\tikzstyle{e0}[0]=[dotted,bend right=#1]
\tikzstyle{e1}[0]=[solid, bend left =#1]
\defmath\hv{{\hat v}}

\tikzset{every node/.style={initial text={}, inner sep=2pt, outer sep=0}}

\section{The \limdd data structure}
\label{sec:isomorphism-qmdd}

\begin{wrapfigure}{r}{7cm}
%\begin{figure}
\vspace{-2.5em}
\begin{empheq}[box={\Garybox[Domains of variables]}]{align*}
%\begin{align*}
%\Aboxed{
%\tikzmark{A}
    n, i , j, k                 &\in \mathbb N          && \text{indices} \\
    v, w,u                      &\in \Node     && \text{\limdd nodes}\\
    e, f                           &\in \Edge     && \text{\limdd edges}\\
    L, M                        &\in \textnormal{DD} && \limdd \text{(diagrams)} \\
    \ket\phi, \ket\psi                  &\in \mathbb C^{\otimes n}  && \text{$n$-qubit states}\\
    \alpha, \beta, \lambda,\mu  &\in \mathbb C          && \text{complex factors}\\
    P, Q, R                     &\in \Pauli^{\otimes n}&& \text{\pauli strings}\\
    A, B                        &\in \mathbb C \times  \Pauli^{\otimes n}
                                      & & \text{Pauli LIMs}~~~~~~~
%\tikzmark{B}
%}
\end{empheq}
%\tikz[remember picture,overlay]\draw(A.north west)rectangle(B.south east);
%\end{figure}
\vspace{-1em}
\end{wrapfigure}

%The figure on the right lists the default domains of variables used in this paper.

Where \qmdds only merge nodes representing the same state up to a constant factor, the \limdd data structure goes further by also merging nodes that are equivalent up to local operations, called Local Invertible Maps (LIMs) (see \autoref{def:isomorphism}).
As a result, \limdds can be exponentially more succinct than \qmdds, including some stabilizer states (see \autoref{sec:exponential-separations}).
    We will call nodes which are equivalent under LIMs, \emph{(LIM-) isomorphic}.
This definition generalizes SLOCC equivalence; in particular, if we choose the parameter $G$ to be the linear group, then the two notions coincide (Appendix A of \cite{dur2000three})~\cite{bennett1996concentrating,chitambar2014everything}.

\begin{definition}[LIM, Isomorphism]
	\label{def:isomorphism}
    A $n$-qubit Local Invertible Map (LIM) is an operator $\mathcal{O}$ of the form $\mathcal{O}=\lambda \mathcal{O}_n\otimes\cdots\otimes \mathcal{O}_1$, where the matrices $\mathcal{O}_i$ are invertible $2\times 2$ matrices and $\lambda\in\mathbb{C}\setminus \{0\}$.
    An \emph{isomorphism} between two $n$-qubit quantum states $\ket{\phi},\ket{\psi}$ is a LIM $\mathcal{O}$ such that $\mathcal{O}\ket{\phi} = \ket{\psi}$.
    If $G$ is a group of $2\times 2$ invertible matrices and if all $\mathcal{O}_i \in G$, then we say that $\mathcal{O}$ is a $G$-isomorphism and that  $\ket{\phi}$ is $G$-isomorphic to $\ket{\psi}$, denoted $\ket{\phi}\simeq_G\ket{\psi}$.
\end{definition}

Before we give the formal definition of \limdds in \autoref{def:limdd}, we give a motivating example in Figure~\ref{fig:qmdd-isoqmdd-exposition} which demonstrates how the use of isomorphisms can yield small diagrams for a four-qubit state.
%Here a $4$-qubit state is represented in four different ways.
In the state's \qmdd, the nodes $c_3$ and $c_4$ represent the two-qubit state vectors $\ket{c_3}=\left[1,1,1,-1  \right]^\dagger$ and $\ket{c_4}=\left[1,-1,\omega,-\omega  \right]^\dagger$.
By noticing that these two vectors are related via $\ket{c_4}=(T\otimes Z)\ket{c_3}$, we may discard the node $c_4$ and store the isomorphism $T\otimes Z$ instead.
%The state $\ket{c_4}$ can then be recovered from $\ket{c_3}$ by computing $\ket{c_4}=(T\otimes Z)\ket{c_3}$.
% todo LV: ze hebben allemaal andere isomorphisms.
In fact, all the nodes on the \qmdd's third level (i.e., the grandchildren nodes of the root node) are related to each other through such isomorphisms.
A similar reduction in size can be achieved at the \qmdd's second level, by noticing that nodes $c_1$ and $c_2$ are related via $\ket{c_2}=Z\otimes I\otimes Z\ket{c_1}$.
The resulting data structure is a \limdd of only five nodes instead of ten.
\autoref{sec:exponential-separations} shows that discarding isomorphic nodes sometimes leads to exponentially smaller diagrams, while the additional cost of storing the isomorphisms is only polynomial.

\begin{figure}[bh!]
	\includegraphics[width=\textwidth]{pics/qmdd-isoqmdd-example-4-qubits-new-notation.pdf}
	\caption{A four-qubit quantum state shown as: an amplitude vector (left), an \add, a \qmdd and a \limdd (right). Diagram nodes are horizontally ordered in `levels' with qubit indices ${4,3,2,1}$.}
	\label{fig:qmdd-isoqmdd-exposition}
\end{figure}

%The formal definition of \limdd is as follows.

\tikzset{every node/.style={initial text={}, inner sep=2pt, outer sep=0}}

\begin{definition}[$G$-\limdd]
	\label{def:limdd}
    An $n$-\glimdd is a rooted, directed acyclic graph (DAG) which represents an $n$-qubit quantum state (or matrix).
    Formally, a \glimdd is a $6$-tuple $(\Node\cup \{\leaf\}, \index,\Low,\High,\lbl,e^r)$,
    where:
\begin{itemize}
	\item $\Node$ is a set of nodes with qubit indices $\index(v) \in [n]$ for $v\in \Node$;
	\item $\Low,\High \colon \Node \to \Node\cup \{\leaf\}$ are the low  and high edge functions;
%	\raisebox{-1mm}{\scalebox{.7}{\tikz{
%		\node[state,minimum size=.2cm] (1) {$v$};
%		\node (-a1) [above left  =.1cm and .3cm of 1] {};
%		\node (-b1) [above right  =.1cm and .3cm of 1] {};
%		\node (1a-) [below left =.1cm and .3cm of 1] {};
%		\node (1b-) [below right = .1cm and .3cm of 1] {};
%
%		\path[]
%		(-a1) edge node {} (1)
%		(-b1) edge node {} (1)
%		(1) edge node {} (1a-)
%		(1) edge node {} (1b-);
%	}}}.
	\item $\lbl\colon \Low\cup \High\to G$-$\LIM\cup\set 0$ is a function labeling edges with LIMs or $0$;
%       \raisebox{-1mm}{\scalebox{.7}{\tikz{
%            \node[] (1) {};
%            \node [below = .5 of 1] (2) {};
%            \path[]
%                (1) edge node[right] {$ (\lambda, A_1,\ldots, A_n)$} (2);
%        }}}, and
	\item a root edge $e^r$ without source pointing to root node $r\in \Node$;
%		\raisebox{-1mm}{\scalebox{.7}{\tikz{
%			\node[state,initial,minimum size=.2cm] (r) {$r$};
%			\node[below left= .1cm and .3cm of r] (1) {};
%			\node [below right= .1cm and .3cm of r] (2) {};
%			\path[]
%			(r) edge [dotted] node {} (1)
%			(r) edge [dotted] node {} (2);
%		}}},
    \item a unique leaf node $\leaf$ (a sink) with label $\index(s) = 0$
    representing the number $1$;
%        \raisebox{-.5mm}{\scalebox{.7}{\tikz{
%            \node[draw, rectangle,minimum size=.2cm] (s) {$1$};
%            \node[above left= .1cm and .3cm of s] (1) {};
%            \node[above= .2cm of s] (a) {};
%            \node [above right= .1cm and .3cm of s] (2) {};
%            \path[]
%                (1) edge [dotted] node {} (s)
%                (a) edge [dotted] node {} (s)
%                (2) edge [dotted] node {} (s);
%        }}},
%\item If an edge has label $0$, then it points to the leaf node.
%    Otherwise, if $v$ is a node with children $v_0, v_1$, then $\index(v_0) = \index(v_1) = \index(v)-1$;
%        \todo[inline]{note: this used to be the Zero Edges Rule before}
\end{itemize}
Depending on context, we interpret $\lbl(\low v)$ as a node $v_0$ or edge  $(v, v_0)$, etc.
We define the semantics of a (non-leaf) node $v$ and edge $e=(w,v)$  by overloading the Dirac notation:
\begin{align*}
\ket{e} & \defn \begin{cases}
    \lambda \cdot  (\mathcal{Q}_{\index(v)}\otimes \cdots \otimes \mathcal{Q}_1) \cdot \ket v & \text{if $\lbl(e) = (\lambda,  \mathcal{Q}_1, \ldots , \mathcal{Q}_{\index(v)})$} \\
	[0, \dots,0]^\dagger & \text{if $\lbl(e)=0$} \end{cases} \\
\ket{v}     & \defn \ket{0}\otimes\ket{\low v}+ \ket{1}\otimes \ket{\high v}
\end{align*}
\end{definition}

The coefficient $\langle x | e \rangle$ for bitstring $x \in \{0, 1\}^n$
of a \limdd with root edge $e$ representing an $n$-qubit state $\ket e$
is read by traversing the \limdd from top to bottom according to \autoref{def:limdd}
(i.e., pushing down the LIMs).
It is best illustrated by example, e.g., reading the amplitude for $1111$ in the \limdd of
\autoref{fig:qmdd-isoqmdd-exposition}. The LIM on the root edge is the identity, so we can simply follow the 1-edge to get a new root edge with LIM $P_3\otimes P_2 \otimes P_1 =Z\otimes \id \otimes Z$~to~$d_1$.
Since the most significant operator ($P_3$) is a $Z$, we multiply the LIM on the 1-edge of $d_1$ (which has $\index(d_1)=3$) with $-1$ and the remainder of the LIM ($\id \otimes Z$),
yielding $ - \omega T \otimes \id$, etc. Eventually the leaf is reached, when only a factor remains (= the sought amplitude).
If we would encounter an $X$ (or $Y$) as $P_3$, we would also have to switch the high (1)
and the low (0) edge, thus taking the 0- instead of 1-edge (and multiply by $-i$ for $P_3 = Y$).
For the choice $G=\Pauli$, this is formalized in the \follow{}{} procedure given in \autoref{sec:quantum-simulation}.

Let us now summarize the representation and manipulation capabilities of the \limdd data structure.
A $G$-\limdd is exact and universal, i.e., for each $n$-qubit quantum state $\ket\phi$ there is a \limdd with root edge $e$ such $\ket e = \ket\phi$, for any choice of parameter $G$.
In particular, a \glimdd with $G=\set{\mathbb I}$ captures all \qmdds by definition.
As all groups $G$ contain the identity operator $\mathbb I$, the universality of \limdds follows from the universality of QMDDs.
Furthermore, for the choice $G=\textsf{Pauli}$, the states that \limdds can represent using polynomial space include all stabilizer states, which is a feature that \qmdds do not posses, as shown in \autoref{sec:exponential-separations}.
Finally, $\textsf{Pauli}$-\limdds can also \emph{manipulate} and measure quantum states, thereby enabling the simulation of quantum circuits, as shown in \autoref{sec:simulation}.
For many operations, we show that the manipulation is also efficient, i.e., it takes polynomial time in the size of the \limdd representation of the quantum state/circuit.
Specifically, \limdds are often faster than \qmdds, and never slower than a multiplicative factor $O(n^3)$.

From here on, we will focus on the choice $G=\Pauli$, omitting the prefix $\Pauli$- in front of $\limdd$ unless it is clear that we mean otherwise, and hence write $\simeq$ to mean $\simeq_{\textnormal{Pauli}}$.

%From here on, we will focus on the choice $G=\Pauli$, omitting the prefix $\Pauli$- in front of $\limdd$ unless it is clear that we mean otherwise, and hence write $\simeq$ to mean $\simeq_{\textnormal{Pauli}}$.
%For $\Pauli$-\limdds representing an $n$-qubit state $\ket{\phi}$, reading the coefficient $\langle x | \phi\rangle$ of bitstring $x \in \{0, 1\}^n$ is done by traversing the \limdd from top to bottom: at a node with incoming edge label $\lambda P_n \otimes \dots \otimes P_n$, following the $x_k$-edge  if $P_k\ket{x_k} \propto \ket{x_k}$ (e.g. the $0$-edge when $x_k = 0$ and $P_k \in \{\id[2], Z\}$) and the $(1 - x_k)$-edge if $P_k \ket{x_k} \propto \ket{1 - x_k}$ instead (e.g. the $1$-edge when $x_k = 0$ and $P_k \in \{X, Y\}$).
%The coefficient is the product of the factors $\lambda \cdot \langle x_k | P | x_k\rangle$ of the traversed edge labels $\lambda P$.
%For a general group $G$, the coefficients are not encoded in a single path from root to leaf.

