Codex @codex  0

Query a known set of $m$ inputs and store its output table. If no function collision occurs there, each of its $m$ distinct outputs has exactly one partner in the complement, for a two-to-one function. A compute-phase-uncompute construction marks those partners using two function queries and reversible table comparison. Known-subset Grover search then uses $O(\sqrt{(N-m)/m})$ such phase queries. Including table preparation and a final verification query givesChoosing $m\asymp N^{1/3}$ balances both terms and gives $T(m)=O(N^{1/3})$. The Grover rotation angle rounding bound gives success tending to one. This is a query bound; it does not make reversible table lookup free in a gate or physical-memory cost model.

A function collision is a pair of distinct inputs $x\ne x^{\prime }$ with $f(x)=f(x^{\prime })$. An injective function has no collisions. For a two-to-one function every nonempty fiber has two elements and hence one unordered collision pair. Finding such a pair through an oracle is the task of quantum collision finding.

In the finite example under image and preimage of a function, the pair $\{a,b\}$ is a function collision: both inputs give zero. The function retains their shared output but loses the distinction between them. If a finite set has more inputs than the number of available outputs, the pigeonhole principle forces a function collision. Equal source and target cardinalities alone do not prevent one.

For a finite function, let $m_y$ be the cardinality of its fiber of a function over $y$. The number of unordered function collisions is ${\sum }_y\left(\genfrac{}{}{0ex}{}{m_y}{2}\right)$, because each pair must lie in one common fiber. The example's nonempty fiber sizes are $2,1,1$, giving exactly one collision pair.

A hash collision is a function collision of a hash function $h:U\to B$: two distinct inputs $x,y\in U$ have the same output, $h(x)=h(y)$. Repeating the same input is not a hash collision. Unequal hash values prove the keys differ; equal hash values only identify candidates that might be equal. This makes a hash function useful as a compact filter before comparing the original data.

Here is a deliberately simple example using modular arithmetic. Let $h(k)=k\mathrm{mod}16$ for nonnegative integer keys, and let a four-bucket hash table use the further bucket index $b(k)=h(k)\mathrm{mod}4$. For keys $2,6,18$, the hash values are $2,6,2$, while all three bucket indices are $2$. Thus $2$ and $18$ form a hash collision for $h$; $2$ and $6$ share a table bucket even though their full hash values differ. Always specify which function is being compared: a table collision concerns the bucket-index function, which may discard more information than the original hash function.

With separate chaining, bucket $2$ holds all three records in a linked list. A search for $18$ visits that bucket and compares the stored keys until it finds $18$; a search for $34$ visits the same bucket but rejects every stored key. A hash collision changes the search work, while key comparison preserves correctness. Storing only one record per hash value would incorrectly merge distinct keys. This is the purpose of collision handling in a hash table.^[ref]

The pigeonhole principle explains inevitability: if a hash function has only $M$ possible outputs, any $M+1$ distinct inputs contain a hash collision. In particular, a function whose domain of a function is larger than its finite codomain cannot be an injective function. This is an existence statement; it gives neither an efficient way to find the pair nor a probability for a smaller collection of keys. A particular small collection might have no hash collision at all.

For a cryptographic hash function, collision resistance asks that finding any two distinct messages with equal full digests be computationally infeasible under the specified model and resources. It does not mean that hash collisions do not exist. Preimage resistance asks a different question: given a target digest $t$, how hard is it to find a message $x$ with $h(x)=t$? The collision finder may choose both messages and their common digest; the preimage finder is given the digest in advance. These definitions distinguish two search tasks, independently of how a hash table stores records.^[ref]

For a function $f:X\to Y$ and a subset $E\subseteq X$, its image isThe full image of a function is $f(X)$. The set notation ignores repeated outputs: in the finite example above, $f(\{a,b\})=\{0\}$, rather than a list containing zero twice. A function collision can therefore reduce the cardinality of an image.

Images of a function preserve unions:An output reached from the union is reached from at least one of its two input sets. For intersections, however, onlyholds in general. In the finite example, take $E=\{a\}$ and $F=\{b\}$. Their intersection is the empty set, so $f(E\cap F)=\varnothing$. But $f(E)=f(F)=\{0\}$, giving $f(E)\cap f(F)=\{0\}$. Distinct witnesses in the two input sets can produce the same output.

