8 Circuit lower bounds and proof complexity
This chapter collects unconditional lower bounds for concrete computational models, together with the proof-complexity side of the same program. The library proves Shannon’s counting bounds, which determine the maximum circuit complexity of an \(N\)-bit function up to a constant factor, the essential-input bound and Schnorr’s \(2N - 1\) bound for parity, Valiant’s depth-reduction lemma, Spira’s formula balancing, the monotone Karchmer–Wigderson correspondence, and the soundness of resolution. For \(\mathsf{AC}^0\) it proves a finite, width-sensitive switching lemma, iterates it through arbitrary depth-bounded formulas, derives a finite counting obstruction for every formula computing parity, and concludes that parity is not in \(\mathsf{AC}^0\) as defined in this library, so that \(\mathsf{AC}^0 \subsetneq \mathsf{TC}^0\). All of these results are finite or nonuniform. Beyond them, the plan covers Håstad’s quantitative size bound for the circuits of this library, monotone circuit lower bounds, pseudorandom restrictions, and resolution size and width lower bounds leading to the pigeonhole principle and to Cook–Reckhow proof systems (roadmap track L5). Section 8.2 collects the results of the imported algebraic-circuits library: parity bounds in the De Morgan basis and in its own \(\mathsf{AC}^0\) model (including parity outside that model’s \(\mathsf{AC}^0\) and an explicit Håstad-type size bound), monotone CLIQUE (more than \(2^{\sqrt{k}}\) gates for every \(k \le n^{1/4}\)), Nechiporuk’s formula bound, Karchmer–Wigderson, a circuit-size hierarchy, conditional complexity, algebraic lower bounds, and mass production; the imported sunflower lemma appears in Section 8.10. Its circuit results use CSLib’s circuits, each over the imported library’s own signature and cost model; Nechiporuk’s bound and Karchmer–Wigderson are about formulas, and the Waring bound is an identity of polynomials.
8.1 Counting bounds
For every \(N \ge 6\) there is a function \(f : \{ 0,1\} ^N \to \{ 0,1\} \) that no fan-in-two AND/OR circuit of size at most \(\lfloor 2^N / (5N) \rfloor \) computes, where the size \(G + 1\) of a single-output circuit counts its output gate. Consequently \(\mathrm{size}(f) {\gt} \lfloor 2^N / (5N) \rfloor \).
Encode circuits of a given size by short descriptors and compare their number with the \(2^{2^N}\) functions.
For every \(N \ge 16\), every \(f : \{ 0,1\} ^N \to \{ 0,1\} \) satisfies \(\mathrm{size}(f) \le \lfloor 18 \cdot 2^N / N \rfloor \) over the fan-in-two AND/OR basis.
Select among the columns of the truth table with a multiplexer, reading each column from a library that contains every function of the remaining variables.
For every \(\varepsilon {\gt} 0\) and all sufficiently large \(N\), every \(f : \{ 0,1\} ^N \to \{ 0,1\} \) satisfies \(\mathrm{size}(f) \le (1 + \varepsilon )\, 2^N / N\).
CSLib proves the bound for its De Morgan circuits by refining the column library: the rows of the truth table are grouped into strips, and each strip’s column patterns are computed once and shared. A CSLib circuit with \(g\) gates is a fan-in-two AND/OR circuit of size \(g + 1\), and the extra gate is absorbed by the slack in \(\varepsilon \).
For all sufficiently large \(N\), some \(f : \{ 0,1\} ^N \to \{ 0,1\} \) satisfies \(2^N / N {\lt} N + 2\, \mathrm{size}(f)\), that is, \(\mathrm{size}(f) {\gt} (2^N / N - N) / 2\), with \(2^N / N\) a real quotient.
CSLib’s counting argument gives a function that no De Morgan circuit with at most \(2^N / N\) gates computes, and a fan-in-two AND/OR circuit of size \(s\) is a CSLib circuit with at most \(N + 2s\) gates.
Let the slice complexity of a language \(L\) at length \(n \ge 1\) be the size complexity of its length-\(n\) slice, and \(0\) at \(n = 0\), where a circuit family answers with a stored bit. Then \(L \in \mathsf{SIZE}(s)\) exactly when the slice complexity is at most \(s(n)\) at every \(n\). If \(L \in \mathsf{SIZE}(s)\), then every length-\(n\) slice, \(n = 0\) included, is decided by a CSLib De Morgan circuit with at most \(n + 2s(n) + 1\) gates; conversely, CSLib circuits with at most \(s(n)\) gates at every length \(n \ge 1\) put \(L\) in \(\mathsf{SIZE}(s + 1)\).
For every \(\varepsilon {\gt} 0\) there is one threshold \(N_0\) such that every language has slice complexity at most \((1 + \varepsilon ) 2^n / n\) at every length \(n \ge N_0\). Hence every language is in \(\mathsf{SIZE}(s)\) for some \(s\) with \(s(n) \le (1 + \varepsilon ) 2^n / n\) for all large \(n\), and for some \(s = O(\lfloor 2^n / n \rfloor )\). Conversely, a single language lies outside \(\mathsf{SIZE}(s)\) for every \(s\) with \(n + 2s(n) \le 2^n / n\) for all large \(n\), in particular for every \(s = o(\lfloor 2^n / n \rfloor )\).
Apply Lupanov’s bound to every slice. A big-O bound only constrains large lengths, so Lupanov’s bound with \(\varepsilon = 1\) gives \(O(\lfloor 2^n / n \rfloor )\), the floor costing at most a factor of two. For the lower bound, CSLib’s family-level Shannon bound gives a language with \(2^n / n {\lt} n + 2\, \mathrm{size}\) at every large length after translating circuits as in Theorem 281; a size bound \(s\) with \(n + 2s(n) \le 2^n / n\) for large \(n\) contradicts this at some length.
8.2 Results from the algebraic-circuits library
These results come from the algebraic-circuits library, imported wholesale under Complexitylib/Algebraic, and keep the Algebraic namespace. The circuit results are stated for CSLib’s straight-line circuits (Cslib.Circuits.Circuit), but each over the imported library’s own signature and cost model, not over CSLib’s De Morgan signature or the bases of this library. For example, its De Morgan signature adds an identity gate to constants, negation, conjunction, and disjunction; the De Morgan parity bound charges only conjunctions and disjunctions, while the hierarchy counts every gate; its \(\mathsf{AC}^0\) circuits have unbounded fan-in, with negations free and adding no depth; mass production charges negations, conjunctions, and disjunctions but not constants or identities. Each node names its model and what it counts. Nechiporuk’s formula bound and Karchmer–Wigderson are stated for the imported library’s formula types, not for circuits, and the Waring bound is an identity of polynomials with no circuit in its statement. Conditional complexity is defined in this library, although it lives in CSLib’s namespace. The consolidation plan in ROADMAP.md relates these results to the statements elsewhere in this chapter.
For every \(n\), every circuit over the imported library’s De Morgan signature computing \(n\)-input parity has at least \(3(n - 1)\) AND and OR gates; constant, identity, and negation gates are free.
Gate elimination: fixing a well-chosen input removes at least three AND or OR gates while leaving a parity function on one fewer input.
No nonuniform family of unbounded fan-in AND/OR circuits with negations at the inputs, with polynomially many AND and OR gates (negations free) and constant AND/OR depth (negations add no depth), computes parity at every input length. The same holds when negation gates may occur anywhere in the circuits. This is stated for the imported library’s own \(\mathsf{AC}^0\) model; Theorem 955 proves the statement for \(\mathsf{AC}^0\) as defined here independently, through this library’s own normalization and switching lemmas.
Håstad’s switching lemma: random restrictions collapse each bottom layer of such a circuit to a shallow decision tree, reducing the depth, while parity restricts to parity on the remaining inputs. At input length \((20(t + 1))^{d - 1}\) this forces \(2^{t + 1} \le 20\, t\, S\) for a depth-\(d\) circuit with \(S\) AND and OR gates, which a polynomial bound on \(S\) violates for large \(t\).
Consider circuits of the imported library’s \(\mathsf{AC}^0\) model: unbounded fan-in AND and OR gates and negation gates anywhere, where \(S\) counts the AND and OR gates and the depth counts AND and OR levels only. Let \(d \ge 2\) and \(t \ge 1\). Every such circuit with \(n \ge (20(t + 1))^{d - 1}\) inputs and depth at most \(d\) that computes \(n\)-input parity satisfies \(2^{t + 1} \le 20\, t\, S\). In particular, if \(n \ge 40^{d - 1}\) and \(q = \lfloor \lfloor n^{1/(d-1)} \rfloor / 20 \rfloor \), with \(\lfloor n^{1/(d-1)} \rfloor \) the integer root, then \(S \ge \lfloor 2^q / (20(q - 1)) \rfloor \). This bound is of order \(2^{\Omega (n^{1/(d-1)})}\), but no asymptotic form is stated. It is not transferred to the circuits of this library; see Theorem 956.
Apply \(d - 1\) rounds of random restrictions. Each round switches one layer, with a union bound over the \(S\) AND and OR gates, while an explicit integer schedule keeps enough inputs free; the unreduced top gate is then a bounded-width normal form, which cannot compute parity on the surviving inputs. The switching condition is equivalent to \(20\, t\, S {\lt} 2^{t + 1}\), and \(n \ge (20(t + 1))^{d - 1}\) implies the survivor condition.
Let \(t \ge 4\) and \(N = 2^{20t}\). Every circuit over the imported library’s binary AND/OR signature (fan-in-two AND and OR gates, no constants and no negations, every gate counted) whose inputs are the \(\binom {N}{2}\) edge variables of an \(N\)-vertex graph and which computes \(2^{4t}\)-CLIQUE has more than \(2^{t \cdot 2^t}\) gates.
Razborov’s method of approximations, with the sunflower lemma bounding the error introduced at each gate.
Consider circuits over the imported library’s binary AND/OR signature, as in Theorem 361, whose inputs are the \(\binom {n}{2}\) edge variables of an \(n\)-vertex graph. If \(w \ge 16\), \(4w^2 \le k - 1\), and \(64 w^6 k \le n\), then every such circuit computing \(k\)-CLIQUE has more than \(64^w\) gates. Consequently, for every \(k\) with \(k \le n^{1/4}\) (that is, \(k^4 \le n\)), every such circuit computing \(k\)-CLIQUE has more than \(2^{2 \lfloor \sqrt{k} \rfloor }\) gates, and hence more than \(2^{\sqrt{k}}\) gates. For \(k \le 1\) no such circuit exists, and for \(2 \le k \le n\) every such circuit has at least \(\binom {n}{2} - 1\) gates.
For \(k \le 1\), \(k\)-CLIQUE accepts the empty graph, on which a circuit without constants outputs \(0\). For \(2 \le k \le n\), every edge variable is essential: deleting an edge \(e\) from the clique on a \(k\)-set containing \(e\) leaves no \(k\)-clique. A fan-in-two circuit with one output and \(G\) gates depends on at most \(G + 1\) inputs, so \(G \ge \binom {n}{2} - 1 \ge \lfloor n/2 \rfloor ^2 - 1\), which exceeds \(4^{\lfloor \sqrt{k} \rfloor }\) for \(2 \le k \le 1024\) and \(k^4 \le n\). For larger \(k\), apply the finite approximation dichotomy behind Theorem 361 with width \(w\) and \(w^2\) petals. The sunflower bound \((w + 1)\, w!\, (w^2 - 1)^w\) on the size of an approximator is at most \(F = (w + 1)\, w^{3w}\). Positive side: since \(64 w^6 k \le n\), the \(k\)-sets containing a fixed \((w + 1)\)-set form at most a \((64 w^6)^{-(w + 1)}\) fraction of all \(k\)-sets, and \(F^2\, 64^w {\lt} (64 w^6)^{w + 1}\). Negative side: since \(4w^2 \le k - 1\), plucking a sunflower with \(w^2\) petals errs on at most a \(4^{-w^2}\) fraction of the colorings with \(k - 1\) colors, and \(6F^2\, 64^w {\lt} 4^{w^2}\) because \(128 w^6 \le 4^w\) and \(6(w + 1)^2 {\lt} 2^w\) for \(w \ge 16\). For the general bound with \(k \ge 1025\) take \(w = \lfloor \lfloor \sqrt{k - 1} \rfloor / 2 \rfloor \ge 16\), so that \(4w^2 \le k - 1\), \(64 w^6 k \le k^4\), and \(6w \ge 2 \lfloor \sqrt{k} \rfloor \).
Suppose that, for all large \(n\), the length-\(n\) member of a family of Boolean functions is \(K(n)\)-rectangle-free (under every split of its inputs, every rectangle of accepted inputs has a side with fewer than \(K(n)\) elements), with \(K(n) \le n^c\) for a natural number \(c\), and has at least \(2^{n - 2}\) accepting inputs. Then for all large \(n\) every formula over the full binary basis (all sixteen binary gates, constant leaves allowed) computing the length-\(n\) member satisfies \(n^2 \le 64(c + 3)\log _2 n \cdot L\), where \(L\) counts variable leaves and constants are free; that is, it has at least \(n^2 / (64(c + 3)\log _2 n)\) variable leaves. This statement requires a polynomial rectangle threshold; the later explicit circuit family has a checked subexponential threshold.
Count subfunctions on each block of a partition of the inputs; rectangle-freeness forces the maximal number on every block at once.
Under the hypotheses of Theorem 363, split the inputs into consecutive blocks of size \(b = 3 + c(\lfloor \log _2 n\rfloor + 1)\), and consider single-output circuits over the full binary basis; a shared gate is a gate of fan-out at least two. If the shared gates whose input cone meets a block have total fan-out \(a_i\) on block \(i\), and \(20\, b\sum _i a_i \le n^2\), then for all large \(n\), \(n^2 \le 64(c+3)\log _2 n\, (2\, \mathrm{size} + 1)\), and under this budget the size is superlinear. More generally, every fan-in-two circuit has total shared fan-out at most \(2\, \mathrm{size} + 1\), so the fan-out of shared gates active on at most \(d(n)\) blocks can be absorbed into the right-hand side: if the shared gates active on more than \(d(n)\) blocks have total fan-out at most \(s(n)\) with \(20\, s(n) \le n\), then \(n^2 \le 16(5 d(n) + 4)(c+3)\log _2 n\, (2\, \mathrm{size} + 1)\) for all large \(n\), with no hypothesis on total shared fan-out. Since a gate’s block-span is at most the cardinality of its syntactic input support, the same bound holds with \(s(n) = 0\) whenever every shared gate is active on at most \(d(n)\) blocks or depends on at most \(d(n)\) inputs.
Cut the circuit at its shared gates to obtain a sequence of formulas in which each shared value is a fresh variable. On a block of inputs, a shared formula with no leaf in the current block is constant once the outside inputs are fixed, so only shared gates whose cone meets the block enter the subfunction count of Theorem 363. Summed over the blocks, each shared gate is charged its fan-out times the number of blocks its cone meets. Splitting at span threshold \(d(n)\) bounds the sum by \(d(n)(2\, \mathrm{size} + 1) + (n/b)\, s(n)\), and pairwise disjointness of the blocks injects the active blocks of a gate into its syntactic input support.
Every block sees at most the total shared fan-out, so with \(n/b\) blocks the active budget of Theorem 364 is at most \(20\, b\, (n/b)\, s(n) \le n^2\).
Consider the imported library’s De Morgan formulas, trees of literal leaves \(x_i\) and \(\neg x_i\), constant leaves, and binary AND and OR gates, with depth the length of a longest root-to-leaf path and size the number of leaves, constants included. In the Karchmer–Wigderson game of \(f\), Alice holds \(x\) with \(f(x) = 1\), Bob holds \(y\) with \(f(y) = 0\), and a deterministic protocol must output a coordinate where \(x\) and \(y\) differ. For every \(f\) on \(n \ge 1\) inputs, the minimum depth of a formula computing \(f\) equals the minimum depth of a protocol for this game, and the minimum size of a formula equals the minimum number of leaves of a protocol. The hypothesis \(n \ge 1\) is used because a protocol leaf names an input position; the fact that no protocol exists at \(n = 0\) is a remark, not a formalized statement.
Formulas and protocols translate into each other gate for move: an AND gate is a move of the player holding a rejected input, an OR gate a move of the player holding an accepted input.
In the De Morgan formulas of Theorem 366 (leaves counted, constants included), let a formula be \(1\) on a set \(A\) of inputs and \(0\) on a set \(B\), and let \(E\) be the set of pairs in \(A \times B\) at Hamming distance one. Then \(|E|^2 \le L \cdot |A| \cdot |B|\), where \(L\) is the number of leaves. Consequently, if \(A\) and \(B\) are nonempty, every input of \(A\) has at least \(s_1\) neighbours in \(B\), and every input of \(B\) has at least \(s_0\) neighbours in \(A\), then \(L \ge s_0 s_1\); in particular this holds with \(A = f^{-1}(1)\) and \(B = f^{-1}(0)\) when every one-input of \(f\) is sensitive on at least \(s_1\) coordinates and every zero-input on at least \(s_0\).
Induction on the formula. A literal separates only along its own coordinate, so its edges form a partial matching and \(|E| \le \min (|A|, |B|)\). A constant leaf has \(A\) or \(B\) empty. An AND gate splits \(B\) by which child rejects, an OR gate splits \(A\) by which child accepts, and the Cauchy–Schwarz inequality \((r_1 + r_2)^2/(b_1 + b_2) \le r_1^2/b_1 + r_2^2/b_2\) makes the measure \(|E|^2/(|A||B|)\) subadditive.
Every De Morgan formula computing the parity of \(n \ge 1\) bits has at least \(n^2\) leaves, and for \(n = 2^k\) the minimum number of leaves is exactly \(n^2\). For \(1 \le k \le n\), every De Morgan formula computing the threshold function “at least \(k\) of the \(n\) inputs are \(1\)” has at least \(k (n + 1 - k)\) leaves; for strict majority (\(k = \lfloor n/2 \rfloor + 1\), ties rejected) this is \((n - \lfloor n/2 \rfloor )(\lfloor n/2 \rfloor + 1)\), which equals \(((n + 1)/2)^2\) for odd \(n\).
Parity is sensitive to every coordinate at every input. For thresholds take \(A\) the inputs of weight \(k\) and \(B\) those of weight \(k - 1\): each input of \(A\) has \(k\) neighbours in \(B\) and each input of \(B\) has \(n + 1 - k\) neighbours in \(A\). The matching upper bound for parity splits the inputs in half and uses \(x \oplus y = (x \wedge \neg y) \vee (\neg x \wedge y)\), with negated subformulas obtained by De Morgan duality at no cost, so the leaf count multiplies by four when \(n\) doubles.
Call an edge uncut when its endpoints agree on every shared value computed so far. Khrapchenko’s induction, run on a formula over the inputs and the shared values, gives \(|E'|^2 \le X' \cdot |A| \cdot |B|\) for its uncut edges \(E'\), where \(X'\) counts only the formula’s input literals: a literal on \(z_j\) separates only pairs that \(z_j\) cuts. For a shared formula \(G\), an uncut edge on which \(G\) is constant stays uncut for the rest of the program; the others lie in \(\{ G = 1\} \times \{ G = 0\} \), where \(G\) separates them, or in \(\{ G = 0\} \times \{ G = 1\} \), where the De Morgan dual of \(G\) does, and by the Cauchy–Schwarz inequality the two rectangles together contain at most \(\sqrt{X_G \, |A| \, |B|}\) such edges. Every edge is cut by the output, so \(|E| \le \sum _j \sqrt{X_j \, |A| \, |B|}\) over the \(k + 1\) formulas, and the Cauchy–Schwarz inequality gives the factor \(k + 1\). The corollaries repeat the computations of Corollary 368, which use only this rectangle bound, with \(X \le s + k + 1\).
A circuit becomes a program from its last gate down, over variables for all its wires; initially the program outputs the literal of the output wire. A gate of fan-out at least two becomes a shared formula whose value is exactly the variable of its wire. Any other gate’s formula is substituted for its variable, which occurs at most once, so the substitution adds only the gate’s own cost, and every earlier gate still occurs at most as often as its fan-out.
Process the gates from the last one down as for De Morgan circuits. An XOR or EQUIV gate of any fan-out becomes two shared values, the gate’s two arguments, followed by the four-leaf formula \((z_1 \wedge \neg z_2) \vee (\neg z_1 \wedge z_2)\) or \((z_1 \wedge z_2) \vee (\neg z_1 \wedge \neg z_2)\) substituted for the gate; its leaves read only shared values, so it adds no input leaf and two shared values. The bounds then follow from Khrapchenko’s bound for shared programs.
Cut the inputs into \(k + 1\) blocks of \(m = \lceil n/(k + 1) \rceil \) consecutive bits. Share the parity of the first block, then, for each of the next \(k - 1\) blocks, the exclusive or of the last shared value with the parity of the block, and output the exclusive or of the last shared value with the parity of the last block. A balanced formula for the parity of \(m\) bits has at most \(2m^2\) gates, and \(z \oplus \varphi = (z \wedge \neg \varphi ) \vee (\neg z \wedge \varphi )\) uses \(\varphi \) and its De Morgan dual, so \(s \le 2m^2 + k(4m^2 + 3)\), and \((k + 1) m \le n + k\).
For fixed \(n\) and \(s\), \(\mathsf{MCSP}_{n,s}\) is the Boolean function on \(N = 2^n\) truth-table bits that accepts exactly the truth tables whose (weighted) circuit complexity over a given signature is at most \(s\). Truth tables are indexed big-endian: the first input bit selects the lower or upper half, and pairing two \(2^n\)-bit tables gives the table of the multiplexer on the first bit. This differs from the language \(\mathsf{MCSP}\) of Definition 1107, which uses encoded instances, the library’s AND/OR basis, and little-endian indexing. The main cost model is the imported De Morgan signature with only AND and OR charged.
Suppose \(\mathsf{MCSP}_{n,s}\) (De Morgan AND/OR cost, or full binary basis gate count with \(s \ge 1\)) is non-constant. Then every circuit computing it reads all \(2^n\) inputs. Hence every fan-in-two circuit computing it has at least \(2^n - 1\) gates, and every De Morgan circuit computing the De Morgan variant has at least \(2^n - 1\) AND and OR gates.
Flipping input variables permutes the truth-table coordinates transitively and preserves complexity (negations are free, or are absorbed into binary gates). A non-constant function that is invariant under a transitive group of coordinate permutations depends on every coordinate. Then apply the frontier bounds on the input support.
In the De Morgan AND/OR cost model, the multiplexer of \(u\) with itself on a fresh first variable has the same complexity as \(u\). If \(u_0 \ne u_1\) and one of them has positive complexity, the multiplexer of \(u_0\) and \(u_1\) has complexity strictly greater than both. Consequently, if \(T\) has complexity exactly \(s \ge 1\), the pair \((T', T)\) (and likewise \((T, T')\)) is a yes instance of \(\mathsf{MCSP}_{n+1,s}\) if and only if \(T' = T\).
Restrict the first variable. If \(u_0 \ne u_1\), some charged gate reads the first variable, and fixing it eliminates that gate.
The conjunction of two variables has De Morgan AND/OR complexity exactly \(1\). If some \(2^n\)-bit truth table has complexity exactly \(s \ge 1\), then \(\mathsf{MCSP}_{n+1,s}\) in this model is non-constant. In particular, for \(N = 2^{n+3}\), every De Morgan circuit computing \(\mathsf{MCSP}_{n+3,1}\) has at least \(N - 1\) AND and OR gates. Every fan-in-two circuit, over any basis, has at least \(N - 1\) gates. Every De Morgan formula has at least \(N\) leaves.
One gate suffices. Both variables are essential, and a circuit reads at most one more input than its cost. For \(T\) of complexity \(s\), the pair \((T, T)\) is accepted and \((\lnot T, T)\) is rejected.
Let \(E\) be the set of \(2^n\)-bit truth tables of De Morgan AND/OR complexity exactly \(s \ge 1\), and suppose \(E\) is nonempty. Duplicating a table in \(E\) across both halves of the cube preserves its exact complexity, so iterating \(k\) times embeds \(E\) injectively into the exact-complexity-\(s\) tables on \(n + k\) bits. Write \(N = 2^{n+1}\). For any circuit computing \(\mathsf{MCSP}_{n+1,s}\), every wire cut separating the two halves of the truth table carries at least \(\log _2 |E|\) bits. Every De Morgan formula computing it has at least \(N\) leaves. A De Morgan circuit with at most \(k\) shared gates satisfies \(N \le (k+1)(\mathrm{cost} + k + 1)\). Every binary formula \(F\) satisfies \(|E| \le 2 \cdot 16^{\ell }\), where \(\ell \) is the number of leaves of \(F\) in either half, and \(|E|^2 \le 4 \cdot 16^{L}\), where \(L\) is the total number of leaves; the analogous bound holds for full-binary-basis circuits with at most \(k\) shared gates of total shared fan-out at most \(f\), with \(L\) replaced by \(\mathrm{size} + k + 1 + 2f\) and an extra factor \(4^k\). All of these bounds are at most linear in \(N\).
The diagonal tables \((T, T)\) for \(T \in E\) are yes instances whose one-bit flips are all no instances, and mixing two diagonals across the halves gives a no instance. Apply the single-cut, Khrapchenko, and Nechiporuk arguments on both halves of the truth table.
For real exponents \(1 \le a {\lt} b\), the class of Boolean function families, one function for each input length, whose De Morgan circuit complexity in the imported library’s signature (every gate counted, constants and identities included) is at most \(C \lfloor n^a \rfloor \) for some constant \(C\) and all large \(n\) is strictly contained in the corresponding class for \(\lfloor n^b \rfloor \). The families are nonuniform and no explicit separating family is given.
At each length walk from a constant function towards a function of complexity above \(2^n / n\), which Shannon’s counting bound supplies, one truth-table entry at a time. Each step changes the complexity by at most \(2n\), so some function has complexity in \((\lfloor n^b \rfloor - 2n, \lfloor n^b \rfloor ]\). The resulting family is in the larger class, and since \(\lfloor n^b \rfloor - 2n\) eventually exceeds every constant multiple of \(\lfloor n^a \rfloor \), not in the smaller one.
Let \(C(f)\) be the minimum number of gates of a single-output circuit over the imported library’s De Morgan signature computing \(f : \{ 0,1\} ^n \to \{ 0,1\} \), every gate counted, constants and identities included. Then \(\lvert C(f) - C(g) \rvert \le 2n \cdot d_H(f, g)\), where \(d_H\) is the number of truth-table entries on which \(f\) and \(g\) differ. Consequently, if \(t \ge 1\) and \(t {\lt} C(h)\) for some \(h\), then some \(f\) has \(t {\lt} C(f) \le t + 2n\).
Patching one truth-table entry costs at most \(2n\) gates, by combining the old circuit with an indicator of the changed point. Walk from a constant function to a hard one entry by entry.
Sparse corrections in CSLib’s circuit model.
The following results use the native CSLib De Morgan signature, counting AND, OR, NOT, and constant gates, with free fan-out and output designation. They refine the entry-by-entry estimate above by sharing the support and the labels of a whole correction. The synthesis methods are classical: see A. V. Chashkin, On computing partial Boolean functions (in Russian), Mathematical Problems of Cybernetics 22 (2024), pp. 152–222, Sections 2–3, which credit L. A. Sholomov for partial-function synthesis and O. B. Lupanov for bounded-weight synthesis. The formalization proves the needed specialization from finite pattern banks and affine hashing.
For \(F,G:\{ 0,1\} ^n\to \{ 0,1\} ^m\), let \(S=\{ x:F(x)\ne G(x)\} \), \(d=|S|\), and \(R=\{ j:F_j\not\equiv G_j\} \), with \(r=|R|\). The error vector \(E_R=(F\oplus G)|_R\) contains only the selected output coordinates. Write \(C^S(E_R)\) for the minimum size of a circuit agreeing with \(E_R\) on \(S\); its values outside \(S\) are unrestricted.
Let \(S\) contain every row on which \(F\) and \(G\) differ, and let \(R\) contain every output coordinate that changes. With the original input and \(G(x)\) supplied for free,
Moreover \(C^S(E_R)\le \sum _{j\in R}C^S((E_R)_j)\).
Build the support indicator and the partial label circuit once. Mask each selected label with the support bit, then XOR it with the corresponding output of \(G\). This costs one AND and four further gates per selected output; the other outputs reuse their old wires. Exchange \(F,G\) for the reverse inequality. Scalar label circuits can be appended with shared inputs.
For every \(\varepsilon {\gt}0\), for all sufficiently large integers \(p\), uniformly over all \(S\subseteq \{ 0,1\} ^{2p}\) with \(|S|\le 2^p\) and all Boolean functions \(u\),
Share column and row minterms and a bank of short patterns. Sparse rows are partitioned into tuples of true columns. For partial rows, a greedy covering argument supplies a bank extending every assignment on at most \(K\) positions; interval masks protect the specified values of other chunks. The leading assembly cost is one OR per chunk. Affine hashing reduces the input width at polynomial cost. Repeated membership filters synthesize \(1_S\), while one hash and explicit collision repairs suffice for partial labels. Choose parameters with an exponential gap for every secondary table and repair term, and absorb the polynomial factors in that gap.
For every \(\varepsilon {\gt}0\), there exists \(p_0\) such that for all \(p\ge p_0\), every output width \(m\), and all \(F,G:\{ 0,1\} ^{2p}\to \{ 0,1\} ^m\) with at most \(2^p\) differing input rows and at most \(2p\) active output coordinates,
The threshold is independent of \(m,F,G\). The same bound holds when only covering sets for the erroneous rows and active outputs are supplied.
Apply the finite correction bound. The support costs \((1+o(1))2^p\); at most \(2p\) scalar partial labels cost a total of \((2+o(1))2^p\). The \(5r\le 10p\) correction gates are lower order. The proof keeps the estimates uniform before converting them to the displayed epsilon bound.
These results do not assert the unrestricted vector entropy formula \(H/\log _2 H+O(n+r)\) for arbitrary \(n,r,d\). In particular, counting possible error maps alone is not an upper-bound synthesis theorem. The theorem above establishes the proposed coefficient-three regime without that assumption.
For scalar functions and \(S=\{ x:f(x)\ne g(x)\} \),
Consequently, for every \(\varepsilon {\gt}0\) and all sufficiently large \(p\), uniformly over scalar functions on \(2p\) bits with at most \(2^p\) errors,
Since \(f\oplus g=1_S\), append a circuit for \(1_S\) and four XOR gates. Exchange \(f,g\), apply sparse support synthesis, and absorb the four gates into the epsilon slack.
For every \(\varepsilon {\gt}0\) and all sufficiently large \(p\), let \(F:\{ 0,1\} ^{2p}\to \{ 0,1\} ^m\) with \(m\le 2p\). If
then every circuit with at most \(s\) gates disagrees with \(F\) on more than \(2^p\) input rows. For a scalar function, replace \(3\) by \(1\). The thresholds are uniform in the functions and in \(s\).
A size-\(s\) circuit defines a function \(G\) with \(C(G)\le s\). If there were at most \(2^p\) erroneous rows, the continuity bound would contradict the assumed lower bound. The resulting error fraction is greater than \(2^{-p}\); this statement does not give a constant error fraction.
Let \(F_p,G_p\) be vector functions on \(2p\) bits, with arbitrary common output width depending on \(p\). Suppose that eventually they differ on at most \(2^p\) rows and at most \(2p\) output coordinates. If \(2^p=o(C(F_p))\), then
The uniform continuity theorem with \(\varepsilon =1\) gives \(|C(F_p)-C(G_p)|=O(2^p)\). Compose this estimate with the assumed little-o relation. No structure or computability assumption on the edits is needed.
For every \(p\ge 4\) there exists \(S\subseteq \{ 0,1\} ^{2p}\) with \(|S|=2^p\) and \(C(1_S){\gt}2^p/16\). There is also a scalar \(f\) at exactly \(2^p\) errors from zero satisfying
Consequently, any real-valued function \(b(p)\) eventually bounding the complexity difference of every scalar pair at distance at most \(2^p\) fails to satisfy \(b(p)=o(2^p)\).
Apply Shannon’s circuit-counting argument to graph indicators. The \(2^{p2^p}\) maps \(\{ 0,1\} ^p\to \{ 0,1\} ^p\) have distinct graphs, each of size \(2^p\). CSLib’s De Morgan count, even after discarding its factorial saving, bounds the number of functions with at most \(s\) gates by
At \(s=2^{p-4}\) and \(p\ge 4\) this is strictly less than \(2^{p2^p}\). A missing graph gives the first assertion. Since \(C(0)\le 1\) and circuit sizes are integers, the same witness gives the complexity-distance bound. A hypothetical little-o modulus is eventually at most \(2^p/32\), a contradiction. The witnesses are nonconstructive, and the constant \(1/16\) is not asserted to be optimal.
Let \(\mathcal C_{n,s}\) be the finite family of sets \(T\subseteq \{ 0,1\} ^n\) with \(C(1_T)\le s\). A family shatters \(S\) if every \(A\subseteq S\) is \(S\cap T\) for some member \(T\) of the family. Its VC dimension is the largest cardinality of a shattered set, using Mathlib’s finite set-family definitions.
For every \(\varepsilon {\gt}0\) and all sufficiently large \(p\), every assignment of Boolean labels to any sample \(S\subseteq \{ 0,1\} ^{2p}\) of size at most \(2^p\) is computed on \(S\) by a circuit of size at most
Thus \(\mathcal C_{2p,s_p}\) shatters every such \(S\), and its VC dimension is at least \(2^p\). With \(D=2^p\), this budget is \((1+o(1))D/\log _2 D\).
Extend the sample labels arbitrarily to the full cube and apply partial synthesis. Its minimum is attained by a concrete circuit, and its integer size is at most the displayed floor. For a subset \(A\subseteq S\), use its indicator as the labels and take the support of the resulting circuit; its intersection with \(S\) is exactly \(A\). A sample of cardinality \(2^p\) gives the VC-dimension bound. Circuit outputs outside the sample are unrestricted; this is an interpolation result, not a learning algorithm.
Fix a signature and an interpretation of it. The conditional complexity of a target \(f\), possibly with several outputs, given supplied functions \(g_1, \ldots , g_k\) of the same input is the minimum number of gates, every gate counted, of a circuit \(h\) with \(h(x, g(x)) = f(x)\) for every \(x\): the original inputs and the supplied values are free extra inputs, and nothing is required of \(h(x, y)\) when \(y \ne g(x)\). It is \(\infty \) when no circuit computes \(f\) this way.
Over any signature and interpretation, conditional complexity obeys the triangle inequality: computing \(h\) given \(f\) costs at most computing \(h\) given \(g\) plus computing \(g\) given \(f\). Over \(\mathbb {F}_2\), take any signature whose operations have arity at most two, interpreted over \(\mathbb {F}_2\), in which some one-gate circuit computes \(x_0 + x_1\). Then the conditional complexity of a nonzero linear form \(t \cdot x\) given linear helpers \(s_1 \cdot x, \ldots , s_k \cdot x\) is exactly
where \(\lvert \cdot \rvert \) is Hamming weight: the fewest helpers and inputs whose sum is the target, minus one. Every gate is counted, constant gates included. The signature may contain other operations as well, nonlinear ones included; the single-gate addition is a hypothesis of the theorem.
Compose the two circuits for the triangle inequality. For linear forms, a circuit computing the form must combine at least the minimum number of input and helper terms, and such a combination is realized directly.
Every arithmetic circuit over a field, with addition, multiplication, and constant gates, whose output equals \(p\) as a formal polynomial has at least \(\lceil \operatorname {rank} H_p(a) / 2 \rceil \) multiplication gates, where \(H_p(a)\) is the Hessian of \(p\) at any point \(a\). Additions and constants are free, but every multiplication gate is counted, including multiplication by a constant. This is weaker than the classical form of the bound, which counts only nonscalar multiplications.
Each multiplication gate raises the rank of the second-order part of the computed polynomials by at most two, while additions and constants do not.
Over a field of characteristic zero, any expression of \(x_1 x_2 \cdots x_{2n}\) as a polynomial identity \(\sum _{i \in I} a_i \ell _i^{2n}\), with scalars \(a_i\) and linear forms \(\ell _i\) without constant term, has \(\lvert I \rvert \ge \binom {2n}{n}\). This bounds the number of terms of this restricted representation, not arithmetic circuit size.
Compare the dimension of the space of partial derivatives of order \(n\) of each side.
Circuits are over the imported library’s De Morgan signature with its standard cost: negation, AND, and OR gates cost one, constants and identities are free. For \(f\) on \(n\) inputs and \(t \ge 1\), the mass complexity of \(f\) at \(t\) copies is the minimum cost of one circuit that evaluates \(f\) independently on \(t\) disjoint blocks of \(n\) inputs.
For every real \(0 \le \gamma {\lt} 1\) and \(\varepsilon {\gt} 0\) there is a threshold such that for every \(n\) above it, every \(f\) on \(n\) inputs, and every \(1 \le t \le 2^{\gamma n}\), the mass complexity of \(f\) at \(t\) copies is at most \((1/(1 - \gamma ) + \varepsilon )\, 2^n / n\). In a coarser discrete form, for all natural numbers \(a {\lt} b\) there is a constant \(C\) such that at every length \(n \ge 1\), every \(f\) on \(n\) inputs, and every \(1 \le t \le 2^{\lfloor a n / b \rfloor }\), the mass complexity is at most \(C \lfloor 2^n / n \rfloor \).
A nonuniform construction that routes all copies through shared table lookups: sorting and routing networks gather the requests, each table entry is computed once and broadcast to every copy that needs it, and finite-field local-recovery codes with disjoint-line scheduling serve the requests. The discrete form comes from an induction over equal input blocks, which reaches every rational rate below one.
With mass complexity as in Theorem 393, let \(D : \mathbb {N} \to \mathbb {N}\) satisfy \(D(n) = o(n / \log n)\) in the discrete form: for every natural number \(M \ge 1\), eventually \(M \cdot D(n) \cdot \lfloor \log _2 n \rfloor \le n\). Then for every natural number \(P \ge 1\), for all large \(n\), every \(f\) on \(n\) inputs, and every \(1 \le t \le 2^{D(n)}\), the mass complexity of \(f\) at \(t\) copies is at most \((1 + 1/P)\, 2^n / n\), stated without division as \(P\, n \cdot \mathrm{mass}(f, t) \le (P + 1)\, 2^n\).
Combine a coefficient-one Lupanov circuit for a single copy with Uhlig’s recursive two-copy construction, in which XORs of subfunctions at adjacent prefix values serve as shared resources from which each request is recovered through its own disjoint set of resources.
A path decomposition ends at \(X\) if it has a last bag and that bag is exactly \(X\); it starts at \(X\) if its first bag is exactly \(X\). Reversal exchanges the endpoint roles. The one-bag decomposition ends at the full vertex set.
Let \(v\in Y\), \(X\subseteq Y\), and suppose all neighbors of \(v\) lie in \(Y\). A path decomposition of \(H-v\) ending at \(Y\setminus \{ v\} \) with bags of size at most \(b\) extends to one of \(H\) ending at \(X\), provided \(|Y|\le b\). This supplies the deletion cases in Fomin and Høie’s endpoint induction.
Append \(Y\), then \(X\). All incident edges are covered, and every old vertex in an appended bag was already present in the previous last bag.
In a finite graph of maximum degree three, if \(|V|{\lt}3|X|\), then some vertex of \(X\) has at most one neighbor outside \(X\), or \(H-X\) has a connected component that is a tree.
Otherwise the cut has at least \(2|X|\) edges. Degree counting gives \(2|E(H-X)|+2|X|\le 3|V\setminus X|\), hence an edge deficit in \(H-X\). If every component contained a cycle, each would have at least as many edges as vertices, contradicting that deficit.
In a finite simple graph, if \((M+1)|E|{\lt}M|V|\), some connected component is a tree with at most \(M\) vertices. No degree bound is needed.
Suppose every tree component has more than \(M\) vertices. For a tree component with \(v\) vertices and \(e=v-1\) edges, \(Mv\le (M+1)e\). For a component containing a cycle, \(v\le e\) gives the same inequality. Summing over the components contradicts the assumed deficit.
Let \(H\) be a finite simple graph and \(S\) a set of vertices such that every vertex has a neighbor across the cut \((S,S^c)\). If the cut contains \(b\) edges, \(H\) has a path decomposition with first bag \(S\), last bag \(S^c\), and every bag of size at most \(b+1\). This is the boundary transition used in Fomin and Høie’s proof of the pathwidth bound for cubic graphs; this transition itself does not require a degree bound.
Scan the vertices of \(S\), introducing their neighbors in \(S^c\) before forgetting them. Charge each introduced right vertex to an edge from an already scanned left vertex, and each remaining left vertex to an edge from itself. The charges are disjoint except for the current left vertex, which accounts for the extra one. Edges within each side are covered by its endpoint bag.
Every finite tree on \(n\) vertices has a vertex whose deletion leaves connected components of at most \(n/2\) vertices.
Choose a vertex minimizing the sum of distances to all vertices. Moving into a component larger than half the tree decreases the distances to its vertices by one and increases every other distance by at most one, contradicting minimality. Uniqueness of paths proves the distance change.
A tree with at most \(2^k\) vertices has a path decomposition with bags of size at most \(k+1\). In particular, every tree or forest on \(n\) vertices has bags of size at most \(\lceil \log _2 n\rceil +1\), with the logarithmic term defined to be zero when \(n=0\). This elementary bound suffices for the tree component in Fomin and Høie’s endpoint induction.
Recurse on the components left by a centroid, concatenate their decompositions, and insert the centroid into every bag. Append its singleton to cover also the one-vertex case. Each recursion halves the component size and adds at most one vertex per bag. For forests, concatenate the tree decompositions without increasing their bag sizes.
Suppose two induced graphs together cover every vertex and edge, and their adjoining endpoint bags contain every shared vertex. Their decompositions concatenate without enlarging any bag. In particular, an induced subgraph with bag bound \(c\) can be attached along a boundary \(X\) to a decomposition of the rest ending at \(X\): the new decomposition ends at \(X\) and has bag bound \(\max \{ b,|X|+c\} \), where \(b\) was the bound for the rest. Every edge leaving the attached subgraph must meet \(X\).
Shared vertices persist through the join because they lie in both adjoining bags. For attachment, add \(X\) to each subgraph bag and put \(X\) at both ends before concatenating.
Every graph of maximum degree three on \(n\) vertices has a path decomposition ending at any prescribed set \(X\), with bags of size at most
The logarithmic term is zero for \(n=0\). This proves the endpoint lemma in Fomin and Høie’s argument with an elementary logarithmic remainder. It does not require the bisection theorem.
For a nonempty graph, enlarge \(X\) to a boundary \(Y\) of size \(\max \{ |X|,\lfloor n/3\rfloor +1\} \). If a boundary vertex has at most one outside neighbor, delete it, recurse with that neighbor added to the boundary, and restore the vertex. Otherwise the complement of \(Y\) has a tree component. Delete the component, recurse, and attach its logarithmic-width decomposition after adding \(Y\) to its bags. Both recursions reduce the number of vertices, and concatenation preserves the bound on the remaining graph. Finally append \(X\).
The predicate \(\mathrm{BisectionBound}(\xi ,N_0)\) says that every simple \(3\)-regular graph on \(n{\gt}N_0\) vertices has a cut \((S,S^c)\) with \(||S|-|S^c||\le 1\) and at most \((1/6+\xi )n\) crossing edges. The Monien–Preis conclusion for every \(\xi {\gt}0\) and some \(N_0\) is proved in Theorem 461.
Write \(\partial S\) for the edges crossing the vertex cut \((S,S^c)\). The helpfulness of flipping a vertex set \(X\) is the signed integer
For \(X\subseteq S\), this is the helpfulness in Monien and Preis’s bisection argument: crossing edges removed minus internal edges made crossing by moving \(X\) to the other side.
The helpfulness is exactly \(h_S(X)=|\partial S|-|\partial (S\mathbin {\triangle }X)|\), and successive moves have additive helpfulness. A minimum cut exists at each prescribed side cardinality, and a minimum balanced cut exists also for graphs of odd order. At a minimum cut \(S\), if \(X\subseteq S\), \(Y\subseteq (S\setminus X)^c\), and \(|X|=|Y|\), then
If all vertices of \(X\) have degree at most \(d\), then \(|h_S(X)|\le d|X|\).
Flipping \(X\) toggles exactly the edges of \(\partial X\). Subtracting the cardinalities gives the signed identity, which telescopes for successive moves. Minimize over the finite family of cuts with the chosen cardinality; complementing a cut handles either orientation of an odd balanced partition. The equally sized second move restores the cardinality, so positive total helpfulness would contradict minimality. At most the edges incident to \(X\) can change.
For \(X\subseteq S\), let \(d_{S^c}(v)\) count the neighbors of \(v\) outside \(S\). Then
In a graph of maximum degree three, a vertex with two crossing edges is at least \(1\)-helpful. A connected set \(X\) of boundary vertices has \(h_S(X)\ge |X|-2\); thus three or more connected boundary vertices form a helpful set. These include the first two local cases of Monien–Preis’s bounded helpful-set lemma.
The degree sum on \(X\) counts its internal edges twice and its crossing edges once. The helpfulness formula follows by separating edges going outside \(S\). For connected boundary vertices, each summand \(d_{S^c}(v)\) is at least one, there are at least \(|X|-1\) internal edges, and the degree sum is at most \(3|X|\).
Let \(C\) be the vertex boundary of a side \(S\) and let \(X\subseteq S\setminus C\). The lift of \(X\) is \(X\) together with all vertices of \(C\) adjacent to \(X\). The shared boundary consists of those vertices of \(C\) with at least two neighbors in \(X\). When \(C\) is independent and each of its vertices has one outside neighbor in a cubic graph, each vertex of \(C\) represents a red edge between its two interior neighbors. The shared boundary counts internal red edges, preserving parallel edges as distinct boundary vertices.
Under the normalized boundary hypotheses above, the lift \(Y\) of \(X\) lies in \(S\), has \(|Y|\le 4|X|\), and satisfies
Thus more internal red edges than external black edges give a \(1\)-helpful set. This proves the lifting step of Monien–Preis’s bounded helpful-set argument; it does not assume or prove that such a positive witness exists.
Every selected interior vertex contributes minus its remaining black neighbors. An attached boundary vertex contributes zero if it has one selected neighbor and one if it has two. Sum these contributions. Each selected vertex has at most three adjacent boundary vertices, giving the size bound.
In a normalized cubic side, put \(D=S\setminus C\) and let \(B\) be the edges induced by \(D\). Then \(|C|=|\partial S|\) and \(2|B|+2|C|=3|D|\). If \(|\partial S|{\gt}(1/3+\xi )|S|\) with \(\xi {\gt}0\), then \(|C|{\gt}(1/2+3\xi /2)|D|\). Consequently the black graph has a tree component of at most \(M\) vertices whenever \((M+1)3\xi /2\ge 1\). This component need not itself be a positive red/black witness.
Every boundary vertex has two interior neighbors, and every interior vertex has total red-plus-black degree three. Double counting gives the identities. The density inequality uses \(|S|=|C|+|D|\). Hence \(|B|{\lt}(1-3\xi /2)|D|\), which gives \((M+1)|B|{\lt}M|D|\) under the stated budget.
In a subcubic graph, adjoining boundary vertices adjacent to a moved set increases its helpfulness by at least one per new vertex. More generally, let \(X\subseteq S\) and \(Z\subseteq S\setminus C\). Suppose every neighbor of \(Z\) lies in \(X\cup Z\cup C\), and an edge joins \(X\) to \(Z\setminus X\). Then adjoining the boundary lift of \(Z\) increases helpfulness by at least one.
Consequently, suppose \(h_S(X)\ge 0\) and an interior vertex \(v\notin X\) is adjacent to \(X\). If every neighbor of \(v\) outside \(X\) either belongs to \(C\) or is an interior vertex with at least two boundary neighbors, there is a helpful set of at most \(|X|+7\) vertices.
Adding a vertex contributes its singleton helpfulness plus twice its number of neighbors already selected. For the closure statement, write helpfulness as a sum over selected vertices of twice their number of neighbors outside \(S\) minus their number of neighbors outside the selected set. New interior vertices have no remaining external neighbors; new boundary vertices contribute nonnegatively. Old contributions cannot decrease, and the attaching edge increases one of them strictly. For the last claim, include \(v\), its interior neighbors outside \(X\), and their boundary neighbors. At most two neighbors of \(v\) lie outside \(X\), and each adds at most three vertices including itself. Together with \(v\), at most seven vertices are added.
Write \(D_3\) for the interior vertices with three boundary neighbors. The remaining local configurations in Monien–Preis’s normalization argument give the following helpful sets in a subcubic graph:
A boundary edge with one endpoint adjacent to \(D_3\) gives a set of at most five vertices.
Two distinct \(D_3\) vertices sharing a boundary neighbor give a set of at most seven vertices.
Let an interior vertex \(v\) be adjacent to \(c\in C\), where \(c\) also has a boundary neighbor or a \(D_3\) neighbor distinct from \(v\). If every other neighbor of \(v\) belongs to \(C\) or is an interior vertex with at least two boundary neighbors, a helpful set of at most eleven vertices exists.
Boundary neighborhoods may overlap.
A boundary edge is nonnegative in helpfulness, as is a \(D_3\) vertex together with its three neighbors. Adding a \(D_3\) vertex and its neighbors to a set containing one of those neighbors adds at most three vertices and improves helpfulness by at least one. This proves the five- and seven-vertex cases. In the last case, start from the boundary edge or the four-vertex star and apply the seven-vertex extension bound. Repeated neighbors reduce the size and improve the helpfulness accounting.
If no helpful subset of \(S\) has at most eleven vertices, every boundary vertex has exactly one neighbor outside \(S\) and at most one neighbor within \(C\). Suppose an interior vertex \(v\) is adjacent to \(c\in C\), and \(c\) has either a boundary neighbor or a \(D_3\) neighbor distinct from \(v\). Then \(v\) has another neighbor \(p\in S\setminus C\) with at most one boundary neighbor. These are the local prerequisites for Monien–Preis’s edge switches. Both phases and their combined reverse bounds are formalized below.
Two outside neighbors would give a helpful singleton. Two boundary neighbors would give three connected boundary vertices. If every other neighbor of \(v\) had one of the types in the eleven-vertex configuration, that configuration would supply a forbidden helpful set. An interior vertex has no neighbors outside \(S\), so the remaining neighbor has the required type.
Four distinct vertices \(a,b,c,d\) form a valid switch when \(ab\) and \(cd\) are edges and \(ac\) and \(bd\) are absent. The switched graph deletes \(ab,cd\) and adds \(ac,bd\).
A valid switch preserves every degree. If all endpoints lie in \(S\), it preserves the cut of \(S\), every vertex’s neighbors outside \(S\), and the boundary vertex set. For \(X\subseteq S\), let \(\chi \) be its membership indicator. The helpfulness in the switched graph satisfies
Each endpoint exchanges one old neighbor for one new neighbor, and all changed edges lie within \(S\). In the neighbor-sum expression for helpfulness, only the four endpoints change. Sum their contributions to obtain the indicator formula.
In a cubic graph with no helpful subset of \(S\) of size at most eleven, a boundary edge \(ab\) admits a valid switch \(a,b,c,d\). So does an edge \(ab\) with \(a\) an interior vertex having three boundary neighbors and \(b\in C\). In both cases \(bc\) is an edge, \(c,d\in S\setminus C\), \(c\) has at most two boundary neighbors, and \(d\) has at most one.
Vertex \(b\) has one outside neighbor and two inside neighbors. Let \(c\) be its inside neighbor other than \(a\). The five- and seven-vertex configurations rule out the forbidden types of \(c\). The switching-neighbor lemma supplies \(d\). Degree counting excludes \(bd\). In the first case, an existing \(ac\) would make the boundary edge together with \(c\) helpful; in the second case, all neighbors of \(a\) are boundary vertices, so \(ac\) is absent. The vertex types and adjacencies establish distinctness.
Reversing a valid normalization switch transfers any \(X\subseteq S\) to a superset \(Y\subseteq S\) with \(h_S(Y)\ge h'_S(X)\). At most two vertices are added for a boundary-pair switch and at most four for a three-boundary-neighbor switch. If \(Y\ne X\), both \(a,b\) belong to \(Y\) and exactly one belonged to \(X\). This is a bound for one switch. Both phases receive combined bounds below.
The indicator formula loses two units on reversal only when \(X\) selects exactly \(a,c\) or exactly \(b,d\) among the endpoints. In the first case add \(b\): its outside edge and two selected neighbors gain at least three. In the second case add \(a,c\) for a boundary-pair switch. For the other switch also add the boundary neighbors of \(a\); \(b\) is already selected, so at most four new vertices suffice. Each step gains at least the two units lost. In all other cases reversal does not decrease helpfulness; the exact formula also allows an increase.
For a side \(S\) of any cubic graph \(H\), either a helpful subset of \(S\) has at most 33 vertices, or there is a cubic graph \(G\) on the same vertices with the same cut and boundary \(C\). In \(G\), the boundary is independent and every boundary vertex has one outside neighbor. Moreover, every \(X\subseteq S\) admits \(X\subseteq Y\subseteq S\) with \(|Y|\le 3|X|\) and \(h^H_S(Y)\ge h^G_S(X)\). This completes the first normalization phase. The next phase eliminates interior vertices with three boundary neighbors.
If a helpful set of size at most eleven already exists, stop. Otherwise the original boundary graph is a matching. Repeatedly apply the first switch; each removes exactly one boundary edge, so induction on their number terminates. Stop early if a helpful set of at most eleven vertices appears.
For the reverse transfer, complete pairs in the original matching. Fix the closure \(U\) of the initially selected boundary vertices under their original partners. This set has size at most \(2|X\cap C|\). The local restoration adds only the two endpoints of the restored boundary edge and possibly one interior vertex, so selected boundary vertices remain in \(U\). Every nontrivial extension adds at least one boundary vertex and at most two vertices in total. Thus
telescopes over the entire reverse sequence. Since \(|Y\cap C|\le |U|\le 2|X\cap C|\), this gives \(|Y|\le 3|X|\). An early eleven-vertex witness therefore lifts to at most 33 vertices.
Suppose the boundary \(C\) of a side \(S\) in a cubic graph \(H\) is independent. Either a helpful subset of \(S\) has at most 55 vertices, or there is a cubic graph \(G\) on the same vertices with the same cut and boundary, independent boundary vertices, one outside neighbor per boundary vertex, and at most two boundary neighbors per interior vertex. Every \(X\subseteq S\) admits \(X\subseteq Y\subseteq S\) with \(|Y|\le 5|X|\) and \(h^H_S(Y)\ge h^G_S(X)\).
Stop if a helpful set of at most eleven vertices already exists. Otherwise the original three-neighbor stars are disjoint: a shared boundary neighbor would give a helpful set of at most seven vertices. Let \(A\) be the original centers, and \(P\subseteq A\) those already processed. Each processed center retains two of its original boundary neighbors; each unprocessed center retains three. All other interior vertices have at most two. The second switch processes a fresh center \(a\), and its endpoint \(d\), having at most one boundary neighbor, cannot be in \(A\). The boundary remains independent. Induction on \(|A\setminus P|\) therefore terminates, stopping early if a small helpful set appears.
Write \(B(P)=\bigcup _{a\in P}(N_H(a)\cap C)\) and define
The last inequality uses \(B(P)\subseteq C\) and \(P\cap C=\varnothing \). When a switch is reversed, its extension \(Y\) satisfies \(\Phi _P(Y)\le \Phi _{P\cup \{ a\} }(X)\). If \(a\) was selected, removing its one credit pays for the added boundary vertex \(b\). In the other exceptional case \(b\) was selected, and removing its four credits pays for all added vertices. The added interior vertex \(c\) cannot be an original center: its edge to \(b\) would put \(b\) in two original stars. Thus the extension selects no earlier center or boundary vertex of another original star. In all other cases no extension is needed. The potential inequalities telescope to \(|Y|\le 5|X|\), while local helpfulness inequalities compose. An early eleven-vertex witness lifts to at most 55 vertices.
For any side \(S\) of a cubic graph \(H\), either a helpful subset of \(S\) has at most 165 vertices, or there is a cubic graph \(G\) with the same cut and boundary \(C\), independent boundary vertices, one outside neighbor per boundary vertex, and at most two boundary neighbors per interior vertex. Every \(X\subseteq S\) admits \(X\subseteq Y\subseteq S\) with \(|Y|\le 15|X|\) and \(h^H_S(Y)\ge h^G_S(X)\).
Apply boundary-edge normalization, then eliminate three-neighbor vertices. The reverse size factors multiply to \(3\cdot 5=15\). The first phase’s early witness has size at most 33; the second phase’s early witness lifts to at most \(3\cdot 55=165\) vertices. Both phases preserve the cut and boundary.
Let \(B\) be a simple black graph and \(R\) a red multigraph on the same finite vertex set. A set \(X\) is positive if its internal red edges outnumber its external black edges. Red edges retain distinct identities.
A boundary suppression has interior vertex set \(D=S\setminus C\), red edge set \(C\), no red loops, and red incidence exactly when a boundary vertex is adjacent to the corresponding interior vertex in the original graph.
For a normalized side of a cubic graph, a boundary suppression exists. Its red and black degrees sum to three at each interior vertex. Internal red edges count shared boundary vertices, and the black cut of \(X\) has size \(|\partial X\setminus \partial C|\) in the original graph. Consequently a positive set of \(k\) vertices gives a \(1\)-helpful move of at most \(4k\) vertices. The preceding normalization theorem supplies the required boundary hypotheses unless a uniformly small helpful set already exists.
Choose the two distinct interior neighbors of every boundary vertex as its red endpoints. Incidence bijections prove the degree and edge counts. Sum the original neighbors remaining outside the chosen interior set to identify the black cut, then apply the boundary-lift identity.
A red edge joining two black components of at most \(M\) vertices gives a positive set of at most \(2M\) vertices; the components may coincide. More generally, attach sets with empty black cuts to a set \(P\) along distinct red edges. If these red edges outnumber the black cut of \(P\), their union with \(P\) is positive. If each of the \(k\) attached sets has at most \(M\) vertices, the size is at most \(|P|+Mk\). In particular, three attachments suffice when \(P\) is connected and all its vertices have black degree at most two.
Adding sets with empty black cuts cannot increase the black cut, while each distinct attaching edge becomes internal and red. A connected set of black degree at most two has at least \(|P|-1\) internal black edges; degree counting bounds its external black edges by two.
Let a black walk have length \(\ell \), black degree at most two at all its vertices, and \(m\ge 3\) distinct red attachments indexed in order along the walk. Suppose \(\ell \le Mm\), and each attachment reaches a set with empty black cut and at most \(M\) vertices. Then a positive set of at most \(8M+1\) vertices exists. This formalizes the thin-path witness construction in Monien–Preis’s core lemma.
Among at least two nonnegative integer weights, some adjacent pair sums to at most three times their average: otherwise summing all adjacent pairs contradicts twice the total weight (the two-weight case is immediate). Apply this to the gaps between attachment positions. Three consecutive attachments have span at most \(3\ell /(m-1)\le 5M\). Their connecting subwalk has at most \(5M+1\) vertices and at most two external black edges. Add the three attached sets to obtain the bound \(8M+1\) and at least three internal red edges.
In a finite forest, assign real weights to vertices. If every leaf and isolated vertex has nonnegative weight, and the endpoint weights of every edge sum to a nonnegative value, then the total weight is nonnegative. Consequently, if leaves and isolated vertices weigh at least \(A\) but the total weight is less than \(A\) times the number of vertices, some adjacent pair has weight less than \(2A\).
Choose a vertex \(l\) of degree at most one. If it has a neighbor \(p\) of negative weight, remove both: their combined weight is nonnegative, and every newly exposed leaf is adjacent to \(p\), hence has nonnegative weight. Otherwise remove \(l\) alone; any newly exposed leaf was its nonnegative neighbor. Induction proves the claim. Subtract \(A\) from every vertex weight to obtain the shifted version.
Let a tree on \(n\ge 2\) vertices have nonnegative integer weights of total \(W\). Suppose each leaf \(l\) satisfies \(W\le (n-1)w(l)\). Then an edge \(uv\) satisfies \((n-1)(w(u)+w(v))\le 2W\). This is Monien–Preis’s weighted-tree lemma with denominators cleared.
If \(W=0\), every weight is zero and any edge works. Otherwise set \(A=W/(n-1)\). Leaves weigh at least \(A\) and \(W{\lt}An\), so the forest inequality gives an adjacent pair of weight less than \(2A\). Clear the positive denominator and weaken to a non-strict inequality.
Write \(R(Y)\) for the red edges internal to \(Y\), and \(\partial Y\) for its black cut in \(B\). Suppose \(X\) is positive after deleting \(\partial A\) from \(B\), the overlap \(X\cap A\) has empty black cut, and
Then \(X\cup A\) is positive in \(B\). In particular, it suffices that \(|\partial A|\le 2\), at least one of these boundary edges belongs to \(\partial X\), and \(A\) contains a red edge not already internal to \(X\). This proves a local compensation step in Monien–Preis’s argument. The next result bounds simultaneous restoration of a family.