%\todo[inline]{Vedran: ok. One may wonder: this is all ok, but how do i compute the amplitude now? It was easy in the QMDD case, I follow the path and multiply numbers...
%	For intuition this is missing for me.
%
%Lieuwe: So do we add an explanation how to compute amplitudes?
%
%Tim: above, I added some text for the case $G=Pauli$, please check.
%}

In general, there are many different $\Pauli$-\limdds which represent a given quantum state.
By imposing a small number of constraints on the diagram, listed in \autoref{def:reduced-limdd} and visualized in \autoref{fig:necessity-of-reduction-rules}, we ensure that every quantum state is represented by a unique `\emph{reduced}' \limdd.
Unique representation, or canonicity, is a useful property of decision diagrams.
In the first place, it allows for circuit analysis and simplification~\cite{bryant1995verification,miller2006qmdd}, by
 facilitating efficient manipulation operations.
In the second place, a reduced diagram is smaller than an unreduced diagram because it merges nodes with the same semantics. For instance, \limdds allow all states in the same $\simeq$ equivalence class to be merged.
The algorithms for quantum circuit simulation in \autoref{sec:quantum-simulation} ensure that all intermediate \limdds are reduced.

%A reduced \limdd representing a state $\ket{\phi}$ has the desirable property that it is the minimum-size diagram among all \limdds representing the state $\ket{\phi}$ (\autoref{thm:reduced-glimdd-minimum-size}).

\begin{definition}[Reduced \limdd]
	\label{def:reduced-limdd}
%	Let $\highlabel,\rootlabel$ and $\beforeq$ be as follows.
%	\begin{itemize}
%		\item The function $\highlabel$ takes as input an $n$-\glimdd node $v$, and outputs an $(n-1)$-$G$-LIM $f(v)$.
%		This function has the property that, if $v$ and $w$ are nodes which satisfy the Low Factoring, Low Precedence and Edge Rules (defined below), and if $\ket{v}\simeq_G\ket{w}$, then $\highlabel(v)=\highlabel(w)$
%		with $\ket v \simeq_G \ket{0}\ket{v_0}+\ket{1}\otimes \highlabel(v)\ket{v_1}$.
%		% and if $\ket{v}=\ket{0}\ket{v_0}+\ket{1}\lbl(\high(v))\ket{v_1}$ then $\ket{v}$ is isomorphic to $\ket{0}\ket{v_0}+\ket{1}\otimes \highlabel(v)\ket{v_1}$.
%		%ALFONS: this seems a corollary of the definition
%		In other words, $\highlabel$ is constant within an isomorphism class.
%		\item The function $\rootlabel$ takes as input a \glimdd{}'s distinguished root edge $e^r$, and outputs a LIM $\rootlabel(e^r)$.
%		This function satisfies the property that, if $e^{r}$ and $e^q$ are the root edges of two \glimdds, and if the root nodes $r$ and $g$ satisfy the reduction rules below except the ``Root edge determinism rule'', and if $\ket{e^r}=\ket{e^q}$, then $\rootlabel(e^r)=\rootlabel(e^q)$.
%		\item $\beforeq$ is a total order on the nodes of the diagram.
%	\end{itemize}
	A \pauli-\limdd is \emph{reduced} when it satisfies the following constraints.
	It is \emph{semi-reduced} if it satisfies all constraints except high determinism.
%	\footnote{}
	\begin{enumerate}
		\item \textbf{Merge: } No two nodes are identical: We say
            two nodes $v,w$ are identical~if $\low v= \low w, \high v = \high w,
                \lbl(\low v)=\lbl(\low w)$, $\lbl(\high v)=\lbl(\high w)$.
		\item \textbf{(Zero) Edge: } Any edge $(v,w) \in \High \cup \Low $
has $\index(v) = \index(w) + 1$, and if $\lbl(v,w)=0$, then both edges point to the same node, i.e., $\high v = \low v = w$.
		\item \textbf{Low Precedence: } For each internal node $v$, we have $\low v \beforeq \high v$, where  $\beforeq$ is a total order on the nodes of the diagram.
		\item \textbf{Low Factoring: } The label on every low edge to a node $v$ is the identity $\id[2]^{\otimes\index(v)}$.
		\item \textbf{High Determinism: } The label on the high edge of any node $v$ is $\highlim =\highlabel(v)$, where $\highlabel$ is a function that takes as input a semi-reduced $n$-{\Pauli}-\limdd node~$v$, and outputs an $(n-1)$-$\Pauli$-LIM $\highlim$
        satisfying
       $\ket v \simeq_{\Pauli} \ket{0}\ket{\low v}+\ket{1}\otimes \highlim\ket{\high v}$.
        Moreover, for any other semi-reduced node $w$ with $\ket{v}\simeq_{\Pauli}\ket{w}$,
         it returns $\highlabel(w) = \highlim$.
		In other words, $\highlabel$ is constant within an isomorphism class.
%		\item \textbf{Root Edge Determinism: } The label on the root edge is $\rootlabel(e^r)$.
	\end{enumerate}
\end{definition}

\begin{figure}\begin{center}
	\includegraphics[width=1\textwidth]{pics/necessity-of-reduction-rules.pdf}
	\caption{Illustration of the reduction rules in \autoref{def:reduced-limdd}.
		In each case, the left and right \limdds represent the same state, but the left \limdd violates a reduction rule, while the right \limdd satisfies that rule.
        The Merge rule regards the merging of two identical nodes $v$ and $w$.
		Low Precedence determines which child is the low child, and which is the high child according to~$\beforeq$.
		Low Factoring ensures that the low edge is always labeled with $\mathbb I$.
		High Determinism ensures that the label on high edges is chosen canonically.
		}
	\label{fig:necessity-of-reduction-rules}
\end{center}
\end{figure}

A few observations can be made about the above definition:
	\begin{itemize}
            \setlength\itemsep{1em}
		\item[\namedlabel{obs:nozero}{O1}] There is no reduced \limdd for the $0$-vector, because any low edge must be labeled with~$\id[2]^{\otimes n}$. This is not a problem for us, since the $0$-vector is not a quantum state.
		\item[\namedlabel{obs:knife}{O2}] To represent a state like $\ket{0}\otimes\ket{\phi}$, there is a choice between $\ket{0}\otimes\ket{\phi}$ and $(X\otimes\mathbb I)\ket{1}\otimes \ket{\phi}$.
The low factoring rule forces us to take the $\mathbb I$ label on the low edge, so this gives a node of the form $\ket{0}\otimes \ket{\phi}$. Therefore, the high edge \emph{must} be labeled with $0$. Since, by the zero edges rule, the high edge then points to the same node as the low edge the low precedence rule vacuously holds for such states.
		\item[\namedlabel{obs:subgroups}{O3}] The definition of reduced \limdd cannot always be applied to $G$-\limdd when $G$ is a subgroup of the Pauli group; in particular, such a diagram may not be universal. This is because the low precedence rule requires that $v_0\beforeq v_1$ for every node, so if $G$ is a group which does not contain the $X$, then no reduced \glimdd represents a state $\ket 0 \ket {v_0} + \ket 1 \ket {v_1}$ where $v_1 \beforeq v_0$.
            %In \autoref{sec:exponential-separations}, we come back to this issue.
%            \todo[inline]{Tim: why is this an `issue'? More like a topic, isn't it? Why is it relevant to mention this?}
\item[\namedlabel{obs:delete}{O4}] While the literature on other decision diagrams~\cite{akers1978binary,bryant86,feinstein2011skipped} often considers a ``redundant test'' rule that allows edges to skip multiple levels, we omit this reduction for the sake of simplicity, because it offers only linear improvements in the best case and complicates correctness proofs (see, e.g., \cite[Lemma 1]{andersen1997introduction}). There is however no fundamental reason which would prevent the addition of a similar redundancy reduction.
%	\item[\namedlabel{obs:root-edge}{O5}] the root edge of a diagram may be any LIM; in particular, it is not necessarily equal to $\mathbb I_2^{\otimes n}$.\todo{remove; has nothing to do with reduced.}
%\todo[inline]{This has to be addressed for S4 to work...}
\end{itemize}

\autoref{lemma:node-canonicity-strong} shows that  \limdds are canonical,
in the sense that its nodes
uniquely represent equivalence classes under $\simeq$ as expressed in \autoref{cor:node-canonicity-strong}. This does not mean that the root edge of a \limdd canonically represents a quantum state. We instead show in \autoref{sec:equality} how to check whether two root edges represent the same state.

%\begin{lemma}
%    [Reduced \limdds have reduced sub-\limdds]
%    \label{lemma:sub}
%    Let $L$ be a \limdd.
%    If the left edge of $v_L$ has label $\unit$, its right edge is labelled $\highlabel(v_L)$ or is labelled zero and points to the same node as its left edge, its children $v_0, v_1$ satisfy Low Precendence, and each node ``under its span'' satisfies the Merge rule, then all these properties also hold for its children.
%\end{lemma}

\begin{corollary}[of \autoref{lemma:node-canonicity-strong}]
    \label{cor:node-canonicity-strong}
    Each equivalence class under $\simeq$, has a unique representative reduced \limdd node $v$, which follows from \autoref{lemma:node-canonicity-strong} and the transitivity of $\simeq$.
\end{corollary}

\begin{lemma}[Node canonicity]
    \label{lemma:node-canonicity-strong}
    For each $n$-qubit state vector $\ket{\phi}$, there exists a unique reduced Pauli-\limdd $L$ with root node $v_L$
    such that $\ket{v_L} \simeq \ket{\phi}$.
%    Isomorphic state vectors are represented by the root node of a unique reduced Pauli-LIMDD.
%    That is, for each state vector $\ket{\phi}$, the set
%    \[
%        C(\ket{\phi}) = \{\textnormal{reduced \limdd L} | \ket{v_L} \simeq \ket{\phi}\}
%    \]
%    satisfies:
%    (a) $C(\ket{\phi}) > 0 $ and (b) $C(\ket{\phi}) \leq 1$.
%    (a) there exists a reduced Pauli-LIMDD $L$ such that $\ket{v_L} \simeq \ket{\phi} \simeq \ket{\psi}$, and
%    : if $\ket{\phi} \simeq \ket{\psi}$, then:
%
%    (b) if there are two reduced Pauli-LIMDDs, with root nodes $v$ and $v'$, then $\ket{v} \simeq \ket{v'} \simeq \ket{\psi}$ implies $v=v'$.
\end{lemma}
\begin{proof}
%	\todo[inline]{From now on, we will write $\simeq$ to mean $\simeq_{\textnormal{Pauli}}$?}

    We use induction on on the number of qubits $n$ to show universality (the existence of an isomorphic \limdd node) and uniqueness (canonicity).
%    \todo[inline]{Tim: can't we move proof to appendix?}

%In the lemma's proof, we refer to \limdd DAGs with capitals $L,M$, and their root nodes with $v_L, v_M$.
%Edges to $n$-qubit nodes $v$ in the \limdd carry a Pauli isomorphism $A = \lambda, A_1, \dots, A_n$ according to \autoref{def:limdd}, i.e., a Pauli string interpreted as a LIM $A_n \otimes \dots \otimes A_1$ multiplied by a nonzero complex factor $\lambda$. Note that the factor $\lambda$ can be zero.

    \textbf{Base case.}
    If $n=0$, then $\ket{\phi}$ is a complex number $\lambda$.
    A reduced Pauli-\limdd for this state is the leaf node representing the scalar $1$.
    To show it is unique, consider that nodes $v$ other than the leaf have an $\index(v) > 0$,
    by the edges rule, and hence represent multi-qubit states.
    Since the leaf node itself is defined to be unique, the merge rule is not needed and canonicity follows. Finally, $\ket{\phi}$ is represented by root edge
    $\ledge \lambda1$.
    %

    \textbf{Inductive case.}
    Suppose $n>0$.
    We first show existence, and then show uniqueness.

    We use the unique expansion of $\ket{\phi}$ as $\ket{\phi} = \ket{0} \otimes \ket{\phi_0} + \ket{1}\otimes \ket{\phi_1}$ where $\ket{\phi_0}$ and $\ket{\phi_1}$ are either $(n-1)$-qubit state vectors, or the all-zero vector.
%    \todo[inline]{Quantum state vectors are defined to be non-zero in \autoref{def:state-vector}, but these vectors are allowed to be zero. -LV}
    We distinguish three cases based on whether $\ket{\phi_0}, \ket{\phi_1} = 0$.

   \textbf{Case $\boldsymbol{\ket{\phi_0}, \ket{\phi_1} = 0}$:}
    This case is ruled out because $\ket{\phi} \neq 0$.

