\input{../../UCLHeader.tex}
\input{../../UCLCommands.tex}
\begin{document}
\title{Quantum Error Correction - Lecture 5}
\author{with Dan Browne}
\maketitle
\tableofcontents

\section{Introduction}
In this lecture, we shall introduce the concept of fault-tolerant quantum computing. We will especially focus on the threshold theorem and emphasise how important efficient scaling methods becomes for fault-tolerant computing.

\section{The Clifford group}
The concept of a Clifford algebra might sound related. This is a type of associative algebra that generalises the notion of real numbers, complex numbers, quaternions and so on.

The Clifford group is something else, however. It is the set of unitary gates that maps to stabiliser states.

What then are stabiliser states? They are states, or codewords in a stabiliser code with $k = 0$. That is, the stabiliser code that does not encode any qubits. This code has the property $n = m$, thus the number of independent stabiliser generators is $m = n$.

For example, the very simplest code contains the following states and stabilisers.

\begin{tabular}{ c c}
\hline
State & Stabiliser \\ \hline
$\ket{0}$ & $Z$ \\
$\ket{1}$ & $- Z$ \\
$\ket{00} + \ket{11}$ & $XX, ZZ$ \\
$\ket{000} + \ket{111}$ & $XXX, ZZI, IZZ$ \\
\end{tabular}

For example, the Hadamard gate acts as a stabiliser in that it maps a codeword to the same codespace.
\beq
H \ket{0} \rightarrow \ket{+}
\eeq
\beq
H \ket{1} \rightarrow \ket{-}
\eeq
We find that $H$ is a Clifford group unitary. So it the $Z$ operator,
\beq
Z \ket{0} = \ket{0}
\eeq
\beq
Z \ket{1} = - \ket{1}
\eeq
Note the global phase here. It does not affect the stabiliser group since the states $\ket{1}$ and $-\ket{1}$ are experimentally indistinguishable.
The CNOT gate is another example of a member of the Clifford group.

Now that we have listed a few gates, we might perhaps rather have a simple way to demonstrate the characteristics of Clifford group gates. We can do so by considering a general operator $\sigma$ as part of the Clifford group and then use a set of unitary matrices $\{U\}$ in a similarity transformation to map the elements of one Puali group to other elements in the Pauli group. That is,
\beq
\sigma \rightarrow \sigma' = U\sigma U^\dagger
\eeq
where $\sigma$ is some Pauli operator (holds for the $N$-qubit case as well). That is, the Clifford group is the group of unitary matrices that maps elements in the Pauli group to another element in the Pauli group.

A convenient fact which we shall now prove is that this operation is equivalent to conjugation of the operators. So, a stabiliser $S_j$ fulfils the following relationship
\beq
S_j \ket{\psi} = \ket{\psi}
\eeq
for all $j$. We say that $S_j \in $ the stabiliser group. Consider now
\beq
U S_j \ket{\psi} = U \ket{\psi}
\eeq
But since we know that $U^\dagger U = \identity$, we can insert this into the expression to find,
\beq
U S_j U^\dagger U \ket{\psi} = U \ket{\psi}
\eeq
which again holds for all $j$. In fact, $US_j U^\dagger$ is just another stabiliser.

In order to prove that all the objects that we can obtain for $US_jU$ with different unitary matrices form a group, we need to prove the group properties. First, we have the identity. This is quite clearly filled by the identity matrix $\identity$. Secondly, there exists an inverse since we are dealing with unitary matrices. By conjugating the matrices, we obtain the inverse. Finally, the group is closed because, as we showed, the product $U S_j U^\dagger$ still maps the state $U \ket{\psi}$ to itself. Thus, $US_j U^\dagger$ is also a stabiliser, and the group is closed.

Let us have a look at another gate which is a member of the Clifford group. This is the $S$-gate, given by
\beq
S = \bpmat 1 & 0 \\ 0 & i \epmat
\eeq
We find that $S \in$ the Clifford group, since
\beq
S Z S^\dagger = S
\eeq
That is, $S$ maps $Z$ to itself, and thus stays in the Clifford group. This can be easily confirmed since $[S, Z]= 0$.

The $S$ gate has the following effect.
\beq
S \ket{+} = \ket{+i}
\eeq
\beq
S \ket{+i} = \ket{-}
\eeq
On the Bloch sphere, the $S$ gate can be thought of as a rotation of 90 degrees on the equator.