The empty-cut overlap implies \(\partial (X\cup A)=\partial X\mathbin {\triangle }\partial A\). Thus the restored cut has the modified cut size of \(X\) plus \(|\partial A\setminus \partial X|\) edges. The union retains all internal red edges of \(X\) and adds those in \(R(A)\setminus R(X)\). The budget inequality preserves strict positivity.
A restoration family consists of pairwise disjoint regions \(P_i\) with \(|\partial _B P_i|\le 2\), attached sets \(A_i\) with empty black cut, and a designated red edge between \(P_i\) and \(A_i\). Every \(P_i\) is disjoint from every \(A_j\); the attached sets may overlap one another. Its deleted graph is \(B\) with all cuts \(\partial _B P_i\) removed. Each boundary edge gives one endpoint mark to its endpoint outside \(P_i\). The family’s endpoint marks sum these contributions, retaining multiplicities at a shared outside vertex. These are the data used to restore a supplied family of isolated paths.
For one region, total endpoint marks equal its cut size. For a restoration family, write \(m(v)\) for its endpoint marks and \(H\) for its deleted graph. At every vertex \(v\) outside all regions,
If \(X\) avoids all regions, then
Each cut edge has exactly one outside endpoint. A mark lies on \(X\) exactly when that edge also crosses \(X\). At a vertex outside all regions, distinct regions contribute distinct incident edges, by disjointness. Their union is the incident deleted-edge set. Partition the original incidence set into its deleted and retained edges to get the degree identity.
Suppose \(X\) is positive in the deleted graph of a restoration family, avoids every region \(P_i\), and \(|P_i\cup A_i|\le L\) for every \(i\). There is a positive set \(Y\supseteq X\) in the original graph with
If every vertex of \(X\) has black degree at most \(d\), then \(|Y|\le (1+dL)|X|\). In particular, \(d=3\) and \(L=4M\) give \((1+12M)|X|\), independently of the total number of isolated regions. Attached sets may overlap \(X\) arbitrarily. The mark-based version gives a witness satisfying
charging only endpoint marks on the original witness.
Select exactly the indices \(i\) for which \(\partial _B P_i\cap \partial _B X\) is nonempty, and add their regions and attachments. Each selected region leaves at most one of its two boundary edges outside \(X\). Each also supplies a distinct new internal red edge: its endpoint in \(P_i\) was outside \(X\), and disjointness prevents two designated red edges from coinciding.
A black edge crossing the enlarged set either already crossed \(X\) and was not deleted, or belongs to the remaining boundary of a selected region. Closed attachments add no crossing edges. Thus at most one new black crossing per selected region is paid for by its new red edge, preserving positivity. Since \(X\) avoids all pairwise disjoint regions, the sets \(\partial _B P_i\cap \partial _B X\) are pairwise disjoint. The number of selected indices is at most \(|\partial _B X|\), giving the size bound. Summing degrees over \(X\) gives the final inequality. Alternatively, each selected region contributes at least one cut incidence on \(X\), hence at least one endpoint mark there. This bounds the number of added regions by the mark sum.
Suppose \(X\) avoids all regions of a restoration family, has empty black cut after their boundaries are deleted, and \(|P_i\cup A_i|\le L\) for every \(i\). If some region has nonempty boundary entirely contained in \(\partial _B X\), there is a positive set \(Y\supseteq X\) in the original graph with
If the black degree on \(X\) is at most \(d\), the bound is \(|Y|\le (1+dL)|X|\). In particular, a core set of size at most \(2M\) with \(d=3\) and \(L=3M\) gives a witness of size at most \(2M(1+9M)\).
Add every region whose boundary meets \(\partial _B X\), together with its chosen closed attachment. Every added region contributes a distinct internal red edge and leaves at most one black boundary edge. The specified region leaves none, since its whole boundary meets \(X\). As \(X\) has no surviving black cut, the final black cut is strictly smaller than the number of added internal red edges. The same counting as in simultaneous restoration gives the size bound.
Let a restoration family have black degree at most \(d\) and \(|P_i\cup A_i|\le L\). After isolating a subfamily and deleting all remaining region boundaries, suppose each region is identified with a distinct connected component whose support is exactly that region. Form the associated core graph. If core pieces \(C,D\) are adjacent, the original graph has a positive set \(Y\supseteq C\cup D\) with
All incident regions, including previously isolated ones, are restored in this one bound.
Deleting all remaining region boundaries after partial isolation gives the same graph as deleting all original boundaries at once. Thus \(C\cup D\) is closed in the fully deleted graph and avoids all regions. Distinct core pieces cannot have a direct edge in the boundary quotient, so their core edge passes through a region \(P_i\). Its two connections to \(C,D\) are distinct original edges. As \(|\partial _B P_i|\le 2\), these exhaust its nonempty boundary, which is absorbed by \(C\cup D\). Apply the closed-core witness theorem.
Assign natural weights dominating core-piece sizes. If the core graph is a forest, every leaf and isolated vertex has weight at least \(M\), and total weight is less than \(M\) times the number of core vertices, there is a positive witness of size at most \(2M(1+dL)\) in the original graph. For a nontrivial tree, it suffices that each leaf has weight at least \(M\) and total weight is at most \(M(n-1)\).
The weighted-forest or weighted-tree inequality gives an adjacent pair of total weight at most \(2M\). The weights dominate the piece sizes; apply the adjacent-core witness theorem. For the actual thin family, \(d=3\) and \(L=3M\) give the bound \(2M(1+9M)\).
Let \(T\subseteq E(B)\) be designated edges of a finite simple graph. There is \(F\subseteq T\) such that \(B-F\) has exactly the same reachability relation as \(B\), every edge of \(T\setminus F\) is a bridge in \(B-F\), and
where \(c(B)\) is the number of connected components. Thus the number deleted is at most the original cycle rank.
Choose a largest subset of \(T\) whose deletion preserves reachability. Any retained designated non-bridge could also be deleted, contradicting maximality. Each component of the remaining graph has at least one fewer edge than vertices. Sum over components, use the unchanged component count, and account for the \(|F|\) deleted edges.
Let \(F\subseteq E(B)\) have reachability-preserving deletion. Let \(\mathcal C\) be any collection of original connected components, each containing a cycle and having all its internal edges retained. Then
In particular, the deleted edges and the untouched cyclic components share one cycle-rank budget.
A connected graph has at least one fewer edge than vertices, with equality only for a tree. Each cyclic component therefore supplies one additional edge. Sum these inequalities over components using the degree-sum identity. Reachability-preserving deletion identifies the old and new components with equal supports, and untouched internal edges preserve each designated cycle. Account for the deleted edges.
Let \(P_i\) be connected regions whose vertices have black degree at most two. Choose a boundary edge \(e_i\in \partial _B P_i\) for each region, with all chosen edges distinct. Some set \(J\) of at most the original cycle rank many indices satisfies both of the following: deleting only \(\{ e_i:i\in J\} \) preserves reachability, and deleting all cuts \(\bigcup _{i\in J}\partial _B P_i\) leaves no cycle meeting any \(P_i\). This selects regions for a supplied thin-path system. The construction below instantiates it. The later marked-tree reorganization is not needed by the connected-cluster proof of the sharp bisection theorem.
At a degree-two vertex on a cycle, both incident edges belong to the cycle. Propagate this fact through a connected region: a cycle meeting it contains every boundary edge. Apply the preceding theorem to the chosen edges. A cycle in the resulting graph can contain none of them: each is deleted or is a bridge. It therefore avoids every region. Deleting the remaining boundary edges of the selected regions cannot create a cycle. Injectivity of the chosen edges identifies the number of selected regions with the number of selected edges.
Let \(P_i\) have at most two black boundary edges, and choose one boundary edge \(e_i\) for each selected index \(i\in J\). Suppose deleting the chosen edges preserves reachability. Then deleting the full cuts of the selected regions preserves reachability between any two vertices outside \(\bigcup _{i\in J}P_i\). Disjointness of the regions is not needed.
After deleting the chosen edges, each selected region has at most one boundary edge left. A simple path between outside vertices cannot cross that boundary: entering and leaving would repeat its sole edge. Choose a simple path in the graph after the chosen-edge deletions. It avoids every remaining selected boundary and therefore survives full isolation.
Delete designated edges \(F\) and take the connected components of \(B-F\) as quotient vertices. Two distinct components are adjacent when an original black edge joins them. The region-boundary quotient designates the union of all black cuts of a supplied region family.
Quotient reachability is exactly original reachability between any representatives. If every designated actual edge is a bridge, the quotient is a forest and every component is a tree. The designated actual edges map bijectively to quotient edges: none becomes a loop and distinct edges do not merge. In particular, the quotient has \(|F\cap E(B)|\) edges. If every cycle avoids a region family, its region-boundary quotient is a forest.
Project original walks, collapsing steps within a component; lift quotient walks using paths through each connected contracted piece. A quotient path avoiding the image of a designated bridge would lift to an original path avoiding that bridge, a contradiction. Thus every quotient edge is a bridge. The same lifting argument rules out a collapsed bridge or two bridges with the same quotient endpoints. Finally, every surviving boundary edge of a region avoided by all cycles is a bridge, so the general result applies to region boundaries.
Deleting any subset of the boundaries of pairwise disjoint regions preserves the induced graph inside each region. If the regions are connected, deleting all their boundaries makes each region exactly one connected component, hence one distinct vertex of the quotient. Every quotient vertex has degree at most the black cut of its support. If the designated actual edges are bridges, this bound is an equality.
An edge internal to one region crosses no disjoint region. After all boundaries are deleted, internal connectivity and the empty cut identify the region with one component. Different regions give different components. For each neighbor of a quotient vertex, choose an original connecting edge. Distinct neighbors give distinct edges in the component’s cut. Conversely, every boundary edge goes to another quotient vertex. When these edges are bridges, injectivity of the edge projection ensures that distinct boundary edges give distinct neighbors.
Suppress a vertex set \(S\) by retaining vertices outside \(S\), keeping their original edges, and adding an edge between distinct vertices joined by a two-edge path through \(S\). The core graph suppresses the designated region vertices of the region-boundary quotient.
Suppressing an independent set preserves reachability between surviving vertices. Suppressing vertices of degree at most two in a forest leaves a forest. Consequently, suppressing an independent set of such vertices in a tree leaves a tree whenever at least one vertex survives. Isolated vertices and leaves are allowed among the suppressed vertices.
Assign each removed vertex with a surviving neighbor to one such neighbor, and fix surviving vertices. Lift new edges to one- or two-edge original paths and project original walks through this assignment. Independence ensures reachability survives projection. Contract edges whose assigned endpoints agree. Distinct surviving vertices remain in distinct contracted components, and the degree-two bound makes each new edge an edge of this bridge quotient. Thus the suppressed graph embeds into a forest.
In a finite forest, suppose both \(S\) and its complement are independent, and every vertex of \(S\) has degree at most two. There is a bijection from the degree-two vertices of \(S\) to the edges of the suppressed graph. The edge corresponding to a removed vertex joins its two original neighbors. Isolated vertices and leaves contribute no edge.
A degree-two vertex has two distinct neighbors outside \(S\). Two removed vertices cannot have the same neighbor pair: that would give two different simple paths between the same endpoints in a forest. Every surviving edge comes from such a pair, since there are no original edges inside the complement of \(S\).
Let the regions be connected, pairwise disjoint, with no black edges between distinct regions, and with at most two boundary edges each. If every black cycle avoids the regions, identifying and suppressing their quotient vertices produces a forest on the remaining pieces. Reachability between these core pieces is exactly original reachability between their representative vertices. The number of core edges equals the number of regions with exactly two boundary edges.
The region vertices are independent in the boundary quotient and have degree at most two. The quotient is a forest because cycles avoid the regions. Apply path suppression, then compose its reachability equivalence with that of the component quotient. The complementary core vertices are also independent in the boundary quotient: each quotient edge crosses some region boundary. Exact quotient degrees and the preceding bijection give the edge count.
Given eligible vertices \(U\), the regions are the connected components of \(B[U]\), viewed as subsets of the original vertex set. For a region \(P\), let \(A_M(P)\) be the distinct red edges joining \(P\) to an original black component of at most \(M\) vertices. For each such edge choose its attached small component, preferring the second endpoint when both orientations qualify. A region is thin if \(|P|\le M|A_M(P)|\).
The regions partition \(U\), with no black edges between distinct regions; their boundary cuts are pairwise disjoint. If every eligible vertex has black degree at most two, every region has a spanning simple path and at most two boundary edges. A region with nonempty boundary is a tree. If the ambient degrees are exactly two, its boundary size is zero or two. Every subfamily with nonempty cuts admits distinct choices of boundary edges.
Induced connected components give the partition and separation. A longest simple path in a finite connected graph of maximum degree two spans the graph: an external neighbor at an endpoint would extend it, and each internal vertex already has two path neighbors. Thus its support is closed under adjacency and connectivity forces it to be all vertices. Apply this to each induced region. Connectedness and the degree-sum identity give the boundary bound; a nonempty boundary forces exactly \(|P|-1\) internal edges, while degree exactly two makes the cut size even.
A connected degree-two region \(P\) with \(m\ge 3\) distinct red attachments to closed sets of size at most \(M\), and \(|P|\le Mm\), gives a positive set of at most \(8M+1\) vertices. No walk or attachment ordering is assumed. Consequently, if no positive set of that size exists, every canonical thin region has one or two red attachments, at most \(2M\) vertices, and a nonempty black boundary. With ambient degree exactly two, that boundary has exactly two edges.
Construct a spanning simple path, choose the position of each attachment, and sort the distinct red edges by these positions. Equal positions are allowed. The existing thin-walk theorem applies since the path length is \(|P|-1\). Thinness and nonemptiness force at least one attachment; excluding three attachments bounds \(|P|\) by \(2M\). A closed thin region together with one small attachment would itself be a positive set of at most \(3M\) vertices, so its boundary cannot be empty.
For each shaded thin path \(P\) and each of its \(\alpha (P)\) red attachments, give \(3-\alpha (P)\) marks to the attached small component. Marks are a finite map to natural numbers, so repeated targets retain their multiplicities. A count \(k\) satisfies the reserved cycle budget when, for every collection \(\mathcal C\) of original cyclic components of size at most \(M\),
Suppose eligible vertices have degree at most two and there is no positive set of size at most \(8M+1\). Shading a subfamily \(J\) assigns exactly \(2|J|\) attachment marks, all to original components of size at most \(M\). Any collection \(\mathcal D\) of components with at least two marks satisfies \(|\mathcal D|\le |J|\).
Suppose also that eligible vertices lie in original components larger than \(M\), and deleting distinct designated boundary edges of \(J\) preserves reachability. Then \(|J|\) satisfies the reserved cycle budget. Consequently, for any collection \(\mathcal C\) of small cyclic components,
This counts the initial shading step. Preservation through later color swaps and leaf reorganization is a separate obligation.
Each thin path has \(\alpha (P)\in \{ 1,2\} \), and \(\alpha (P)(3-\alpha (P))=2\). Sum the finite mark map; counting multiplicities makes the identity hold even when targets coincide. Each doubly marked component consumes at least two marks. A boundary edge of a thin region touches its large original component, so no such edge is internal to a small component. The cycle-rank reserve theorem applies to the designated deletions and every small cyclic component.
Suppose every eligible vertex has black degree at most two and lies in an original black component larger than \(M\). If no positive set of at most \(8M+1\) vertices exists, the canonical thin regions form a restoration family with one chosen small attachment each, and \(|P_i\cup A_i|\le 3M\). Choose distinct boundary edges and isolate some subfamily \(J\), with
The stronger reserved cycle budget holds as well: each original small cyclic component reserves another unit in this inequality. Deleting its chosen single edges preserves reachability. Deleting its full cuts preserves reachability among outside vertices and leaves no cycle meeting any thin region. The resulting region-boundary quotient is a forest, with every connected component a tree. The simultaneous restoration theorem applies with \(L=3M\), hence with factor \(1+9M\) in a subcubic black graph for witnesses avoiding the isolated regions. The following theorem completes the suppression of the thin-path vertices. The connected-cluster argument below supplies the final density contradiction without requiring weighted-tree reorganization.
Choose one of the one or two attachments of each thin region. Large original components containing eligible vertices are disjoint from every chosen small component, giving all region–attachment separations. The region and attachment sizes are at most \(2M\) and \(M\) respectively. Disjoint cuts give injective boundary choices, so the preceding cycle selection theorem applies to this constructed restoration family. Apply the core-connectivity theorem to the full-cut deletion, and the bridge-quotient theorem to the surviving boundaries of all thin regions. The designated deletions leave small original components untouched, giving the stronger cycle budget from the preceding mark theorem.
Under the hypotheses of the constructed thin-family theorem, identify all thin regions in the boundary quotient after isolation and suppress their vertices. The resulting core graph is a forest, and reachability between its vertices agrees with reachability between their representatives in the original black graph. The \(3M\) restoration bound per region and attachment and the original cycle-rank bound on isolated regions are retained. This includes the reserve for every original small cyclic component.
Isolation deletes no internal edge of any region, so the regions remain connected and separated and their boundaries still have size at most two. Apply the preceding core-forest construction. A core representative belongs to none of the thin regions, so the outside-connectivity theorem upgrades reachability in the graph after isolation to original black reachability.
Under the hypotheses of the constructed thin-family theorem, suppose eligible vertices have black degree exactly two. If \(\mathcal P\) is the original thin-path family, \(J\) is the selected shaded subfamily, and \(T\) is the constructed core forest, then
The same construction retains the restoration bound, original reachability between core representatives, and the cycle-rank bound \(|J|+|V|\le |E(B)|+c(B)\). The stronger reserve for original small cyclic components is retained too.
A thin region has a nonempty boundary. Since all its vertices have ambient degree two, that boundary has exactly two edges. The boundaries of distinct regions are disjoint. Isolating \(J\) therefore empties precisely its cuts and preserves every other region’s cut. The core edge count is consequently the number of unshaded regions. Partition the original thin-path family into its shaded and unshaded members.
For the constructed restoration family and shaded subfamily \(J\), endpoint marks vanish on every eligible vertex. If eligible vertices have ambient degree exactly two, their total is \(2|J|\). At every ineligible vertex, remaining degree plus endpoint marks equals original degree. Consequently, a degree-three vertex made degree two by isolation receives exactly one mark. It cannot become a new unmarked degree-two path vertex.
For a positive witness \(X\) avoiding the shaded regions, the original graph has a positive witness \(Y\supseteq X\) with
These are the endpoint invariants of the initial shading step. Preservation through later color swaps and leaf reorganization is not used by the connected-cluster proof below.
Every thin region has two boundary edges, giving two outside marks. An eligible vertex adjacent to a vertex of a canonical region belongs to the same induced component. Thus no boundary edge can mark an eligible vertex. Apply the general degree identity outside the eligible set. A degree-three vertex was ineligible, and a drop to degree two gives one mark. The constructed family has region-plus-attachment size at most \(3M\), so the mark-based restoration theorem gives the stated witness bound.
A connected graph of maximum degree three on \(n{\gt}M{\gt}0\) vertices has a partition into \(k\) connected sets, each of size at most \(3M\), with \(Mk\le 2n\).
Recursively remove a root and partition the resulting components. Keep finished pieces of size between \(M\) and \(3M\) and a connected remainder of size less than \(M\) containing the chosen root, or an empty remainder. There are at most three child components. Their remainders join through the root to a connected set of size at most \(3M\); finish it if it reaches size \(M\). At the end only one piece can have size below \(M\), so \(Mk\le n+M\le 2n\). This partition argument and its application below were developed in this formalization.
Let \(B\) be a simple black graph and \(R\) a loopless red multigraph on the same \(n\) vertices, with total red-plus-black degree three everywhere. If \(M{\gt}0\) and \((M+4)n{\lt}2M|E(R)|\), there is a positive set of at most \(3M(1+3M)\) vertices. In particular, red density greater than \(1/2+\epsilon \) suffices whenever \(2\le \epsilon M\).
Let \(U\) be the union of black components of size at most \(M\). A red edge inside \(U\) gives a positive set of size at most \(2M\). Otherwise partition its complement \(W\) into connected clusters \(P_i\) as above, with \(Mk\le 2|W|\). Write \(A_i\) for the red edges between \(P_i\) and \(U\). If \(|A_i|\le |\partial _B P_i|\) for all \(i\), connectivity gives \(|\partial _B P_i|+2|P_i|\le \sum _{v\in P_i}\deg _B(v)+2\). Sum this, use the degree identity and count each red edge meeting \(U\) exactly once. It follows that \(2|E(R)|\le |W|+2k\), contradicting the density assumption after multiplying by \(M\). A surplus cluster, together with the original small black components reached by its red edges, is positive. Each attachment has empty black cut and at most \(M\) vertices. There are at most \(3|P_i|\) red attachments, so the union has size at most \(3M(1+3M)\). Edge identities preserve parallel-edge multiplicity even when several attachments coincide.
Let \(\xi {\gt}0\), \(M{\gt}0\), and \(4\le 3\xi M\). Every side \(S\) in a simple cubic graph with \(|\partial S|{\gt}(1/3+\xi )|S|\) contains a helpful set of at most \(36M(1+3M)\) vertices. If the boundary is independent and each boundary vertex has exactly one outside neighbor, the bound is \(12M(1+3M)\).
For a normalized side, suppress its boundary to obtain red density greater than \(1/2+3\xi /2\). The preceding theorem applies, and boundary lifting costs a factor four. For an arbitrary side, the first boundary normalization either supplies a helpful set of at most \(33\) vertices or transfers the normalized witness back with a factor-three size bound. The second normalization phase and marked-tree reorganization are not needed by this argument.
Let \(a\ge 0\) and let \(M,k\) be natural numbers. Suppose \(|\partial S|{\gt}a|S|+k\), and every \(T\subseteq S\) with \(|\partial T|{\gt}a|T|\) contains a set of at most \(M\) vertices of helpfulness at least one. Then some \(X\subseteq S\) has \(|X|\le kM\) and \(h_S(X)\ge k\). This proves the accumulation step in Monien–Preis’s argument. The preceding bounded helpful-set theorem supplies its local hypothesis uniformly.
Until the total helpfulness reaches \(k\), the remaining side has cut size greater than \(|\partial S|-k{\gt}a|S|\), hence greater than \(a\) times its own cardinality. Apply the local lemma, remove its helpful set, and add the gain. At most \(k\) moves are needed, and their sets are disjoint. Each contributes at most \(M\) vertices.
In a cubic graph, every side \(S\) and \(0\le r\le |S|\) admit a subset \(T\subseteq S\) of size \(r\) with
Consequently, if \(|S|{\lt}3|\partial S|\), every prescribed move size \(k\le |S|\) has a witness \(X\subseteq S\) with \(h_S(X)\ge -\lceil \log _2|S|\rceil -2\). No bisection hypothesis or connectivity assumption is used. The ceiling logarithm is interpreted as zero at zero.
Delete vertices with at least two outside neighbors while the side is larger than the requested subset; each deletion decreases the cut. Once each remaining vertex has two internal neighbors, take its induced graph’s prescribed-endpoint decomposition ending at the cut boundary. Extend it by one bag containing that boundary and the other side. Place edges in their first available bags. Every vertex on the chosen side has its median edge before the final bag; every other vertex has its median in the final bag. An initial segment of any prescribed cardinality is therefore contained in the chosen side. The median charging argument bounds its cut by one more than an earlier bag. For the move, take \(X=S\setminus T\) with \(|T|=|S|-k\) and use the exact helpfulness identity. The density condition absorbs the maximum.
Fix \(\xi {\gt}0\). Suppose every side with cut density greater than \(1/3+\xi \) contains a set of at most \(M\) vertices of helpfulness at least one. A cubic graph on \(n\) vertices has a bisection of size at most \((1/6+\xi )n\) whenever
A graph-independent \(M\) therefore gives \(\mathrm{BisectionBound}(\xi ,N_0)\) for some \(N_0\). The preceding bounded helpful-set theorem supplies a uniform \(M\).
Start from a minimum cut with one side of size \(\lfloor n/2\rfloor \). If its size exceeds the bound, accumulate helpfulness \(k=\lceil \log _2 n\rceil +3\) using at most \(kM\) vertices. From the enlarged opposite side, select a subset of its original cardinality using the preceding theorem. The original-cut term of its maximum is paid by the accumulated gain; the side-size term is below the original cut by the displayed size condition. This restores balance with a strictly smaller cut, contradicting minimality. The maximum also handles overshoot of the accumulated gain. Finally, a fixed multiple of the logarithm is sublinear.
For every \(\xi {\gt}0\) there is \(N_0\) such that every simple cubic graph on \(n{\gt}N_0\) vertices has a balanced cut of at most \((1/6+\xi )n\) edges. This is the Monien–Preis bisection conclusion, with the connected-cluster argument replacing the red/black reorganization in their proof.
Choose an integer \(M{\gt}4/(3\xi )\). The helpful-set bound \(36M(1+3M)\) depends only on \(\xi \). Apply the preceding local-to-global reduction and absorb its logarithmic remainder for large \(n\).
The predicate \(\mathrm{BisectionBound}(4/3,0)\) holds. This checks the bisection contract with a coarse constant and does not prove the sharp theorem for arbitrarily small positive slack.
Choose any \(\lfloor n/2\rfloor \) vertices. The cut has at most all \(3n/2\) edges of the cubic graph, by the degree-sum formula.
If a graph of maximum degree three on \(n\) vertices has a balanced cut with \(b\) crossing edges, it has a path decomposition with bags of size at most
For an arbitrary cut, replace \(\lfloor (n+1)/6\rfloor \) by \(\lfloor \max \{ |S|,|S^c|\} /3\rfloor \). The logarithmic term is zero for \(n=0\).
Each vertex boundary has at most \(b\) vertices. Apply the prescribed endpoint theorem to both induced sides and reverse the second decomposition. Between them put the decomposition on the two vertex boundaries, with bags of size at most \(b+1\). The adjoining bags contain all shared vertices, so concatenation preserves the bag-size bound.
For a coefficient \(p\), a slack \(\xi \), and a threshold \(N_0\), the predicate \(\mathrm{PathwidthBound}(p,\xi ,N_0)\) says that every simple \(3\)-regular graph on \(h{\gt}N_0\) vertices has a path decomposition with bags of at most \((p+\xi )h+1\) vertices. The predicate \(\mathrm{CutwidthBound}(c,\xi ,N_0)\) says that every such graph has an injective vertex key all of whose prefixes are crossed by at most \((c+\xi )h\) edges. For a coefficient \(A\), a slack \(\eta \), and a constant \(C\), the graph-ordering hypothesis \(\mathrm{OrderingBound}(A,\eta ,C)\) says that every connected loopless multigraph of maximum degree three with \(N\) vertices and \(M\) edges has a vertex ordering all of whose prefix cuts have at most \((A+\eta )\max \{ M-N,0\} +3\log _2 N+C\) edges.
If \(\xi \ge 0\), \(\delta {\gt}0\), and \(\mathrm{BisectionBound}(\xi ,N_0)\) holds, then \(\mathrm{PathwidthBound}(1/6,\xi +\delta ,N_1)\) holds for some \(N_1\). Consequently the sharp asymptotic cubic bisection theorem implies the sharp asymptotic cubic pathwidth theorem. This proves the reduction of Fomin and Høie. Instantiating the proved sharp bisection theorem gives \(\mathrm{PathwidthBound}(1/6,\xi ,N_0)\) for some \(N_0\) at every \(\xi {\gt}0\).
For all sufficiently large \(n\), the ceiling logarithm plus two is less than \(\delta n\). Absorb the finite assembly’s remainder in that slack. For the universally quantified conclusion, allocate half the target slack to the bisection and half to the remainder.
If \(p+\xi \ge 0\), then \(\mathrm{PathwidthBound}(p,\xi ,N_0)\) implies \(\mathrm{OrderingBound}(2p,2\xi ,N_0+9)\). If \(c+\xi \ge 0\), then \(\mathrm{CutwidthBound}(c,\xi ,N_0)\) implies \(\mathrm{OrderingBound}(2c,2\xi ,N_0+8)\). A pathwidth bound also gives \(\mathrm{CutwidthBound}(p,\xi +2/(N_0+1),N_0)\). With the proved pathwidth coefficient \(1/6\), for every \(\eta {\gt}0\) some \(C\) satisfies \(\mathrm{OrderingBound}(1/3,\eta ,C)\).
Merge blocks of the multigraph until no merge applies. If at least two blocks remain, the quotient is a simple cubic graph on \(h\) blocks with \(h\le 2\max \{ M-N,0\} \). Order it by the median edge positions of a path decomposition, which cut at most one edge more than a bag holds, or by the cutwidth key; a quotient with at most \(N_0\) blocks uses its one-bag decomposition. Listing each block’s vertices in its recorded order adds at most \(3\lceil \log _2 N\rceil +3\) edges to every prefix cut.
A Boolean function \(f\) on \(n\) bits is a flat-source sumset extractor with threshold \(K\) and error \(\nu \) when, for all sets \(P,Q\subseteq \{ 0,1\} ^n\) of cardinality at least \(K\), the fraction of pairs \((x,y)\in P\times Q\) with \(f(x\oplus y)=1\) lies in \([1/2-\nu ,1/2+\nu ]\). Source pairs are counted with multiplicity even when their sums coincide. On one bit, the identity function has threshold \(2\) and error zero. This finite example does not give an asymptotic family.
Suppose \(\nu \le 1/4\), \(\log _2 K(n)=o(n)\), and eventually \(f_n\) is a flat-source sumset extractor with threshold \(K(n)\) and error \(\nu \). Then eventually \(f_n\) is \(K(n)\)-rectangle-free and accepts at least \(2^{n-2}\) inputs. More generally, flat-source extraction implies balance on all coordinate rectangles at the same threshold and error.
Zero-pad the two rectangle sides on complementary coordinates; XOR recovers their glued input, with each source pair retained. An all-one rectangle contradicts error below \(1/2\). Apply balance to the full cube, splitting its coordinates into nearly equal halves, for the density bound. Sublinear source entropy ensures that both halves support enough inputs.
A function is a two-sided flat sumset disperser at threshold \(K\) if both Boolean values occur among the sums of every pair of sources of size at least \(K\). Balanced padding is the \((n+1)\)-bit function \(g(b,x)=b\oplus f(x)\), evaluated on lists by the corresponding tail evaluator followed by XOR with the first bit.
If \(K{\gt}0\) and \(f\) extracts with error below \(1/2\), balanced padding is rectangle-free at threshold \(2K\) and accepts exactly \(2^n\) strings. Its uniform list evaluator agrees with the finite function and belongs to \(\mathrm{FP}\) whenever the original evaluator does.
Error below \(1/2\) forces both outputs on every large source pair. In each source of size at least \(2K\), fix a first bit whose fiber has size at least \(K\). Dispersion in the tails then supplies either padded outcome. Zero-padding complementary rectangle sides proves rectangle freeness. For each old input exactly one fresh bit accepts. The evaluator uses polynomial-time tail extraction, the given evaluator, and XOR.
Fix a family of flat sumset extractors with error \(\nu {\lt}1/2\), eventually positive thresholds \(K(n)\), and \(\log _2 K(n)=o(n)\). For every \(\varepsilon {\gt}0\) and all large \(n\), its balanced padding requires more than \((4-\varepsilon )(n+1)\) gates, including for nondeterministic circuits with arbitrarily many witness inputs. The family is fixed before \(\varepsilon \). The concrete family below instantiates the deterministic conclusion.
At length \(n+1\) use threshold \(2K(n)\). Doubling the threshold and shifting its index preserve sublinearity of the binary logarithm. Exact balance gives the accepting-input bound, so apply the graph-free circuit theorem to the single padded family at every positive length.
Strict majority returns false on ties, including the empty input. The margin on designated good coordinates is their number of true bits minus their number of false bits.
The list majority evaluator agrees with finite-vector majority and is in \(\mathrm{FP}\). A good-coordinate margin strictly greater than the number of bad coordinates forces true; a margin at most the negative of that number forces false. The bad coordinates may depend arbitrarily on the good ones.
Count true bits with the polynomial-time bounded-counting API. The bad coordinates change the margin by at most their number, and the evaluator uses the strict sign test.
For a finite weighted sample space and \(m\) coordinates \(\sigma _i\), write \(S=\sum _i\sigma _i\). The parity-bias bound \(\delta \) requires \(|\mathbb E\prod _{i\in T}\sigma _i|\le \delta \) for every nonempty coordinate subset \(T\) of size at most four. The coordinates being signs and the weights being probabilities are separate hypotheses.
On a finite probability space let \(\sigma _1,\ldots ,\sigma _m\) take values in \(\{ -1,1\} \) and satisfy the parity-bias bound \(\delta \ge 0\). Then
These are algebraic consequences of low-order parity bias. Producing that bias from an actual sumset source is supplied by the construction below.
Expand each power into ordered coordinate tuples and cancel repeated signs in pairs. Odd tuples leave a nonempty parity. In degree two only the \(m\) diagonal terms survive without a bias factor. In degree four the three possible pairings account for at most \(3m^2\) such terms; every other tuple is bounded by \(\delta \). Sum the bounds.
On a finite probability space, suppose \(|\mathbb E Z|,|\mathbb E Z^3|\le 1/100\), \(\mathbb E Z^2\ge 99/100\), and \(\mathbb E Z^4\le 301/100\). Each of the events \(Z{\gt}1/8\) and \(Z{\lt}-1/8\) has probability at least \(1/36\). In particular the conclusion holds when the first and third moments vanish, the second is one, and the fourth is at most three. This is a finite analytic component of the Chattopadhyay–Liao constant-error route; the source reduction and extractor primitives are supplied by the subsequent construction.
The polynomial \(q(u)=u(u+1)^2(3-u)\) is at most \(36\mathbf1_{u{\gt}0}\). Expand \(\mathbb E q(Z-1/8)\) and use the moment bounds to obtain a value greater than one. Apply the same argument to \(-Z\) for the other tail. This quartic certificate is a direct calculation.
On a finite probability space, let \(m{\gt}0\) signs satisfy the parity-bias bound \(\delta \ge 0\), with \(100m^2\delta \le 1\). Each of the events \(S{\gt}\sqrt m/8\) and \(S{\lt}-\sqrt m/8\) has probability at least \(1/36\).
Normalize by \(\sqrt m\). The raw moment bounds and the bias budget give the four hypotheses of the quartic tail certificate. Rescale its events.
In a finite probability distribution on \(N\) bits, select \(m{\gt}0\) good coordinates. Encode true as \(1\) and false as \(-1\). If their parity bias is at most \(\delta \ge 0\), \(100m^2\delta \le 1\), and \(N-m\le \sqrt m/8\), each strict-majority outcome has probability at least \(1/36\). The other coordinates may depend arbitrarily on the good coordinates, and ties return false.
On each sign-sum tail the good-coordinate margin dominates all bad votes. Compare its event with the corresponding majority outcome.
Let \(K{\gt}0\) and \(\rho \ge 0\). For every \(P,Q\) of size at least \(K\), suppose a subset \(G\subseteq Q\) has size at least \(\theta |Q|\), and for every \(y\in G\), both values of \(f(X\oplus y)\) have probability at least \(\rho \) when \(X\) is uniform on \(P\). Then \(f\) is a flat sumset extractor with error \(1/2-\rho \theta \). In particular, \(\rho =1/36\) and \(\theta =1/2\) give error \(35/72\).
Sum each conditional lower bound over \(G\) and then over \(Q\). The two outcome counts partition \(P\times Q\), giving both sides of the extraction interval. Keep all pairs when their XORs coincide.
Fix a map \(R:\{ 0,1\} ^n\to \{ 0,1\} ^N\), a threshold \(K{\gt}0\), and \(\delta \ge 0\). For every \(P,Q\) of size at least \(K\), suppose at least half the \(y\in Q\) admit \(m{\gt}0\) good coordinates of \(R(X\oplus y)\), for uniform \(X\in P\), satisfying the parity and size bounds of Theorem 478. Then \(\operatorname {Maj}\circ R\) is a flat sumset extractor with error \(35/72{\lt}1/2\). The selected coordinates may depend on \(P,Q,y\); \(R\) is fixed before the source sets. This proves the final analytic implication, leaving construction and uniform evaluation of such an \(R\) as separate obligations.
Apply the majority probability bound on each good fixing, then the good-fixing averaging theorem with \(\rho =1/36\) and \(\theta =1/2\).
For finite seed and output sets, \(E\) is a flat seeded extractor at threshold \(K\) and error \(\epsilon \) if every uniform source of support at least \(K\), with an independent uniform seed, has output test-set discrepancy at most \(\epsilon \). For each test of density at most \(\epsilon \), an input is bad if more than a \(2\epsilon \) fraction of seeds hit that test. The sampler contract requires bad-input probability at most \(\delta \) for every source with point masses at most \(1/L\). The definition records this cap as \(Lp(x)\le 1\); its entropy interpretation requires \(L{\gt}0\).
Assume the seed and output sets are nonempty. An extractor with threshold \(K{\gt}0\) has fewer than \(K\) bad inputs for each small test. If \(L{\gt}0\) and \(K\le \delta L\), it therefore satisfies the sampler contract, including for nonuniform source weights. For a uniform source on \(P\), \(K\le \delta |P|\) gives the direct bad-cardinality bound. Returning the seed itself is a sampler with zero failures for \(\epsilon \ge 0\), although its seed is as large as its output.
This is the conversion credited to Zuckerman in Chattopadhyay–Liao Lemma 3.15. The finite budget gives sampler entropy \(k+\log _2(1/\delta )\) from extractor entropy \(k\), as used in their Lemma 3.18, correcting the reversed direction printed in Lemma 3.15.
If at least \(K\) inputs are bad, apply extraction to their uniform distribution. Its hit frequency is strictly greater than \(2\epsilon \), contradicting the test-density bound plus extractor error. The source point-mass cap bounds their total probability by \(K/L\).
A neighbor map sends each outer seed to a list of base seeds. Coverage \((K,\rho )\) means that every outer support of size at least \(K\) reaches at least a \(\rho \) fraction of base seeds. A somewhere sampler has a candidate list at each outer seed: the small-test failure event occurs when more than a \(2\epsilon \) fraction of outer seeds have every candidate output in the test. It has probability at most \(\delta \) for every source with point masses bounded by \(1/L\).
Suppose \(E\) is a sampler with parameters \((L,\epsilon _0,\delta )\) and \(\Gamma \) has coverage \((K,\rho )\) on a nonempty base seed set. If \(\epsilon \le \epsilon _0\), \(2\epsilon _0{\lt}\rho \), and \(K\le 2\epsilon A\) for \(A\) outer seeds, then \(S(x,y,z)=E(x,\Gamma (y,z))\) is a somewhere sampler with parameters \((L,\epsilon ,\delta )\). A flat seeded extractor of error \(e\) and positive threshold \(K\) supplies coverage \((K,1-e)\) when its candidate seed set is nonempty. Listing every seed gives concrete full-coverage and zero-failure examples, without giving the short-seed parameters required by the eventual construction.
At a base-good input the hit-seed set has size at most \(2\epsilon _0\) times the base size. If \(K\) outer seeds had all candidates in that set, coverage and \(2\epsilon _0{\lt}\rho \) would contradict that size bound. Thus amplified bad inputs are base-bad; compare their probability sums. For extraction-to-coverage, test the full neighbor image, which receives every source–seed pair. The amplification argument follows Chattopadhyay–Liao Appendix A.
The parity tests are all nonempty subsets of the coordinate set of size at most \(t\). Given a bad-seed set for each test and each candidate position, the common bad-seed set is their union over both indices.
Among \(A\) coordinates there are at most \(A^t\) parity tests of order at most \(t\). If each test and each of \(C\) candidates excludes at most an \(\eta \ge 0\) fraction of seeds, their union excludes at most an \(A^tC\eta \) fraction. Both bounds include empty coordinate, candidate, or seed types and order zero.
Each nonempty subset of size at most \(t\) is the range of a \(t\)-tuple: enumerate the set and repeat a member in unused positions. Count all tuples, then apply a finite union bound over tests and over candidates.
Let \(S\) be a somewhere sampler with parameters \((L,\epsilon ,\delta )\) and \(N\) outer coordinates. Fix a nonempty uniform source support \(Q\) with \(L\le |Q|\). For every parity test of orders one through four and every candidate, suppose a seed set of density at most \(\eta \ge 0\) is excluded, with \(N^4C\eta \le \epsilon \). For each parity test suppose some member coordinate has this property: every candidate escaping its excluded set guarantees absolute weighted parity expectation at most \(\beta \), for every fixing in \(Q\).
Then at least a \(1-\delta \) fraction of fixings in \(Q\) admit an embedding of \(m\) good coordinates with \(N-m\le 2\epsilon N\) and parity-bias bound \(\beta \). This selection theorem places no sign or probability assumptions on the first-source weights or coordinates; those remain hypotheses of the majority theorem. In the intended application, the actual leakage and linearity estimate below supplies the component-call bound. Indexing every test and composing the global sampler must still supply this selection theorem’s seed-escape premise.
Apply the sampler to the common bad-seed set and uniform weights on \(Q\). At each good fixing retain every coordinate with an escaping candidate. For any parity on these coordinates, its distinguished member has such a candidate, which escapes its own test as well. Apply its estimate and reindex through the fixed embedding.
For a supplied polynomial \(E\), set \(g_0=f\bmod E\) and \(g_{j+1}=g_j^2\bmod E\). For exponent \(h=2^r\), output coordinates \(g_{ri}(y)\) for \(0\le i{\lt}m\); the seed \(y\) is kept separate. This is the polynomial map of Guruswami–Umans–Vadhan with the characteristic-power exponent used by Cheraghchi for source linearity. It is an algebraic specification using Mathlib’s polynomial type; an encoded evaluator and uniform field and modulus construction are separate obligations.
Coordinate \(i\) equals \((f^{h^i}\bmod E)(y)\). Over a nontrivial commutative ring, every stored polynomial has degree below that of monic \(E\). For sources already below that degree, coordinate zero equals \(f(y)\). In characteristic two the output map preserves zero, addition, and scalar multiplication over \(\mathbb F_2\) for every fixed seed. No irreducibility hypothesis is needed for these algebraic facts. The finite expansion theorem below additionally requires an irreducible modulus; the full encoded construction is separate.
Induct over modular squaring and use remainder compatibility with multiplication for the power formula. Monic remainder has smaller degree. Squaring is additive in characteristic two, and remainder and evaluation preserve addition. An additive map between \(\mathbb F_2\) modules respects their scalar action.
Let \(e_i(j)=\lfloor j/h^i\rfloor \bmod h\) and \(M_j(z)=\prod _{i{\lt}m}z_i^{e_i(j)}\). For \(K\) coefficient polynomials \(p_j\) define
Only the first \(K\) features are used, where \(K\) will be the actual source cardinality, rather than the full capacity \(h^m\).
If \(j{\lt}h^m\), then \(M_j(u,u^h,\ldots ,u^{h^{m-1}})=u^j\). Thus the first \(K\le h^m\) features become a polynomial of degree below \(K\), nonzero whenever some coefficient is nonzero. For monic \(E\), \(h{\gt}0\), \(A{\gt}0\), and \(\deg p_j{\lt}A\), the substituted sum satisfies
Evaluation commutes with the displayed substitution. No source-degree or irreducibility premise is needed for this degree estimate.
Base-\(h\) digits reconstruct \(j\) and have total at most \(m(h-1)\). Each reduced coordinate has natural degree at most \(\deg E-1\). Apply product, power, and sum degree bounds.
For a field \(F\), a finite set \(T\), seed values \(y_x\in F\), and weights \(w_{x,j}\in F\), if \(|T|{\lt}AK\) there is a nonzero family \((p_j)_{j{\lt}K}\) of polynomials of degree below \(A\) satisfying \(\sum _{j{\lt}K}p_j(y_x)w_{x,j}=0\) for every \(x\in T\).
The linear map from \(AK\) coefficients to the \(|T|\) constraints has a nontrivial kernel. Grouping coefficients into \(K\) polynomials is injective, so the resulting family is nonzero.
If a positive-degree monic \(E\) does not vanish at the constrained seeds, an interpolating family can be chosen with some coefficient not divisible by \(E\), preserving its degree bound and constraints. For irreducible \(E\), the polynomial \(\sum _{j{\lt}K}[p_j]Z^j\) over \(F[Y]/(E)\) is then nonzero of degree below \(K\). Consequently fewer than \(K\) distinct source polynomials of degree below \(\deg E\) can give roots of this quotient polynomial.
Divide common factors of \(E\) out of the coefficient family; each division strictly lowers its common degree bound. Cancel \(E(y_x)\) in each constraint. In the quotient, digit substitution gives the stated polynomial, while distinct bounded-degree representatives have distinct classes. Apply the field root bound.
The full neighbor of a source \(f\) at seed \(y\in F\) is \((y,((f^{h^i}\bmod E)(y))_{i{\lt}m})\). The neighbors of \(P\) are the union of these pairs over \(f\in P\) and every seed in \(F\).
Let \(F\) have cardinality \(q\), let \(E\) be monic and irreducible of degree \(n\ge 2\), and let \(h{\gt}0\). Every set \(P\) of polynomials of degree below \(n\), with \(|P|\le h^m\), satisfies
where subtraction is truncated at zero. This is the finite expansion argument of Guruswami–Umans–Vadhan (2009), Theorem 3.3. For degree-one moduli and at least one output coordinate, the exact neighbor count is \(q|P|\). For \(h=2^r\), the full neighbor equals the seed paired with the modular-squaring condenser output. The field and modulus are supplied; this theorem alone makes no uniform construction or distributional claim.
Put \(K=|P|\) and \(A=q-(n-1)(h-1)m\). If expansion fails and \(A{\gt}0\), interpolate with exactly \(K\) features against the neighbor union. Primitive normalization is possible because \(E\) has no roots in \(F\). Each substituted polynomial has degree below \(q\) and vanishes at all \(q\) seeds, hence is zero. The quotient-field root count would then give \(|P|{\lt}K\), a contradiction. If \(A=0\), the bound is immediate.
For a finite source support \(P\) and seeded map \(C\), let \(\Gamma _C(P)=\{ (y,C(x,y)):x\in P,\ y\in S\} \). The seeded test probability is the fraction of independent uniform source and seed pairs whose joint seed-output belongs to the test set. Repeated outputs retain their multiplicity in this probability.
Suppose \(P,S\) are nonempty, the output alphabet has at least \(|P|\) elements, and \(|\Gamma _C(P)|\ge (1-\epsilon )|P||S|\). There are injections \(g_y:P\hookrightarrow \Omega \), one for each seed, such that every test on \((y,C(x,y))\) differs in probability by at most \(\epsilon \) from the same test on \((y,g_y(x))\). Conditional on each seed, this ideal output is uniform on exactly \(|P|\) values. The construction preserves exactly \(|\Gamma _C(P)|\) original source-seed pairs.
For the polynomial map with \(h=2^r\le q\), supplied irreducible modulus of degree \(n\ge 2\), and a nonempty qualifying source set \(|P|\le h^m\), the error is \((n-1)(h-1)m/q\). The source-dependent witness is a distributional comparison, not an evaluator or a theorem about arbitrary weighted sources.
For each seed retain one actual source representative for every reached output. Extend this partial assignment to an injection using the alphabet capacity. Agreeing pairs map bijectively to reached neighbors. Every change in a test outcome occurs on a disagreeing pair, so division by \(|P||S|\) gives the bound. Apply finite polynomial expansion, including its valid trivial bound when the loss exceeds \(q\).
For a coefficient \(a\) in the supplied field, set \(E_{a,s}(X)=X^{3^s}-a\).
If \(a\) is not a cube, every \(E_{a,s}\) is monic and irreducible, with degree exactly \(3^s\), including \(s=0\). A noncube exists in any finite field with \(3\mid (q-1)\), in particular when \(q=2^b\) and \(b\) is even. For every \(n{\gt}0\), choosing \(s=\lceil \log _3 n\rceil \) gives \(n\le \deg E_{a,s}{\lt}3n\). These are semantic statements; they do not provide encoded field or coefficient selection.
Reuse Mathlib’s odd-prime-power binomial irreducibility theorem in its Kummer development. Cauchy’s theorem gives a nontrivial cube root of unity, so cubing on the finite field is not injective and therefore not surjective. The degree bounds follow from the defining inequalities of the integer ceiling logarithm.
The root \(t\) in \(F[X]/(X^{3^s}-a)\) has norm \(a\) over \(F\). Consequently, if \(a\) is a noncube, \(t\) is also a noncube and \(Z^{3^v}-t\) is monic and irreducible of degree exactly \(3^v\). Both exponents may be zero. This supplies a second algebraic modulus without another coefficient-existence premise; an encoded field representation remains a separate construction.
Mathlib’s power-basis norm formula gives \((-1)^{3^s}(-a)=a\). Applying the norm to a hypothetical equation \(b^3=t\) contradicts the noncube premise on \(a\). Apply the binomial irreducibility theorem in the first quotient field.
Set \(s=\lceil \log _3\lceil (u+1)T/2\rceil \rceil \), \(b=2\cdot 3^s\), \(r=b-T\), and \(m=\lceil k/r\rceil \). The Lean definitions are total natural-number functions; the following bounds specify their positive-parameter behavior.
For \(u,T{\gt}0\) these choices satisfy
The seed has \(b\) bits and the output has \(mb\) bits, with \(umb\le (u+1)k+ub\). If \(Dk\le \epsilon 2^T\), then
These are finite parameter inequalities, without an asymptotic or runtime assertion. Choosing the powering exponent after the sparse field size adapts Cheraghchi’s condenser parameter tradeoff to the binomial degree grid; this choice is a deduction in this development.
Ceiling logarithms bound the rounded field width. Its lower bound gives \(ub\le (u+1)(b-T)\). Ceiling division gives \((m-1)r\le k\), from which the output bound follows. Bound the numerator of the error by \(Dk2^r\) and use \(b=r+T\).
A bit list represents a polynomial over \(\mathbb F_2\), constant coefficient first, with high zero padding permitted. Carryless multiplication computes the parity of each coefficient convolution. The evaluator reads both operands through the standard pairing codec. Both polynomials are runtime inputs.
The coefficient-list product denotes the product of the represented polynomials and has length equal to the sum of the operand lengths. The theorem covers empty operands and high zero padding. On a paired input the evaluator returns exactly this product list, and the single evaluator belongs to \(\mathrm{FP}\) uniformly over all input lengths. This arithmetic component is used with the explicit binary modulus generator and bounded-state evaluators below.
Expand the product coefficient as a convolution, restrict to indices within the first operand, and count the true coefficient pairs modulo two. Beyond the chosen output length every contributing coefficient is zero. Polynomial-time bounded counting, parity, bit access, and output generation give the machine certificate through Cobham’s algebra.
Significant length is one past the highest true coefficient, or zero. For a nonzero modulus of degree \(d\), scan the dividend from high to low, keeping \(d\) bits. Shift, insert the next coefficient, and XOR the modulus when needed to cancel the degree-\(d\) term. A zero modulus returns the dividend unchanged, following the polynomial remainder convention. The paired evaluator reads both lists at runtime.
For every dividend and modulus list, the output represents their exact monic polynomial remainder, with no nonzero or padding premise. Its length is the dividend length for a zero modulus, and otherwise one less than the modulus’s significant length. In particular, a constant-one modulus gives the empty list. Significant length is a polynomial-time unary function, and the paired remainder evaluator belongs to \(\mathrm{FP}\) uniformly in both input lists.
Identify significant length with the represented polynomial degree and prove the single cancellation step by coefficient extensionality and uniqueness of monic remainder. Induct over the scan. A bounded maximum, bitwise step, and bounded-state fold give the machine certificate; routine closure proofs use polytime.
Given finitely many seeded maps \(C_i\) and real weights \(w_i\), define the mixture test value as \(\sum _i w_i\Pr [(Y,C_i(X_i,Y))\in T]\). Each \(X_i\) is uniform on its own finite source type, and \(Y\) is an independent uniform seed shared by all components.
For \(0{\lt}K\le |P|\), the uniform source on \(P\) equals the uniform mixture of its \(K\)-element subsets on every seeded test. Nonnegative weights summing to one preserve a common discrepancy bound. Consequently, lossless witnesses for every \(K\)-subset give an explicit mixture of seedwise \(K\)-flat witnesses for the larger support.
For the polynomial condenser, this applies whenever \(K\le (2^r)^m\) and \(2^r\le q\), with the same normalized error \((\deg E-1)(2^r-1)m/q\). There is no upper bound on \(|P|\) beyond its membership in the bounded-degree source domain. This does not assert decomposition of arbitrary capped probability weights.
Each point of \(P\) belongs to exactly \(\binom {|P|-1}{K-1}\) subsets of size \(K\). Double counting proves the averaging identity with all source and seed multiplicities retained. The triangle inequality proves mixture closure, and the existing lossless theorem supplies each polynomial-condenser component.
Set \(M_s(X)=X^{2\cdot 3^s}+X^{3^s}+1\) over \(\mathbb F_2\).
For every \(s\ge 0\), \(M_s\) is monic and irreducible of degree \(2\cdot 3^s\). Its quotient has cardinality \(2^{2\cdot 3^s}\), and its named root is a noncube. Moreover \(M_s(X^3)=M_{s+1}(X)\). Thus this sparse family supplies both a binary field and the coefficient for a subsequent binomial extension without search.
The root of \(X^2+X+1\) is a noncube in the four-element field. Mathlib’s irreducible-composition theorem and odd-prime-power Kummer theorem give irreducibility of every \(M_s\). The monic power basis gives the quotient cardinality. If its named root had a cube root, that element would be a root of \(M_{s+1}\), whose minimal-polynomial degree would exceed the quotient dimension.
Addition XORs the coefficient lists with zero padding. Modular squaring reduces after each square, once per bit in a unary count word; it starts by reducing the dividend. The evaluator reads dividend, modulus, and count through nested pairing. A zero modulus gives the empty output.
Encoded addition denotes polynomial addition and has the maximum operand length. For a nonzero represented modulus \(E\), the squaring loop on a count word of length \(t\) denotes \(f^{2^t}\bmod E\). Every loop state has exactly \(\deg E\) bits, including zero remainders. Both evaluators belong to \(\mathrm{FP}\) uniformly in all runtime words; squaring time is polynomial in the unary count length \(t\).
Coefficient extensionality proves addition. Induction on the count word and modular-power identities prove squaring correctness. The remainder width gives the state invariant for Cobham’s bounded fold, using the registered multiplication and remainder certificates.
Split a coefficient word into consecutive blocks of runtime width \(b\). For a runtime block count \(t\), evaluate the first \(t\) blocks by Horner’s rule from high to low, reducing modulo the supplied binary modulus after every step. Width and count are unary word lengths. Missing bits are zero, and a zero modulus gives empty output.
If \(c_j\) is the polynomial represented by coefficient block \(j\), then for nonzero modulus \(E\) the output represents \(\bigl(\sum _{j{\lt}t}c_jy^j\bigr)\bmod E\). Every state has exactly \(\deg E\) bits. The encoded evaluator belongs to \(\mathrm{FP}\) uniformly in the coefficient word, unary width, seed, modulus, and unary count, including truncated and padded coefficient data.
A partial-fold invariant records the interval of coefficients already consumed. The step adds the next block to the seed times the current state. The fixed remainder width bounds every state; the arithmetic and pairing certificates discharge the fold’s polynomial-time premises.
Generate \(2d+1\) bits, true exactly at positions \(0,d,2d\). The rounded generator takes \(d=3^{\lceil \log _3 n\rceil }\), where \(n\) is the input word length; at \(n=0\), it takes \(d=1\).
The generated polynomial is \(X^{2d}+X^d+1\), even at \(d=0\). Both generators are uniformly polynomial-time. More generally, rounding a polynomial-time unary target to a power of a polynomial-time unary base is polynomial-time, including bases zero and one. This closure is registered for polytime.
At positive \(d\) the three positions are distinct. At zero the three unit coefficients sum to one in \(\mathbb F_2\). The bound \(b^{\operatorname {clog}_b n}\le bn+1\) permits the existing capped-power program to compute rounding. A bitwise output program generates the coefficients from unary arithmetic tests.
Decode a bit list by polynomial interpretation and the quotient map into \(\mathbb F_2[X]/(M_s)\). Encode a quotient element by the coefficients of its unique reduced representative, retaining exactly \(2\cdot 3^s\) bits. This gives a semantic equivalence with lists of that exact length; it is not an algorithm on abstract quotient objects.
Both round trips hold, with high zero coefficients retained at the canonical width. Decoding respects encoded addition and multiplication. Reduction by any representation of \(M_s\) leaves the quotient element unchanged, and the bounded squaring loop decodes to the corresponding power of that element.
Mathlib’s monic-remainder map is inverse to the quotient map on reduced representatives. Every coefficient is either zero or one. The arithmetic laws follow from the encoded polynomial semantics and the quotient ring homomorphism.
Read a dividend, a unary half-degree target, and a unary squaring count. Generate the rounded trinomial modulus and run the bounded modular-squaring evaluator on these runtime data.
For target length \(n\), the generated polynomial is the irreducible modulus \(M_{\operatorname {clog}_3 n}\), with degree between \(2n\) and \(6n+2\). The output has exactly that degree in bits and denotes the condenser’s modular Frobenius operation for the supplied count. This single composed program belongs to \(\mathrm{FP}\) uniformly. The extension-field packing and complete seeded evaluator are connected to this operation in the results below.
Identify the generated coefficient list with \(M_s\), then apply the modular-squaring semantics and degree invariant. The registered generator, pairing, and squaring certificates compose using polytime.
Write \(K_s=\mathbb F_2[X]/(M_s)\) and let \(t\) be its named root. For \(d=3^v\), define \(E_{s,v}(Z)=Z^d-t\) over \(K_s\). The binary quotient \(K_{s+v}\) is identified as an \(\mathbb F_2\) algebra with \(K_s[Z]/(E_{s,v})\).
We have \(M_s(X^{3^v})=M_{s+v}(X)\), and \(E_{s,v}\) is monic and irreducible of degree \(3^v\). If \(w\) and \(u\) are the roots of the binary and tower presentations, the equivalence sends \(w\) to \(u\) and sends the embedded \(t\) back to \(w^{3^v}\). It transports every polynomial evaluation with these same coefficient and generator maps. All statements include \(s=0\) and \(v=0\).
Substitute the power in the explicit trinomial. Mathlib’s AdjoinRoot.compAlgEquiv identifies a quotient by \(f(g(X))\) with the tower obtained by adjoining a root of \(g(X)-\operatorname {root}(f)\). Transport along the two polynomial equalities. The noncube root and Kummer theorem give irreducibility; evaluation naturality gives the coefficient laws.
A row-major \(d\) by \(b\) bit matrix is transposed by sending input position \(jb+i\) to output position \(id+j\). The output has exactly \(db\) bits. Absent input bits are false; excess bits are ignored. Both dimensions are supplied as unary word lengths.
The coordinate map is exact, and transposing twice recovers the input truncated or zero-padded to \(db\) bits. For exact-length inputs it is an inverse. The total runtime evaluator belongs to \(\mathrm{FP}\) and has a quadratic output bound. Either zero dimension gives the empty list.
Quotient and remainder recover the two matrix indices. Their inverse laws prove the round trip. Unary arithmetic and bit access compute each output bit through the polynomial-time bitwise closure.
The runtime inputs are a coefficient word, unary half-degree, unary extension degree, seed word, unary stride, and unary output-coordinate count. Transpose the source coefficient blocks, square modulo the larger generated binary modulus, transpose back, and evaluate the blocks by Horner modulo the base modulus. Coordinate \(i\) uses \(ri\) squarings; concatenate the coordinates.
For semantic comparison, interpret the first \(d\) blocks of width \(b=2\cdot 3^s\) as a source polynomial over \(K_s\). The decoded map canonically encodes a field seed before running the program and decodes each output block. The runtime output omits the seed; strong distributional comparisons retain it externally.
Every coordinate has exactly twice the half-degree word length in bits. The concatenation has \(mb\) bits, and taking consecutive blocks recovers the coordinates in order. The single paired-input evaluator belongs to \(\mathrm{FP}\) uniformly in all six runtime words and has output length at most twice the square of its encoded input length, even for malformed data or zero dimensions.
The generated trinomial has a true leading coefficient at the prescribed degree. Every Horner result has that fixed width. Compose the registered arithmetic and transposition certificates, then apply polynomial-time concatenation over the unary output range. The stride times coordinate index is also a polynomial-time unary value.
If the half-degree and extension-degree words have lengths \(3^s\) and \(3^v\), the decoded output vector is exactly \(\operatorname {polynomialCondenser}(E_{s,v},r,m,f,y)\). This applies to the actual paired-input \(\mathrm{FP}\) evaluator, with arbitrary source and seed word lengths. Missing source bits are zero and excess source bits are ignored; the semantic source has degree below \(3^v\). The statement includes zero exponents, zero stride, and an empty output vector.
A coefficient bit contributes \(t^iu^j=u^{3^vi+j}\), which is exactly the transposition index. Reindexing the finite coefficient sum proves the packing law. Binary modular squaring preserves the quotient power and has the exact width needed for inverse transposition. Both resulting extension polynomials have degree below the monic modulus, so equality of their quotient classes implies polynomial equality. Horner decoding and block extraction then prove the complete vector statement.