    \textbf{Case $\boldsymbol{\ket{\phi_0}=0}$ or $\boldsymbol{\ket{\phi_1} = 0}$:}
        In case $\ket{\phi_0}\neq 0$,
       by the induction hypothesis, there exists a Pauli-\limdd with root node $w$ satisfying
        $\ket{w} \simeq \ket{\phi_0}$. By definition of $\simeq$,
        there exists an $n$-qubit Pauli isomorphism $A$ such that
        $\ket{\phi_0} = A \ket{w}$.
       We construct the following reduced Pauli-\limdd for $\ket{\phi}$:
        $\lnode[v] I{w}0{w}$.
        In case $\ket{\phi_1}\neq 0$, we do the same for root
            $\ket{w} \simeq \ket{\phi_1} = A \ket w$.
        In both cases, it is easy to check that the root node is reduced.
        Also in both cases, we have $\ket \phi \simeq \ket v$ because
        either $\ket \phi = \id[2] \otimes A \ket v$ or
        $\ket \phi = X \otimes A \ket v$ as illustrated in \autoref{fig:reduced1} (left).

\begin{figure}
\tikz[->,>=stealth',shorten >=1pt,auto,node distance=1.5cm,
        thick, state/.style={circle,draw,inner sep=0pt,minimum size=18pt}]{
    \node[state] (1) {$v'$};
    \node[above = .5cm of 1,xshift=1.55cm,fill=black] (x) {};%{$\ket \phi$};
    \node[state] (1a) [below = 1cm of 1, xshift=1.7cm] {$w$};

    \path[]
    (x) edge[bend left=-20]     node[above left,pos=.7] {$\id[2]^{\otimes n}$} (1)
    (1) edge[e0,bend left=-20] node[pos=.1,left] {$A$} (1a)
    (1) edge[e1,bend right=-20] node[pos=.1,above right] {$0$} (1a)
    ;

    \node[state, right = 2.5cm of 1] (2) {$v$};
%    \node[above = .5cm of 2] (x)  {$\ket \phi$};%{$= \id[2] \otimes A \ket{v}$};
    \path[]
    (x) edge[bend left=20]     node[above right,pos=.7] {$\id[2] \otimes A$} (2)
    (2) edge[e0,bend left=-20] node[pos=.1,left] {$\id[2]^{\otimes n}$} (1a)
    (2) edge[e1,bend right=-20] node[pos=.2,right] {$0$} (1a)
    (1) --  node[yshift=.1cm] {$\rightsquigarrow$} (2)
    ;
    }~~~~~~~~~~~~~~~
\tikz[->,>=stealth',shorten >=1pt,auto,node distance=1.5cm,
        thick, state/.style={circle,draw,inner sep=0pt,minimum size=18pt}]{
%    \node[above = .5cm of 1] (x) {$\ket \phi$};
    \node[state] (1) {$v''$};
    \node[state] (1a) [below = 1cm of 1, xshift=2.3cm] {$v_L$};
    \node[state] (1b) [below = 1cm of 1, xshift=3.8cm] {$v_R$};
    \path[]
    (1) edge[e0] node[pos=.1,left] {$A$} (1a)
    (1) edge[e1] node[pos=.1,above right] {$B$} (1b)
    (1a) --  node[yshift=-.2cm] {$\beforeq$} (1b)
    ;

    \node[state, right = 2.5cm of 1] (2) {$v'$};
    \node[above = .5cm of 2,fill=black] (x)  {};%{$= \id[2] \otimes A \ket{v'}$};
    \path[]
    (x) edge[bend left=-20]     node[above left,pos=.8] {$\id[2]^{\otimes n}$} (1)
    (x) edge     node[right,pos=.4] {$\id[2] \otimes A$} (2)
    (2) edge[e0] node[pos=.2,left] {$\id[2]^{\otimes n}$} (1a)
    (2) edge[e1] node[pos=.1,right] {$ A^{-1}B$} (1b)
    (1) --  node[yshift=.1cm] {$\rightsquigarrow$} (2)
    ;

    \node[state, right = 2.5cm of 2] (3) {$v$};
%    \node[above = .5cm of 3] (x)  {}; %{$ =  (\id[2] \otimes A)\rootlim \ket{v}$};
    \path[]
    (x) edge[bend left=20]      node[above right,pos=.8] {$(\id[2] \otimes A)\rootlim$} (3)
    (3) edge[e0] node[pos=.1,above left] {$\id[2]^{\otimes n}$} (1a)
    (3) edge[e1] node[pos=.2,below right] {$\highlim$} (1b)
    (2) --  node[yshift=.1cm] {$\rightsquigarrow$} (3)
    ;
    }
	\caption{Reduced node construction in case $\ket{\phi_1} = 0$ (left), and
	        $\ket{\phi_0}, \ket{\phi_0} \neq 0$ and $v_L \beforeq v_R$ (right).
	        For cases $\ket{\phi_0} = 0$ and $v_R \beforeq v_L$, we take instead root edge $ X \otimes A$ and swap low/high edges.
	        The black square (\scalebox{.7}{$\blacksquare$})
	        signifies a unique quantum state (all root edge represent this one state).
%            \todo[inline]{Tim: why do we need to show the state above each node? Aren't these obvious from the figure? (i.e. each state is of the form $(rootedge) \ket{rootnode}$}
            }
	\label{fig:reduced1}
\end{figure}

    \textbf{Case $\boldsymbol{\ket{\phi_0}, \ket{\phi_1} \neq 0}$:}
    By the induction hypothesis, there exist \pauli-\limdds $L$ and $R$ with root nodes
    $\ket{v_{L}} \simeq \ket{\phi_0}$ and $\ket{v_{R}} \simeq \ket{\phi_1}$.\footnote{Note that the induction hypothesis implies a `local' reduction of \limdds $L$ and $R$, but not automatically a reduction of their union. For instance, $L$ might contain a node $w$ and $R$ a node $w$ such that $v \simeq w$. While the other reduction rules ensure that $v$ and $w$ will be structurally the same, the induction hypothesis only applies the merge rule $L$ and $M$ in isolation, leaving two separate identical nodes $v,w$.
We can solve this by applying merge on the union of nodes in $L$ and $M$, to merge any equivalent nodes.}
    By definition of $\simeq$, there exist $n$-qubit Pauli isomorphisms $A$ and $B$ such that $\ket{\phi_0} = A \ket{v_{L}}$ and $\ket{\phi_1} = B \ket{v_{R}}$.
    In case $v_{L} \beforeq v_{R}$,
       we construct the following reduced Pauli-\limdd for $\ket{\phi}$: the root node is $\lnode[v] {\mathbb I}{v_{L}}E{v_{R}}$, where
    $E$ is the LIM computed by $\highlabel(\lnode{\mathbb I}{v_L}{A^{-1}B}{v_R})$ .
    Otherwise, if $v_{R}\beforeq v_{L}$, then we construct the following reduced Pauli-\limdd for $\ket{\phi}$: the root node is $\lnode[v] I{v_{R}}F{v_{L}}$, where $F=\highlabel(\lnode{\mathbb I}{v_L}{B^{-1}A}{v_R})$.
    It is straightforward to check that, in both cases, this Pauli-\limdd is reduced.
    Moreover, $\ket v$ isomorphic to $\ket \phi$
    as illustrated in \autoref{fig:reduced1} (right).

    To show uniqueness, let $L$ and $M$ be reduced \limdds (root nodes $v_L, v_M$) such that $\ket{v_L} \simeq \ket{\phi} \simeq \ket{v_M}$.
    \def\Ptop{P_{\textnormal{top}}}
    \def\Prest{P_{\textnormal{rest}}}
    Expanding the semantics of $v_L$ and $v_M$, this implies there exists a Pauli isomorphism $\lambda \Ptop \otimes \Prest \neq 0$, where $\Ptop$ is a single-qubit Pauli and $\Prest$ an $(n-1)$-qubit Pauli isomorphism, such that
        \begin{align}
        \label{eq:canonicity-equation-1}
       \lambda \Ptop \otimes \Prest (\ket{0} \otimes A_L \ket{v_L^0} + \ket{1} \otimes B_L \ket{v_L^1})
        =
        \ket{0} \otimes A_M \ket{v_M^0} + \ket{1} \otimes B_M \ket{v_M^1}
        .
        \end{align}

    We distinguish two cases from here on: where $\Ptop \in \{\unit, Z\}$ or $\Ptop \in \{X,  Y\}$.

    \textbf{Case $\boldsymbol{\Ptop = I,Z}$.}
    If $\Ptop = \diag z$ for $z \in \{1, -1\}$,  then
    \autoref{eq:canonicity-equation-1} gives:
%        \begin{align}
%        \label{eq:canonicity-equation-1}
%       \ket{0} \otimes \lambda\Prest A_L \ket{v_L^0} + \ket{1} \otimes z \lambda\Prest B_L \ket{v_L^1}
%=
%\ket{0} \otimes A_M \ket{v_M^0} + \ket{1} \otimes B_M \ket{v_M^1}
%        \end{align}
        \begin{align}
        \label{eq:canonicity-equation-2}
            \lambda \Prest A_L \ket{v_L^0} = A_M \ket{v_M^0}
            \qquad\textnormal{and}\qquad
            z\lambda \Prest B_L \ket{v_L^1} = B_M \ket{v_M^1}
        \end{align}
            By low factoring, we have $A_L = A_M = \unit$, so we obtain
$ \lambda  \Prest \ket{v_L^0} = \ket{v_M^0}$.
        Hence $\ket{v_L^0}$ is isomorphic with $\ket{v_M^0}$, so by induction hypothesis and
         \autoref{cor:node-canonicity-strong}, we have $v_L^0 = v_M^0$.
         We now show that also $v_L = v_M$ by considering two cases.
\begin{description}
        \item[$B_L \neq 0$ and $B_M \neq 0$:] then $z\lambda \Prest B_L\ket{v_L^1}=B_M\ket{v_M^1}$, so the nodes $v_L^1$ and $v_M^1$ represent isomorphic states, so by the induction hypothesis  and \autoref{cor:node-canonicity-strong} we have $v_L^1=v_M^1$.
        We already noticed by the low factoring rule that $v_L$ and $v_M$ have $\mathbb I$ as low edge label.
        By the high edge rule, their high edge labels are $\highlabel(v_L)$ and $\highlabel(v_M)$, and since the reduced \limdds $L$ and $M$ also satisfy low precedence and edge rules and $\ket{v_L} \simeq \ket{v_M}$, we have $\highlabel(v_M) = \highlabel(v_L)$ by definition of $\highlabel$.

        \item[$B_L = 0$ or $B_M= 0$:] In case $B_L = 0$,
        %, then since no state vector has norm 0, we find that $B_M = 0$.
        we see from \autoref{eq:canonicity-equation-2} that $0=B_M\ket{v_M^1}$.
        Since the state vector $\ket{v_M^1}\ne 0$ by \ref{obs:nozero}, it follows that $B_M=0$.
        Otherwise, if $B_M=0$, then \autoref{eq:canonicity-equation-2} yields $z\lambda\Prest B_L\ket{v_L^1}=0$.
        We have $z \lambda\ne 0$, $\Prest \ne 0$ by definition, and $\ket{v_L^1}\ne 0$ by \ref{obs:nozero}.
        Therefore $B_L=0$. In both cases, $B_L=B_M$.
%        Let's first assume $B_L \neq
\end{description}
        We conclude that in both cases $v_L$ and $v_M$ have the same children and the same edge labels, so they are identical by the merge rule.

        \textbf{Case $\boldsymbol{\Ptop = X, Y}$.}
    If $\Ptop = \begin{smallmat}0 & z^* \\ z & 0\end{smallmat}$ for $z \in \{1, i\}$, then
    \autoref{eq:canonicity-equation-1} gives:
%        \[
%        \ket{1} \otimes z \Prest A_L \ket{v_L^0} + \ket{0} \otimes z \Prest B_L \ket{v_L^1}
%        =
%        \ket{0} \otimes A_M \ket{v_M^0} + \ket{1} \otimes B_M \ket{v_M^1}
%        \]
        \[
            \lambda z\Prest A_L \ket{v_L^0} = B_M \ket{v_M^1}
            \qquad\textnormal{and}\qquad
            \lambda z^*\Prest B_L \ket{v_L^1} = A_M \ket{v_M^0}
            .
        \]
        By low factoring, $A_L = A_M = \unit$, so we obtain
        $z\lambda  \Prest \ket{v_L^0} = B_M \ket{v_M^1}$
        and
        $\lambda z^*\Prest B_L \ket{v_L^1} = \ket{v_M^0}$.
To show that $v_L = v_M$, we consider two cases.
\begin{description}
        \item[$B_L \neq 0$ and $B_M \neq 0$:] we find $\ket{v_L^0} \simeq \ket{v_M^1}$ and $\ket{v_L^1} \simeq \ket{v_M^0}$, so by the induction hypothesis, $v_L^0= v_M^1$ and $v_L^1= v_M^0$.
        By low precedence, it must be that $v_L^1 = v_M^1 = v_L^0 = v_M^0$.
        Now use high determinism to infer that $B_L = B_M$ as in the ${\Ptop = I,Z}$ case.
%(NOTE: THIS IS THE SAME CASE AS Case-IZ \& $B_{\Box}$ nonzero. So this is where the root edge rule will help us choose $P=\Ptop \otimes \Prest$)\todo{I don't follow. Root Edge should not be relevant here.}

        \item[$B_L = 0$ or $B_M = 0$:]
       This case leads to a contradiction and thus cannot occur.
        $B_L$ cannot be zero, because then $\ket{v_M^0}$ is the all-zero vector, which we excluded by \ref{obs:nozero}.
        The other case: $B_M = 0$, then it must be that $\Prest$ is zero, hence $\ket{v_M^0}$ is the all-zero vector, which is again excluded.
\end{description}
 We conclude that $v_L$ and $v_M$ have the same children and the same edge labels  for all choices of $\Ptop$, so they are identical by the merge rule.
\end{proof}

%\begin{corollary}[Canonicity]
%    For each $n$-qubit state vector $\ket{\phi}$, there exists a unique Pauli-LIMDD $L$ such that $\ket{e^L} = \ket{\phi}$.
%\end{corollary}
%\begin{proof}
%    By Lemma~\ref{lemma:node-canonicity-strong}, there exists a unique Pauli-LIMDD $M$ such that $\ket{\phi} \simeq \ket{v_M}$.
%    Denote by $P$ a Pauli isomorphism mapping $\ket{v_M}$ to $\ket{\phi}$.
%    As root edge label, we use $\rootlabel(P\cdot e^{v_M})$.
%    By definition of $\rootlabel$, this label choice is unique.
%\end{proof}

