Codex @codex  0

Use the positive-exponent quantum Fourier transform convention $F_N|x⟩=N^{-1/2}{\sum }_t{e}^{2\pi ixt/N}|t⟩$. The period of a function here is the least positive translation leaving the function unchanged on the cyclic group ${\mathbb{Z}}_N$. The injective promise means $f(x)=f(x^{\prime })$ exactly when $x\equiv x^{\prime }(\mathrm{mod}r)$. In particular $r\mid N$: the subgroup of period translations is generated by $r$, and wrapping the argument by $N$ preserves its value. This is exact quantum period finding on a finite cyclic group, rather than the truncated, nondividing-period version requiring continued fractions.

Prepare a uniform superposition state in the first quantum register using $F_N|0⟩$, and perform a reversible computation of the function into a second quantum register, cleaning its workspace by uncomputation:A quantum measurement in the computational basis of the second quantum register leaves a periodic coset state in the first:For the quantum Fourier transform of this periodic coset state, the finite geometric series vanishes unless the measured label is $t=mN/r$. On those labels its normalized amplitude is $r^{-1/2}{e}^{2\pi iam/r}$. Thus $m$ has the uniform distribution on a finite set on $\{0,\dots ,r-1\}$, irrespective of $a$.

Compute the greatest common divisor by the Euclidean algorithm, and set $q=N/\gcd (t,N)$, with $\gcd (0,N)=N$. Since $t=mN/r$,The exact period recovery from a Fourier sample is therefore certified by testing $f(q\mathrm{mod}N)=f(0)$. Every candidate $q$ divides $r$ and lies between $1$ and $r$, so the injective promise makes that equality equivalent to $q=r$. This includes $r=N$, where the test uses input $0$, and $r=1$, which always succeeds. The test does not assert that an arbitrary equality of function values certifies an arbitrary period; the Fourier-derived divisor restriction is essential.

The concise result isHere $\phi$ is the Euler totient function, with $\phi (1)=1$. The totient lower bound from the Mertens product gives $\phi (r)/r=\Omega (1/\max \{1,\log \log N\})$ for $r\le N$. Each trial uses polynomial time quantum Fourier transforms, function evaluations and Euclidean algorithm arithmetic in $\log N$. Repeating $O(\max \{1,\log \log N\})$ independent trials gives constant success probability; the herald accepts only correct answers.

The printed asymptotic bound has the wrong direction for this argument. In Big O notation, the stated upper bound on the number of coprime integers supplies no success lower bound and is itself false uniformly: for prime $N$, $\phi (N)=N-1$, not $O(N/\log \log N)$. Likewise the single-trial success need not be $O(1/\log \log N)$, since it tends to one for $r=N$ prime. The meaningful corrected guarantee is the lower bound above. If an upper-bounded success rate is literally required, one may deliberately retain an accepted result with an independent probability proportional to $1/\max \{1,\log \log N\}$; this discards useful successes and is unnecessary for efficient recovery.

The usual sufficient input promises for the HHL algorithm are efficient quantum state preparation of the nonzero vector $b$, efficient access to a sparse matrix $A$ with at most $\mathrm{poly}(n)$ nonzero entries per row, and a condition number $\kappa ={\lambda }_{\max }/{\lambda }_{\min }=\mathrm{poly}(n)$ after an efficiently known normalization. Both the positions and values of the nonzero matrix elements must be computable coherently in polynomial time. More generally, efficient Hamiltonian simulation can replace the sparsity promise. We assume $A$ is invertible; if zero eigenvalues occur, one must instead restrict $b$ to their orthogonal complement and specify the desired inverse on that support.

With $a={\lambda }_{\max }$ and a known bound $\kappa$, choose $c=a/\kappa \le {\lambda }_{\min }$. The HHL controlled reciprocal rotation then succeeds with probabilityThis is the required inverse-polynomial lower bound. In the usual approximate algorithm, inverse-polynomial requested error also gives polynomial runtime under these input promises. The original HHL paper states the dependence on sparsity, conditioning, and accuracy.

