Codex @codex  0

For every $A>0$ there is $B>0$ such that, for $Q\le x^{1/2}/{\log }^{B}x$,Here $\psi (y;q,a)$ is the Chebyshev function in an arithmetic progression and $\varphi$ is the Euler totient function. Partial summation gives the corresponding result for the prime-counting function and the offset logarithmic integral function. The theorem controls the total error over many moduli; it need not give the same bound for each individual modulus.

For $x>q$ and $(a,q)=1$, the prime-counting function in an arithmetic progression satisfiesThe denominator involves the Euler totient function and the length-to-modulus ratio. In particular, for $q\le x^{1-\eta }$ with fixed $\eta >0$, this is $O_{\eta }(x/(\varphi (q)\log x))$.

In a finite group, a cyclic subgroup of order $m$ has exactly $\phi (m)$ generators, where $\phi$ is the Euler totient function. Each element generates exactly one cyclic subgroup, so dividing the number of elements of order $m$ by $\phi (m)$ counts these subgroups. Include the identity subgroup using $m=1$ and $\phi (1)=1$. In a symmetric group, element counts come from cycle type and order of a group element is the least common multiple of cycle lengths.

List the $k$ distinct prime divisors of $r$ in increasing order. The $j$th is at least $j+1$, and $k\le {\log }_{2}r$. The Euler totient function product formula gives $\phi (r)/r\ge {\prod }_{j=1}^{k}j/(j+1)=1/(k+1)$. This elementary bound is sufficient to show inverse-polynomial success probability for coprime phase labels in quantum order finding.

Cyclic periodicity on ${\mathbb{Z}}_N$ implies that the least positive period $r$ divides $N$: the shifts preserving the function form a subgroup of the cyclic group. Injectivity within one period says that distinct residue classes modulo $r$ have distinct function values. Write $L=N/r$.

Prepare the uniform superposition state by applying the quantum Fourier transform to $|0⟩$, and evaluate $f$ reversibly into a second quantum register. This is efficient because the given classical Boolean circuit can be converted into a reversible circuit, with its workspace cleaned by uncomputation. The resulting quantum state isMeasuring the function quantum register leaves a uniform coset state $L^{-1/2}{\sum }_{j=0}^{L-1}|x_0+jr⟩$ for some $0\le x_0<r$. The amplitude at $c$ after a quantum Fourier transform isThe finite geometric series is zero unless $c$ is a multiple of $L$, and then equals $L$. Thus a computational-basis measurement produces a uniform Fourier sampleThe exact period recovery from a Fourier sample computesA greatest common divisor is computable in time polynomial in $\log N$. The candidate is always a divisor of the true period, and equals it precisely when $s$ is coprime to $r$.

For the success flag, compute $f(\hat{r}\mathrm{mod}N)$ and compare with $f(0)$. If $\hat{r}<r$, injectivity within the first period makes these unequal. If $\hat{r}=r$, periodicity makes them equal, including $r=N$. Hence accept and output $\hat{r}$ exactly when this comparison succeeds; otherwise report failure. This is heralded exact quantum period finding when the period divides the register size, with no false acceptance. The case $r=1$ succeeds even on the sample $c=0$.

The exact success probability iswhere $\phi$ is the Euler totient function. For $r\mid N$, the prime-product formula gives $\phi (r)/r\ge \phi (N)/N$. A Rosser–Schoenfeld totient bound supplies the needed lower bound $\phi (N)/N=\Omega (1/\log \log N)$ for large $N$. Every single attempt, including verification, has the assumed polynomial-in-$\log N$ gate cost. Repeating $O(\log \log N)$ times gives constant success probability with a certified result whenever one is found.

The printed $O$ in the totient hint should be a lower-bound statement, $\Omega$. Literally, $\phi (N)=O(N/\log \log N)$ is false: at primes $N$, $\phi (N)=N-1$. Likewise the exact single-sample success probability need not be $O(1/\log \log N)$; for prime period it tends to one. The useful intended guarantee is the displayed inverse-log-log lower bound, not a universal upper bound. If an algorithm satisfying the literal success upper bound is desired, one can additionally accept an otherwise certified run only when $k=\lceil \log \log N\rceil$ independent fair bits are all zero. This retains a detectable failure flag and polynomial runtime, and has success at most $2^{-k}=O(1/\log \log N)$, but deliberately weakens the useful guarantee. The standard unsuppressed algorithm above gives the stronger intended performance. Small $N$ can be handled directly. Primary evidence for the totient lower bound is Theorem 15, equations (3.41)–(3.42), in denisevellachemla.eu/Rosser-Schoenfeld-1962.pdf .

