributes at most one. Conditional expectation gives a labeling with this bound. To implement it, try each of the r a r^a r a labels of the next vertex and compute the conditional expectation by enumerating pairs of edges. Each probability concerns at most four vertices, so this is an exact polynomial-time calculation. This is the usual conditional-expectation method [55 ] .
Every load is at most M / D a r r + 2 M Δ M/D_{\mathrm{arr}}+\sqrt{2M\Delta} M / D arr + 2 M Δ . Pad all pair-label classes to a common number H p a d H_{\mathrm{pad}} H pad of slots, the maximum load rounded up to a multiple of L L L . The assumptions imply
H p a d ≤ M / D a r r + 2 M Δ + L ≤ 3 M / D a r r . H_{\mathrm{pad}}\leq M/D_{\mathrm{arr}}+\sqrt{2M\Delta}+L\leq3M/D_{\mathrm{arr}}. H pad ≤ M / D arr + 2 M Δ + L ≤ 3 M / D arr .
Fix the unordered pair of symbols in each coordinate. If a ′ a' a ′ coordinates have unequal symbols, their orientations give 2 a ′ 2^{a'} 2 a ′ pair labels. Partition their padded slots into packets using 2 a ′ − a 2^{a'-a} 2 a ′ − a slots from each of these labels per packet. This is possible because H p a d H_{\mathrm{pad}} H pad is divisible by L L L . Number a packet’s positions from 0 0 0 to L − 1 L-1 L − 1 . Its i i i th bit specifies the orientation when the i i i th pair is unequal and the copy when the pair is equal. Use one orientation convention throughout each packet.
There are H p a d D a r r / L ≤ 3 M / L H_{\mathrm{pad}}D_{\mathrm{arr}}/L\leq3M/L H pad D arr / L ≤ 3 M / L packets. In a fixed coordinate, a given symbol occurs in exactly 1 / r 1/r 1/ r of all padded pair labels on either side. Its number of real ports is therefore at most H p a d D a r r / r ≤ 3 M / r H_{\mathrm{pad}}D_{\mathrm{arr}}/r\leq3M/r H pad D arr / r ≤ 3 M / r . □
A Cauchy deformation and integral local coordinates
D.4.3. A Cauchy deformation and integral local coordinates . Fix an active call, its packets, and its entrywise lifted tensors. Use
S = { − L , − L + 1 , … , L − 1 } , C ( T ) = ∏ t ∈ S ( T − t ) , α = 2 a + 1 . S=\{-L,-L+1,\ldots,L-1\},\qquad C(T)=\prod_{t\in S}(T-t),\qquad\alpha=2^{a+1}. S = { − L , − L + 1 , … , L − 1 } , C ( T ) = t ∈ S ∏ ( T − t ) , α = 2 a + 1 .
Within a packet, for its row slot x x x and column slot y y y , put
W x y ( T ) = C ( T ) C ′ ( 0 ) ( T − ( y − x ) ) . (76) W_{xy}(T)=\frac{C(T)}{C'(0)(T-(y-x))}. \tag*{(76)} W x y ( T ) = C ′ ( 0 ) ( T − ( y − x )) C ( T ) . (76)
The factor in the denominator cancels a numerator factor, since y − x ∈ S y-x\in S y − x ∈ S . Thus this is a polynomial over Q \mathbb{Q} Q of degree 2 L − 1 2L-1 2 L − 1 . Set entries between different packets to zero and restrict to the real ports. Under the original edge identification, W ( 0 ) = I W(0)=I W ( 0 ) = I , since the diagonal entries are one and each other entry has an uncancelled zero factor.
Let A ( Y ) A(Y) A ( Y ) and B ( X ) B(X) B ( X ) be the products of the lifted row and column tensors, respectively, on independent port assignments Y , X ∈ { 0 , 1 } M Y,X\in\{0,1\}^M Y , X ∈ { 0 , 1 } M . Write l 0 ( z ) = 1 − z l_0(z)=1-z l 0 ( z ) = 1 − z and l 1 ( z ) = z l_1(z)=z l 1 ( z ) = z . Define
F ( T ) = ∑ X , Y ∈ { 0 , 1 } M A ( Y ) B ( X ) ∏ row ports x l x ( ( W ( T ) X ) x ) . (77) F(T)=\sum_{X,Y\in\{0,1\}^M}A(Y)B(X)\prod_{\text{row ports }x}l_{x}\bigl((W(T)X)_x\bigr). \tag*{(77)} F ( T ) = X , Y ∈ { 0 , 1 } M ∑ A ( Y ) B ( X ) row ports x ∏ l x ( ( W ( T ) X ) x ) . (77)
Its coefficients lie in K [ V ] / ( V ℓ ) \mathbb{K}[V]/(V^\ell) K [ V ] / ( V ℓ ) , its degree is at most M ( 2 L − 1 ) M(2L-1) M ( 2 L − 1 ) , and F ( 0 ) F(0) F ( 0 ) is the contraction of the lifted tensors. In particular, reducing F ( 0 ) F(0) F ( 0 ) modulo the call’s precision gives the required answer.