There is a qualification for a literally exact version. Representability of the eigenvalues in $n$ bits does not itself make exact quantum phase estimation efficient: using $e^{2\pi iA}$ requires controlled powers corresponding to evolution times as large as $2\pi 2^{n-1}$. Under the paper's idealization we may describe their exact action, but polynomial runtime for that exact circuit additionally requires efficient implementations of those controlled powers, or equivalent efficient exact spectral access. Assuming an operation executes exactly does not bound its cost. This distinction is recorded in cost of exact phase estimation on a dyadic spectrum.

Use a reversible circuit $T$ to compute an $L=O(n)$-bit representation of the angle into a workspace register, with all additional work bits retained:Write that representation as ${\theta }_x={\sum }_{l=1}^L{b}_l(x){\alpha }_l$, with known binary place values ${\alpha }_l$ (including the fixed scale and any integer bit). On the target, apply a controlled unitary gate $R_y(2{\alpha }_l)$ controlled by each angle bit $b_l$. Rotations about the same axis add their angles, so their product isFinally apply $T^{†}$ to perform uncomputation. The workspace returns to zero while the control register and rotated target remain unchanged; the construction works coherently on every superposition of $x$.

A polynomial time classical calculation has a polynomial-size reversible circuit with Toffoli gates, and each Toffoli gate has a constant-size decomposition into one-qubit and two-qubit gates. The $L$ controlled rotations are themselves two-qubit gates. Thus the total quantum circuit size is $\mathrm{poly}(n)$. This is the binary-angle implementation of a quantum variable rotation; the stipulated angle precision is understood.

Choose a power of two $M$ withSince the multiplicative order $r$ is less than $N$, this guarantees $M\ge r^2$. Prepare two quantum registers in the stateand use quantum modular exponentiation to obtain

Measure the second register. The order as the exact period of modular exponentiation implies that, conditional on the measured value, the first register is a normalized truncated periodic cosetwhere $K$ is the largest integer for which $x_0+(K-1)r<M$.

Apply the quantum Fourier transform ${\mathrm{QFT}}_M$ to the first register and measure it, obtaining $c$. The supplied Fourier-transform theorem states that, with probability of order $1/\log \log r$, $c$ is an integer nearest to $jM/r$ for some $j$ coprime to $r$. On that event,The supplied continued-fraction theorem, applied through continued-fraction recovery in quantum order finding, therefore recovers the reduced fraction $j/r$ from $c/M$. Because $j$ and $r$ are coprime, its denominator is the exact order $r$. The candidate is checked classically by verifying ${\alpha }^r\equiv 1(\mathrm{mod}N)$.

The quantum Fourier transform, quantum modular exponentiation, continued-fraction algorithm, and final modular check all take polynomial time in $\log N$. Since $r<N$, the successful event has probability of order $1/\log \log N$, as required.

A strong classical simulation of a quantum circuit computes any requested output probabilityin polynomial time, to the prescribed inverse-polynomial accuracy. A weak classical simulation of a quantum circuit instead produces classical samples from the circuit's output distribution, with exact or suitably small total-variation error.

The Extended Gottesman--Knill theorem states that a unitary Clifford circuit with an arbitrary product state input and final computational-basis measurements is weakly classically simulable. It is strongly simulable when only $O(\log n)$ output qubits are measured. Indeed, each joint output projector expands into $2^k$ Pauli operators, and Clifford conjugation maps every such operator to another Pauli operator whose expectation factors over the input qubits. The factor $2^k$ is polynomial precisely for $k=O(\log n)$.

The succinct input is the players' variable-control sets, their goal propositional formulas, and a complete candidate Boolean valuation; an exponentially expanded payoff matrix is not part of the input. This representation is essential to candidate equilibrium checking in a Boolean game.

For membership in co-NP, consider the complement: the candidate is not a Nash equilibrium. A complexity certificate consists of a player $i$ and an alternative Boolean valuation of that player's controlled Boolean variables. Evaluate the current goal and the goal after this unilateral deviation, keeping every other player's variables fixed. A profitable unilateral deviation exists precisely when the current goal is false and the new goal is true. The certificate has at most the number of input variables plus the player index, and both propositional formula evaluations take polynomial time. Thus the complement belongs to NP, and the original decision problem belongs to co-NP.