For every \(n\le (2\cdot 3^s)3^v\), source-polynomial encoding is injective on bit lists of length \(n\), including a partial final coefficient block and \(n=0\). Thus zero padding does not merge distinct points of a fixed-length flat source.
Equal source polynomials give equal classes in the larger binary quotient. The canonical-width codec recovers equal packed words. Transposing twice recovers equal padded inputs, and their common original length recovers the original words.
Padded coefficientwise XOR represents addition of source polynomials. At every field seed, the decoded runtime map preserves this addition and sends each all-zero source to zero. No source-length or capacity hypothesis is needed, and unequal source lengths are allowed.
Decode each coefficient block using the binary addition law and apply the polynomial map’s characteristic-two additivity. The exact program identity transfers the result to the computed output.
Let \(b=2\cdot 3^s\), \(d=3^v\) with \(v{\gt}0\), \(r\le b\), and \(n\le bd\). On every nonempty flat support of \(n\)-bit words with at most \(2^{rm}\) points, the decoded runtime program has a seedwise injective ideal map, with joint seed-output test error at most
For any \(0{\lt}K\le 2^{rm}\) and a larger flat support with at least \(K\) points, the same bound holds against an explicit mixture of seedwise \(K\)-flat witnesses. Irreducibility and the field cardinality are proved for the generated moduli; they are not external hypotheses.
Injective source encoding preserves every subset’s cardinality. The exact program identity identifies its neighbors with the polynomial neighbors. Apply expansion, the seedwise injection theorem, and the exact-\(K\) subset averaging identity for larger supports.
Given source length \(n\), entropy budget \(k\), inverse-error exponent \(e\), and rate parameter \(u\), set \(T=e+\lceil \log _2(9(n+1)(k+1))\rceil +1\). Retain the sparse choices \(b=2\cdot 3^s\) and \(r=b-T\). Set \(v=\lceil \log _3\max (3,\lceil n/b\rceil )\rceil \), \(d=3^v\), and \(m=\lceil k/r\rceil \), with total natural-number division in degenerate cases. These rounding choices are deductions in this formalization from the credited sparse rate and loss bounds.
The budget, field width, and extension exponent are positive, and
For \(u{\gt}0\), also \(r{\gt}0\) and \(k\le rm\). Every parameter, including \(3^s\) and \(3^v\), has a registered unary polynomial-time certificate when its inputs do. All finite inequalities include zero source length, zero entropy, and zero inverse-error exponent.
Ceiling division gives capacity, and rounding up to a power of three loses at most a factor of three. The logarithmic budget pays for the extension-degree times entropy bound. Unary arithmetic and bounded power-of-ceiling-logarithm computation generate the parameters; no general polynomial-time exponentiation rule is used.
Compute the explicit dimensions from \(n,k,e,u\) and run the binary condenser on source and seed words. The paired evaluator takes the four numerical parameters as unary word lengths. The decoded map canonically encodes a field seed and reads the computed coordinates.
One \(\mathrm{FP}\) evaluator computes the parameters and all output bits. Its output has exactly \(mb\) bits and satisfies the selected rate bound. Its decoded output equals the polynomial condenser and preserves source XOR for each seed. These program identities require no source-length promise or positive-parameter hypothesis.
Instantiate the exact runtime semantics and source-linearity laws. Compose the registered unary parameter certificates with the uniform condenser certificate using the polynomial-time tactic.
For \(u{\gt}0\), the actual scheduled program on every nonempty flat \(n\)-bit support of size at most \(2^k\) is within \(2^{-e}\) of a seedwise flat witness of the same support size. On every flat support of size at least \(2^k\), it is within \(2^{-e}\) of an explicit mixture of seedwise \(2^k\)-flat witnesses. Every test retains the seed. No field, capacity, stride, or error-budget inequality is supplied by the caller. The following one-shot extraction layer composes this finite lossless guarantee with linear hashing; the recursive extractor and correlation-breaker construction remains separate.
Use \(dk\, 2^e\le 2^T\) in the sparse normalized loss bound. The selected dimensions supply the degree and source capacity hypotheses, and \(k\le rm\) gives the entropy capacity. Apply the program’s flat and mixture guarantees with the resulting error bound.
For a finite seed set \(S\) and output set \(\Omega \), strong extraction compares \((Y,E(X,Y))\) with independent uniform seed and output on every test \(T\subseteq S\times \Omega \). The source \(X\) is uniform on any nonempty finite support \(P\) of size at least \(K\). The uniform test probability is \(|T|/(|S||\Omega |)\), and the permitted discrepancy is \(\epsilon \). Nonemptiness of \(P\) remains explicit when \(K=0\).
Strong extraction is preserved by increasing the support threshold or permitted error. For nonempty seed and output sets, it implies the existing output-only flat seeded-extractor contract.
Restrict the source quantifier and increase the error bound. For weak extraction, apply the strong bound to product tests \(S\times U\) and clear the positive seed and output cardinalities. The empty support satisfies the denominator-free weak inequality directly.
A family \(H:A\times S\to \Omega \) is universal when every pair of distinct inputs collides on at most \(|S|/|\Omega |\) seeds. The definition uses the integer inequality
It does not require pairwise independence or uniform output at each fixed input; linear hash families all send the zero input to zero.
Suppose the seed and output sets are nonempty. For a universal family, every joint test on a nonempty flat support of cardinality \(N\) has squared discrepancy at most \(M/(4N)\), where \(M=|\Omega |\). Consequently, \(K{\gt}0\), \(\epsilon \ge 0\), and \(M\le 4\epsilon ^2K\) imply strong extraction with threshold \(K\) and error \(\epsilon \). Restricting the input along an injection preserves universality. This is the standard leftover-hash argument, in the finite test form used here; see Guruswami–Umans–Vadhan, Lemma 5.1, and Barak et al., Leftover Hash Lemma, Revisited, Lemma 1.
Double-count squared output-fiber sizes over ordered pairs of source points. Separate the diagonal pairs and use universality on distinct pairs. Center the fiber counts and apply Cauchy–Schwarz to a centered test indicator, whose variance is at most \(1/4\). Normalize by the exact source and seed cardinalities.
Let \(K{\gt}0\). Suppose the retained-seed output of \(C\) is within \(\delta \) of a supplied finite mixture with nonnegative normalized weights. Conditional on the component and condenser seed, its ideal output is uniform on the image of an injection from a set of size at least \(K\). If \(H\) is a strong \((K,\epsilon )\) extractor, then
has error at most \(\delta +\epsilon \), retaining both independent seeds. The witness supports may depend on the component and on \(y\); the actual map \(C\) need not be injective. The subset-mixture wrapper matches the lossless condenser’s witnesses on every larger flat support. This is a finite formulation of the composition in Guruswami–Umans–Vadhan, Proposition 4.5 and Remark 5.15, and Chattopadhyay–Goodman–Liao, Lemma 4.9.
Fix the fresh seed \(a\) and pull each composed test back to a joint condenser test; averaging preserves its error \(\delta \). Next fix the condenser seed and apply strong extraction to each ideal image support. Average the component errors using the normalized weights, then apply the triangle inequality. Every probability counts source occurrences before dividing, so repeated actual outputs retain their multiplicities.
For a field \(F\), additive group \(\Omega \), and additive map \(\pi :F\to \Omega \), set \(H(x,a)=\pi (ax)\). The multiplier \(a\) is the hash seed. Coefficient truncation gives the standard field hash of Guruswami–Umans–Vadhan, Lemma 5.1.
Every fixed-seed map is additive and sends zero to zero. If \(F\) and \(\Omega \) are finite and \(\pi \) is surjective, distinct inputs collide on exactly \(|F|/|\Omega |\) seeds; hence the family is universal.
Collisions are exactly the seeds satisfying \(\pi (a(x-x'))=0\). For distinct inputs, multiplication by \(x-x'\) permutes \(F\). Surjectivity gives equal-size fibers of \(\pi \), so its kernel has the stated cardinality.
Over the explicit field \(F_s=\mathbf F_2[X]/(M_s)\) of bit width \(b=2\cdot 3^s\), project to the first \(\ell \) coefficients. The runtime hash multiplies two supplied bit words, reduces modulo the generated binary trinomial, and takes the requested prefix. Its paired evaluator receives source, seed, modulus half-degree, and output count as runtime words. The decoded map uses a canonically encoded field seed.
If \(\ell \le b\), the coefficient projection is surjective and distinct field inputs collide on exactly a \(2^{-\ell }\) fraction of seeds. Decoding is injective on source words of every fixed length \(n\le b\), so the actual decoded hash strongly extracts from such flat sources whenever \(2^\ell \le 4\epsilon ^2K\), \(K{\gt}0\), and \(\epsilon \ge 0\). With a valid half-degree word, the runtime output length is \(\min (\ell ,b)\) and its coefficient vector is the semantic field hash. Padded source XOR is preserved for each fixed seed, including unequal source lengths. The total paired evaluator is in \(\mathrm{FP}\) uniformly in all four runtime words and has output length bounded by input length.
Represent any prefix by its polynomial below degree \(b\), then use field hashing and the fixed-length coefficient codec. Correctness of carryless multiplication, runtime remainder, and prefix truncation identifies the computed map. Compose their registered polynomial-time certificates.
A vector of \(m\) elements of \(F_s\) is encoded by concatenating its \(m\) canonical blocks of width \(b=2\cdot 3^s\). Decoding reads those blocks in the same order. The resulting equivalence is between coordinate vectors and bit words of length exactly \(mb\), including high zero bits. These semantic maps describe the existing runtime output layout.
Both codec round trips are exact at the prescribed width; serialization is injective and sends coordinate addition to bitwise XOR. Re-encoding the decoded condenser returns its exact original runtime output. The latter identity also holds for the scheduled program.
Identify each consecutive block with its field encoding and apply the field codec’s inverse and addition laws coordinate by coordinate. Exact output length and the condenser’s checked coordinate formula identify the full runtime word, including its zero padding.
For source length \(n\), output length \(\ell \), and inverse-error exponent \(e\), set \(k=\ell +2e\). Condense with rate parameter \(u=1\) and error exponent \(e+1\). Write \(b\) for its field width and \(N\) for its output width. Choose the hashing field width \(B=2\cdot 3^{s_H}\) by sparse rounding above \(\max (N,\ell )\).
The selected dimensions satisfy
The exact sharp leftover-hash budget is \(2^\ell =4(2^{-(e+1)})^2\, 2^{\ell +2e}\), and the two half-errors sum to \(2^{-e}\). All statements include zero parameters. All three parameter functions and both selected field half-degrees have uniform unary polynomial-time certificates; no general exponentiation rule is asserted.
Apply the condenser’s rate bound at \(u=1\) and the sparse rounding bounds to \(\max (N,\ell )\). Handle the zero rounding target by the minimum two-bit field. The error identities follow from power arithmetic. The existing bounded power-rounding certificates compose with unary arithmetic to compute the actual half-degrees.
Run the scheduled condenser at \(k=\ell +2e\), error exponent \(e+1\), and \(u=1\), then hash its complete output with an independent field seed. The paired evaluator takes source, both seeds, and unary words for \(n,\ell ,e\). It emits the output bits; the decoded statistical map retains both seeds externally for joint tests.
For all source and seed words the total program emits exactly \(\ell \) bits, and the paired evaluator belongs to \(\mathrm{FP}\). Parameter generation is part of this single evaluator. At canonical field seeds, its decoded map is exactly condensation, serialization, and field hashing, and it preserves padded source XOR for every fixed pair of seeds. The latter identity does not require equal source lengths.
Hash-field capacity gives exact output width. The serialization identity connects the actual condenser word to the coordinate map used by hashing. Compose the two additivity laws and the registered polynomial-time certificates, including the unary parameter generators.
For every finite support \(P\) of \(n\)-bit words with \(|P|\ge 2^{\ell +2e}\), the actual decoded program produces \(\ell \) bits with discrepancy at most \(2^{-e}\) on every joint test retaining both independent uniform field seeds. The parameters and program are fixed before \(P\) and the test are chosen. No capacity or numerical error assumption is supplied by the caller. This implements the finite condense-then-hash mechanism of Chattopadhyay–Goodman–Liao, Lemma 4.9, with the explicit sparse field schedule used here.
The scheduled condenser is within \(2^{-(e+1)}\) of its conditional \(2^{\ell +2e}\)-flat mixture. Serialization and fixed-width hashing-field decoding preserve each witness injection. Universality and the exact leftover budget give another \(2^{-(e+1)}\) error. Apply mixture-aware strong composition and identify it with the actual program.
A probability weight on a finite type is a nonnegative function \(p\) with \(\sum _xp(x)=1\). Its threshold-\(K\) cap is \(Kp(x)\le 1\) for every \(x\). Statistical distance is \(\frac12\sum _x|p(x)-q(x)|\); deterministic images sum the weights of all preimages. Marginals, uniform weights, and uniform weights supported on a finite subset use the same finite-sum conventions.
If \(K{\gt}0\) and \(p\) is a probability weight with \(Kp(x)\le 1\), there are nonnegative weights \(w_S\), indexed by the \(K\)-element subsets of the ambient type, such that \(\sum _Sw_S=1\) and
No extra bound on the ambient cardinality is required.
Complete the capped probability vector to a doubly stochastic matrix. Apply Mathlib’s Birkhoff–von Neumann theorem, formalized by Bhavik Mehta, and group the resulting permutation weights by their selected \(K\)-subset. At full ambient cardinality the source is already uniform. This is an exact finite existence argument for real weights, with no runtime claim.
Statistical distance satisfies the triangle inequality and contracts under deterministic maps. Probability weights have distance at most one. For weights of equal total mass, distance at most \(\varepsilon \) is equivalent to discrepancy at most \(\varepsilon \) on every finite test. Two deterministic observations of one probability source have distance at most their disagreement probability. A normalized source capped at the full ambient cardinality is exactly uniform.
Use finite sums of absolute values, grouping fibers for deterministic images. Equal total mass identifies the positive discrepancy with half the absolute discrepancy. For uniformity, all deficits from uniform weights are nonnegative and sum to zero.
A weighted strong extractor satisfies the retained-seed test bound for every normalized threshold-\(K\) capped source. A weighted strong condenser at thresholds \(K_{\rm in},K_{\rm out}\) sends each such input source within distance \(\varepsilon \) of a family \(q_y\) of normalized threshold-\(K_{\rm out}\) capped output weights, indexed by the seed. Both joint laws have a uniform seed marginal; the actual seed is independent of the input source.
For positive \(K\), the flat and weighted strong-extractor contracts are equivalent, with identical error and seed parameters.
Seeded-test probabilities are linear in the source weights. Decompose a capped source into its exact-size flat components and average their errors. Conversely, the uniform weighting on a nonempty support is a normalized capped weighting.
Replacing the seed and output alphabets by finite equivalent types preserves weighted strong extraction, with the same input threshold and error. The seed equivalence reindexes the uniform seed, and the output equivalence reindexes the ideal uniform output law.
Pull each retained-seed/output test back through the two equivalences. Bijections preserve finite uniform weights and the actual test sum.
Suppose \(K{\gt}0\) and every \(K\)-element input support has seedwise injective output witnesses within retained-seed test error \(\varepsilon \). Then the same map is a weighted strong condenser at input and output threshold \(K\), with the same error. A weighted strong extractor is a weighted strong condenser whose output threshold is the full output cardinality. Seeds are nonempty; the latter statement also assumes a nonempty output type.
Mix the injective images of the exact-size flat components at each seed. These conditional laws are normalized and capped. Average the test bounds and use the test characterization of statistical distance. For an extractor, take the uniform output law at every seed.
For every positive rate parameter \(u\), on arbitrary distributions of \(n\)-bit inputs the scheduled condenser preserves point-mass cap \(2^{-k}\) in its seedwise ideal output, with joint error \(2^{-e}\). The one-shot program strongly extracts \(\ell \) bits with error \(2^{-e}\) from every source capped by \(2^{-(\ell +2e)}\). The statements also permit any injective encoding into words of length \(n\). These are the same actual programs with their previously proved uniform polynomial-time evaluators.
Transport each finite flat support through the input encoding and apply the checked flat guarantee. Then use the exact mixture transfers. For Boolean vectors, the encoding is List.ofFn.
An injective encoding of the output, allowed to depend on the retained seed, preserves both entropy thresholds and the error of a weighted strong condenser. The statement includes the empty seed type under the zero-mass convention.
Push each conditional witness through its injective encoding. Its cap is preserved, and deterministic contraction bounds its distance from the correspondingly encoded actual output. Average over the seed.
If the selected field width is \(b=2\cdot 3^s\) and the condenser has \(c\) field coordinates, set \(H=c3^s\). The paired map runs the actual scheduled bit program on the input and encoded field seed, then reads its first and second \(H\) bits as two Boolean vectors.
The actual output length is exactly \(2H=cb\), so the paired map needs no padding. Its half-width satisfies \(u(2H)\le (u+1)k+ub\). For positive rate parameter \(u\), the paired map is a weighted strong condenser from threshold \(2^k\) to threshold \(2^k\) with error at most \(2^{-e}\), over two half-alphabets of size \(2^H\).
The even field width gives the length identity and transfers the existing output-rate bound. The fixed-length serialization followed by splitting is injective. Apply output transport to the proved weighted guarantee of the decoded scheduled condenser.
Write \(H\) for the actual output half-width and \(b\) for the field bit width. For \(u{\gt}0\), the coordinate capacity gives \(k\le 2H\). For \(u{\gt}1\), the sufficient integer budget
implies \(s\le H\) and \(H+s+E\le k\). Here the splitting exponent \(E\) can differ from the condenser error exponent. One may replace \(b\) in this sufficient condition by its proved upper bound. Taking the budget at \(s=0\) justifies the maximal next entropy \(k-H-E\), with exact equality \(H+(k-H-E)+E=k\) and no truncated-subtraction loss.
The chosen coordinate count gives capacity, since its powering width is at most the field width. Add the budget to the output-rate inequality and cancel the positive factor \(2u\) to obtain the entropy inequality. Capacity then gives \(s\le H\). Prove \(H+E\le k\) before using subtraction.
Given a word of concatenated \(n\)-bit blocks, a seed word, a unary block count, and the condenser parameters, apply the scheduled bit program to each fixed-width input slice using the same seed and concatenate the resulting output words in block order.
The block program is polynomial-time when its numerical parameters have uniform unary certificates and its words and unary block count are polynomial-time. Its exact output length is the block count times the component output length. On a concatenated fixed-width tuple, its output is exactly the concatenation of the component outputs. Zero blocks and zero block width are included.
Use polynomial-time fixed-width slicing and the actual condenser certificate inside finite-range concatenation. Each component has the same exact length. Slicing the concatenated fixed-width input recovers its corresponding tuple entry.
On a concatenated tuple of fixed-width Boolean blocks and the canonical encoding of a field seed, the block program returns exactly the concatenated output of the statistical condense-and-split map. Each pair’s first half immediately precedes its second half. The equality includes zero blocks and zero input width, without entropy assumptions.
Apply the componentwise program identity, recombine each actual paired output, and identify the flattening order of the split tuple.
Any two finite probability weights admit a coupling with disagreement probability equal to their statistical distance. For a joint law \(p(a,b)\) and a proposed first marginal \(q(a)\), there is a joint law \(p'\) with first marginal \(q\), unchanged second marginal, and \(d(p,p')=d(p_A,q)\). The lifted law \(\rho ((a,b),a')\) also satisfies
including rows with zero mass. This records the conditional independence used in the finite coupling ingredient of Chattopadhyay–Goodman–Liao, Lemma 4.19, which credits Li’s 2015 Lemma 3.20. The full extension over an external conditioning variable is a further obligation.
Place common pointwise mass on the diagonal and couple the residual weights by their normalized product. Lift this coupling through the old conditional row weights. Projection bounds the joint distance from above by disagreement, and marginalization gives the reverse bound.
A threshold-\(K\) source on \(t\) blocks is a normalized probability weight on \(\alpha ^t\) for which every one-block prefix extension satisfies \(Kp(u,a)\le p(u)\). This multiplicative definition includes zero-mass prefixes without conditional division. For \(K{\gt}0\) it expresses conditional min-entropy at least \(\log _2K\) in every block given its predecessors.
Block-source caps survive taking prefixes, decreasing the threshold, and taking normalized nonnegative mixtures. Zero blocks impose only normalization; one block gives the ordinary point-mass cap. Two blocks are equivalent to a capped first marginal and the inequalities \(Kp(a,b)\le p_A(a)\) for the second block. A source on \(t\) blocks has joint threshold \(K^t\). At threshold \(|\alpha |\), the joint source is exactly uniform on all block tuples, including the zero-block case.
Prefix pushforwards compose and commute with finite linear combinations. Apply these identities to the defining nonnegative linear inequalities. The zero-, one-, and two-block cases use the corresponding tuple equivalences and explicit marginal sums. Induction on prefix length gives the joint cap; the full-cardinality cap forces uniformity.
For a joint law \(p(a,b)\) with point weights at most \(\mu \), replace each row of mass less than \(K\mu \) by a uniform row of the same total mass. Keep every other row unchanged.
Let each of two blocks have \(2^m\) possible values, and let \(p\) have point-mass cap \(2^{-k}\). If \(t\le m\) and \(m+t+e\le k\), there is a two-block source with threshold \(2^t\), the same first marginal, and distance at most \(2^{-e}\) from \(p\). More generally, if \(0{\lt}K\le |\beta |\) and \(K|\beta |\mu \le 1\), the repair has first-marginal and conditional threshold \(K\), and distance at most \(|\alpha |K\mu \). A sharper bound is the total mass of the repaired rows. The explicit repair also preserves every original joint point-mass cap. This is the finite two-block step in Chattopadhyay–Goodman–Liao, Lemma 5.3, attributed there to Goldreich–Wigderson (1997).
Uniformizing a row preserves its mass and enforces its conditional cap; an unrepaired row already has mass at least \(K\mu \). The marginal cap follows by summing the original point bound. The absolute discrepancy in a repaired row is at most twice its mass. For the power-of-two specialization, \(2^m2^t/2^k\le 2^{-e}\) supplies both budgets. Averaging a row cannot increase its largest point weight, preserving the old joint cap.
For nonnegative coefficients \(w_i\), retaining a component tag gives
Forgetting the tag gives the corresponding upper bound. Thus the distance between two uniform-seed families equals the average of their conditional distances. The component weights need not be normalized. A deterministic map that preserves a tag acts separately on its components.
Expand the finite sum defining distance and factor the nonnegative coefficient out of each absolute value. Contraction gives the untagged inequality. Uniform-seed averaging uses coefficient \(1/|\mathrm{Seed}|\).
For a joint law \(p(a,b)\) with first marginal \(p_A(a)\), its conditional row is \(p(a,b)/p_A(a)\) when \(p_A(a)\ne 0\) and uniform otherwise. Uniform extension appends independent uniform randomness to a supplied first-coordinate law. Write \(U_2p(a,b)=p_A(a)/|B|\) for the law retaining the actual first marginal and uniformizing its second coordinate.
On a nonempty second alphabet, conditional rows of a probability law are normalized, including null rows. Multiplying each row by its marginal recovers the original law, and
Processing the second coordinate within each row leaves the first marginal unchanged. Deterministically processing the retained first coordinate cannot increase distance from an independent uniform output.
A nonnegative zero-mass row vanishes pointwise. On positive rows cancel the marginal, then use exact tagged-distance averaging. Uniformization commutes with deterministic processing of the first coordinate, so contraction proves the last claim.
For equal-mass real weights \(p,q\) and \(0\le f\le 1\), \(|\sum _xp(x)f(x)-\sum _xq(x)f(x)|\le d(p,q)\). On nonempty seed and output alphabets, the weighted strong-extractor test contract is equivalent to distance at most \(\varepsilon \) from the independent uniform seed-output law for every normalized capped source.
The positive and negative parts of \(p-q\) have equal total mass, each equal to its total variation. A statistic in \([0,1]\) is bounded by these parts. The extractor equivalence uses the equal-mass finite-test characterization of total variation.
Let \(E\) be a weighted strong extractor with threshold \(K\) and nonnegative error \(\varepsilon \), on nonempty seed and output alphabets. If \(p(t,x)\) is a probability law and \(0\le p(t,x)\le \mu (t)\), extraction from \(x\) with an independent uniform seed has distance at most \(\varepsilon +K\sum _t\mu (t)\) from uniform, retaining both the entire tag \(t\) and the seed. No cap on every conditional row is assumed. This is the finite average-entropy step in Chattopadhyay–Liao, Lemma 3.26, which credits Chattopadhyay–Goodman–Liao and ideas from Chattopadhyay–Li (2016).
A positive row with \(K\mu (t)\le p_T(t)\) satisfies the extractor’s conditional cap. Other rows have total mass at most \(K\sum _t\mu (t)\) and contribute distance at most their mass. Null rows contribute zero. Sum the row distances and average over the seed.
A shared transcript has law \(w(z)\), and the left and right variables have conditionally independent laws \(l_z(a),r_z(b)\). The source \(x(z,a)\) and observation \(u(z,a)\) depend on the left side; the seed \(y(z,b)\) and observation \(v(z,b)\) depend on the right. A further finite leak \(L(z,v,a)\) may depend on the left variable and the right observation together. The actual output law retains \((z,b,u(z,a),L(z,v(z,b),a))\) alongside \(E(x(z,a),y(z,b))\).
Let \(w,l_z,r_z\) be probability laws and \(E\) a threshold-\(K\) strong extractor of nonnegative error \(\varepsilon \), with nonempty seed and output alphabets. Suppose a nonnegative envelope \(\mu (z,u)\) bounds \(\Pr [Z=z,U=u,X=x]\) for every \(x\), and the law of \((Z,V,Y)\) is within \(\delta \) of its actual \((Z,V)\) marginal with an independent uniform seed. The actual retained extraction law has distance at most
from its actual retained marginal with an independent uniform output, where \(\mathcal L\) is the extra leak’s alphabet. A bound \(K|\mathcal L|\sum \mu \le \rho \) gives error \(\varepsilon +\delta +\rho \).
For the independent uniform seed, apply the average leakage theorem with tag \((z,v,u,L)\). Refining an event reduces its point mass; averaging over \(v\) leaves envelope total \(|\mathcal L|\sum \mu \). Conditional independence expresses both actual and uniform-seed distances as expectations of the same \([0,1]\)-valued row statistic. The bounded-expectation inequality therefore charges the seed discrepancy once, while retaining all of the right variable.
From the original factored law, retain \(H=((Z,U(Z,A)),Q(Z,A))\). The right seed \(Y(H,B)\) and right observation \(V(H,B)\) may depend on this entire transcript. The extraction law keeps \(H\), the complete original right variable \(B\), and a leak \(W(H,V(H,B),A)\) alongside \(E(X(Z,A),Y(H,B))\). Both \(Q\) and \(W\) are evaluated on the original left variable.
Let the original factors be probability laws and let \(E\) be a threshold-\(K\) strong extractor of nonnegative error \(\varepsilon \), with nonempty seed and output alphabets. Suppose \((Z,U,X)\) is within \(\rho \) of its actual \((Z,U)\) marginal times an independent uniform \(X\), and \((H,V,Y)\) has analogous seed discrepancy at most \(\delta \). The actual retained extraction law has error at most
No pointwise conditional source cap or repaired witness is assumed. When \(V,Y\) depend only on \((Z,Q)\), their joint seed discrepancy is exactly unchanged by retaining \(U\), so the seed premise needs only \((Z,Q,V)\). This is the smooth-source consumer for Chattopadhyay–Liao Theorem 6.1; the actual one-round specialization is proved below.
Observe \(U\), then repair the honest source coordinate to uniform while preserving the entire original conditional left variable. Observing the actual \(Q\) gives joint envelope total \(|Q|/|X|\). Apply two-sided merging. The original \(U,Q,B,W\) marginal is exact, so transfer costs the old distance once. If the seed uses only \((Z,Q)\), finite weighted averaging sums out the independent extra left observation, including null rows.
Given transcript \(Z\), let the entire left tuple \((X,X_1,\ldots ,X_t)\) be independent of the entire right tuple \((Y,Y_1,\ldots ,Y_t)\). For index sets \(S,T\subseteq [t]\), the actual law applies \(E\) to each source-seed pair and retains \((Z,Y,Y_1,\ldots ,Y_t,(E(X_i,Y_i))_{i\in S\cup T})\) alongside \(E(X,Y)\). It is the deterministic image of the factored source law, and \(S,T\) may overlap.
Let the transcript and both conditional tuple laws be normalized, and let \(E\) be a threshold-\(K\) strong extractor of nonnegative error \(\varepsilon \), with nonempty seed and output alphabets. Suppose \(\mu (z,u)\ge 0\) bounds every joint mass \(\Pr [Z=z,X_T=u,X=x]\), and \((Z,Y_S,Y)\) is within \(\delta \) of its actual \((Z,Y_S)\) marginal with an independent uniform seed. The independence-merging law is within
of its actual retained marginal with a fresh independent uniform output. If the last term is at most \(\varepsilon \), the error is \(2\varepsilon +\delta \). This is the finite envelope form of Chattopadhyay–Liao, Lemma 3.26; the envelope total expresses the average conditional guessing budget without logarithms.
Apply two-sided leakage with \(U=X_T\), \(V=Y_S\), and the extra leak \((E(X_i,Y_i))_{i\in S}\), whose alphabet has size \(|\mathrm{Out}|^{|S|}\). The retained source copies \(X_T\) and all right-side seeds recover every remaining output indexed by \(T\). On overlaps use the already retained \(S\) output. Processing side information preserves the actual uniform comparison and contracts distance. The numerical budget gives the stated final error.
Given transcript law \(w(z)\), source kernel \(p_z(a)\), and deterministic message \(f(z,a)\), the new transcript law is \(w'(z,u)=w(z)\Pr [f(z,A)=u\mid z]\). Its updated source kernel is the conditional law of \(A\) on that message, completed uniformly on null rows. Both original source coordinates remain available after updating.
A left-side observation updates its conditional kernel while preserving the right kernel; a right-side observation has the symmetric property. The resulting factored law is exactly the pushforward of the original law retaining the message and both original side variables. Every updated kernel and transcript is normalized. A left message followed by a right message depending on that first message has the same exact factorization. These rules include null observation rows and formalize the deterministic-conditioning step of Chattopadhyay–Liao, Lemma 3.25.
Multiplying the updated kernel by its transcript weight recovers the original joint mass on the observed event and is zero elsewhere. Finite pushforward sums then identify the complete factored law. Compose the two exact pushforwards for the adaptive observation.
Let \(p\) be a probability law of \((Z,A,B)\) and let \(q\) be a probability law of \((Z,A')\) with the same \(Z\) marginal. There is a coupling preserving the complete original \((Z,A,B)\) law, giving \((Z,A')\) law \(q\), and satisfying \(\Pr [A\ne A']=d(p_{ZA},q)\). Its kernel makes \(A'\) independent of \(B\) given \((Z,A)\), including null rows. The projected law \(p'\) of \((Z,A',B)\) preserves \((Z,B)\) jointly and satisfies \(d(p,p')=d(p_{ZA},q)\). No per-transcript error bound is required.
Normalize each transcript row, lift a maximal marginal coupling through its original conditional kernel, and multiply by the common transcript mass. Summing exact row disagreements gives the global joint marginal distance. Projection gives the upper bound on joint distance; marginal contraction gives the matching lower bound.
For arbitrary finite real weights \(p(a,b)\) and output equivalences \(e_a:B\simeq C\), the map \((a,b)\mapsto (a,e_a(b))\) commutes with uniformizing the output and preserves the exact distance \(d(p,U_2p)\). Adding a tag-dependent mask in a finite additive group is a special case. The statements require neither normalization nor nonnegative weights.
Each fiber bijection preserves its cardinality and uniform law, while the first marginal is unchanged. Apply deterministic contraction in both directions of the complete tagged equivalence.
Sample \((Z,A,B)\) from a factored law. A left source \(x(Z,A)\) and right seed \(y(Z,B)\) give the retained law of \((Z,B,E(x(Z,A),y(Z,B)))\). The affine version first combines the left source with a right mask \(m(Z,B)\) using a specified operation, and applies the same extractor and actual seed. Both are deterministic images of the original factored law and retain the whole right variable.
Let the factor laws be normalized and \(E\) be a threshold-\(K\) strong extractor of nonnegative error \(\varepsilon \), with nonempty seed and output alphabets. Suppose \(\mu (z)\ge 0\) bounds every joint source mass \(\Pr [Z=z,x(Z,A)=x]\), and \((Z,y(Z,B))\) is within \(\delta \) of its actual transcript law with a fresh uniform seed. Retained extraction has distance at most \(\varepsilon +\delta +K\sum _z\mu (z)\) from its actual \((Z,B)\) marginal with independent uniform output. The same bound holds on the combined input whenever each fixed mask and seed acts bijectively on the extractor output. The mask may be correlated arbitrarily with the seed.
Specialize two-sided leakage to singleton observation and leakage alphabets, retaining all of \(B\). For the masked input, the extractor’s equivariance identifies its actual law with a tagged output bijection of the unmasked law. Exact distance preservation adds no error.
The actual scheduled Boolean extractor, under its proved finite budget and reserve conditions, has the affine retained-law guarantee with error \(\varepsilon _{\rm schedule}+\delta +K\sum \mu \) on a left source XOR a right mask. The explicit dyadic schedule gives \(\varepsilon _{\rm schedule}=2^{-e}\). These are the same bit programs and exact Boolean seed widths already supplied by the uniform runtime construction. No extractor or finite-field instance is a caller premise.
Use the proved weighted extraction guarantee and fixed-seed XOR law of the actual program. Coordinatewise XOR with the mask output is an involution on the complete block-output tuple. Apply affine initial extraction, preserving the actual full right-side marginal.
If \(\lceil \log _2(n+1)\rceil \le L\), \(64\le L\), \(h\le 64\), and \(E\le L\), the actual scheduled extractor with reserve \(4096(L+E+1)\) and leaf output width \(L\) has seed length at most \(2^{24}L\). For \(1\le L\) and \(E\le L\), its source entropy in bits is at most \(2^{62}L\) at depth 24, and at most \(2^{142}L\) at depth 64. These are conservative finite bounds on the existing construction, supporting successive calls with matched seed and output widths; they assert no correlation-breaker guarantee.
Bound the existing seed formula using \(h+1\le 65\) and \(\lceil \log _2(L+E+1)\rceil \le L+E\). Substitute the reserve in the exact initial entropy \(4^hQ\) for each of the two fixed depths and use \(L+E+1\le 3L\).
Set \(d=2^{24}L\) and output width \(2^hL\). On Boolean vectors of source width \(n\) and seed width \(d\), run the scheduled bit program with \(E=e+h+2\) and reserve \(4096(L+E+1)\). Feed exactly its prescribed seed prefix, completed by zero bits when necessary, and read the actual output in flat block order.
Suppose \(\lceil \log _2(n+1)\rceil \le L\), \(64\le L\), \(h\le 64\), and \(e+h+2\le L\). The prescribed seed fits within \(d\) bits, and the actual extractor has strong error \(2^{-e}\) at its exact scheduled entropy threshold, retaining all \(d\) seed bits. At depths 24 and 64 the source entropy may be weakened to \(2^{62}L\) and \(2^{142}L\) bits respectively. Fixed-seed source XOR becomes coordinatewise output XOR for all parameters.
Identify the raw bit output with the scheduled Boolean tuple, flatten by a coordinate equivalence, and pad the seed while retaining its unused suffix. Apply the finite depth bounds to the exact entropy formula.
Suppose
The actual matched extractor at depth \(h\) has seed width \(2^{24}L\), output width \(2^hL\), and strong error \(2^{-e}\) at its exact scheduled entropy threshold, retaining the entire padded seed. Its entropy requirement may be weakened to \(2^{2h+14}L\) bits. Nonvacuous use still requires a source meeting this mass bound. For \(e\le L\), depth \(h=\lceil \log _2(t+1)\rceil +64\) also gives output width at least \(2^{62}L+(2t+2)2^{24}L+e\). The logarithmic-depth runtime below implements the depth choice \(h=\lceil \log _2(t+1)\rceil +64\) with polynomially many blocks in \(t\).
Bound the exact scheduled seed formula by the displayed depth budget, then use retained-seed padding. Bound the reserve in the initial entropy \(4^hQ\). The ceiling-logarithm inequality gives the final output-width reserve.
Let the original law factor into normalized left and right kernels given \(Z\), with a nonnegative honest-left joint envelope \(\mu \) and right-derived seed discrepancy at most \(\delta \). XOR the source with an arbitrary mask from the complete right state. Under the preceding growing-depth budget, the actual matched output retains that state and has distance from independent uniform output at most
At depth 64, the bounded-depth conditions give the same estimate with threshold \(2^{\, 2^{142}L}\).
The actual fixed-seed XOR identity makes the mask an output translation depending only on the retained right state. Apply the finite affine extraction theorem to the corresponding checked matched extractor.
Test the four finite conditions above before generating the schedule. A valid call cuts the supplied seed word to the exact schedule width and runs the bit program; an invalid call returns the empty word. A paired input supplies the source, seed, and unary depth, scale, and error.
The total evaluator is uniformly polynomial-time, including its guard, numerical schedule, exact seed width, and all payload computations. Every output has length at most \(2^{64}L\). Canonical valid inputs compute exactly the matched Boolean extractor, even when an arbitrary suffix is appended to the padded seed word.
Compile a schedule with depth bounded by 64 and a scale covering its source length; prove equality on the accepted branch. Generate the exact seed width through a bounded numerical-state loop, then use the full scheduled-program certificate. The seed prefix identity proves canonical agreement and independence from the appended suffix.
A unary runtime parameter \(t\) selects \(h=\lceil \log _2(t+1)\rceil +64\). Test the finite conditions of Theorem 593, then run the actual scheduled program with its exact seed prefix. Invalid parameters return the empty word. The paired interface stores the source and seed words, followed by unary \(t,L,e\).
The complete runtime belongs uniformly to \(\mathrm{FP}\), since \(2^h\le 2^{65}(t+1)\) and \(4^h\le (2^{65}(t+1))^2\). On valid canonical inputs it computes exactly the actual matched Boolean extractor, with any trailing seed suffix ignored. The paired evaluator’s output has length at most \(2^{65}(|z|+1)^2\) on every input string \(z\).
Bound the rounded power before compiling the schedule. Use the complete numerical-state and payload bounds of the scheduled program, then its exact seed-prefix and Boolean-output identities. No unrestricted variable exponent or unbounded iteration is compiled.
Use the actual depth-24 extractor for \(W\) and \(Q\), and the actual depth-64 extractor \(R\) for refreshing from the original right source \(y\). A look-ahead returns \((r_1,r_2)\) from \(s_1=\operatorname {prefix}_d(q)\), \(r_1=W(x,s_1)\), \(s_2=Q(q,r_1)\), \(r_2=W(x,s_2)\). For advice zero, refresh with \(R(y,r_1)\), perform another look-ahead, and return \(R(y,\bar r_2)\); for advice one, use \(r_2\) and \(\bar r_1\). This is Chattopadhyay–Goyal–Li Algorithm 1, with all eight calls explicit.
The single string evaluator is uniformly polynomial-time in all words and unary parameters. If \(e+66\le L\) and \(L\) bounds the ceiling logarithms of both source lengths plus one and of \(2^{64}L+1\), every canonical input computes exactly the vector step for either advice bit. Its output always has at most \(2^{64}L\) bits, including invalid inputs. The complete step estimates and full advice runtime are formalized below.
Compose the exact matched-runtime identities along the three and eight calls. The common scale discharges each local guard. Registered polytime rules prove closure through pairing, slicing, and the two bit-dependent choices. The final refresh supplies the size bound.
Suppose the original law factors into nonnegative left and right kernels given \(Z\), and \(\mu (z)\) bounds each original joint mass of the left source with transcript \(z\). A left message in \(U\) admits the envelope \(\mu '(z,u)=\mu (z)\), of total \(|U|\sum _z\mu (z)\). A right message admits \(\mu '(z,v)=\mu (z)\Pr [V=v\mid z]\), whose total is unchanged when the right kernels have mass one. A left message followed by an adaptive right message pays only the factor \(|U|\). The updated source masses are exactly the original joint message-and-source masses; no positive-probability or per-row entropy premise is required.
Sum the exact transcript-weight times conditional-kernel identity over each source fiber. Refining a nonnegative event can only reduce mass. The opposite side’s conditional message probabilities sum to one.
From the original factored law of \((Z,A,B)\), reveal \(v(Z,B)\) and compute a seed \(s(Z,v(Z,B),A)\). Alternating extraction applies \(E\) to the right source and this seed, retaining \((Z,v(Z,B),A)\). The affine two-call law instead obtains that seed by applying a first extractor to the combined left source and right mask. It retains the whole left state and the first call’s seed and extracted mask.
Let the original factors be probability laws and let \(E\) have threshold \(K\) and nonnegative error \(\varepsilon \), with nonempty seed and output alphabets. Suppose the actual seed is \(\delta \)-close to uniform jointly with \((Z,V)\), and \(\mu (z,v)\ge 0\) bounds the joint right-source masses with that transcript. Then the actual alternating output, with all of \((Z,V,A)\) retained, has distance at most \(\varepsilon +\delta +K\sum _{z,v}\mu (z,v)\) from its actual retained marginal with uniform output. An original source envelope \(\mu (z)\) instead gives \(\varepsilon +\delta +K|V|\sum _z\mu (z)\).
Update the transcript by the right message and swap the two sides of its exact factored law. The envelope identity gives the new source cap. Apply retained extraction; both the next seed and output laws are deterministic images of the original distribution. Only one copy of the incoming seed discrepancy is charged.
Let the first extractor \(E:X\times S\to M\) have threshold \(K\) and error \(\varepsilon \), and the second \(F:Y\times M\to O\) threshold \(L\) and error \(\eta \), both nonnegative. Suppose fixed-mask output transport is an equivalence determined by the extracted mask, the original factors are normalized, the left and right joint source envelopes are nonnegative \(\mu ,\nu \), and the first seed is \(\delta \)-close to uniform jointly with \(Z\). For nonempty seed and output alphabets, the actual two-call law has distance at most
from its actual retained marginal with uniform final output. It retains the complete left state, first seed, and extracted right mask.
Reveal the first seed and its extracted mask. The first actual output is now a function of the left state and this transcript. Project its retained affine guarantee to obtain the next seed bound and apply the alternating transition. The right-message alphabet is exactly \(S\times M\).
From the original law \(w(z)l_z(a)r_z(b)\) compute \(s_1=p(q)\), \(r_1=W(x,s_1)\), \(s_2=Q(q,r_1)\), and \(r_2=W(x,s_2)\), and the same calls on arbitrarily correlated tampered values \(x',q'\). The seed law retains \(z,s_1,s_1',a\) alongside \(s_2\). The output law retains \(z,b,r_1,r_1'\) alongside \(r_2\).
Assume normalized factored sides, nonnegative original joint source envelopes \(\mu (z),\nu (z)\), and initial honest-seed discrepancy \(\delta \) jointly with \(Z\). Let \(W:X\times S\to M\) and \(Q:Q_0\times M\to S\) have thresholds \(K,J\) and nonnegative errors \(\varepsilon ,\eta \). The actual final law differs from its retained marginal with an independent uniform final output by at most
The retained variables determine both initial and both second seeds. No tampered seed is assumed uniform, and no per-transcript entropy bound is required. This formalizes the two-round case of Chattopadhyay–Goyal–Li Lemma 6.5 and Claim 6.6 with explicit losses.
Extract \(r_1\) retaining the full right state. Observe \((s_1,s_1')\) on the right, switch sides, and derive the second honest seed estimate. Observe \((r_1,r_1')\) on the left, then extract the final left output. Exact transcript factorizations and average envelope sums charge the two message alphabets and include null rows without case assumptions.
Push the original factored source law through the concrete three-call look-ahead. Retain \(z\), the full right state, and both honest and tampered first outputs alongside the honest second output.
Suppose \(L\ge 64\), \(e+26\le L\), and \(L\) bounds the ceiling logarithms of \(n+1\) and \(2^{64}L+1\). Under the original normalized factored-source, joint-envelope, and seed-prefix hypotheses of the two-round theorem, the actual matched program has distance at most
Both the honest and tampered inputs may be arbitrarily correlated within each side. No extractor or intermediate-seed guarantee is supplied as a premise.
Identify the direct program pushforward with the generic look-ahead law. Instantiate both extractor calls with the matched depth-24 certificate, including the separate source-log bound for the right state.
For a normalized factored law \(w(z)l_z(a)r_z(b)\) and right coordinate \(q(z,b)\in Q\), there is a normalized replacement kernel on \((B,Q)\). Its \(B\) marginal is unchanged and its \(Q\) marginal is uniform given \(Z\). The full factored replacement has distance exactly \(d((Z,q),(Z,U_Q))\) from the original deterministic lift. The entire original \((Z,A,B)\) law and all source envelopes are preserved. The new \(Q\) coordinate may remain correlated with \(B\). Transferring conditional uniformity through a later deterministic map costs at most twice this repair distance, or once if its retained marginal is unchanged.
Apply finite marginal replacement to each normalized right row, keeping its original right coordinate. Average the exact row distances against \(w\). Deterministic contraction and the triangle inequality give the continuation bounds, including null rows and empty alphabets.
Suppose the whole right state is \(\rho \)-close to uniform jointly with \(Z\), and its initial-seed map sends uniform states to uniform seeds. Under the original left-source envelope \(\mu \), the actual two-round law retaining the original right state and both first outputs has error
No pointwise entropy bound for the approximately uniform state is needed. For the actual matched program, the prefix map is balanced and the bound is \(3\cdot 2^{-e}+2\rho +K(1+D^2)\sum _z\mu (z)+KD^2/C\), where \(K=2^{2^{62}L}\), \(D=2^{2^{24}L}\), and \(C=2^{2^{64}L}\), under the same finite scale conditions as the concrete two-round theorem.
Repair the distinguished state, use envelope \(w(z)/|Q|\) and an exactly uniform initial seed, then apply two-round extraction. Project away the auxiliary repaired coordinate and transfer back at cost \(2\rho \). A Boolean coordinate-splitting equivalence proves prefix uniformity.
The common transcript records \(Z\), both initial right states, and all four honest and tampered look-ahead outputs. The first refresh applies \(R(y,r_1)\), retaining this transcript and the full left state. The second-output refresh applies \(R(y,r_2)\) and additionally retains \(R(y',r_1')\). Both laws are direct images of the original factored law.
Let \(C,D,O\) be the cardinalities of the right state, look-ahead output, and refresh output. Write \(K_W,K_R\) for the first and refresh thresholds, \(\varepsilon _W,\varepsilon _R\) for their errors, and \(\mu _X,\mu _Y\) for original source envelopes. From the original seed error \(\delta \), the first refresh has error at most
If \(E_{\mathrm{LA}}\) is the original two-round bound, the second-output refresh retaining the tampered refresh has error at most \(\varepsilon _R+E_{\mathrm{LA}}+K_RC^2O\sum \mu _Y\). The common transcript admits exact normalized left and right kernels; their original-source envelope totals are \(D^4\sum \mu _X\) and \(C^2\sum \mu _Y\) respectively.
Observe the right state pair, derive the appropriate seed estimate from the actual first call or look-ahead, and alternate back to the right source. Append the remaining left messages using the retained full left state. Exact observation identities give the factorization and envelopes.
Let \(v(Z,A)\in M\) be an arbitrary left-only tampered seed. The actual output \(R(y,W(x,p(q)))\), retaining the full left state, \(Z,v,q,R(y',v)\), and \(W(x,p(q))\), has error at most
Its only seed hypothesis is the original joint error \(\delta \). The retained law has an exact normalized transcript factorization.
Reveal the left leak, extract retaining the whole right state, and reveal the right state and tampered refresh before the final alternating call. Charge each message to its source’s original envelope.
A normalized left-only observation preserves the average original right-seed discrepancy exactly, including zero-mass observations. Let \(v(Z,A)\in M\) be a left-only tampered seed. Refreshing from the actual second look-ahead output, while retaining \(Z,v,q\), both honest look-ahead outputs, \(R(y',v)\), and the full left state, has error at most
All three envelopes and the prefix error \(\delta \) concern the original factored law. This is a finite component of Chattopadhyay–Goyal–Li’s already-distinct-advice analysis.
Reveal \(v\) without changing the average seed error, apply two-round extraction, and observe the right state and tampered refresh before alternating to the original right source. The full left state and original right state reconstruct the retained honest history.
Run the actual honest and tampered look-ahead computations and refresh the original right source using either honest output. Retain the full common history and original left state. The tampered final refresh is unobserved; the two current right states may coincide.
Suppose the honest right state is \(\rho \)-close to uniform given \(Z\), and the initial-seed map sends uniform states to uniform seeds. For either refresh selection, the actual retained law has error at most
Only the original left and right source envelopes are assumed. The law is normalized and factors through the exact common transcript; dropping the left state gives the refreshed seed law over that transcript. This supplies the single-refresh step before advice first differs in Chattopadhyay–Goyal–Li Algorithm 2 and Claim 6.11.
Repair the honest state while preserving the original right-source marginal. Apply the selected-refresh estimate with exact uniform cap \(w(z)/|Q|\) and transfer the complete retained law back at cost \(2\rho \).
Apply the concrete eight-call step to both original source pairs with opposite advice bits. Retain the original transcript, both initial and refreshed states, all eight look-ahead outputs, the tampered final output, and the full original left state. The honest final output and this transcript are a direct image of the original factored source law.
Under the common flip-flop size guard, suppose the original law factors into normalized sides given \(Z\), with original left and right source envelopes \(\mu ,\nu \), and initial prefix error \(\delta \). Let
and set \(\rho =2\varepsilon +\delta +K\sum \mu +JC^2\sum \nu \). For honest advice zero and tampered advice one, the full actual law has distance from its retained marginal with uniform honest output at most
The tampered inputs may be arbitrarily correlated within each side. There is no entropy premise on the initial right state and no supplied intermediate-seed or extractor guarantee. The invariant across advice positions is constructed below.
Derive the first-refresh bound and observe the exact common transcript. Repair the refreshed coordinate while preserving both original sources. Apply the tampered second-output refresh theorem with a uniform repaired state and its balanced prefix. Substitute the exact envelope totals and transport the complete deterministic continuation back at cost \(2\rho \).
Under the common size guard, take normalized original factors with left-source, honest-state, and right-source envelopes \(\mu ,\nu ,\xi \), and original prefix error \(\delta \). With \(K,J,D,C,\varepsilon \) as above, set
The full actual honest-one/tampered-zero law has error at most
retaining both complete histories, the tampered final output, and the original left state. This completes the two opposite-bit orientations of Chattopadhyay–Goyal–Li Algorithm 1 and Lemma 6.8 for these programs.
Bound the honest first refresh while retaining the tampered refresh. Fix that tampered coordinate in the transcript and repair the honest coordinate. The next tampered seed is then left-only, so the fixed-side refresh theorem applies. Charge \(2\rho \) to return to the actual law.
For arbitrary honest and tampered advice bits, record both pairs of right states and all eight short look-ahead outputs. Leave both final outputs unobserved. Each becomes a right-only map after fixing this transcript. The factors condition the original sources successively on the two actual look-ahead histories.
The actual transcript and original sources have an exact factored law, with normalized kernels even at null observations. Both right-only outputs equal their actual advice-bit programs. For opposite bits, appending the tampered final output gives the opposite-advice transcript. Original source envelopes update explicitly, with total masses exactly \(D^8\sum \mu _X\) on the left and \(C^4\sum \mu _Y\) on the right.
Compose the two common-transcript factorizations. Each four-output left message costs \(D^4\) to its envelope, and each right-state pair costs \(C^2\) to its envelope. Opposite-side message probabilities sum to one.
Run both look-aheads and both selected refreshes, assuming the old transcript fixes the tampered right input. Retain the full common look-ahead history, selected tampered refresh, and original left state. Each selection bit chooses its second short output exactly when true.
Under the common size guard, original source envelopes \(\mu ,\xi \), normalized factors, and whole honest-state error \(\rho \) given the old transcript, the actual selected half-step has error at most
All four selection pairs satisfy this bound; no pointwise entropy premise on the current honest state is needed. The complete step and advice-prefix induction below compose these estimates.
Repair the honest state with exact uniform cap, preserving the original right source. The fixed tampered input makes either selected tampered seed left-only. Apply the corresponding first- or second-output refresh theorem and transfer the complete law back at cost \(2\rho \).
Appending the actual final tampered state to the common transcript preserves exact normalized factors of the original sources, including null observations. Its original-source envelope totals are \(D^8\sum \mu _X\) and \(C^5\sum \mu _Y\). The honest output is right-only over those factors. Dropping the full left state gives exactly the honest-state law needed for the next advice bit. For opposite bits, the observed output law is the previously defined opposite-advice law.
Observe one additional right-only \(C\)-valued coordinate. The original left envelope is unchanged in total; the right envelope pays another factor \(C\). Deterministic projection identifies both next-state laws.
Under the common size guard and normalized original factors, suppose the honest state is \(\rho \)-close to uniform given \(Z\). Let the nonnegative original \(X/Y\) envelope totals be \(\alpha ,\beta \). For arbitrary current advice bits and correlated tampered state, the complete actual step, retaining both histories and the full left state but leaving the final tampered output unobserved, has error at most
Only the incoming whole-state discrepancy and original source envelopes are assumed; the intermediate discrepancy is derived.
Apply the selected-refresh theorem twice, using the exact first-history factors and their original-source envelopes for the second pass.
With the same normalized factors, source envelopes, and whole-state discrepancy, either honest bit against its opposite has error at most
This law retains both complete histories, the actual tampered final output, and the full original left state. There is no pointwise cap premise on the incoming honest state or a supplied repaired invariant.
In the zero branch, project the original whole-state guarantee through the balanced prefix map. In the one branch, repair the incoming state while preserving both original source envelopes, apply the capped-state result, and return to the actual retained law at cost \(2\rho \).
Suppose in addition that the old transcript fixes the incoming tampered state. For arbitrary current advice bits, the complete actual step retaining both histories, the tampered final output, and the original left state has error at most
Both refreshes reread the original right source. The second half uses a derived first-refresh guarantee rather than a new independence premise.
Compose the two half-step estimates with complementary selection bits. Observing the first tampered refresh gives envelope factors \(D^4,C^3\); the second application then produces the displayed finite bound.
Initialize the right state from a prefix of \(y\), completed with false bits when short. Fold the actual flip-flop step over the advice bits in their given order, holding \(x,y\) fixed. This is the loop in Chattopadhyay–Goyal–Li Algorithm 2. The present construction additionally applies the depth-24 extractor to \(x\) using the final state’s seed prefix. The encoded runtime stores the sources, unary parameters, remaining advice, and current state explicitly.
One total string program evaluates the complete construction uniformly in both sources, unary parameters, and advice length. Under the common flip-flop size guard it agrees with the vector construction. Every iteration, including those after advice exhaustion, has encoded length at most \(4|x|+2|y|+2L+2e+2|\alpha |+2^{64}L+12\). Polynomial time requires no size or statistical promise. The separate probability induction below tracks this same executed fold.
Induct through the left-to-right fold using exact step correctness. Bound every component of the encoded state and apply bounded-iteration closure. Registered polytime rules compose the loop with the final extraction and total input decoder.
The proof witness records a finite deterministic transcript of the original sample, its exact normalized left and right kernels, and pointwise equality of both current states with the executed programs. It bounds the original-source envelope totals by \(\alpha ,\beta \) and the honest-state discrepancy given the transcript by \(\rho \). Once the advice prefixes differ, the transcript fixes the tampered current state. Normalized original factors, nonnegative source envelopes, and an initial whole-state discrepancy construct the empty-prefix witness. This is internal proof data, not a security premise for the eventual public correlation-breaker theorem.
For \(K,J,D,C,\varepsilon \) as above, put
Set \(\rho _0=\rho \) and \(\rho _{i+1}=\Phi (\rho _i,D^{8i}\alpha ,C^{5i}\beta )\). The common update conservatively covers all three step estimates.
Under the common size guard, an initial invariant extends through any list of paired advice bits. At length \(a\), both current states equal their actual folds, the envelope totals are bounded by \(D^{8a}\alpha ,C^{5a}\beta \), and the whole-state error is at most \(\rho _a\). The separated condition holds if it held initially or the two processed advice words differ. In that phase, the transcript fixes the actual tampered state. Every prefix retains exact factors of the original sample, including null conditional rows.
Before separation use the weak step. At the first unequal pair use opposite-advice extraction, then use full-step preservation thereafter. Appending the actual tampered state gives the next exact factors. Induct from the last paired bit and use the program’s append identity. This follows the two-phase structure of Chattopadhyay–Goyal–Li, Algorithm 2 and Lemma 6.9, with the displayed conservative error update.
The update is monotone and preserves nonnegative inputs. For \(\rho _0=0\) and nonnegative \(\alpha ,\beta \),
Write \(d=2^{24}L\) and \(c=2^{64}L\). If \(\alpha \le 2^{-k_X}\), \(\beta \le 2^{-k_Y}\) and
then \(\rho _a+\varepsilon +KD^{8a+1}\alpha \le (24a4^a+2)2^{-e}\). Equal reserves \(k_X=k_Y=2^{150}(a+1)L\) suffice when \(e\le L\). Choosing \(e=t+2a+\lceil \log _2(a+1)\rceil +10\) bounds this expression by \(2^{-t}\). This is finite arithmetic for the recurrence and the extra final left extraction; it does not assume a program-security witness.
Bound the left and right coefficients by \(6D^7\) and \(3C^5\) and use the final-depth envelope powers throughout the factor-four recurrence. Each reserve term is at most \(\varepsilon \). The logarithmic rounding in \(e\) absorbs \(24a4^a+2\), including the zero-length case.
For left input length \(n\), advice length \(a\), target exponent \(t\), and requested output \(o\), set
The total chooser uses \(m\) both as source entropy reserve and intended right-source length. Capacity \(m\le n\) remains an explicit condition.
With \(d=2^{24}L\) and \(c=2^{64}L\), the chosen parameters satisfy the common program guard, \(e\le L\), \(c\le m\), \(o\le d\), and all three displayed entropy reserves with \(k_X=k_Y=m\). These facts hold for every natural input. When \(m\le n\), the left reserve also fits in the original input width. Neither this capacity condition nor the required source entropy is asserted for arbitrary \(n\). These constants and the conservative \(4^a\) amplification are our finite deductions, not the sharper parameter bounds of the source construction.
Bound \(\lceil \log _2(2^r(a+1)1024b+1)\rceil \) by \(r+a+b+11\). The chosen scale then covers both source widths and the refreshed state. Apply the checked entropy reserve inequalities from \(e\le L\).
Run both actual advice programs on the original factored sample \((Z,B,A)\). The retained law is \(((Z,B,W'),W)\), where \(W,W'\) are the honest and tampered outputs after the additional final extraction. Thus the whole original right state remains, including both right inputs when these are arbitrary functions of \((Z,B)\). For advice length \(a\) and original left-envelope total \(\alpha \), define
Assume the common size guard, \(c\le m\), normalized factors \(w,l,r\), and nonnegative envelope \(\mu \) satisfying \(w(z)\Pr [x(z,A)=x_0\mid z]\le \mu (z)\). The honest \(m\)-bit right input is uniform on every conditional row. Honest and tampered inputs on each side are arbitrary functions of the same original state; the two sides are independent given \(Z\). For two fixed unequal advice words of the same length \(a\), the actual law \(((Z,B,W'),W)\) is within \(\mathcal E(m,L,e,a,\sum _z\mu (z))\) of its exact retained marginal with a fresh uniform honest output. No intermediate factorization, repaired seed, or security invariant is supplied as a theorem hypothesis.
The initial prefix of the uniform right input gives zero state error. Construct the initial invariant and iterate it through the actual paired advice. Unequal words force the separated phase. Apply the extra final left-source extraction while retaining the full original right state and actual tampered output, then substitute the finite recurrence bound.
Under the preceding source, advice, and size hypotheses, set \(e=t+2a+\lceil \log _2(a+1)\rceil +10\). If
the actual complete program has retained-law error at most \(2^{-t}\). The finite program guard uses this chosen local error exponent.
Conditional uniformity gives original right-envelope total \(2^{-m}\). Apply the three checked reserves and the conservative dyadic error budget.
Return the first \(o\) coordinates of each actual output, completing positions beyond the full width \(d\) by false. Retain the original \((Z,B)\) and the truncated tampered output. This is a total definition for all widths; the uniformity guarantee below concerns \(o\le d\).
For \(o\le d\), the prefix of a uniform full output is uniform on \(o\) bits. Simultaneously truncating honest and tampered outputs cannot increase the distance to the actual retained marginal times a uniform honest output. The raw finite-weight comparison requires no new source assumptions, and normalized input factors give a normalized truncated law.
Split uniform Boolean words into prefix and suffix coordinates. Apply deterministic contraction first to the honest output and then to the tampered coordinate in the retained tag.