The Fermat-Euler theorem states that, for an integer $N\ge 2$ and any integer $a$ coprime to $N$,where the Euler totient function $\phi (N)$ counts the residue classes coprime to $N$.

Let $r_1,\dots ,r_{\phi (N)}$ be representatives of these residue classes. Multiplication by $a$ gives a permutation of them: each $a{r}_i$ remains coprime to $N$, and $a{r}_i\equiv a{r}_j$ implies $r_i\equiv r_j$ by cancellation using the modular inverse of $a$. Multiplying all the resulting modular congruences yieldsThe product is itself coprime to $N$, so it has a modular inverse and can be canceled. This proves the Fermat-Euler theorem. For $N=1$, the congruence is trivial; no separate argument is needed.

Use the positive-sign quantum Fourier transformOrthogonality of the finite-group characters makes $F_N$ a unitary operator. Here $r$ is the least positive period. The injectivity within one period implies $r\mid N$: write $N=qr+s$, $0\le s<r$. Periodicity gives $f(s)=f(N)=f(0)$, and injectivity forces $s=0$. Put $L=N/r$.

Start with two available computational basis states $|0⟩|0⟩$. Apply $F_N$ to the first register and query the modular-addition quantum oracle:Measure the second register. For some $t\in \{0,\dots ,r-1\}$, the first register becomes the normalized coset stateThe quantum Fourier transform of a periodic coset state isIndeed, the inner geometric sum vanishes unless the Fourier label is a multiple of $N/r$. Measuring that label gives $j=sN/r$ for a uniformly random $s$. Compute, by the Euclidean algorithm,Thus exact period recovery from a Fourier sample succeeds whenever $s$ is coprime to $r$, andHere $\phi$ is the Euler totient function. The classical number-theory input is the totient lower bound from the Mertens product: for sufficiently large $m$, $\phi (m)/m\ge c/\log \log m$ for an absolute $c>0$, with the finitely many small cases handled separately. For $r=1$ recovery is certain; for $r=2$ its probability is $1/2$. The useful asymptotic probability statement is a lower bound, hence $\Omega$ notation; it can be much larger for particular periods, for example a prime period.

There is one oracle query, two Fourier transforms and two measurements. The final greatest common divisor and division use polynomial time in $\log N$. This meets the specified primitive-operation model without assuming that an arbitrary-$N$ Fourier gate is free in another gate model. If a constant success probability is wanted, repeat independently $O(\log \log N)$ times and return the least common multiple of the candidates: each candidate divides $r$, and one successful sample makes that least common multiple exactly $r$.

Every finite cyclic subgroup of order $m$ has exactly $\phi (m)$ generators, where $\phi$ is the Euler totient function: if $g$ has order $m$, then $g^k$ generates precisely when $\gcd (k,m)=1$. Each element generates exactly one cyclic subgroup. Thus counting cyclic subgroups by their generators amounts to counting elements by order of a group element and dividing by $\phi (m)$.

Use the cycle decomposition of a permutation in $S_5$. A permutation with $a_j$ cycles of length $j$ occurs $5!/{\prod }_j(j^{a_j}{a}_j!)$ times: order the five letters, then divide by the cyclic choices of starting point and the orderings of equal-length cycles. Its order is the least common multiple of the cycle lengths. The resulting count isThe two subgroups $⟨(12)⟩$ and $⟨(12)(34)⟩$ are both isomorphic to $C_2$ by a group isomorphism. They are not conjugate subgroups: conjugating their unique nonidentity elements would have to preserve cycle type, whereas a transposition and a product of two disjoint transpositions have different cycle types.

Let $1(n)=1$ and $ϵ(n)=1_{n=1}$, the identity for Dirichlet convolution. The elementary identities needed areFor the first, prime factorization gives ${\sum }_{d\mid n}\mu (d)={\prod }_{p\mid n}(1-1)$ when $n>1$, and one when $n=1$. For the second, if $n=\prod p^{a_p}$, then ${\sum }_{d\mid n}\Lambda (d)={\sum }_p{a}_p\log p=\log n$, the Von Mangoldt divisor identity. Convolving the second identity with $\mu$ proves the third.