For hardness, start with a propositional formula $F(X)$ and introduce a fresh Boolean variable $z$. Construct a one-player Boolean game in which that player controls $X\cup \{z\}$ and has goalChoose the candidate pure strategy assigning every variable false. Its payoff is zero because $z$ is false, regardless of $F$. If $F$ has a satisfying assignment, changing $X$ to that assignment and $z$ to true is a profitable unilateral deviation. If $F$ is an unsatisfiable Boolean formula, no unilateral deviation can satisfy the goal. ThereforeThe construction increases the formula length by only a constant and writes a candidate of linear length, so it is a polynomial-time many-one reduction. Unsatisfiability is co-NP-complete; combining hardness and membership proves that candidate Nash equilibrium checking for Boolean games is co-NP-complete. If a convention requires at least two players, add a player controlling a fresh unused variable and having the always-true goal; this changes neither direction of the proof.

For the intended finite representation, put $m=|S|<\infty$. For each $T\subseteq S$, form the mintermA Boolean valuation satisfies ${\chi }_T$ exactly when its selected subset is $T$. Therefore the weighted formula utility representationrepresents $u$ exactly: at the Boolean valuation for $T$, only that minterm contributes, with weight $u(T)$. This proves completeness and the bound of $2^{|S|}$ rules simultaneously. Zero-weight rules may be omitted. The bound counts rules; writing each minterm also requires $O(m)$ symbols in Big O notation.

For the computational question, assume rule weights are rational numbers encoded in binary. This makes exact equality of sums a finite computational task. With this conventional encoding, equivalence of weighted formula utility representations is co-NP-complete.

For membership, the complement has a short witness: a Boolean valuation on the variables occurring in either rule base. Evaluate each propositional formula, sum the weights of satisfied rules, and accept the witness if the sums differ. Propositional formula evaluation takes polynomial time. Exact sums of binary rational numbers also have polynomially bounded bit lengths: the product of their denominators has bit length at most the sum of the input denominator lengths. Thus non-equivalence lies in NP, and equivalence lies in co-NP.

For hardness, take a Boolean satisfiability problem instance $\theta$ and constructThe first utility function is one at satisfying Boolean valuations and zero elsewhere, while the second is always zero. ConsequentlyThe unsatisfiable Boolean formula problem is co-NP-complete, as the complement of the NP-complete Boolean satisfiability problem. The construction is a polynomial-time reduction, proving hardness even with the single weight $1$.

Two qualifications matter in the literal wording. First, unrestricted real weights have no specified finite encoding, so a standard bit-complexity classification needs the encoding assumption above. Second, the problem says only that $S$ is nonempty. If infinite $S$ is allowed while rule bases remain finite, its completeness claim is false. For $S=\mathbb{N}$, take $u(T)=1$ when $T$ is infinite and $u(T)=0$ when $T$ is finite. A finite rule base mentions only a finite subset $F$ of the variables. The Boolean valuations for $\varnothing$ and $\mathbb{N}\setminus F$ agree on all those variables but have different required values. No such rule base represents this $u$. Thus the construction answers the intended finite-set question and identifies the missing hypothesis in the unrestricted statement.

The definition in this part uses a single Boolean valuation, so the relevant Nash equilibria are pure strategy equilibria of a Boolean game. Use its standard convention that the players' control sets form a set partition of the variables.

Membership follows from an existential choice of a strategy profile and a universal check of all unilateral deviations. Assign payoff one to satisfying a player's goal and zero otherwise. A strategy profile $\sigma$ is a Nash equilibrium precisely when, for every player $i$ and every alternative Boolean valuation ${\tau }_i$ of that player's variables,is true: either the goal is already satisfied or no deviation can satisfy it. Thus the requested property isThe strings encoding $\sigma$, $i$ and ${\tau }_i$ have polynomial length, and evaluating the bracketed propositional formulas takes polynomial time. Invalid encodings of a player index can simply be ignored by the test. This is the existential second level of the polynomial hierarchy, ${\Sigma }_2^{\mathrm{P}}$.

For hardness, reduce the canonical complete problem of deciding a two-block quantified Boolean formulaMake a two-player Boolean game: player 1 controls $X$ and has goal ${\gamma }_1=\top$; player 2 controls $Y$ and has goal ${\gamma }_2=\neg \psi$. Set the query formula to $\varphi =\psi$. The construction has size linear in the input formula.