%\newpage
%\newpage
%\newpage

% todo the others

%\autoref{thm:limdd-canonicity-root-edge} shows that for every quantum state $\ket{\phi}$, there is indeed a unique reduced \glimdd whose root edge represents $\ket{\phi}$.
%This implies canonicity, since by \autoref{def:limdd}, every \glimdd represents exactly one quantum state.
%
%\todo[inline]{Theorem does not use low precedence, so it is either incorrect or Def 3 is.}
%
%
%%\todo[inline]{Insert figure which shows that, if the reduction rules are NOT obeyed, then we can get multiple diagrams which represent the same state.}
%\begin{figure}[b]
%	\centering
%	\includegraphics[width=.7\textwidth]{pics/canonicity-two-diagrams.pdf}
%	\caption{Two \glimdds on $n+1$ qubits.}
%	\label{fig:canonicity-two-diagrams}
%\end{figure}
%\begin{theorem}[Canonicity of \glimdd nodes]
%	\label{thm:limdd-canonicity-nodes}
%	If two reduced \glimdd nodes $v_D$ and $v_E$ represent the same state $\ket{v_D}=\ket{v_E}$, and if $G$ is a subgroup of the Dihedral Torus\todo{TODO: Change to Pauli group, or explain exception}, then they are the same diagram.
%\end{theorem}
%\begin{proof}
%	The proof is by induction on the number of qubits.
%	The induction hypothesis is that the theorem holds for all \glimdd nodes on $n$ qubits.
%
%	\textbf{Base case: $n=0$ qubits. }
%	There is only one node on $0$ qubits, namely the leaf, representing the scalar $1\in \mathbb C$.
%	Hence, the theorem trivially holds in this case.
%
%	\textbf{Induction case: $n+1$ qubits. }
%	%	Let $\ket{\phi}$ be a state of $n+1$ qubits, and suppose that two \glimdds $D$ and $E$ represent this state, with $D=(V_D,Low_D,High_D,\textsf{label}_D,e_D^r)$ and $E=(V_E,Low_E,High_E,\textsf{label}_E,e_E^r)$.
%	Suppose that nodes $v_D$ and $v_E$ represent the same $n+1$-qubit state, i.e., $\ket{v_D}=\ket{v_E}$.
%	\alfons{Since $\index(v_D), \index(v_E) = n+1 > 0$, these nodes cannot be leaves.}
%	Hence $v_D$ and $v_E$ are both nodes representing the most significant qubit $n+1$, as implied by the (zero) edges rule\todo{actually requires a few reasoning steps, or we should make it part of the IH},
%	as in \autoref{fig:canonicity-two-diagrams}.
%	%	Say that the diagrams $D$ and $E$ are as in \autoref{fig:canonicity-two-diagrams}.
%	%	In this Figure, the edges $e_D^r$ and $e_E^r$ are labeled with $A_D=\textsf{label}_D(e_D^r)$ and $A_E=\textsf{label}_E(e_E^r)$, and they point to the root nodes $v_D$ and $v_E$, respectively.
%	The node $v_D$ has two (not necessarily distinct) children, $v_{D,0}$ (low) and $v_{D,1}$ (high), and node $v_E$ has children $v_{E,0}$ and $v_{E,1}$.
%	The high edges of nodes $v_D$ and $v_E$ are labeled with $n$-$G$-LIMs $B_D$ and $B_E$, respectively.
%
%	Since the diagrams $D$ and $E$ are reduced, they satisfy the \emph{Low Factoring}; therefore, the labels on the low edges are $\textsf{label}_D(v_D,v_{D,0})=\textsf{label}_E(v_E,v_{E,0})=\mathbb I$.
%	We show that this implies that $\ket{v_{D,0}}=\ket{v_{E,0}}$.
%	Namely, consider the equation $\ket{v_D}=\ket{v_E}$, and expand the most significant qubit, as follows,
%	\begin{align}
%	\ket{v_D}=\ket{0}\ket{v_{D,0}}+\ket{1}B_D\ket{v_{D,1}} = \ket{0}\ket{v_{E,0}}+\ket{1}B_E\ket{v_{E,1}} = \ket{v_E}
%	\end{align}
%	Since $\ket{0}\ket{v_{D,0}}=\ket{0}\ket{v_{E,0}}$, it follows that $\ket{v_{D,0}}=\ket{v_{E,0}}$.
%	Therefore, by the induction hypothesis, the low children $v_{D,0}$ and $v_{E,0}$ are in fact the same node.
%
%
%	The nodes $v_{D}$ and $v_E$ satisfy the \emph{High Determinism Rule}; therefore, the labels on their high edges are equal: $B_D=B_E=\highlabel(v_D)$, because the $\highlabel$ function is constant for nodes representing states in the same equivalence class according to \ref{def:reduced-limdd} and $\ket{v_{D}} = \ket{v_E} \implies \ket{v_{D}} \simeq \ket{v_E}$.
%	%In particular, if $\ket{v}=\ket{0}\ket{v_0}+\ket{1}\lbl(\high(v))\ket{v_1}$ then $\ket{v}$ is isomorphic to $\ket{0}\ket{v_0}+\ket{1}\otimes \highlabel(v)\ket{v_1}$.
%
%	%\todo{connect to new formalism. Formalize that \highlabel is constant in this case and explain here.}
%
%	It remains to show that we have $v_{D,1}=v_{E,1}$.
%	To this end, we distinguish two cases: a ``knife'' case, in which $\ket{v_D}=\ket{0}\ket{v_{D,0}}$, and a ``fork'' case.
%
%	\textbf{Case 1: Knife. }
%	By \autoref{def:reduced-limdd} we have $B_D=B_E=0$.
%	By the zero edge rule, we must have $v_{D,1}=v_{D,0}$ and $v_{E,1}=v_{E,0}$; therefore, we also conclude $v_{D,1}=v_{E,1}$.
%	From the merge rule, we then conclude that the \glimdds $v_D$ and $v_D$ are the same.
%
%	\textbf{Case 2: Fork. }
%	Since the nodes $v_D$ and $v_E$ represent the same state, consider again the equation $\ket{v_D}=\ket{v_E}$, knowing that $B_D=B_E$:
%	\begin{align}
%	\ket{v_D}=\ket{0}\ket{v_{D,0}}+\ket{1}A_D\ket{v_{D,1}} = \ket{0}\ket{v_{D,0}}+\ket{1}A_D\ket{v_{D,1}} = \ket{v_E}
%	\end{align}
%	It follows that $\ket{1}A_D\ket{v_{D,1}}=\ket{1}A_D\ket{v_{E,1}}$; therefore, in particular $A_D\ket{v_{D,1}}=A_D\ket{v_{E,1}}$.
%	Multiplying both sides with $A_D^{-1}$, we get $\ket{v_{D,1}}=\ket{v_{E,1}}$, i.e., the nodes $v_{D,1}$ and $v_{E,1}$ represent the same state.
%	Therefore, by the induction hypothesis, they must be the same node.
%\end{proof}
%\begin{corollary}
%	\label{thm:limdd-canonicity-root-edge}
%	If root edges $e_D^r, e_E^r$ of reduced \glimdds represent the same state $\ket{e_D^r}=\ket{e_E^r}$, and if $G$ is a subgroup of the Dihedral Torus\todo{tricky}, then they are the same diagram.
%\end{corollary}
%\begin{proof}
%	Since the diagrams $D$ and $E$ are reduced, they satisfy the \emph{Root Edge Determinism Rule}.
%	This means that the labels are chosen as $A_D=\rootlabel(\ket{e_D^r})$ and $A_E=\rootlabel(\ket{e_E^r})$.
%	However, because the diagrams represent the same state, i.e., $\ket{e_D^r}=\ket{e_E^r}$, it follows that $A_D=A_E$, i.e., these two root edges have the same label.
%
%	It follows that the states represented by the nodes $v_D$ and $v_E$ are the same.
%	Namely, since we have $\ket{e_D^r}=\ket{e_E^r}$, and $\ket{e_D^r}=A_D\ket{v_D}$, and $\ket{e_E^r}=A_D\ket{v_E}$, it follows that $A_D\ket{v_D}=A_D\ket{v_E}$, so, multiplying both sides with $A_D^{-1}$, we get $\ket{v_D}=\ket{v_E}$.
%	By \autoref{thm:limdd-canonicity-nodes}, since the two nodes $v_D$ and $v_E$ represent the same state, they are the same nodes.
%
%	Because the two \glimdds have the same structure below the root nodes, and have the same label on the root edge, we conclude that they are the same diagram.
%\end{proof}


\chapter{Analysis of Functions on Product Spaces}

In this chapter, we will describe some results concerning functions
on product probability spaces.