For a single qubit, the Clifford group is generated by $H$ and $S$. This is all we need.

Recall that the stabiliser states in the single qubit group lie on an octahedron in the Bloch sphere - one for each axial extremal point. Thus, the symmetry group for the stabilisers is the symmetry group of the octahedron. Here, all $X,Y,Z$ are rotations of 180 degrees around a certain axis. The Hadamard gate is a reflection about a diagonal line.

However, we want to be able to go from the single qubit Clifford group to the $N$-qubit Clifford group. It turns out that it is generated by the set
\beq
\{H, S, CNOT\}
\eeq
which must act on every qubit and every pair of qubits. Note the similarity between this set and the universal quantum computing gate set.

We now wish to prove that the CNOT gate is a meber of the Clifford group. It suffices to check that
\beq
U \sigma U^\dagger = \sigma'
\eeq
where $\sigma$ is some Pauli operator. We use the following notation $CNOT_{CT}$ where $C$ is the control qubit and $T$ is the target qubit. We know that CNOT is self-inverse. We can check that
\beq
CNOT_{CT} ( Z\otimes I) CNOT_{CT} = I \otimes Z
\eeq
The control commutes with $Z$ gates. WE also find that
\beq
CNOT ( X \otimes I ) CNOT = X\otimes X
\eeq
\beq
CNOT(I \otimes Z ) CNOT = Z\otimes Z
\eeq
Note that the commutator relations are preserved. Finally,
\beq
CNOT(I\otimes X)CNOT = I \otimes X
\eeq
Since we proved this for generators of the Pauli group, we know it applies to the entire group.

\section{Gottesmann-Knill Theorem}
Theorem: The Clifford group circuits acting on stabiliser states are easy to simulate classically. Any quantum circuit on $n$ qubits acting on an initial stabiliser state consisting of a polynomial in $n$ different gates can be effectively simulated in $\mathcal{O}(n)$ gates on a classical computer.

\emph{Proof idea}: We shall here not prove the entire theorem, but rather give a flavour of the proof ingredients.
\begin{itemize}
\item Represent states by stabiliser generators and show that we end up with unitary update rules.
\item Then, must show that the measurement update rules are all efficiently simulatable.
\end{itemize}

The consequences are substantial. It shows that Clifford gates, stabiliser states and the Pauli group is not enough for universal quantum computing.

So given stabiliser states, Clifford unitaries and Pauli measurements, what must we add for true universal computing?

It turns out that we need to add a single non-Clifford unitary. We can consider using a non-stabiliser states as an ancilla, or performing some non-Pauli measurements to achieve this. It is usually enough to add just one of these components.

We paraphrase the following theorem:

\textbf{Theorem}: (Nebe, Rains, Sloane) Given a non-Clifford unitary $U$, the set
\beq
\{U, U^\dagger, CNOT, H, S\}
\eeq
is approximately universal.

It means that we can approximate universality with other sets. A gate set is approximately universal if any unitary $U$ can be approximated to arbitrary accuracy by a gate sequence contained in the set.

So, by using the set above, we can \emph{efficiently} simulate any other set, thus gaining approximate universality. As long we are happy with a little bit of error.

\section{The Solovay-Kitaev theorem}
Again, we paraphrase this theorem: Given a set (single qubit) of unitarieis which is approximately universal for single qubit quantum computing, we can represent an arbitrary single qubit unitary to arbitrary accuracy \emph{efficiently}.

That is, if $U$ is our target unitary, $S$ is our unitary achieved as a sequence of gates, and we want
\beq
\norm{S - U}< \epsilon
\eeq
where the norm is
\beq
\norm{S - U } = \max_{\ket{\psi}} \norm{S \ket{\psi} - U \ket{\psi} }
\eeq
It turns out that it suffices to use a sequence of length $\mathcal{O} \left( \log^c{\frac{1}{\epsilon}} \right)$ where $c \simeq 1.7$. Here, the scaling is the important thing -- it shows that the process is efficient.

So we just need a unitary $U$ gate set to efficiently simulate anything.