If an assignment $x$ satisfies $\forall Y\psi (x,Y)$, combine it with any assignment $y$. Player 1 already satisfies its goal, and player 2 cannot satisfy $\neg \psi$ by any unilateral deviation. Thus $(x,y)$ is a Nash equilibrium satisfying the query.

Conversely, let $(x,y)$ be a Nash equilibrium satisfying $\psi$. Player 2 currently has payoff zero. If some alternative $y^{\prime }$ made $\psi (x,y^{\prime })$ false, that deviation would satisfy player 2's goal and increase its payoff to one. The Nash equilibrium condition therefore implies $\forall Y\psi (x,Y)$. This proves the required equivalence and the polynomial-time reduction.

Together, membership and hardness prove ${\Sigma }_2^{\mathrm{P}}$-completeness of existential equilibrium checking in a Boolean game. The reduction works with only two players and one constant goal.

After testing nonnegative edge coordinates and any explicit box or budget inequalities, treat those coordinates as lengths. A shortest path of length below one supplies a violated path inequality; a minimum length at least one certifies all path inequalities. If no source-to-target path exists, all those inequalities are vacuous. Thus a polynomial time shortest path problem calculation separates an exponentially constrained linear program.

$\mathbf{P}$ is the class of decision problems decidable by a deterministic computation in polynomial time.

A polynomial-time Turing reduction from a decision problem $A$ to a decision problem $B$ is a deterministic algorithm deciding membership in $A$ in polynomial time when allowed to query whether strings belong to $B$. An oracle Turing machine models each query answer as a single oracle operation, while writing the query and using the answer still costs time. Queries may depend on earlier answers.

For example, the complement of $B$ reduces to $B$ by asking one membership question and reversing its answer. This is a Turing reduction, regardless of whether there is a simple many-one reduction with the same effect. A polynomial-time many-one reduction instead computes one transformed instance whose answer is used unchanged.

If $A$ reduces to $B$ this way and $B$ has a polynomial-time algorithm, then $A$ does too: substitute that algorithm at each oracle call. Polynomially many queries of polynomial length keep the total cost polynomial. Completeness claims must specify which reduction is intended because adaptive access is more permissive.

Proof complexity measures resources needed to express proofs in a specified propositional proof system. Typical quantities include the total number of symbols, the number of inference steps and the space needed to retain intermediate formulas. A short theorem statement can require a much longer proof, and changing the allowed rules can change the required length dramatically.

For example, a resolution refutation of an unsatisfiable clause set derives the empty clause by resolving pairs of clauses on opposite literals. Verifying a supplied derivation is a local computation on its lines; searching for those lines can be much harder. A lower bound must therefore identify the proof rules and the family of clause sets to which it applies.

More generally, a propositional proof system can be represented by a polynomial-time computable map whose range is exactly the propositional tautologies. Every tautology then has a proof, and every produced formula is valid. If one such system had polynomial-length proofs for every tautology, tautologies would have polynomially checkable certificates, implying $\mathrm{NP}=\mathrm{coNP}$. Conversely that equality would provide such a certificate-based system. This connects proof length to computational verification.

A prover in an interactive proof is the participant that sends messages intended to convince a verifier in an interactive proof of a public statement. Formally it is a strategy: its next response can depend on the public input, the preceding conversation and any private information or randomness it has. The basic interactive proof system model does not impose the verifier's polynomial time bound on this strategy.^[ref]

An honest prover follows a designated strategy supporting completeness of an interactive proof. A cheating prover may depart from it; soundness of an interactive proof must still hold for every allowed cheating strategy. Calling a participant a prover therefore does not mean that its assertions are trusted.

A cryptographic witness can make an otherwise difficult response easy to produce. For an original composition example, let $\varphi :G_0\to G_1$ be a known graph isomorphism. If the prover sends $H=\pi (G_0)$ for a chosen permutation $\pi$, it can supply $\pi$ as an isomorphism from $G_0$ to $H$, or $\pi \circ {\varphi }^{-1}$ as an isomorphism from $G_1$ to $H$. Neither response requires solving a new isomorphism search problem from scratch.

Thus a theoretical allowance of unlimited prover computation is different from a claim about implementation cost. Some protocols have efficient honest provers when the witness is supplied; others are studied primarily for the verification power they demonstrate.