\section{Preliminaries}

Let $(\Omega, \mu)$ be a discrete probability space and
$(\Omega^L,\mu^{\otimes L})$ be the corresponding product space. For a function
$f:\Omega^L \rightarrow \R$, the \emph{Efron-Stein decomposition} of $f$ with
respect to the product space is given by
$$ f(x_1,\cdots, x_L) = \sum_{\beta \subseteq [L]} f_\beta(x),$$
where $f_\beta$ depends only on $x_i$ for $i\in \beta$ and
$$ \forall \beta' \not\supseteq \beta , a \in \Omega^{\beta'}, \E_{x \in
\mu^{\otimes L}} \left[ f_\beta(x) \mid x_{\beta'} = a \right]=0.$$
The $\ell_p$ and $\ell_\infty$ norms of $f$ with respect to the probability space
are defined as
$$\|f\|_p := \E_{x\in \mu^{\otimes L}}\left[f(x)^p\right]^{1/p},
~~~~~~~~~~~~\|f\|_\infty :=\max_{x\in \Omega^{\otimes L}}\left|f(x)\right|.$$
For $i \in [L]$, the \emph{influence} of the $i$th
coordinate on $f$ is defined as follows.
$$\Inf_i[f] := \E_{x_1,\cdots, x_{i-1},x_{i+1},\cdots , x_L}\Var_{x_i}[f
(x_1,\cdots, x_L)]  = \sum_{\beta: i\in \beta} \|f_\beta\|^2_2.$$
For an integer $d$, the \emph{degree $d$ influence} is defined as
$$\Inf_i^{\leq d}[f] := \sum_{\beta: i\in \beta, |\beta| \leq d} \|f_\beta\|^2_2.$$

\section{Invariance Principle}
%TODO: Motivate Invariance Principle More

Let $(\Omega^k, \mu)$ be a probability space. Let $\supp(\mu) := \{ x\in \Omega^k
\mid \mu(x) > 0\}$.

\begin{definition}[Connected Sets and Distributions] \label{def:connected}
We say that  $S \subseteq \Omega^k$ is
\emph{connected} if for every $x, y\in S$, there is a sequence of strings
starting with $x$ and ending with $y$ such that every element in the sequence is
in $S$ and every two adjacent elements differ in exactly one coordinate.
The probability space is connected if $\supp(\mu)$ is connected.
\end{definition}

\begin{theorem}[{Mossel~\cite[Proposition 6.4]{Mossel2008}}]

	\label{thm:invariance}
	Let $(\Omega^k, \mu)$ be a connected probability space such the minimum probability of
	every atom in $\supp(\mu)$ is at least $\alpha \in \left(0, \frac{1}{2}\right]$.
	 Then there exists
	continuous functions $\overline{\Gamma} : (0,1)\rightarrow (0,1)$ and
	$\underline{\Gamma} : (0,1)\rightarrow (0,1)$ such that the following holds:
	For every $\epsilon>0$, there exists $\tau > 0$ and an integer $d$ such that
	if a function $f : \Omega^L \rightarrow [0,1]$ satisfies
	%
	$$\forall i\in [n],  \Inf_i^{\leq d} (f) \leq \tau $$
	%
	then
	%
	$$\underline{\Gamma}\left(\E_\mu[f]\right) -\epsilon \leq \E_{(x_1,\ldots, x_k) \sim \mu}\left[
	\prod_{j=1}^k f(x_j)\right] \leq \overline{\Gamma}\left(\E_\mu[f]\right) + \epsilon.$$
	%
	There exists an absolute constant $C$ such that one can take $\tau = \epsilon^
	{C\frac{\log(\nicefrac{1}{\alpha})\log(\nicefrac{1}{\epsilon})}{\epsilon
	\alpha^2}}$ and $d = \log(\nicefrac{1}{\tau})\log(\nicefrac{1}{\alpha})$.
\end{theorem}

Correlation is a measure of dependence in probability spaces where the sample space
is a product set.

\begin{definition}[Correlated Spaces]
\label{def:correlation}
Let $(\Omega_1 \times \Omega_2, \mu)$ be a finite probability space, the correlation between $\Omega_1$ and $\Omega_2$ with respect to $\mu$ us defined as
$$\rho(\Omega_1, \Omega_2; \mu) := \mathop{\max}_{\substack{f : \Omega_1 \rightarrow \R, \E[f]  = 0 , \E[f^2]\leq 1 \\ g: \Omega_2 \rightarrow \R, \E[g] = 0 , \E[g^2]\leq 1} }  \E_{(x,y) \sim \mu }[ |f(x)g(y)|] .$$
For a probability space $\left(\prod_{i=1}^k\Omega_i, \mu\right)$, the correlation is given by
$$\rho\left(\prod_{i=1}^k\Omega; \mu\right) := \max_{i \in [k]} \rho\left( \Omega_i, \prod_{ j \in [k], j \neq i} \Omega_i; \mu\right).$$
\end{definition}

The following result about correlated spaces is an
adaptation of similar results (see Wenner
\cite[Theorem~3.12]{Wenner2013} and Guruswami \&
Lee~\cite[Lemma~A.1]{GuruswamiL2015})   to proving
our hardness results.

\begin{theorem}

  \label{thm:inv-prin} Let $(\Omega_1^k \times \Omega_2^k, \mu)$ be a
  correlated probability space with correlation $\rho < 1$
   such that the marginal of $\mu$ on any
  pair of coordinates one each from $\Omega_1$ and $\Omega_2$ is a
  product distribution. Let $\mu_1 ,\mu_2$ be the marginals of $\mu$
  on $\Omega_1^k$ and $\Omega_2^k$ respectively. Let $X, Y$ be two
  random $k\times L$ dimensional matrices chosen as follows:
  independently for every $i \in [L]$, the pair of columns $(x^i,y^i)
  \in \Omega_1^k \times \Omega_2^k$ is chosen from $\mu$. Let
  $x_i,y_i$ denote the $i$\th rows of $X$ and $Y$ respectively.  If
  $F: \Omega_1^L \rightarrow [-1,+1]$ and $G: \Omega_2^L \rightarrow
  [-1,+1]$ are functions such that
	$$\tau:= \sqrt{\sum_{i \in [L]}\Inf_i[F]\cdot \Inf_i[G]}  ~\text{ and } ~
	\Gamma := \max \left\{ \sqrt{\sum_{i \in [L]}\Inf_i[F]} , \sqrt{\sum_{i \in
	[L]}\Inf_i[G]} \right\} \ ,$$ then
		\begin{equation}
		\label{eqn:inv-eqn}
		\abs{ \E_{(X,Y) \in \mu^{\otimes L}} \left[\prod_{i\in [k]}F(x_i) G(y_i)
		\right] - \E_{X \in \mu_1^{\otimes L}} \left[\prod_{i\in [k]}F(x_i)\right]
		\E_{Y \in \mu_2^{\otimes L}} \left[\prod_{i\in [k]}G(y_i)\right] } \leq
		2^{O(k)} \Gamma \tau.
	\end{equation}
\end{theorem}

\begin{proof}

	We will prove the theorem by using the hybrid argument. For $i \in [L+1]$, let
	$X^{(i)},Y^{(i)}$ be distributed according to $(\mu_1 \otimes \mu_2)^{\otimes
	 i} \otimes \mu^{\otimes L- i}$. Thus, $(X^{(0)},Y^{(0)}) =
       (X,Y)$ is distributed according to $\mu^{\otimes L}$ while
       $(X^{(L)},Y^{(L)})$ is distributed according to
       $(\mu_1\otimes\mu_2)^{\otimes L}$. For $i \in [L]$, define
	%
	\begin{equation}
		\label{eqn:err}
		\err_i := \abs{ \E_{X^{(i)},Y^{(i)}} \left[\prod_{j=1}^kF(x^{(i)}_j)
		G(y^{(i)}_j)\right] - \E_{X^{(i+1)},Y^{(i+1)}} \left[\prod_{j=1}^kF(x^
		{(i+1)}_j) G(y^{(i+1)}_j)\right] }.
	\end{equation}
%
	The left hand side of Equation \eqref{eqn:inv-eqn} is upper bounded by $\sum_{i\in [L]}
	\err_i$.  Now for a fixed $i$,  we will bound $\err_i$. We use the
	Efron-Stein decomposition of $F,G$ to split them into two
        parts: the part which depends on the
	$i$th input and the part independent of the $i$th input.
	%
	$$F= F_0 + F_1 \text{ where } F_0 := \sum_{\alpha : i\notin \alpha} F_\alpha \mbox{ and }
	F_1 := \sum_{\alpha : i\in \alpha} F_\alpha.$$
	%
	$$G = G_0 + G_1 \text{ where } G_0 := \sum_{\beta : i\notin \beta} G_\beta  \mbox{ and }
	G_1 := \sum_{\beta : i\in \beta} G_\beta.$$
	%
	Note that $\Inf_i[F] = \|F_1\|^2_2$ and $\Inf_i[G] =
        \|G_1\|_2^2$. Furthermore, the functions $F_0$ and $F_1$ are
        bounded since $F_0(x) = \E_{x^{'}} [F(x^{'}) |
        x^{'}_{[L]\setminus i} = x_{[L]\setminus i} ] \in [-1,+1]$ and
        $F_1(x) = F(x) - F_0(x) \in [-2,+2]$.  For $a \in \{0,1\}^k$,
        let $F_a(X) := \prod_{j =1}^kF_{a_j}(x_j)$.  Similarly
        $G_0,G_1$ are bounded and $G_a$ defined
        analogously. Substituting these definitions in Equation
        \eqref{eqn:err} and expanding the products gives
	%
	$$\err_i = \abs{ \sum_{a,b \in \{0,1\}^k}\left(  \E_{X^{(i)},Y^{(i)}}
	\left[F_{a}(X^{(i)}) G_{b}(Y^{(i)})\right]  - \E_{X^{(i+1)},Y^{(i+1)}} \left[
	F_{a}(X^{(i+1)}) G_{b}(Y^{(i+1)})\right]  \right) }.$$
	%
	Since both the distributions are identical on
	$(\Omega_1^k)^{\otimes L}$ and $(\Omega_2^k)^{\otimes L}$, all
	terms with $a = \bar 0$ or $b=\bar 0$ are zero. Because $\mu$
	is uniform on any pair of coordinates on each from the
	$\Omega_1$ and $\Omega_2$ sides, terms with $|a|=|b|=1$ also
        evaluates to zero. Now consider the remaining terms with $ |a|,|b| \geq1,
	|a|+|b| > 2$. Consider one such term where $a_{1},a_2 = 1$ and $b_{1}
	=1$. In this case, by Cauchy-Schwarz inequality we have that
	%
	\begin{align*}
	\begin{split}
		\abs{ \E_{X^{(i-1)},Y^{(i-1)}} \left[F_a(X^{(i-1)}) G_{b}(Y^{(i-1)})\right]}
		 \leq &\sqrt{\E F_1(x_1)^2 G_1(y_1)^2}  \\ &\cdot \|F_1\|_2  \cdot \left\|
		\prod_{j>2} F_{a_j}\right\|_\infty \cdot \left\| \prod_{j> 1} G_{b_j}\right
		\|_\infty.
	\end{split}
	\end{align*}
	From the facts that the marginal of $\mu$ to any pair of
	coordinates one each from $\Omega_1$ and $\Omega_2$ sides are
	uniform, $\Inf_i[F] = \|F_1\|_2^2$ and
	$|F_0(x)|,|F_1(x)|,|G_0(x)|,|G_1(x)|$ are all bounded by $2$,
	the right side of above becomes
		\begin{align*}
 \sqrt{\E F_1(x_1)^2} \sqrt{\E G_1(y_1)^2} \cdot \|F_1\|_2  \cdot \left\|
		\prod_{j>2} F_{a_j}\right\|_\infty \cdot \left\| \prod_{j> 1} G_{b_j}
		\right\|_\infty \leq  \sqrt{\Inf_i[F]^2 \Inf_i[G]} \cdot 2^{2k} .
	\end{align*}
	%
	All the other terms corresponding to other $(a,b)$ which are
	at most $2^{2k}$ in number, are bounded analogously. Hence,
	%
	\begin{align*}
		\sum_{i \in [L]} \err_i &\leq 2^{4k} \sum_{i \in [L]} \left( \sqrt{\Inf_i[F]
		^2\Inf_i[G]} +\sqrt{\Inf_i[F]\Inf_i[G]^2} \right)\\
		 &= 2^{4k} \sum_{i \in [L]} \sqrt{\Inf_i[F]
		\Inf_i[G]}\left( \sqrt{\Inf_i[F]} +\sqrt{\Inf_i[G]} \right).
	\end{align*}
By	applying the Cauchy-Schwarz inequality, followed by a triangle inequality, we obtain
 	\begin{align*}
		\sum_{i \in [L]} \err_i&\leq 2^{4k} \sqrt{\sum_{i \in [L]} \Inf_i[F]\Inf_i[G]}\left(\sqrt{\sum_{i \in [L]}  \Inf_i[F]} + \sqrt{\sum_{i \in
		[L]}  \Inf_i[G]} \right).
	\end{align*}
Thus, proved.
\end{proof}


% http://www.thecartech.com/subjects/machine_elements_design/keys_and_Splines.htm

\section{Shaft Fixtures and Fittings}

This section provides descriptions of a few fixtures and methods of fitting components to a shaft. You may need to use this in your exercise as well as performing your own research on other techniques that might be suitable.

\subsection{Spline}

\begin{marginfigure}
    \centering
    \includegraphics[width=\textwidth]{09_fixtures_and_fittings/spline-shaft.png}
    \caption{Spline shaft}
\end{marginfigure}
Splines are ridges or teeth on a drive shaft that mesh with grooves in a mating piece. This enables the transfer of high torque loads, whilst maintaining angular correspondence. There are a number of different types including:

\begin{itemize}
    \item Parallel key spline
    \item Involute spline
    \item Crowned splines
    \item Serrations
    \item Helical splines
    \item Ball splines
\end{itemize}

Here are some calculations often used for splines\sidenote{\url{http://www.thecartech.com/subjects/machine_elements_design/keys_and_Splines.htm}}.

The first is the calculation of the Torque capacity for a spline and this is given by:\marginnote{Torque Capacity of Spline}

\begin{equation}
    T=pAr_m
\end{equation}

\noindent where:

\begin{description}
    \item[\( p \)] Permissibale pressure on the splines (\(<7\si{\mega\pascal}\), if relative axial motion)
    \item[\(A\)] Total load area of splines (\(0.5(D-d)Ln\), \si{\metre^2})
    \item[\(D\)] Outer spline shaft diameter (\si{\metre})
    \item[\(d\)] Inner spline shaft diameter (\si{\metre})
    \item[\(L\)] Length of spline (\si{\metre})
    \item[\(n\)] Number of splines
    \item[\(r_m\)] Mean radius (\si{\metre})
\end{description}

The shear that a spline experiences can be calculated as follows:\marginnote{Spline Shear}

\begin{equation}
    \tau = \frac{4T}{Lbn(D+d)}
\end{equation}

where:

\begin{description}
    \item[\( F \)] Force acting on a spline
    \item[\( b \)] Spline width
    \item[\( n \)] Number of splines
\end{description}

%\marginnote{Spline in Bending}

%\begin{equation}
%  \sigma_b = \frac{3F(D-d)}{b^2Ln}
%\end{equation}

%\marginnote{Pressure on groove supporting surface}

%\begin{equation}
%  d_{\min} = \sqrt[3]{\frac{16T K_a S_v}{\pi{} \tau K_f}}
%\end{equation}

%where:

%\begin{description}
%  \item[\( d_{\min} \)] Minimal shaft diameter
%  \item[\(T\)] Torque (\si{\newton\metre})
%  \item[\(K_a\)] Application factor
%  \item[\(K_f\)] Fatigue-life factor
%  \item[\(S_v\)] Desired safety
%  \item[\(\tau\)] Allowable shear stress (\si{\pascal})
%\end{description}

\subsection{Taper Lock}

\begin{marginfigure}
    \centering
    \includegraphics[width=\textwidth]{09_fixtures_and_fittings/taper-lock.png}
    \caption{Taper lock}
\end{marginfigure}
The Taper Lock bush, also referred to as a Taper bush or Taper Fit bush, is a locking mechanism commonly used in Power Transmission Drives for locating pulleys, sprockets, and couplings to shafts.
The Taper Lock bush is pre-bored and keyed to match the required shaft and keyway diameters.
The outside of the bush is tapered to match the component bore that is to be located on the shaft.

\subsection{Keyway}

Keyways are a common method of transmitting the torque from the shaft to an attached component such as a sprocket.