Choose \(e,L,m\) from \(n,a,t,o\) as above. Let the original law have normalized left and right factors given \(Z\), with a nonnegative honest-left joint point-mass envelope \(\mu \) of total at most \(2^{-m}\). Suppose the honest right input is conditionally uniform on \(m\) bits. For any two fixed unequal advice words of length \(a\), the actual \(o\)-bit truncated program output has error at most \(2^{-t}\), retaining the original \((Z,B)\) and the actual truncated tampered output. No size guard, reserve inequality, field instance, primitive extractor, or intermediate security witness is supplied by the caller. The source hypotheses govern feasibility; the theorem does not assert the reserve fits every left-input width. The selected runtime is certified below; later asymptotic family composition remains separate.
Discharge the dyadic theorem’s program guards, state width, and entropy reserves with the total chooser. Apply the exact prefix contraction at the chooser’s proved output-width bound.
Decode \(\operatorname {pair}(\operatorname {pair}(x,y), \operatorname {pair}(\alpha ,\operatorname {pair}(t_{\rm word},o_{\rm word})))\). The last two word lengths are the target and output parameters. Compute the selected \(e,L,m\), normalize \(y\) to its first \(m\) bits with false completion, then execute the actual advice program and return its requested output prefix. Zero requested width returns immediately.
This one string function is uniformly polynomial-time in both source words, advice, and unary target/output requests. Its output length is exactly the decoded request, even for malformed pairs. On canonical \(n\)-bit left and selected \(m\)-bit right words it equals the serialized selected truncated correlation breaker, with no statistical hypothesis. At every iteration the complete encoding has length at most
Compile the total arithmetic chooser and right-word normalization. Apply the bounded complete advice runtime and the output-prefix certificate. Canonical word lengths identify the same parameters and semantic program as the selected statistical theorem.
Keep the original normalized factored source, left envelope, size guards, and unequal equal-length advice hypotheses. Replace exact right-input uniformity by distance at most \(\rho \) from uniform jointly with \(Z\). The actual complete program has error at most \(\rho +\mathcal E(a,\sum _z\mu (z))\), and at most \(\rho +2^{-t}\) under the dyadic reserves. It retains the original \(Z\), full right state, and actual tampered final output.
Construct a uniform right-coordinate repair preserving the original right marginal on every row, including null transcript rows. The original left kernel and tampered program are unchanged. Project away the repaired coordinate after applying the exact-uniform theorem. The actual retained marginal is equal before and after repair, so the transfer charges \(\rho \) only once.
Observe a right-side message \(V\). Feed the original right-side source and the resulting left-side seed to the actual advice program. Retain the observation, original tag, complete original left state, and actual tampered output.
Suppose the original source law factors given \(Z\) and all factors are normalized. A nonnegative joint envelope \(\mu \) for the right-side honest source becomes an envelope of total \(|V|\sum _z\mu (z)\) after the observation. Under the advice program’s finite dyadic guards and reserves, and actual alternating-seed discrepancy at most \(\rho \), the retained output has error at most \(\rho +2^{-t}\). The preceding seed estimate remains a premise of this local composition theorem.
Condition the original right factor on its observed message, preserving normalized null-row kernels. Swap the factored source roles and apply the preceding perturbed-right-input theorem with the exact observed envelope.
Follow the three-stage first phase of Chattopadhyay–Liao, Theorem 6.1, https://arxiv.org/abs/2110.12652. On the same masked source \(X=A+B\), first extract linearly with a prefix of the right input, run the actual advice breaker with the source/seed roles reversed, and extract linearly again using its output. Index the honest execution by \(\mathsf{none}\) and the \(t\) tampered executions by \(\mathsf{some}(i)\). The transcript records all initial prefixes and mask contributions, all first extraction outputs, then all advice outputs. It retains the original latent variables in its factored representation. These total definitions alone assert no statistical guarantee.
Let the original law have normalized factors given \(Z\), a nonnegative honest-left joint envelope \(\mu \), and a conditionally uniform honest right word of length \(d\). Assume
The honest seed prefix is uniform. The actual first masked extraction, retaining \(Z\) and every honest/tampered initial prefix and mask contribution, has distance from uniform at most
No intermediate seed certificate is a premise.
A sufficiently long uniform word has a balanced prefix. Apply the actual depth-64 affine extraction theorem while retaining the entire original right state. Project this state onto the complete first right message and use the exact fixed-seed XOR identity.
For normalized original factors, each of the three observations has an exact factorization retaining the original left and right states. All conditional kernels are normalized, including null rows. The actual first and final extraction outputs are the XOR of their corresponding side-local contributions. Write \(d_0=2^{24}L_0\), \(r_0=2^{64}L_0\), and \(d_1=2^{24}L_1\). Nonnegative original source envelopes \(\mu ,\xi \) become envelopes with exact totals
respectively. These exact execution and counting identities feed the complete pairwise first-phase guarantee below; the subsequent subset-doubling construction remains separate.
Alternate the existing right-, left-, and right-observation identities on the original factors. Opposite-side observations preserve envelope totals; own-side observations copy the envelope across the message alphabet. There are \((2^w)^{t+1}\) families of \(w\)-bit words, and the first right message has alphabet size \((2^{d_0+r_0})^{t+1}\). The matched extractor’s exact XOR law identifies every side-local formula with the actual program.
For one tampered index \(i\), the second-seed law retains the first right message, complete original left state, and tampered advice output. The final pair laws retain the entire executed transcript, original right state, and corresponding tampered final value. One law contains the original-left extraction contributions; the other contains the actual masked program outputs. Set \(r_0=2^{64}L_0\), \(r=2^hL_1\), \(F=2^{2h+14}L_1\), and \(M=\sum \mu \). Their complete error budget is
where \(e_1^*\) is the requested error exponent of the advice call, whose internal exponent is selected by its checked error schedule.
Suppose the original factors are normalized, the honest right word is conditionally uniform, and a nonnegative original-left envelope has total \(M\). For one tampering with unequal advice of the same length, assume the finite advice guards and original-right entropy reserve after all first right messages. The actual second-seed law has error at most \(2^{-e_0}+2^{2^{142}L_0}M+2^{-e_1^*}\). No intermediate seed certificate is supplied.
Identify the actual advice call after the right observation, apply the original-input first-seed bound, and use the perturbed-seed advice theorem with the reversed source roles. The observation’s full alphabet cost is discharged by the explicit source reserve.
Under the growing-depth budget, if the actual second-seed pair has error \(\delta \), both final pair laws have error at most \(2^{-e_r}+\delta +2^{F+r+(t+1)r_0}M\). The estimate retains the complete executed transcript and original right state, as well as the indicated tampered final value.
The original-left envelope pays for the first-output family. Two-sided merging pays for one tampered final output. Source linearity identifies the masked output with a right-state-dependent XOR translation, preserving the corresponding uniform target exactly.
From the original normalized factors, a conditionally uniform honest right input, original-left envelope, fixed unequal equal-length advice, and the displayed finite component guards and reserves, both actual final pair laws satisfy the complete error budget above. This proves the pairwise first phase of Chattopadhyay–Liao Theorem 6.1, printed p.23. Joint security against larger tampering subsets still requires the later doubling rounds.
Compose the proved first-seed, advice-generated second-seed, and final extraction estimates. Rewrite the exact alphabet sizes as binary exponents. Every security premise concerns the original source.
Set all three local error targets to \(e+3\). If \(M\le 2^{-k}\) and
then the complete first-phase error is at most \(2^{-e}\). These are conservative finite sufficient reserves; a nonvacuous application still needs an original source meeting the mass bound.
Each of the three local errors and two source-mass contributions is at most \(2^{-(e+3)}\). Their sum is bounded by \(2^{-e}\).
For source width \(n\), tampering count \(t\), advice length \(a\), and target error exponent \(s\), set
Use \(h=\lceil \log _2(t+1)\rceil +64\), local target \(e=s+3\), and
The advice call uses its checked internal error schedule for target \(e\). These explicit conservative choices do not assert the paper’s sharp constants or universal capacity \(k\le n\).
Every numerical guard of the initial extraction, advice call, and final extraction holds for the chosen parameters. The right width contains the initial seed prefix and pays the complete first right-message family plus advice reserve. The chosen left entropy pays both dyadic source charges. All six chooser values have total uniform polynomial-time unary generators, without a source-capacity or guard promise. The finite bound \(k\le 2^{256}(t+1)^2(a+1)B^2\) can be used to discharge source capacity in concrete applications.
Bound the logarithms of the polynomially enlarged widths in terms of \(B\), then use the fixed scale factors to discharge the guards. The two left reserves are summands of \(k\). The logarithmic depth has polynomially bounded powers, so registered unary arithmetic computes every chosen value on all inputs.
Use the named chooser at \((n,t,a,s)\). Suppose the original law has normalized factors given \(Z\), the honest right word is conditionally uniform at the selected width \(d\), and the original-left envelope has total at most \(2^{-k}\). For any selected tampered index whose fixed advice and the honest advice both have length \(a\) and differ, both actual final pair laws have distance at most \(2^{-s}\) from their actual retained marginal times uniform output. No numerical guard, intermediate seed estimate, or repaired source is a premise. The original source still must satisfy the chosen entropy bound; capacity is not claimed for every \(n\).
Instantiate the complete original-input estimate with every proved chooser guard. The two explicit source reserves and three local target exponents give the finite dyadic error bound.
False-complete the first seed prefix, perform the first depth-64 extraction, run the actual advice program with reversed input roles, and feed its output to the growing-depth final extraction on the same supplied source word. The paired evaluator reads three data words and six unary numerical words. Each component keeps its total behavior on invalid inputs.
The runtime and its single paired evaluator belong uniformly to \(\mathrm{FP}\) on every string. Under the three component guards, canonical words compute exactly the semantic first-phase output at \(h=\lceil \log _2(t+1)\rceil +64\), with no statistical premise. The paired output length is at most \(2^{65}(|z|+1)^2\). Its exact output width is \(2^hL_1\) when the final growing guard holds, and zero otherwise.
Compose the three registered runtime certificates and exact output equations. Both supplied input words remain available throughout. Prefix padding agrees with the semantic seed even for short words, and the growing final call supplies the unconditional output bound.
Derive \(n\) and \(a\) from the supplied source and advice word lengths. With unary \(t,s\), compute the complete chooser, truncate or false-complete the right word to its chosen width \(d\), and run all three actual calls. The paired input stores source, right, and advice words followed by the two unary parameter words. No source-entropy or capacity test is performed.
The single paired evaluator belongs to \(\mathrm{FP}\) on every encoded string, including malformed data and infeasible entropy requests. Its output always has the chosen length \(2^hL_1\). Canonical source and right-input words compute exactly the selected semantic first phase, with no numerical guard or source premise. Statistical security remains the separate original-source theorem above.
Compose the total unary chooser certificates, right-word padding, and full runtime certificate. The finite chooser discharges each canonical correctness guard and the final output-length guard.
Balanced output projections and transcript-dependent output bijections preserve or contract distance from the actual retained marginal times uniform. In an original factored law, observing an independent opposite side leaves the averaged discrepancy exactly unchanged. The equality requires nonnegative transcript weights and normalized opposite kernels; it includes zero-mass observations.
Push forward both the actual law and its conditional-uniform comparison. For the opposite-side observation, sum its normalized message law on each original transcript row.
Read all left seeds and right source copies from the original factored sample. Apply the same extractor to each pair, retaining the original transcript, every executed left seed, and the tampered outputs indexed by \(S\), alongside the honest output.
For normalized original factors, a threshold-\(K\) strong extractor of nonnegative error \(\varepsilon \) and nonempty seed/output alphabets, suppose the honest left seed has error \(\delta \) against its copies in \(S\). If a nonnegative joint envelope \(\mu (z)\) bounds the original honest right source, the actual call has error at most \(\varepsilon +\delta +K|\mathrm{Out}|^{|S|}\sum _z\mu (z)\). The law is exactly the observed seed law after all executed left seeds are fixed, so it supplies the next alternating call.
Regard the selected tampered outputs as left-dependent finite leakage after swapping the two original factors. Sum over the original opposite state to identify the next observed law.
Let the original left state determine \(X,X_1,\ldots ,X_t\) and an actual prefix \(Q\). The right state determines its seed family after \((Z,Q)\) is fixed. The source comparison retains \((Z,X_T)\); the seed comparison retains \((Z,Q,Y_S)\). The extraction law is the direct original-law image retaining \((Z,Q)\), complete original right state \(B\), and all actual tampered outputs in \(S\cup T\).
With normalized original factors and a threshold-\(K\) strong extractor of nonnegative error \(\varepsilon \) and nonempty seed/output alphabets, source discrepancy \(\rho \) and actual prefix-conditioned seed discrepancy \(\delta \) imply error at most
The subsets may overlap. No conditional point-mass cap or repaired-source witness is required.
Use \(X_T\) as the original left observation and the outputs on \(S\) as leakage in smooth merging. Retain the stored \(S\) output on overlaps; reconstruct the remaining \(T\) outputs from \(X_T\) and the full right state. This deterministic projection introduces no additional error.
Starting with a long row, use its short prefix to extract from the original right word, use that seed to extract a short row, reread the original right word with this short row, then extract the next long row from the unchanged original affine input \(X=A\mathbin {\oplus }B\). The proof tracks its left contribution and right mask separately. All calls are actual matched extractors. The transcript observes right prefix masks, actual prefixes, the first right seeds and short-row mask contributions, actual short rows, then the second right seeds. This is the round in Chattopadhyay–Liao, Theorem 6.1, printed pp.23–25.
For normalized original factors, each stage is exactly the original joint law with its actual observations appended. Both original latent states survive in the conditional kernels, which are normalized even on null rows. Linearity identifies the short and final actual rows with the XOR of their original-left and original-right contributions.
Alternate deterministic right and left observations. False-completed prefixes preserve XOR, as do the fixed-seed matched extractors.
If \(C\) is the cardinality of the entire honest/tampered short-message family, original nonnegative joint source envelopes with totals \(\alpha ,\beta \) acquire final totals \(C^2\alpha ,C^4\beta \). Before the final right extraction its envelope total is \(C^3\beta \). Opposite-side observations preserve totals exactly; observations of the source side pay the corresponding finite message alphabet.
Apply the exact conditional-kernel point-mass identities at every observation. Sum normalized opposite messages, including zero-mass rows.
Each law reads only actual original inputs and executed calls. The final left and masked output laws retain the complete transcript, original right state, and selected tampered outputs. Intermediate seed laws are the exact conditional marginals needed by the next call; no security property or replacement-source witness is a definition.
Under the relevant finite matched-extractor guards, the old-row discrepancy controls the actual first right seed. Smooth merging combines the two selected subsets in the actual short row. The second right extraction uses that exact seed-input law and the original-right envelope. The last call rereads the original affine input; its left contribution is bounded using the original-left envelope. Masking with retained right contributions and taking the next-left marginal add no error. These individual implications compose in the theorem below.
Observe right prefix masks without changing the averaged old-left discrepancy, then use balanced prefix transport and alternating extraction. Apply smooth independence merging to the original actual prefix, append the complete right messages, and use fibrewise XOR. Recover a final seed by the next alternating call and finish with source-envelope extraction, retaining the executed transcript throughout.
Put \(c=2^{24}L\), \(m=2^hL\), \(k_{24}=2^{62}L\), and \(k_h=2^{2h+14}L\). For \(s=|S|\), \(u=|S\cup T|\) and original source envelope totals \(\alpha ,\beta \), define
Let the original sources have normalized factors given \(Z\) and nonnegative joint point-mass envelopes of totals \(\alpha ,\beta \). Assume \(c\le m\), the three input log-lengths are at most \(L\), \(64\le L\), \(e+26\le L\), \(e+h+2\le L\), and
If the old honest left row has discrepancies \(\rho _S,\rho _T\) against the respective tampered subsets, the actual next output has error at most \(\mathcal E\), retaining the complete executed transcript, full original right state, and all actual outputs in \(S\cup T\). The same bound holds for original-left contributions and for the new conditional left-row law. The sets may overlap. No intermediate seed, repaired source, primitive extractor, or security witness is supplied.
Compose all four preceding actual-law implications and substitute the exact original-source envelope totals. Deterministic marginal projection exposes the next left-row invariant.
If \(\alpha \le 2^{-k_x}\), \(\beta \le 2^{-k_y}\) and
then \(\mathcal E\le \rho _S+\rho _T+8\cdot 2^{-e}\). The reserve assumptions are explicit finite inequalities, not an asserted global iteration schedule.
Each source or old-row charge is at most one local error. Add these four charges to the four actual extractor errors.
If \(|U|\le 2k\), there exist disjoint \(S,T\subseteq U\) with \(S\cup T=U\) and \(|S|,|T|\le k\), including \(k=0\). This supplies the finite combinatorial split for a doubling update; it does not itself iterate the probabilistic invariant.
Choose a subset of size \(\min (k,|U|)\) and take its complement in \(U\).
Decode \(\operatorname {pair}(\operatorname {pair}(x,\operatorname {pair}(y,w)), \operatorname {pair}(t_{\rm word}, \operatorname {pair}(L_{\rm word},e_{\rm word})))\). The three parameter-word lengths specify \(t,L,e\). False-complete the old row’s short prefix and execute the four component string programs, rereading the original source words. The final depth is \(h=\lceil \log _2(t+1)\rceil +64\).
The single evaluator is uniformly polynomial-time on all encoded inputs, including malformed strings and invalid parameters. Its output length is at most \(2^{65}(|z|+1)^2\). Under the component guards, canonical source and row words produce exactly the serialized semantic round. Neither polynomial time nor this equality assumes source entropy or statistical independence.
Compose the registered component certificates and prefix operation. Each short word is bounded by \(c\), while the growing final call supplies the unconditional quadratic bound and canonical semantic identity.
At every tuple selected by the existing first-phase chooser, the right source and complete long row satisfy the short-call guards. The round runtime therefore agrees with its canonical semantic program without additional numerical premises. This theorem concerns execution widths; it does not supply the successive statistical reserves for full iteration.
Apply the finite chooser bounds to the component log-length and growing-seed budgets, then use the checked four-call runtime identity.
An actual state consists of the transcript weight, normalized-factor candidates, unchanged original source maps, and left/right row contributions. It carries no extraction certificate. Each transition executes the five observations of one round and lifts the original source maps along the old-transcript projection. The invariant at capacity \(k\) and error \(\rho \) bounds the honest left row’s discrepancy from uniform while retaining every subset of at most \(k\) tampered rows.
Suppose \(t{\gt}0\), every tampered advice word has the honest advice length and differs from it, and the original-source hypotheses of the first phase hold. Its actual left-row law obeys the same first-phase error bound against every set \(S\) with \(|S|\le 1\), including the empty set.
Choose an index \(i\) with \(S\subseteq \{ i\} \). Drop the retained right state from the pairwise law and map its tampered output into the \(S\)-indexed family. Contraction of discrepancy gives the bound. The positive tampering count supplies an index when \(S\) is empty.
Under the original normalized-factor hypotheses, source envelopes, execution guards, and the four finite reserves with subset cardinalities bounded by \(t\), an invariant of capacity \(k\) and error \(\rho \) implies the actual next-state invariant of capacity \(2k\) and error \(2\rho +8\cdot 2^{-e}\).
Split every requested set of size at most \(2k\) into two sets of size at most \(k\). Apply the actual round union bound and the uniform finite reserves, then identify the next conditional left-row law.
Every iterated state has normalized factors, including null rows, and its factored law is the pushforward of the original law along the actual transcript. The XOR of its row contributions equals the actual deterministic row iteration, reading the same original source words. Original source envelopes persist; after \(i\) rounds their total masses are exactly \(C^{2i}\sum \mu \) and \(C^{4i}\sum \nu \), respectively, where \(C\) is the full short-message alphabet cardinality.
Induct on the number of executed rounds, using exact one-round factorization, pointwise execution identities, and envelope transport.
Initializing with the actual first-phase factors gives normalized kernels, the exact first-phase left-row law, and the original source envelopes with their exact transcript losses. Every subsequent factored law is the image of the original source law along the executed complete transcript. Each actual masked output is the complete affine program on its original source, its specified right word, and its advice.
Package the three first-phase observation stages and apply their factorization and envelope theorems. Compose this image with the actual round iteration. Pointwise XOR identities identify every retained output before applying the resulting exact law identity.
From an initial invariant of capacity \(k\) and error \(\rho _0\), original source envelopes, and scalar reserves for every round, the actual state after \(i\) rounds has capacity \(2^ik\) and error \(\rho _i=2^i\rho _0+8(2^i-1)2^{-e}\). The same error bounds the actual XOR outputs while retaining the complete executed transcript, the original right state, and any subset of at most \(2^ik\) tampered outputs.
Induct with the doubling theorem, obtaining each round’s envelopes from the original ones and the exact mass identities. Append the conditionally independent right state without changing the discrepancy. The honest right mask is a fiberwise XOR bijection, and masking the retained tampered outputs only processes the retained coordinates.
Set \(R=\lceil \log _2(t+1)\rceil \) and \(\sigma =\mathrm{target}+R+1\). Evaluate the unchanged first-phase chooser at \(\sigma \), writing its widths as \(L_0,L,D\), its original-left entropy reserve as \(\kappa \), and its local error exponent as \(e=\sigma +3\). The original-left reserve for the complete construction is \(2\kappa \). Write \(m_0=2^{64}L_0\), \(c_0=2^{24}L_0\), and \(c=2^{24}L\). The initial transcript losses are \(A_x=(t+1)m_0\) and \(A_y=(t+1)(c_0+m_0+c)\); one short-message family costs \(M=(t+1)c\) bits. The remaining source entropies before round \(i\) are \(2\kappa -A_x-2iM\) and \(D-A_y-4iM\).
The remaining entropies are nonnegative through all \(R\) rounds. At every \(i{\lt}R\) they satisfy all four worst-case reserves from the actual doubling theorem. Exact dyadic identities give the propagated masses after the initial transcript and all prior round messages. The error recurrence satisfies
Moreover, if \(B\) is the first-phase chooser base at \(\sigma \), then \(2\kappa \le 2^{257}(t+1)^2(a+1)B^2\). These finite bounds do not assume that every input length can support this entropy.
The sixty-four spare depth levels pay the retained long outputs and repeated short messages. The original right width has an additional base factor paying its complete observation budget. Subtract only earlier observations to obtain each current round’s reserves. The doubled original-left budget also pays initialization. Expanding the geometric error recurrence and using \(e=\sigma +3\) gives the final bound.
Execute the actual first phase and then the actual four-call round repeatedly, always on the same original source words. The selected construction runs \(R=\lceil \log _2(t+1)\rceil \) rounds and uses the first-phase chooser at target \(\sigma =\mathrm{target}+R+1\). Its retained law is the direct image of the original factored source law, keeping the original tag, full right state, and selected tampered outputs alongside the honest output. The selected string evaluator computes these parameters and normalizes the original right word before running the construction.
A unary number of actual rounds has one total uniform \(\mathrm{FP}\) evaluator. The selected complete evaluator agrees exactly with the serialized semantic construction, with all execution guards discharged. Its output length is \(2^hL\), where \(h=\lceil \log _2(t+1)\rceil +64\) and \(L\) is the selected scale. Polynomial time holds on all strings and imposes no statistical or source-feasibility premise.
Encode the immutable context \(c\) containing both original sources and all unary round parameters, and pair it with the evolving row. Every complete state has length at most \(2|c|+2+|w_0|+2^{65}(t+1)L\), including the initial state and invalid parameters. This bound supplies polynomial-time iteration. Compose with the actual first phase and unary parameter computation; canonical agreement follows by induction using the one-round execution identity.
Let \(t{\gt}0\) and use the selected finite parameters. Suppose the original tag and two conditional factors are normalized, the honest right word is uniform at every original tag, and the original left-word joint masses have a nonnegative envelope \(\mu \) with \(\sum _z\mu (z)\le 2^{-2\kappa }\). Let all advice words have length \(a\), with every tampered advice different from the honest advice. Then the actual honest output is within \(2^{-\mathrm{target}}\) of uniform while retaining the original tag, the full original right state, and every actual tampered output. The same bound holds for every subset of the tamperings. All calls use the same original affine input, and the theorem requires no intermediate seed, row-invariant, or numerical-guard hypothesis.
The actual first phase initializes capacity one at error \(2^{-\sigma }\). Its exact transcript envelopes and the chosen finite reserves supply the actual induction through \(R\) rounds. Since \(t\le 2^R\), its final invariant covers every tampering set, and the chosen error recurrence is at most \(2^{-\mathrm{target}}\). Append the original right state, apply the known XOR masks, identify the complete executed program, and discard only the intermediate transcript by contraction.
Write \(F\) for the complete selected affine construction, with seed width \(d\), source reserve \(k\), and error \(2^{-q}\). Fix advice \(\alpha _0,\ldots ,\alpha _t\) and deterministic source observations \(L_0,\ldots ,L_t\) of width \(d\). The actual leaky law retains all \(F(A+b,y_i\oplus L_i(A),\alpha _i)\) for \(i{\gt}0\), together with the honest output \(F(A+b,y\oplus L_0(A),\alpha _0)\). An honest seed is bad at threshold \(\gamma \) if some shift and tampered seed tuple give conditional-uniformity distance greater than \(\gamma \). The complete leakage reserve is \(k+(t+1)d\).
Suppose \(t{\gt}0\), \(\gamma {\gt}0\), the original source is normalized with point masses at most \(2^{-(k+(t+1)d)}\), and all advice has length \(a\), with the honest advice distinct from every tampered advice. For every shift and tampered-seed tuple chosen as functions of the honest base seed, the average actual leaky-output distance is at most \(2^{-q}\). Consequently the bad-seed fraction is at most \(2^{-q}/\gamma \). The full leakage reserve is at most \(2^{258}(t+1)^2(a+1)B^3\), for the boosted common parameter base \(B\).
Following Chattopadhyay–Liao, Lemma 5.3, reveal the complete tuple of leakage observations. The conditional source kernel and the uniform base seed give an exact factorization, including zero-mass transcripts. Its joint source envelope sums to at most \(2^{-k}\). XOR with each fixed honest leakage word preserves uniformity, so the actual affine theorem applies. Forgetting the leakage tag gives the exact base-seed average. Choose adversarial witnesses separately at each bad seed and bound their number by the nonnegative average.
Let the selected sampler maps be linear in the original source. Fix a second summand \(b\) and any coordinate of the affine output. If the honest sampler value at \(b\) escapes the actual bad set, the absolute sign bias of the complete selected component parity is at most \(2\gamma \). The actual selected construction supplies both this estimate and the preceding bad-set cardinality bound from the original source hypotheses alone.
A coordinate of a uniform Boolean word is uniform. Its sign has zero mean even after multiplication by any bounded statistic of the retained tampered outputs. Twice total variation bounds the remaining expectation. Use the product of tampered signs as that statistic. Source linearity identifies all leaky calls with their actual sampler calls, as in Chattopadhyay–Liao, Lemma 5.4, equation (5).
At each outer coordinate, XOR all component bits obtained by applying the correlation breaker to the same original source, the sampler’s candidate seed, and the candidate advice. This is a deterministic map; statistical and runtime guarantees are separate statements.
For every finite outer-coordinate set and every weighted input law, the absolute bias of the reduction’s sign product equals that of the full component-call sign product. This includes zero candidates and the empty coordinate set.
With true represented by \(+1\), XOR of \(C\) bits contributes the product of their signs times \((-1)^{C+1}\). The resulting constant factor has absolute value one for every outer parity.
Set \(b=2^{24}L\) and \(h=\lceil \log _2(d+1)\rceil +64\). For an outer word of width \(8b\) and candidate word of width \(s=\mathrm{gammaBlockSeedBudget}(b)\), use the actual padded Gamma output as the seed of the actual growing matched extractor at error \(1/16\). Read its first \(d\) bits, completing with false bits if needed. Little-endian binary codes enumerate the outer and candidate words; concatenating the codes gives injective advice of length \(8b+s\).
Under \(L{\gt}0\) and the growing-matched and Gamma numerical guards, the actual composition is a somewhere sampler with source threshold \(2^{2^{2h+14}L+1}\), test allowance \(2^{-5b}\), and failure \(1/2\). At every fixed pair of indices it preserves source XOR, without any parameter guard. Its single total evaluator belongs to \(\mathrm{FP}\) and returns exactly \(d\) bits on every input. Under the growing guard it agrees with the semantic sampler; binary reindexing preserves the sampling guarantee.
Truncate the growing matched extractor, convert it to a sampler using one extra source-entropy bit, and apply Gamma’s \(3/4\) neighbor coverage. The exact amplification budget is \(2^{2b}\le 2\cdot 2^{-5b}\cdot 2^{8b}\). Compose the two actual runtimes, truncate and complete their output, and use their uniform certificates.
Fix \(C{\gt}0\), advice length \(a{\gt}0\), target exponent \(q\), and \(\gamma {\gt}0\). Use the same actual affine breaker with \(4C-1\) tamperings for every parity test. For a normalized original source satisfying its complete leakage cap, any source-linear sampler and injective length-\(a\) advice give bad-seed sets of relative size at most \(2^{-q}/\gamma \). Every nonempty parity on at most four outer coordinates has a distinguished coordinate, chosen before the candidate and second summand. If that candidate seed escapes the corresponding bad set, the actual XOR-reduction parity has absolute sign expectation at most \(2\gamma \) at every second-source fixing.
Embed all real calls except the honest call into the \(4C-1\) slots. Fill unused slots with zero leakage and same-length advice obtained by flipping the honest advice’s first bit. Apply the actual leakage theorem with the product of only the real tampered signs as its bounded mask. Linearity and the XOR grouping identity identify the original reduction. No unused output enters its parity.
Set \(N=2^{8b}\), \(C=2^s\), \(a=8b+s\), \(q=54b+s+10\), and \(\gamma =2^{-(17b+10)}\). Let \(d\) be the selected seed width of the fixed affine breaker with \(4C-1\) tamperings. Use the actual enumerated sampler at width \(d\) and the binary advice above, XOR the \(C\) calls at each of the \(N\) outer coordinates, and take their strict majority. The source entropy \(k\) is the maximum of the actual affine leakage reserve and the amplified sampler reserve.
For \(L{\gt}0\) and the two numerical sampler guards, the actual finite construction is a flat-source sumset extractor with threshold \(2^k\) and error \(35/72\). No extractor, sampler, affine-security, or parity estimate is a hypothesis.
The exact identity \(N^4 C\, 2^{-q}/\gamma =2^{-5b}\) pays for all small parity tests. Apply the actual sampler and select good coordinates on at least half the second-source fixings. The finite budgets give \(100m^2(2\gamma )\le 1\), \(m{\gt}0\), and \(N-m\le \sqrt m/8\); here \(L{\gt}0\) implies \(b\ge 5\). Apply the checked moment and majority theorem to these actual parities.
Set \(L=\lceil \log _2(n+1)\rceil \). The actual candidate count is \(o(n)\), the complete source entropy \(k(n)\) is \(o(n)\), and both numerical sampler guards eventually hold. Consequently the same fixed finite construction is eventually a sumset extractor at threshold \(2^{k(n)}\) and error \(35/72\), with \(k(n)\le n\) eventually.
Write \(r=\lceil \log _2(L+1)\rceil +1\). The actual candidate seed width is at most \(2^{41}r^3\), the growing depth at most \(2^{42}r^3\), the matched guard overhead at most \(2^{90}r^6\), and the full source entropy at most \(2^{2^{44}r^3}\). A fixed polynomial in \(\log L\) is \(o(L)\); exponentiating a fixed polynomial in the iterated logarithm is \(o(n)\). Transfer Gamma’s eventual guard along \(2^{24}L\to \infty \). The full candidate count is retained throughout.
The runtime takes unary scale and enumeration counts and executes the actual sampler and affine calls, then XOR and majority. The length-indexed evaluator uses \(L=\lceil \log _2(n+1)\rceil \), the exact outer count, and candidate count \(\min (C,n+1)\). Its Boolean family is the unique output bit. XOR with a fresh first input bit gives the balanced hard evaluator, family, and accepted language.
Both evaluators belong to \(\mathrm{FP}\) and compute their stated Boolean families at every length, including zero. The candidate cap is eventually inactive, so the unpadded computed family eventually equals the actual finite extractor with error \(35/72\) and sublinear source entropy. The padded family is exactly balanced at every positive length, and its language belongs to \(P\).
The exact outer count is \((2^{\lceil \log _2(n+1)\rceil })^{2^{27}}\), so unary computation of rounded powers and fixed powers supplies its polynomial-time bound. Capped powers supply the candidate count on every input. Compose the certified runtimes over both bounded loops; source linearity and the canonical execution equations identify every actual call. Eventual cap inactivity transfers the statistical theorem to this same evaluator. Apply the checked balanced-padding and decision-function bridges.
The constants are enormous: the polynomial has degree at least \(2^{27}\approx 1.3\cdot 10^{8}\), and the cap is inactive at a positive length only once \(\log _2(n+1)\ge 2^{27}\cdot 70^{3}\approx 4.6\cdot 10^{13}\). Every circuit bound for this family is therefore purely asymptotic, with an implicit threshold above \(2^{4.6\cdot 10^{13}}\).
For every \(\varepsilon {\gt}0\) and all sufficiently large \(n\), every circuit computing the fixed family \(\mathrm{sourceReductionHardFamily}(n)\) has more than \((4-\varepsilon )n\) gates. The basis contains all sixteen binary Boolean operations, repeated input slots and unrestricted fan-out are permitted, and every gate is counted. The family is fixed before \(\varepsilon \), belongs to \(P\), and \(n\) is the full padded input length. No graph, extractor, entropy, or hard-family hypothesis remains. The circuit argument follows Ryan Williams’s September 2026 working note and the author’s circuit-to-read-once compiler; the constructed family uses Chattopadhyay–Liao’s extractor route with the library’s conservative finite parameters.
The dyadic support threshold has binary logarithm exactly \(k(n)=o(n)\). Apply the checked balanced-padding cutwidth theorem at fixed error \(35/72{\lt}1/2\), then shift its eventual statement from the unpadded index to the full input length.
Let \(p\) be the normalized law of \((T,X,S)\) with joint source masses bounded by nonnegative \(\mu (t)\), and let \(E\) be a threshold-\(K\) strong extractor of nonnegative error \(\varepsilon \). If \(d(p,U_2p)\le \delta \), extraction retaining the actual \((T,S)\) marginal has error at most \(\varepsilon +2\delta +K\sum _t\mu (t)\). Comparing instead with the uniformized output law for the independent-seed reference \(U_2p\) costs only \(\varepsilon +\delta +K\sum _t\mu (t)\).
Apply average leakage to the source marginal with a fresh uniform seed. Deterministic contraction transfers to the actual input law at cost \(\delta \). Uniformizing the output contracts distance, so restoring the actual retained marginal costs at most one further \(\delta \).
Every threshold-\(K\) source on \(t+1\) blocks admits a normalized capped head law \(w\) and normalized threshold-\(K\) tail laws \(p_a\) such that \(p(a,z)=w(a)p_a(z)\) for all heads and tails. Conversely these conditions give a block source. More generally, nonnegative coefficients \(c(h,a)\) with row totals equal to a normalized capped head law give a block source by mixing the tail laws within each head row.
Normalize each positive head row. Assign a fixed positive row’s conditional law to zero-mass heads; normalization guarantees such a row exists. Prefix-mass identities transfer every conditional cap. For the converse, sum the tail inequalities with the nonnegative row coefficients.
Sample a latent value \(a\) from a probability law \(w\), and a conditional threshold-\(K\) block-source tail \(Z_a\). Given a deterministic head \(f(a)\) and any normalized threshold-\(K\) head law \(v\), there is a threshold-\(K\) block source \(R\) with head marginal \(v\) such that
No independence between the latent value and its tail is required.
Replace the first marginal of the joint law of \((f(a),a)\), preserving the latent marginal and paying exactly the head distance. Attach the same normalized conditional tail to each latent value. Keeping all tags preserves the distance exactly; projection can only decrease it. The unchanged head distance gives the reverse inequality. The row-mixture criterion proves that the repaired tuple is a block source.
Split a tuple of \(t\) pairs into \(2t\) coordinates, preserving the order first coordinate, second coordinate, then the next pair. With zero-based indexing, pair \(i\) occupies positions \(2i\) and \(2i+1\). This map is an equivalence and introduces no randomness.
Let \(p\) be a threshold-\(2^k\) block source on \(t\) pairs of values in an alphabet of size \(2^m\). If \(s\le m\) and \(m+s+e\le k\), then its split law is within distance \(t2^{-e}\) of a threshold-\(2^s\) source on \(2t\) consecutive blocks. The original pairs can be dependent, with the input entropy bound conditioned on all earlier pairs. This is the finite power-of-two form of Chattopadhyay–Goodman–Liao, Corollary 5.4. The zero-block case is included without an upper bound on \(k\).
Disintegrate the original head pair and its block-source tails. Repair the pair into a two-block source while retaining its original joint cap. Correlated head replacement therefore gives a nearby source that still has the original threshold on all pair blocks. Disintegrate it again, split each conditional tail by induction, and prepend the repaired head coordinates. Deterministic contraction charges at most \(2^{-e}\) for the head repair, and normalized conditional averaging charges at most \((t-1)2^{-e}\) for the remaining pairs. The triangle inequality gives the stated error; the empty tuple case has distance zero.
Under the preceding entropy and alphabet-size conditions, suppose that every fixing of an earlier uniform seed gives a threshold-\(2^k\) source on \(t\) pairs. Splitting the pairs while retaining that seed gives a joint law within \(t2^{-e}\) of a uniform-seed family of threshold-\(2^s\) sources on \(2t\) blocks. The source may depend on the earlier seed, and splitting introduces no fresh seed.
Choose the preceding splitting witness separately in each seed fiber. The seed-preserving deterministic map acts fiberwise, and exact distance averaging gives the same bound on the joint distribution.
Let \(C\) be a weighted strong condenser from threshold \(K_{\rm in}\) to \(K_{\rm out}\) with error \(\varepsilon \), and let \((X_1,\ldots ,X_t)\) be a threshold-\(K_{\rm in}\) block source. For one independent uniform seed \(Y\),
is within distance \(t\varepsilon \) of a uniform-seed family of normalized threshold-\(K_{\rm out}\) block sources. The blocks can be dependent; the seed appears only once. This proves the finite shared-seed conclusion of Chattopadhyay–Goodman–Liao, Lemma 5.5.
Induct on the number of blocks, conditioning on the original head. Correct each conditional tail by the induction hypothesis; averaging and deterministic processing cost at most \(t\varepsilon \). Apply the condenser to the head marginal, and repair the head separately at each seed while retaining its latent value. Exact distance averaging bounds this second change by \(\varepsilon \). The triangle inequality gives \((t+1)\varepsilon \). The empty tuple case has distance zero.
Applying a weighted strong extractor of error \(\varepsilon \) to all \(t\) blocks with the same uniform seed has discrepancy at most \(t\varepsilon \) from independent uniform seed and output tuple on every joint test. The input is a block source at the extractor’s threshold. Seed and output alphabets are nonempty.
Regard the extractor as a condenser at full output cardinality. Its conditional block-source witnesses are exactly uniform on the whole output tuple by full-entropy uniformity. Use the distance-to-test bound.
For positive rate \(u\), apply the actual decoded scheduled condenser to every block of an \(n\)-bit threshold-\(2^k\) block source, using one field seed. Its retained-seed output is within \(t2^{-e}\) of a seed-conditioned threshold-\(2^k\) block source. Both Boolean-vector inputs and arbitrary injective encodings into words of length \(n\) are covered. This is a statistical theorem about the actual component maps; a uniform evaluator for the full multilevel recursion remains a separate construction.
Instantiate shared-seed block condensation with the proved weighted guarantee of the scheduled runtime condenser.
For a source of \(t\) blocks at threshold \(2^{\ell +2e}\), the actual one-shot map can reuse the same pair of independent field seeds on all blocks. The entire tuple of \(t\) outputs of \(\ell \) bits has joint test discrepancy at most \(t2^{-e}\) from uniform, retaining the field-seed pair once. Both fixed-length Boolean-vector inputs and generic injective word encodings are supported, without extra capacity or positivity premises.
Apply shared-seed block extraction to the proved weighted one-shot guarantee. The finite field and output types supply the required nonempty instances.
Given a joint weighting on an earlier seed and a current state, sample one fresh independent uniform seed, apply the specified deterministic step, and retain the ordered pair of seeds with the output. The new seed is independent of the entire old joint law.
Retained-seed steps contract total variation and preserve probability when the fresh seed type is nonempty. On an exact earlier-seed family, the resulting conditional law is the deterministic image in each pair of seed values. Distances over a product seed average the fresh-seed joint distances over earlier seeds. Successive seeded programs equal their deterministic composition with both seeds retained.
Reassociate the seed coordinates by an equivalence and use product cardinality, exact tagged averaging, and deterministic contraction. Composition follows from composition of the finite pushforwards.
Suppose the actual joint law of earlier seeds and \(t\) current blocks is within \(\eta \) of an earlier-seed family of threshold-\(K\) block sources. Let a fresh-seed condenser preserve those blocks at output threshold \(2^k\), with error \(\varepsilon \) and pair-valued output over an alphabet of size \(2^m\). If \(s\le m\) and \(m+s+e\le k\), condensing with one fresh seed shared by all blocks and then splitting gives a threshold-\(2^s\) block-source family at joint error at most \(\eta +t(\varepsilon +2^{-e})\). Both earlier and fresh seeds are retained.
Apply block condensation separately at each earlier seed, averaging its joint fresh-seed error. Split the ideal pair-block family and contract the condenser comparison through the same split map. The preceding approximation contracts through the whole step. Two triangle inequalities add the three errors.
If the current joint law is \(\eta \)-close to a family of \(t\) block sources at an extractor’s threshold, a fresh-seed extractor of error \(\varepsilon \), shared across the blocks, produces a joint law within \(\eta +t\varepsilon \) of uniform on both seed coordinates and the entire output tuple. For normalized actual weights, the same bound holds on every joint test. The earlier and fresh seed types and output alphabet are nonempty.
Full-entropy block-condenser witnesses are uniform on all output tuples. Average their distance bounds over earlier seeds, and use contraction for the preceding joint error. Equal total mass gives the test bound.
Starting from an initial seeded map, run \(h\) levels, each using its own fresh seed to condense all current blocks and split their pair outputs. Block alphabets and seed types can vary with the level. Starting from \(t\) blocks, level \(i\) has \(2^it\) blocks. The recursive extractor starts with a single condensed block and finally applies one shared-seed extractor to every leaf. Every seed is retained exactly once.
Suppose the joint law of the initial seed and output is within \(\eta \) of a uniform-seed family of threshold-\(2^{k_0}\) sources on \(t\) blocks. At each executed level \(i{\lt}h\), let the condenser preserve threshold \(2^{k_i}\) with error \(\varepsilon _i\), let its half-output alphabet have size \(2^{m_i}\), and suppose
The actual recursive map is within
of a retained-seed family of threshold-\(2^{k_h}\) sources on \(2^ht\) blocks. No bound on each individual seed’s error is assumed.
Induct on the number of levels, applying the preceding level theorem to the actual recursive output. Exact seeded composition identifies its output with the next recursive map. The error recurrence is the displayed finite sum. Only hypotheses for the executed levels are used.
The retained seed alphabet has cardinality equal to the initial seed cardinality times the product of the \(h\) fresh-seed cardinalities. Hence power-of-two seed widths add. With one initial block and all initial, local, splitting, and final extraction errors budgeted by \(2^{-E}\), the total bound is \((3\cdot 2^h-1)2^{-E}\). Choosing \(E=e+h+2\) makes this at most \(2^{-e}\).
Induct using product cardinality for the seed formula. Sum the doubled block counts for the local errors, and add the initial and leaf errors. The inequality \(3\cdot 2^h-1\le 4\cdot 2^h\) gives the dyadic budget.
Combine an initial strong condenser, the lossless level condensers satisfying the preceding finite entropy inequalities, and a final strong extractor at threshold \(2^{k_h}\). The actual recursive function is a weighted strong extractor at the initial input threshold, with error at most the sum of the initial bound, the level budgets, and \(2^h\) times the final component bound. In particular, local error exponent \(e+h+2\) gives final error at most \(2^{-e}\). These are finite guarantees for the supplied components; no asymptotic schedule or uniform runtime claim is included in this theorem.
Transport the initial condenser witness to a single-coordinate block source. Apply the recursive guarantee, then final retained-seed block extraction. Exact seeded composition identifies the tested function with the recursive extractor. The finite dyadic budget gives the specialization.
If the initial map and every executed condenser preserve addition for each fixed seed, so does the recursive block map. If the final component also preserves addition, the recursive extractor does too. Only addition structures and the stated component equalities are needed.
Successive splitting is a coordinate rearrangement, so it preserves pointwise addition. Induct through the level maps and compose with the final component equality at each output coordinate.
For depth \(h\), leaf reserve \(Q\), and common error exponent \(E\), set \(k_i=4^{h-i}Q\). Starting from width \(N\), recursively set \(n_{i+1}\) to the actual half-output width of the rate-three condenser on \(n_i\) bits at entropy \(k_i\) and exponent \(E\). Record its actual field seed width \(b_i\). The explicit reserve is \(Q=4096(L+E+1)\).
Write \(T\) for the condenser budget on width \(N\), entropy \(k_0\), and exponent \(E\). If \(k_0\le N\) and \(3(24T)+6E\le 2Q\), then every executed level satisfies \(k_{i+1}\le n_{i+1}\) and \(n_{i+1}+k_{i+1}+E\le k_i\). For \(i\le h\), one has \(k_i\le n_i\le N\), \(b_i\le 24T\), and \(2^in_i\le 2N\). Also \(k_h=Q\) and \(k_i=4k_{i+1}\) for \(i{\lt}h\). When \(Q{\gt}0\), the block count satisfies \(2^i\le k_0\).
Induct on the level, using monotonicity of the condenser budget and the rate-three splitting inequality. The geometric entropy decrease bounds the width and total payload; positivity of \(Q\) bounds the count.
Suppose \(\lceil \log _2(n+1)\rceil \le L\). Set \(Q=4096(L+E+1)\), \(k_0=4^hQ\), and let \(N\) be the full output width of the actual rate-one condenser on \(n\) bits at entropy \(k_0\). Then \(Q{\gt}0\), \(k_0\le N\le 64k_0\), and its next condenser budget satisfies
If also \(h\le L\), then \(3(24T)+6E\le 2Q\).
Bound the logarithm of \(4^hQ+1\) by \(2h+13+\lceil \log _2(L+E+1)\rceil \). The checked rounded field and output-rate bounds give the width and budget estimates. The reserve’s coefficient absorbs the remaining integer slack.
Start with the actual rate-one condenser, run the scheduled rate-three paired condensers for \(h\) levels, and apply the actual one-shot extractor with output length \(\ell \) to all leaves. Its seed consists of one initial field seed, one fresh field seed per level, and one final field-seed pair shared by every leaf. Let \(d\) be the sum of their field bit widths.
If \(\lceil \log _2(n+1)\rceil \le L\) and \(h\le L\), set \(E=e+h+2\) and \(Q=4096(L+E+1)\). The specified map is a weighted strong extractor from \(n\)-bit sources of min-entropy at least \(4^hQ\) to \(2^hL\) bits, with error at most \(2^{-e}\). More generally, the global reserve budget and \(\ell +2E\le Q\) give error \((3\cdot 2^h-1)2^{-E}\) for leaf output length \(\ell \).
Instantiate the finite recursive extraction theorem with the actual initial, internal, and leaf maps. The explicit reserve pays every splitting inequality and the leaf extractor’s entropy requirement. The dyadic error budget gives the stated final error. This follows the recursive method of Chattopadhyay–Goodman–Liao, Theorem 5.6 of Affine Extractors for Almost Logarithmic Entropy (2021), with our coarser factor-four entropy schedule rather than their sharper bound.
The actual retained seed type has cardinality \(2^d\) for all natural parameters. Under \(\lceil \log _2(n+1)\rceil \le L\) and \(h\le L\), with \(Q=4096(L+E+1)\) and leaf output length \(L\), its width satisfies
This is a finite bound on the specified seed type.
Multiply the proved field cardinalities along the actual seed tuple. Bound the initial seed by its input budget, every level seed by the common compressed budget, and the final shared pair by the one-shot estimates. Sum these bounds once per retained seed.
For every fixed complete seed tuple and all natural parameters, the scheduled extractor sends XOR of two Boolean inputs to coordinatewise addition of their outputs in \(\mathbf F_2\). No entropy or error-budget premise is needed for this identity.
Apply recursive additivity to the actual condenser, its serialization into Boolean halves, and the actual one-shot leaf extractor.
Fix natural parameters \(a,e\). At input length \(n\), take \(L=\lceil \log _2(n+1)\rceil \), raw depth \(h=a\lceil \log _2(L+1)\rceil \), \(E=e+h+2\), and \(Q=4096(L+E+1)\). Instantiate the specified extractor with leaf length \(L\), source entropy threshold \(k=4^hQ\), and its actual retained seeds. These family definitions do not truncate the depth at small lengths.
For every fixed \(a,e\), eventually \(h\le L\) and the actual map is a weighted strong extractor at source support threshold \(2^k\) and error \(2^{-e}\). Its entropy threshold satisfies \(k=o(n)\), so eventually \(k\le n\). Its actual seed alphabet has cardinality \(2^d\), with eventually \(d\le 16384L\). At every length its output length \(M\) satisfies
This is the factor-four entropy schedule above, not the sharper near-linear entropy dependence in Chattopadhyay–Goodman–Liao, Theorem 5.6. The quantifiers here fix both \(a\) and \(e\).
Apply the finite schedule and seed bounds once the raw depth fits \(L\). Ceiling-logarithm estimates give the output bounds. Exponential growth dominates every fixed polynomial in the input logarithm, giving sublinear entropy and absorbing the depth-dependent seed terms into \(16384L\).
Store the current width and entropy in unary, with fixed error exponent \(E\). A numerical step computes the actual rate-three output half-width and divides the entropy by four. For arbitrary requested depth \(r\) and error exponent \(e\), the total initializer selects \(h=\min (r,\lceil \log _2(n+1)\rceil )\), \(E=e+h+2\), the explicit leaf reserve, and the actual rate-one initial compressed width.
The exact paired-condenser half-width and initialized schedule parameters have uniform polynomial-time unary computations. The encoded numerical transition computes the prescribed widths and entropies through every scheduled level. Clipping gives \(4^h\le 4(n+1)^2\), so the initializer computes its initial entropy by a bounded-power operation without a circular capacity premise. Its selected width contains that entropy and is at most \(64\) times it, and its reserve pays the global split budget. The initialized numerical loop is polynomial-time uniformly up to any requested level clipped to \(h\).
Compose the unary half-width and bounded arithmetic certificates. Division by four matches the entropy recurrence through depth \(h\). The independent bound on \(4^h\) initializes the entropy; the explicit reserve then bounds every numerical state in the iterated evaluator.
Encode the initial field seed, followed by the fresh level seeds in increasing order, followed by the final condenser seed and hash seed. A prefix through any level and the complete tuple are each equivalent to Boolean words of their exact summed field widths. These semantic equivalences require no field-enumeration instances.
Extending a prefix appends exactly the next fresh field word. The full word is \((\text{prefix}\mathbin {+\! +}\text{condenser}) \mathbin {+\! +}\text{hash}\) and has exactly the specified seed budget \(d\). Decoding each encoding recovers its tuple; encoding a decoded word recovers every word of the prescribed exact length. Zero depth is included.
Induct over the prefix and use the binary-field codec’s exact length and inverse laws. Taking and dropping at those widths recover each adjacent component, including all coefficient zeros.
A runtime state contains the numerical dimensions, block count, concatenated block payload, and unused seed suffix. Initial compression consumes its first seed word. Each later step consumes one fresh seed prefix, applies the actual shared-seed condenser to every block, and keeps its two halves consecutively. The loop executes \(h\) such steps.
The string transition computes the structured state transition and its every iterate. The endpoint has width \(n_h\), entropy \(Q\), and \(2^h\) blocks. For \(Q{\gt}0\) and the global reserve budget, every intermediate encoding has length at most \(18N+2E+|s|+18\), where \(N\) is the initial compressed width and \(s\) is the original seed word. The entire initial compression and payload loop is uniformly polynomial-time when the numerical operands, including initial entropy, have unary certificates.
The exact state codec transfers the one-step computation to iteration. Sum the proved widths of the numerical workspace, unary count, payload, and remaining seeds. The finite schedule bounds these throughout the run, permitting bounded polynomial-time iteration.
On a Boolean input of width \(n\) and a canonical seed prefix through \(i\le h\) followed by any trailing word, the runtime state after \(i\) steps has exactly the prescribed width, entropy, and block count. Its payload is precisely the serialized recursive block tuple, in coordinate order, and its remaining seeds are exactly that trailing word. At \(i=h\) this is the complete semantic leaf tuple with entropy \(Q\). No entropy-budget or field-enumeration premise is required.
Recombining the initial output halves recovers the complete initial condenser word. Induct using the prefix append law and the one-level runtime correctness theorem, keeping the trailing word arbitrary.
Slice a payload into a runtime number of fixed-width blocks, apply the actual one-shot extractor to every block with the same condenser and hash seed words, and concatenate their \(\ell \)-bit outputs in order. The number of blocks is given in unary; short payloads use the existing total fixed-width slicing convention.
For a unary count of length \(t\), the output has exactly \(t\ell \) bits. On concatenated Boolean tuples and canonical field seeds it is exactly the serialized tuple of decoded one-shot outputs, with \(0,1\in \mathbf F_2\) represented by Boolean bits. The program is uniformly polynomial-time in the unary numerical parameters, payload, two seed words, and count, including zero widths and zero blocks.
Fixed-width slicing recovers each supplied block. Apply the one-shot correctness and length theorems, and concatenate the certified outputs over the unary range. The shared-seed statistical application follows Chattopadhyay–Goodman–Liao, Lemma 5.5; this node proves the runtime identity.
Run initial compression and every internal level, then consume the final condenser/hash seed pair and extract all leaves. The total wrapper derives the source length from its actual input word and initializes the clipped schedule. Its single paired interface accepts a source, a flat seed word, unary requested depth, and unary error exponent. All projections and component programs are total on malformed encodings.
The specified bit program emits exactly \(2^h\ell \) bits. Under its positive-reserve and global-budget premises it has a uniform polynomial-time certificate in all certified unary parameters and input words. The total paired evaluator generates parameters satisfying these premises and belongs to \(\mathrm{FP}\) on every input word, without any externally supplied numerical validity certificate. A requested depth already at most \(\lceil \log _2(n+1)\rceil \) is left unchanged.
Compose the total parameter initializer, bounded payload iteration, and final shared-seed leaf program. The initializer supplies the reserve premises internally, and all numerical values have unary certificates.
For every natural parameter choice, Boolean source, and complete semantic seed tuple, the bit program at its canonical seed encoding returns exactly the flattened scheduled extractor output, with each \(\mathbf F_2\) coordinate encoded by its Boolean equality test with \(1\). This identity has no reserve, entropy, or field-enumeration premise.
Exact loop correctness leaves the semantic leaf payload and the final condenser/hash seed words. The seed widths split that suffix exactly, and the leaf-program identity returns precisely the scheduled output.
Supply an \(n\)-bit source and a \(d\)-bit seed to the actual program, where \(d\) is its specified total seed width. Read its output as \(2^h\) successive blocks of \(\ell \) Boolean coordinates. This definition directly runs the bit program and invokes no abstract field enumeration.
Each actual output bit equals the corresponding scheduled semantic coordinate at the decoded seed, and input XOR becomes output XOR for every fixed Boolean seed. The entire uniformly sampled \(d\)-bit seed is retained in the weighted strong-extractor test. Under the global reserve budget and \(\ell +2E\le Q\), the source threshold is \(2^{4^hQ}\) and the error is at most \((3\cdot 2^h-1)2^{-E}\). The explicit reserve specialization of Theorem 727 has error at most \(2^{-e}\). No caller-supplied finite-field instances are required.
Use the exact seed codec and bit-program correctness, then transport the retained-seed guarantee through the seed and output equivalences. The known binary quotient cardinalities supply finite instances internally. Coordinatewise conversion from \(\mathbf F_2\) turns addition into Boolean XOR.
For fixed \(a,e\), read a paired source and flat seed word, compute the raw requested depth from the source’s actual length, and call the total scheduled evaluator. Thus one string function covers all source lengths; its clipped runtime behavior is also specified at the exceptional small lengths.
For each fixed \(a,e\), the single paired source/seed program is in \(\mathrm{FP}\). At every sufficiently large input length it returns exactly the fully serialized polylogarithmic-output extractor, for every Boolean input and every canonically encoded semantic seed. The exact-length seed equivalence covers all words of the stated seed width; this correctness claim is not restricted to a smaller seed subset.
Uniformly compute the raw depth and invoke the certified total evaluator. The eventual depth bound makes clipping inactive; complete program correctness then identifies every output coordinate with the named family.
Increasing the source entropy threshold or keeping an output prefix preserves weighted strong extraction. For nonempty finite seed and output types, adding independent unused seed bits also preserves its error, even when the statistical test inspects those bits. The identity map with any finite seed is a zero-error weighted strong condenser preserving every source cap.
Restrict the source class and pull tests back through output projection. For seed padding, apply the retained-seed identity step to both actual and ideal laws; total variation cannot increase. The unchanged source itself supplies the identity condenser’s conditional witness.
For depth \(h\), reserve \(Q\), and error exponent \(E\), let
Starting at input width \(N\), recursively use the actual rounded paired condenser width at entropy \(k_i\), rate \(u\), and exponent \(E\). The seed length sums one field seed per level and the final one-shot condenser/hash seed pair. Initialization is the identity and needs no bits.
Suppose \(k_0\le N\) and \(T\) bounds the initial explicit condenser budget. The sufficient inequality \(12(u+1)T+4E\le Q\) pays every splitting condition, bounds all payloads by \(2N\), and bounds total seed bits by
With \(M=2^h\ell \), the exact identity \(9M+2^hQ=8k_0\) and inequality \(7k_0\le 8M\) hold for every \(h,Q\).
Induct on the actual widths, using the entropy reserve and the sparse field rounding bounds at each level. Sum the level seed costs and add the final one-shot pair. The output accounting is direct integer algebra.
Apply identity initialization, the specified paired condensers, and the shared one-shot extractor of length \(\ell \) at every leaf. The Boolean interface decodes the entire fixed-length seed word and flattens the \(\mathbf F_2\) outputs in block order.
Under the preceding capacity and reserve inequalities, the actual map is a weighted strong extractor at threshold \(2^{k_0}\) and error \((3\cdot 2^h-1)2^{-E}\). Choosing \(E=e+h+2\) gives error at most \(2^{-e}\). The Boolean statement requires no caller-supplied finite-field instances.
Instantiate the finite recursive composition with the identity condenser and actual paired condensers. The reserve also pays the final one-shot entropy requirement. Transport through the exact seed and output equivalences. This uses the recursive method of Chattopadhyay–Goodman–Liao, Theorem 5.6, with the stated finite schedule.
For target \(b\), set \(L=\lceil \log _2(b+1)\rceil \), \(R=\lceil \log _2(L+1)\rceil \), \(h=\lfloor \log _2 b\rfloor -3R-15\) using natural subtraction, \(E=h+4\), and
The guard is \(3R+15\le \lfloor \log _2 b\rfloor \). Use \(N=8b\) input bits and keep the first \(b\) output bits. Output coverage holds even when the guard fails.
Under the guard, \(k_0\le 2b\), \(M\ge b\), every reserve condition holds, and the actual total seed length satisfies \(d\le 2^{27}L^3\). The guard holds for all sufficiently large \(b\).
Bound the rounded reserve below by \(4096(L+1)^2\) and the initial condenser budget above by \(13(L+1)\). The depth offset pays the reserve and the ceiling loss while keeping \(k_0\le 2b\). The established logarithm-of-logarithm growth bound proves eventuality.
Under the guard, the specified map on \(8b\) input bits is a weighted strong seeded extractor at support threshold \(2^{2b}\), output length \(b\), and error \(1/4\). Its seed length is at most \(2^{27}L^3\). Consequently it is an ordinary flat seeded extractor with these parameters, for every sufficiently large \(b\).
Use the near-halving dyadic guarantee with \(e=2\), increase the threshold to \(2^{2b}\), and truncate to \(b\) coordinates. Forget the retained seed to obtain the ordinary flat contract.
Encode level seeds in order, followed by the shared final condenser and hash seeds. The workspace records width, remaining depth and its power of two, block count, payload, and unused seed suffix. Each actual condenser step halves the stored remaining power and doubles the count. The final extractor reads both of its seeds at their exact widths.
The complete program is polynomial-time for uniformly unary-computable parameters and initialization power, when the number of iterations is at most \(h\) and is either zero or satisfies the capacity and reserve bounds. At \(h\) iterations and the specified leaf length, its output equals the statistical map on every canonical seed word, including arbitrary trailing bits. Correctness needs no entropy premise. For Gamma parameters, \(2^h\le b+1\) on every input, and all parameter generators and the size-guard decision have uniform certificates.