What then, shall we use? We can make use of the so-called $T$ gate.
It is defined as
\beq
T = \sqrt{S}
\eeq
If we write
\beq
S = \bpmat 1 & 0 \\ 0 & e^{i \pi/2} \epmat
\eeq
Then
\beq
T = \bpmat 1 & 0 \\ 0 & e^{i \pi /4} \epmat
\eeq
It is also known as a $\pi/8$ gate because we could write
\beq
T= e^{i \pi /8}\bpmat e^{- i \pi/8} &0 \\ 0 & e^{i \pi/8}
\epmat
\eeq
However, the name $T$-gate is the more common jargon. This is a non-Cliford gate with many more properties. We know that
\beq
T^2 = S
\eeq
Also, for $T $ and $T^\dagger$, it follows
\beq
T^\dagger = T^\dagger T^\dagger T = S^\dagger T = S¨\dagger S¨\dagger S T = ZST
\eeq
So we can obtain the inverse by multiplication of other gates. This becomes very clear if we view it in the Bloch sphere.

As a result, we can conclude that the set $\{CNOT, H, T\}$ is an approximately universal set. For fault tolerance, it is very useful to have a universal gate set. In general, we can approximate any small evolution as
\beq
e^{i Ht} \simeq I + i Ht
\eeq
That is, we divide it up into gates.

\section{Fault-Tolerant Quantum Computing}
We first introduce the Threshold Theorem. There exist many implementations of it, but we shall use a simple error model to demonstrate its purpose.

\textbf{Threshold Theorem}: Assume the following simplified error model: Every component in our computation, e.g. the preparation of input states, unitary gates, and measurements.

Assume that every component succeeds with probability $1-p$ and fails with probability $p$. We take this probability to be very small $p\ll 1$.

Here, fail means that the gate is followed by an arbitrary error -- anything can happen. If we use quantum error correcting codes, concatenation or similar, frequent error correction, we need a fault-tolerant construction to stop errors from spreading.

We find that certain methods cause errors to spread to the extent that they multiply. We thus need to prevent single errors from turning into multiple errors.

Given all this, efficient, reliable quantum computation is possible provided
\beq
p<p_{th}
\eeq
where $p_{th}$ is a threshold rate. Then, the errors will be suppressed through correction.

How would we do this? It turns out that we only need a code that can correct a single error.  The key idea is that we use a distance 3 code that allows us to correct one error and call the set of qubits supporting the code a code block.

For example, we can take the Steane code, $n = 7, d = 3, k = 1)$. Here, let 7 qubit represent a code block - this is one single encoded qubit. Then, in order to implement a fault-tolerant design, we would try and ensure that the probability of more than one error in each code block is heavily suppressed.

So fault-tolerant constructions want to design circuits such that one component failure leads to at most one error on one single qubit in one separate code block.

The key idea is the following. It means that if this is achieved, a code block will only fail to have its error corrected if two or more independent component failures occur. This notion of \textbf{independence} is very important.

If a component failure rate is $p$, then the probability of wo independent failures is $p^2$, which is indeed very small. We can do the same kind of analysis with $d>3$ codes.

This means estimating the probability of a code block failure occuring. It will be
\beq
p^2 \times \mbox{no. of pairs or error locations}
\eeq
where the second term simply means all the possible things that can go wrong. We must consider every component as an error location., e.g. the number of pairs of failed components which cause code blocks to fail.

For example, we can look at the encoded CNOT gate in the Steane code. Since the CNOT gate operates on two logical qubits, it must act on two separate code blocks. After we act with the CNOT gate, we must measure each code block for an error and then correct them individually.

Counting all pairs of errors that can occur gives us about $\sim 10^4$. If we then calculate the probability of an error occuring times the number of ways in which this can happen, we get
\beq
\left( 10^4 \cdot 10^{-4} \right)^2 = 1
\eeq
We would want this quantity to be really small, preferably smaller than 1.

But note that our one layer of encoding has brought us from $p$ to $p^2$. We write
\beq
cp^2
\eeq
where $c$ denotes pairs of error locations.

\section{Code concatenation}
We replace every qubit by a code-block and every component by an encoded CNOT gate. We worked out before that we got $cp^2$ for one layer. For two layers of encoding, we gain
\beq
cp^2 \rightarrow c \left( cp^2 \right)^2 = c^3 p^4 = \frac{(cp)^4}{c}\eeq
Then, we go from $2 \rightarrow 2\cdot 7 \rightarrow 2 \cdot 7^2$ qubits in the case of the Steane code.