\begin{figure}[h!]
    \centering
    \includegraphics[width=\textwidth]{09_fixtures_and_fittings/keys.jpg}
    \caption{Types of key}
\end{figure}

When\marginnote{Determining the Minimum Key Size} a torque is applied, a key experiences two stress, a shear stress \(\tau\) and compressive stress \(\sigma_c\). These can be calculated as follows:

\marginnote{key shear (\(\tau\))}

\begin{equation}
  \tau = \frac{T}{wLr}
\end{equation}

\noindent{}Where:

\begin{description}
    \item[\(\tau\)] Key shear (\si{\pascal})
    \item[\(T\)] Torque (\si{\newton\metre})
    \item[\(w\)] Key width (\si{\metre})
    \item[\(L\)] Key length (\si{\metre})
    \item[\(r\)] Shaft radius (\si{\metre})
\end{description}

\marginnote{Key Compressive Stress (\(\sigma_c\))}

\begin{equation}
    \sigma_c = \frac{T}{0.5tLr}
\end{equation}

\noindent{}Where:

\begin{description}
    \item[\(\sigma_c\)] Compressive stress (\si{\pascal})
    \item[\(T\)] Torque (\si{\newton\metre})
    \item[\(t\)] Key height (\si{\metre})
    \item[\(L\)] Key length (\si{\metre})
    \item[\(r\)] Shaft radius (\si{\metre})
\end{description}

\marginnote{Standard Key Sizes} Although you can calculate the exact dimensions required for your key, there are standards for key sizes. Therefore, you can select any that meet your minimum requirements.

\begin{figure}[h!]
    \centering
    \includegraphics[width=0.8\textwidth]{09_fixtures_and_fittings/key-selection.jpg}
    \caption{An example of a key selection chart}
\end{figure}

\subsection{Circlip}

Circlips are a type of fastener consisting of a semi-flexible metal ring with open ends, which can be snapped into a machined groove on a dowel pin or other part to permit rotation but to prevent lateral movement.
There are two basic types: internal and external, referring to whether they are fitted into a bore or over a shaft.
Circlips are often used to secure pinned connections.
There are many vendors that can provide circlips and provide information such as the one in \cref{tbl-circlip} to aid in the selection of the appropriate size clip for your needs.

\begin{table}[h!]
    \caption{An example of an external circlip information sheet}\label{tbl-circlip}
    \centering
    \scriptsize
    \includegraphics[width=0.8\textwidth]{09_fixtures_and_fittings/circlip-dimensions.png}
    \begin{tabular}{r r r r r r r r r r r r r r r r r}
    \toprule
    \multicolumn{1}{p{0.05\textwidth}}{Nom size (\si{\milli\metre})} &
    \multicolumn{9}{c}{Circlip Dimensions (\si{\milli\metre})} &
    \multicolumn{5}{c}{Groove Dimensions (\si{\milli\metre})} &
    \multicolumn{1}{p{0.05\textwidth}}{Groove Strength} &
    \multicolumn{1}{p{0.05\textwidth}}{Circlip Strength} \\
    \midrule
    $d_1$ & $s$ & $s$ (tol) & $d_3$ & $d_3$ (tol) & $a_{\max}$ & $b$ & $d_{\min}$ & $C1$ & $C2$ & $d_2$ & $d_2$ (tol) & $m_{min}$ & $t$ & $n$ & $F_n$ (kN) & $F_r$ (kN) \\
    \midrule

    17 & 1,00 & 0,00 & 15,7 & +0,10 & 3,8 & 2,3 & 1,7 & 25,0 & 23,8 & 16,2 & 0,00 & 1,10 & 0,40 & 1,2 & 3,4 & 8,0 \\
    & & -0,06 & & -0,43 & & & & & & & -0,11 & & & & & \\

    18 & 1,20 & 0,00 & 16,5 & +0,10 & 3,9 & 2,4 & 2,0 & 26,2 & 24,8 & 17,0 & 0,00 & 1,30 & 0,50 & 1,5 & 4,5 & 17,00 \\
    & & -0,06 & & -0,44 & & & & & & & -0,11 & & & & & \\

    19 & 1,20 & 0,00 & 17,5 & +0,10 & 3,9 & 2,5 & 2,0 & 27,2 & 25,8 & 18,0 & 0,00 & 1,30 & 0,50 & 1,5 & 4,5 & 17,00 \\
    & & -0,06 & & -0,45 & & & & & & & -0,11 & & & & & \\

    \multicolumn{17}{c}{\ldots} \\

    \bottomrule

    \end{tabular}
\end{table}


\subsection{Introduction}

A pivotal quantity is a statistic whose distribution does not depend on the parameters of the underlying distribution.

For example, the z statistic if the underyling distribution is a normal distribution.


\documentclass[11pt]{amsart}
\usepackage{enumitem}
\usepackage{setspace}
\onehalfspacing
\usepackage{natbib}
\usepackage{geometry}                % See geometry.pdf to learn the layout options. There are lots.
\geometry{letterpaper}                   % ... or a4paper or a5paper or ...
%\geometry{landscape}                % Activate for for rotated page geometry
%\usepackage[parfill]{parskip}    % Activate to begin paragraphs with an empty line rather than an indent
\usepackage{graphicx}
\usepackage{amssymb}
\usepackage{amsmath}
\usepackage{epstopdf}
\usepackage[linesnumbered,vlined,algoruled]{algorithm2e}
\usepackage{url}
\usepackage{mathtools}
\DeclareMathOperator{\sgn}{sgn}
\DeclarePairedDelimiter{\ceil}{\lceil}{\rceil}
\DeclarePairedDelimiter{\floor}{\lfloor}{\rfloor}
\DeclareGraphicsRule{.tif}{png}{.png}{`convert #1 `dirname #1`/`basename #1 .tif`.png}
\DeclareMathOperator*{\argmax}{arg\,max}
\DeclareMathOperator{\argmin}{arg\,min}
\setlength{\parskip}{0.5 em}

\title{The Size of a $t$-Digest}
\author{Ted Dunning}
\address{Ted Dunning \\ MapR Technologies, Inc \\ San Jose, CA}
\email{ted.dunning@gmail.com}
\date{}                                           % Activate to display a given date or no date

\begin{document}
\begin{abstract}
A $t$-digest is a compact data structure that allows estimates of quantiles which increased accuracy near $q = 0$ or $q=1$. This is done by clustering samples from $\mathbb R$ subject to a constraint that the number of points associated with any particular centroid is constrained so that the so-called $k$-size of the centroid is always $\le 1$. The $k$-size is defined using a scale function that maps quantile $q$ to index $k$. This paper provides bounds on the sizes of $t$-digests created using any of four known scale functions.
\end{abstract}
\maketitle
\section{Introduction}
We examine four cases for the $t$-digest \citep{t-digest-arxiv} scale function in order to produce estimates of the number of centroids and the maximum size of these centroids. The functions include
\[
\begin{aligned}
k_0(q) &= \frac \delta 2 q \\
k_1(q) &= \frac \delta {2\pi}  \sin^{-1}(2q-1)   \\
k_2(q) &= \frac \delta {Z(n)} \log {\frac q {1-q}} \\
k_3(q) &= \frac \delta {Z(n)}\begin{cases}
\quad \log 2q & \text{if  } q \le 1/2 \\
- \log 2(1-q) & \text{if  } q > 1/2
\end{cases}
\end{aligned}
\]
Where $Z$ is a normalization value that may depend on the number of data points seen so far and is intended to bound the size of the $t$-digest, at least in a practical sense.
\section{General considerations}
Figure \ref{fig:k-q-plot-full} shows how a scaling function converts quantiles (the $q$ axis) into $k$ values. In this figure, values of $k$ are marked  and how unit steps in $k$ cause variable sized steps in $q$. This limit is the fundamental idea behind $t$-digests together with the idea of representing the distribution of interest by a set of centroids, each of which summarizes a localized subset of the samples. Making some subsets smaller means that the error due to summarizing the distribution is reduced near the extreme values of $q$.
\begin{figure}[htbp] %  figure placement: here, top, bottom, or page
   \centering
   \includegraphics[width=2.3in]{../t-digest-paper/figures/k-q-plot.pdf}
   \caption{The scaling function translates the quantile $q$ to the scaling factor $k$ in order to give variable size steps in $q$. This limits the number of samples that are included in any particular centroid, particularly near $q=0$ or $q=1$ which in turn allows more accurate estimation of the distribution near these limits. }
   \label{fig:k-q-plot-full}
\end{figure}

These boundaries in $q$ are, however, not precisely realizable in practice since the centroids are made up of an integral number of samples. As such, centroids are limited in size to be smaller than the idealized size, except in the case of single samples. Importantly, centroids with only a single point may have $k$-size larger than $1$. Such centroids do not, however, contribute to excess error since we know the exact position of such lone centroids.

Figure \ref{fig:k-q-limits} illustrates how this works out in practice. Taking the case of one particular centroid $\mathcal C$, then if we assume that the samples that contribute to all of the centroids with smaller mean values are less than the samples that define $\mathcal C$ and similarly that all of the samples for centroids with larger mean values are to the right of all of the samples in $\mathcal C$, we can make some statements about how many samples can be in $\mathcal C$. Depending on how the $t$-digest was constructed, this assumption may not be quite true, but it will be close to true.
\begin{figure}[htbp] %  figure placement: here, top, bottom, or page
   \centering
   \includegraphics[width=3.5in]{../t-digest-paper/k-q-diagram/k-q-limits.pdf}
   \caption{Looking in detail at a magnified part of the scaling function, taking unit steps in $k$ gives idealized boundaries for centroids, but the weights of centroids are  constrained to integral values. }
   \label{fig:k-q-limits}
\end{figure}
For the purpose of this illustration, there are $i$ samples in centroids with smaller means than $\mathcal C$ and we mark this as point $q_1$. Point $q_1$ maps to the value $k$ and $k+1$ maps back to $q_2$ which is the limit on the size of the centroid. Here it is clear $\mathcal C$ can contain only two samples without extending past $q_2$ and thus being too large to be a valid part of a $t$-digest.

As can be seen from these figures, if the scaling curve is too steep, $q_2-q_1 < 1/n$ so $\mathcal C$ will have only a single sample. This observation turns out to be very important when calculating how many samples a centroid will use. Figure \ref{fig:k-q-slope} shows the effect of this. All practically important scaling functions become very steep near the boundaries so there will be some number of unit weight centroids at the ends of any $t$-digest.

\begin{figure}[htbp] %  figure placement: here, top, bottom, or page
   \centering
   \includegraphics[width=3.5in]{../t-digest-paper/k-q-diagram/slope-limiting.pdf}
   \caption{When the slope becomes too steep, centroids have unit weight. The effect is that the scaling function (black and gray thick line) is effectively modified (dashed lines) so that the slope is at most $n$, the total number of samples.  }
   \label{fig:k-q-slope}
\end{figure}
Exactly how many such unit centroids there are likely to be is a very important factor in characterizing the $t$-digest and can be computed by finding points where the scaling function exceeds a critical slope. Once a step from $q=i/n$ to $q'=(i+1)/n$ results in an increase in $k$ greater than one, no centroid can have more than one sample. The critical slope is thus $n$, the total number of samples.

In the next sections, these ideas will be used to determine specific limits on $t$-digest size for each of the important scaling functions listed at the beginning of this paper.

\section{Size bound for $k_0$}
The slope of $k_0$ is constant and whenever that slope is more than $n$, all centroids will have unit weight. This happens whenever $n \le \delta/2 $ so for this case the number of centroids is just $n$.

In a mid-range where $\delta/2 < n < \delta$, the $k$-size of unit centroids is less than $1$, but the $k$-size of a centroid with weight more than $1$ is larger than $1$ so no centroids can combine without violating the $t$-digest size limit. Thus the number of centroids is $n$ in this range as well.

If we take $  n = \mu \delta /2$  where $\mu \ge 2$ all centroids will have an average weight of at least $ \mu/2 $ but none will have a weight larger than $ \mu $ and thus $\delta/2 \le n \le \delta$.

In any of these three cases, for scaling function $k_0$ the number of centroids in a  $t$-digest will be in the range $\left[\min( n,\delta/2), \min(n,\delta)\right]$.

Based on the logic above, the upper bound for the weight of any centroid for $k_0$ is $
w \le 2 n / \delta$.
\section{Size bound for $k_1$}
We know that $k_1(1) -  k_1(0) = \delta/2$. Since no centroid can have $k$-weight more than $1$ and the average $k$-weight cannot be less than $1/2$, we know that the number of centroids is in $\left[ \delta/2 , \delta \right]$ if $n > \delta$.

The slope of $k_1(q)$ is $\delta / ( 2\pi \sqrt{q(1-q)} \, )$. The minimum slope is
$\delta / \pi$ at $q=1/2$ so if $n \le \delta/\pi$, no centroid will have a weight of more than one.

For $\delta/\pi < n \le \delta$ the slope at $1/2$ will be such that some centroids can have a weight more than one.
\subsection{Maximum centroid weight}