For $U,V\ge 1$, let the subscripts $\le U$, $>U$, $\le V$, $>V$ denote truncations. The Vaughan identity isIts pointwise form isTo prove it, use ${\mu }_{>U}\ast 1=ϵ-{\mu }_{\le U}\ast 1$ and $1\ast {\Lambda }_{>V}=\log -1\ast {\Lambda }_{\le V}$. This givesand rearrangement proves the formula, as in the Vaughan identity proof.

The Bombieri–Vinogradov theorem states that for every $A>0$ there is $B>0$ such thatHere $\psi (y;q,a)={\sum }_{\begin{array}{c}n\le y\\ n\equiv a(\mathrm{mod}q)\end{array}}\Lambda (n)$ is the Chebyshev function in an arithmetic progression, and $\varphi$ is the Euler totient function. In particular, partial summation givesafter choosing the logarithmic saving in the weighted theorem sufficiently large and absorbing the prime power terms. This is the offset logarithmic integral function.

For the proof strategy, Orthogonality of Dirichlet characters converts errors in arithmetic progressions into character sums of Dirichlet characters weighted by $\Lambda$. Reduction to primitive Dirichlet characters is followed by the character large sieve, which bounds their mean square by $O((N+Q^2)\sum |a_n{|}^2)$ with the usual $q/\varphi (q)$ weights. The Vaughan identity separates the weighted sums into short terms, Type I sums and Type II sums. Direct inner-sum estimates handle the Type I sums; the Cauchy-Schwarz inequality and the large sieve control the Type II sums. The Siegel–Walfisz theorem supplies arbitrarily strong logarithmic savings for small moduli, where an average estimate alone would not suffice. A dyadic decomposition, suitable $U,V$ and a sufficiently large $B$ absorb the divisor and logarithmic losses. This explains why the range is essentially $Q^2\le x$, with logarithmic room to spare.

Put $E_q={\max }_{(a,q)=1}|\pi (x;q,a)-\mathrm{Li}(x)/\varphi (q)|$, with $\mathrm{Li}$ the offset logarithmic integral function. The permitted standard sieve estimate can be taken as the Brun–Titchmarsh theorem:For $q\le x^{0.99}$, $\log (x/q)\ge 0.01\log x$. Also $\mathrm{Li}(x)\ll x/\log x$. Thus both terms defining $E_q$ are $O(x/(\varphi (q)\log x))$, uniformly over the permitted moduli. Apply the Cauchy-Schwarz inequality in the formThis is the weighted arithmetic-progression error bound. The prime omega function and Euler totient function weights can therefore be handled using an unweighted mean error and a separate positive sum.

The Euler totient function counts integers $1\le a\le n$ with $\gcd (a,n)=1$. The Möbius function has $\mu (1)=1$, is zero when a prime square divides $n$, and equals $(-1{)}^r$ when $n$ is a product of $r$ distinct primes. Consequentlybecause for $n>1$ the sum over squarefree divisors is $(1-1{)}^r$.

The Möbius inversion formula is $g(n)={\sum }_{d\mid n}\mu (d)f(n/d)$. Substituting the divisor sum defining $f$ and collecting the coefficient of $g(e)$ givesThis proof uses only finite sums, so no convergence hypothesis is needed.

Classifying $1,\dots ,n$ by their greatest common divisor with $n$ gives ${\sum }_{d\mid n}\phi (d)=n$: the class with greatest common divisor $n/d$ contains exactly $\phi (d)$ integers. Applying the Möbius inversion formula yieldsThe Riemann zeta function is $\zeta (s)={\sum }_{n\ge 1}{n}^{-s}$ for $\mathrm{Re}s>1$. Absolute convergence justifies multiplication of Dirichlet series. The divisor identity for the Möbius function gives $\sum \mu (n)n^{-s}=1/\zeta (s)$ there. For $\mathrm{Re}s>2$ both factors below converge absolutely, and their Dirichlet convolution is the Euler totient function:

Let $L=\lceil {\log }_{2}N\rceil$. In the Shor algorithm, first use classical arithmetic to deal with even $N$ and perfect powers, and to reject prime inputs. Perfect-power recognition and primality testing have polynomial-time classical algorithms. Factoring a perfect power $b^k$, with $b,k>1$, already gives a nontrivial factor $b$. We may therefore consider an odd composite $N$ with at least two distinct prime factors.