Bound every encoded state, including payload and unary counters, before bounded iteration. Compose with the shared one-shot block program. Induction identifies all runtime state fields with the recursive map; exact seed slicing gives the final output identity. Capped powering and the unconditional depth bound certify Gamma initialization.
Generate the rounded parameters from \(b\) and execute \(h\) levels if the size guard holds, or zero levels otherwise. Return the first \(b\) bits on the guarded branch and \(b\) zero bits otherwise. The single paired string evaluator infers \(b\) as the source-word length divided by eight.
The runtime always emits exactly \(b\) bits and is uniformly polynomial-time in unary \(b\), source, and seed words. The paired evaluator is in \(\mathrm{FP}\) on every encoded word. Under the size guard, it computes the named Gamma extractor on every \(8b\)-bit source and every exact-length seed, with any trailing padding. This agreement therefore holds eventually for the whole family.
The guarded iteration count satisfies the resource bound on both branches before selecting the final output. Compose the unconditional parameter and bounded-run certificates. Exact near-halving program correctness and prefix truncation identify the output on the guard; source length divided by eight recovers \(b\) on all canonical inputs.
Give the runtime an \(8b\)-bit source and a seed of exactly \(r(b)=2^{27}\lceil \log _2(b+1)\rceil ^3\) bits. Read its \(b\) output coordinates to define the Boolean family. This definition invokes the actual total string program, including its specified small-size behavior.
The budget \(r(b)\) is uniformly unary-computable. The same single \(\mathrm{FP}\) evaluator computes the entire Boolean output at every size and seed word. Under the size guard, the family is a weighted strong extractor with input length \(8b\), threshold \(2^{2b}\), output length \(b\), and error \(1/4\), retaining all \(r(b)\) uniform seed bits. Its ordinary flat guarantee consequently holds for all sufficiently large \(b\).
Split each padded word at the actual seed length. The runtime identity with an arbitrary trailing suffix gives the original semantic Gamma output on its prefix. Independent seed padding preserves strong extraction, while the exact output length identifies every coordinate with the paired string evaluator, including below the size guard.
The fixed-family logarithmic-seed primitive and the ordinary Gamma linear-output parameters are now supplied by actual recursive maps. The complete actual affine correlation breaker now has an original-source security theorem for every positive tampering count, explicit finite parameters and dyadic error, and a total uniform polynomial-time evaluator. The actual first phase initializes the repeated-round invariant, whose entropy losses and error are discharged by the chosen global schedule. The actual sumset/amplification composition and fixed-family parity estimates are proved above. Their eventual sublinear entropy and bounded uniform evaluator give the concrete polynomial-time family in Theorem 703.
A constraint network on \(n\) variables is a multigraph whose vertices carry local checks on the bits written on their incident edges, with a port (a vertex and an incident edge) for every variable it reads. It computes \(f\) when the accepted inputs are exactly those admitting an edge assignment that satisfies every check and carries the input on every port. For a prefix \(L\) of a vertex ordering and a cut assignment \(\sigma \), the past set consists of the assignments to the variables read in \(L\) that extend to an edge assignment satisfying the checks of \(L\) and agreeing with \(\sigma \) on the cut; the future set is defined symmetrically. The patterns realized on an edge set \(C\) are the restrictions to \(C\) of satisfying edge assignments. A subset \(T\) determines \(C\) when two satisfying assignments that agree on \(T\) agree on \(C\). The edges charged at a vertex are the cut before it and its incident edges.
Let a network compute a \(K\)-rectangle-free function \(f\), \(K{\gt}1\), and fix a vertex ordering. If a subset \(T\subseteq C\) determines \(C\), at most \(2^{|T|}\) patterns are realized on \(C\). If at most \(P\) patterns are realized on the edges charged at every vertex, then either the final past set is small, so that fewer than \(K\cdot 2^{n-n'}\) inputs are accepted, where \(n'\) variables are read, or
With every prefix cut of size at most \(w\) and every degree at most three, \(P=2^{w+3}\) is admissible.
Gluing a past and a future assignment of one cut assignment yields an accepted input, so the past and future sets form a one-rectangle and one of them has fewer than \(K\) elements. Charge every accepted input to the first vertex at which the past set of its satisfying assignment reaches size \(K\); the past set before that vertex and the future set after it are both small. The key of an input is that vertex and the realized pattern on its charged edges, which contain both cuts and the ports read at the vertex, so at most \((K-1)^2\) inputs share a key and there are at most \(|V|\cdot P\) keys. Restriction to a determining subset is injective on realized patterns.
The wiring network of a circuit over the full binary basis has a vertex for every wire with a path to the output and, for a signal feeding \(f\ge 2\) slots, \(f-1\) copy vertices of degree three; gate vertices check their operation, the output gate checks the value \(1\), and copy vertices check agreement. It computes the circuit’s function, is connected with maximum degree three, has at most \(2s+1\) vertices, and its edges minus vertices equal the reachable gates minus the reachable inputs. Call a signal carried by an edge set \(C\) a generator of \(C\) unless it is a gate both of whose argument signals are carried by \(C\). One edge of \(C\) per generator determines \(C\), so at most \(2^{|\mathrm{generators}(C)|}\) patterns are realized on \(C\), and the cut-counting bound holds with \(P=2^{w}\) whenever the edges charged at every vertex have at most \(w\) generators. No layout theorem bounding generators is proved; the assembly below charges edges.
Under a satisfying assignment every edge of one signal carries the bit of the signal’s first outgoing edge, by the copy checks. Induct along the program order: a generator’s bit is fixed by its chosen edge, and a determined gate carries its operation applied to two bits that already agree. The counting statements are instances of Lemma 763.
Every rectangle-free Boolean function family with polynomial rectangle threshold and at least \(2^{n-2}\) accepting inputs, as in Theorem 363, needs circuits of more than \((4-\varepsilon )n\) gates over the full binary basis (all sixteen binary gates, every gate counted), for every \(\varepsilon {\gt}0\) and all large \(n\). The cubic graph bounds are proved, so the theorem has no graph hypothesis. This reusable theorem applies to every family satisfying the displayed properties. The concrete family of Theorem 703 uses its subexponential-threshold form. The circuit argument follows Ryan Williams’s private working note of September 2026, combining the rectangle bound for read-once programs with the circuit-to-read-once compiler of the author’s counting note.
Order the gates by a path decomposition of the circuit’s wiring graph and count the rectangles cut at each position.
The polynomial threshold in Theorem 765 can be replaced by \(\log _2 K(n)=o(n)\). In particular, a family of flat-source sumset extractors with this threshold and fixed error at most \(1/4\) satisfies the same circuit lower bound with no graph hypothesis. The explicit sumset family and its uniform polynomial-time evaluation are supplied above with sublinear source entropy. Li’s Theorem 7.13 (2023) provides logarithmic source entropy; Chattopadhyay and Liao (2021) already provide polylogarithmic source entropy, which is sufficient for this version.
Keep the terms involving \(\log _2 K\) in the finite counting inequality. The loss is \(O(\log n+\log K)=o(n)\), so the coefficient remains four.
Under the hypotheses of Theorem 765, the same bound holds for nondeterministic circuits: for every \(\varepsilon {\gt} 0\) and all large \(n\), every circuit on \(n + m\) inputs with arbitrary \(m\), whose accepted inputs \(x\) are exactly those with some witness \(y\) making the output \(1\) has more than \((4 - \varepsilon )n\) gates. Nondeterminism does not reduce the size below this bound. The subexponential threshold of Theorem 766 is also sufficient.
Witness inputs are read by the wiring graph but carry no port of the computed function, so forgetting their ports (Network.forget) leaves a network with the same multigraph computing the existential projection. The excess of the wiring graph counts every reachable input, ordinary or witness, so it is at most the gate count minus the ordinary inputs read. Every signal except the output feeds a slot; charging signals and copy vertices to slots gives at most \(2s+1\) wiring vertices, independent of the declared witness count. The deterministic assembly then applies.
Let \(A{\gt}0\), and suppose that for every \(\eta {\gt}0\) some \(C\) satisfies \(\mathrm{OrderingBound}(A,\eta ,C)\). Every family as in Theorem 766 then needs more than \((1+1/A-\varepsilon )n\) gates, for deterministic circuits and for nondeterministic circuits with arbitrarily many witness inputs, for every \(\varepsilon {\gt}0\) and all large \(n\). The balanced padding of Theorem 471 needs more than \((1+1/A-\varepsilon )(n+1)\) gates. A cubic cutwidth or pathwidth coefficient \(c{\gt}0\) at every positive slack gives the circuit coefficient \(1+1/(2c)\). The coefficient-four theorems are the case \(A=1/3\).
Let \(\theta =\min \{ \varepsilon ,1/A\} \) and use the ordering slack \(\eta =A^2\theta /2\). A circuit with at most \((1+1/A-\theta )n\) gates that reads more than \(n-k\) inputs, \(k=\lceil \log _2K\rceil \), has excess at most \((1/A-\theta )n+k\), and \((A+\eta )(1/A-\theta )\le 1-A\theta /2\). Comparing the \(2^{n-2}\) accepted inputs with the cut-counting bound leaves \(A\theta n/2\le O(\log n+\log K)\), which fails for all large \(n\).
For a finite simple graph, a decay rate \(q\), and a radius \(R\), the kernel row of a vertex \(v\) is \(a_v(z)=q^{\operatorname {dist}(v,z)}\) when \(\operatorname {dist}(v,z)\le R\) and \(0\) otherwise. Its normalization is \(\hat a_v=a_v/\lVert a_v\rVert \); the norm is at least one because \(a_v(v)=1\).
In a graph of maximum degree three, spheres of radius \(d\) have at most \(3\cdot 2^d\) vertices. For adjacent vertices \(u,v\) and \(q\ge 0\),
No girth or expansion hypothesis is needed.
The two distances to any vertex differ by at most one. If both kernel values are nonzero, their product is at least \(\kappa =2q/(1+q^2)\) times the mean of their squares, with equality when the distances differ. If exactly one is nonzero, it lies on the truncation sphere of radius \(R\). Summing, the defect is at most \((\kappa /2)q^{2R}\) per sphere vertex. Normalize using the arithmetic–geometric mean inequality and norms at least one.
Let \(\omega \) have independent standard Gaussian coordinates and let \(\alpha ,\beta \) have equal norms with \(\alpha +\beta \ne 0\). For every threshold \(t\), the probability that \(t\) separates \(\langle \alpha ,\omega \rangle \) and \(\langle \beta ,\omega \rangle \) is at most \((2/\pi )\lVert \beta -\alpha \rVert /\lVert \alpha +\beta \rVert \). A unit form lies in a window of width \(\delta \) with probability at most \(\delta /\sqrt{2\pi }\) and beyond \(\pm T\) with probability at most \(1/T^2\).
The forms \(U=\langle \alpha +\beta ,\omega \rangle \) and \(V=\langle \beta -\alpha ,\omega \rangle \) are uncorrelated jointly Gaussian, hence independent. A separated threshold forces \(|U-2t|\le |V|\). Condition on \(V\), bound the density of \(U\) by its maximum, and use \(\mathbb E|N(0,1)|=\sqrt{2/\pi }\). The tail is Chebyshev’s inequality.
Under a product of probability measures, let each event of a finite family depend only on a finite set of coordinates, each set meeting at most \(D\) of the sets. The number of occurring events has variance at most \(|F|D\), and deviates from its mean by at least \(c{\gt}0\) with probability at most \(|F|D/c^2\).
Indicators of events on disjoint coordinate sets are independent, so their covariance vanishes; every other covariance is at most one. Apply Chebyshev’s inequality.
For every \(\xi {\gt}0\), every sufficiently large simple cubic graph on \(h\) vertices has a vertex ordering all of whose prefix cuts have at most \(\bigl(\tfrac {3}{\pi }(3-2\sqrt2)+\xi \bigr)h\) edges. The coefficient is about \(0.16384\), below the \(1/6\) of the Monien–Preis and Fomin–Høie bounds.
Order the vertices by Gaussian scores \(\langle \hat a_v,\omega \rangle \). Fix thresholds \(-T+i\delta \) with \(M\delta =2T\). Every prefix lies between two consecutive threshold sets or inside a tail, so its cut is at most a threshold cut plus three times a window count, or three times a tail count. The expected threshold cut is at most \(\tfrac 32 h\cdot \tfrac 2\pi \sqrt{(1-\rho _0)/(1+\rho _0)}\) with \(\rho _0\) the correlation bound. All events are local, so each of the \(2M+2\) counts deviates by \(\varepsilon h\) with probability \(O(1/h)\), and one sample keeps them all close to their means. As \(q\uparrow 1/\sqrt2\) and \(R\to \infty \), \(\rho _0\to 2\sqrt2/3\), where \(\sqrt{(1-\rho _0)/(1+\rho _0)}=3-2\sqrt2\).
For independent standard Gaussians, \(|Z_1|\le k|Z_2|\) has probability \((2/\pi )\arctan k\). Consequently, for unit vectors \(\alpha ,\beta \) with \(\langle \alpha ,\beta \rangle =\rho {\gt}-1\), every threshold separates \(\langle \alpha ,\omega \rangle \) and \(\langle \beta ,\omega \rangle \) with probability at most \(\arccos (\rho )/\pi \), with equality at threshold zero.
The sum and difference forms are independent. A separated threshold forces the sum to lie within the absolute difference of twice the threshold; a symmetric unimodal density gives the interval centred at zero the most mass. The planar angle law and \(2\arctan \tan (\theta /2)=\theta \) finish the computation.
For unit vectors \(\alpha ,\beta \) with \(\langle \alpha ,\beta \rangle =\rho {\gt}-1\) and every threshold \(t\), the threshold separates \(\langle \alpha ,\omega \rangle \) and \(\langle \beta ,\omega \rangle \) with probability at most \(e^{-t^2/2}\arccos (\rho )/\pi \).
Write the sum and difference forms in polar coordinates \((R,\psi )\) after rescaling. At radius \(R\) a separating threshold forces \(R\ge |t|\) and puts \(|\psi |\) within half the angle \(\arccos \rho \) of \(\arccos (t/R)\), because the cosine is decreasing on \([0,\pi ]\). So each circle contributes angle at most \(2\arccos \rho \), and the radial tail \(\int _{|t|}^\infty Re^{-R^2/2}\, dR=e^{-t^2/2}\) supplies the factor.
The function \(\arccos \) is concave on \([0,1]\). For three unit vectors with inner products at least \(\kappa \ge 7/8\) with a unit vector, the sum of their pairwise angles over ordered pairs is at most \(6\arccos \bigl((3\kappa ^2-1)/2\bigr)\).
Apply Jensen’s inequality to the six ordered-pair correlations, whose average is at least \((3\kappa ^2-1)/2\) by the star inequality.
If unit vectors \(y_1,\dots ,y_n\) satisfy \(\langle y_j,x\rangle \ge \kappa \ge 0\) for a unit vector \(x\), then \(\sum _{j\ne j'}\langle y_j,y_{j'}\rangle \ge n^2\kappa ^2-n\) and each \(\langle y_j,y_{j'}\rangle \ge 4\kappa -3\).
Expand \(\lVert \sum _j y_j\rVert ^2\ge \langle \sum _j y_j,x\rangle ^2\), and sum the squares \((y-2x+y')^2\ge 0\).
List the edges of a simple cubic graph by a real score, and keep each vertex in the bags between its first and last incident edge. A vertex in the bag of an edge of score \(t\) has incident edges scoring at most and at least \(t\). With thresholds \(a+i\delta \), if both tails hold few edges and every threshold has few vertices whose edge scores straddle it and few edges in the following window, every bag is small. A straddling vertex has at least four separated ordered pairs of incident edges.
Sort the edges with a stable merge sort. A bag vertex lies in a tail, straddles the threshold below the bag’s score, or is an endpoint of an edge in the window.
Score the edges of a simple cubic graph and fix \(c{\gt}0\). Call an edge low, band or high as its score lies below \(-c\), in \([-c,c)\), or at least \(c\), and split the band edges into blocks so that two band edges at a common vertex share a block. List the low edges by score, then the blocks one at a time in increasing order of the number of their vertices with a high edge minus the number with a low edge, then the high edges by score. Every bag of the resulting path decomposition has at most \(\max (S(-c),S(c))+|V_j|\) vertices for some block \(j\), or at most the number of vertices with incident scores on both sides of a threshold outside \([-c,c)\). Here \(S(t)\) counts the vertices whose edge scores straddle \(t\) and \(V_j\) the vertices of block \(j\).
Give each block a common score inside \((-c,c)\), increasing with its imbalance, and use the edge-score decomposition of the modified scores. Between blocks a bag holds the band-free vertices with low and high edges, the vertices of finished blocks with a high edge, and those of unstarted blocks with a low edge. Every vertex lies in at most one block, so \(S(-c)\) and \(S(c)\) split into these sets, and processing blocks in order of imbalance keeps the middle count below \(\max (S(-c),S(c))\) by an exchange argument.
For every \(\xi {\gt}0\), every sufficiently large simple cubic graph on \(h\) vertices has a path decomposition with bags of at most \(\bigl(\tfrac {3}{2\pi }\arccos \tfrac {1+2\sqrt2}{4}+\xi \bigr)h+1\) vertices. The coefficient is about \(0.14035\), well below the \(1/6\) of the Fomin–Høie bound; twice it is at most \(9/32\).
Give each edge \(uv\) the unit vector \(y_{uv}=(\hat a_u+\hat a_v)/\lVert \hat a_u+\hat a_v\rVert \) and the score \(\langle y_{uv},\omega \rangle \), and decompose by edge scores. If adjacent kernel rows have correlation at least \(\rho _0\), the edge vectors at a vertex have correlation at least \(\kappa =\sqrt{(1+\rho _0)/2}\) with its row. A threshold separates two edge scores with probability at most \(\arccos /\pi \) of their correlation, so by the angle lemma a vertex straddles a threshold with probability at most \(\tfrac {3}{2\pi }\arccos \bigl((1+3\rho _0)/4\bigr)\). The grid, locality, and second-moment argument of Theorem 773 control every bag of one sample, and \(\rho _0\to 2\sqrt2/3\).
Give each edge \(uv\) of a finite simple graph the Gaussian edge score \(\langle y_{uv},\omega \rangle \) with \(y_{uv}=(\hat a_u+\hat a_v)/\lVert \hat a_u+\hat a_v\rVert \), built from the kernel with decay rate \(q\) and radius \(R\). For \(c{\gt}0\) the band graph keeps the edges scoring in \([-c,c)\), and the band cluster of a vertex is its connected component in the band graph. The band hypothesis \(\mathrm{BandSubcritical}(q,R,c)\) says that for every \(\varepsilon {\gt}0\) some \(K\) makes the expected number of vertices whose band cluster has more than \(K\) vertices at most \(\varepsilon h\) on every simple cubic graph with \(h\) vertices. This is an open percolation hypothesis, not a theorem of the library: it asserts that the band clusters of the edge-score field are subcritical uniformly over cubic graphs. Numerically it holds on the infinite cubic tree for \(c{\lt}0.1826\), which appears to be the worst case.
This result is conditional on the open band hypothesis of Definition 781. Let \(c{\gt}0\) and assume \(\mathrm{BandSubcritical}(q,R,c)\) for every decay rate \(0\le q{\lt}1/\sqrt2\) and every radius \(R\). Then for every \(\xi {\gt}0\), every sufficiently large simple cubic graph on \(h\) vertices has a path decomposition with bags of at most \(\bigl(e^{-c^2/2}p+\xi \bigr)h+1\) vertices, where \(p=\tfrac {3}{2\pi }\arccos \tfrac {1+2\sqrt2}{4}\). Unconditionally, \(2e^{-c^2/2}p\le 5/18\) at \(c=4/25\).
Use the band-jump order of Lemma 779 for the edge scores of one Gaussian sample, with the band clusters as blocks. Every threshold \(t\) of a low grid on \([-T,-c]\) or a high grid on \([c,T]\) has \(|t|\ge c\), so by Lemma 775 and the angle bound of Theorem 780 a vertex straddles it with probability at most \(e^{-c^2/2}\tfrac {3}{2\pi }\arccos \bigl((1+3\rho _0)/4\bigr)\); the second-moment bound of Lemma 772 controls the grids and tails of one sample. Inside the band a bag also holds the vertices of one block. They lie in one band cluster, so there are at most \(K\) of them, or they all lie in clusters of more than \(K\) vertices; by the hypothesis and Markov’s inequality the latter number less than \(2\eta h\) with probability at least \(1/2\). The cluster event is measurable because it depends only on the finitely many band indicators. Taking \(K\le \varepsilon h\) and \(\rho _0\to 2\sqrt2/3\) gives the coefficient. At \(c=4/25\) use \(2p\le 9/32\) and \(e^{-8/625}\le 80/81\), which follows from \(e^{x}\ge 1+x\).
For every \(\eta {\gt}0\) some \(C\) satisfies \(\mathrm{OrderingBound}\bigl(\tfrac {6}{\pi }(3-2\sqrt2),\eta ,C\bigr)\), from the Gaussian cutwidth layout, and some \(C\) satisfies \(\mathrm{OrderingBound}(2p,\eta ,C)\) with \(p=\tfrac {3}{2\pi }\arccos \tfrac {1+2\sqrt2}{4}\), from the Gaussian pathwidth decomposition; these coefficients are about \(0.32768\le 20/61\) and \(0.28070\le 9/32\). Every family as in Theorem 766 therefore needs more than \(\bigl(1+\pi /(3\arccos \tfrac {1+2\sqrt2}{4})-\varepsilon \bigr)n\) gates, about \((4.5625-\varepsilon )n\), for deterministic circuits and for nondeterministic circuits with arbitrarily many witness inputs.
Apply the cutwidth-to-ordering and pathwidth-to-ordering transports to Theorems 773 and 780, and the general coefficient theorem with the pathwidth coefficient \(p\), for which \(1+1/(2p)\) equals \(1+\pi /(3\arccos \tfrac {1+2\sqrt2}{4})\). The comparison with \(20/61\) needs rational bounds on \(\sqrt2\) and \(\pi \); the comparison with \(9/32\) also uses the fourth-order Taylor bound for the cosine at \(3\pi /32\).
Direct every edge of a multigraph from its first to its second endpoint. A directed walk is a list of vertices in which each vertex is joined to the next by an edge directed towards it. A multigraph with distinct vertices \(i_1,\dots ,i_N\) (inputs) and \(o_1,\dots ,o_N\) (outputs), \(2N\) in all, is an \(N\)-superconcentrator when for every \(k\), all \(k\)-sets \(X\) of inputs and \(Y\) of outputs are joined by \(k\) vertex-disjoint directed walks from \(X\) to \(Y\). Every path is a walk, so this includes superconcentrators defined with paths.
Every linear order of the vertices of an \(N\)-superconcentrator has a lower set whose cut has at least \(N\) edges.
Take a lower set \(S\) containing exactly \(N\) of the \(2N\) terminals, say \(a\) inputs and \(N-a\) outputs; its complement contains \(N-a\) inputs and \(a\) outputs. The superconcentrator joins the \(a\) inputs in \(S\) to the \(a\) outputs outside \(S\) by vertex-disjoint directed walks, each of which leaves \(S\) along an edge directed out of \(S\), and the \(N-a\) inputs outside \(S\) to the \(N-a\) outputs in \(S\), each entering along an edge directed into \(S\). Walks of one family are vertex-disjoint, so their crossing edges are distinct, and an edge directed out of \(S\) is not directed into it. No Menger theorem is needed.
Assume \(\mathrm{OrderingBound}(A,\eta ,C)\) with \(A+\eta \ge 0\). Every \(N\)-superconcentrator with \(N{\gt}0\) and \(M\) edges satisfies \(N\le (A+\eta )\max \{ M-2N,0\} +3\log _2(2M)+C\), and a connected one with \(V\) vertices satisfies \(N\le (A+\eta )\max \{ M-V,0\} +3\log _2(2M)+C\). Hence if \(A{\gt}0\) and every \(\eta {\gt}0\) admits such a \(C\), then for every \(\varepsilon {\gt}0\) and all large \(N\) every \(N\)-superconcentrator has at least \((2+1/A-\varepsilon )N\) edges. With the edge-score coefficient \(A=2p\), \(p=\tfrac {3}{2\pi }\arccos \tfrac {1+2\sqrt2}{4}\), this is \(\bigl(2+\pi /(3\arccos \tfrac {1+2\sqrt2}{4})-\varepsilon \bigr)N\approx (5.5625-\varepsilon )N\) edges, and at least \((50/9-\varepsilon )N\) since \(2p\le 9/32\). The coefficient \(A=1/3\) of the Fomin–Høie bound gives \((5-\varepsilon )N\), the bound of Lev and Valiant (Size bounds for superconcentrators, Theoretical Computer Science, 1983).
Every input reaches every output, so all terminals lie in one undirected component. Replace each vertex of that component by a directed path with one vertex per end of an edge with its tail in the component, the ends of entering edges first. Each path vertex meets at most two path edges and one original edge, no edge is a loop, the result is connected, and its edges minus vertices are the component’s. A directed walk enters a vertex at an entering end, from which its path reaches every leaving end, so vertex-disjoint walks lift to vertex-disjoint walks; with each input at the first vertex of its path and each output at the last, the result is a superconcentrator. Its ordering has prefix cuts of at most \((A+\eta )\max \{ M'-V',0\} +3\log _2V'+C\) edges, and one has at least \(N\) by Lemma 785. Here \(M'-V'\le M-2N\), since the component contains the \(2N\) terminals, and \(V'\le 2M\). If \(M{\lt}(2+1/A-\varepsilon )N\), then at slack \(\eta =A^2\varepsilon /2\) the right side is at most \((1-A\varepsilon /2)N+O(\log N)\), which is less than \(N\) for large \(N\).
Let the inputs have in-degree zero and every vertex in-degree at most two. Under the hypotheses of Theorem 786, for every \(\varepsilon {\gt}0\) and all large \(N\) every such \(N\)-superconcentrator has at least \((1+1/A-\varepsilon )N\) vertices that are not inputs. This is \((4-\varepsilon )N\) for \(A=1/3\), the corresponding bound of Lev and Valiant, and \(\bigl(1+\pi /(3\arccos \tfrac {1+2\sqrt2}{4})-\varepsilon \bigr)N\approx (4.5625-\varepsilon )N\) for the edge-score coefficient.
Count in the component of the terminals. Its edges enter non-input vertices, at most two each; if \(S\) is the set of non-input vertices met by an edge of the component, the component has at most \(2|S|\) edges and at least \(N+|S|\) vertices. Its edges minus vertices is therefore at most \(|S|-N\le (V-N)-N\), and it has at most \(2(V-N)\) edges, so the argument of Theorem 786 applies with \((V-N)-N\) in place of \(M-2N\).
A multigraph with distinct vertices \(i_1,\dots ,i_n\) (inputs) and \(o_1,\dots ,o_m\) (outputs), \(n+m\) in all, is an \((n,m)\)-concentrator when every set \(X\) of at most \(m\) inputs is joined to some \(|X|\) outputs by \(|X|\) vertex-disjoint directed walks, one from each input of \(X\); the outputs are not prescribed, and the walks may pass through other inputs and outputs. Every path is a walk, so this includes the concentrators of Pinsker (On the complexity of a concentrator, 7th International Teletraffic Congress, 1973), defined with paths. Parallel edges are counted separately.
Every linear order of the vertices of an \((n,m)\)-concentrator has a lower set whose cut has at least \(\min (m,n-m)\) edges.
Let \(h=\min (m,n-m)\), take a lower set \(S\) containing exactly \(h\) inputs, and let \(b\) outputs lie in \(S\). As \(h\le m\), the \(h\) inputs in \(S\) are joined to distinct outputs by vertex-disjoint walks; at most \(b\) of them end in \(S\), and each of the others leaves \(S\) along an edge directed out of \(S\). As \(n-h\ge m\), some \(m\) inputs outside \(S\) are joined to \(m\) distinct outputs, that is, to all of them; each of the \(b\) walks ending in \(S\) enters it along an edge directed into \(S\). Walks of one family are vertex-disjoint, so their crossing edges are distinct, and the cut of \(S\) has at least \((h-b)+b=h\) edges.
Let \(1\le m{\lt}n\). Every \((n,m)\)-concentrator with \(M\) edges has \(M\ge n+m-1\), and under \(\mathrm{OrderingBound}(A,\eta ,C)\) with \(A+\eta \ge 0\) it satisfies \(\min (m,n-m)\le (A+\eta )\max \{ M-n-m,0\} +3\log _2(2M)+C\). Hence if \(A{\gt}0\) and every \(\eta {\gt}0\) admits such a \(C\), then for every \(\varepsilon {\gt}0\) and all large \(n\), uniformly in \(m\), every \((n,m)\)-concentrator has at least \(n+m+\min (m,n-m)/A-\varepsilon n\) edges. With the edge-score coefficient \(A=2p\) this is \(n+m+\kappa \min (m,n-m)-\varepsilon n\) edges, where \(\kappa =\pi /(3\arccos \tfrac {1+2\sqrt2}{4})\approx 3.5625\); with \(\lfloor n/2\rfloor \) outputs it is \((3/2+\kappa /2-\varepsilon )n\approx (3.28-\varepsilon )n\) edges, at least \((59/18-\varepsilon )n\). The coefficient \(A=1/3\) gives \(n+m+3\min (m,n-m)-\varepsilon n\), and \((3-\varepsilon )n\) with \(\lfloor n/2\rfloor \) outputs. Pinsker (1973) proved that every \((n,m)\)-concentrator with \(m\ge 2\) has at least \(2n-2\) edges; the bound here is larger, up to \(\varepsilon n\), whenever \(m\ge n/(1+\kappa )\approx 0.22n\).
A set of vertices closed under adjacency that holds \(a\) inputs holds at least \(\min (a,m)\) outputs, since the walks from its inputs stay in it. If neither the undirected component of the first input nor its complement held all \(m\) outputs, each would hold no more inputs than outputs, giving \(n\le m\); so the component holds every output, and then its complement holds no input. Every input reaches an output and every output is reached, so each terminal has an edge of the component at it. As in Theorem 786, splitting each vertex of the component into a directed path of edge ends gives a connected loopless concentrator of maximum degree three whose edges minus vertices are those of the component, at most \(M-n-m\), with at most \(2M\) vertices; vertex-disjoint walk families lift. Its ordering has prefix cuts of at most \((A+\eta )\max \{ M-n-m,0\} +3\log _2(2M)+C\) edges, and one has at least \(\min (m,n-m)\) by Lemma 789. The split graph is connected, so it has at least its number of vertices minus one edges, which gives \(M\ge n+m-1\). If \(M{\lt}n+m+\min (m,n-m)/A-\varepsilon n\), then at slack \(\eta =A^2\varepsilon /2\) either \(\min (m,n-m)/A\ge \varepsilon n\) and the ordering bound fails by \((A\varepsilon /2)n-O(\log n)\), or \(\min (m,n-m){\gt}A(\varepsilon n-1)\) exceeds the logarithmic term, or \(M{\lt}n+m-1\).
A multigraph is acyclic when some numbering of its vertices increases strictly along every edge, from its first endpoint to its second. A finite multigraph is acyclic exactly when no vertex reaches itself along a directed walk of positive length.
Let \(G\) be an acyclic \((n+1,m)\)-concentrator whose inputs have in-degree zero, with \(2\le m\le n\). Removing at least two edges of \(G\) and replacing its inputs leaves an acyclic \((n,m)\)-concentrator on the same vertices and outputs whose inputs have in-degree zero.
Walks from inputs visit a vertex of in-degree zero only at their start. Every input has an edge leaving it. If some input has two, remove its edges and drop it. Otherwise every input \(x\) has one edge, to its head, and distinct inputs have distinct heads, as two inputs with a common head cannot be routed together. If the head \(u\) of some input \(x\) is entered only by the edge from \(x\), then \(u\) is neither an input nor an output (every output is reached from \(m\) inputs other than \(x\)); remove that edge and make \(u\) an input in place of \(x\), whose walks continue from \(u\). Otherwise let \(w\) be a first non-input vertex at an edge in a topological order. Edges entering \(w\) come from inputs whose head is \(w\), so there is at most one, and then \(w\) would be a head entered only by it; so no edge enters \(w\), \(w\) is no output, and its edges can be removed. The last two steps keep the number of inputs and remove an edge, so induction on the number of edges concludes.
Let \(G\) be an acyclic \((n,m)\)-concentrator with \(M\) edges whose inputs have in-degree zero, with \(2\le m{\lt}n\), and \(h=\min (m,n-m)\). Then \(M\ge 2n-h-1\), and under \(\mathrm{OrderingBound}(A,\eta ,C)\) with \(A+\eta \ge 0\), \(h\le (A+\eta )\max \{ M-(2n-h),0\} +3\log _2(2M)+C\). Hence if \(A{\gt}0\) and every \(\eta {\gt}0\) admits such a \(C\), then for every \(\varepsilon {\gt}0\) and all large \(n\), uniformly in \(m\), every such \(G\) has at least \(2n+(1/A-1)h-\varepsilon n\) edges: with the edge-score coefficient \(2n+(\kappa -1)h-\varepsilon n\), \(\kappa =\pi /(3\arccos \tfrac {1+2\sqrt2}{4})\approx 3.5625\), and with \(A=1/3\), \(2n+2h-\varepsilon n\). For \(m\ge n/2\) this is Theorem 790; for \(m{\lt}n/2\) it is larger, about \(2.64n\) rather than \(2.14n\) at \(m=n/4\), and it exceeds Pinsker’s \(2n-2\) whenever \(h\) grows linearly.
For \(m\ge n/2\) apply Theorem 790, as \(n+m=2n-h\). For \(m{\lt}n/2\), eliminate \(n-2m\) inputs by Lemma 792, removing at least \(2(n-2m)\) edges, and apply Theorem 790 to the resulting \((2m,m)\)-concentrator with \(M'\le M-2(n-2m)\) edges: \(m\le (A+\eta )\max \{ M'-3m,0\} +3\log _2(2M')+C\) with \(M'-3m\le M-(2n-m)\), and \(M'\ge 3m-1\) gives \(M\ge 2n-m-1\). The asymptotic form follows as for Theorem 790.
A multigraph with distinct vertices \(i_1,\dots ,i_N\) (inputs) and \(o_1,\dots ,o_N\) (outputs), \(2N\) in all, is an \(N\)-hyperconcentrator when for every \(k\), every set of \(k\) inputs is joined to the first \(k\) outputs \(o_1,\dots ,o_k\) by \(k\) vertex-disjoint directed walks. The walks may pass through other inputs and outputs, and every path is a walk, so this includes hyperconcentrators defined with paths. Every superconcentrator is a hyperconcentrator. Parallel edges are counted separately.
Every linear order of the vertices of an \(N\)-hyperconcentrator has a lower set whose cut has at least \(\lfloor N/2\rfloor \) edges.
Let \(h=\lfloor N/2\rfloor \), take a lower set \(S\) containing exactly \(h\) inputs, and let \(c\) of \(o_1,\dots ,o_h\) lie in \(S\). The \(h\) inputs in \(S\) are joined to \(o_1,\dots ,o_h\) by vertex-disjoint walks, and the \(h-c\) of them ending outside \(S\) leave it along distinct edges directed out of \(S\). The \(N-h\ge h\) inputs outside \(S\) are joined to \(o_1,\dots ,o_{N-h}\), among them \(o_1,\dots ,o_h\), and the \(c\) walks ending in \(S\) enter it along distinct edges directed into \(S\). So the cut of \(S\) has at least \(h\) edges.
Assume \(\mathrm{OrderingBound}(A,\eta ,C)\) with \(A+\eta \ge 0\). Every \(N\)-hyperconcentrator with \(N{\gt}0\) and \(M\) edges satisfies \(\lfloor N/2\rfloor \le (A+\eta )\max \{ M-2N,0\} +3\log _2(2M)+C\); if its inputs have in-degree zero and its vertices in-degree at most two, then with \(V\) vertices also \(\lfloor N/2\rfloor \le (A+\eta )\max \{ (V-N)-N,0\} +3\log _2(4(V-N))+C\). Hence if \(A{\gt}0\) and every \(\eta {\gt}0\) admits such a \(C\), then for every \(\varepsilon {\gt}0\) and all large \(N\) every \(N\)-hyperconcentrator has at least \((2+1/(2A)-\varepsilon )N\) edges, and at least \((1+1/(2A)-\varepsilon )N\) non-input vertices under the degree conditions. With the edge-score coefficient \(A=2p\) these are \((2+\kappa /2-\varepsilon )N\approx (3.78-\varepsilon )N\) edges, at least \((34/9-\varepsilon )N\), and \((1+\kappa /2-\varepsilon )N\approx (2.78-\varepsilon )N\) non-input vertices, at least \((25/9-\varepsilon )N\), where \(\kappa =\pi /(3\arccos \tfrac {1+2\sqrt2}{4})\). The coefficient \(A=1/3\) gives \((7/2-\varepsilon )N\) edges.
Every input reaches \(o_1\) and every output is reached, so all terminals lie in one undirected component and each has an edge of the component at it. Splitting the component as in Theorem 786 gives a connected loopless hyperconcentrator of maximum degree three whose edges minus vertices are at most \(M-2N\), with at most \(2M\) vertices; its ordering has a prefix cut with at least \(\lfloor N/2\rfloor \) edges by Lemma 795. Under the degree conditions the count of Corollary 787 bounds the edges minus vertices by \((V-N)-N\). The connected split graph gives \(M\ge 2N-1\), and \(\lfloor N/2\rfloor /A\ge N/(2A)-1/(2A)\); the asymptotic bound follows as for concentrators.
A comparator network on \(n\) wires with \(s\) comparators applies its comparators in the order \(0,1,\dots ,s-1\). Comparator \(c\) acts on two distinct wires \(p_c\) and \(q_c\), not necessarily with \(p_c{\lt}q_c\): it puts the smaller of their two values on \(p_c\) and the larger on \(q_c\), and leaves the other wires unchanged. The network acts on values in any linear order, and it commutes with monotone maps. The bottom half \(B\) is the set of wires \(w{\lt}\lfloor n/2\rfloor \) and the top half \(T\) the set of the others. The network is an \(\varepsilon \)-halver when for every input \(x\in \{ 0,1\} ^n\) with \(k\le n/2\) ones, at most \(\varepsilon k\) ones of the output lie in \(B\), and for every input with \(k\le n/2\) zeros, at most \(\varepsilon k\) zeros of the output lie in \(T\). For even \(n\) this is the \(0\)-\(1\) form of the \(\varepsilon \)-halvers of Ajtai, Komlós and Szemerédi (Sorting in \(c\log n\) parallel steps, Combinatorica, 1983): by the commutation with monotone maps, it is equivalent to asking, for every input with distinct values and every \(k\le n/2\), that at most \(\varepsilon k\) of the \(k\) largest inputs end in \(B\) and at most \(\varepsilon k\) of the \(k\) smallest in \(T\).
The wire graph of a comparator network on \(n\) wires with \(s\) comparators is a directed multigraph. Its vertices are an input and an output terminal for every wire and, for every comparator \(c\), its two ends \(c_p\) on \(p_c\) and \(c_q\) on \(q_c\). Its edges are the wire segments, which follow each wire from its input terminal through the ends of the comparators acting on it, in order, to its output terminal, and for every comparator a link from \(c_p\) to \(c_q\).
The wire graph of a comparator network on \(n\) wires with \(s\) comparators is loopless, has maximum degree three, \(2n+2s\) vertices and \(n+3s\) edges; its edges minus vertices are \(s-n\).
Number the input terminals \(0\), the ends of comparator \(c\) by \(c+1\), and the output terminals by \(s+1\). Every wire segment enters a vertex of a larger number on the same wire, so there are no loops. Two segments leaving one vertex lie on its wire, and if one entered a comparator before the other, the other would leave a vertex numbered after that comparator. So at most one segment leaves each vertex, at most one enters it, and at most one link meets it. There are \(n\) segments into output terminals, \(2s\) into comparator ends, and \(s\) links.
For a vertex set \(L\) of the wire graph and an input \(x\in \{ 0,1\} ^n\), let \(\mathrm{net}_x(L)\) be the number of ones of \(x\) at input terminals in \(L\) minus the number of ones of the output at output terminals in \(L\). For all inputs \(x\) and \(x'\), the cut of \(L\) has at least \(\mathrm{net}_x(L)-\mathrm{net}_{x'}(L)\) edges.
On input \(x\), let a wire segment carry the value of its wire, and the link of comparator \(c\) carry \(1\) exactly when the value on \(p_c\) before \(c\) is \(1\) and the value on \(q_c\) is \(0\): the one that moves. The flow is conserved at every comparator end, so the flow out of \(L\) minus the flow into \(L\) is \(\mathrm{net}_x(L)\). Formally, the number of wires carrying \(1\) whose last vertex before time \(t\) lies in \(L\) changes at comparator \(t\) by minus the net flow out of \(L\) along its two incoming segments and its link, and the sum telescopes. Each edge carries at most one token, so the edges leaving \(L\) number at least \(\mathrm{net}_x(L)\), and those entering \(L\) at least \(-\mathrm{net}_{x'}(L)\).
Let \(\varepsilon {\lt}1/2\). In an \(\varepsilon \)-halver, every set of wires closed under the comparators (each comparator has both wires in it or neither) is empty or all wires. Hence the wire graph is connected, and the halver has at least \(n-1\) comparators.
A closed set \(S\) of \(0{\lt}k\le n/2\) wires keeps its indicator input fixed, and so does its complement. With ones exactly on \(S\), at most \(\varepsilon k\) of its wires lie in \(B\); with zeros exactly on \(S\), at most \(\varepsilon k\) lie in \(T\); so \(k\le 2\varepsilon k\), a contradiction. If \(S\) has more than \(n/2\) wires, apply this to its complement. Every vertex of the wire graph is joined to the input terminal of its wire, and the link of a comparator joins its two wires, so the wires joined to a fixed input terminal form a nonempty closed set. A connected graph has at least its number of vertices minus one edges: \(n+3s\ge 2n+2s-1\).
Every linear order of the vertices of the wire graph of an \(\varepsilon \)-halver has a lower set whose cut has at least \((1-2\varepsilon )\lfloor n/2\rfloor \) edges.
Let \(h=\lfloor n/2\rfloor \), take a lower set \(L\) containing exactly \(h\) input terminals, and let \(\tau \) output terminals of wires in \(T\) lie in \(L\). With ones exactly on the inputs in \(L\), at most \(\varepsilon h\) ones end in \(B\), so at most \(\varepsilon h+\tau \) ones end at output terminals in \(L\) and \(\mathrm{net}\ge h-\varepsilon h-\tau \). With zeros exactly on the inputs in \(L\), at most \(\varepsilon h\) zeros end in \(T\), so at least \(\tau -\varepsilon h\) ones end at output terminals in \(L\) and \(\mathrm{net}\le \varepsilon h-\tau \). By Lemma 800 the cut has at least \((1-2\varepsilon )h\) edges.
Assume \(\mathrm{OrderingBound}(A,\eta ,C)\) and \(\varepsilon {\lt}1/2\). Every \(\varepsilon \)-halver on \(n\) wires with \(s\) comparators satisfies \((1-2\varepsilon )\lfloor n/2\rfloor \le (A+\eta )\max \{ s-n,0\} +3\log _2(2n+2s)+C\). Hence if \(A{\gt}0\) and every \(\eta {\gt}0\) admits such a \(C\), then for every \(0\le \varepsilon {\lt}1/2\), every \(\delta {\gt}0\), and all large \(n\), every \(\varepsilon \)-halver on \(n\) wires has at least \((1+(1-2\varepsilon )/(2A)-\delta )n\) comparators. With the edge-score coefficient \(A=2p\) this is \((1+\kappa (1-2\varepsilon )/2-\delta )n\) comparators, where \(\kappa =\pi /(3\arccos \tfrac {1+2\sqrt2}{4})\approx 3.5625\): about \(2.78n\) as \(\varepsilon \to 0\) and \(2.43n\) at \(\varepsilon =1/10\). With \(2p\le 9/32\) it is at least \((1+16(1-2\varepsilon )/9-\delta )n\), and the coefficient \(A=1/3\) gives \((1+3(1-2\varepsilon )/2-\delta )n\). Ajtai, Komlós and Szemerédi build \(\varepsilon \)-halvers of linear size from expanders, and Paterson (Improved sorting networks with \(O(\log N)\) depth, Algorithmica, 1990) and Seiferas (Sorting networks of logarithmic depth, further simplified, Algorithmica, 2009) analyse their constructions; we found no size lower bound for \(\varepsilon \)-halvers beyond the trivial \(n-1\) of Lemma 801.
The wire graph is connected, loopless, and of maximum degree three, with \(2n+2s\) vertices and \(n+3s\) edges, so its ordering has prefix cuts of at most \((A+\eta )\max \{ s-n,0\} +3\log _2(2n+2s)+C\) edges, and one of them has at least \((1-2\varepsilon )\lfloor n/2\rfloor \) by Lemma 802. The asymptotic bound follows from the numeric lemma of Theorem 786 with \(Q=n+s\), baseline \(2n\), the baseline \(s\ge n-1\) of Lemma 801, and \(\lfloor n/2\rfloor \ge (n-1)/2\).
Let \(A{\gt}0\), and suppose that for every \(\eta {\gt}0\) some \(C\) satisfies \(\mathrm{OrderingBound}(A,\eta ,C)\). For every \(\varepsilon {\gt}0\) and all sufficiently large \(n\), every circuit computing \(\mathrm{sourceReductionHardFamily}(n)\) has more than \((1+1/A-\varepsilon )n\) gates, with \(n\) the full input length. The family is the one of Theorem 703, which is the case \(A=1/3\).
Apply the general-coefficient padded theorem at fixed error \(35/72\), then shift its eventual statement from the unpadded index to the full input length.
For every \(\varepsilon {\gt}0\) and all sufficiently large \(n\), every circuit computing \(\mathrm{sourceReductionHardFamily}(n)\) over the full binary basis has more than \(\bigl(1+\pi /(3\arccos \tfrac {1+2\sqrt2}{4})-\varepsilon \bigr)n\) gates, about \((4.5625-\varepsilon )n\), with \(n\) the full input length. In particular it has more than \((41/9-\varepsilon )n\) gates. The family, its polynomial-time evaluator, and the basis are those of Theorem 703; no hypothesis remains.
Apply Theorem 804 with the Gaussian ordering coefficient \(A=\tfrac {3}{\pi }\arccos \tfrac {1+2\sqrt2}{4}\), or with its rational weakening \(A=9/32\), for which \(1+1/A=41/9\).
A mixed circuit contains arbitrary binary Boolean gates and special gates of the form \(h_j(\prod _i \phi _{ji}(z_i))\), where \(M_j\) is a finite commutative monoid, \(\phi _{ji}:\{ 0,1\} \to M_j\) is a slot-dependent contribution, and \(h_j:M_j\to \{ 0,1\} \) is arbitrary. Fan-in, fanout, depth, repeated slots, and special-to-special connections are unrestricted. For the actual \(q\) special occurrences, define
This counts one output-guess bit and one aggregate register per occurrence. An aggregate network adds local monoid contributions and a final predicate of their product to the Boolean wire constraints of a graph network.
Let a degree-at-most-three aggregate network with vertex set \(V\), finite commutative monoid \(M\), and cutwidth at most \(w\) compute a \(K\)-rectangle-free function on \(n\) inputs, where \(K{\gt}1\). If its input ports read \(n'\) coordinates, its number of accepting inputs is at most
If all coordinates are read, this is at most \((|V|2^{w+3}+1)|M|(K-1)^2\).
Charge the first large past set to the previous frontier values, previous aggregate, and incident edge bits. This outgoing key determines the next aggregate without inverting multiplication. Rectangle-freeness bounds the two input fibres. Terminal states with small past sets contribute the first term. Thus neither cancellation nor inverse operations are needed.
Suppose the mixed circuit’s output is \(K\)-rectangle-free and accepts at least \(2^{n-2}\) inputs. Set \(r=D+\lceil \log _2 K\rceil +3\) and assume \(3r\le n\). After guessing special outputs and erasing special incoming slots, some connected component contains more than \(n-r\) input coordinates. Fixing the other coordinates preserves rectangle-freeness and can preserve the accepting density. The resulting \(m\)-input restriction satisfies
whenever \(\mathrm{OrderingBound}(A,\eta ,C)\) holds, \(A+\eta \ge 0\), and \(C\ge 0\); here \(g\) counts all circuit gates.
Every union of components has a mixing key consisting of the guessed outputs and its partial aggregates, with at most \(2^D\) values. A balanced union would contradict rectangle-freeness and density. A greedy union argument therefore gives the large component. Its observed signals compile to a subcubic network without extra edges, including observations of sinks. One additional two-state register checks the designated output. Apply the aggregate count to each guessed computation and sum over the guesses.
Fix a budget bound \(D(n)=o(n)\). For every \(\varepsilon {\gt}0\) and all sufficiently large \(n\), every mixed circuit of budget at most \(D(n)\) computing the same fixed polynomial-time family \(\mathrm{sourceReductionHardFamily}(n)\) has more than
total gates. In particular it has more than \((41/9-\varepsilon )n\) gates. More generally the coefficient is \(1+1/A\) for every \(A{\gt}0\) with the ordering bound at all positive slacks. No invertibility or unproved graph assumption remains in the Gaussian specialization.
The fixed balanced family has a rectangle threshold with \(\log _2 K(n)=o(n)\). Taking logarithms of the dense-slice bound leaves an \(O(D+\log K+\log n)\) remainder, absorbed by any positive linear slack. Apply the proved Gaussian ordering coefficient.
Let \(R\) be the product of all special-gate registers. A joint factorization consists of a finite commutative monoid \(M\), a homomorphism \(d:M\to R\), and one contribution \(a(w,b)\in M\) for each circuit wire \(w\) and Boolean value \(b\), such that \(d(a(w,b))\) is exactly the vector of that wire’s contributions to all special gates, counting repeated slots. Its budget is \(D_M=2\lceil \log _2|M|\rceil \).
Fix \(D(n)=o(n)\). For every \(\varepsilon {\gt}0\), all sufficiently large \(n\), and every mixed circuit computing the same fixed explicit family, a joint factorization with \(D_M\le D(n)\) implies more than \((L-\varepsilon )n\) total gates, where \(L=1+\pi /(3\arccos ((1+2\sqrt2)/4))\). There is no bound on the number of special gates or their dependencies. The submonoid of \(R\) generated by all local contributions gives a canonical factorization; its cardinality is still charged.
Guess one joint final state to determine every special output. Accumulate all local contributions in a second copy of \(M\) and check equality with the guess. Decoding verifies every special equation; induction along the circuit recovers its true evaluation, including special-to-special edges. These two states also give the component-mixing key. Apply the aggregate network count and the existing graph-ordering asymptotics.
For a common prime modulus \(p\), form the matrix whose columns are the joint contribution vectors of every pair \((w,b)\) and whose rows are special gates. If its rank is \(r\), its column space supplies a factorization with \(p^r\) states and budget \(2\lceil \log _2(p^r)\rceil \le 2r\lceil \log _2p\rceil \). A sublinear bound on the latter budget therefore preserves coefficient \(L\). The threshold is uniform over prime moduli and circuits; no separate factorization certificate is required. Arbitrary modular readouts are allowed.
Every local column belongs to its span, and inclusion decodes it. A rank-\(r\) vector space over \(\mathbf F_p\) has \(p^r\) elements. Use the compressed-state theorem with its constructed factorization and the logarithmic budget bound.
If a mixed circuit has \(s\) binary gates and special registers \(M_j\), its exact capacity is \(B=s+\sum _j\log _2|M_j|\). The integral version rounds each logarithm upward. These capacities have no guessed-output term. A one-way summary for a coordinate split depends only on the sending coordinates and determines the output for every assignment to the remaining coordinates.
Every mixed aggregate circuit computing a \(K\)-rectangle-free function with at least \(2^{n-2}\) accepting inputs has
No bound is imposed on the number, placement, or fan-in of special gates.
Give the receiving party \(\lceil \log _2K\rceil +3\) input coordinates. The sender supplies each special gate’s aggregate over its own primary-input slots and at most one bit per binary gate. The receiver reconstructs all internal gates topologically. A further bit handles a directly designated primary output. Small row classes have fewer than \(K\) rows, while large row classes accept fewer than \(K\) receiving assignments. Counting both classes and taking logarithms gives the bound. This is a classical communication-complexity argument, in the tradition of Roychowdhury–Orlitsky–Siu (1994).
For every \(\varepsilon {\gt}0\), all sufficiently large mixed circuits computing the same fixed polynomial-time family have \(B{\gt}(1-\varepsilon )n\). If all special registers have at most \(r\ge 2\) states, they have more than \((1/\log _2r-\varepsilon )n\) gates. In particular arbitrary numbers of two-state aggregates, together with the full binary basis, require more than \((1-\varepsilon )n\) gates. Depth, fanout, repeated slots, and special-to-special wiring remain unrestricted.
The rectangle threshold has sublinear logarithm. Absorb the finite remainder in positive linear slack, and bound exact capacity by \(g\log _2r\) for \(g\) gates.
The fixed balanced family eventually has both output colors rectangle-free at the same threshold, and is a flat sumset disperser at that threshold. If \(V\) is XOR-closed and \(f\) is constant on a translate \(a+V\), then \(|V|{\lt}K\) for every \(K\)-flat sumset disperser \(f\).
Flipping the balancing bit negates the output and preserves rectangles. For the coset obstruction, apply sumset dispersion to \(a+V\) and \(V\): all their XOR sums lie in the same monochromatic translate.
A gate is either an affine Boolean function \(b\oplus \bigoplus _i a_i z_i\), or an optionally negated conjunction \(b\oplus \bigwedge _i[z_i=p_i]\), with arbitrary finite arity and Boolean parameters. Every gate costs one. The existing acyclic circuit model allows arbitrary depth, fanout, and repeated wires, including opposite literals of the same wire. This basis contains unbounded AND, OR, and XOR, constants, and every binary Boolean operation; binary normalization preserves gate count and outputs. For a circuit with \(g\) gates, let \(h_2\) count conjunction-form gates whose slots directly read at least two distinct primary-input variables. This is a syntactic count and requires no independence of the values read.
Every signed unbounded AND/OR/XOR circuit on \(n\) inputs has a nonempty monochromatic affine subspace \(S\) of codimension \(d\) satisfying
Consequently, if its output is a \(K\)-flat sumset disperser, then
Process gates topologically, keeping every processed output affine on the current subspace. For a non-affine conjunction with a nonconstant internal predecessor, one affine equation fixes that predecessor to a controlling value and makes both gates permanently constant. If every internal predecessor is constant, a non-affine conjunction must have at least two distinct primary inputs; charge one equation to this gate and its \(h_2\) mark. Thus each equation is paid for by two newly constant gates or by one such gate and one mark. A final equation fixes the designated output if necessary. The coset obstruction gives \(|S|{\lt}K\), yielding the displayed gate inequality.
Write \(H_2(p)=-p\log _2p-(1-p)\log _2(1-p)\) and define
When \(k+3\le n\), the factor \(\alpha (n,k)\) is the probability that two designated distinct primary variables both lie on a uniformly chosen sending side of size \(n-k-1\). The constant \(c\) measures the information saving from a Boolean message whose probability of being true is at most one quarter.
Let a signed unbounded AND/OR/XOR circuit with \(g\) gates compute a \(K\)-flat sumset disperser on \(n\) inputs. Assume \(K{\gt}0\), set \(k=\lceil \log _2K\rceil \), and suppose \(k+3\le n\). With \(\delta =c\alpha (n,k)\), its gate count satisfies
The sender supplies one partial parity or signed-conjunction bit per gate, with one extra bit for a possible primary output; the receiver reconstructs the circuit. Giving the receiver \(k+1\) coordinates makes every message fibre smaller than \(K\) by two-sided rectangle-freeness. Designate a pair of distinct primary variables at each of the \(h_2\) gates. Averaging retains at least \(\alpha (n,k)h_2\) pairs on the sending side, each giving a quarter-biased message. Weighted counting, without assuming independence of message coordinates, gives \(g\ge n-k-2-\log _2K+\delta h_2\). Combine this with \(g+h_2\ge 2n-2k\) from affine pairing.
For every \(\varepsilon {\gt}0\) and all sufficiently large \(n\), every signed unbounded AND/OR/XOR circuit computing the fixed polynomial-time family \(\mathrm{sourceReductionHardFamily}(n)\) has more than \((\gamma -\varepsilon )n\) gates, where \(1{\lt}\gamma {\lt}2\) is the exact coefficient above. There is no sparsity, depth, fanout, or fan-in hypothesis. This theorem concerns the signed affine/conjunction basis, not all finite-monoid gates.
The family’s sumset threshold has \(\log _2K(n)=o(n)\), hence \(k=o(n)\) and \(\alpha (n,k)\to 1\). Divide the finite inequality by \((1+\delta )n\) and absorb its sublinear remainder in \(\varepsilon \). The argument combines affine restrictions in the tradition of Demenkov–Kulikov with communication accounting in the tradition of Roychowdhury–Orlitsky–Siu. Formal verification establishes the stated model and bound; historical priority and the strongest previously published coefficient for this exact basis remain unresolved.
With binary entropy measured in bits, set
Here \(\beta {\gt}0\) charges distinct primary variables, while \(\rho {\gt}0\) is the gate saving in the joint message bound.
Let \(A_1,A_2\) be signed conjunctions on two distinct primary coordinates each, with intersecting supports, under uniform independent primary bits. Suppose Boolean features \(Y_i\) satisfy \(Y_i\le A_i\) pointwise. The features may otherwise depend arbitrarily on all primary coordinates. There is a normalized finite weight certificate for \((Y_1,Y_2)\) of natural-log cost
The saving \(2H(1/4,3/4)-J\) is strictly positive. Constant false features are allowed, so this is not a positive lower bound on mutual information.
For compatible literal patterns, use weights \((5/8,1/8,1/8,1/8)\) in the order \((00,01,10,11)\). For incompatible patterns, use \((1/2,1/4,1/4,0)\), whose cost is at most \(J\). Exact two- and three-bit truth tables cover equal supports and one-coordinate intersections. Both weights increase when either Boolean coordinate changes from true to false. Replacing \(A_i\) by any dominated \(Y_i\) therefore preserves the average logarithmic weight bound, even when the extra predicates depend on every primary bit. The strict saving reduces to \(3^{12}{\lt}2^8 5^5\).
Let a signed unbounded AND/OR/XOR circuit compute a \(K\)-flat sumset disperser, where \(K{\gt}0\), \(k=\lceil \log _2K\rceil \), and \(k+3\le n\). With \(d=\rho \alpha (n,k)\), its gate count satisfies
For \(m\) signed two-variable conjunctions using \(v\) primary variables, a normalized joint message weight has average coding cost at most \(m(3/2-h)+\beta v\) bits. Insert the support-graph edges in any order: an edge with zero, one, or two previously used endpoints costs at most \(h\), \(3/4\), or \(3/2-h\) bits respectively. Conditional tables on at most four independent bits establish all signed cases, including parallel edges and triangles. Contradictory conjunctions have constant summaries; summaries using at least three variables cost at most \(H_2(1/8)\le 3/2-h\). Thus the actual sending-side message costs at most \(g+1-\rho m+\beta (n-k-1)\) bits. Pair averaging retains \(m\ge \alpha (n,k)h_2\), while rectangle freeness bounds every message fibre. Combine the resulting inequality with \(g+h_2\ge 2n-2k\).
For every \(\varepsilon {\gt}0\), all sufficiently large input lengths require more than \((C_*-\varepsilon )n\) signed unbounded AND/OR/XOR gates to compute the same fixed polynomial-time Boolean family. The exact constant \(C_*\) is strictly larger than the previous separate-coordinate coefficient \(\gamma \). There are no depth, fanout, fan-in, placement, or sparsity restrictions.
The existing family’s logarithmic threshold is sublinear, so \(k=o(n)\) and \(\alpha (n,k)\to 1\). Normalize the finite inequality and absorb the vanishing remainder. The limiting ratio is \((1-\beta +2\rho )/(1+\rho )=C_*\). The strict improvement is equivalent to \(h(h-3/4){\gt}0\), established by exact logarithmic inequalities.
Choose a maximal gate-disjoint pairing of intersecting two-primary supports. If it contains \(p\) pairs, the remaining supports are disjoint, so \(2t\le n+4p\). Fix one common primary coordinate per pair when necessary. Each independent equation makes a distinct gate constant, and both primary products in the pair become affine. Run the affine restriction procedure from this initial flat, subtracting the initially constant gates from its charge. It yields \(2n+p\le g+h_2+2\lceil \log _2K\rceil \). Eliminate \(p\) with the matching inequality.
Keep separate information costs for exact-two-primary gates and gates using at least three primary variables. The latter cost at most \(H_2(1/8)\) bits each. Averaging a chosen triple for each gate retains a common fraction tending to one when Bob receives \(\lceil \log _2K\rceil +1=o(n)\) coordinates. Combine this finite information inequality with both the original affine count and the shared-control count. Exact logarithmic comparisons give positive multipliers eliminating both gate classes. Normalize by \(n\); the threshold losses vanish.