We can then repeat the concatenation. After $n$ layers of encoding, we have
\beq
\frac{(cp)^{2^n}}{c}
\eeq
Now, if $cp<1$, this quantity gets exponentially suppressed. However, we do end up having to use $2\cdot 7^n$ qubits for the encoding. We can show though that the error grows slower than the number of qubits.

More generally, let $d$ be the size of a code block. We then get a number of $d^n$ physical qubits and gates that scale with $d^n$. It is not too bad, considering that the error quantity scaled with $2^n$, which is much faster.

Consider then a quantum algorithm with problem size $n$ and $f(n)$ number of polynomial components. We can accept an overall error $\calE$, where $\calE$ must not scale with $n$. Thus, if we repeat the algorithm, we bring down the error. This is the case for e.g. Grover's unstructured search algorithm. Note that by problem size, we mean the parameter that determines the complexity of hte problem.

The encoded component error at the top layer is $p$. Then, the probability of all components succeeding for a number of $f(n)$ operations is
\beq
(1- p)^{f(n)} \simeq 1 - pf(n)
\eeq
So here, we want $pf(n) \ll \calE$. To explore this more closely, set $p = \epsilon$, where
\beq
\epsilon = \frac{(cp)^{2^n}}{c}
\eeq
is the quantity we considered before. So then, for $k$ levels of encoding (we switch the name of the variable since $n$ is already taken), we get
\beq
\frac{(cp)^{2^k}}{c} f(n) \ll \calE
\eeq
We can solve this for $k$, see Nielsen and Chuang Section 10.6 for details. However, the overhead from encoding is $d^k$, and we can show that
\beq
d^k = \cal{O} \left( poly \left( \log{f(n)/\epsilon} / \calE \right) f(n) \right)
\eeq
which is approximately $Polyl(\log{n})$, so it's actually pretty good. Thus, provided we can encode everything, all our gates and all the qubits, we can have fault-tolerant computing.

However, the architecture for such a system is difficult, and the overhead is difficult.

Question: What is meant by overhead? I don't seem to have written that down.

\end{document}

Error Correction Lecture 7 March 2016.tex


\section{The identity types of pushouts}

\subsection{Characterizing families of maps over pushouts}

\begin{defn}
    Consider a span $\mathcal{S}$
  \begin{equation*}
    \begin{tikzcd}
      A & S \arrow[l,swap,"f"] \arrow[r,"g"] & B,
    \end{tikzcd}
  \end{equation*}
  and consider $P,Q:\mathsf{Fam\usc{}pushout}(\mathcal{S})$.
  A morphism of descent data from $P$ to $Q$ over $\mathcal{S}$ is defined to be a triple $(h_A,h_B,h_S)$ consisting of
  \begin{align*}
    h_A & : \prd{x:A} P_A(x)\to Q_A(x) \\
    h_B & : \prd{y:B} P_B(y)\to Q_B(y)
  \end{align*}
  equipped with a homotopy $h_S$ witnessing that the square
  \begin{equation*}
    \begin{tikzcd}[column sep=huge]
      P_A(f(s)) \arrow[r,"h_A(f(s))"] \arrow[d,swap,"P_S(s)"] & Q_A(f(s)) \arrow[d,"Q_S(s)"] \\
      P_B(g(s)) \arrow[r,swap,"h_B(g(s))"] & Q_B(g(s))
    \end{tikzcd}
  \end{equation*}
  commutes for every $s:S$. We write $\mathsf{hom}_{\mathcal{S}}(P,Q)$ for the type of morphisms of descent data over $\mathcal{S}$.

  An equivalence of descent data from $P$ to $Q$ is a morphism $h$ such that $h_A$ and $h_B$ are families of equivalences.
\end{defn}

\begin{rmk}\label{rmk:id-hom-Fam-pushout}
  The identity type $h=h'$ of $\mathsf{hom}_{\mathcal{S}}(P,Q)$ is characterized as the type of triples $(H_A,H_B,H_S)$ consisting of
  \begin{align*}
    H_A & : \prd{a:A} h_A(a)\htpy h'_A(a) \\
    H_B & : \prd{b:B} h_B(b)\htpy h'_B(b)
  \end{align*}
  and a homotopy $K_S(s)$ witnessing that the square
  \begin{equation*}
    \begin{tikzcd}
      h_B(g(s))\circ P_S(s) \arrow[d] \arrow[r] & Q_S(s)\circ h_A(f(s)) \arrow[d] \\
      h'_B(g(s))\circ P_S(s) \arrow[r] & Q_S(s)\circ h'_A(g(s))
    \end{tikzcd}
  \end{equation*}
  of homotopies commutes for every $s:S$.
\end{rmk}