Lemma D.4. For every t ∈ S t\in S t ∈ S , the entries of W ( t + α z ) W(t+\alpha z) W ( t + α z ) belong to O [ z ] \mathcal{O}[z] O [ z ] , and F ( t + α z ) F(t+\alpha z) F ( t + α z ) belongs to A [ z ] \mathcal{A}[z] A [ z ] . Given the e e e coordinates of ζ \zeta ζ modulo 2 p 2^p 2 p , each entry W x y ( t + α ζ ) W_{xy}(t+\alpha\zeta) W x y ( t + α ζ ) mod 2 p 2^p 2 p can be computed using polynomially many bit operations in s , p s,p s , p .
Proof. The grid S S S is a complete residue system modulo 2 a + 1 2^{a+1} 2 a + 1 . For t ≠ q t \ne q t = q in S S S , v 2 ( t − q ) ≤ a v_2(t-q) \le a v 2 ( t − q ) ≤ a , and the counts of nonzero differences at every valuation are independent of t t t . Hence v 2 ( C ′ ( t ) ) = v 2 ( C ′ ( 0 ) ) v_2(C'(t)) = v_2(C'(0)) v 2 ( C ′ ( t )) = v 2 ( C ′ ( 0 )) . In
C ( t + α z ) C ′ ( 0 ) = α z ∏ q ∈ S ∖ { t } ( t − q + α z ) C ′ ( 0 ) , \frac{C(t+\alpha z)}{C'(0)}=\frac{\alpha z\prod_{q\in S\setminus\{t\}}(t-q+\alpha z)}{C'(0)}, C ′ ( 0 ) C ( t + α z ) = C ′ ( 0 ) α z ∏ q ∈ S ∖ { t } ( t − q + α z ) ,
each factor indexed by q ≠ t q \ne t q = t is coefficientwise divisible by 2 v 2 ( t − q ) 2^{v_2(t-q)} 2 v 2 ( t − q ) . After canceling these powers against the denominator, the displayed polynomial is divisible by 2 a + 1 2^{a+1} 2 a + 1 . To obtain (D.7), omit just the factor indexed by y − x y-x y − x . If y − x = t y-x=t y − x = t , this removes α z \alpha z α z and leaves an integral polynomial. Otherwise α z \alpha z α z remains and the omitted factor has two-adic content 2 v 2 ( t − y + x ) 2^{v_2(t-y+x)} 2 v 2 ( t − y + x ) with v 2 ( t − y + x ) ≤ a v_2(t-y+x) \le a v 2 ( t − y + x ) ≤ a , so the result is still divisible by two. Substitution in (D.8) proves the assertion for F F F .
For the evaluation, first divide each factor t − q + α z t-q+\alpha z t − q + α z with q ≠ t q\ne t q = t by the known integer 2 v 2 ( t − q ) 2^{v_2(t-q)} 2 v 2 ( t − q ) . Both coefficients of the resulting linear polynomial are integers. Cancel the remaining explicit powers of two against the denominator as above, and invert its odd part modulo 2 p 2^p 2 p . We can now evaluate the product directly at the supplied residue of ζ \zeta ζ , including ζ = 0 \zeta=0 ζ = 0 . The input has e p ep e p bits, and the product has O ( L ) O(L) O ( L ) factors. All coordinate operations take polynomial time in s , p s,p s , p . □
Tapered Hermite recovery
The next lemma isolates the precision estimate. All power-series truncations in its statement are ordinary truncations in z z z .