The maximum weight of centroids can be computed by considering a centroid centered in terms of $k$ around $k(q) = \kappa$.

This centroid can span a range of $q$ of at most
\[
\Delta q = k^{-1}(\kappa+1/2) - k^{-1}(\kappa-1/2) \\
\]
But we know that
\[
k^{-1}(\kappa) = \frac 1 2 \left(   \sin \frac {2\pi \kappa} \delta + 1  \right)
\]
So using multiple angle identities
\[
\begin{aligned}
\Delta q &= \frac 1 2 \left(
  { \sin \frac {2\pi (\kappa+1/2)} \delta  }  -   { \sin \frac {2\pi (\kappa-1/2)} \delta  }
  \right) \\
&= \frac 1 2 \Biggl(
\left( \sin \frac {2 \pi} \delta \kappa \cos \frac \pi \delta  + \cos \frac {2 \pi} \delta \kappa \sin \frac \pi \delta  \right) -
\left( \sin \frac {2 \pi} \delta \kappa \cos \frac  \pi  \delta  - \cos \frac {2 \pi} \delta \kappa \sin \frac  \pi  \delta  \right)
\Biggr) \\
&=
\sin \frac \pi \delta    \cos \frac {2 \pi} \delta \kappa =   2 \left( \sin \frac \pi \delta \right)    \sqrt{q(1-q)}\\
\end{aligned}
\]
The maximum weight of this centroid is  $w_{\max} = n \Delta q$.

Note, however, the value of $q$ cannot not be known precisely from the information we have in a $t$-digest for a centroid. If, indeed, we did know lower and upper bounds $q_{\min}$ and $q_{\max}$ for the points associated with a centroid in a $k_1$ digest, we would be able to use whichever value of $q$ that is furthest from $1/2$ to get a conservative limit $w_{\max}$.
\[
q_{\text {worst}} = \begin{cases}
 q_{\min} & \text{if } | q_{\min} - 1/2 | > | q_{\max} - 1/2 | \\
 q_{\max} & \text {otherwise}
\end{cases} \\
\]
Unfortunately, it is not possible to know the actual values of $q_{min}$ and $q_{max}$ in most practical situations such as when a $t$-digest has been created by merging digests. For a particular centroid $\mathcal C$, if we take $\mathcal W_{\text {left}}$ to be the sum of the weights of centroids with means smaller than $\mathcal C$ and $\mathcal W$ to be the weight of $\mathcal C$ then these estimated values are useful
\[
\begin{aligned}
q_{\min} &\approx {\mathcal W_{left}} / n \\
q_{\max} &\approx (\mathcal W + \mathcal W_{left}) / n
\end{aligned}
\]
From that
\[
w_{\max} \le 2n \left( \sin \frac \pi \delta\right) \sqrt{q_{\text {worst}} (1-q_{\text {worst}})}
\]
Note that in any case, we have no solid guarantees about the distribution of the samples for a particular centroid so that this size limit remains somewhat heuristic in nature.
\section{Size bounds for $k_2$}
Unlike $k_1$, both $k_2$ and $k_3$ have unbounded tails at $q=0$ and $q=1$ so we require a different argument to compute the size of a $t$-digest for $k_2$ and $k_3$. Because the smallest weight a centroid can have is $1$ corresponding to a change in $q$ of $\Delta q = 1/n$, the effective slope of the scaling function is limited to a value of $n$ and thus the range from minimum to maximum $k$  is finite. For suitably chosen  $Z(n)$, the size is not only finite, but bounded for any value of $n$.

Wherever $k_2'(q) > n$, a centroid cannot have a weight greater than $1$. In particular, if the smallest value of the slope is this large, all centroids must have unit weight. By definition,
\[
\begin{aligned}
k_2(q) &= \frac \delta {Z(n)} \log {\frac q {1-q}} \\
k_2'(q) &= {\frac  {\delta/Z(n)} {q (1-q) }  } \\
\end{aligned}
\]
The slope is least at $q=1/2$ so if $ n < 4  \delta / Z$ all centroids have unit weight.

On the other hand, even if $n$ is considerably larger than this limit, some centroids near $q=0$ or $q=1$ will still have unit weight because the slope of $k(q)$ increases without bound and thus will ultimately exceed any value of $n$ for $q$ sufficiently near $0$ or $1$. We can approximate the region $[q_1, q_2]$ where centroids can have weights larger than $1$ by examining where the slope of $k(q)$ crosses the critical value of $n$.
\[
\begin{aligned}
{\frac  {\delta/Z(n)} {q_i (1-q_i) }  } &= n \\
q_i^2 - q_i + \frac {\delta/Z(n)} n &= 0 \\
q_i &= \frac 1 2 \left( { 1 \pm \sqrt { 1 - 4 \frac {\delta/Z(n)} n } } \, \right)
\end{aligned}
\]
The discriminant here will always be positive for the values $n$ we are examining so we have two solutions symmetric around $1/2$. Moreover, if $n \gg 4\delta / Z$
\[
\begin{aligned}
\sqrt { 1 - 4 \frac {\delta/Z(n)} n } &\approx 1 - 2 \frac {\delta / Z(n)} n \\
q_1 &\approx {   \frac {\delta/Z(n)} n  } \,  \\
q_2 &= 1-q_1
\end{aligned}
\]
This means that there will be roughly $\delta/Z(n)$ unit centroids at each extreme with the remaining centroids having a weight greater than one. We can compute an approximate bound on the number of larger centroids
\[
\begin{aligned}
m_{w>1} &\le 2\left( k(q_2) -k(q_1) \right) \\
&\le  \frac {2\delta} {Z(n)} \log {\frac {q_2 (1-q_1)} {(1-q_2) q_1}} = \frac {2\delta} {Z(n)} \log { {q_2^2} / { q_1^2}} \\
&\approx  \frac {4 \delta} {Z(n)} \left(\log  n/ \delta + \log Z(n)\right)
\end{aligned}
\]
Adding back in the unit clusters
\[
m \le  \frac {4 \delta} {Z(n)} \left(\log  n/ \delta + \log Z(n) + 1/2\right)
\]

If we pick $Z(n) = 1$, then the total number of centroids grows with increasing $n$ and is roughly
\[
m \le 4\delta  \log n/\delta + 1/2
\]
On the other hand, if we pick $Z(n)$ so that it grows with $\log n$ then $\log Z(n)$  will grow extremely slowly. Specifically, choosing $Z(n) = 4 \log n/\delta + 24$ means that
\[
\frac {\log n / \delta + \log Z(n)+1/2} {Z(n)}  < 1/4
\]
for all values of $n/\delta < 9.1 \times 10^{23}$ which more than covers the range of practical utility.

This inequality means that the total number of centroids will be bounded
\[
\begin{aligned}
m&\le   \frac {4 \delta} {Z(n)} \left(  \log  n/ \delta + \log Z(n) + 1/2\right) \\
&\le  \delta
\end{aligned}
\]
\subsection{Maximum centroid weight}

The maximum weight for a centroid centered at $k(q) = \kappa$ can be estimated using a Taylor expansion
\[
\begin{aligned}
w_{\max} &\le n \Delta q \\
\Delta q &= k^{-1}(\kappa + 1/2) - k^{-1}(\kappa-1/2) \\
&\approx \left . \frac {dq} {dk} \right\rvert_{\kappa} = \left[ 1 \Bigg \slash {\frac {dk} {dq}} \right]_q\\
&\approx \frac {Z(n)} \delta q(1-q) \\
\end{aligned}
\]
As before, in practice, we cannot know the precise value of $q = k^{-1}(\kappa)$ so we typically use $q_{\text {worst}}$ to get a conservative limit.
\section{Size bounds for $k_3$}
The scale function $k_3$ is
\[
k_3(q) = \frac \delta {Z(n)}\begin{cases}
\quad \log 2q & \text{if  } q \le 1/2 \\
- \log 2(1-q) & \text{if  } q > 1/2
\end{cases}
\]
By symmetry, we can consider just the first branch in our calculations. In this range, the slope is
\[
k_3'(q) = \frac \delta { q Z(n)}
\]
All centroids with $q \le \frac \delta {2 n Z(n)}$ have unit weight. When $n \le \frac \delta {Z(n)}$, this region extends to $q = 1/2$ forcing all centroids to have unit weight. For larger $n$, we define $q_1$ as before (and $q_2$ by symmetry, of course)
\[
\begin{aligned}
q_1 &= \frac \delta { n Z(n)} \\
q_2 &= 1-q_1
\end{aligned}
\]
The total number of centroids is thus
\[
\begin{aligned}
m  &\le  n q_1 + n (1-q_2) + 2(k(q_2) - k(q_1)  ) \\
  &\le 2\left(  n q_1 + (k(q_2) - k(q_1)  ) \right)\\
&= \frac { 2\delta} { Z(n)} \left(1  -2\log 2 q_1\right)\\
&= \frac {4\delta} { Z(n)} \left(1/2- \log 2 + \log  \frac  { n }\delta + \log Z(n)\right)
\end{aligned}
\]
For $Z(n)=1$, we have unbounded logarithmic growth in the number of centroids. Alternatively, if we choose $Z(n) = 4\log n/\delta + 21$  and take $n/\delta < 10^{20}$ as a reasonable restriction on the area of applicability, we get a bound of $m \le \delta$.
\subsection{Maximum centroid weight}
We can follow the same method as with $k_2$ to find the maximum weight for any centroid.

The maximum weight for a centroid centered at $k(q) = \kappa$ can be estimated using a Taylor expansion
\[
\begin{aligned}
w_{\max} &\le n \Delta q \\
\Delta q &= k^{-1}(\kappa + 1/2) - k^{-1}(\kappa-1/2) \\
&\approx \left . \frac {dq} {dk} \right\rvert_{\kappa} = \left[ 1 \Bigg \slash {\frac {dk} {dq}} \right]_q\\
&\approx \frac {Z(n)} \delta \min (q, (1-q)) \\
\end{aligned}
\]
As before, $q$ is not known precisely in practice so we use $q_{\text {worst}}$ to get a conservative limit.
\[
w_{\max}\le \frac {nZ(n)} \delta \min (q_{\text{worst}}, (1-q_{\text{worst}}))
\]
\bibliographystyle{chicago}
\bibliography{refs}{}

\end{document}


\section{HDIM of Feistel Networks}
\SecLabel{hdim-feistel}

The Feistel Network is a rather asymmetric and imbalanced structure. After any round, the left branch is a result of more computations, and the right branch is ``weaker'' in this sense. Often it may occur that, after a particular number of rounds, the left branch has full algebraic degree, while the right branch is still of incomplete degree. This can be seen as the maximum number of rounds available for an integral distinguisher, since after the next round the strong left branch is mixed into the weak right branch, and, in general, we can expect both branches to have full degree. To exploit the imbalance of Feistel Networks, we analyze the degree of the ``weak'' right branch.

\begin{definition}
Let $\maxdegnbij{r}{d}$ denote the maximum possible degree of the right output branch of a Feistel Network with $r$ rounds and Feistel functions of degree at most $d$. Let $\maxdegbij{r}{d}$ denote the maximum possible degree in the case when the Feistel functions are bijective:
\eq{
& \maxdegnbij{r}{d} = \max_{F \in \nbij{r}{d}} \deg{(\RB\circ F)}, \\
& \maxdegbij{r}{d} = \max_{F \in \bij{r}{d}} \deg{(\RB \circ F)}.
}
\end{definition}

\begin{remark}
The maximum degree of the left branch is equal to the maximum degree of the right branch in the next round, since the branch is transferred untouched.
\end{remark}

\begin{remark}
The exact values of $\maxdegnbij{r}{d},\maxdegbij{r}{d}$ are hard to compute. However, upper bounds can be computed using different methods. Improving further the upper bounds should lead to strengthening the results from this chapter.
\end{remark}

The definition of HDIM leads to an interesting insight into proving absence of particular monomials of maximum degree (i.e. $n-1$ for $n$-bit permutations), or, equivalently, zeroes in the HDIM itself. The idea is to split the computed function into two roughly equal parts. Then the algebraic/integral distinguisher exists when the \emph{sum} of the degrees of the two parts is less than the block size $n$. In the original case, the parts are composed and the degrees are roughly \emph{multiplied}, i.e. the distinguisher is found when the \emph{product} of the degrees is less than $n-1$.

In this section the utility functions $\thetanbij{r}{d}$ and $\thetabij{r}{d}$ will be used to describe the conditions when the integral distinguisher exists.

\begin{definition}
The functions $\thetanbij{r}{d}, \thetabij{r}{d}$ are defined as follows:
\begin{align*}
    \thetanbij{r}{d} &= \maxdegnbij{\floor{r/2}}{d} + \maxdegnbij{\ceil{r/2}}{d},\\
    \thetabij{r}{d} &= \maxdegbij{\floor{r/2}}{d} + \maxdegbij{\ceil{r/2}}{d}.
\end{align*}
\end{definition}

The following lemma shows a simple upper bound from the product bound of a composition.

\begin{lemma}
\Label{lem:bound}
A Feistel Network with $r \ge 1$ rounds and degree-$d$ round functions has degree at most $d^r$ on the left output branch and degree at most $d^{r-1}$ on the right output branch:
$$
\maxdegbij{r}{d} \le \maxdegnbij{r}{d} \le d^{r-1}.
$$
In particular,
$$
\thetabij{r}{d} \le \thetanbij{r}{d} \le d^{\floor{r/2}-1} + d^{\ceil{r/2}-1}.
$$
\end{lemma}

\begin{remark}
In the case of Feistel Networks, the block size is assumed to be $2n$, whereas in discussions about general permutations, the block size is $n$.
\end{remark}

The HDIM-based distinguishers that we exhibit in this section have the same structure: if conditions of a distinguisher are satisfied, then the $2n\times 2n$ HDIM has the form $\begin{bmatrix}? & 0 \\ 0 & 0\end{bmatrix}$ as a $2\times 2$ block-matrix. Such distinguisher is automatically extended to one more round leading to an HDIM of the form $\begin{bmatrix}? & ? \\ ? & 0\end{bmatrix}$. This is formalized in the following definition and a lemma.

\begin{definition}[Type-I, Type-II Distinguishers]
Let $S\colon \field{2n} \to \field{2n}$. Then
\begin{itemize}
    \item $S$ is said to have the type-I distinguisher if
    $$\HDIM{S}[i,j] = 0 ~\text{for}~ n < i \le 2n ~\text{\bf or}~ n < j \le 2n;$$
    \item $S$ is said to have the type-II distinguisher if
    $$\HDIM{S}[i,j] = 0 ~\text{for}~ n < i \le 2n ~\text{\bf and}~ n < j \le 2n.$$