\begin{defn}\label{defn:hom-Fam-pushout-map}
  Consider a commuting square
  \begin{equation*}
    \begin{tikzcd}
      S \arrow[r,"g"] \arrow[d,swap,"f"] & B \arrow[d,"j"] \\
      A \arrow[r,swap,"i"] & X
    \end{tikzcd}
  \end{equation*}
  with $H:i\circ f \htpy j \circ f$, and let $P$ and $Q$ be type families over $X$. We define a map
  \begin{equation*}
    \Big(\prd{x:X}P(x)\to Q(x)\Big) \to \mathsf{hom}_{\mathcal{S}}(\mathsf{desc\usc{}fam}(P),\mathsf{desc\usc{}fam}(Q)).
  \end{equation*}
\end{defn}

\begin{constr}
  Let $h:\prd{x:X}P(x)\to Q(x)$. Then we define
  \begin{align*}
    h_A & : \prd{a:A}P(i(a))\to Q(i(a)) \\
    h_B & : \prd{b:B}P(j(b))\to Q(j(b))
  \end{align*}
  by $h_A(a,p)\defeq h(i(a),p)$ and $h_B(b,q)\defeq h(j(b),q)$. Then it remains to define for every $s:S$ a homotopy $h_S(s)$ witnessing that the square
  \begin{equation*}
    \begin{tikzcd}[column sep=huge]
      P(i(f(s))) \arrow[r,"h_A(f(s))"] \arrow[d,swap,"\mathsf{tr}_P(H(s))"] & Q(i(f(s))) \arrow[d,"\mathsf{tr}_Q(H(s))"] \\
      P(j(g(s))) \arrow[r,swap,"h_B(g(s))"] & Q(j(g(s)))
    \end{tikzcd}
  \end{equation*}
  commutes. Note that every family of maps $h:\prd{x:X}P(x)\to Q(x)$ is natural in the sense that for any path $p:x=x'$ in $X$, there is a homotopy $\psi(p,h)$ witnessing that the square
  \begin{equation*}
    \begin{tikzcd}
      P(x) \arrow[r,"h(x)"] \arrow[d,swap,"\mathsf{tr}_P(p)"] & Q(x) \arrow[d,"\mathsf{tr}_Q(p)"] \\
      P(x') \arrow[r,swap,"{h(x')}"] & Q(x')
    \end{tikzcd}
  \end{equation*}
  commutes. Therefore we define $h_S(s)\defeq\psi(H(s),h)$.
\end{constr}

\begin{thm}\label{thm:hom-Fam-pushout}
  The map defined in \cref{defn:hom-Fam-pushout-map} is an equivalence.
\end{thm}

\begin{proof}
  We will first construct a commuting triangle
  \begin{equation*}
    \begin{tikzcd}[column sep=-3em]
      \phantom{\mathsf{hom}_{\mathcal{S}}(\mathsf{desc\usc{}fam}(P),\mathsf{desc\usc{}fam}(Q))} & \prd{x:X}P(x)\to Q(x) \arrow[dl] \arrow[dr] & \phantom{\mathsf{dep\usc{}cocone}_{(i,j,H)}(x\mapsto P(x)\to Q(x))} \\
      \mathsf{dep\usc{}cocone}_{(i,j,H)}(x\mapsto P(x)\to Q(x)) \arrow[rr,densely dotted] & &
      \mathsf{hom}_{\mathcal{S}}(\mathsf{desc\usc{}fam}(P),\mathsf{desc\usc{}fam}(Q))
    \end{tikzcd}
  \end{equation*}
  Recall from \cref{thm:dependent-pullback-property-pushout} that $X$ satisfies the dependent universal property, so the map on the left is an equivalence. Therefore we will prove the claim by showing that the bottom map is an equivalence.