Lemma D.5 (Tapered Hermite recovery). Let integers u , M u,M u , M satisfy 1 ≤ u ≤ a 1\le u\le a 1 ≤ u ≤ a and M ≥ u M\ge u M ≥ u , and put h = ⌈ 3 M / u ⌉ h=\lceil3M/u\rceil h = ⌈ 3 M / u ⌉ . For t ∈ S ∖ { 0 } t\in S\setminus\{0\} t ∈ S ∖ { 0 } set
i = v 2 ( t ) , q t = q ( i ) = h max ( 0 , u − i ) , D t = L / 2 i . i=v_2(t),\qquad q_t=q(i)=h\max(0,u-i),\qquad D_t=L/2^i. i = v 2 ( t ) , q t = q ( i ) = h max ( 0 , u − i ) , D t = L / 2 i . Suppose F ∈ ( K [ V ] / ( V ℓ ) ) [ T ] F\in(K[V]/(V^\ell))[T] F ∈ ( K [ V ] / ( V ℓ )) [ T ] has degree at most M ( 2 L − 1 ) M(2L-1) M ( 2 L − 1 ) , F ( 0 ) ∈ A F(0)\in A F ( 0 ) ∈ A , and F ( t + α z ) ∈ A [ z ] F(t+\alpha z)\in A[z] F ( t + α z ) ∈ A [ z ] for every t ∈ S t\in S t ∈ S . For p ≥ 1 p\ge1 p ≥ 1 , its value F ( 0 ) F(0) F ( 0 ) modulo 2 p 2^p 2 p can be recovered from
F ( t + α z ) ( m o d 2 p t ) , p t = p + 8 h D t + 8 M ( a + 1 ) , q t > 0. F(t+\alpha z)\pmod{2^{p_t}},\qquad p_t=p+8hD_t+8M(a+1),\qquad q_t>0. F ( t + α z ) ( mod 2 p t ) , p t = p + 8 h D t + 8 M ( a + 1 ) , q t > 0. Only the first q t q_t q t coefficients of each polynomial are needed. Recovery takes polynomial time and space in M , L , ℓ , e M,L,\ell,e M , L , ℓ , e and the precisions.
Proof. There are L L L odd points in S S S , so ∑ t ≠ 0 q t ≥ L h u ≥ 3 M L > M ( 2 L − 1 ) \sum_{t\ne0}q_t\ge Lhu\ge3ML>M(2L-1) ∑ t = 0 q t ≥ L h u ≥ 3 M L > M ( 2 L − 1 ) . Also h ≤ 4 M / u h\le4M/u h ≤ 4 M / u , and hence q t ≤ 4 M q_t\le4M q t ≤ 4 M . For each t t t of positive multiplicity put
E t ( T ) = ∏ q ∈ S ∖ { 0 , t } ( T − q t − q ) q q . E_t(T)=\prod_{q\in S\setminus\{0,t\}}\left(\frac{T-q}{t-q}\right)^{q_q}. E t ( T ) = q ∈ S ∖ { 0 , t } ∏ ( t − q T − q ) q q .
Hermite interpolation gives
F ( 0 ) = ∑ t : q t > 0 E t ( 0 ) ( [ F ( t + α z ) E t ( t + α z ) ] < q t ) ( − t / α ) . (78) F(0)=\sum_{t:q_t>0}E_t(0)\left(\left[\frac{F(t+\alpha z)}{E_t(t+\alpha z)}\right]_{<q_t}\right)(-t/\alpha). \tag*{(78)} F ( 0 ) = t : q t > 0 ∑ E t ( 0 ) ( [ E t ( t + α z ) F ( t + α z ) ] < q t ) ( − t / α ) . (78)
For completeness, replace zero in the right side by an indeterminate T T T , and − t / α -t/\alpha − t / α by ( T − t ) / α (T-t)/\alpha ( T − t ) / α . Each summand has degree less than ∑ q t \sum q_t ∑ q t . At its own node it has the prescribed jet, and at every other node it vanishes to the required order. The difference from F F F is therefore divisible by ∏ t ≠ 0 ( T − t ) q t \prod_{t\ne0}(T-t)^{q_t} ∏ t = 0 ( T − t ) q t and has smaller degree, so is zero. This is the usual Chinese-remainder construction of Hermite interpolation [31 Section 5.6] .
Each factor of E t ( t + α z ) E_t(t+\alpha z) E t ( t + α z ) is a power of 1 + α z / ( t − q ) 1+\alpha z/(t-q) 1 + α z / ( t − q ) . It is integral and has constant term one. Its reciprocal truncated at q t q_t q t is therefore integral, so forming the quotient in (D.9) loses no precision.