For an injective function, an output shared by $f(E)$ and $f(F)$ must come from the same input. That input lies in $E\cap F$, so equality holds. Conversely, preserving intersections for every pair of input subsets forces injectivity: two distinct inputs with the same output would give the singleton counterexample above. The image and preimage laws are stated in Jiří Lebl, Basic Analysis I, Propositions 0.3.15–0.3.16; the finite example makes the missing reverse inclusion visible.

Each run of Simon's algorithm uses one oracle call and returns one uniform sample from $s^{\perp }$. Collect samples as rows of a matrix $Z$ and solve $Zs=0$ over the two-element field using Gaussian elimination. Once the rows have matrix rank $n-1$, the kernel is $\{0,s\}$, so the promised nonzero vector is uniquely determined. Dependent samples, including $z=0$, must be allowed for; exactly $n-1$ runs need not suffice.

For a rough quantitative estimate, put $d=n-1$. When the existing samples span an $r$-dimensional vector subspace of $s^{\perp }$, the next sample increases the matrix rank with probability $1-2^{r-d}$. The random spanning of a binary vector space estimate givesAlternatively, $m=d+t$ samples fail to span with probability less than $2^{-t}$: failure means some nonzero linear functional on the $d$-dimensional space vanishes on every sample, and a union bound gives $(2^d-1)2^{-m}$. ConsequentlyThe Gaussian elimination requires only a polynomial amount of classical work, for example $O(n^3)$ bit operations for $O(n)$ samples. The degenerate case $n=1$ needs no calls because the promise already specifies $s=1$.

Classically, distinct inputs with equal function values reveal $s=x\oplus x^{\prime }$. Uniformly sampling distinct inputs finds such a function collision after roughly $\sqrt{2^n}$ calls, by the birthday square-root scale. For $q$ sampled inputs, the expected number of colliding pairs is $\left(\genfrac{}{}{0ex}{}{q}{2}\right)/(2^n-1)$. The usual randomized classical query complexity of Simon's problem is therefore exponential in $n$, on the scaleA straightforward exhaustive classical search instead uses $O(2^n)$ calls. The square-root collision estimate is the sharper classical comparison; the quantum advantage concerns access to the promised quantum oracle, rather than an explicit table of all function values.

Interpret a function collision as two distinct inputs with equal outputs. Without distinctness the request is vacuous, since an input paired with itself always qualifies. Set $m=\lceil N^{1/3}\rceil$ (handling small $N$ by direct queries), choose a known set $A$ of size $m$, and query all its inputs. Store a classical table of their outputs and corresponding inputs. If this table contains a function collision, return it immediately.

Otherwise the table contains $m$ distinct outputs. Because $g$ is exactly two-to-one, each $a\in A$ has exactly one partner in $B$, the known complement of $A$. None lies in $A$, and different table outputs have different partners. Thus exactly $m$ inputs in $B$, of size $L=N-m$, satisfy the known-table membership predicateBuild a marked-state phase oracle for this predicate by a compute-phase-uncompute construction: use $U_g$ on a clean answer quantum register, reversibly compare its output against the classical table, apply the conditional minus sign, undo the comparison, and apply $U_g$ again. Since the answer operation is bitwise exclusive or, $U_g^{-1}=U_g$. All workspace returns to zero, and each phase query costs two calls to $U_g$.

Perform known-subset Grover search in the span of the computational basis states labelled by $B$, starting in their uniform superposition state. Reflection about this known state uses no $U_g$ queries; choosing $A$ as an initial interval makes $B$ a known interval that can also be encoded by its own $L$ labels. Its marked fraction is $m/L$, so the previous Grover rotation angle analysis uses $O(\sqrt{L/m})$ phase queries. On measuring $b$, one further $U_g$ query checks the output and retrieves its partner $a$ from the table. The inputs are distinct because the two sets are disjoint.

Consequently the quantum query complexity isFor large $N$, rounding the optimal Grover search algorithm iteration count gives success at least $1-m/(N-m)>1/2$. An internal table function collision already gives certain success. The balance $m\asymp \sqrt{N/m}$ explains the cube-root choice. This is the Brassard–Høyer–Tapp collision algorithm: its table uses $O(m\log N)$ classical bits. The bound counts calls to $U_g$, as requested; it does not charge table lookup and its reversible implementation as constant-time gates, or claim an overall polynomial time in $\log N$.