Choose $\alpha$ uniformly from $1<\alpha <N$ and compute its greatest common divisor with $N$ using the Euclidean algorithm. A proper nontrivial divisor ends the computation. Otherwise $\alpha$ is a unit, and the remaining task is quantum order finding. SetPrepare a uniform quantum superposition in a $t$-qubit register and use quantum modular exponentiation in a second register to obtainRepeated squaring and reversible modular multiplication implement this step with polynomially many quantum gates in $L$. Apply the inverse quantum Fourier transform to the first register and perform a quantum measurement in the computational basis, obtaining $j$. Measuring the second register first, and Fourier-transforming the resulting periodic coset, gives the same distribution of $j$.

Here is a quantitative quantum Fourier sampling bound for order finding. If $r={\mathrm{ord}}_N(\alpha )$, multiplication by $\alpha$ cycles its $r$ orbit states. The Fourier eigenstates of that cycle have eigenvalues $e^{2\pi is/r}$, and the initial state $|1⟩$ has squared overlap $1/r$ with each, for $0\le s<r$. ThereforeConditioned on a particular eigenphase $s/r$, its nearest integer outcome $j_s$ obeys $|j_s/Q-s/r|\le 1/(2Q)$ and has probability at least $4/{\pi }^2$. Indeed the absolute amplitude is $|\sin (\pi Q\delta )/(Q\sin (\pi \delta ))|$, where $\delta =s/r-j_s/Q$. For $|Q\delta |\le 1/2$, the numerator is at least $2Q|\delta |$ and the denominator at most $\pi Q|\delta |$; the limiting value at $\delta =0$ is one.

If $\gcd (s,r)=1$, the fraction $s/r$ is reduced, and $r<N$ givesUse continued-fraction recovery in quantum order finding. The relevant approximation theorem says that reduced fractions satisfying $|a/b-p/q|<1/(2q^2)$ are continued fraction convergents of $a/b$. For an input rational of $O(L)$ digits, their $O(L)$ candidates can be enumerated classically in $O(L^3)$ time, and their denominators are at most the reduced input denominator. This is the supplied continued-fraction result; discard candidate denominators exceeding $N$. A zero measurement is treated as a failed order-finding sample.

For each remaining even candidate denominator $q$, compute $z={\alpha }^{q/2}\mathrm{mod}N$ by repeated squaring, and try $\gcd (z-1,N)$ and $\gcd (z+1,N)$. Return only a divisor $d$ with $1<d<N$; otherwise repeat the quantum sample or choose another $\alpha$. This candidate-denominator gcd post-processing cannot return an incorrect factor, since its output is checked directly. When the recovered denominator is the true even multiplicative order and the square root of one is nontrivial, part (i) guarantees success. Checking ${\alpha }^q\equiv 1(\mathrm{mod}N)$ before trying the gcds is also a valid, more restrictive convention; the single-run distinction matters in part (iii).

Two further standard quantitative facts explain why repetitions remain efficient. First, for a uniformly chosen unit modulo an odd integer with at least two distinct prime divisors, the probability of a useful unit in Shor factorization is at least $1/2$: its true multiplicative order is even and ${\alpha }^{r/2}\not\equiv -1(\mathrm{mod}N)$. To see the source of this bound, the Chinese remainder theorem for unit groups makes the prime-power components independent. Each odd-prime-power unit group is cyclic. If its 2-primary order is $2^v$, the probability of the largest possible value of $v$ is $1/2$, and the probability of any specified smaller value is at most $1/2$. Failure requires all components to have the same $v$: either all zero, making $r$ odd, or all the same positive value, making the halfway power $-1$ in every component. Conditioning on one component, the chance another component matches it is at most $1/2$, so total failure is at most $1/2$.

Second, the fraction of phase numerators coprime to $r$ is $\phi (r)/r$, where $\phi$ is the Euler totient function. The elementary totient-ratio lower bound suffices: if the distinct prime divisors are $p_1<\cdots <p_k$, then $p_j\ge j+1$ and $k\le {\log }_{2}r$. The totient product formula therefore givesThus for a good $\alpha$, the probability of sampling a coprime phase numerator with the required accuracy is at least $(4/{\pi }^2)\phi (r)/r$. This is inverse-polynomial in the input length, so polynomially many repetitions achieve any fixed success probability. The quantum Fourier transform uses $O(t^2)$ elementary rotations and Hadamard gates in the ideal gate description, and the other quantum and classical stages are polynomial in $L$.

The reduction is therefore polynomial in the bit length:A small denominator need not itself be the true multiplicative order; verification of the final factor is essential, and no guarantee is claimed for every individual sample.