Fix i = v 2 ( t ) i=v_{2}(t) i = v 2 ( t ) and D = D t D=D_{t} D = D t . Directly from the product,
v 2 ( E t ( 0 ) ) = ∑ q ≠ 0 , t q q ( v 2 ( q ) − v 2 ( t − q ) ) = D ∑ j = 1 a − i j 2 j ( q ( i + j ) − q ( i ) ) ≥ − 6 D h . (79) v_{2}(E_{t}(0))=\sum_{q\ne0,t}q_{q}\left(v_{2}(q)-v_{2}(t-q)\right)
= D\sum_{j=1}^{a-i}\frac{j}{2^{j}}\left(q(i+j)-q(i)\right)\ge-6Dh. \tag*{(79)} v 2 ( E t ( 0 )) = q = 0 , t ∑ q q ( v 2 ( q ) − v 2 ( t − q ) ) = D j = 1 ∑ a − i 2 j j ( q ( i + j ) − q ( i ) ) ≥ − 6 D h . (79)
To justify the second equality, points of valuation less than i i i contribute zero. For 1 ≤ j ≤ a − i 1\le j\le a-i 1 ≤ j ≤ a − i , there are D / 2 j D/2^{j} D / 2 j points with v 2 ( q ) = i + j v_{2}(q)=i+j v 2 ( q ) = i + j , and the same number with v 2 ( t − q ) = i + j v_{2}(t-q)=i+j v 2 ( t − q ) = i + j . The latter have v 2 ( q ) = i v_{2}(q)=i v 2 ( q ) = i , and these levels exhaust the points other than t t t with that valuation. These counts follow from the complete residue grid, whose nonzero integer differences have valuation at most a a a . Finally, q ( i + j ) − q ( i ) ≥ − h j q(i+j)-q(i)\ge-hj q ( i + j ) − q ( i ) ≥ − hj and ∑ j ≥ 1 j 2 / 2 j = 6 \sum_{j\ge1}j^{2}/2^{j}=6 ∑ j ≥ 1 j 2 / 2 j = 6 .
Evaluation of a polynomial of degree below q t q_{t} q t at − t / α -t/\alpha − t / α loses at most 4 M ( a + 1 ) 4M(a+1) 4 M ( a + 1 ) further powers of two. Thus replacing each quotient coefficient by any lift of its residue modulo 2 p t 2^{p_{t}} 2 p t changes its contribution in (D.9) by an element of 2 p A 2^{p}A 2 p A . Summing these errors loses no further precision. The reconstructed sum is integral, since it differs from the integral value F ( 0 ) F(0) F ( 0 ) by an element of 2 p A 2^{p}A 2 p A .
One can perform this last combination by rational arithmetic in the specified bases. The multipliers E t ( 0 ) ( − t / α ) j E_{t}(0)(-t/\alpha)^{j} E t ( 0 ) ( − t / α ) j , j < q t j<q_{t} j < q t , are products of polynomially many rational factors of O ( a ) O(a) O ( a ) bits, counting multiplicity. Their numerator and denominator lengths are therefore polynomial in M , L , a M,L,a M , L , a . There are polynomially many such coefficients, so even a product of their denominators is an adequate polynomial-bit common denominator. After addition, cancel its powers of two and reduce the resulting integral coordinates modulo 2 p 2^{p} 2 p . This proves the algorithmic assertion. □
At a call with input precision p p p , apply this lemma with the parameters in (D.4). For every active t t t , obtain the entire polynomial F ( t + α z ) F(t+\alpha z) F ( t + α z ) modulo 2 p t 2^{p_{t}} 2 p t by evaluation at M ( 2 L − 1 ) + 1 M(2L-1)+1 M ( 2 L − 1 ) + 1 distinct binary-coordinate lifts of residue-field elements and Lagrange interpolation. Lemma D.4 permits this interpolation over A p t A_{p_{t}} A p t . The number of points is less than s 4 s^{4} s 4 by (D.5). The evaluation algorithm below passes precision p t p_{t} p t to its children.