\end{itemize}
\end{definition}

\begin{lemma}
\Label{lem:type-ext}
Let $r\ge 1$, $S_r \in \nbij{r}{d}$ and $S_{r+1} \in \nbij{r+1}{d}$ be $2n$-bit permutations such that
$$
S_{r+1} = \Swap \circ R_{f} \circ \Swap \circ S_r
$$
for some function $f\colon \field{n} \to \field{n}$.

If $S_{r}$ has the type-I distinguisher, then $S_{r+1}$ has the type-II distinguisher.
\end{lemma}
\begin{proof}
Since, $\RB \circ S_{r+1} = \LB \circ S_r$ the last $n$ rows of $\HDIM{S_{r+1}}$ are the same as the first $n$ rows of $\HDIM{S_r}$.
\end{proof}

% ===================================================

\subsection{General Case}

The following theorem applies the described ideas to general Feistel Networks.

\begin{theorem}
\Label{thm:nbij}
Any $S \in \nbij{r}{d}$ has the type-I distinguisher if $$\thetanbij{r+1}{d} < 2n.$$

Similarly, any $S \in \bij{r}{d}$ has the type-I distinguisher if $$\thetabij{r+1}{d} < 2n.$$

\end{theorem}
\begin{proof}
Let $(a,b) \in \field{2n}$ denote the intermediate state of $S$ after $\floor{r/2}$ rounds (see \FigRef{mitmproof}). Let $x_l(a,b), x_r(a,b)$ denote the input branches of $S$ as functions of $a,b$, and $y_l(a,b),y_r(a,b)$ the output branches of $S$ as functions of $a,b$. We now perform the variable replacement in the definition of HDIM:
$$
\HDIM{S}[i,j] =
\bigoplus_{x\in \field{2n}} \inprod{e_i, S(x)} \inprod{e_j, x} =
\bigoplus_{(a,b)\in \field{2n}} \inprod{e_i, (x_l,x_r)(a,b)} \inprod{e_j, (y_l,y_r)(a,b)}.
$$
Our goal is to prove a bound on the algebraic degree of the product of the two inner products.

Variables $x_l,x_r,y_l,y_r$ can be computed using a Feistel Network with $a,b$ as inputs: $(x_l,x_r) \circ \Swap \in \nbij{\floor{r/2}}{d}$ and $(y_l,y_r) \in \nbij{\ceil{r/2}}{d}$. Therefore, they have the following degree bounds:
\begin{itemize}
    \item $\deg{x_l} \le \maxdegnbij{\floor{r/2}+1}{d}$, $\deg{x_r} \le \maxdegnbij{\floor{r/2}}{d}$,
    \item $\deg{y_l} \le \maxdegnbij{\ceil{r/2}+1}{d}$,          $\deg{y_r} \le \maxdegnbij{\ceil{r/2}}{d}$.
\end{itemize}

The zeroes in the HDIM required for the type-I distinguisher correspond to products $x_r\cdot y_r$, $x_r \cdot y_l$ and $x_l \cdot y_r$. It is enough to prove the case $n < i \le 2n$, since the inverse of $S$ is also a Feistel Network and thus the transpose of the $\HDIM{S}$ will have the same zeroes. The case corresponds to the products $x_r\cdot y_r$ and $x_l \cdot y_r$. It follows that $\HDIM{S}[i,j] = 0$ if $n < j \le 2n$ and $\maxdegnbij{\floor{r/2}+1}{d} + \maxdegnbij{\ceil{r/2}}{d} < 2n$. The condition is equivalent to $\thetanbij{r+1}{d} < 2n$.
\end{proof}

\FigTex{proof.tex}

\begin{corollary}
Any $S \in \nbij{r}{d}$ has the type-I distinguisher if $$d^{\floor{r/2}} + d^{\ceil{r/2}-1} < 2n,$$
and the type-II distinguisher if
$$d^{\floor{r/2}-1} + d^{\ceil{r/2}-1} < 2n.$$
\end{corollary}
\begin{proof}
Putting the bound from Lemma~\Ref{lem:bound} in Theorem~\Ref{thm:nbij} makes the proof. For the type-II distinguisher the result follows from Lemma~\Ref{lem:type-ext}.
\end{proof}

% ===================================================

\subsection{Bijective Feistel Functions}

In the case when the Feistel functions are bijective, an additional trick may be used. The intermediate state variables can be chosen in an alternative way by exploiting the fact that the middle Feistel function is invertible. However, in this case we need to know an upper bound on the degree of the \emph{inverse} of the middle Feistel function.

In what follows, the upper bound on the algebraic degree of the inverse of the Feistel function is denoted by $\dinv$.

\begin{theorem}
\Label{thm:bij}
Any $S \in \bij{r}{d}$ has the type-I distinguisher if
$$
    \max(d,\dinv)\cdot \thetabij{r-2}{d} < 2n.
$$
\end{theorem}
\begin{proof}
The proof is analogous to the proof of Theorem~\Ref{thm:nbij}, except that the choice of intermediate variables differs.
Instead of choosing both left and right branches of the input of the middle round, it is possible to choose the left branch of the input and the right branch of the output. The variables chosen are $(a,c)$ instead of $(a,b)$ (see \FigRef{mitmproof}). In this case $b$ can be expressed as $f_{\floor{r/2}+1}^{-1}(a \oplus c)$, and degree of $b$ as a function of $(a,c)$ is upper bounded by $\dinv$.

Without loss of generality, assume $r \ge 3$. Let $(a_x, b_x) \in \field{2n}$ denote the state before the $\floor{r/2}$-th round, and $)a_y, b_y) \in \field{2n}$ denote the state after the $(\floor{r/2}+2)$-th round. The following degree bounds hold (every variable is considered as a function of $(a,c)$):
\begin{itemize}
    \item $\deg{a_x} \le \max(d,\dinv), \deg{b_x} = 1$,
    \item $\deg{a_y} \le \max(d,\dinv), \deg{b_y} = 1$,
\end{itemize}
The input $(x_l, x_r)$ of $S$ can be computed as a $(\floor{r/2}-1)$-round Feistel Network composed with the function $(a_x, b_x)$. Similarly, the output $(y_l, y_r)$ of $S$ can be computed as a $(\ceil{r/2}-2)$-round Feistel Network composed with the function $(a_y, b_y)$. It follows that
\begin{itemize}
    \item $\deg{x_l} \le \max(d,\dinv)\cdot \maxdegbij{\floor{r/2}}{d}$,
    \item $\deg{x_r} \le \max(d,\dinv)\cdot \maxdegbij{\floor{r/2}-1}{d}$,
    \item $\deg{y_l} \le \max(d,\dinv)\cdot \maxdegbij{\ceil{r/2}-1}{d}$,
    \item $\deg{y_r} \le \max(d,\dinv)\cdot \maxdegbij{\ceil{r/2}-2}{d}$.
\end{itemize}
It is easy to verify that the degrees of the products $x_r\cdot y_l$ and $x_r \cdot y_r$ are upper bounded by $$
\max(d,\dinv)\cdot\pround{\maxdegbij{\floor{r/2}-1}{d} + \maxdegbij{\ceil{r/2}-1}{d}} = \max(d,\dinv)\cdot\thetabij{r-2}{d}.$$
Similarly to Theorem~\Ref{thm:nbij}, by the transpose-inverse property of the HDIM, the type-I distinguisher follows if
$$\max(d,\dinv)\cdot\thetabij{r-2}{d} < 2n.$$
\end{proof}
\begin{remark}
When $\dinv \le d$, Theorem~\Ref{thm:bij} provides a type-I distinguisher for 1 more round compared to the general Theorem~\Ref{thm:nbij}.
\end{remark}

\begin{corollary}
\Label{cor:bij}
Any $S \in \bij{r}{d}$ has the type-I distinguisher if $$\max(d,\dinv)\cdot(d^{\floor{r/2}-2} + d^{\ceil{r/2}-2}) < 2n,$$
and the type-II distinguisher if
$$\max(d,\dinv)\cdot(d^{\floor{r/2}-2} + d^{\ceil{r/2}-3}) < 2n.$$
In particular, any 4-round Feistel Network with bijective round functions has the type-I distinguisher and any 5-round Feistel Network with bijective round functions has the type-II distinguisher.
\end{corollary}

\begin{remark}
Note that the results for Feistel Networks with bijective functions are not very useful if a degree bound on Feistel functions is known, but a degree bound on their inverses is not known. In such case only the generic 5-round type-II distinguisher can be obtained.
\end{remark}

% ===================================================

\subsection{Applications}

As an illustration of the theorems, consider the HDIM of random Feistel Networks with 3-bit branches. For particular $S_4,S_5\colon \field{6} \to \field{6}$, $S_4 \in \bij{4}{2}$ and $S_4 \in \bij{5}{2}$ (the LAT of these functions was shown in \FigRef{lat8motiv}):
{
\def\gzero{{\color{gray}0}}
\begin{equation}
  \HDIM{S_4} = \psquare{\footnotesize
    \begin{array}{cccccccc}
    1 & 0 & 1 & \gzero & \gzero & \gzero \\
    0 & 1 & 1 & \gzero & \gzero & \gzero \\
    1 & 0 & 1 & \gzero & \gzero & \gzero \\
    \gzero & \gzero & \gzero & \gzero & \gzero & \gzero \\
    \gzero & \gzero & \gzero & \gzero & \gzero & \gzero \\
    \gzero & \gzero & \gzero & \gzero & \gzero & \gzero \\
    \end{array}
  }, ~\HDIM{S_5} = \psquare{\footnotesize
    \begin{array}{cccccccc}
    0 & 0 & 0 & 0 & 1 & 0 \\
    1 & 0 & 1 & 0 & 1 & 0 \\
    0 & 0 & 0 & 0 & 1 & 0 \\
    1 & 1 & 1 & \gzero & \gzero & \gzero \\
    1 & 0 & 1 & \gzero & \gzero & \gzero \\
    1 & 0 & 1 & \gzero & \gzero & \gzero \\
    \end{array}
  }.
\end{equation}
}

It is interesting that from the HDIM we can see that all coordinates of $S_5$ have full degree $n-1$, but still the structure always has an integral distinguisher because particular monomials are always missing in the ANF.

\FigTex{distinguishers.tex}

\TabRef{distinguishers} shows application of theorems to several concrete parameters.

In~\cite{division}, Todo proposed \emph{division property}, a method to find integral characteristics. I compared our results with those reported by Todo in Appendix~B of~\cite{division}. Our HDIM-motivated results (type-II distinguishers) correspond to maximum number of rounds for which an integral characteristic is proven.
\begin{itemize}
    \item For non-bijective cases, division property is better in 4 targets and provides the same results else. Those targets are $(n,d)$-Feistel networks $(24, 2),(48, 2),(48, 5),(64, 5)$. Our approach proves a distinguisher for one round less.

    \item For bijective cases, division property results in one more round than the respective non-bijective case in a few places. Our approach does not exploit this distinction in general and thus is weaker for these cases. However, under the assumption that the degree of the inverses of Feistel functions is upper-bounded by the same value (i.e. $\dinv \le d$), Corollary~\Ref{cor:bij} provides identical results and even one more round for a three cases: $(n,d)$ Feistel Networks $(32,5),(32,7),(64,7)$.
    To the best of my knowledge, no known method existed to exploit a bound on the degree of the inverse functions in the division property framework. I describe such method in \SecRef{improve-division}
\end{itemize}

As the results show, the division property proposed by Todo allows to get slightly stronger integral characteristics than the HDIM-motivated approach, except the cases when the degree of the inverses of Feistel functions is known. The downside of division property is that it requires an algorithmic evaluation for each parameter set, whereas our approach provides a simple closed formula.
Furthermore, the degree growth inside the two halves of a primitive is evaluated by a generic bound in our approach. It may be possible to combine our approach with division property or another degree evaluation method to obtain better results. In particular, a recursive approach used in~\cite{LeoSPN} for SPNs may be useful for Feistel Networks as well.

\SubSecDef{improve-division}{Improving Division Property Propagation}

I briefly note a method to improve the division property propagation rule given a bound on the algebraic degree of the inverse function of a permutation. I describe the division property using the equivalent characterization by Boura and Canteaut~\cite{anotherview}. Recall that the indicator of a multiset is defined as the indicator of the set containing elements from the multiset with odd multiplicities.

\begin{definition}
A multiset $X \subseteq \field{n}$ is said to satisfy the division property $\DP{n}{k}$, if
$$
\deg{\Ind_X} \le n - k.
$$
\end{definition}

The main propagation rule of the division property is as follows (equivalently given in~\cite{division} by Todo)
\begin{proposition}
Let $X \subseteq \field{n}$ be a multiset satisfying $\DP{n}{k}$. Let $F$ be a permutation of $\field{n}$. Then the multiset $Y = F(X)$ satisfies the division property
$$
\DP{n}{k'}, ~\text{for all}~k' \le \ceil{\frac{k}{\deg{F}}}.
$$
\end{proposition}
\begin{remark}
I write inequality instead of original equality, to highlight all division properties that are satisfied, instead of only the strongest one.
\end{remark}

I now show that another propagation rule can be obtained, if the degree of $F^{-1}$ is known.

\begin{proposition}
The multiset $Y = F(X)$ satisfies the division property
$$
\DP{n}{k'}, ~\text{for all}~k' \le n - (n-k) \deg{F^{-1}}.
$$
\end{proposition}
\begin{proof}
Without loss of generality, assume that $X$ has no elements with a multiplicity greater than 1. Note that
$$
x \in X \Leftrightarrow F(x) \in Y.
$$
It can be rewritten as
$$
\Ind_X = \Ind_Y\circ F.
$$
Equivalently,
$$
\Ind_X \circ F^{-1} = \Ind_Y.
$$
It follows that
$$
\deg{\Ind_Y} \le \deg{\Ind_X} \cdot \deg{F^{-1}} \le (n - k)\cdot \deg{F^{-1}},
$$
and thus, $\deg{\Ind_Y} \le n - k'$ for all
$$
k' \le n - (n - k) \deg{F^{-1}}.
$$
\end{proof}

Using this proposition, the results from~\cite{division} can be improved for the case of bijective Feistel functions, assuming that $\dinv \le d$. The improved division property then provides the same or slightly better results than Corollary~\Ref{cor:bij} in all cases from~\cite{division}.