  In order to construct the bottom map, we first note that for any two maps $\alpha:P(x)\to Q(x)$ and $\alpha':P(x')\to Q(x')$ and any path $p:x=x'$, there is an equivalence
  \begin{equation*}
    \varphi(p,f,f'):\Big(\mathsf{tr}_{x\mapsto P(x)\to Q(x)}(p,f)=f'\Big) \simeq \Big(\prd{y:B(x)} f'(\mathsf{tr}_B(p,y))=\mathsf{tr}_C(p,f(y))\Big).
  \end{equation*}
  The equivalence $\varphi$ is defined by path induction on $p$, where we take
  \begin{equation*}
    \varphi(\refl{},f,f')\defeq \mathsf{htpy\usc{}eq}\circ\mathsf{inv}.
  \end{equation*}
  Now we define the bottom map in the asserted triangle to be the map
  \begin{equation*}
    (h_A,h_B,h_S)\mapsto (h_A,h_B,\lam{s}\varphi(H(s),h_A(f(s)),h_B(g(s)),h_S(s))).
  \end{equation*}
  Note that this map is an equivalence, since it is the induced map on total spaces of an equivalence.

  It remains to show that the triangle commutes. By \cref{rmk:id-hom-Fam-pushout} it suffices to construct families of homotopies
  \begin{align*}
    K_A : \prd{a:A} h_{i(a)}\htpy h_{i(a)} \\
    K_B : \prd{b:B} h_{j(b)}\htpy h_{j(b)}
  \end{align*}
  and for each $s:S$ a homotopy $K_S(s)$ witnessing that the square
  \begin{equation*}
    \begin{tikzcd}[column sep=13em]
      h_{j(g(s))} \circ \mathsf{tr}_P(H(s)) \arrow[d] \arrow[r,"{\psi(H(s),h)}"] & \mathsf{tr}_Q(H(s)) \circ h_{i(f(s))} \arrow[d] \\
      h_{j(g(s))} \circ \mathsf{tr}_P(H(s)) \arrow[r,swap,"{\varphi(H(s),h_{i(f(s))},h_{j(g(s))},\apd{h}{H(s)})}"] & \mathsf{tr}_Q(H(s))\circ h_{i(f(s))}
    \end{tikzcd}
  \end{equation*}
  commutes. Of course, we take $K_A(a)\defeq\mathsf{htpy\usc{}refl}$ and $K_B(b)\defeq\mathsf{htpy\usc{}refl}$, so it suffices to show that
  \begin{equation*}
    \psi(H(s),h)\htpy \varphi(H(s),h_{i(f(s))},h_{j(g(s))},\apd{h}{H(s)}).
  \end{equation*}
  Now we would like to proceed by homotopy induction on $H:i\circ f \htpy j\circ g$. However, we can only do so after we generalize the problem sufficiently to a situation where $H$ has free endpoints. It is indeed possible by homotopy induction to construct for every $f,g:S\to X$ equipped with a homotopy $H:f\htpy g$, every family of maps $h:\prd{x:X}P(x)\to Q(x)$ and every $s:S$, a homotopy
  \begin{equation*}
    \psi(H(s),h)\htpy \varphi(H(s),h_{f(s)},h_{g(s)},\apd{h}{H(s)}).\qedhere
  \end{equation*}
\end{proof}

\subsection{Characterizing the identity types of pushouts}

\begin{defn}
  Consider a span $\mathcal{S}$ equipped with $a:A$, and consider
  $P:\mathsf{Fam\usc{}pushout}(\mathcal{S})$ equipped with $p:P_A(a)$. We say that $P$ is \define{universal} if for every $Q:\mathsf{Fam\usc{}pushout}(\mathcal{S})$ the evaluation map
  \begin{equation*}
    \mathsf{hom}_{\mathcal{S}}(P,Q)\to Q_A(a)
  \end{equation*}
  given by $h\mapsto h_A(a,p)$ is an equivalence.
\end{defn}

\begin{lem}
  Consider a pushout square
  \begin{equation*}
    \begin{tikzcd}
      S \arrow[r,"g"] \arrow[d,swap,"f"] & B \arrow[d,"j"] \\
      A \arrow[r,swap,"i"] & X
    \end{tikzcd}
  \end{equation*}
  with $H:i\circ f \htpy j\circ g$, and let $a:A$. Furthermore, let $P$ be the descent data for the type family $x\mapsto i(a)=x$ over $X$. Then $P$ is universal.
\end{lem}