The input and child precisions satisfy
p ≤ s λ O ( 1 ) 2 a d − 1 , p t = O C ( M D t / u ) . (80) p\le s^{\lambda^{O(1)}2^{a_{d-1}}},\qquad p_{t}=O_{C}(MD_{t}/u). \tag*{(80)} p ≤ s λ O ( 1 ) 2 a d − 1 , p t = O C ( M D t / u ) . (80)
The first assertion holds at the root since P 0 ≤ C s P_{0}\le Cs P 0 ≤ C s . Along a path, the increments in precision are 8 h D t + 8 M ( a + 1 ) 8hD_{t}+8M(a+1) 8 h D t + 8 M ( a + 1 ) , with h ≤ 4 M / u h\le4M/u h ≤ 4 M / u , M ≤ C s M\le Cs M ≤ C s , and D t ≤ 2 a d D_{t}\le2^{a_{d}} D t ≤ 2 a d . Summing them over O ( log λ ) O(\log\lambda) O ( log λ ) depths proves the first assertion for every call, including leaves. For the second, q t > 0 q_{t}>0 q t > 0 implies i < u i<u i < u and hence
D t ≥ 2 a d − u = 2 a d − 1 + u . D_{t}\ge2^{a_{d}-u}=2^{a_{d-1}+u}. D t ≥ 2 a d − u = 2 a d − 1 + u .
Since M > H M>H M > H and u ≥ λ 4 / 5 u\ge\lambda^{4/5} u ≥ λ 4/5 , this extra factor 2 u 2^{u} 2 u dominates every fixed power of λ \lambda λ . Thus the first bound on p p p , as well as 8 M ( a + 1 ) 8M(a+1) 8 M ( a + 1 ) , is O C ( M D t / u ) O_{C}(MD_{t}/u) O C ( M D t / u ) . The remaining increment 8 h D t 8hD_{t} 8 h D t has that bound directly. All precisions remain polynomial in s s s because a d ≤ 4 e λ a_{d}\le4e\lambda a d ≤ 4 e λ .
The paper accounts for the factor 1 / u 1/u 1/ u in this estimate. For comparison, assign the same multiplicity q ∗ = Θ ( M ) q_{*}=\Theta(M) q ∗ = Θ ( M ) to every level below u u u , and zero to the remaining levels. At the last retained level i = u − 1 i=u-1 i = u − 1 , the identity (D.10) would give the loss
− q ∗ D t ∑ j = 1 a − i j 2 j = − Θ ( M D t ) . -q_{*}D_{t}\sum_{j=1}^{a-i}\frac{j}{2^{j}}=-\Theta(MD_{t}). − q ∗ D t j = 1 ∑ a − i 2 j j = − Θ ( M D t ) .
Our multiplicities instead change by only h = Θ ( M / u ) h=\Theta(M/u) h = Θ ( M / u ) per level, giving loss O ( M D t / u ) O(MD_{t}/u) O ( M D t / u ) . The cumulative choice of a d a_{d} a d provides the additional factor 2 u 2^{u} 2 u needed to absorb inherited precision and the evaluation loss. Thus the smaller bound holds at every retained level and every recursion depth.
Modes for interactions between groups
Fix an active t t t and an interpolation value ζ ∈ O \zeta\in\mathcal{O} ζ ∈ O for z z z . In this subsection T = t + α ζ T=t+\alpha\zeta T = t + α ζ and all calculations are modulo 2 p t 2^{p_t} 2 p t . Put i = v 2 ( t ) < u i=v_2(t)<u i = v 2 ( t ) < u and D = L / 2 i D=L/2^i D = L / 2 i . Group vertices on both sides by their symbol in coordinate i i i . Entries of W ( T ) W(T) W ( T ) whose two ports have the same group are called local and are kept unchanged.
This choice of coordinate makes W ( t ) W(t) W ( t ) local. Indeed, W x y ( t ) = 0 W_{xy}(t)=0 W x y ( t ) = 0 unless y − x = t y-x=t y − x = t . Adding an integer of valuation i i i flips bit i i i , so a surviving pair has different i i i th bits. When the packet’s two symbols in that coordinate differ, this means that the row and column symbols agree. Equal pairs of symbols already lie in one group. Moving from t t t to t + α ζ t+\alpha\zeta t + α ζ introduces the crossing terms that we now expand.