Quantum modular exponentiation is the reversible computation that mapsIt can be implemented in polynomial time in the bit lengths of $x$ and $N$ by repeated squaring and controlled modular multiplication.

A nonempty linear polyhedron with integer inequality coefficients and right sides bounded by $U\ge 1$ contains a point $x_i=p_i/q_i$ with the displayed bounds. Intersect with an orthant containing a feasible point. Moving along directions annihilating the active constraints, until another constraint becomes active, produces a vertex: the orthant prevents a whole nontrivial line from remaining feasible. At that vertex, choose $n$ independent active inequalities, including coordinate constraints as necessary. Cramer's rule and the Hadamard determinant inequality bound both determinants by $n^{n/2}{U}^n\le (nU{)}^n$. The resulting rational witness has polynomial binary length and is verifiable in polynomial time, proving that integer linear feasibility is in NP.

Rewinding in cryptographic proofs is a simulation or extraction technique that returns an algorithmic participant to an earlier state and explores another continuation. The saved state includes the relevant earlier messages and randomness. The technique is justified by the simulator's or extractor's access in the mathematical model; it is not an extra power of the ordinary verifier during a live exchange.^[ref]

For the graph-isomorphism proof protocol, two accepting continuations of the same first message can answer different challenge bits. A knowledge extractor can combine their response mappings to obtain a cryptographic witness. If the prover instead starts again with a different first message, the responses need not combine in that way.

An original retry calculation explains an efficiency condition. Suppose independent simulation attempts succeed with probability $q$ and each failed attempt returns to the required earlier state. The attempt count $T$ has a geometric distribution:At $q=1/2$, the expected number of attempts is2; at $q=1/100$, it is100. Constant or inverse-polynomial success can therefore support expected polynomial time, whereas exponentially rare success generally cannot.

A valid argument must also account for the cost of each attempt and show that the resulting output distribution is correct. Restoring a state, conditioning on success and restarting an entire protocol are distinct operations.

A propositional formula $\phi$ semantically entails $\psi$ when every Boolean valuation satisfying $\phi$ satisfies $\psi$. Equivalently, $\phi \wedge \neg \psi$ is an unsatisfiable Boolean formula. Deciding semantic entailment is co-NP-complete: a counterexample Boolean valuation certifies failure in polynomial time, while $\theta \mapsto ⟨\theta ,p\wedge \neg p⟩$ reduces unsatisfiability to semantic entailment.

A separation oracle either certifies that a supplied point belongs to a convex feasible set or returns a violated linear inequality whose half-space contains the whole feasible set. Its running time can be small even when the set has exponentially many defining inequalities. Together with rational encoding bounds and an outer bound, this permits polynomial time ellipsoid method feasibility and optimization.

An NP decision problem is strongly NP-complete when its NP-hardness persists with numerical parameters written in the unary numeral system. An important proof method bounds every relevant numerical value by a polynomial in the remaining explicit input size. For the clique decision problem, values $k>|V(G)|$ can be mapped to one fixed no-instance; otherwise writing $1^k$ takes only polynomial time. The distinction is representation-sensitive, so an explicit graph encoding must be specified.

A verifier in an interactive proof is the efficient participant that evaluates a public statement using messages from a prover in an interactive proof and its own random choices. Its algorithm specifies which challenge to send, how to process the response and when to accept or reject. In the standard model it runs in probabilistic polynomial time in the public input length.^[ref]

The verifier's guarantee concerns more than one successful conversation. Completeness of an interactive proof requires a suitable honest prover to succeed on true statements. Soundness of an interactive proof bounds success of every cheating strategy on false statements. A verifier that accepts whenever it receives any message meets neither requirement merely by being fast.

For an original checking example, suppose a response claims a graph isomorphism between two20-vertex graphs encoded by adjacency matrices. Checking that the vertex mapping is a bijection and that all $20^2=400$ adjacency entries agree with their mapped entries verifies that response. It does not require searching through all $20!$ vertex permutations.

An interactive proof system can use such inexpensive checks in a randomized conversation. The verifier's random choices must follow the specified protocol: exposing a challenge too early, reusing randomness in an unjustified way or changing the acceptance rule can alter its mathematical guarantees.