Let \(s\) signed two-variable conjunctions have pairwise disjoint endpoints among \(a\) Boolean coordinates. The number of inputs on which every conjunction is false equals
Each pair has exactly three false assignments. Disjoint endpoints identify the majority event with the product of these three-element choices and the unrestricted assignments on the unused coordinates.
Let a finite message map from these \(a\) input coordinates to an alphabet \(Y\) have fibres of size at most \(K{\gt}0\) on the majority event. Then
In particular, an \(r\)-bit residual message has \(\log _2|Y|=r\). Removing message coordinates that are fixed on the event preserves the original full-message fibre bound.
Partition the majority event by its residual messages and compare its exact cardinality with \(|Y|K\). Take base-two logarithms. The residual messages need not be independent.
Put \(c=1-H_2(1/4)\), \(r=1-H_2(1/8)\), \(\rho =H_2(1/4)-1/2\), and \(\beta =H_2(1/4)-3/4\). Define
The scalar and inversion constants are the exact ratios
with inversion penalty \(P_{\mathrm I}=4r/D_{\mathrm i}\). Their decimal approximations are \(C_{\mathrm F}\approx 1.2364849888\), \(C_{\mathrm I}\approx 1.5644077959\), and \(P_{\mathrm I}\approx 0.5640721944\).
The four constants \(\gamma _{\mathrm F},\ell ,\mu ,\nu \) are positive, and
Exact logarithmic comparisons give \(c{\lt}r/2{\lt}\rho \); the first follows from \(3^{12}{\lt}7^7\). The identities are field arithmetic with positive denominators.
For every \(\varepsilon {\gt}0\), every sufficiently large member of the same fixed polynomial-time Boolean family requires more than \((C_{\mathrm F}-\varepsilon )n\) gates over the whole signed unbounded AND/OR/XOR basis. Depth, fan-in, fanout, repetitions, and gate placement are unrestricted. The earlier scalar coefficients remain separate proved results.
Use one maximal primary-support pairing in all inequalities. The unpaired exact-two supports are disjoint. Their majority event saves \(\gamma _{\mathrm F}\) bits per retained support, while each coordinate given to the receiver destroys at most one such support. Combine marginal entropy, joint entropy, majority counting, and shared-control affine geometry with weights \(\mu ,\nu ,\ell ,r\), retaining the finite cut-retention factors. The gate-class counts cancel. Normalize by \(n\) and use \(\log _2K(n)=o(n)\).
Let an \(n\)-input, \(n\)-output signed unbounded AND/OR/XOR circuit compute a permutation whose coordinates are not primary projections. Suppose every affine flat on which all output coordinates are affine has size at most \(2^r\). Then its gate count satisfies
Bijectivity makes the output coordinates distinct and balanced. A conjunction gate reading two distinct primary inputs has one output fibre of size at most \(2^{n-2}\), so it cannot be a balanced output. Thus the \(n\) distinct output gates lie outside the \(h_2\) gates, giving \(g\ge n+h_2\). The affine restriction invariant before fixing an output gives \(g+h_2\ge 2n-2r\). Add the inequalities.
The affine functions of the primary input bits form a submodule of all \(\mathbf F_2\)-valued functions. A Boolean map has independent nonaffine components when every nonzero linear combination of its output coordinates lies outside this submodule. Write \(q\) for the number of conjunction operations in a signed unbounded AND/OR/XOR circuit.
A circuit with \(m\) independent nonaffine output components contains at least \(m\) conjunction gates. Gate arity, depth, fanout, and reuse of nonlinear intermediate functions are unrestricted.
Pass to the vector space of functions modulo the affine primary functions. Every affine gate is a linear combination of earlier gate values in this quotient. Induction on the actual acyclic program therefore places all output classes in the span of the \(q\) conjunction classes. Independence gives \(m\le q\).
Let \(K\) be a binary field and fix a linear isomorphism \(e:\mathbf F_2^n\longrightarrow K\). The Boolean map \(I_e\) encodes its input using \(e\), takes the multiplicative inverse in \(K\) with \(0^{-1}=0\), and decodes all \(n\) output bits in the same basis.
For every \(n\ge 3\) and every linear coordinate basis, any signed unbounded AND/OR/XOR circuit computing all \(n\) output bits of \(I_e\) satisfies
Depth, fan-in, and fanout are unrestricted, and each scalar Boolean gate costs one. There is no supplied hardness hypothesis.
Inversion is a permutation. The reciprocal ternary identity in characteristic two shows that every simultaneous affine restriction has at most four points. A nonzero additive defect, scaled by arbitrary field elements, shows that no nonzero additive component of inversion can be additive when \(|K|{\gt}4\); in particular no output is a primary projection. Apply the preceding theorem with \(r=2\). The reciprocal identity is a special case of the nonvanishing affine-subspace sums studied by Claude Carlet, On the vector subspaces of \(\mathbf F_{2^n}\) over which the multiplicative inverse function sums to zero (2024), doi:10.1007/s10623-024-01531-6. The circuit deduction is formalized here; historical priority is not asserted.
Put \(c=1-H_2(1/4)\). Under the same assumptions as the inversion theorem,
The leading coefficient is \(1.54311234736\ldots {\gt}3/2\); the additive penalty is \(0.34489877887\ldots \). The field, basis, and circuit assumptions are unchanged.
The scaling-defect argument excludes every affine nonzero output component, so the nonlinear-generator count is at least \(n\). Let \(o\) count conjunction output gates. Distinct outputs imply \(g\ge 2n-o\). A balanced conjunction with a primary literal must equal a signed primary literal; thus all \(o\) conjunction outputs have constant primary summaries. The full primary-message vector is injective, and the \(h_2\) marked summaries are quarter-biased, giving \(n\le g-o-ch_2\). Hence \(2g\ge 3n+ch_2\). Combine with \(g+h_2\ge 2n-4\) and divide by \(2+c{\gt}0\).
Let \(K\) be a finite field over \(\mathbf F_2\) with a supplied linear isomorphism \(e:\mathbf F_2^n\longrightarrow K\), where \(n\ge 3\). Every signed unbounded AND/OR/XOR circuit computing all \(n\) coordinates of inversion \(I_e\), with \(0^{-1}=0\), satisfies
Here \(C_{\mathrm I}\approx 1.5644077959\) and \(P_{\mathrm I}\approx 0.5640721944\); the exact constants are the logarithmic ratios defined above. Depth, fan-in, fanout, repeated literals, and nonlinear reuse are unrestricted. All target hardness properties are proved; no uniform field/basis construction or evaluator complexity is asserted by this theorem.
In a nonliteral permutation, conjunction output summaries are constant true and the full primary message is injective. Remove these output coordinates and the constant false coordinates of the disjoint majority event. With \(o\) conjunction outputs and \(t-2p\) unmatched gates, this gives \(n+\gamma _{\mathrm F}(t-2p)\le g-o\). Independent nonaffine output components and distinct designated outputs give \(2n\le g+o\). Combine these with both entropy bounds and the shared affine restriction. Inversion has at most four points in every simultaneous affine-output flat, giving the exact finite penalty \(4r/D_{\mathrm i}\).
On the uniform distribution on a product of disjoint three-point majority fibers and unrestricted remaining coordinates, an assignment to any \(d\) distinct coordinates has probability at most \((2/3)^d\). Consequently a conjunction of two or at least three distinct prescribed coordinates has entropy at most \(H_2(4/9)\) or \(H_2(8/27)\), respectively. For a message with fibers of size at most \(K\), the logarithm of the domain size is at most its entropy bound plus \(\log _2 K\).
Count the compatible choices on each disjoint pair: prescribing one coordinate retains at most two of its three choices, and prescribing both retains at most one. Multiply these bounds over the product. Binary entropy is increasing up to \(1/2\); entropy subadditivity bounds the whole message without assuming independent summaries.
Set \(\eta _2=1-H_2(4/9)\), \(\eta _3=1-H_2(8/27)\), \(\gamma =\log _2(3/2)\), \(c=1-H_2(1/4)\), and \(r=1-H_2(1/8)\). Put
The new exact coefficients and finite penalty are
The same fixed polynomial-time scalar family requires more than \((C-\varepsilon )n\) signed unbounded AND/OR/XOR gates eventually, for every \(\varepsilon {\gt}0\). All coordinates of binary-field inversion in every supplied linear basis require at least \(In-P\) gates when \(n\ge 3\). The depth, fan-in, fanout, and gate-placement assumptions are unchanged. The earlier inversion inequality remains useful because its additive penalty is smaller.
Use the same maximal pairing for the affine restriction and the majority event. If \(t\) counts narrow summaries, \(w\) counts wide summaries, and \(u\) counts unpaired narrow summaries, the new scalar leading inequality is \(n+(\gamma -\eta _2)u+\eta _2t+\eta _3w\le g+o(n)\). The finite theorem retains receiver-cut losses explicitly. Combine it with the marginal and joint entropy inequalities and the shared affine geometry; the positive interpolation weights cancel all three gate-class counts. For inversion, output-component independence replaces the leading \(n,g\) by \(3n,2g\), and the four-point affine obstruction supplies the penalty \(P\).
Every output of a signed unbounded AND/OR/XOR circuit is an affine function of the primary bits plus a linear combination of its actual conjunction gate outputs. Suppose the circuit computes all coordinates of inversion in any supplied binary-field basis. Let \(N\) count conjunction gates and let \(m\) count those reading at least two distinct primary coordinates. With \(c=1-H_2(1/4)\),
No independence, fan-in, fanout, depth, or nonlinear-reuse restriction is imposed.
Apply the gate-span induction to the sum of the affine subspace and the range of the linear-combination map on actual conjunction functions. Assemble the output representations in the field basis to obtain \(I(x)+Ax+a=D(h(x))\). Inversion’s classical differential-uniformity bound gives at most \(q+4(q-1)\) ordered collisions for this affine residual, with \(q=2^n\). Equality of feature vectors implies equality of residuals, so their average fibre size is at most five. The weighted logarithmic collision inequality charges every quarter-biased feature. Each of the \(m\) marked actual conjunction outputs has a rare Boolean value occurring on at most one quarter of the cube, even with repeated or internal wires.
Let \(K\) be a finite field over \(\mathbf F_2\) with a supplied linear isomorphism \(e:\mathbf F_2^n\longrightarrow K\), where \(n\ge 3\). Every signed unbounded AND/OR/XOR circuit computing all inversion coordinates satisfies
Equivalently, its gate count is at least \(1.5793801642\ldots n-1.6116903280\ldots \). This gives a larger leading coefficient than the majority-fibre bound; both finite inequalities remain available with their different penalties.
Let \(o\) count conjunction output gates. Distinct designated outputs give \(n+N\le g+o\), while their constant primary summaries and the biased internal summaries give \(n\le g-o-cm\). Hence \(2g\ge 2n+N+cm\ge 3n+2cm-\log _2 5\). The affine-restriction inequality \(2n\le g+m+4\) eliminates \(m\). Divide by \(2+2c{\gt}0\) for the normalized gate bound.
A function \(f:\mathbf F_2^n\to \mathbf F_2\) is affine on an affine flat \(V\) when \(f(x+y+z)=f(x)+f(y)+f(z)\) for all \(x,y,z\in V\); its values off \(V\) are unrestricted, and these functions form a subspace. A map \(F:\mathbf F_2^n\to \mathbf F_2^m\) is nonaffine on flats of \(2^D\) points when no nonzero component \(w\cdot F\) is affine on a flat with at least \(2^D\) points. The least such \(D\) is \(D(F)=A(F)+1\), where \(A(F)\) is the largest dimension of an affine flat on which some nonzero component of \(F\) is affine.
Let \(F:\mathbf F_2^n\to \mathbf F_2^m\) with \(m\ge 1\) be nonaffine on flats of \(2^D\) points, where \(D\le n\). Every signed unbounded AND/OR/XOR circuit computing \(F\) has at least
conjunction gates. Affine (XOR) gates of every fan-in are not counted, so this also bounds the number of unbounded-fan-in AND/OR gates in circuits with free XOR. Conjunction fan-in, fanout, depth, literal repetitions, and reuse of nonlinear values are unrestricted.
Process the gates in program order while maintaining an affine flat \(V\) on which every earlier gate is affine. While \(|V|{\gt}2^D\), a conjunction with a literal constant at its controlling value is already constant; otherwise fix one nonconstant (affine) literal to its controlling value, which halves \(V\) and makes the gate constant; if all literals are constant at the other value the gate is constant too. XOR gates of affine functions stay affine. Once \(|V|=2^D\), every later conjunction contributes one generator, and every gate lies in the functions affine on \(V\) plus the span of these generators. If \(V\) never shrinks to \(2^D\) points then all outputs are affine on a flat of more than \(2^D\) points, which is impossible for \(m\ge 1\). Otherwise at least \(n-D\) conjunctions were used for restrictions, and the \(m\) outputs are independent modulo functions affine on \(V\), so at least \(m\) generators remain.
Let \(K\) be a binary field and fix a linear isomorphism \(e:\mathbf F_2^n\longrightarrow K\). The Boolean map \(G_e\) encodes its input using \(e\), cubes it in \(K\), and decodes all \(n\) output bits in the same basis.
Let \(n\) be odd. Then \(G_e\) is a permutation, all of its output bits are simultaneously affine only on flats of at most two points, and every nonzero component of \(G_e\) is affine only on flats of dimension at most \((n+1)/2\): \(G_e\) is nonaffine on flats of \(2^{(n+3)/2}\) points. For \(n\ge 3\) no output bit is a signed primary literal.
Since \(n\) is odd, \(3\) is coprime to \(2^n-1\), so cubing is injective. In characteristic two, \((a+b+c)^3=a^3+b^3+c^3+(a+b)(b+c)(c+a)\), so cubing preserves ternary sums only on sets with at most two points. A component \(\ell (x^3)\) is affine on \(a+U\) exactly when \(U\) is totally isotropic for the alternating form \(B(u,w)=\ell (u^2w+uw^2)\). A nonzero radical vector \(u\) satisfies \(\ell (r)=\ell (r^2/u^3)\) for every \(r\); since every element is a square and \(\ell \ne 0\), this determines \(u^3\), so the radical has dimension at most one. The dimension formula for orthogonal complements then gives \(2\dim U\le n+1\). The trace form is not used. The almost perfect nonlinearity of the Gold map is classical (R. Gold, IEEE Trans. Inform. Theory 14 (1968); see also C. Carlet, Vectorial Boolean Functions for Cryptography, Section 3.1).
With \(c=1-H_2(1/4)\), put \(C_{\mathrm G}=(7+4c)/(4+2c)\approx 1.771556\) and \(P_{\mathrm G}=(3+4c)/(4+2c)\approx 0.857781\).
Let \(K\) be a finite field over \(\mathbf F_2\) with a supplied linear isomorphism \(e:\mathbf F_2^n\longrightarrow K\), where \(n\ge 3\) is odd. Every signed unbounded AND/OR/XOR circuit computing all \(n\) coordinates of \(G_e\) has at least \((3n-3)/2\) conjunction gates, and its gate count \(g\) satisfies, with \(c=1-H_2(1/4)\),
For every \(\varepsilon {\gt}0\) all sufficiently large odd \(n\) require more than \((C_{\mathrm G}-\varepsilon )n\) gates, uniformly over fields and bases. Depth, fan-in, fanout, literal repetitions, and nonlinear reuse are unrestricted. For comparison, the bound proved here for binary-field inversion in the same model has leading coefficient about \(1.5659\) (Theorem 843). In the fan-in-two basis with free XOR, Boyar and Find (Theoretical Computer Science, 2018) give an explicit \((n,n)\) map needing \(2n-3\) AND gates. The literature search behind this result found no explicit \((n,n)\) map known to need more than \(n\) unbounded-fan-in AND gates when XOR is free; the conjunction bound here exceeds \(n\) for \(n\ge 5\).
Theorem 847 with \(m=n\) and \(D=(n+3)/2\) gives \(h\ge (3n-3)/2\) conjunctions. Let \(o\) count conjunction output gates and \(h_2\) the multiple-primary conjunctions. Distinct outputs give \(n+h\le g+o\), biased primary messages give \(n\le g-o-ch_2\), and affine pairing with two-point flats (\(r=1\)) gives \(2n\le g+h_2+2\). Eliminating \(o\) and \(h_2\) leaves \((2+c)g\ge (2+2c)n+h-2c\); substitute the conjunction bound and divide by \(4+2c{\gt}0\).
For \(x\in \mathbf F_2^n\), let \(w_3(x)\in \mathbf F_3\) be its Hamming weight modulo three, interpreting each binary coordinate as zero or one. This is the full three-valued residue, not a Boolean residue predicate.
If \(w_3\) is constant on an affine flat \(a+V\subseteq \mathbf F_2^n\), then \(2\dim V\le n\). Consequently, for any \(q\) binary linear equations and any coordinate block \(B\) with \(|B|{\gt}2q\), there is a homogeneous solution supported in \(B\) that changes the residue at any prescribed base point.
Write the affine coordinates as \(a_i+\ell _i(u)\). Over \(\mathbf F_3\), their sign characters are linearly independent when the linear forms are distinct. Constant full residue forces the signed multiplicity of each nonzero form to vanish, so every such form occurs at least twice. Injectivity requires at least \(\dim V\) distinct nonzero forms. For the supported conclusion, restrict the equations to \(B\) and apply rank–nullity.
For every linear map \(R:\mathbf F_2^n\to \mathbf F_2^q\) and every base point \(a\), put \(r=\lfloor n/(2q+1)\rfloor \). There are an injective linear map \(L:\mathbf F_2^r\to \mathbf F_2^n\) and signs \(\delta _j\in \{ 1,-1\} \) such that \(RL=0\) and, for every \(z\in \mathbf F_2^r\),
with each \(z_j\) interpreted as zero or one.
Partition \(r(2q+1)\) coordinates into \(r\) disjoint blocks. The preceding theorem supplies a residue-changing kernel direction in every block. Their disjoint supports give injectivity and additive residue changes. Every nonzero element of \(\mathbf F_3\) is \(1\) or \(-1\).
The geometric statements above are checked ingredients for a restricted-circuit research direction. Circuit freezing, probabilistic polynomial approximation, and the Razborov–Smolensky degree lower bound are not formalized by these nodes; no superlinear unrestricted circuit theorem follows from them alone.
This result is conditional on the open band hypothesis of Definition 781. Let \(c{\gt}0\) and assume \(\mathrm{BandSubcritical}(q,R,c)\) for every decay rate \(0\le q{\lt}1/\sqrt2\) and every radius \(R\), and let \(p=\tfrac {3}{2\pi }\arccos \tfrac {1+2\sqrt2}{4}\). Then for every \(\eta {\gt}0\) some \(C\) satisfies \(\mathrm{OrderingBound}(2e^{-c^2/2}p,\eta ,C)\), and for every \(\varepsilon {\gt}0\) and all sufficiently large \(n\), every circuit computing \(\mathrm{sourceReductionHardFamily}(n)\) over the full binary basis has more than \(\bigl(1+1/(2e^{-c^2/2}p)-\varepsilon \bigr)n\) gates, with \(n\) the full input length. If the hypothesis holds at \(c=4/25\), the ordering coefficient is at most \(5/18\) and every such circuit has more than \((23/5-\varepsilon )n\) gates.
Call \(f\) \((K, \nu )\)-balanced when on every rectangle with both sides of size at least \(K\), under every split of the coordinates, the fraction of accepting inputs lies within \(\nu \) of one half (a sumset extractor with polynomial threshold \(K\) and error \(\nu \) is balanced at that threshold). For every \(\nu \ge 0\), every family \(f_n\) that is \((K_n, \nu )\)-balanced with \(K_n \le n^c\), every \(\varepsilon {\gt} 0\), and all large \(n\), every circuit with at most \((4 - \varepsilon )n\) binary gates agrees with \(f_n\) on at most \((1/2 + 3\nu )\, 2^n + 2^{(1 - \varepsilon /24)n}\) inputs.
The worst-case count gives nothing here, since an input whose past set is still small at a vertex lies in a thin rectangle on which a balanced function is unconstrained. Instead the direction of the wiring graph is used: at a cut, the forward-crossing bits are determined by the inputs read so far together with the backward-crossing bits, and symmetrically for the future. This caps the number of cut assignments a fixed past or future can see, so the thin-rectangle mass at a prefix \(L\) is at most \((K - 1)(2^{n - a(L)} + 2^{n - c(L)})\) with \(a(L)\) the inputs read minus the forward cut and \(c(L)\) the inputs unread minus the backward cut. Along the vertex order \(a\) grows by at most four per step and \(a + c\) is \(n\) minus the cut, so a prefix with both \(a\) and \(c\) linear exists whenever the cutwidth is below \((1 - \Omega (\varepsilon ))n\). Circuits reading few inputs are constant on subcubes, which balance handles directly.
Split the wires of a straight-line program, its inputs and its gates, into a set \(S\) and its complement \(\bar S\), and let \(i\) be the number of inputs in \(S\). The forward signals \(A\) are the wires in \(S\) read by some gate in \(\bar S\), and the backward signals \(B\) are the wires in \(\bar S\) read by some gate in \(S\). A signal is the value of one wire, counted once however many gates read it. The boundary key of an input \(x\) is the pair \((a, b)\) of the values of the signals in \(A\) and in \(B\). Mixing \(x\) and \(x'\) takes the coordinates of \(x\) whose input wires lie in \(S\) and the remaining coordinates of \(x'\). For a set \(Z\) of inputs and a key \(\sigma \), the left and right parts \(L_\sigma \) and \(R_\sigma \) are the restrictions of the members of \(Z\) with key \(\sigma \) to the inputs in \(S\) and in \(\bar S\).
Fix a program over any signature, with values in any type \(U\), and any number of outputs. If \(x\) and \(x'\) have the same boundary key, the mixed input takes the values of \(x\) on every wire of \(S\) and those of \(x'\) on every wire of \(\bar S\). The inputs in \(S\) and the values on \(B\) determine the values on all of \(S\); symmetrically, the inputs in \(\bar S\) and the values on \(A\) determine the values on all of \(\bar S\). Consequently, if \(Z\) is closed under mixing inputs with equal keys, then the members of \(Z\) with key \(\sigma \) correspond bijectively to \(L_\sigma \times R_\sigma \); for a fixed \(b\) the sets \(L_{(a, b)}\) are pairwise disjoint, so \(\sum _\sigma |L_\sigma | \le |U|^{i + |B|}\), and symmetrically \(\sum _\sigma |R_\sigma | \le |U|^{n - i + |A|}\). There are at most \(|U|^{|A| + |B|}\) keys.
Induct over the wires in program order. A gate in \(S\) reads wires of \(S\), where the values agree by induction, and backward signals, whose values are part of the key; a gate in \(\bar S\) is symmetric. Restricting to the inputs in \(S\) and in \(\bar S\) is injective, and mixing shows that every pair of a left part and a right part of key \(\sigma \) is realized. Two inputs with the same left part and the same \(b\) have the same \(a\) by determination, which gives the disjointness.
Let a single-output circuit over any basis with Boolean values compute a \(K\)-rectangle-free function \(f\) on \(n\) inputs (as in Theorem 363). Then for every split of its wires into \(S\) and \(\bar S\),
The accepted inputs are closed under mixing inputs with equal keys, because the output wire lies on one side and the mixed input copies that side. So the accepted inputs with key \(\sigma \) form the one-rectangle \(L_\sigma \times R_\sigma \), one of whose sides has fewer than \(K\) elements; hence it has at most \((K - 1)(|L_\sigma | + |R_\sigma |)\) points. Summing over \(\sigma \) and applying the partition bounds of Lemma 858 gives the bound. A rectangle-free threshold is positive, which gives the strict form.
If moreover \(f\) has at least \(2^{n - 2}\) accepting inputs, then every split satisfies \(n \le \max (i + |B|, n - i + |A|) + \lceil \log _2 K \rceil + 2\), and hence \(\max (i + |B|, n - i + |A|) {\gt} n - \log _2 K - 3\). In particular, for every injective ranking of the wires some prefix, the wires ranked below a threshold, is crossed by at least \(\lfloor n/2 \rfloor - \lceil \log _2 K \rceil - 2\) forward and backward signals.
Bound \(K \le 2^{\lceil \log _2 K \rceil }\) and both powers by \(2^{\max (i + |B|, n - i + |A|)}\) and compare exponents. Adding the wires in rank order changes the number of inputs in the prefix by at most one at a time, so some prefix contains exactly \(\lfloor n/2 \rfloor \) inputs; for it \(\max (i + |B|, n - i + |A|) \le \lceil n/2 \rceil + |A| + |B|\).
Two wires of a straight-line program are linked when one is a gate reading the other; the components of the resulting undirected wire graph are its connected components. For a ranking of the wires, the prefix up to a wire \(w\) consists of the wires ranked at most as high as \(w\). For designated output wires and a split \(S\) of the wires with complement \(T\), let \(X_S\) and \(X_T\) be the inputs placed in \(S\) and in \(T\), and \(Y_S\) and \(Y_T\) the outputs whose wires lie in \(S\) and in \(T\). For a function \(f\) and an input \(x\), the left fibre of \(x\) is the set of inputs that agree with \(x\) on \(X_T\) and on which \(f\) agrees with \(f(x)\) on \(Y_T\); the right fibre is defined symmetrically. For a matrix \(M\), \(M[Y, X]\) is its block with rows \(Y\) and columns \(X\).
Let a straight-line program over any signature, with any value type and any designated outputs, have \(n\) inputs, \(s\) gates, and fan-in at most two, and suppose \(\mathrm{OrderingBound}(A,\eta ,C)\) with \(A+\eta \ge 0\). Then some injective ranking of the wires, with ranks below \(n+s\), has the following property: for every wire \(w\), the prefix up to \(w\) is crossed by at most
forward and backward signals, where \(g\) and \(i\) are the numbers of gates and inputs in the component of \(w\). If the wire graph is connected, every prefix is crossed by at most \((A+\eta )\max \{ s-n,0\} +3\log _2(n+3s)+C\) signals.
For each component, build the subcubic wire graph: a vertex per wire, and \(f-1\) copy vertices routing a signal read by \(f\ge 2\) argument slots, with the slots and the copy edges as edges. It is loopless, of maximum degree three, and connected, and its edge excess is at most \(g-i\); apply the ordering hypothesis and order the wires of the component by their vertices. The edges carrying one signal form a tree joining its wire to every gate reading it, so a signal crossing a split of the wires crosses the corresponding cut with an edge of its own, and distinct signals use distinct edges. Lay out the components one after another. A component is closed under reading, so earlier components contribute no crossing signals, and the prefix up to \(w\) is charged to a lower-set cut of the wire graph of the component of \(w\).
Let a circuit over any signature with values in a finite set \(U\) compute \(f\colon U^n\to U^m\). If, for a split \(S\) with forward signals \(A\) and backward signals \(B\), every left fibre has at most \(D_T\) elements and every right fibre at most \(D_S\), then \(|U|^n\le |U|^{|A|+|B|}D_TD_S\). In particular, if a circuit with values in a finite field computes the linear map \(x\mapsto Mx\), with arbitrary gate functions, then every split satisfies
Each side is bounded separately: \(|U|^{|X_S|}\le |U|^{|A|}D_T\) and \(|U|^{|X_T|}\le |U|^{|B|}D_S\), so \(\operatorname {rank} M[Y_T,X_S]\le |A|\) and \(\operatorname {rank} M[Y_S,X_T]\le |B|\).
The inputs with a fixed boundary key form a product \(L\times R\) of left and right parts (Lemma 858). Mixing a member of the fibre into a fixed member \(x_0\) on \(X_T\) keeps the outputs in \(Y_T\), so \(L\) embeds into the left fibre of \(x_0\), and symmetrically \(R\) embeds into its right fibre; sum over the at most \(|U|^{|A|+|B|}\) keys. For a linear map, a left fibre minus its base point lies in the kernel of \(M[Y_T,X_S]\), which has \(|F|^{|X_S|-r_1}\) elements; symmetrically for right fibres, and comparing exponents gives \(r_1+r_2\le |A|+|B|\). For the one-sided bounds, vary only the inputs in \(X_S\) (respectively \(X_T\)): then only the forward (respectively backward) signals can change.
A matrix over a field is totally regular when every square submatrix is nonsingular. The Cauchy matrix of nodes \(x_i\) and \(y_j\) has entries \(1/(x_i-y_j)\); over \(\mathbb {Z}/q\), the explicit family takes \(x_i=i\) and \(y_j=N+j\) for \(0\le i,j{\lt}N\).
Every block of a totally regular matrix has rank at least the smaller of its dimensions. A Cauchy matrix with distinct \(x_i\), distinct \(y_j\), and \(x_i\ne y_j\) for all \(i\) and \(j\) is totally regular. In particular the explicit family over \(\mathbb {Z}/q\) is totally regular for every prime \(q\ge 2N\).
A block contains a square block of the smaller dimension, which is nonsingular. Every square submatrix of a Cauchy matrix is a Cauchy matrix, so it suffices that a square Cauchy matrix has trivial kernel. If \(\sum _j v_j/(x_i-y_j)=0\) for all \(i\), the Lagrange interpolant through the points \((y_j, v_j/w_j)\), with \(w_j=\prod _{l\ne j}(y_j-y_l)^{-1}\) the barycentric weights, has the first barycentric form \(\prod _l(x-y_l)\sum _j v_j/(x-y_j)\) away from the nodes, so it vanishes at every \(x_i\). Its degree is below the number of nodes, so it is zero, and then every \(v_j\) is zero. For the explicit family the nodes \(0,\dots ,2N-1\) are distinct modulo \(q\).
Let a circuit over a finite field \(F\), over any signature with fan-in at most two (so with arbitrary functions \(F\times F\to F\), unary functions, and constants as gates), compute the linear map of a totally regular \(N\times N\) matrix with \(s\) gates. Under \(\mathrm{OrderingBound}(A,\eta ,C)\) with \(A+\eta \ge 0\),
Consequently, if the ordering hypothesis holds with coefficient \(A{\gt}0\) at every positive slack, then for every \(\varepsilon {\gt}0\) and all large \(N\), independently of the field and the signature, every such circuit has more than \((1+1/A-\varepsilon )N\) gates. With the Gaussian pathwidth coefficient \(p=\tfrac {3}{2\pi }\arccos \tfrac {1+2\sqrt2}{4}\) of Theorem 783 this is \((1+1/(2p)-\varepsilon )N\approx (4.5625-\varepsilon )N\), and as \(2p\le 9/32\) it is more than \((41/9-\varepsilon )N\); in particular for the explicit Cauchy family over \(\mathbb {Z}/q\) with \(q\ge 2N\) prime.
The graph of a circuit computing a totally regular map is a superconcentrator whatever its gate functions (Valiant), so the same bound also follows from Corollary 787. The proof here goes through the rank-cut bound instead, which applies to linear maps that are not totally regular as well.
Distinct outputs lie on distinct wires, since two outputs on one wire would give equal rows and a singular \(2\times 2\) block. The component of an output is closed, so it is crossed by no signal, and the rank-cut bound forces every input and every output into it. Along the ranking of Theorem 862, the number of inputs plus outputs in a prefix grows by at most two per wire, so some prefix ending at an input or output contains \(N\) or \(N+1\) of them; an output carried by an input wire counts twice. For that prefix the two blocks of the rank-cut bound have full rank by Lemma 865, with ranks summing to at least \(N-1\), and the prefix is charged to the component containing all \(N\) inputs and at most \(s\) gates. For the asymptotic form, assume at most \((1+1/A-\varepsilon )N\) gates, choose \(\eta =A^2\varepsilon /2\), and compare: the cycle term is at most \((1-A\varepsilon /2)N\), and the logarithmic term is \(O(\log N)\).
Row submatrices of totally regular matrices are totally regular. Let \(M\) be an \(m\times N\) totally regular matrix over a finite field with \(N\le m\), and let a circuit over any signature with fan-in at most two compute \(x\mapsto Mx\) with \(s\) gates. Under \(\mathrm{OrderingBound}(A,\eta ,C)\) with \(A+\eta \ge 0\),
If the ordering hypothesis holds with coefficient \(A{\gt}0\) at every positive slack, then for every \(\varepsilon {\gt}0\) and all large \(N\), uniformly in \(m\ge N\), the field and the signature, every such circuit has more than \(m+(1/A-\varepsilon )N\) gates; with \(A=2p\) this is \(m+(1/(2p)-\varepsilon )N\), and more than \(m+(32/9-\varepsilon )N\).
For \(N\ge 2\) distinct rows of \(M\) differ (a \(2\times 2\) minor is nonsingular), so the \(m\) outputs lie on distinct wires. Repeatedly delete the last gate, dropping the at most one output it carries together with its row of \(M\). After \(m-N\) steps a circuit with \(s-(m-N)\) gates computes an \(N\times N\) totally regular row submatrix, and Theorem 866 applies.
A local linear realization assigns a row \(v_w\in F^n\) to every original circuit wire. Input \(j\) carries \(e_j\), and each gate row lies in the span of its argument rows. A polynomial interpretation assigns each operation a polynomial in its argument slots, with unrestricted degree and coefficients. The full polynomial signature contains every such finite-arity polynomial.
Over any field, suppose the output rows of a local realization form \(M\). For any wire cut \(S\), its two crossing-signal sets \(A,B\) satisfy
Restrict each exterior wire’s row to the interior input coordinates. Induction along the program puts it in the span of the forward signal rows: exterior inputs restrict to zero, and an interior predecessor of an exterior gate is a forward signal. This span has dimension at most \(|A|\). Apply the same argument to the complementary cut.
For an element \(\omega \) of a field and \(N\in \mathbb {N}\), the Fourier matrix is \(F_N=(\omega ^{rc})_{0\le r,c{\lt}N}\), with rows \(r\) the outputs and columns \(c\) the inputs. When \(\omega \) is a primitive \(N\)-th root of unity, \(x\mapsto F_Nx\) is the \(N\)-point discrete Fourier transform: over \(\mathbb {C}\) with \(\omega =e^{2\pi i/N}\) the classical DFT, for \(N=2^k\) the map computed by the fast Fourier transform, and over \(\mathbb {Z}/q\) with \(N\mid q-1\) a number-theoretic transform.
Let \(M=(x_c^{\, r})_{0\le r,c{\lt}N}\) for distinct nodes \(x_c\) of a field. For every set \(X\) of \(h\) columns with \(2h\le N\) and every set \(Y\) of rows,
In particular, for a primitive \(N\)-th root of unity \(\omega \) the Fourier matrix \(F_N\), with nodes \(\omega ^c\), satisfies this for \(h=\lfloor N/2\rfloor \).
On a set \(C\) of columns, the rows \(r{\lt}|C|\) of \(M\) are linearly independent: a vanishing combination \(\sum _rg_rx_c^{\, r}\) is a polynomial of degree below \(|C|\) with the \(|C|\) distinct roots \(x_c\), \(c\in C\). So \(M[Y^c,X]\) has rank at least the number of rows \(r{\lt}h\) outside \(Y\), and \(M[Y,X^c]\), with \(N-h\ge h\) columns, has rank at least the number of rows \(r{\lt}N-h\) in \(Y\), hence at least the number of rows \(r{\lt}h\) in \(Y\). The two counts add up to \(h\).
Let \(\omega \) be a primitive \(N\)-th root of unity in a field \(F\), for any \(N\). Consider a fan-in-two circuit with \(s\) gates computing \(x\mapsto F_Nx\) which is either linear over \(F\) (it has a local linear realization: each gate computes a linear combination of its arguments, with arbitrary coefficients) or, when \(F\) is finite, has arbitrary gates \(F\times F\to F\). Under \(\mathrm{OrderingBound}(A,\eta ,C)\) with \(A+\eta \ge 0\),
Consequently, if the ordering hypothesis holds with coefficient \(A{\gt}0\) at every positive slack, then for every \(\varepsilon {\gt}0\) and all large \(N\), independently of the field, the root of unity, and the signature, every such circuit has more than \((1+1/(2A)-\varepsilon )N\) gates. With the edge-score coefficient \(A=2p\) this is \((1+\kappa /2-\varepsilon )N\approx (2.78-\varepsilon )N\), with \(\kappa =\pi /(3\arccos \tfrac {1+2\sqrt2}{4})\), and more than \((25/9-\varepsilon )N\). This applies to the complex DFT with \(\omega =e^{2\pi i/N}\), including \(N=2^k\), and to number-theoretic transforms over \(\mathbb {Z}/q\) for a prime \(q\) with \(N\mid q-1\), where a primitive \(N\)-th root of unity exists.
Valiant (1975) observed that a linear circuit computing the Fourier transform is a hyperconcentrator (Definition 794). For prime \(N\) every minor of the complex Fourier matrix is nonsingular (Chebotarëv), so such circuits are superconcentrators, and Lev and Valiant (1983) derived \(4N-o(N)\) additions. For general \(N\) Lokam (Complexity lower bounds using linear algebra, 2009) and Ailon (arXiv:1403.1307) record no superlinear lower bound for unrestricted linear circuits; the bound here is linear.
The Fourier matrix is not totally regular (for \(N=4\), rows and columns \(\{ 0,2\} \) give a singular block), so Theorem 866 does not apply. The rank-cut inequality holds at every split, by Theorem 863 for finite fields and by Lemma 869 for linear circuits. The component of the wire of output \(0\), whose row has no zero entry, is closed and so crossed by no signal; the rank-cut inequality then puts every input into it. Along the ranking of Theorem 862, the number of inputs in a prefix grows by at most one per wire, so the prefix ending at some input holds exactly \(\lfloor N/2\rfloor \) inputs. By Lemma 871 it is crossed by at least \(\lfloor N/2\rfloor \) signals, and it is charged to the component holding all \(N\) inputs and at most \(s\) gates. For the asymptotic form, assume at most \((1+1/(2A)-\varepsilon )N\) gates and choose \(\eta =A^2\varepsilon \): the cycle term is at most \((1/2-A\varepsilon /2)N\), and the logarithmic term is \(O(\log N)\).
A polynomial interpretation gives a local linear realization on the same program. Over an infinite field, if the circuit computes \(x\mapsto Mx\) as a function, its realization’s output rows are exactly the rows of \(M\).
Take the vector of formal partial derivatives at zero of every wire’s polynomial. Polynomial induction and the product rule put each gate vector in the span of its argument vectors, including nonzero constant terms and in every characteristic. Over an infinite field, equality of evaluated output functions identifies their formal polynomials and linear rows.
For every \(\varepsilon {\gt}0\), all sufficiently large \(n\), every field \(F\), and every totally regular \(n\times n\) matrix \(M\), every circuit computing all coordinates of \(Mx\) with polynomial gates of at most two input slots has more than
gates. The threshold is uniform over fields, matrices, signatures, and gate polynomials. Degrees, coefficients, depth, and fanout are unrestricted. Coefficients are included in gate descriptions; explicit nullary gate occurrences count in this theorem’s size.
On infinite fields use the formal realization and its rank-cut bound. On finite fields use the existing cardinality rank-cut theorem. Both feed the same graph-layout proof of \(n-1\le (A+\eta )(s-n)^++3\log _2(n+3s)+C\) and its Gaussian asymptotics. No separate construction of vertex-disjoint paths is needed.
Let \(M_n(i,j)=1/(i-(n+j))\) for \(0\le i,j{\lt}n\). This is one rational matrix family, interpreted over any characteristic-zero field. For every \(\varepsilon {\gt}0\), all sufficiently large \(n\), and every such field, computing \(M_nx\) requires more than \((L-\varepsilon )n\) polynomial gates of fan-in at most two, with \(L=1+\pi /(3\arccos ((1+2\sqrt2)/4))\).
The nodes \(0,\ldots ,n-1\) and \(n,\ldots ,2n-1\) remain distinct in every characteristic-zero field, so all square minors are nonsingular. Apply the polynomial-gate theorem, uniformly over the field and gate basis.
The same eventual lower bound \((L-\varepsilon )n\) holds for the number of additions and multiplications in an arithmetic circuit, with arbitrary constant gates free, computing a totally regular linear map over any field. In particular it holds for the rational Cauchy family over every characteristic-zero field.
Track an original wire as either a literal constant or a retained signal. A constant gate emits no node. Each addition or multiplication emits one binary polynomial gate with its literal constant arguments substituted into the polynomial. Ignored argument slots use an existing input; this requires only \(n{\gt}0\). Every target output is nonconstant, as its matrix row has a nonzero entry. Thus each output is a retained signal, with no final constant gate needed. The compiled size equals the original arithmetic cost exactly; apply the polynomial theorem.
The quadratic form of a square matrix \(M\) is \(x\mapsto x^{\mathsf T}Mx\). Over \(\mathbb {Z}/q\), the \(N\times N\) Hankel Cauchy matrix has entries \(1/(i+j+2)\) for \(0\le i,j{\lt}N\).
Let a circuit over a finite field \(F\), over any signature, compute the quadratic form of an \(N\times N\) matrix \(M\), and let \(H=M+M^{\mathsf T}\). For every split \(S\) of its wires, with complement \(T\), forward signals \(A\), backward signals \(B\), and inputs \(X_S\) and \(X_T\) on the two sides,
The same holds for a circuit with several outputs \(f_o\) when, for some coefficients \(c_o\in F\), the combination \(x\mapsto \sum _o c_of_o(x)\) is the quadratic form of \(M\).
The inputs with a fixed boundary key form a product \(P_S\times P_T\) of left and right parts (Lemma 858). Mixing two members of a class only exchanges the values of a wire on one side of the split, so the mixed second difference \(f(x_S,x_T)-f(x'_S,x_T)-f(x_S,x'_T)+f(x'_S,x'_T)\) of the output vanishes on the class, wherever the output lies. For a quadratic form the pure terms cancel and this difference is the cross term \((x_S-x'_S)^{\mathsf T}H[X_S,X_T](x_T-x'_T)\). So for \(l,l'\in P_S\) and \(r,r'\in P_T\), \((l-l')^{\mathsf T}H[X_S,X_T](r-r')=0\). Let \(V\) have the columns \(r-r_0\) for a fixed \(r_0\in P_T\); then \(P_T\) embeds in the column space of \(V\), the differences \(l-l_0\) lie in the kernel of \((H[X_S,X_T]V)^{\mathsf T}\), and by Sylvester’s rank inequality \(|P_S|\, |P_T|\le |F|^{|X_S|-\operatorname {rank}(H[X_S,X_T]V)+\operatorname {rank}V} \le |F|^{N-\operatorname {rank}H[X_S,X_T]}\). Summing over the at most \(|F|^{|A|+|B|}\) classes gives \(|F|^N\le |F|^{|A|+|B|}\, |F|^{N-\operatorname {rank}H[X_S,X_T]}\). Only the vanishing of the mixed second difference on the classes is used; for a combination of outputs it vanishes for each output wire, hence for the combination.
If \(M\) is symmetric and totally regular and \(2\ne 0\) in the field, then \(M+M^{\mathsf T}\) is totally regular. For a prime \(q{\gt}2N\) the Hankel Cauchy matrix over \(\mathbb {Z}/q\) is the Cauchy matrix with nodes \(x_i=i+1\) and \(y_j=-(j+1)\), so it and its symmetrization are totally regular.
For symmetric \(M\), \(M+M^{\mathsf T}=2M\), and a square block of \(2M\) has determinant \(2^k\) times that of \(M\). The nodes \(x_i\) are distinct, the \(y_j\) are distinct, and \(x_i-y_j=i+j+2\) is nonzero modulo \(q\) since \(0{\lt}i+j+2\le 2N{\lt}q\); as \(q\) is odd, \(2\ne 0\).
Let a circuit over a finite field \(F\), over any signature with fan-in at most two (so with arbitrary functions \(F\times F\to F\), unary functions, and constants as gates, which covers arithmetic circuits over \(F\)), compute with \(s\) gates the quadratic form of an \(N\times N\) matrix \(M\) such that \(M+M^{\mathsf T}\) is totally regular. Under \(\mathrm{OrderingBound}(A,\eta ,C)\) with \(A+\eta \ge 0\),
Consequently, if the ordering hypothesis holds with coefficient \(A{\gt}0\) at every positive slack, then for every \(\varepsilon {\gt}0\) and all large \(N\), independently of the field, the matrix, and the signature, every such circuit has more than \((1+1/(2A)-\varepsilon )N\) gates. With the Gaussian pathwidth coefficient \(p\) of Theorem 783 and \(A=2p\) this is \((1+1/(4p)-\varepsilon )N\approx (2.7812-\varepsilon )N\), and as \(2p\le 9/32\) it is more than \((25/9-\varepsilon )N\); in particular for the quadratic form of the Hankel Cauchy matrix over \(\mathbb {Z}/q\) with \(q{\gt}2N\) prime.
For context, no superlinear lower bound is known for general arithmetic circuits computing an explicit polynomial of constant degree; Ramya and Shastri (arXiv:2509.11322, 2025) prove \(\Omega (n\log n)\) for planar circuits computing totally regular bilinear forms.
The component of an input wire is closed, so it is crossed by no signal, and by the rank-cut bound (Theorem 878) the block of \(M+M^{\mathsf T}\) between its inputs and the other inputs has rank zero; by total regularity the component contains every input. Along the ranking of Theorem 862, the number of inputs in a prefix grows by at most one per wire, so the prefix ending at some input holds exactly \(\lfloor N/2\rfloor \) inputs. Its block has rank at least \(\min \{ \lfloor N/2\rfloor ,\lceil N/2\rceil \} =\lfloor N/2\rfloor \) (Lemma 865), and the prefix is charged to the component containing all \(N\) inputs and at most \(s\) gates. For the asymptotic form, assume at most \((1+1/(2A)-\varepsilon )N\) gates, choose \(\eta =A^2\varepsilon \), and compare with \(\lfloor N/2\rfloor \ge (N-1)/2\): the cycle term is at most \((1/2-A\varepsilon /2)N\), and the logarithmic term is \(O(\log N)\).
Let a circuit with polynomial gates of fan-in at most two over any field, of any degree and with any coefficients, formally compute the quadratic form \(\sum _{i,j}M_{ij}x_ix_j\) of an \(N\times N\) matrix \(M\) such that \(M+M^{\mathsf T}\) is totally regular. Every split of its wires obeys the rank-cut bound \(\operatorname {rank}(M+M^{\mathsf T})[X_S,X_T]\le |A|+|B|\), so the finite and asymptotic bounds of Theorem 880 hold: for every \(\varepsilon {\gt}0\) and all large \(N\), independently of the field, the matrix, and the gate polynomials, the circuit has more than \((1+1/(4p)-\varepsilon )N\ge (25/9-\varepsilon )N\) gates. Over an infinite field the same holds for circuits computing the quadratic function. Over every field of characteristic zero the Hankel Cauchy matrix \((1/(i+j+2))\) and its symmetrization are totally regular, so its quadratic form needs more than \((25/9-\varepsilon )N\) polynomial gates over \(\mathbb {Q}\), \(\mathbb {R}\), or \(\mathbb {C}\).
The Hessian of \(\sum _{i,j}M_{ij}x_ix_j\) is \(M+M^{\mathsf T}\) at every point, so the Hessian consequence of the Taylor cut lemma (Theorem 896) gives the rank-cut bound. The proof of Theorem 880 uses only this bound and the graph ordering. In characteristic zero the Hankel Cauchy matrix is the Cauchy matrix with the distinct nodes \(i+1\) and \(-(j+1)\), whose differences \(i+j+2\) are nonzero (Lemma 865); it is symmetric and \(2\ne 0\).
Let a circuit over any signature with values in a finite set \(U\) compute \(f\colon U^n\to U^m\), and let \(S\) be a split of its wires with forward signals \(A\) and backward signals \(B\). If \(D=D_0\times \dots \times D_{n-1}\) is a coordinatewise product domain, every left fibre taken within \(D\) has at most \(D_T\) elements, and every right fibre within \(D\) at most \(D_S\), then \(|D|\le |U|^{|A|+|B|}D_TD_S\); the same holds for every set of inputs closed under mixing.
Now let \(U\) be a finite abelian group, \(J\) a set of free coordinates and \(z_0\) a base point, and suppose that \(f(z')-f(z)=g(z'-z)\) whenever \(z\) and \(z'\) agree with \(z_0\) outside \(J\). For sets \(P\) of coordinates and \(Q\) of outputs, let \(\ker _g(P,Q)\) be the set of vectors supported on \(P\) whose image under \(g\) vanishes on \(Q\). With \(X_S\) and \(X_T\) the free inputs in \(S\) and outside \(S\), and \(Y_S\) and \(Y_T\) the outputs carried in \(S\) and outside \(S\),
and in fact \(|U|^{|X_S|}\le |U|^{|A|}\, |\ker _g(X_S,Y_T)|\) and \(|U|^{|X_T|}\le |U|^{|B|}\, |\ker _g(X_T,Y_S)|\) separately. For a linear \(g\) this is the rank-cut bound of Theorem 863 restricted to the free inputs. If \(S\) is crossed by no forward signal, \(\ker _g(X_S,Y_T)\) is full: \(g\) maps vectors supported on \(X_S\) to vectors vanishing on \(Y_T\); if it is crossed by no backward signal, \(g\) maps vectors supported on \(X_T\) to vectors vanishing on \(Y_S\). These two facts need no finiteness of \(U\).
The proof of the rank-cut bound only mixes two inputs with equal boundary keys, and the mixture of two members of a product domain lies in it. So the inputs in the domain with a fixed key form a product of left and right parts (Lemma 858), the left parts embed into the left fibre, within the domain, of any member, and summing over the at most \(|U|^{|A|+|B|}\) keys bounds the domain. The inputs agreeing with \(z_0\) outside \(J\) form a product domain with \(|U|^{|J|}\) members, and subtracting the base point maps a left fibre injectively into \(\ker _g(X_S,Y_T)\), and a right fibre into \(\ker _g(X_T,Y_S)\). A kernel has at most \(|U|^{|P|}\) members, and \(|X_S|+|X_T|=|J|\); without crossing signals the bound forces both kernels to have exactly that many.
Let \(K\) be an algebra over \(F\) with a basis \(b_0,\dots ,b_{n-1}\). Multiplication in \(K\), written in coordinates, is the map \(F^{n+n}\to F^n\) sending the coordinates \(x\) and \(y\) of two elements to the coordinates of their product \(\bigl(\sum _i x_ib_i\bigr)\bigl(\sum _j y_jb_j\bigr)\). The first \(n\) inputs are the coordinates of the first factor and the last \(n\) inputs those of the second.
Let \(K\) be a finite field of degree \(n\) over a finite field \(F\), with any basis, and let a circuit over \(F\), over any signature with fan-in at most two (so with arbitrary functions \(F\times F\to F\), unary functions, and constants as gates), compute multiplication in \(K\) in coordinates with \(s\) gates. Every split of its wires holding \(a\) inputs of the first factor and \(n-a\) outputs is crossed by at least \(n-2\) signals, and all inputs and outputs lie in one component of the wire graph. Under \(\mathrm{OrderingBound}(A,\eta ,C)\) with \(A+\eta \ge 0\),
Consequently, if the ordering hypothesis holds with coefficient \(A{\gt}0\) at every positive slack, then for every \(\varepsilon {\gt}0\) and all large \(n\), independently of the fields, the basis, and the signature, every such circuit has more than \((2+1/A-\varepsilon )n\) gates. With the Gaussian pathwidth coefficient \(p\) of Theorem 783 this is \((2+1/(2p)-\varepsilon )n\approx (5.5625-\varepsilon )n\), and as \(2p\le 9/32\) it is more than \((50/9-\varepsilon )n\). In particular, multiplication in \(\mathrm{GF}(2^n)\) over \(\mathrm{GF}(2)\), in any basis, needs more than \((2+1/(2p)-\varepsilon )n\) gates over the full binary basis.
Earlier lower bounds for this multiplication count only the multiplications of bilinear or quadratic algorithms; we know of no earlier bound on the number of gates over the full binary basis. The coefficient is not claimed to be a record for explicit functions with \(2n\) inputs and \(n\) outputs in general.
Fixing the second factor \(y\) makes the map linear in \(x\): it is multiplication by \(y\). By Theorem 882 on the inputs with second factor \(y\), a split \(S\) satisfies \(|F|^n\le |F|^{|A|+|B|}k_1(y)k_2(y)\), where \(k_1(y)\) and \(k_2(y)\) are the sizes of the kernels of the blocks of multiplication by \(y\) with columns \(X_S\) and rows \(Y_T\), and with columns \(X_T\) and rows \(Y_S\). Sum a kernel with columns \(P\) and rows \(Q\) over all \(y\): the zero vector lies in every kernel, and for a nonzero \(u\) the map \(y\mapsto uy\) is a bijection of \(K\), so exactly \(|F|^{n-|Q|}\) values of \(y\) put \(u\) in the kernel. The sum is at most \(|F|^n+|F|^{|P|+n-|Q|}\le 2|F|^n\) when \(|P|\le |Q|\). If \(S\) holds \(a\) inputs of the first factor and \(n-a\) outputs, both blocks have \(|P|=|Q|\), so some \(y\) has \(k_1(y)+k_2(y)\le 4\), hence \(k_1(y)k_2(y)\le 4\le |F|^2\) and \(n\le |A|+|B|+2\).
The component of an output is crossed by no signal, so both kernels are full for every \(y\). Since \(b_j\cdot b_j^{-1}b_i=b_i\), a suitable \(y\) makes any entry of the block nonzero; hence the component holds every input of the first factor and every output, and, fixing \(x\) instead of \(y\), every input of the second factor. The outputs are distinct wires (take \(y=1\)) and none is an input of the first factor (take \(y=0\)), so along the ranking of Theorem 862 the number of first-factor inputs and outputs in a prefix grows by at most one per wire, and some prefix ending at one of them holds exactly \(n\). It is charged to the component holding all \(2n\) inputs and at most \(s\) gates. For the asymptotic form, assume at most \((2+1/A-\varepsilon )n\) gates, choose \(\eta =A^2\varepsilon /2\), and compare: the cycle term is at most \((1-A\varepsilon /2)n\), and the logarithmic term is \(O(\log n)\).
The product \(C=AB\) of two \(n\times n\) matrices over a semiring \(R\) is the map \(R^{n^2+n^2}\to R^{n^2}\) whose output \(C_{ik}\) is \(\sum _jA_{ij}B_{jk}\): the first \(n^2\) inputs hold the entries \(A_{ij}\) of the first factor and the last \(n^2\) inputs the entries \(B_{jk}\) of the second, index pairs numbered row by row. In a circuit computing it, the terminals are the wires of the inputs \(A_{ij}\) and \(B_{jk}\) and the output wires carrying \(C_{ik}\).
The terminals of \(n\times n\) matrix multiplication are the edges of the complete tripartite graph on three copies \(I\), \(J\), \(K\) of \(\{ 0,\dots ,n-1\} \): \(A_{ij}\) joins \(i\) and \(j\), \(B_{jk}\) joins \(j\) and \(k\), and \(C_{ik}\) joins \(i\) and \(k\), so every vertex has degree \(2n\). A set of placed terminals (those whose wires lie in a split \(S\)) places \(d(v)\) terminals at each vertex \(v\). The minority at \(v\) is \(g(d(v))=\min \{ d(v),2n-d(v)\} \), and the charges are \(R_I=\sum _{i\in I}g(d(i))\), \(R_J=\sum _{j\in J}g(d(j))\) and \(R_K=\sum _{k\in K}g(d(k))\). A vertex is heavy when \(d(v)\ge n\) and light otherwise.
For every set of placed terminals, the number \(P\) of terminals with one light and one heavy endpoint satisfies \(P\le R_I+R_J+R_K\). If the number \(h\) of heavy vertices satisfies \(3n\le 2h\le 3n+3\), then
Placing one more terminal adds at most two heavy vertices. Consequently, if \(n\ge 1\) and the \(3n^2\) terminals of a program lie on distinct wires, then along every injective ranking of the wires some prefix of the form \(\{ w : \mathrm{rank}(w)\le \mathrm{rank}(w_0)\} \), with \(w_0\) a terminal, has \(3n\le 2h\le 3n+3\).
Charge a light–heavy terminal to its light endpoint if it is placed and to its heavy endpoint otherwise. At a light vertex \(g(d)=d\) counts its placed terminals, at a heavy vertex \(g(d)=2n-d\) counts its unplaced ones, so every vertex pays for the terminals charged to it. With \(x\), \(y\), \(z\) heavy vertices in \(I\), \(J\), \(K\) and \(h=x+y+z\), \(P=x(n-y)+(n-x)y+y(n-z)+(n-y)z+x(n-z)+(n-x)z=2nh-2(xy+yz+zx)\), and \(3(xy+yz+zx)\le h^2\), so \(3(2P+3-3n^2)\ge 9-(2h-3n)^2\ge 0\). The degrees sum to twice the number of placed terminals, so placing one terminal raises the degrees by two in total and the heavy count by at most two. Along the ranking the heavy count of the prefixes climbs from \(0\) to \(3n\) in steps of at most two; the first prefix with at least \(\lceil 3n/2\rceil \) heavy vertices has at most \(\lceil 3n/2\rceil +1\), and it ends at a terminal, since the heavy count changes there.
Let a circuit over a finite field \(F\), over any signature, compute \(n\times n\) matrix multiplication. Its \(3n^2\) terminals lie on distinct wires, and if \(n\ge 1\) they all lie in the component of the output \(C_{00}\) in the wire graph. Let \(S\) be a set of its wires with forward signals \(A\) and backward signals \(B\), and let \(R_I\), \(R_J\), \(R_K\) be the charges of the terminals placed in \(S\). If \(F\) has a totally regular \(n\times n\) matrix, in particular if \(F=\mathbb {Z}/q\) for a prime \(q\ge 2n\), then
over every finite field, \(R_I,R_J,R_K\le |A|+|B|+4n\). For a circuit with polynomial gates formally computing the product over any field \(K\), \(R_I,R_J,R_K\le |A|+|B|\).
Fix the second factor to a matrix \(B_0\). The product changes by \(\delta A\mapsto \delta A\, B_0\), which is block diagonal over the rows \(i\), and Theorem 882 on these inputs gives \(|F|^{n^2}\le |F|^{|A|+|B|}\prod _i k_1(i)k_2(i)\), where \(k_1(i)\) and \(k_2(i)\) count the left kernels of the blocks of \(B_0\) with rows the placed (respectively unplaced) entries \(A_{ij}\) and columns the unplaced (respectively placed) outputs \(C_{ik}\). With \(a\) and \(c\) placed entries of the two kinds at \(i\), a totally regular \(B_0\) gives these blocks ranks \(\min \{ a,n-c\} \) and \(\min \{ n-a,c\} \), which sum to \(g(a+c)\); so \(R_I\le |A|+|B|\). Fixing the first factor gives \(R_K\) over the columns \(k\). For \(R_J\), the combination \(\sum _{ik}\Lambda _{ik}C_{ik}\) is a quadratic form whose Hessian pairs \(A_{ij}\) with \(B_{jk}\) through \(\Lambda _{ik}\); by Theorem 878 its cross block between the inputs in \(S\) and outside \(S\) has rank at most \(|A|+|B|\), and its kernel is block diagonal over \(j\), with blocks of \(\Lambda \) and \(\Lambda ^{\mathsf T}\) whose ranks again sum to \(g(d(j))\). Over an arbitrary finite field, choose the matrix after \(S\), uniformly at random. For a block with columns \(P\) and rows \(Q\), a nonzero vector supported on \(P\) lies in the kernel for at most an \(|F|^{-|Q|}\) fraction of all matrices, so the kernel sizes average at most twice the ideal size \(|F|^e\), \(e=|P|-\min \{ |P|,|Q|\} \). A kernel of size \(k\) has \(k{\lt}|F|^{d+1}\) with \(d=\lfloor \log _{|F|}k\rfloor \), and its excess exponent \(d+1-e\) is at most \(k/|F|^e\), so the excess averages at most \(2\) for each of the \(2n\) blocks of a part; some matrix has total excess at most \(4n\), which is the loss. The component of \(C_{00}\) is crossed by no signal, so with a matrix unit as the fixed factor the slices separate; the unit vector at \(A_{ij}\) moves \(C_{ik}\) when \(B_0=E_{jk}\), and the unit vector at \(B_{jk}\) moves \(C_{ik}\) when the first factor is \(E_{ij}\), so the component spreads from \(C_{00}\) to every terminal. Distinct terminals differ on a suitable input built from matrix units.
Let a circuit over a finite field \(F\), over any signature with fan-in at most two (so with arbitrary functions \(F\times F\to F\), unary functions, and constants as gates), compute \(n\times n\) matrix multiplication over \(F\) with \(s\) gates. Under \(\mathrm{OrderingBound}(A,\eta ,C)\) with \(A+\eta \ge 0\),
and the left side improves to \((n^2-1)/2\) when \(F\) has a totally regular \(n\times n\) matrix, in particular over \(\mathbb {Z}/q\) for a prime \(q\ge 2n\). Consequently, if the ordering hypothesis holds with coefficient \(A{\gt}0\) at every positive slack, then for every \(\varepsilon {\gt}0\) and all large \(n\), independently of the field and the signature, every such circuit has more than \((2+1/(2A)-\varepsilon )n^2\) gates. With the Gaussian pathwidth coefficient \(p\) of Theorem 783 and \(A=2p\) this is \((2+1/(4p)-\varepsilon )n^2\approx (3.7812-\varepsilon )n^2\), and as \(2p\le 9/32\) it is more than \((34/9-\varepsilon )n^2\). In particular, every circuit over the full binary basis computing the product of two \(n\times n\) matrices over \(\mathrm{GF}(2)\) has more than \((2+1/(4p)-\varepsilon )n^2\) gates.