In a packet whose two symbols in coordinate i i i differ, a row position x x x and a column position y y y are in different groups exactly when their i i i th bits are equal. Partition columns into tiles
y = y 0 + 2 i + 1 j , 0 ≤ y 0 < 2 i + 1 . y=y_0+2^{i+1}j,\qquad0\le y_0<2^{i+1}. y = y 0 + 2 i + 1 j , 0 ≤ y 0 < 2 i + 1 .
The column group is constant on a tile. For a row crossing to that tile,
v 2 ( t − y 0 + x ) ≤ i . v_2(t-y_0+x)\le i. v 2 ( t − y 0 + x ) ≤ i .
Otherwise y 0 y_0 y 0 would agree with x + 2 i x+2^i x + 2 i modulo 2 i + 1 2^{i+1} 2 i + 1 , contrary to equality of their i i i th bits. Adding α ζ \alpha\zeta α ζ does not change this valuation. A geometric expansion consequently gives
W x y ( T ) = ∑ b ≥ 0 b + 1 < p t C ( T ) C ′ ( 0 ) ( T − y 0 + x ) ( 2 i + 1 T − y 0 + x ) b j b ( m o d 2 p t ) . (81) W_{xy}(T)=\sum_{\substack{b\ge0\\b+1<p_t}}\frac{C(T)}{C'(0)(T-y_0+x)}
\left(\frac{2^{i+1}}{T-y_0+x}\right)^b j^b
\pmod{2^{p_t}}. \tag*{(81)} W x y ( T ) = b ≥ 0 b + 1 < p t ∑ C ′ ( 0 ) ( T − y 0 + x ) C ( T ) ( T − y 0 + x 2 i + 1 ) b j b ( mod 2 p t ) . (81)
Indeed the first fraction has valuation at least a + 1 − i ≥ 1 a+1-i\ge1 a + 1 − i ≥ 1 , and the ratio raised to the b b b th power has valuation at least one before taking that power. The geometric remainder is divisible by 2 p t 2^{p_t} 2 p t . These expressions are computable by factoring the known powers of two and using only unit inverses.
For each such packet, tile, and b b b introduce a mode variable Z Z Z of weight w Z = b + 1 w_Z=b+1 w Z = b + 1 , to be replaced by
L Z ( X ) = ∑ real columns y in the tile j b X y . L_Z(X)=\sum_{\text{real columns }y\text{ in the tile}}j^bX_y. L Z ( X ) = real columns y in the tile ∑ j b X y .
As usual j 0 = 1 j^0=1 j 0 = 1 , including j = 0 j=0 j = 0 . Its source is the tile’s column group and its target is the other group in that packet’s coordinate pair. Formula (D.12) expresses each row form as its local part plus a linear combination of its targeted modes. The coefficient of Z Z Z is divisible by 2 w Z 2^{w_Z} 2 w Z . There are at most
( 3 M / L ) 2 i + 1 = 6 M / D (82) (3M/L)2^{i+1}=6M/D \tag*{(82)} ( 3 M / L ) 2 i + 1 = 6 M / D (82)
variables of any one weight.
In the product of the affine factors l Y x ( ( W ( T ) X ) x ) l_{Y_x}((W(T)X)_x) l Y x (( W ( T ) X ) x ) , every coefficient of a mode monomial Z β Z^\beta Z β is divisible by 2 ∑ Z w Z β Z 2^{\sum_Z w_Z\beta_Z} 2 ∑ Z w Z β Z . Consequently only the exponent tuples
∑ Z w Z β Z < p t (83) \sum_Z w_Z\beta_Z<p_t \tag*{(83)} Z ∑ w Z β Z < p t (83)
need be considered. The number of these tuples is
exp ( O ( M p t / D ) ) = exp ( O C ( M / u ) ) . (84) \exp\!\left(O\!\left(\sqrt{Mp_t/D}\right)\right)
=\exp\!\left(O_{\mathcal{C}}(M/\sqrt{u})\right). \tag*{(84)} exp ( O ( M p t / D ) ) = exp ( O C ( M / u ) ) . (84)
Here is the complete counting estimate. For any θ > 0 \theta>0 θ > 0 , the generating product and (D.13) bound the number by
exp ( θ p t + 6 M D ∑ j ≥ 1 − ln ( 1 − e − θ j ) ) . \exp\!\left(\theta p_t+\frac{6M}{D}\sum_{j\ge1}-\ln(1-e^{-\theta j})\right). exp ( θ p t + D 6 M j ≥ 1 ∑ − ln ( 1 − e − θ j ) ) .