\begin{proof}
  Since $\mathsf{desc\usc{}fam}$ is an equivalence, it suffices to show that for every type family $Q$ over $X$, the map
  \begin{equation*}
    \mathsf{hom}_{\mathcal{S}}(\mathsf{desc\usc{}fam}(\mathsf{Id}(i(a))),\mathsf{desc\usc{}fam}(Q))\to Q(i(a))
  \end{equation*}
  given by $h\mapsto h_A(a,\refl{i(a)})$ is an equivalence.
  Note that we have a commuting triangle
  \begin{equation*}
    \begin{tikzcd}
      \prd{x:X}(i(a)=x)\to Q(x) \arrow[r] \arrow[dr,swap,"\mathsf{ev\usc{}refl}"] &
      \mathsf{hom}_{\mathcal{S}}(\mathsf{desc\usc{}fam}(\mathsf{Id}(i(a))),\mathsf{desc\usc{}fam}(Q)) \arrow[d,"{h\mapsto h_A(\refl{i(a)})}"] \\
      & Q(i(a))
    \end{tikzcd}
  \end{equation*}
  The map $\mathsf{ev\usc{}refl}$ is an equivalence by \cref{thm:yoneda}, and the top map is an equivalence by \cref{thm:hom-Fam-pushout}. Therefore it follows that the remaining map is an equivalence.
\end{proof}

\begin{thm}
  Consider a pushout square
  \begin{equation*}
    \begin{tikzcd}
      S \arrow[r,"g"] \arrow[d,swap,"f"] & B \arrow[d,"j"] \\
      A \arrow[r,swap,"i"] & X
    \end{tikzcd}
  \end{equation*}
  with $H:i\circ f \htpy j\circ g$, and let $a:A$. Furthermore consider a pair $(P,p_0)$ consisting of $P:\mathsf{Fam\usc{}pushout}(\mathcal{S})$ and $p:P_A(a)$. If $P$ is universal, then we have two families of equivalences
  \begin{align*}
    e_A & : \prd{x:A}P_A(x)\simeq (i(a)=i(x)) \\
    e_B & : \prd{y:B} P_B(y)\simeq (i(a)=j(b))
  \end{align*}
  equipped with a homotopy $e_S$ witnessing that the square
  \begin{equation*}
    \begin{tikzcd}[column sep=huge]
      P_A(f(s)) \arrow[r,"e(s)"] \arrow[d,swap,"e_A(f(s))"] & P_B(g(s)) \arrow[d,"e_B(g(s))"] \\
      (i(a)=i(f(s))) \arrow[r,swap,"\lam{p}\ct{p}{H(s)}"] & (i(a)=g(s))
    \end{tikzcd}
  \end{equation*}
  commutes for each $s:S$, and an identification $e_A(a,r)=\refl{i(a)}$
\end{thm}

\begin{thm}
  Let $X$ be a pointed type with base point $x_0:X$. Then the loop space of $\susp{X}$ is the initial type $Y$ equipped with a base point $y_0:Y$, and a pointed map
  \begin{equation*}
    X \to_\ast (Y\simeq Y).
  \end{equation*}
\end{thm}

\begin{proof}
  The type of pairs $(Y,\mu)$ consisting of a pointed type $Y$ and a pointed map $\mu:X\to_\ast (Y \simeq Y)$ is equivalent to the type of triples $(Y,Z,\mu)$ consisting of a pointed type $Y$, a type $Z$, and a map $\mu:X\to (Y\simeq Z)$.
\end{proof}

\begin{cor}
  The loop space of $\sphere{2}$ is the initial type $X$ equipped with a point $x_0:X$ and a homotopy $H:\idfunc\htpy\idfunc$.
\end{cor}