Lower bounds for matrix multiplication usually count multiplications in arithmetic or bilinear models: Bläser (STACS 2001) proves that \(\tfrac 52n^2-3n\) nonscalar multiplications are needed, and Shpilka (SICOMP 2003) \(3n^2-o(n^2)\) product gates over \(\mathrm{GF}(2)\) for bilinear and quadratic circuits. We know of no earlier bound beyond about \(2n^2\) on the number of gates of circuits with arbitrary fan-in-two gates, or over the full binary basis, computing the matrix product. The coefficient is not claimed to be a record for explicit functions with \(2n^2\) inputs and \(n^2\) outputs in general.
By Theorem 888 the terminals lie on distinct wires in one component. Along the ranking of Theorem 862, take the threshold prefix of Lemma 887: it ends at a terminal and \(3n^2\le 2(R_I+R_J+R_K)+3\). Each charge is at most the number \(w\) of crossing signals plus a loss \(L\) (\(L=0\) with a totally regular matrix, \(L=4n\) in general), so \(w\ge (n^2-2L-1)/2\), and the prefix is charged to the component holding all \(2n^2\) inputs and at most \(s\) gates. For the asymptotic form, assume at most \((2+1/(2A)-\varepsilon )n^2\) gates and choose \(\eta =A^2\varepsilon \): the cycle term is at most \((1/2-A\varepsilon /2)n^2\), while the loss \(4n\) and the logarithmic term \(O(\log n)\) are \(o(n^2)\).
Over a commutative semiring \(K\), the outputs of \(n\times n\) matrix multiplication are the polynomials \(C_{ik}=\sum _jA_{ij}B_{jk}\) in the \(2n^2\) inputs. For sets \(c_Y\), \(a_X\), \(b_X\) of index pairs and a set \(H\) of row indices, the row Jacobian sum is
and for a set \(H\) of column indices the column Jacobian sum is its mirror image
For placed terminals \(a\), \(b\), \(c\) (the pairs \((i,j)\), \((j,k)\), \((i,k)\) whose terminals \(A_{ij}\), \(B_{jk}\), \(C_{ik}\) are placed) with heavy rows \(H_I\) and heavy columns \(H_K\), the row Jacobian charge \(L_I\) is the row Jacobian sum of \((c^{\mathsf c},a,b,H_I)\) plus that of \((c,a^{\mathsf c},b^{\mathsf c},H_I^{\mathsf c})\), and the column Jacobian charge \(L_K\) is the column Jacobian sum of \((c^{\mathsf c},a,b,H_K)\) plus that of \((c,a^{\mathsf c},b^{\mathsf c},H_K^{\mathsf c})\).
Let a circuit with polynomial gates over a field \(K\), of any degree and arity and with any coefficients, formally compute \(n\times n\) matrix multiplication: every output wire carries the polynomial \(C_{ik}=\sum _jA_{ij}B_{jk}\). Its size \(s\) counts the gates; inputs and output designations are free. If \(n\ge 1\), the component of the output \(C_{00}\) contains every input and every output. Let \(S\) be a set of its wires crossed by \(w\) forward and backward signals, and let \(R_J\), \(L_I\), \(L_K\) be the charge of \(J\) and the Jacobian charges of the terminals placed in \(S\). Then
and if the number \(h\) of heavy vertices satisfies \(3n\le 2h\le 3n+3\), then \(15n^2\le 8(R_J+L_I+L_K)+6n+9\). Under \(\mathrm{OrderingBound}(A,\eta ,C)\) with \(A+\eta \ge 0\), a circuit as above with fan-in at most two satisfies
Consequently, if the ordering hypothesis holds with coefficient \(A{\gt}0\) at every positive slack, then for every \(\varepsilon {\gt}0\) and all large \(n\), independently of the field, the signature, and the gate polynomials, every such circuit has more than \((2+5/(8A)-\varepsilon )n^2\) gates. With the Gaussian pathwidth coefficient \(p\) of Theorem 783 and \(A=2p\) this is \((2+5/(16p)-\varepsilon )n^2\approx (4.2266-\varepsilon )n^2\), and as \(2p\le 9/32\) it is more than \((38/9-\varepsilon )n^2\). The bound \((2+5/(16p)-\varepsilon )n^2\) also holds for circuits whose operations are polynomial functions of at most two arguments computing the product as a function over an infinite field, and for the number of additions and multiplications, with arbitrary constants free, of arithmetic circuits computing the product as a function over an infinite field or formally computing it over any field; for the last also with \(38/9\).
Bläser (A \(5/2\, n^2\)-lower bound for the multiplicative complexity of \(n\times n\)-matrix multiplication, STACS 2001) proves that \(\tfrac 52n^2-3n\) nonscalar multiplications are needed over every field; counting about \(n^2\) further gates for the outputs, this is about \(3.5n^2\) operations in total. Shpilka (Lower bounds for matrix product, SICOMP 2003) proves \(3n^2-o(n^2)\) product gates over \(\mathrm{GF}(2)\) for quadratic circuits, about \(4n^2\) operations with the outputs. The bound here counts every gate of circuits with arbitrary fan-in-two polynomial gates, and every addition and multiplication of arithmetic circuits.
Over \(K(t)\) the Hankel matrix \(M=(t^{(i+j)^2})\) is totally regular (Lemma 898), and the rank consequences of the Taylor cut lemma (Theorem 896) hold over \(K(t)\). The Hessian of \(\sum _{ik}M_{ik}C_{ik}\) pairs \(A_{ij}\) with \(B_{jk}\) through \(M_{ik}\) and has no other nonzero entries, so its cross block between the inputs in \(S\) and outside \(S\) is block diagonal over \(j\), with a block of \(M\) and one of \(M^{\mathsf T}\) whose ranks sum to \(g(d(j))\); hence \(R_J\le w\). The Jacobian at \(A_0=B_0=M\) sends \((\delta A,\delta B)\) to \(\delta A\, B_0+A_0\, \delta B\): the derivative of \(C_{ik}\) is \([i=i']\, (B_0)_{jk}\) in \(A_{i'j}\) and \([k=k']\, (A_0)_{ij}\) in \(B_{jk'}\). In the forward block (outputs outside \(S\), inputs in \(S\)), choose for each heavy row \(i\) a square minor of \(B_0\) between the outputs \(C_{ik}\) and the inputs \(A_{ij}\), then for each column \(k\) a square minor of \(A_0\) between the outputs \(C_{ik}\) of light rows and the inputs \(B_{jk}\). Ordered this way the chosen square submatrix is block triangular, since an output of a light row does not depend on the entries \(A_{i'j}\) of another row, and its diagonal blocks are nonsingular; the backward block, with the light rows first, is the same. The two blocks have ranks summing to at most \(w\), so \(L_I\le w\), and grouping by columns gives \(L_K\le w\).
For the charging inequality, charge every terminal with one light and one heavy endpoint to its light endpoint if it is placed and to its heavy one otherwise, as in Lemma 887; let \(x\), \(y\), \(z\) be the numbers of heavy vertices in \(I\), \(J\), \(K\) and \(C_{\mathrm{LH}}\) the number of light–heavy \(C\) terminals. Then \(R_J\) pays for the \(A\) and \(B\) terminals charged to \(J\). At a heavy row the forward term of \(L_I\) is the number of unplaced \(C_{ik}\), at a light row the backward term is the number of placed ones; at a heavy column \(k\) the forward term is the number of \(C\) terminals charged to \(k\) and the backward term is at least the number of \(B\) terminals charged to \(k\) less the unplaced heavy–heavy \(C_{ik}\) and less \((n-x-y)^+\), and symmetrically at a light column. The light–light and heavy–heavy \(C\) terminals counted at the rows and at the columns cancel, so \(L_I+z(n-x-y)^++(n-z)(x+y-n)^+\) is at least \(C_{\mathrm{LH}}\) plus the number of \(B\) terminals charged to \(K\); transposing the terminal graph gives the mirror bound for \(L_K\) with the \(A\) terminals charged to \(I\). Summing, \(R_J+L_I+L_K\) plus the two overshoot terms is at least the number \(P\) of light–heavy terminals plus \(C_{\mathrm{LH}}\). With \(x=n/2+u\), \(z=n/2+w'\) and \(\delta =x+y+z-3n/2\), the total equals \(2n^2+\varphi (u)+\varphi (w')\) with \(\varphi (u)=u^2-\delta u-\tfrac n2|u-\delta |\ge -(n/2+\delta )^2/4\), so it is at least \(\tfrac {15}8n^2-n\delta /2-\delta ^2/2\), and \(0\le 2\delta \le 3\) at the threshold.
The component of \(C_{00}\) is crossed by no signal, so at the point where every input is one both Jacobian blocks vanish; there \(C_{ik}\) has derivative one in every \(A_{ij}\) and every \(B_{jk}\), so \(C_{ik}\), \(A_{ij}\) and \(B_{jk}\) lie together in or out of the component, which therefore holds every terminal. The terminals lie on distinct wires, since the circuit computes the product over \(K\). Along the ranking of Theorem 862, the threshold prefix of Lemma 887 ends at a terminal and has \(15n^2\le 24w+6n+9\); it is charged to the component holding all \(2n^2\) inputs and at most \(s\) gates. For the asymptotic form, assume at most \((2+5/(8A)-\varepsilon )n^2\) gates and choose \(\eta =A^2\varepsilon /2\): the cycle term is at most \((5/8-A\varepsilon /2)n^2\), while the linear loss and the logarithmic term are \(o(n^2)\). Over an infinite field a polynomial is determined by its values (Lemma 894), and every output is nonconstant, so constant gates can be absorbed into the coefficients (Theorem 876). An arithmetic circuit formally computing the product over \(K\) computes it as a function over the infinite field \(K(t)\).
Let \(K\) be a field of degree \(n\ge 1\) over \(\mathrm{GF}(2)\) with any basis, and read multiplication in coordinates as a Boolean map with \(2n\) inputs and \(n\) outputs. No nonzero component of it is affine on an affine flat with \(2^{n+1}\) points, and every signed unbounded AND/OR/XOR circuit computing it has at least \(2n-1\) conjunction gates. XOR gates of every fan-in are not counted, so this also bounds the number of unbounded-fan-in AND/OR gates in circuits with free XOR; fan-in, fanout, depth, and nonlinear reuse are unrestricted. The bound is attained for \(n=1\) and, by Karatsuba’s three products, for \(n=2\).
The value \(2n-1\) is the classical lower bound on the bilinear rank of multiplication in a degree-\(n\) extension. Here it holds for the conjunction gates of arbitrary circuits, which need not compute bilinear products. We know of no earlier bound above \(n\) on the AND gates of general free-XOR circuits for this multiplication.
In prime-field coordinates every affine flat is a translate \(a+U\) of a subspace with \(2^{\dim U}\) points. A nonzero component is \(\ell (xy)\) for a nonzero linear functional \(\ell \) on \(K\). It preserves ternary sums at \(a+u\), \(a\), \(a+w\) exactly when the polar form \(B((x,y),(x',y'))=\ell (xy'+x'y)\) vanishes at \((u,w)\), so it is affine on \(a+U\) only if \(U\) is totally isotropic for \(B\). If \(x\ne 0\) then \(t\mapsto \ell (xt)\) is nonzero, so \(B\) is nondegenerate on the \(2n\)-dimensional input space, and the dimension formula for orthogonal complements gives \(\dim U\le n\). Apply Theorem 847 with \(n\) outputs, \(2n\) inputs, and \(D=n+1\).
Let every operation of a signature carry a polynomial in its argument slots with coefficients in a commutative ring \(K\), of any degree. Over every commutative \(K\)-algebra \(A\) the program is evaluated by substituting the arguments of each gate into its polynomial. The wire polynomial \(f_w\in K[X_0,\dots ,X_{n-1}]\) of a wire \(w\) is its value over the polynomial ring at the variables, and a circuit formally computes polynomials \(f_o\) when its output \(o\) carries \(f_o\). For a \(K\)-algebra \(L\) and \(a\in L^n\), the Jacobian of a family of polynomials and the Hessian of one polynomial at \(a\) are the matrices of their formal first and second partial derivatives evaluated at \(a\). Arithmetic circuits have the gate polynomials \(X_0+X_1\), \(X_0X_1\), and the constants.
Over every commutative \(K\)-algebra a wire carries its wire polynomial evaluated at the input, so a circuit formally computing polynomials computes them as functions over every such algebra. Conversely, over an infinite field, a circuit whose operations are polynomial functions and which computes polynomial functions formally computes those polynomials, for the polynomials chosen to represent its operations. Over every commutative \(K\)-algebra, the arithmetic gate polynomials interpret addition, multiplication, and the constants mapped into the algebra.
Evaluation at a point is an algebra homomorphism out of the polynomial ring, and algebra homomorphisms commute with substitution into the gate polynomials, hence with the whole program. Over an infinite field a polynomial is determined by its values.
Let a program have polynomial gates with coefficients in a commutative ring \(K\), let \(L\) be a field that is a \(K\)-algebra, let \(a\in L^n\), and let \(S\) be a split of the wires with complement \(T\), forward signals \(A\), backward signals \(B\), and inputs \(X_S\) and \(X_T\) on the two sides. There are subspaces \(V\) of vectors supported on \(X_S\) and \(W\) of vectors supported on \(X_T\), with \(\dim V+\dim W\ge n-|A|-|B|\), in fact \(|X_S|\le \dim V+|A|\) and \(|X_T|\le \dim W+|B|\) separately, such that
\(\nabla f_t(a)\cdot v=0\) for every \(v\in V\) and every wire \(t\) of \(T\);
\(\nabla f_s(a)\cdot u=0\) for every \(u\in W\) and every wire \(s\) of \(S\);
\(v^{\mathsf T}\, \nabla ^2 f_w(a)\, u=0\) for all \(v\in V\), \(u\in W\), and every wire \(w\).
Evaluate the program over \(L[s,t]=L[s][t]\) with \(s^2=t^2=0\). The first-order Taylor expansion over dual numbers, applied twice, shows that at \(a+sv+tu\) every wire carries \(f(a)+s\, \nabla f(a)\cdot v+t\, \nabla f(a)\cdot u+st\, v^{\mathsf T}\nabla ^2 f(a)\, u\). Let \(Z\) be the directions along which no crossing wire moves to first order; it is cut out by at most \(|A|+|B|\) linear equations. For \(\delta \in Z\) the jets \(a+s\delta \) and \(a\) agree on every crossing wire, so they have the same boundary key, and cut and paste (Lemma 858) between them shows, on the coefficient of \(s\), that the part of \(\delta \) on \(X_S\) moves the wires of \(S\) as \(\delta \) does and fixes those of \(T\), and symmetrically for the part on \(X_T\). So both parts lie in \(Z\); let \(V\) and \(W\) be the sets of these parts, so that \(Z\subseteq V+W\), and (a) and (b) hold. For \(v\in V\) and \(u\in W\) the jets \(a+sv\) and \(a+tu\) agree on every crossing wire, their mixtures are \(a+sv+tu\) and \(a\), and the vanishing mixed second difference (Theorem 878) gives (c) on the coefficient of \(st\).
In the setting of Theorem 895, let \(O_S\) and \(O_T\) be the outputs carried in \(S\) and in \(T\), and \(J\) the Jacobian of the outputs at \(a\). Then
and in fact \(\operatorname {rank}J[O_T,X_S]\le |A|\) and \(\operatorname {rank}J[O_S,X_T]\le |B|\) separately. For all coefficients \(\mu _o\in L\) the Hessian \(H=\sum _o\mu _o\nabla ^2f_o(a)\) of the combination \(\sum _o\mu _of_o\) satisfies \(\operatorname {rank}H[X_S,X_T]\le |A|+|B|\), and more strongly
All of these hold over every field, with the point and the coefficients in any field extension, for gate polynomials of any degree, arity, and coefficients.
The rank of a Hessian block as a bound on the information two parties must exchange to evaluate a function of their joint inputs is due to Abelson (Lower bounds on information transfer in distributed computations, J. ACM 27, 1980); here it is applied at every cut of a circuit.
Restricted to its support, \(V\) lies in the kernel of \(J[O_T,X_S]\) by (a), and \(W\) in that of \(J[O_S,X_T]\) by (b). By (c) the restrictions of \(V\) and \(W\) are orthogonal through \(H[X_S,X_T]\): for matrices \(R_V\) and \(C_W\) whose rows and columns are bases of \(V\) and \(W\), \(R_VH[X_S,X_T]C_W=0\), and Sylvester’s rank inequality applied twice gives \(\dim V+\dim W+\operatorname {rank}H[X_S,X_T]\le n\). Compare with \(\dim V+\dim W\ge n-|A|-|B|\). The one-sided and combined bounds use the directed form \(|X_S|\le \dim V+|A|\), \(|X_T|\le \dim W+|B|\) of the cut lemma.
Polynomial multiplication maps the coefficients \(x_0,\dots ,x_{n-1}\) and \(y_0,\dots ,y_{n-1}\) of two polynomials of degree below \(n\), the first and the last \(n\) inputs, to the \(2n-1\) coefficients \(z_m=\sum _{i+j=m}x_iy_j\), \(0\le m\le 2n-2\), of their product; each \(z_m\) is also a polynomial in the \(2n\) inputs. For weights \(\mu \), the Hankel matrix of \(\mu \) is the \(n\times n\) matrix \(\Lambda =(\mu (i+j))\), and \(\left(\begin{smallmatrix} 0 & \Lambda \\ \Lambda ^{\mathsf T} & 0 \end{smallmatrix}\right)\) is indexed by the inputs, the \(x\) first. For a set \(X\) of inputs, \(X\cap x\) and \(X\cap y\) are the coefficients of the two factors whose inputs lie in \(X\).
At every point, the Hessian of \(\sum _m\mu (m)z_m\) is \(\left(\begin{smallmatrix} 0 & \Lambda \\ \Lambda ^{\mathsf T} & 0 \end{smallmatrix}\right)\) for the Hankel matrix \(\Lambda \) of \(\mu \). Over the field \(K(t)\) of rational functions, in every characteristic, the Hankel matrix \((t^{(i+j)^2})\) is totally regular. If \(\Lambda \) is totally regular, the block of \(\left(\begin{smallmatrix} 0 & \Lambda \\ \Lambda ^{\mathsf T} & 0 \end{smallmatrix}\right)\) with rows \(X\) and columns \(X^{\mathsf c}\) has rank at least \(\min \{ |X\cap x|,|X^{\mathsf c}\cap y|\} +\min \{ |X\cap y|,|X^{\mathsf c}\cap x|\} \).
The only nonzero second derivatives of \(x_iy_j\) are those in \(x_i\) and \(y_j\), equal to one. For a square minor of \((t^{(i+j)^2})\) with increasing rows \(r\) and columns \(c\), the term of a permutation \(\pi \) in the Leibniz expansion is \(\pm t^{E(\pi )}\) with \(E(\pi )=\sum _a(r_{\pi (a)}+c_a)^2=\sum _ar_a^2+\sum _ac_a^2+2\sum _ar_{\pi (a)}c_a\). By the rearrangement inequality and its equality case, only the identity attains the largest \(E\), so \(t^{E(\mathrm{id})}\) has coefficient one and the minor is nonzero; arbitrary rows and columns are sorted by permutations, which change a minor by a sign. For the block, choose \(k_1=\min \{ |X\cap x|,|X^{\mathsf c}\cap y|\} \) rows in \(X\cap x\) with as many columns in \(X^{\mathsf c}\cap y\), and \(k_2=\min \{ |X\cap y|,|X^{\mathsf c}\cap x|\} \) rows in \(X\cap y\) with as many columns in \(X^{\mathsf c}\cap x\). The resulting square block is block diagonal, with a square block of \(\Lambda \) and one of \(\Lambda ^{\mathsf T}\), both nonsingular.
Let a circuit with polynomial gates of fan-in at most two over a field \(K\), of any degree and with any coefficients, formally compute polynomial multiplication with \(s\) gates. Every split \(S\) of its wires, with inputs \(X_S\) and \(X_T\) on the two sides, is crossed by at least \(\min \{ |X_S\cap x|,|X_T\cap y|\} +\min \{ |X_S\cap y|,|X_T\cap x|\} \) signals. Under \(\mathrm{OrderingBound}(A,\eta ,C)\) with \(A+\eta \ge 0\),
Consequently, if the ordering hypothesis holds with coefficient \(A{\gt}0\) at every positive slack, then for every \(\varepsilon {\gt}0\) and all large \(n\), independently of the field, the signature, and the gate polynomials, every such circuit has more than \((2+1/A-\varepsilon )n\) gates; with the Gaussian pathwidth coefficient \(p\) of Theorem 783 and \(A=2p\) this is \((2+1/(2p)-\varepsilon )n\approx (5.5625-\varepsilon )n\), and more than \((50/9-\varepsilon )n\). The same bounds hold for circuits with polynomial gates computing the polynomial function over an infinite field; for the number of additions and multiplications, with arbitrary constants free, of arithmetic circuits formally computing polynomial multiplication over any field or computing it as a function over an infinite field; and for circuits over \(\mathbb {Z}/q\), \(q{\gt}2n\) prime, with arbitrary gate functions of fan-in at most two.
Earlier lower bounds for polynomial multiplication count multiplications: Kaminski and Bshouty (Multiplicative complexity of polynomial multiplication over finite fields, J. ACM 36, 1989) prove that bilinear algorithms over a fixed finite field need \(3n-o(n)\) multiplications, while over fields with at least \(2n-2\) elements \(2n-1\) multiplications suffice; read as bounds on the total number of operations they give about \(4n\). The coefficient is not claimed to be a record beyond this comparison.
For the cut bound, apply the Hessian consequence of the Taylor cut lemma (Theorem 896) over \(K(t)\) with the weights \(\mu (m)=t^{m^2}\): the block \(H[X_S,X_T]\) of the Hessian of \(\sum _m\mu (m)z_m\) has rank at most the number of crossing signals, and by Lemma 898 at least the stated sum. Over \(\mathbb {Z}/q\) take \(\mu (m)=1/(m+2)\): every output has vanishing mixed second differences on the classes of equal boundary keys, hence so does \(\sum _m\mu (m)z_m=x^{\mathsf T}\Lambda y\) with \(\Lambda \) the Hankel Cauchy matrix, and the counting rank-cut bound of Theorem 878 applies, with \(\Lambda \) totally regular by Lemma 879. The component of the first input is crossed by no signal, so the cut bound puts every input into it. Along the ranking of Theorem 862, the number of inputs in a prefix grows by at most one per wire, so the prefix ending at a suitable input holds exactly \(n\) inputs, \(a\) of the first factor and \(n-a\) of the second, and is crossed by at least \(\min \{ a,a\} +\min \{ n-a,n-a\} =n\) signals; it is charged to the component holding all \(2n\) inputs and at most \(s\) gates. For the asymptotic form, assume at most \((2+1/A-\varepsilon )n\) gates, choose \(\eta =A^2\varepsilon /2\), and compare. Over an infinite field a polynomial is determined by its values (Lemma 894), and every output is nonconstant, so constant gates can be absorbed into the coefficients (Theorem 876). An arithmetic circuit formally computing polynomial multiplication over \(K\) computes it as a function over the infinite field \(K(t)\).
Let a circuit with polynomial gates of fan-in at most two, of any degree and with any coefficients, formally compute the \(n\times n\) matrix product over a field \(K\) with \(s\) gates. Under \(\mathrm{OrderingBound}(A,\eta ,C)\) with \(A+\eta \ge 0\),
so it has more than \((2+1/(4p)-\varepsilon )n^2{\gt}(34/9-\varepsilon )n^2\) gates for all large \(n\), with \(p\) the Gaussian pathwidth coefficient of Theorem 783. The same holds for such circuits computing the product function over an infinite field. It also holds for the number of additions and multiplications, with constants free, of arithmetic circuits computing it, formally over every field or as a function over an infinite field.
Evaluate over \(K(t)\) with the generic Hankel matrix \(M=(t^{(i+j)^2})\), which is totally regular (Lemma 898). The charges \(R_I\) and \(R_K\) are bounded by the one-sided Jacobian bounds of Theorem 896 at \((0,M)\) and \((M,0)\), and \(R_J\) by its Hessian bound for \(\sum _{ik}M_{ik}C_{ik}\). So the loss is \(L=0\), and the charging argument proceeds as in Theorem 889.
Let \(D(f)\) and \(L(f)\) be the minimum depth and the minimum number of leaves, constant leaves included, of a De Morgan formula of Theorem 366 computing \(f\); they are defined for every number of inputs, \(0\) included. For \(f\) on \(m\) bits and \(g\) on \(n\) bits, the block composition \(f \diamond g\) applies \(f\) to the values of \(g\) on \(m\) disjoint blocks of \(n\) bits. Substituting formulas gives \(D(f \diamond g) \le D(f) + D(g)\) and \(L(f \diamond g) \le L(f)\, L(g)\) for all \(f\) and \(g\); both bounds are proved.
The Karchmer–Raz–Wigderson conjecture says these bounds are nearly tight. It is formalized in its strong form, with a constant slack. The depth form says that there is a constant \(c\) such that \(D(f) + D(g) \le D(f \diamond g) + c\) for all \(m\), \(n\) and all non-constant \(f\) and \(g\). The size form says that there is a constant \(c\) such that \(L(f)\, L(g) \le c \cdot L(f \diamond g)\) for all such \(f\) and \(g\). The constant does not depend on \(m\), \(n\), \(f\) or \(g\); forms whose slack grows with \(m\) or \(n\) are not formalized. The conjecture is open; it is formalized as a statement only.
Both non-constancy hypotheses are needed. If \(f\) or \(g\) is constant, so is \(f \diamond g\), and it is proved that dropping either hypothesis makes the depth form and the size form false for every \(c\).
8.3 The frontier method
The cutwidth argument above is stated for Boolean circuits over the full binary basis. The frontier method (namespace Complexity.Frontier) proves the same bound in a general form: circuits over any finite alphabet \(U\) with \(|U|\ge 2\), over any basis (a CSLib signature with an interpretation on \(U\)), with any accepting set \(\mathrm{Acc}\subseteq U\), and with fan-in \(r\ge 2\). Only gates of positive arity are counted (Circuit.innerSize), so constant gates are free. The graph-theoretic input is a layout hypothesis measured by the cycle rank. Gaussian layouts supply it in every fixed degree, and for fan-in two the coefficient is that of Theorem 783. The development is mirrored from a separate formalization by scripts/sync_frontier.py. The same frontiers give bounds for linear maps, aggregate gates, verifier circuits, and the average case, and they refine the counting by signals, codes, pruned transitions, and trees of regions.
For a set of coordinates \(X\subseteq \iota \), the rectangle with sides \(A\subseteq U^X\) and \(B\subseteq U^{X^c}\) consists of the inputs whose part on \(X\) lies in \(A\) and whose part on \(X^c\) lies in \(B\). A set \(S\subseteq U^\iota \) is \(K\)-rectangle-free when every rectangle contained in \(S\), for every \(X\), has a side with fewer than \(K\) elements. A sweep of \(S\) reveals coordinates over \(T\) steps, from none to all, and sends at each step a message such that inputs of \(S\) with the same message can exchange their unrevealed parts and remain in \(S\). A sweep is coherent when such an exchange also keeps the message, and every other message equals that of one of the two inputs.
If \(S\) is \(K\)-rectangle-free with \(|S|\ge K\), then for every sweep of \(S\),
where \(m_t\) is the message at step \(t\) and \(x|_{\text{new}_t}\) the newly revealed coordinates. An asymmetric form allows different thresholds on the two sides. A \(K\)-rectangle-free set depending only on the coordinates \(R\) satisfies \(|U|^{|R^c|}{\lt}K\) or \(|S|{\lt}|U|^{|R^c|}K\).
Charge each input of \(S\) to the first step at which its peers’ revealed parts number at least \(K\). At that step the peers form a rectangle, so their unrevealed parts number fewer than \(K\), and the revealed parts at the previous step numbered fewer than \(K\); each transition is therefore charged at most \((K-1)^2\) times.
The cycle rank of a multigraph is \(\beta _1=|E|+1-|V|\), truncated at zero. A layout numbers the vertices \(0,\dots ,|V|-1\). The layout hypothesis \(\mathrm{LB}_d(A)\) says that for every \(\eta {\gt}0\) some \(C\) bounds, for every connected loopless multigraph of maximum degree \(d\), some layout all of whose initial segments are crossed by at most \((A+\eta )\beta _1+\eta |V|+C\) edges.
A network over \(U\) is a multigraph whose edges carry values in \(U\), with a local check at each vertex that sees the values of its incident edges and of the inputs read at that vertex; each input is read by at most one vertex. It accepts the inputs for which some edge assignment passes every check. A layout sweeps the accepted set: the message at step \(t\) is the assignment on the edges crossing the first \(t\) vertices.
Two satisfying assignments that agree on the cut of a vertex set \(L\) splice into a satisfying assignment of the spliced input. Hence a \(K\)-rectangle-free accepted set has at most \((K-1)^2\bigl(|V|\, |U|^{w+d+m}+|U|^{\text{unread}}\bigr)\) elements when some layout has width \(w\), the maximum degree is \(d\), and every vertex reads at most \(m\) inputs.
Splice vertex by vertex: each check sees only edges on one side of the cut or edges of the cut itself. Apply Lemma 903 to the frontier sweep, whose transitions are determined by the edge values at two adjacent frontiers and the inputs read at the new vertex; unread inputs are revealed in one final step.
A straight-line program of fan-in at most \(r\) over any basis on \(U\), with any family of outputs and accepting sets, compiles into an exact network of maximum degree \(r+1\): signals, one junction per consumer, and output vertices. It accepts exactly the inputs whose outputs lie in their accepting sets, it has at most \(2rs+3|O|\) vertices, and when it is connected its cycle rank plus the number of inputs it reads is at most \((r-1)s+1\), where \(s\) counts the reachable gates of positive arity.
Each gate checks its operation against the junctions feeding it, and each junction chain copies one signal. An edge count over slots, junctions, and gates gives the cycle rank; constant gates have no slots and contribute nothing.
Let \(r\ge 2\), \(A{\gt}0\), and assume \(\mathrm{LB}_{r+1}(A)\). Let \(S_n\subseteq U^n\) be \(K_n\)-rectangle-free with \(\log K_n=o(n)\) and \(n\log |U|-\log |S_n|=o(n)\). Then for every \(\varepsilon {\gt}0\) and all large \(n\), every circuit of fan-in at most \(r\) deciding \(S_n\), over any basis on \(U\) and with any accepting set, has \(s\) gates of positive arity with \((r-1)s{\gt}(1+1/A-\varepsilon )n\).
The support lemma forces all but \(\log _{|U|}K\) inputs to be read, so the compiled network has cycle rank at most \((r-1)s-n+o(n)\). Every layout has width at least \(\log _{|U|}|S_n|-o(n)=n-o(n)\) by Lemma 906, while \(\mathrm{LB}_{r+1}(A)\) supplies a layout of width at most \((A+\eta )\beta _1+\eta |V|+C\). The comparison of demand and supply fails for small \(\eta \) and large \(n\) unless \((r-1)s{\gt}(1+1/A-\varepsilon )n\).
\(\mathrm{LB}_3(2p)\) holds with \(p=\tfrac {3}{2\pi }\arccos \tfrac {1+2\sqrt2}{4}\), hence \(\mathrm{LB}_3(1/3)\); \(p\) is the coefficient of Theorem 780. The ordering hypothesis of the cutwidth development at every positive slack also gives \(\mathrm{LB}_3\) with the same coefficient. In every maximum degree \(d\), every connected multigraph has a layout of width at most \(\beta _1+d\lfloor \log _2|V|\rfloor \), so \(\mathrm{LB}_d(1)\) holds.
Order the vertices of the cubic core by median Gaussian edge scores, as in Theorem 780, and expand the core. For the transfer, number the vertices in the given order; \((|E|-|V|)^+\le \beta _1\) and \(3\log _2|V|\le \eta |V|+K\). For general degree, merge the blocks of a degree-\(d\) compression along a spanning tree: a prefix of a merged block is a prefix of its larger part or that part followed by a prefix of a part at most half as large, so tree layouts have width \(d\lfloor \log _2|V|\rfloor \), and each of the \(\beta _1\) edges outside the tree adds one to every cut.
For every fixed \(d\ge 2\), loopless multigraphs of maximum degree \(d\) have layouts of width at most \(\gamma _d|E|+o(|V|)\), where \(\gamma _d=\arccos (2\sqrt{d-1}/d)/\pi \). Consequently \(\mathrm{LB}_d(A_d)\) holds for every \(d\ge 3\), with \(A_d=\tfrac {3d}{2d-3}\gamma _d{\lt}3/4\), and \(A_4=2/5\).
Score each vertex by a Gaussian form of its normalized truncated distance-kernel row and sort; adjacent rows have correlation at least \(2\sqrt{d-1}/d-o(1)\), so Sheppard’s bound gives the crossing probability \(\gamma _d\) per edge, and bounded-radius second moments control a grid of thresholds, windows, and tails at once. Terminal block compression keeps parallel edges, has degrees between three and \(d\), and adjacent degree sums at least \(d+3\), so its \(m\) edges satisfy \((2d-3)m\le 3d\beta _1\).
Under the hypotheses on \(S_n\) of Theorem 908, every circuit of fan-in two deciding \(S_n\), over any basis on \(U\), has more than \(\bigl(1+\pi /(3\arccos \tfrac {1+2\sqrt2}{4})-\varepsilon \bigr)n\approx (4.5625-\varepsilon )n\) gates of positive arity, in particular more than \((4-\varepsilon )n\). For every fixed fan-in \(r\ge 2\), \((r-1)s{\gt}(1+1/A_{r+1}-\varepsilon )n\) with \(A_d{\lt}3/4\), so circuits of fan-in three need more than \((7/4-\varepsilon )n\) gates; the spanning-tree bound gives the simpler \((r-1)s{\gt}(2-\varepsilon )n\).
The accepted sets of the polynomial-time family \(\mathrm{sourceReductionHardFamily}\) of Theorem 703 satisfy the hypotheses of Theorem 908. Hence, for every \(\varepsilon {\gt}0\) and all large \(n\): every circuit of fan-in two deciding it, over any basis on \(\{ 0,1\} \) and with any accepting set, has more than \(\bigl(1+\pi /(3\arccos \tfrac {1+2\sqrt2}{4})-\varepsilon \bigr)n\) gates of positive arity; for every fan-in \(r\ge 2\), \((r-1)s{\gt}(1+1/A_{r+1}-\varepsilon )n\), in particular \((7/4-\varepsilon )n\) gates at fan-in three; the Gaussian bound holds for verifier circuits over any basis, uniformly in the number of witness inputs; and it holds for circuits with special gates of unbounded fan-in aggregating in a finite commutative monoid with \(o(n)\) bits of total state, counting only the ordinary gates. Moreover the unpadded extractor, with error \(35/72\), agrees with every circuit of fan-in two over any basis with at most \(\bigl(1+\pi /(3\arccos \tfrac {1+2\sqrt2}{4})-\varepsilon \bigr)n\) gates of positive arity on at most a \(71/72+2^{-\gamma n}\) fraction of inputs, for some \(\gamma {\gt}0\).
Boolean rectangle-freeness of the cutwidth development is rectangle-freeness of the accepted set. Balanced padding of the eventually flat extractor is \(2K\)-rectangle-free with \(\log K=o(n)\), and it accepts exactly half the cube, so the density deficit is \(\log 2\). Apply Theorems 911, 914, and 917. An extractor with error \(\nu \) has signed sumset bias \(2\nu \), so Theorem 918 applies with \(b_n=35/72\).
A function on \(U^n\), for a finite alphabet with an addition and zero, that takes both values on \(A+B\) whenever \(|A|,|B|\ge K\) has \(K\)-rectangle-free fibres. If such dispersers have \(\log K_n=o(n)\) and accept a fixed fraction \(\delta {\gt}0\) of \(U^n\), every circuit of fan-in two deciding them, over any basis, has more than \(\bigl(1+\pi /(3\arccos \tfrac {1+2\sqrt2}{4})-\varepsilon \bigr)n\) gates.
A rectangle with large sides, padded by zero on the opposite coordinates, gives sets \(A\) and \(B\) whose sumset is the rectangle. A fixed density fraction makes the density deficit constant.
Theorem 908 holds for circuits on \(n+k\) inputs, with arbitrary \(k\), that accept \(x\) exactly when some witness \(y\) makes the output accept, uniformly in \(k\); for fan-in two the Gaussian coefficient holds. Witness inputs are not counted in \(n\); every gate of positive arity is counted.
Hiding an input moves its existential quantifier into the local check of the vertex that reads it, which preserves the network and its acceptance. The exact counting argument never uses uniqueness of satisfying assignments.
Under \(\mathrm{LB}_{r+1}(A)\), every circuit of fan-in at most \(r\) with linear capacity computing \(x\mapsto Mx\) for a totally regular \(N\times N\) matrix has \((r-1)s{\gt}(1+1/A-\varepsilon )N\), counting gates of positive arity. With the Gaussian coefficient: over finite fields for every basis of fan-in two; over infinite fields for every basis of polynomial operations, via a dual-number linearization that produces an affine circuit of the same size, inner size, and fan-in; for arithmetic circuits computing the Cauchy map over every field of characteristic zero; and for the Cauchy map over \(\mathbb {Z}/q\) for every prime \(q\ge 2N\), over any basis. Over finite fields, and over infinite fields with polynomial operations, every fixed fan-in \(r\) gives \((r-1)s{\gt}(1+1/A_{r+1}-\varepsilon )N\), and fan-in three gives \((7/4-\varepsilon )N\).
Every layout of the compiled network passes a vertex set that reads inputs \(X\) and holds outputs \(Y\) with \(|X|+|Y|=N\). Splicing shows that the blocks \(M[Y,X^c]\) and \(M[Y^c,X]\) see the input only through the values on the cut, and total regularity makes both nonsingular, so those values determine the input; linear capacity then forces at least \(N\) cut edges. Over infinite fields the polynomial gates are replaced by their first-order Taylor expansions at a base point, computed over the dual numbers.
For any map and any split of its inputs and outputs, the number of inputs is at most the number of used boundary messages times the largest fibres of the two complementary mixed observations; in a compiled circuit the messages are the distinct signals crossing a cut. A map \(F:U^N\to U^N\) is MDS when any \(N\) coordinates of its graph code \((x,F(x))\) determine \(x\). Under \(\mathrm{LB}_{r+1}(A)\), every circuit of fan-in at most \(r\) over any basis computing an MDS map over any finite alphabet satisfies \((r-1)s{\gt}(1+1/A-\varepsilon )N\), uniformly in the alphabet; hence the Gaussian coefficients at fan-in two and in every fixed degree. Totally regular linear maps are MDS, and the MDS property survives coordinatewise permutations of the alphabet.
Every layout passes a set of vertices reading \(|X|\) inputs and holding \(|Y|\) outputs with \(|X|+|Y|=N\); the MDS property makes both mixed fibres singletons, so at least \(N\) symbols cross that cut.
Under the hypotheses of Theorem 908, let the special gates of a circuit, of any fan-in, have a ledger in a finite commutative monoid \(M\) with \(\log |M|\le \beta (n)=o(n)\): each wire contributes an element of \(M\) according to its value, and each special gate is read off the product. Then the ordinary gates of positive arity, of fan-in at most \(r\), satisfy \((r-1)s{\gt}(1+1/A-\varepsilon )n\). Gates aggregating in one monoid \(T\), such as AND, OR, parity, and counting modulo a fixed number, have a ledger in \(T^{\text{special}}\).
Guess the special outputs, replace the special gates by placeholders, and lay out the erased program one connected component after another, carrying the product of contributions in the messages; a guess is consistent exactly when the ledger total confirms it. The counting lemma finds a component that reads almost every input and whose layout is wide, up to \(2\log |M|\), and its cycle rank gives the comparison of demand and supply.
For a coherent sweep, a weight bounded by \(a\) whose sum over every rectangle with sides at least \(K_L\) and \(K_R\) is paid by a nonnegative budget satisfies \(|\sum _S w|\le \sum _S\mathrm{cost}+a(K_L-1)(K_R-1)T\), where \(T\) counts the transitions. Consequently, if \(f_n\) has bias at most \(2b_n\) on every coordinate rectangle with both sides at least \(K_n\), with \(\log K_n=o(n)\), then under \(\mathrm{LB}_3(A)\) every Boolean circuit of fan-in two over any basis with at most \((1+1/A-\varepsilon )n\) gates of positive arity agrees with \(f_n\) on at most a \(1/2+b_n+2^{-\gamma n}\) fraction of inputs, for any \(\gamma {\lt}\min (1,A\varepsilon )\); the same bound holds for the absolute correlation. For the Gaussian coefficient and for flat-source sumset extractors with error \(b_n\), some \(\gamma {\gt}0\) works. Extractor error at most \(Cn^{-a}\) gives agreement at most \(1/2+(C+1)n^{-a}\). Sumset bias is preserved by every injective affine change of the input coordinates.
Peel thick rectangles of peers, which the budget pays for, and delete their message classes; coherence keeps the remaining sweep a sweep. The thin remainder pays the maximum atom per transition. Apply this to both output classes of the circuit along a Gaussian layout.
The distinct signals crossing a cut of the compiled network are exactly the cut of its signal hypergraph, and their number is a symmetric submodular function of the cut; counting may charge distinct signals instead of edges. For a linear system \(Lx+Ry=0\) over a finite field \(F\), the feasible syndromes number exactly \(|F|^{\operatorname {rank}L+\operatorname {rank}R-\operatorname {rank}[L\, R]}\). Any finite code that determines the transitions on \(S\) bounds the transition count, in both the exact and the weighted counting lemmas. For subspaces \(P\le U\) and \(Q\le V\) of linear observations, encoding the exposed observations together with the shared information \(U\cap V\) costs \(\dim (U+Q)+\dim (V+P)-\dim (U+V)\), not the sum of the separate ranks.
Each signal’s occurrences form a connected subgraph, so a signal crosses a cut exactly when its hyperedge does. The feasible syndromes form \(\operatorname {im}L\cap \operatorname {im}R\), and the joint code is the modular-law identity \((U\cap V)+(P+Q)=(U+Q)\cap (V+P)\). A determining code surjects onto the transitions it determines.
Restricting a coherent sweep with nested revealed sets to the inputs whose transitions all lie in chosen sets preserves splicing; the discarded inputs are paid by a union bound, and discarding probability mass \(\delta \) costs at most \(\delta /2\) in agreement. On a binary tree of regions, weighted peeling has residual factor \((K-1)^3\) per joint merge record. For a network with unique satisfying assignments that reads every input, a laminar decomposition gives such a tree, whose exponent at a node is the size of the union of its cut and its two children’s cuts plus the inputs read locally.
Retained inputs that agree on a message splice into retained inputs, since every transition of a splice is a transition of one of its two parents. For trees, charge each input to a node of minimal rank whose interior is large but whose children’s interiors are small.
In the weighted counting lemma each transition may be charged the smaller of its frontier allowance and the absolute weight of the inputs using it. For a predictor \(g\) with coherent nested sweeps of its two output classes and a target of rectangle bias \(2b\), agreement is at most \(1/2+b+\tfrac 12\sum \min (\lambda ,p)\) over the unconditional transition masses \(p\), with \(\lambda =(K-1)^2/|U|^n\), and at most \(1/2+b+\tfrac 12\lambda ^{1-\theta }\sum p^\theta \) for every \(0\le \theta \le 1\). A potential satisfying local square-root inequalities along an encoding bounds the sum of square roots of codeword masses by its value at the root.
Keep exactly the transitions of mass at least \(\lambda \) and apply the pruning bound; \(\min (\lambda ,p)\le \lambda ^{1-\theta }p^\theta \). The potential inequalities telescope level by level, since each child has one parent.
Let a smooth decomposable DAG have unions on a common scope, products on disjoint scopes, and leaves with at most one assignment, with no determinism or unique certificate assumed. If its accepted set is \(K\)-rectangle-free with at least \(K\) elements, \(K\ge 2\), then it has at most \((K-1)^2e+(K-1)^3p\) elements, where \(e\) counts union edges and \(p\) product nodes.
A node and all contexts of its occurrences in accepting certificates form a rectangle. Descend a certificate to the cardinality threshold and charge the input to the union edge or product node reached there.
A subset \(S\) of an additive monoid is \(K\)-sumset-free when it contains no sumset \(A+B\) with \(|A|,|B|\ge K\); the fibres of a sumset disperser are sumset-free. An additive sweep describes each input as the sum of a past and a future part, built by adding emitted labels, so that past and future parts of inputs with the same message can be recombined within \(S\); labels may overlap and paths need not be unique. If \(S\) is \(K\)-sumset-free with \(K\ge 2\) and \(|S|\ge K\), then \(|S|\le (K-1)^2\) times the number of transitions, and any code determining the transitions may replace them.
As in Lemma 903: the past and future parts of the peers at a step form a sumset inside \(S\), so one side has fewer than \(K\) elements; charge each input to the first step at which its past side is large.
Changing the colours of an independent set of vertices changes the size of a cut by the sum of the local gains, and strictly decreases it when one selected vertex improves. In a cubic multigraph, replacing the keys of an independent set by the median of their neighbours’ keys does not increase the number of edges crossing any threshold.
No edge joins two selected vertices, so the edges at distinct selected vertices are disjoint. At every threshold the median agrees with a majority of the three neighbours.
8.3.1 Exponentially small correlation
The rectangles of the frontier method also give exponentially small correlation, not only bounded agreement, against quadratic forms over \(\mathbb {F}_2\) (namespace Complexity.Correlation). The circuit model, the gate count, and the agreement measure are those of Theorem 918, so the bounds are directly comparable. With \(A=2p\approx 0.2807\) the Gaussian coefficient of Theorem 909, put \(c^*=1+1/(2A)\approx 2.78125\) and \(L=1+1/A\approx 4.5625\). The best previously published average-case bounds for circuits over the full binary basis are \(2.5n\) (Chen and Kabanets, COCOON 2015, for an explicit affine extractor) and \(2.6n\) (Golovnev, Kulikov, Smal, and Tamaki, MFCS 2016, for non-explicit quadratic extractors).
The correlation of Boolean functions \(f\) and \(g\) is \(|\Pr [f=g]-\Pr [f\ne g]|=|2\, \mathrm{agreement}(f,g)-1|\). A square matrix \(Q\) over \(\mathbb {F}_2\) defines the quadratic form \(f_Q(x)=\sum _{i,j}Q_{ij}x_ix_j\). The rank of a block of a matrix is the dimension of the span of its rows, and the cut rank \(\rho _Q(U)\) is the rank of the block of \(Q+Q^{\mathsf T}\) with rows \(U\) and columns \(U^c\). A matrix is submatrix-robust with deficiency \(t\) when every square block with \(k\) rows has rank at least \(k-t\). On inputs of length \(n\), with \(x\) the first \(\lfloor n/2\rfloor \) coordinates and \(y\) the next \(\lfloor n/2\rfloor \), the bilinear form \(x^{\mathsf T}Ry\) is the quadratic form of the matrix with \(R\) in the block with rows \(x\) and columns \(y\).
For every rectangle \(R\) for a cut \(X\) of the \(n\) coordinates, \(\bigl(\sum _{x\in R}(-1)^{f_Q(x)}\bigr)^2\, 2^{\rho _Q(X)}\le |R|\, 2^n\). Consequently, if a predictor \(g\) is constant on the classes of a map into a finite set \(M\) and every class is a rectangle for \(X\), then \(\mathrm{corr}(f_Q,g)^2\, 2^{\rho _Q(X)}\le |M|\).
On a rectangle, \(f_Q(p,q)=f_1(p)+f_2(q)+p^{\mathsf T}Bq\) with \(B\) the block of \(Q+Q^{\mathsf T}\). Cauchy–Schwarz over \(p\), character orthogonality \(\sum _p(-1)^{p\cdot v}=2^{|X|}[v=0]\), and the fibre count \(|\{ q':Bq'=Bq\} |=2^{|X^c|-\operatorname {rank}B}\) give the first bound; Cauchy–Schwarz over the classes gives the second.
Let every set of \(\lfloor n/2\rfloor \) coordinates have cut rank at least \(\lfloor n/2\rfloor -e\), and let \(C\) be a single-output circuit over any basis on \(\{ 0,1\} \). If \(C\) leaves at least \(k\le \lfloor n/2\rfloor \) inputs unread, then \(\mathrm{corr}(f_Q,C)^2\le 2^{1+e-k}\). If \(C\) reads at least \(\lfloor n/2\rfloor \) inputs and its compiled constraint network has a layout all of whose frontiers have at most \(w\) edges, then \(\mathrm{corr}(f_Q,C)^2\le 2^{1+w+e-\lfloor n/2\rfloor }\).
The cut ranks of sets of fewer coordinates are at least their size minus \(e\), since deleting a row lowers a rank by at most one. A circuit that ignores a set \(D\) of inputs has two output classes, each a rectangle for \(D\). Along a layout, each vertex reads at most one input, so some initial segment reads exactly \(\lfloor n/2\rfloor \) inputs; by the separator lemma, the inputs with a given output and given values on that frontier form a rectangle for the inputs read, and there are at most \(2\cdot 2^w\) of them. Apply Lemma 926.
Assume \(A{\gt}0\) and \(\mathrm{LB}_3(A)\), and let \(Q_n\) be \(n\times n\) matrices over \(\mathbb {F}_2\) such that for all large \(n\) every set of \(\lfloor n/2\rfloor \) coordinates has cut rank at least \(\lfloor n/2\rfloor -\tau n\). Then for every \(c\ge 1/2\) and every \(\gamma {\lt}(c^*-c)/(2L)-\tau /2\), where \(c^*=1+1/(2A)\) and \(L=1+1/A\), for all large \(n\) every circuit of fan-in two over any basis with at most \(cn\) gates of positive arity has correlation at most \(2^{-\gamma n}\) with \(f_{Q_n}\). If the deficiency is \(o(n)\) instead of \(\tau n\), every \(\gamma {\lt}(c^*-c)/(2L)\) works; for the Gaussian coefficient, \(c^*=1+\pi /(6\arccos ((1+2\sqrt2)/4))\) and \(L=1+\pi /(3\arccos ((1+2\sqrt2)/4))\). (For \(c{\lt}1/2\) apply the bound with \(c=1/2\).)
Put \(\theta =(1/2-A(c-1))/(1+A)\), so that \(A(c-1+\theta )-1/2=-\theta \) and \((c^*-c)/(2L)=\theta /2\). With at least \(\theta n\) unread inputs the first finite bound gives exponent \(-(\theta -\tau )n+O(1)\). With fewer, the compiled network has cycle rank at most \((c-1+\theta )n+1\) and at most \(4cn+3\) vertices, so \(\mathrm{LB}_3(A)\) supplies a layout of width at most \((A+\eta )(c-1+\theta )n+5c\eta n+O_\eta (1)\), and the second finite bound gives the same exponent up to \(O(\eta )n\). Choose \(\eta \) small.
If \(3m{\lt}(t+1)^2\), some \(m\times m\) matrix over \(\mathbb {F}_2\) is submatrix-robust with deficiency \(t\). In particular \(t=2\lfloor \sqrt m\rfloor +1\) works for every \(m\).
A \(k\times k\) block of rank \(r\) has \(r\) columns spanning the others. Given their positions, a matrix is determined by the coefficients expressing the other \(k-r\) columns and by its entries outside the remaining \(k\times (k-r)\) block, so at most \(2^{r(k-r)}2^{m^2-k(k-r)}=2^{m^2-(k-r)^2}\) matrices arise. Summing over the at most \(2^k\) positions, at most \(2^k\, 2^{m^2-(t+1)^2}\) matrices have a block of rank below \(k-t\) on a given pair of \(k\)-sets of rows and columns. A union bound over fewer than \(4^m\) pairs leaves fewer than \(2^{m^2}\) bad matrices when \(3m{\lt}(t+1)^2\).
Fix, for every \(m\), a submatrix-robust \(m\times m\) matrix \(R_m\) with deficiency \(2\lfloor \sqrt m\rfloor +1\), and let \(h_n=x^{\mathsf T}R_{\lfloor n/2\rfloor }y\). Every set of \(\lfloor n/2\rfloor \) coordinates has cut rank at least \(\lfloor n/2\rfloor -O(\sqrt n)\) in \(h_n\). Hence for every \(c\ge 1/2\) and every \(\gamma {\lt}(c^*-c)/(2L)\), for all large \(n\) every circuit of fan-in two over any basis with at most \(cn\) gates of positive arity has correlation at most \(2^{-\gamma n}\) with \(h_n\). In particular some fixed \(\gamma {\gt}0\) works for all circuits with at most \(2.77n\) gates of positive arity, beyond the previous \(2.5n\) and \(2.6n\). In Lean, \(R_m\) is chosen by Classical.choose. Taking instead the lexicographically first robust matrix makes the family computable in \(\mathsf{E}^{\mathsf{NP}}\): whether some robust matrix extends a given prefix is one \(\mathsf{NP}\) query of length \(2^{O(n)}\) (guess the matrix and check its fewer than \(4^{n/2}\) pairs of row and column sets), so the matrix is found bit by bit in time \(2^{O(n)}\). This uniformity is a remark about the construction and is not formalized.
The block of the polar matrix at a cut \(U\) contains, on disjoint columns, the block of \(R\) with rows \(x\cap U\) and columns \(y\setminus U\) and the transpose of the block with rows \(x\setminus U\) and columns \(y\cap U\); their ranks add. When \(|U|=\lfloor n/2\rfloor \), their smaller sides sum to at least \(\lfloor n/2\rfloor -1\), and robustness costs \(2t\). Apply Theorem 928 with the Gaussian coefficient; \(2.77{\lt}c^*\) because \(2p\le 9/32\).
8.4 Essential inputs and gate elimination
Input \(i\) is essential for \(f : \{ 0,1\} ^N \to \{ 0,1\} ^M\) if flipping bit \(i\) changes \(f(x)\) for some \(x\).
Over any basis, the number of essential inputs of the function \(\{ 0,1\} ^N \to \{ 0,1\} ^M\) computed by a circuit is at most the circuit’s total fan-in, the number of gate-input occurrences with output gates included. For circuits over the AND/OR basis of fan-in at most \(k\), it is at most \(k\) times the size \(G + M\).
Every essential input is read by some gate input occurrence.
The parity family \(\oplus \) maps \(x \in \{ 0,1\} ^N\) to \(x_0 \oplus \cdots \oplus x_{N-1}\), with value \(0\) on the empty string.
Every fan-in-two AND/OR circuit computing \(N\)-bit parity or its complement, \(N \ge 1\), has size at least \(2N - 1\), that is, at least \(2(N - 1)\) internal gates, and in fact size at least \(3(N - 1)\). Hence \(\mathrm{size}(\oplus _N) \ge \max (2N - 1, 3(N - 1))\).
Gate elimination: fixing a well-chosen input removes at least two gates and leaves parity or its complement on one fewer input. For \(3(N-1)\), translate the circuit into a straight-line De Morgan program whose charged binary-gate cost equals its size, and apply the three-gate elimination theorem for parity of the imported algebraic-circuits library.
8.5 Depth, formulas, and communication
Let \(G\) be a finite acyclic digraph with \(S\) edges whose longest simple path has at most \(2^k\) vertices, and let \(r \le k\). There is a set \(F\) of edges of \(G\) with \(k\, |F| \le r S\) whose removal leaves a digraph whose longest simple path has at most \(2^k / 2^r\) vertices.
Label vertices by longest-path depth, partition the edges by the first bit in which the labels of their endpoints differ, and remove the \(r\) smallest classes.
Let \(C\) be a circuit whose dependency graph has longest paths of at most \(2^k\) vertices, and let \(r \le k\). There is a set \(F\) of dependency edges with \(k\, |F| \le r \cdot \mathrm{totalFanIn}(C)\) whose removal leaves a graph whose longest paths have at most \(2^{k-r}\) vertices.
The dependency graph is acyclic and has at most \(\mathrm{totalFanIn}(C)\) edges.
Every Boolean formula \(\varphi \) of size \(s\) has an equivalent formula of depth at most \(15 + 12 \lceil \log _2 s \rceil \) and size at most \(80 s^8 - 4\).
Find a subformula of between one third and two thirds of the size, and recombine the two cases for its value; recurse on both parts.
A monotone formula over \(N\) variables is a tree built from variables \(x_0, \dots , x_{N-1}\) and binary conjunction and disjunction, without constants or negation. Its leaves are its variable occurrences, and its depth is the length of a longest root-to-leaf path, variables having depth zero. A function \(f\) is monotone if \(x \le y\) pointwise and \(f(x) = 1\) imply \(f(y) = 1\).
Every monotone formula computes a monotone function, and a monotone formula computing \(f\) has at least as many leaves as \(f\) has essential inputs.
Induction on the formula; an essential input must occur as a leaf.
A protocol is a tree indexed by a rectangle \(X \times Y\) of sets of inputs in \(\{ 0,1\} ^N\), \(X\) on the one side and \(Y\) on the zero side. At an internal node, Alice splits \(X\) or Bob splits \(Y\) by an arbitrary predicate, and the two children are indexed by the two parts. A leaf names a coordinate \(i\) with \(x_i = 1\) for all \(x \in X\) and \(y_i = 0\) for all \(y \in Y\). A protocol for the monotone Karchmer–Wigderson game of \(f : \{ 0,1\} ^N \to \{ 0,1\} \) is one indexed by the root rectangle \(f^{-1}(1) \times f^{-1}(0)\), so every node’s rectangle lies in it. The depth is the height of the tree.
Every monotone formula computing \(f : \{ 0,1\} ^N \to \{ 0,1\} \) yields a protocol for the monotone Karchmer–Wigderson game of \(f\) of the same depth, and every such protocol yields a monotone formula of the same depth computing \(f\). Hence, for every \(d \in \mathbb {N}\), the game has a protocol of depth at most \(d\) if and only if some monotone formula of depth at most \(d\) computes \(f\). There is no monotonicity hypothesis on \(f\); by Lemma 939, both sides fail when \(f\) is not monotone.
An OR node is an Alice split and an AND node is a Bob split; both translations preserve depth exactly.
8.6 Restrictions, normal forms, and decision trees
A restriction assigns each variable \(x_i\), \(i \in \mathbb {N}\), either a fixed bit or “free”; the finite-arity version does this for exactly \(N\) variables. The composition \(\rho _1 \circ \rho _2\) fixes a variable to \(\rho _1\)’s value when \(\rho _1\) fixes it and to \(\rho _2\)’s value otherwise. A restriction acts on a total assignment by overwriting the fixed variables, and on a Boolean formula by replacing each fixed variable with the corresponding constant.
Evaluating \(\varphi |_\rho \) at \(\alpha \) equals evaluating \(\varphi \) at \(\rho \) applied to \(\alpha \). Restricting by \(\rho _1\) and then by \(\rho _2\) equals restricting by \(\rho _1 \circ \rho _2\), and restriction preserves formula size and depth exactly.
Induction on the formula.
A CNF (resp. DNF) over \(N\) variables is a list of clauses (resp. terms), each a list of literals. Its width is the largest number of literals in a clause (term), and its complexity is the number of clauses (terms). These finite-arity normal forms are distinct from the CNF formulas used for satisfiability and resolution.
For a finite-arity restriction \(\rho \) and a CNF or DNF \(\varphi \) over \(N\) variables, the simplified restriction \(\varphi |_\rho \) satisfies \(\varphi |_\rho (x) = \varphi (\rho \text{ applied to } x)\) for every \(x \in \{ 0,1\} ^N\), and its width is at most the width of \(\varphi \).
In a CNF delete falsified literals and satisfied clauses; in a DNF delete satisfied literals and falsified terms.
A decision tree queries a variable at each internal node and outputs a bit at each leaf. The finite-arity version queries only variables below \(N\). Its depth is the length of a longest root-to-leaf path.
A decision tree of depth \(s\) is computed by a DNF of width at most \(s\) and by a CNF of width at most \(s\).
Take one term per accepting path, and dually one clause per rejecting path.
For \(N \ge 1\), every DNF and every CNF computing \(N\)-bit parity has at least \(2^{N-1}\) terms, respectively clauses.
A satisfiable term that omits a variable accepts two inputs of different parity, so every satisfiable term accepts exactly one input, while parity accepts \(2^{N-1}\) inputs. CNFs follow by negation.