Expanding the logarithm and summing the geometric series gives
∑ j ≥ 1 − ln ( 1 − e − θ j ) = ∑ h ≥ 1 1 h ( e θ h − 1 ) ≤ 1 θ ∑ h ≥ 1 1 h 2 . \sum_{j\ge1} -\ln(1-e^{-\theta j})=\sum_{h\ge1}\frac{1}{h(e^{\theta h}-1)}\le\frac{1}{\theta}\sum_{h\ge1}\frac{1}{h^2}. j ≥ 1 ∑ − ln ( 1 − e − θ j ) = h ≥ 1 ∑ h ( e θ h − 1 ) 1 ≤ θ 1 h ≥ 1 ∑ h 2 1 .
Take θ = M D p t \theta=\sqrt{\frac{M}{Dpt}} θ = D pt M and use (D.11). All mode variables and their exponents have polynomial-size descriptions. Tuples satisfying (D.14) can be enumerated with polynomial delay and space by ordering the variables and successively choosing each exponent subject to the remaining budget. Every feasible partial choice has the all-zero continuation, so the number of visited partial choices is at most the number of complete tuples times the number of variables, up to an additive constant.
The child networks and their descriptions
For one tuple β \beta β in (D.14) construct a child network for each group g ∈ [ r ] g\in[r] g ∈ [ r ] . Place all current vertices in group g g g , from both sides of the current network, on one side of the child. Retain their ports and their chosen lifted entries, now reduced modulo 2 p t 2^{p_t} 2 p t . On the other side put one vertex for each packet, with an edge to every retained port of that packet. Its indices are precisely the row bits Y Y Y and column bits X X X of group g g g in the packet.
To define this new packet tensor, form the product of the row factors l Y X l_{Y X} l Y X for group g g g in the packet, with their arguments expressed in local column bits and formal modes. Extract the coefficient with exponents β Z \beta_Z β Z for all modes targeted at g g g in that packet. Multiply it by
∏ Z in this packet source ( Z ) = g L Z ( X ) β Z . \prod_{\substack{Z\text{ in this packet}\\ \operatorname{source}(Z)=g}}L_Z(X)^{\beta_Z}. Z in this packet source ( Z ) = g ∏ L Z ( X ) β Z .
Empty products equal one. If there are no target rows, the extracted coefficient is zero whenever a target exponent is positive. If the source tile of Z Z Z has no real column, then L Z ( X ) = 0 L_Z(X)=0 L Z ( X ) = 0 and its power contributes one for β Z = 0 \beta_Z=0 β Z = 0 and zero otherwise.
Every mode has one target and one source. Coefficient extraction therefore factors over the packet-group row products, and the substitution for each mode depends only on bits in its source group. Distributing the product in (D.8), and then summing the independent bits within groups, proves the exact identity
F ( t + α ζ ) = ∑ β : ∑ Z β Z ≤ p t ∏ g = 1 r Z g , β ( m o d 2 p t ) , (85) F(t+\alpha\zeta)=\sum_{\beta:\,\sum_Z\beta_Z\le pt}\prod_{g=1}^{r}Z_{g,\beta}\pmod{2^{pt}}, \tag*{(85)} F ( t + α ζ ) = β : ∑ Z β Z ≤ pt ∑ g = 1 ∏ r Z g , β ( mod 2 pt ) , (85)
where Z g , β Z_{g,\beta} Z g , β is the contraction of the child just defined. The omitted monomials vanish by their coefficient divisibility.
By Lemma D.3 , a child has at most 6 M / r = 3 M / 32 < M / 8 6M/r=3M/32<M/8 6 M / r = 3 M /32 < M /8 edges. Old vertex degrees are unchanged, and a new packet vertex has at most 2 L ≤ Δ 2L\le\Delta 2 L ≤ Δ ports. Thus the invariants used in (D.5) hold inductively.
All new tensors are given implicitly. To evaluate a packet tensor entry, expand its product of at most L L L affine row factors. Each factor has polynomially many terms in s s s , including its local term. Enumerating these choices, checking the desired exponents, and summing the resulting terms takes
exp ( O ( L log s ) ) \exp(O(L\log s)) exp ( O ( L log s ))
time and polynomial space. The factors L Z ( X ) β Z L_Z(X)^{\beta_Z} L Z ( X ) β Z are computed by ordinary repeated squaring in A p t \mathbb{A}_{p_t} A p t . Because L ≤ s 1 / 1000 L\le s^{1/1000} L ≤ s 1/1000 , this entry cost is exp ( O ( s 9 / 10 ) ) \exp(O(s^{9/10})) exp ( O ( s 9/10 )) .
A description of a new tensor consists of its packet data, the tuple β \beta β , the interpolation value, and the creation precision. These data and the local kernel suffice to compute its entry directly. A retained tensor is evaluated from its original description, or from its own creation-time description if it was created earlier in the recursion. Its residue at that precision is then canonically lifted to the current precision. The old descriptions are immutable and shared by reference. Thus no composition of entry routines builds up with the depth, and all entry routines continue to have the required time and space bounds. Only polynomially many vertices and polynomially much new description data are added along a path.
Time and space bounds.
Proof of Theorem D.1 . Embed the original entries into A P 0 A_{P_0} A P 0 and perform the recursive algorithm above. At an active call, for every node of positive multiplicity and every required residue-distinct interpolation value, compute (D.16) by its child contractions. Interpolate F ( t + α z ) F(t+\alpha z) F ( t + α z ) and apply Lemma D.5 . At a leaf, sum directly over all Boolean edge assignments. Lemma D.4 , the recursion identity, and the recovery lemma prove correctness by induction from the leaves.
The number of interpolation nodes, values, and groups at a call is polynomial in s s s , independently of L \mathcal{L} L . By (D.15), the number of children of an active depth-d d d call is at most
s O ( 1 ) exp ( O C ( s λ ( 2 8 ) d ) ) . s^{O(1)}\exp\left(O_C\left(\frac{s}{\sqrt{\lambda}}\left(\frac{\sqrt{2}}{8}\right)^d\right)\right). s O ( 1 ) exp O C λ s ( 8 2 ) d .
Indeed M ≤ C S s 8 − d M\leq C_Ss8^{-d} M ≤ C S s 8 − d and u d = Θ C ( λ / 2 d ) u_d=\Theta_C(\lambda/2^d) u d = Θ C ( λ / 2 d ) . Multiplying these bounds over the O C ( log λ ) O_C(\log\lambda) O C ( log λ ) depths, or bounding the number of nodes on each level in this way, gives at most
exp ( O C ( s / λ ) + O C ( λ log λ ) ) = exp ( O C ( s / λ ) ) \exp\left(O_C(s/\sqrt{\lambda})+O_C(\lambda\log\lambda)\right)=\exp(O_C(s/\sqrt{\lambda})) exp ( O C ( s / λ ) + O C ( λ log λ ) ) = exp ( O C ( s / λ ))
calls in total. At a leaf, direct summation uses at most 2 H 2^H 2 H assignments and polynomially many entry evaluations per assignment. Its cost is bounded by a polynomial in s + L s+\mathcal{L} s + L times
exp ( O C ( H ) + O C , A ( s 9 / 10 ) ) = exp ( O C , A ( s / λ ) ) . \exp\left(O_C(H)+O_{C,A}(s^{9/10})\right)=\exp(O_{C,A}(s/\sqrt{\lambda})). exp ( O C ( H ) + O C , A ( s 9/10 ) ) = exp ( O C , A ( s / λ )) .
Local arithmetic, packing, descriptions, and recovery use polynomial time per generated term, apart from the already bounded entry computations. The description-dependent factor bounds the work per call. Since the branching bound is independent of L \mathcal{L} L , the total work retains a fixed polynomial factor in s + L s+\mathcal{L} s + L . This proves the time bound.
For space, traverse the recursion depth first, accumulating one sum over β \beta β and one product over groups at a time. Store the polynomially many Taylor data needed for a call’s recovery, its current interpolation and mode indices, and its graph and new tensor descriptions. Their sizes are polynomial in s + L s+\mathcal{L} s + L , including the precisions by (D.11). There are only O C ( log λ ) O_C(\log\lambda) O C ( log λ ) stack levels. The common-denominator calculation in Lemma D.5 also uses only polynomial-bit integers. Each call accumulates its contraction terms modulo its own fixed precision. Original entry routines use polynomial space by hypothesis, and the new routines have the same property. This proves the space bound. Finally extract the base coordinates in A P 0 A_{P_0} A P 0 , which give the answer in B P 0 , ℓ B_{P_0,\ell} B P 0 , ℓ . □