8.7 The switching lemma and \(\mathsf{AC}^0\)
For \(q \in \mathbb {N}\), a seed assigns to each of \(N\) coordinates one of \(2q + 1\) symbols: one free symbol and \(q\) labelled copies of each fixed bit, so there are exactly \((2q + 1)^N\) seeds. A seed decodes to a finite-arity restriction, so a uniform seed leaves each coordinate free with probability \(1/(2q+1)\) and fixes it to each bit with probability \(q/(2q+1)\), independently. Events are measured by exact counts of seeds rather than by probabilities.
Let \(\varphi \) be a DNF of width \(w\) over \(N\) variables, no term of which contains a complementary pair of literals, and let \(q, s \in \mathbb {N}\). Call a restriction bad if the complete-block switching decision tree of the restricted formula has depth at least \(s\). This tree, rather than the canonical tree that queries one variable at a time, is the one used here: at the first surviving term it queries all of that term’s free variables before accepting or continuing. Then
Every DNF agrees with its sub-DNF of consistent terms, whose width is no larger, and the bound holds for that sub-DNF with \(w\) the original width. The same bounds hold for CNFs, where the condition is that no clause contains a complementary pair, and the switching tree and bad event are defined through the De Morgan dual DNF. Reading the counts as probabilities, which is not a separate formal statement: a uniform seed is bad with probability at most \((4(w+1)/q)^s\) when \(q \ge 1\).
Encode each bad restriction, together with the labels of its first \(s\) queried coordinates, injectively as a seed plus \(s\) advice symbols from an alphabet of size \(4(w + 1)\) (Razborov’s encoding). CNFs follow by De Morgan duality.
A negation-normal unbounded formula over \(N\) variables is a tree built from constants, literals, and AND and OR gates of any fan-in; an empty AND is true and an empty OR is false. Its size counts all nodes (constants, literal occurrences, and gates), and its depth counts gates on a longest root-to-leaf path.
Let \(C\) be an unbounded-fan-in AND/OR circuit, with negations only through the free per-input flags, with \(N\) inputs and \(G\) internal gates, and let output \(j\) have depth \(D\), counting the output gate. Some negation-normal unbounded formula computes output \(j\), has depth at most \(D\), and has size at most \((2(N + G) + 1)^{D+1}\).
Push negations to the literals by De Morgan duality, remove duplicate signed inputs of each gate, and unfold the circuit into a tree.
Let \(\varphi \) be a negation-normal unbounded formula over \(N\) variables with depth at most \(d\), and let \(s \ge 2\) and \(q \in \mathbb {N}\). For any sequence of \(d\) restrictions, one per level, a staged compiler turns \(\varphi \) into a decision tree that computes \(\varphi \) under their composition, earlier restrictions taking precedence. For \(d\) independent sparse seeds, the number of \(d\)-tuples of seeds for which this decision tree has depth at least \(s\), multiplied by \(q^s\), is at most \(\mathrm{size}(\varphi )\, ((2q+1)^N)^d\, (4(s + 1))^s\). Consequently, if \(q {\gt} 0\) and
then some tuple of seeds leaves at least \(s\) variables free and reduces \(\varphi \) to a decision tree of depth less than \(s\).
At a gate, the earlier stages have compiled the children to decision trees; their conjunction is a CNF and their disjunction a DNF of width at most the largest child depth. Unless some child already failed, that width is below \(s\), so the switching lemma bounds the failures at the gate. A union bound over the nodes and the exact first moment of the number of surviving variables give the criterion.
Let \(\varphi \) be a negation-normal unbounded formula over \(N\) variables that computes parity, and let \(d \ge \mathrm{depth}(\varphi )\), \(s \ge 2\) and \(q \ge 1\). Then
Parity restricted to a set of free variables needs a decision tree querying all of them, so the conclusion of Theorem 953 is impossible and its numeric hypothesis must fail.
The parity family is not in \(\mathsf{AC}^0\): no family of polynomial-size, constant-depth, unbounded-fan-in AND/OR circuits, with negations free on gate inputs, computes \(N\)-bit parity at every input length \(N\). The analogous statement for the imported library’s \(\mathsf{AC}^0\) model is Theorem 359.
Suppose a family of depth at most \(c\) and size at most \(a N^k + a\) computes parity. At every length \(N \ge 1\), normalization gives a parity formula of depth at most \(c\) and size at most \(B N^K\), where \(B = (3 + 4a)^{c+1}\) and \(K = (k + 1)(c + 1)\). Apply Theorem 954 with \(d = c + 1\) stages, \(s = (d + 1)K + d + 1\), \(q = m\), and \(N = m^{d+1}\), where \(m = 2B\, 3^d(4(s+1))^s + 2s\, 3^d + 1\). Dividing by \(((2q+1)^{N-1})^d\) and using \((2m+1)^d \le 3^d m^d\), each of the two terms on the right is less than half of the left side, so the inequality fails.
For every \(d \ge 2\) there is \(\varepsilon _d {\gt} 0\) such that, for all sufficiently large \(N\), every unbounded-fan-in AND/OR circuit of depth \(d\) computing \(N\)-bit parity has size at least \(2^{\varepsilon _d N^{1/(d-1)}}\). Theorem 360 proves an explicit non-asymptotic form of this bound for the imported library’s \(\mathsf{AC}^0\) model; the statement here, for the circuits of this library, is not yet formalized.
The same argument with the restriction parameters optimized, keeping the bottom fan-in bound separate from the size.
For \(N \ge 1\), a threshold circuit with \(N\) internal gates, one output gate, and depth at most two computes \(N\)-bit parity. Hence the parity family is in \(\mathsf{TC}^0\).
For \(1 \le j \le N\) let \(T_j\) be the threshold gate “at least \(j\) ones” over all inputs. The output gate reads \(T_j\) for odd \(j\) and \(\neg T_j\) for even \(j\). If the input has \(w\) ones, exactly \(\lfloor N/2 \rfloor + (w \bmod 2)\) of these signed inputs are true, so the output threshold \(\lfloor N/2 \rfloor + 1\) computes parity. The empty input has its answer, false, stored separately.
\(\mathsf{AC}^0 \subsetneq \mathsf{TC}^0\).
\(\mathsf{AC}^0 \subseteq \mathsf{TC}^0\), and parity is in \(\mathsf{TC}^0\) but not in \(\mathsf{AC}^0\).
The strict-majority family, with ties false, is not in \(\mathsf{AC}^0\): no family of polynomial-size, constant-depth, unbounded-fan-in AND/OR circuits, with negations free on gate inputs, computes it at every input length.
A family of depth at most \(c\) and polynomial size has at most \(Cn^k\) internal gates for large \(n\), contradicting the superpolynomial gate bound of Theorem 1018 at depth \(c\).
The bound of Theorem 950 holds, up to an additive error \(\varepsilon \), when the free/fixed pattern and the fixed values are drawn from a distribution that \(\varepsilon \)-fools CNFs of size polynomial in \(N\) instead of the uniform product distribution (Trevisan–Xue). With an explicit generator fooling CNFs, such restrictions can be sampled from \(\mathrm{polylog}(N / \varepsilon )\) random bits.
The bad event of the switching lemma is itself decided by a small CNF-like test on the restriction, so fooling that test preserves its probability. This requires a formal notion of pseudorandom distributions and of fooling a class of tests, which the library does not yet state; pseudorandom generators for \(\mathsf{AC}^0\) would build on it.
8.7.1 Depth-three circuits and subcube dispersers
A \(\Sigma _3^k\) formula is an OR of \(k\)-CNFs. Paturi, Pudlák and Zane’s satisfiability coding lemma shows that parity needs \(\Sigma _3^k\) size about \(2^{n/k}\). The development below proves the same exponent for every dense subcube disperser: a function whose accepted inputs contain no subcube of dimension \(o(n)\). It combines the coding lemma with the sparsification lemma of Impagliazzo, Paturi and Zane. For comparison, Frankl, Gryaznov and Talebanfard (ITCS 2022) prove \(\Sigma _3^3 \ge 2^{0.064n}\) and \(\Sigma _3^k \ge 2^{n/(10k)}\) for affine dispersers through the switching lemma. A subcube is an affine subspace, so dense affine dispersers for sublinear dimension are subcube dispersers, and the bound below has exponent \(1/k - o(1)\) for them. Parity, which accepts no subcube of dimension one and is the OR of \(2^{n/k-1}\) \(k\)-CNFs when \(k\) divides \(n\), shows that \(1/k\) cannot be improved.
A clause set over \(N\) variables is a finite set of clauses, each a finite set of literals; \(x\) satisfies it when every clause has a true literal, and \(\mathrm{sol}(\psi )\) is its set of solutions. A CNF has the clause set of its clauses, and a clause set is listed as a CNF; both translations preserve the accepted inputs and do not increase the width. The occurrences of a variable are the clauses that mention it (for a CNF, counted with multiplicity). Two distinct variables are neighbours in the co-occurrence graph when some clause mentions both. For \(T\subseteq [N]\), \(x\oplus e_T\) flips the coordinates in \(T\). A set \(S\) contains a subcube of dimension \(d\) when some \(a\) and some set \(J\) of \(d\) coordinates have \(a\oplus e_T\in S\) for every \(T\subseteq J\). The isolated directions of \(x\) in \(S\) are the \(i\) with \(x\oplus e_i\notin S\).
Fix a clause set \(\psi \) and an order \(\sigma \) of the variables, a permutation placing \(v\) at position \(\sigma (v)\). On input \(y\) the decoder processes the variables in this order. At \(v\), if some clause has a literal on \(v\) and all its other literals are on earlier variables and false under the values already decoded, it sets \(v\) to satisfy such a literal (positive if some such literal is positive); otherwise it sets \(v := y_v\). The forced variables \(\mathrm{forced}_\sigma (x)\) are those at which the first rule fires on input \(y = x\).
Let \(x\) be a solution of \(\psi \). On every input that agrees with \(x\) outside \(\mathrm{forced}_\sigma (x)\) the decoder outputs \(x\), so \(\sum _{x\in \mathrm{sol}(\psi )} 2^{|\mathrm{forced}_\sigma (x)|}\le 2^N\) for every order \(\sigma \). With \(E(x)\) the average of \(|\mathrm{forced}_\sigma (x)|\) over all \(N!\) orders, \(\sum _{x} 2^{E(x)}\le 2^N\). If every clause has at most \(k\) literals and \(x\) has \(\iota (x)\) isolated directions in \(\mathrm{sol}(\psi )\), then \(\iota (x)\cdot N!\le k\sum _\sigma |\mathrm{forced}_\sigma (x)|\), and so, for \(k\ge 1\), \(\sum _{x\in \mathrm{sol}(\psi )} 2^{\iota (x)/k}\le 2^N\).
Induction along \(\sigma \): before \(v\) the decoder holds \(x\), the first rule fires at \(v\) on the decoded values exactly when it fires on \(x\), and then every forcing literal is the unique true literal of its clause under \(x\). So the sets of inputs agreeing with distinct solutions off their forced variables are disjoint, and each has \(2^{|\mathrm{forced}_\sigma (x)|}\) elements. Average over the orders with Jensen’s inequality for \(t\mapsto 2^t\). If \(i\) is isolated, a clause falsified by \(x\oplus e_i\) has its literal on \(i\) as its only true literal under \(x\); \(i\) is forced whenever \(\sigma \) places \(i\) after the other variables of that clause, which happens for exactly a \(1/|V|\ge 1/k\) fraction of the orders, \(V\) the variables of the clause, by the symmetry \(\sigma \mapsto \sigma \circ (i\; j)\).
For every \(k\) and \(\varepsilon {\gt}0\) there is \(c\) such that every CNF \(\varphi \) of width at most \(k\) over \(N\) variables has a list of at most \(2^{\varepsilon N}\) CNFs of width at most \(k\), in each of which every variable occurs in at most \(c\) clauses, such that each of them accepts only inputs that \(\varphi \) accepts and every input that \(\varphi \) accepts is accepted by one of them. The same holds for clause sets (Impagliazzo, Paturi and Zane, JCSS 2001).
Follow Calabro, Impagliazzo and Paturi (CCC 2006; Calabro’s thesis, Chapter 5). A set \(H\) of \(h\ge 1\) literals is a heavy heart for size \(c{\gt}h\) when at least \(\theta _{c-h}\) clauses of size \(c\) contain it. While there is one, choose \(c\) smallest and then \(h\) largest, and branch: add the clause \(H\), or add every petal \(C\setminus H\); reduce by removing clauses that strictly contain others. The potential \(\sum _C 2^{|C|}\) decreases, so every solution reaches a sparse leaf containing it. Along a branch, introduced clauses are new and distinct, so the length is at most their number. Fewer than \(2\theta _{c-h}\) new clauses of size \(c\) containing a fixed clause of size \(h\) are present at any node (taking the first node containing them all, a larger heart would contradict the choice), and a sparse leaf has at most \(2N\theta _{c-1}\) clauses of size \(c\); so at most \(2N\theta _{c-1}+\sum _{h{\lt}c}2\theta _{c-h}I_h\) clauses of size \(c\) are introduced, \(I_h\) the number of size \(h\). With \(X=2k\alpha \) and \(\theta _j=\alpha X^{2j-1}\) this is at most \(NX^{2c-1}\), so branches have length at most \(\Lambda =NkX^{2k}\) and at most \((k-1)N/\alpha \) petal steps. A leaf is determined by the positions of its petal steps, so there are at most \(\sum _{j\le \rho }\binom {\Lambda }{j}\le e^{\Lambda /T}T^{\rho }\) leaves for every \(T\ge 1\), which is at most \(2^{\varepsilon N}\) for \(T=MkX^{2k}\) and \(\alpha \) large. In a sparse leaf every literal is in at most \(\sum _{c{\lt}k}\theta _c\) clauses.
Let \(x\) be a solution of \(\psi \). If \(x\oplus e_T\) is a solution, \(T'\subseteq T\), and no clause mentions both a variable of \(T'\) and one of \(T\setminus T'\), then \(x\oplus e_{T'}\) is a solution; in particular every connected component of a move in the co-occurrence graph is a move. If \(x\oplus e_{T_j}\) is a solution for each \(j\in s\) and no clause mentions variables of two of the \(T_j\), then \(x\oplus e_{\bigcup _{j\in J}T_j}\) is a solution for every \(J\subseteq s\).
Each clause agrees, on its variables, with \(x\) or with one moved solution.
If every variable has at most \(\Delta \) neighbours in the co-occurrence graph of \(\psi \) and \(\mathrm{sol}(\psi )\) contains no subcube of dimension \(D\), then every solution has at most \((D-1)(\Delta +1)\) non-isolated directions. In a clause set of width \(k\), a variable occurring in \(c\) clauses has at most \(c(k-1)\) neighbours.
A largest set of pairwise non-adjacent non-isolated directions spans a subcube of solutions by Lemma 965, so it has fewer than \(D\) elements, and every non-isolated direction lies in its closed neighbourhood.
If every clause of \(\psi \) has at most \(k\ge 1\) literals, every variable has at most \(\Delta \) neighbours, and \(\mathrm{sol}(\psi )\) contains no subcube of dimension \(D\), then \(|\mathrm{sol}(\psi )|\le 2^{(1-1/k)N+(D-1)(\Delta +1)/k}\). Consequently, for every \(k\ge 1\) and \(\varepsilon {\gt}0\) there is \(C\ge 0\) such that every CNF of width at most \(k\) over \(N\) variables whose accepted inputs contain no subcube of dimension \(D\) accepts at most \(2^{(1-1/k+\varepsilon )N+CD}\) inputs; the same holds for clause sets.
Every solution has at least \(N-(D-1)(\Delta +1)\) isolated directions (Lemma 966), and \(\sum _x2^{\iota (x)/k}\le 2^N\) (Lemma 963). In general, sparsify with \(\varepsilon \) (Theorem 964): each of the at most \(2^{\varepsilon N}\) pieces has degree at most \(c(k-1)\) and only solutions of the original, so no subcube of dimension \(D\); take \(C=(c(k-1)+1)/k\).
A \(\Sigma _3^k\) formula for \(f\colon \{ 0,1\} ^N\to \{ 0,1\} \) is a list of CNFs, each of width at most \(k\), whose OR computes \(f\); a \(\Pi _3^k\) formula is a list of DNFs of width at most \(k\) whose AND computes \(f\). \(\Sigma _3^k(f)\) and \(\Pi _3^k(f)\) are the least lengths of such lists (the top fan-in), which every reasonable size measure of these formulas bounds from above.
For \(k\ge 1\), \(\Sigma _3^k(f)\) is attained, and \(\Pi _3^k(f)=\Sigma _3^k(\neg f)\). For every \(k\ge 1\) and \(\varepsilon {\gt}0\) there is \(C\ge 0\) such that every \(f\) whose accepted inputs contain no subcube of dimension \(D\) has \(|f^{-1}(1)|\le \Sigma _3^k(f)\, 2^{(1-1/k+\varepsilon )N+CD}\). Hence, for a family \(f_n\) whose accepted sets eventually contain no subcube of dimension \(D_n=o(n)\) and have \(n\log 2-\log |f_n^{-1}(1)|=o(n)\), for every \(k\ge 1\) and \(\varepsilon {\gt}0\), eventually \(\Sigma _3^k(f_n)\ge 2^{(1/k-\varepsilon )n}\); under the same hypotheses on the rejected sets, eventually \(\Pi _3^k(f_n)\ge 2^{(1/k-\varepsilon )n}\). A \(K\)-rectangle-free set contains no subcube of dimension \(2m\) when \(K\le 2^m\), so the \(\Sigma _3^k\) bound holds for every family that is eventually \(K_n\)-rectangle-free with \(\log K_n=o(n)\) and has density deficit \(o(n)\).
The OR of the minterms of \(f^{-1}(1)\) is a \(\Sigma _3^1\) formula; De Morgan duality exchanges the two kinds of formulas. Each CNF of a \(\Sigma _3^k\) formula for \(f\) accepts only inputs of \(f\), so it contains no subcube of dimension \(D\), and Theorem 967 bounds what it accepts. In the asymptotic bound apply this with \(\varepsilon /3\), using \(CD_n\le \varepsilon n/3\) and \(|f_n^{-1}(1)|\ge 2^{(1-\varepsilon /3)n}\) for large \(n\). A subcube of dimension \(2m\) with free coordinates \(J_1\sqcup J_2\), \(|J_1|=|J_2|=m\), contains the rectangle for the cut \(J_1\) whose sides are the \(2^m\) restrictions of its points to \(J_1\) and to its complement.
For the polynomial-time family \(\mathrm{sourceReductionHardFamily}\) of Theorem 912, for every \(k\ge 1\) and \(\varepsilon {\gt}0\) and all large \(n\), every OR of CNFs of width at most \(k\) and every AND of DNFs of width at most \(k\) computing it has at least \(2^{(1/k-\varepsilon )n}\) CNFs, respectively DNFs.
Its accepted sets are eventually \(K\)-rectangle-free with \(\log K=o(n)\) and accept half of the cube. On inputs of positive length it is \(f(x)=g(x_1,\dots ,x_{n-1})\oplus x_0\), so flipping \(x_0\) exchanges accepted and rejected inputs: the rejected sets have the same size and no larger subcubes.
8.8 Threshold circuits of unbounded depth
This section bounds the number of input-reading gates of weighted threshold circuits of arbitrary depth by a one-dimensional capacity argument. Fix a two-sided rectangle-free function and a split of its inputs into sides \(A\) and \(B\). A gate whose input weights lie along one direction \(w\) sees the first side \(p\) only through the real number \(\langle w_A,p\rangle \), so sorting the first side by this number and cutting it into groups makes the gate a function of the second side on a large subrectangle. Each input-reading threshold gate costs two bits of the rectangle, one on each side, so about \(n/2\) such gates are needed before the rectangle becomes small. The development is in Complexitylib/Algebraic/LowerBound/Threshold.
A weighted threshold program with \(n\) inputs and \(s\) gates assigns to each gate \(j\) a real input weight vector \(w_j\in \mathbb {R}^n\), real weights \(u_{jk}\) on the earlier gates \(k{\lt}j\), and a real bias \(c_j\), and designates an output gate. On \(x\in \{ 0,1\} ^n\), gate \(j\) outputs \(1\) exactly when \(\langle w_j,x\rangle +\sum _{k{\lt}j}u_{jk}g_k(x)+c_j\ge 0\), Booleans entering the sums as \(0\) and \(1\). The weights are arbitrary reals (integer weights are a special case), and depth, fan-in, and fan-out are unrestricted. The program computes \(f\) when its output gate equals \(f\) on every input. A gate is input-reading when \(w_j\ne 0\); \(s_{\mathrm{in}}\) denotes the number of input-reading gates, and gates that read only other gates are not counted. The evaluation with overrides sets the gates of a set \(F\) to given values and feeds every other gate \(j\) a real number \(z_j\) in place of \(\langle w_j,x\rangle \); the ordinary evaluation overrides nothing.
An activation program has the same wiring and real weights as a weighted threshold program, but gate \(j\) outputs \(\phi _j\bigl(\langle w_j,x\rangle +\sum _{k{\lt}j}u_{jk}g_k(x)\bigr)\) for an arbitrary activation \(\phi _j:\mathbb {R}\to \{ 0,1\} \). A threshold gate is the activation \(t\mapsto [t+c_j\ge 0]\); input-reading gates are those with \(w_j\ne 0\).
A function \(f:\{ 0,1\} ^n\to \{ 0,1\} \) is two-sided \(K\)-rectangle-free if for every split \([n]=A\sqcup B\), balanced or not, and all \(P\subseteq \{ 0,1\} ^A\) and \(Q\subseteq \{ 0,1\} ^B\) such that \(f\) is constant on \(P\times Q\) (with either value), \(|P|{\lt}K\) or \(|Q|{\lt}K\). A function \(\Psi :\mathbb {R}\to Y\) changes at most \(T\) times if along every nondecreasing sequence \(z_0\le z_1\le \cdots \) of reals, every set of positions \(i\) with \(\Psi (z_i)\ne \Psi (z_{i+1})\) has at most \(T\) elements; this is the discrete form of having at most \(T+1\) interval pieces. It has at most \(M\) pieces if it is constant on the level sets of a monotone map \(\pi :\mathbb {R}\to \{ 0,\dots ,M-1\} \).
A block decomposition of \(f\) is a sequence of histories \(h_0,\dots ,h_m\) on \(\{ 0,1\} ^n\), with \(h_0\) constant and \(f\) a function of \(h_m\), in which each step is either one-dimensional with \(T\) changes, \(h_{i+1}(x)=\Phi (h_i(x),\langle w,x\rangle )\) for a weight vector \(w\) and a map \(\Phi \) such that every \(\Phi (\eta ,\cdot )\) changes at most \(T\) times, or a summary with \(V\) values: for every split \((A,B)\), \(h_{i+1}(p,q)=\Phi (h_i(p,q),\sigma (p),q)\) for some \(\sigma \) with at most \(V\) values. Its cost is the product of \(4T\) over the one-dimensional steps with \(T\ge 1\) and of \(V\) over the summary steps. A split of a weighted threshold program into \(B\) direction runs numbers its gates monotonically by \(\{ 0,\dots ,B-1\} \) and assigns each run \(i\) a direction \(d_i\in \mathbb {R}^n\) such that the input weight vector of every gate is a real multiple of the direction of its run; \(r_i\) is the number of input-reading gates of run \(i\).
Cut the positions \(0,1,2,\dots \) into consecutive groups of \(L\). If \(\Psi \) changes at most \(T\) times, then along every nondecreasing sequence \(z\) the map \(i\mapsto \Psi (z_i)\) is nonconstant on at most \(T\) of the groups. Consequently, let \(P\) and \(Q\) be finite sets, \(\alpha \) a real key on \(P\), \(G\ge 1\), and \(\Psi _q\) for \(q\in Q\) functions changing at most \(T\) times. Sort \(P\) by \(\alpha \) and cut it into \(G\) consecutive groups of \(\lfloor |P|/G\rfloor \) elements. For some group \(P'\) there is \(Q_{\mathrm{bad}}\subseteq Q\) with \(G|Q_{\mathrm{bad}}|\le T|Q|\) such that \(p\mapsto \Psi _q(\alpha (p))\) is constant on \(P'\) for every \(q\in Q\setminus Q_{\mathrm{bad}}\). A function with at most \(M\) pieces changes at most \(M-1\) times.
A group on which the sequence is nonconstant contains a change position, and distinct groups contain distinct positions. Sorting \(P\) by \(\alpha \) (by merge sort) gives a nondecreasing sequence of keys, so each \(\Psi _q\) is nonconstant on at most \(T\) groups. Double counting the pairs of a group and a \(q\) for which \(\Psi _q\circ \alpha \) is nonconstant on the group, the sum over the \(G\) groups is at most \(T|Q|\), so some group is bad for at most \(T|Q|/G\) of the \(q\). For pieces, the rank \(\pi (z_{i+1})\) strictly increases from one change position to the next and lies in \(\{ 1,\dots ,M-1\} \).
Fix the values of the gates of a set \(F\) and feed every other gate \(j\) the input contribution \(\lambda _j t\) for one real parameter \(t\), so that gate \(j\) is \([\lambda _j t+\sum _{k{\lt}j}u_{jk}g_k+c_j\ge 0]\). As a function of \(t\), the vector of all gate values has at most \(2^{r'}\) pieces, hence changes at most \(2^{r'}-1\) times, where \(r'\) is the number of gates outside \(F\) with \(\lambda _j\ne 0\).
Induction over the gates in order. On a piece of the earlier gates, gate \(j\) is \([\lambda _j t+c\ge 0]\) for one constant \(c\): constant if \(\lambda _j=0\) or \(j\in F\), and otherwise monotone in \(t\), splitting the piece into at most two intervals. The new rank is twice the old rank plus the gate value, negated when \(\lambda _j{\lt}0\).
If \(f\) is two-sided \(K\)-rectangle-free, every block decomposition of \(f\) has \(2^n{\lt}4K^2\cdot \mathrm{cost}\). With \(K\le 2^k\) this says \(\prod _{i\in I_1}4T_i\prod _{i\in I_2}V_i{\gt}2^{n-2k-2}\), where \(I_1\) consists of the one-dimensional blocks with \(T_i\ge 1\) and \(I_2\) of the summary blocks. In particular, if a weighted threshold program computing \(f\) is split into \(B\) direction runs with \(r_i\) input-reading gates in run \(i\), then \(2^n{\lt}4K^2\prod _ic_i\), where \(c_i=4(2^{r_i}-1)\) if \(r_i\ge 1\) and \(c_i=1\) otherwise.
Suppose \(4K^2\cdot \mathrm{cost}\le 2^n\). Write the cost of each block as a first-side factor (\(2T\) for a one-dimensional block with \(T\ge 1\), \(V\) for a summary block, \(1\) otherwise) times a second-side factor (\(2\) for a one-dimensional block with \(T\ge 1\), \(1\) otherwise), with products \(D_P\) and \(D_Q\). Let \(a=\lceil \log _2(KD_P)\rceil \), so that \(KD_P\le 2^a{\lt}2KD_P\) and hence \(2KD_Q\le 2^{n-a}\), and choose \(A\) with \(|A|=a\). Start from \(P=\{ 0,1\} ^A\) and \(Q=\{ 0,1\} ^B\), keeping the invariant that the current history is a function of \(q\) alone on \(P\times Q\). For a one-dimensional block, \(\langle w,(p,q)\rangle =\alpha (p)+\beta (q)\), so the next history is \(\Psi _q(\alpha (p))\) with \(\Psi _q(t)=\Phi (h(q),t+\beta (q))\); apply the sorted-groups lemma with \(2T\) groups and delete the bad \(q\), at most half of \(Q\). For a summary block keep the largest fiber of \(\sigma \). At the end \(f\) is a function of \(q\) on \(P\times Q\); its majority value on at least half of \(Q\) gives a monochromatic rectangle with \(|P|\ge \lfloor 2^a/D_P\rfloor \ge K\) and \(|Q|\ge \lfloor 2^{n-a}/(2D_Q)\rfloor \ge K\), a contradiction. For direction runs, the history after \(i\) runs holds the values of the gates of the first \(i\) runs, and given the earlier gates, run \(i\) is a run of threshold gates in \(t=\langle d_i,x\rangle \), which changes at most \(2^{r_i}-1\) times by Lemma 976.
Let \(f\) be two-sided \(K\)-rectangle-free with \(K\le 2^k\), and let a weighted threshold program with \(s_{\mathrm{in}}\) input-reading gates compute \(f\). Then:
(C1) \(2^n{\lt}4K^2\cdot 4^{s_{\mathrm{in}}}\), so \(n{\lt}2k+2+2s_{\mathrm{in}}\);
(C2) if every input weight vector is a real multiple of one vector, \(2^n{\lt}16K^2\cdot 2^{s_{\mathrm{in}}}\), so \(n{\lt}2k+4+s_{\mathrm{in}}\);
(C3) if the gates split into \(B\) direction runs, \(2^n{\lt}4K^2\cdot 4^B\cdot 2^{s_{\mathrm{in}}}\), so \(n{\lt}2k+2+2B+s_{\mathrm{in}}\).
A run with \(r\) input-reading gates costs at most \(4^r\) and at most \(4\cdot 2^r\), and the numbers of input-reading gates of the runs sum to \(s_{\mathrm{in}}\). For (C1) split the program into single-gate runs; for (C2) use one run.
Let \(f\) be two-sided \(K\)-rectangle-free with \(K\le 2^k\). (C2\('\)) If \(f(x)=F(\langle w,x\rangle )\) for a function \(F:\mathbb {R}\to \{ 0,1\} \) changing at most \(T\) times, then \(2^n{\lt}4K^2\max (1,4T)\), and \(T{\gt}2^{n-2k-4}\) when \(2k+4\le n\). (C4) If an activation program computes \(f\) and the activation of each input-reading gate \(j\) changes at most \(T_j\) times, then \(2^n{\lt}4K^2\prod _j\max (1,4T_j)\), the product ranging over the input-reading gates.
A multilevel representation is a block decomposition with one one-dimensional block. In an activation program every gate is its own block: given the earlier gates, an input-reading gate \(j\) is \(\phi _j(t+c)\) in \(t=\langle w_j,x\rangle \) for a constant \(c\), and a gate reading no input is a function of the earlier gates.
A two-sided flat sumset disperser at threshold \(K\) is two-sided \(K\)-rectangle-free. Hence, for all sufficiently large \(n\), the fixed polynomial-time family \(\mathrm{sourceReductionHardFamily}(n)\) is two-sided \(K(n)\)-rectangle-free under every split of its inputs, balanced or not, where \(K(n)=2^{k(n)}\) and \(k(n)=o(n)\) is one more than the source entropy of the unpadded extractor at length \(n-1\).
Embed \(P\) as the inputs \((p,0)\) and \(Q\) as the inputs \((0,q)\). These sets have the same sizes, and their XOR sums are exactly the glued inputs \((p,q)\), so dispersion gives both values on \(P\times Q\). The family is eventually such a disperser at \(K(n)\) (Theorem 816).
For every \(\varepsilon {\gt}0\) and all sufficiently large \(n\), the fixed polynomial-time family \(\mathrm{sourceReductionHardFamily}(n)\) satisfies:
(C1) every weighted threshold program with real weights, of any depth, fan-in, and fan-out, computing it has more than \((1/2-\varepsilon )n\) input-reading gates; gates reading only other gates are free;
(C2) if all its input weight vectors are real multiples of one vector, it has more than \((1-\varepsilon )n\) input-reading gates;
(C3) if its gates split into \(B\) consecutive runs along single directions, \(s_{\mathrm{in}}+2B{\gt}(1-\varepsilon )n\); so a program whose input-reading gates switch direction \(B\) times has \(s_{\mathrm{in}}{\gt}n-o(n)-2B\);
(C2\('\)) every representation \(F(\langle w,x\rangle )\) of the family with \(F:\mathbb {R}\to \{ 0,1\} \) changing at most \(T\) times has \(T{\gt}2^{(1-\varepsilon )n}\), so multilevel threshold representations need \(2^{n-o(n)}\) levels;
(C4) every activation program computing it whose input-reading gate \(j\) changes at most \(T_j\) times has \(\sum _j\log _2\max (1,4T_j){\gt}(1-\varepsilon )n\), the sum ranging over the input-reading gates.
For comparison, Roychowdhury, Orlitsky, and Siu (IEEE Trans. Inf. Theory 40(2), 1994) and Gröger and Turán prove that inner product mod \(2\) needs about \(n/4\) gates in threshold circuits of unbounded depth, and Kane and Williams (STOC 2016) prove superlinear gate and superquadratic wire lower bounds for threshold circuits of depth two and three. A literature search in October 2026 found no explicit function proved to need \((1/2+\varepsilon )n\) gates in threshold circuits of unrestricted depth; this has not been checked exhaustively. As for every bound on this family, the threshold on \(n\) is enormous (Theorem 702).
Apply the corollaries with \(K(n)=2^{k(n)}\) and absorb \(2k(n)+4=o(n)\) in the slack \(\varepsilon n\). For C2\('\) use the slack \(\min (\varepsilon ,1)\, n\), which also gives \(2k(n)+4\le n\).
8.9 Polynomial approximation and \(\mathsf{AC}^0[3]\)
Smolensky’s method approximates circuits with \(\mathrm{MOD}_3\) gates by low-degree polynomials over \(\mathbb {F}_3 = \mathbb {Z}/3\) and shows that parity has no such approximation (Razborov–Smolensky). The formalization works with functions \(\{ 0,1\} ^n \to \mathbb {F}_3\) instead of formal polynomials, and it replaces the random choice of the OR approximators by exact counting over all choices.
Read each bit as \(0\) or \(1\) in \(\mathbb {F}_3\). The monomial of a set \(S \subseteq [n]\) is the function \(x \mapsto \prod _{i \in S} x_i\), and a function \(\{ 0,1\} ^n \to \mathbb {F}_3\) has degree at most \(D\) when it is an \(\mathbb {F}_3\)-linear combination of monomials of sets of size at most \(D\).
Let \(C\) be a single-output circuit over the AND/OR/\(\mathrm{MOD}_3\) basis with \(n \ge 1\) inputs and depth at most \(d\), and let \(\ell \ge 1\). Some function \(P\) of degree at most \((2\ell )^d\) satisfies \(\# \{ x : P(x) \ne C(x)\} \cdot 2^\ell \le \mathrm{size}(C) \cdot 2^n\), where \(C(x)\) is read in \(\mathbb {F}_3\).
A \(\mathrm{MOD}_3\) gate on \(u_1, \dots , u_m\) is exactly \((\sum _i u_i)^2\). An OR gate is approximated by \(1 - \prod _{j {\lt} \ell } (1 - (\sum _{i \in T_j} u_i)^2)\) for subsets \(T_1, \dots , T_\ell \) of its inputs, and an AND gate by De Morgan duality; each multiplies degrees by at most \(2\ell \). If \(u \ne 0\) and \(u_k = 1\), pairing each subset \(S\) with \(S \mathbin {\triangle } \{ k\} \) shows that at most half the subsets have \(\sum _{i \in S} u_i = 0\), so at most a \(2^{-\ell }\) fraction of the tuples err at \(u\); if \(u = 0\) none err. Counting pairs of a tuple and an input, some tuple errs on at most \(2^{n - \ell }\) inputs, evaluated on the gate’s true input vector. Fix such a tuple at every gate and compose along the circuit: the result is correct at every input at which every gate approximator is.
A function of degree at most \(D\) agrees with \(n\)-bit parity, read in \(\mathbb {F}_3\), on at most \(\# \{ S \subseteq [n] : |S| \le \lfloor n/2 \rfloor + D\} \) inputs.
Put \(y_i = 1 + x_i \in \{ 1, -1\} \), so that \(\prod _i y_i = 1 + \oplus (x)\) and \(y_i^2 = 1\). On the set \(G\) where \(P\) agrees with parity, \(1 + P\) agrees with \(\prod _i y_i\), so every \(y\)-monomial \(y_S\) with \(|S| {\gt} \lfloor n/2 \rfloor \) equals \((1 + P)\, y_{[n] \setminus S}\) there, of degree at most \(D + \lfloor n/2 \rfloor \). The \(y\)-monomials span all functions, because point indicators have degree at most \(n\) and every \(x\)-monomial expands into \(y\)-monomials. Hence every function \(G \to \mathbb {F}_3\) is the restriction of a function of degree at most \(\lfloor n/2 \rfloor + D\), and comparing cardinalities, \(3^{|G|}\) is at most \(3\) to the number of such monomials.
If \(100 (t + 1)^2 \le n + 1\), then \(10 \cdot \# \{ S \subseteq [n] : |S| \le \lfloor n/2 \rfloor + t\} \le 6 \cdot 2^n\).
By complementation at most \(2^{n-1}\) subsets have \(2|S| {\lt} n\), and the others counted have one of at most \(t + 1\) sizes, each with at most \(\binom {n}{\lfloor n/2 \rfloor }\) subsets. Induction on \(m\) gives \(\binom {2m}{m}^2 (2m + 1) \le 16^m\), hence \(\binom {n}{\lfloor n/2 \rfloor }^2 (n + 1) \le 4^n\) and \(10 (t + 1) \binom {n}{\lfloor n/2 \rfloor } \le 2^n\).
Let \(C\) be a single-output circuit over the AND/OR/\(\mathrm{MOD}_3\) basis with \(n \ge 1\) inputs and depth at most \(d\) that computes \(n\)-bit parity. For every \(\ell \ge 1\),
and for every \(\ell \) with \((40 \ell )^{2d} \le n\), \(5 \cdot \mathrm{size}(C) \ge 2 \cdot 2^\ell \). Taking \(\ell = \lfloor n^{1/(2d)}/40 \rfloor \) gives \(\mathrm{size}(C) \ge 2^{\Omega (n^{1/(2d)})}\); this asymptotic reading is not a separate formal statement.
The approximation of Theorem 983 agrees with parity on all but \(\mathrm{size}(C) \cdot 2^{n-\ell }\) inputs, and Theorem 984 bounds the agreement. If \((40\ell )^{2d} \le n\) and \(d \ge 1\), then \(100((2\ell )^d + 1)^2 \le n + 1\), and Lemma 985 bounds the number of subsets by \(\tfrac {6}{10} \cdot 2^n\).
If a family of size at most \(p(n)\) for a polynomial \(p\) and depth at most \(c\) computed parity, then at length \(n = (40\ell )^{2c}\) Theorem 986 would give \(2 \cdot 2^\ell \le 5\, p((40\ell )^{2c})\) for every \(\ell \ge 1\), which fails for large \(\ell \).
\(\mathsf{TC}^0 \not\subseteq \mathsf{AC}^0[3]\).
Parity is in \(\mathsf{TC}^0\) but not in \(\mathsf{AC}^0[3]\).
8.10 Monotone circuits
A monotone circuit is an AND/OR circuit all of whose negation flags are false. Every monotone circuit computes a monotone function.
Consider a circuit over the imported library’s binary AND/OR signature (fan-in-two AND and OR gates, no constants and no negations) in which the entries \(x_{ik}\) of an \(I \times K\) matrix and \(y_{kj}\) of a \(K \times J\) matrix are distinct inputs (other inputs may be present). If, for all \(i\) and \(j\), some output computes \(\bigvee _k x_{ik} \wedge y_{kj}\) (other outputs are unconstrained), then the circuit has at least \(IJK\) AND gates. Every AND gate of the circuit is counted, used or not, and OR gates are free. In particular, a circuit with the entries of two \(n \times n\) matrices on its \(2n^2\) inputs and their Boolean product on its \(n^2\) outputs, all in row-major order, has at least \(n^3\) AND gates. The schoolbook circuit, with exactly \(IJK\) AND gates, shows the bound is tight; neither this nor the companion lower bound of \(IJ(K - 1)\) OR gates (Paterson; Mehlhorn–Galil) is formalized.
Following Wegener (The Complexity of Boolean Functions, Theorem 6.8.1, after Paterson and Mehlhorn–Galil), call \(x_{ik}\) and \(y_{kj}\) the variables of type \(k\), and re-evaluate the same circuit in stages \(k = 1, \dots , K\). Stage \(k\) sets the variables of type below \(k\) (\(x\) to \(1\), \(y\) to \(0\)), so the outputs become the product over the types from \(k\) on, and forces to the constant \(1\) every gate that was constant \(1\) under this restriction at the previous stage, or whose function accepts each of two distinct type-\(k\) variables on its own. Forcing keeps the outputs: below an input rejected by an output lies a rejected input that sets at most one type-\(k\) variable to \(0\), and every forced gate is already \(1\) there. Call a gate a creator of \((i, k, j)\) if its stage-\(k\) function has the prime implicant \(x_{ik} y_{kj}\) and neither argument’s function has it. The output for \((i, j)\) has this prime implicant, so a creator exists; it is an AND gate one of whose arguments has the implicant \(x_{ik}\) and the other \(y_{kj}\). Two triples of one stage cannot share a creator, since an argument of it would have two type-\(k\) implicants of length one and would have been forced. A creator at stage \(k\) is not one at a later stage, where its argument with the implicant \(x_{ik}\) is constant \(1\). So the creators are \(IJK\) distinct AND gates. The bound is monotone-specific: circuits with negation compute the product with \(O(n^{\log _2 7})\) gates through integer matrix multiplication.
Consider a circuit over the imported library’s De Morgan signature (Boolean constants, identity, NOT, and fan-in-two AND and OR gates, with unbounded fan-out) that has no NOT gate, in which the entries \(x_{ik}\) of an \(I \times K\) matrix and \(y_{kj}\) of a \(K \times J\) matrix are distinct inputs (other inputs may be present). Let \(T\) be any set of triples \((i, k, j)\). If, for all \(i\) and \(j\), some output computes \(\bigvee _{k : (i, k, j) \in T} x_{ik} \wedge y_{kj}\) (other outputs are unconstrained), then the circuit has at least \(|T|\) AND gates. Every AND gate of the circuit is counted, used or not; OR, constant, and identity gates are free. Taking \(T = \{ (i, k, j) : (i, k) \in E_X,\ (k, j) \in E_Y\} \) gives the product of matrices with prescribed supports \(E_X\) and \(E_Y\); taking all triples gives the bound \(IJK\) of Theorem 990 for monotone circuits with constants.
The staged argument of Theorem 990 never uses the shape of \(T\). Stage \(k\) turns the outputs into the product over the triples of \(T\) of type at least \(k\), so the output for \((i, j)\) has the prime implicant \(x_{ik} y_{kj}\) at stage \(k\) for every \((i, k, j) \in T\), and a creator exists. A constant, an identity, or an OR gate has a prime implicant only if one of its arguments has it, so every creator is an AND gate, and the arguments that creators are distinct are unchanged. In Lean the AND/OR bound of Theorem 990 is derived from this one by compiling AND/OR circuits gate by gate into the De Morgan signature.
Consider a circuit over the imported library’s De Morgan signature (Boolean constants, identity, NOT, and fan-in-two AND and OR gates, with unbounded fan-out) in which the entries \(x_{ik}\) of an \(I \times K\) matrix and \(y_{kj}\) of a \(K \times J\) matrix are distinct inputs (other inputs may be present), and suppose that, for all \(i\) and \(j\), some output computes \(\bigvee _k x_{ik} \wedge y_{kj}\) on every input (other outputs are unconstrained). If the circuit has at most \(t\) NOT gates, it has at least \(\lfloor I / 2^t \rfloor \lfloor J / 2^t \rfloor K\) AND gates; every NOT and every AND gate of the circuit is counted, used or not, and OR, constant, and identity gates are free. For \(t = 0\) this is the monotone bound \(IJK\). The bound holds for all \(I\), \(J\), \(K\), and \(t\). In particular, a circuit with the entries of two \(n \times n\) matrices on its \(2n^2\) inputs and their Boolean product on its \(n^2\) outputs, all in row-major order, with at most \(t\) NOT gates has at least \(n \lfloor n / 2^t \rfloor ^2\) AND gates, and at least \(n^3 / 4^{t + 1}\) of them when \(2^t \le n\). Consequently, for \(n \ge 1\) and every real \(\varepsilon \le 2\), if such a circuit has fewer than \(n^{3 - \varepsilon }\) AND gates, it has more than \((\varepsilon / 2) \log _2 n - 1\) NOT gates.
We know of no published lower bound for the Boolean matrix product by circuits with a bounded number of NOT gates. The monotone bound \(n^3\) is due to Pratt, Paterson, and Mehlhorn–Galil; by Markov and Fischer, \(\lceil \log _2 (N + 1) \rceil \) NOT gates suffice for every function of \(N\) inputs, with polynomial overhead in Fischer’s construction; and Jukna (Information Processing Letters, 2004) uses a similar direct-sum restriction for an explicit multi-output function needing \(\log n - O(\log \log n)\) NOT gates.
Induction on \(t\). With no NOT gate, apply Theorem 991 to all triples. Otherwise let \(G\) be the first NOT gate in program order; every wire before it computes a monotone function, in particular the argument \(h\) of \(G\). Let \(F\) consist of the rows \(i {\lt} \lfloor I/2 \rfloor \) of \(x\) and the columns \(j {\lt} \lfloor J/2 \rfloor \) of \(y\), and let \(c = h(\mathbf1_F)\). If \(c = 0\), every input that vanishes outside \(F\) lies below \(\mathbf1_F\), so setting the inputs outside \(F\) to \(0\) makes \(h\), hence \(G\), constant; if \(c = 1\), every input that is \(1\) on \(F\) lies above \(\mathbf1_F\), so setting the inputs of \(F\) to \(1\) makes \(G\) constant. An entry \(z_{ij}\) reads only row \(i\) of \(x\) and column \(j\) of \(y\), so the product of the first \(\lfloor I/2 \rfloor \) rows and \(\lfloor J/2 \rfloor \) columns (if \(c = 0\)), or of the next ones (if \(c = 1\)), is still computed, by a circuit in which \(G\) is replaced by a constant gate and the fixed inputs by a shared constant gate. It has one NOT gate fewer and the same AND gates, and \(\lfloor \lfloor I/2 \rfloor / 2^{t - 1} \rfloor = \lfloor I / 2^t \rfloor \). For the square case, \(n \le 2^{t + 1} \lfloor n / 2^t \rfloor \) when \(2^t \le n\); and if \(\# \mathrm{AND} {\lt} n^{3 - \varepsilon }\), then either \(2^t \le n\) and \(n^\varepsilon {\lt} 4^{t + 1}\), or \(\log _2 n {\lt} t\).
Consider a circuit over the imported library’s De Morgan signature computing the Boolean product of an \(I \times K\) and a \(K \times J\) matrix whose entries are distinct inputs, as in Theorem 992, and a set \(S\) of inputs. If the function computed by every NOT gate depends only on the inputs in \(S\), the circuit has at least \(IJK - |S| \max (I, J)\) AND gates (every AND gate counted, used or not; all other gates free), and in the square row-major case at least \(n^3 - |S|\, n\). The same holds when every gate that computes a non-monotone function depends only on the inputs in \(S\).
Setting the inputs of \(S\) to \(0\) makes every NOT gate constant. Replacing the NOT gates by constant gates and the inputs of \(S\) by a shared constant gate gives a circuit without NOT gates and with the same AND gates computing the product over the triples \((i, k, j)\) with \(x_{ik}, y_{kj} \notin S\). An input lies in at most \(\max (I, J)\) triples, so at least \(IJK - |S| \max (I, J)\) remain, and Theorem 991 applies. For the second form, let a NOT gate compute \(\neg h\). If \(\neg h\) is not monotone, it depends only on \(S\). Otherwise \(h\) is antitone; if \(h\) is an input or a gate computing a monotone function, it is also monotone, hence constant, and if it is a gate computing a non-monotone function, it depends only on \(S\).
Let \(p \ge 2\). Every finite family of more than \(\ell !\, (p-1)^\ell \) finite sets, each of size exactly \(\ell \), contains \(p\) distinct sets whose pairwise intersections are all equal (to their common intersection). The same holds for more than \((\ell + 1)\, \ell !\, (p-1)^\ell \) sets, each of size at most \(\ell \). This is proved in the imported algebraic-circuits library.
Induction on \(\ell \): either a maximal pairwise-disjoint subfamily has \(p\) members, or some element lies in many sets and the lemma applies to them with that element removed (Erdős–Rado). For sets of size at most \(\ell \), some size class has more than \(\ell !\, (p-1)^\ell \) members.
There is \(\varepsilon {\gt} 0\) such that for all \(k \le n^{1/4}\), every monotone circuit deciding whether an \(n\)-vertex graph, given by its adjacency bits, contains a \(k\)-clique has size at least \(2^{\varepsilon \sqrt{k}}\) (Razborov; Alon–Boppana; Arora–Barak Theorem 14.7). This is formalized only in the imported library’s model: Theorem 362 gives more than \(2^{\sqrt{k}}\) gates, that is \(\varepsilon = 1\), for every \(k \le n^{1/4}\), for circuits over that library’s binary AND/OR signature without constants, every gate counted. Transferring the bound to the monotone circuits of Definition 989 remains open.
Razborov’s method of approximations: replace each gate by an approximator that is a small union of clique indicators, use the sunflower lemma to keep approximators small, and show that each replacement errs on few positive or negative test graphs.
8.11 Proof complexity
Clauses are lists of literals over variables in \(\mathbb {N}\), and a CNF is a list of clauses; an assignment is a finite list of bits, variables beyond its end reading \(0\). The resolvent of clauses \(C_1\) and \(C_2\) on a variable \(v\) deletes every occurrence of \(x_v\) from \(C_1\) and of \(\neg x_v\) from \(C_2\) and concatenates the rest. A clause is derivable from \(\varphi \) if it is a clause of \(\varphi \) or a resolvent of two derivable clauses. There is no weakening rule, and the pivot need not occur in the parents.
Every assignment satisfying \(C_1\) and \(C_2\) satisfies their resolvent on any variable, and the resolvent has at most \(|C_1| + |C_2|\) literals.
Case on the value of \(x_v\): the parent whose pivot literal is false keeps a true literal in the resolvent.
Every clause derivable from \(\varphi \) is satisfied by every assignment satisfying \(\varphi \). In particular, if the empty clause is derivable from \(\varphi \), then \(\varphi \) is unsatisfiable.
Induction on the derivation.
If \(\varphi \) is unsatisfiable, then the empty clause is derivable from \(\varphi \).
Induction on the number of variables, eliminating one variable by resolving all pairs of clauses on it (Davis–Putnam).
A resolution refutation of \(\varphi \) is a sequence of clauses ending in the empty clause, each a clause of \(\varphi \) or a resolvent of two earlier ones. Its size is its length and its width is the largest number of literals in one of its clauses. A clause is derivable exactly when it ends such a sequence.
If an unsatisfiable CNF over \(n\) variables whose clauses have at most \(k\) literals has a resolution refutation of size \(S\), then it has one of width at most \(k + O(\sqrt{n \log S})\).
Repeatedly restrict a variable occurring in many wide clauses, and combine the refutations of the two restrictions.
Let \(\mathrm{PHP}^{n+1}_n\) be the CNF over variables \(p_{ij}\) (\(i \le n + 1\), \(j \le n\)) stating that every pigeon \(i\) sits in some hole and no hole holds two pigeons. Every resolution refutation of \(\mathrm{PHP}^{n+1}_n\) has size \(2^{\Omega (n)}\).
Restrict the refutation so that every wide clause disappears, then show that any refutation of the remaining pigeonhole instance contains a wide clause (Beame–Pitassi), or use Haken’s bottleneck counting.
A propositional proof system for unsatisfiable CNFs is a polynomial-time decidable relation \(V(\varphi , \pi )\) that is sound (\(V(\varphi , \pi )\) implies that \(\varphi \) is unsatisfiable) and complete (every unsatisfiable \(\varphi \) has some \(\pi \) with \(V(\varphi , \pi )\)). It is polynomially bounded if every unsatisfiable \(\varphi \) has such a \(\pi \) with \(|\pi | \le p(|\varphi |)\) for a fixed polynomial \(p\).
Checking a resolution refutation, encoded as a clause sequence, is a Cook–Reckhow proof system.
Checking each step takes polynomial time; soundness and completeness are the two theorems above.
A polynomially bounded propositional proof system exists if and only if \(\mathsf{NP} = \mathsf{coNP}\).
Unsatisfiability of CNFs is \(\mathsf{coNP}\)-complete. A polynomially bounded proof system puts it in \(\mathsf{NP}\); conversely an \(\mathsf{NP}\) verifier for it is a polynomially bounded proof system.
8.12 Top-down parity and majority lower bounds
A protocol on coordinates \(I\) with alphabet \(M\) and at most \(d\) rounds either outputs a fixed coordinate or lets one player send a message in \(M\), followed by a protocol with one fewer round. The speaker depends only on the preceding transcript, and a message depends only on that speaker’s input. A solving protocol outputs a coordinate where the two inputs differ, in either orientation. For a function \(f\), Alice’s input belongs to \(f^{-1}(0)\) and Bob’s to \(f^{-1}(1)\). The bound \(|M|\le 2^m\) expresses per-message cost \(m\).
Swapping every speaker exchanges the inputs in the protocol’s run. Hence a protocol for \(f\) gives a protocol for \(\neg f\) with the same alphabet and round bound.
Induct on the protocol tree.
A \((p,k)\)-density rectangle consists of nonempty sets \(X,Y\) of deficit at most \(k\), and some \(0{\lt}r\le p\) such that every point on one side is an \((r,k)\)-limit of the other. The actual rate \(r\) is retained because density-limit conditions need not be monotone in the sampling rate.
Let \(|M|\le 2^m\). Suppose, for \(0\le i{\lt}d\),
and \(p_i\le 1/4\) for \(0\le i\le d\). No protocol with at most \(d\) messages solves a \((p_0,k_0)\)-density rectangle. In particular, for \(k\ge 1\) and \(m+1\le k\), the condition \((32768\cdot 194^d k)^d p\le 1/4\) suffices for a \((p,k)\)-rectangle.
A largest message cell loses at most \(m\) in deficit. Before selecting the cell, mirror if needed so the current limit condition faces the speaking player. The recurrences preserve the density rectangle. A density limit at rate less than \(3/4\) has a point of the other set agreeing with it at any specified coordinate, so no leaf can solve the rectangle. Induct on the remaining messages, allowing early termination. For the finite specialization take \(k_i=194^ik\) and \(p_i=(32768\cdot 194^d k)^i p\).
Suppose \(k\ge 1\), \(X,Y\) are nonempty, each has deficit at most \(k\), and each consists of \((p,k)\)-limits of the other, where \(p{\gt}0\). If \(m\ge 0\) and \((32768\cdot 194^t(m+k))^t p\le 1/4\), no protocol with at most \(t+1\) messages from an alphabet of size at most \(2^m\) solves \(X\times Y\).
Select the first message cell without mirroring. Both deficits are now at most \(m+k\), and the retained limit condition faces the selected side. Apply the density adversary for the remaining \(t\) rounds.
If \(m\ge 0\) and \(16(32768\cdot 194^t(m+1))^t\le n\), no protocol with at most \(t+1\) messages, each from an alphabet of size at most \(2^m\), solves the general KW game for \(n\)-bit parity.
The two parity classes have deficit one. If a resampled coordinate set is nonempty, flipping any selected coordinate pairs the two parities, so each parity fiber has density \(1/2\). At rate \(4/n\) the empty-set probability is at most \(1/5\), using \((1-p)^n(1+np)\le 1\). Thus the initial limits are bilateral. The size condition implies \(n\ge 16\) and the required rate budget.
For each output of an unbounded-fan-in AND/OR circuit with free input negations, depth at most \(d\) gives a general KW protocol with at most \(d\) messages from an alphabet of size \(\mathrm{totalFanIn}\). This is the circuit-to-protocol direction of the Karchmer–Wigderson correspondence in Korten’s Lemma 1. The wire count includes every gate-input occurrence, including output gates and repeated wires. Alternatively, the messages may be drawn from an alphabet of size \(2(n + g)\), where \(n\) is the number of inputs and \(g\) the number of internal gates: each message names a wire together with its negation flag.
Descend through a disagreeing gate input. For OR, Bob selects a true child; for AND, Alice selects a false child. Negated inputs swap the players. Each gate’s fan-in is at most the total wire count. Empty gates have an empty KW relation, so an arbitrary coordinate suffices. For the gate-count alphabet, the message sent at a gate is the chosen input wire and its negation flag, which determines the child subprotocol.
For every \(d\ge 2\) there is \(\varepsilon _d{\gt}0\) such that, for all sufficiently large \(n\), the general Karchmer–Wigderson game for \(n\)-bit parity has no deterministic protocol of at most \(d\) rounds with at most \(\varepsilon _d n^{1/(d-1)}\) bits in each message. Consequently, a depth-\(d\) unbounded-fan-in De Morgan circuit for parity has more than \(2^{\varepsilon _d n^{1/(d-1)}}\) wires. With \(g\) internal gates, also \(2^{\varepsilon _d n^{1/(d-1)}} {\lt} 2(n + g)\); in particular, for every fixed \(d\) and polynomial \(Cn^k + C\), all sufficiently large depth-\(d\) circuits for parity have more than \(Cn^k + C\) internal gates. The analytic prerequisites of this top-down proof are in Section 13.11.
Put \(t=d-1\), \(C=32768\cdot 194^t\), \(\varepsilon _d=(32C)^{-1}\), and \(N_d=(32C)^t\). If \(n\ge N_d\) and \(m\le \varepsilon _d n^{1/t}\), then \(C(m+1)\le n^{1/t}/16\), so \(16(C(m+1))^t\le n\). Apply the finite parity obstruction. For the wire conclusion, a circuit with at most \(2^{\varepsilon _d n^{1/t}}\) wires would give a protocol contradicting the communication conclusion. The gate conclusion is the same argument with the alphabet of size \(2(n+g)\), and \(2(n + Cn^k + C) \le n^{k+2} \le 2^{\varepsilon _d n^{1/(d-1)}}\) for large \(n\) gives the superpolynomial form.
8.12.1 Majority extension
The following extends the formalized argument to strict majority. Korten’s Theorem 3 states the parity case; the adjacent-layer initialization below allows the same adversary to prove the majority bound.
Let \(L_{n,r}=\{ x\in \{ 0,1\} ^n:|x|=r\} \), where \(|x|\) is Hamming weight. The boundary layers of strict majority are \(X=L_{n,\lfloor n/2\rfloor }\) and \(Y=L_{n,\lfloor n/2\rfloor +1}\). Put \(K(n)=128+\log _2(2(n+1))\). A tie belongs to the false side.
Suppose \(n\ge 16\) and at least half the coordinates of \(x\in \{ 0,1\} ^n\) yield a point of \(Z\) when flipped. Then \(x\) is a \((16/n,128)\)-limit of \(Z\).
Sample each coordinate with probability \(16/n\). The probability of hitting a valid flip is at least \(8/9\), using \((1-p)^s(1+sp)\le 1\). The expected mask size is \(16\), so the chance it exceeds \(128\) is at most \(1/8\). With probability at least \(55/72\ge 3/4\), a valid flip is selected and the mask has at most \(128\) coordinates. That single completion gives fiber density at least \(2^{-128}\).
For \(n\ge 16\), both boundary layers are nonempty and have deficit at most \(K(n)\). Each consists of \((16/n,K(n))\)-limits of the other.
The middle binomial coefficient is at least \(2^n/(n+1)\), and its upper neighbor is at least half as large. Thus both layers have deficit at most \(\log _2(2(n+1))\). Each point of \(X\) has at least \(n/2\) zero bits, and each point of \(Y\) has at least \(n/2\) one bits. Flipping any of these bits reaches the other layer. Apply the neighbor lemma and weaken its deficit parameter from \(128\) to \(K(n)\).
If \(m\ge 0\) and \(64(32768\cdot 194^t(m+K(n)))^t\le n\), no protocol with at most \(t+1\) messages, each from an alphabet of size at most \(2^m\), solves the general KW game for \(n\)-bit strict majority.
The size condition implies \(n\ge 64\) and gives the rate budget in the bilateral adversary at \(p=16/n\) and \(k=K(n)\). Restrict a putative majority protocol to the two boundary layers to obtain a contradiction.
For every \(d\ge 2\) there is \(\varepsilon _d{\gt}0\) such that, for all sufficiently large \(n\), the general KW game for strict majority has no deterministic protocol of at most \(d\) rounds with at most \(\varepsilon _d n^{1/(d-1)}\) bits per message. Consequently, every depth-at-most-\(d\) unbounded-fan-in De Morgan circuit for strict majority has more than \(2^{\varepsilon _d n^{1/(d-1)}}\) wires. This covers both even and odd \(n\). With \(g\) internal gates, also \(2^{\varepsilon _d n^{1/(d-1)}} {\lt} 2(n + g)\), so at every fixed depth strict majority needs more than \(Cn^k + C\) internal gates for all sufficiently large \(n\).
Put \(t=d-1\), \(C=32768\cdot 194^t\), and \(\varepsilon _d=(128C)^{-1}\). Since \(K(n)=o(n^{1/t})\), eventually \(K(n)\le \varepsilon _d n^{1/t}\). If also \(m\le \varepsilon _d n^{1/t}\), then \(C(m+K(n))\le n^{1/t}/64\), implying the finite obstruction. Apply the circuit-to-protocol theorem for the wire conclusion. The gate-count alphabet of size \(2(n+g)\) gives the gate conclusions as for parity.