\begin{exercises}
\exercise Consider the suspension
  \begin{equation*}
    \begin{tikzcd}
      P \arrow[r] \arrow[d] & \unit \arrow[d,"\south"] \\
      \unit \arrow[r,swap,"\north"] & \susp{P}
    \end{tikzcd}
  \end{equation*}
  of a proposition $P$. Show that $(\north=\south)\simeq P$.
\exercise Show that if $X$ has decidable equality, then $\susp{X}$ is a $1$-type.
\exercise Consider a pushout square
  \begin{equation*}
    \begin{tikzcd}
      A \arrow[r] \arrow[d,swap,"f"] & \unit \arrow[d,"j"] \\
      B \arrow[r,swap,"i"] & X
    \end{tikzcd}
  \end{equation*}
  where $f:A\to B$ is an embedding.
  \begin{subexenum}
  \item Show that there are equivalences
  \begin{align*}
    (i(b)=i(y)) & \simeq (b=y)\ast \fib{f}{b} \\
    (i(b)=j(\ttt)) & \simeq \fib{f}{b}
  \end{align*}
  for any $b,y:B$.
  \item Use \cref{ex:trunc-join-with-prop} to show that if $B$ is a $k$-type, then so is $X$, for any $k\geq 0$.
  \end{subexenum}
\exercise Consider the join
  \begin{equation*}
    \begin{tikzcd}
      P \times X \arrow[r,"\proj 2"] \arrow[d,swap,"\proj 1"] & X \arrow[d,"\inr"] \\
      P \arrow[r,swap,"\inl"] & \join{P}{X}
    \end{tikzcd}
  \end{equation*}
  of a proposition $P$ and an arbitrary type $X$.
  \begin{subexenum}
  \item Show that for any $x,y:X$ there is an equivalence
    $e:(\inr(x)=\inr(y))\simeq \join{P}{(x=y)}$ for which the triangle
  \begin{equation*}
    \begin{tikzcd}[column sep=tiny]
      \phantom{\join{P}{(x=y)}} & (x=y) \arrow[dl,swap,"\apfunc{\inr}"] \arrow[dr,"\inr"] & \phantom{(\inr(x)=\inr(y))} \\
      (\inr(x)=\inr(y)) \arrow[rr,swap,"e"] & & \join{P}{(x=y)}
    \end{tikzcd}
  \end{equation*}
  commutes.
\exercise \label{ex:trunc-join-with-prop}Show that if $X$ is a $k$-type, then so is $\join{P}{X}$.
  \end{subexenum}
\end{exercises}


\section{Imaging} \label{sec:imaging}

%In addition to multiple cameras at different locations and poses, an uniform lightning is also required to minimize specular difficulties in the texture.

Digital stereo vision in the end analyses digital images; this section introduces the basic image acquisition steps and concerns that affect reconstruction quality. Cameras are never ideal, and practical algorithms take lens imperfections into account (e.g. \cite{opencv}). Images are commonly taken with digital cameras that project a three-dimensional view from a single viewpoint to an image plane, and finally to a discrete grid of numerical values that describe light intensities.

Practical details, such as depth of field, sharpness, aberrations and others are not considered, as they vary greatly depending on the used hardware and are out of scope of this work.
It suffices to say that in a practical system the choice of good optics is a key to good quality reconstruction.
Accuracy and errors depend on not only decidable physical parameters of a stereo imaging rig, such as camera positioning, but also on e.g.~physical construction errors, lens imperfections, camera sensor noise, image compression and algorithmic accuracy. \cite{hollsten2013imagequality, kyto2011method,rieke2009evaluation}.

%In addition to plain photographic cameras, reconstruction can be done using e.g. laser scanners or light field cameras. Those are not covered in this work.

\subsection{Pinhole camera}

\simplegfx{h}{0.6\textwidth}{pinhole-camera}
{Pinhole camera principle. The box represents a camera; image seen through the small hole is formed to the plane on its back, rotated upside down.}

A physical camera is in its simplest form modeled as a pinhole camera; an ideal device that projects an image upside down on its film through a small aperture.
Illustration given in image \ref{fig:pinhole-camera}.
In computer vision, this projection is given as a $3 \times 4$ matrix, when homogeneous coordinates are used.
Homogeneous coordinates add an extra dimension to the interpretation of coordinates and each point becomes a line that crosses the origin in a dimension one higher than the original.
In addition, several vector operations become more convenient to manipulate. \cite{hartley03multiview,heyden2005multiple}

The pinhole model (or, perspective projection) states that the world point $(x, y, z)$ is projected to the image plane ($f$ units away from the origin) at $(u, v)$:

\begin{equation}
\begin{pmatrix}
u \\ v
\end{pmatrix}
=
-\frac{f}{z} \begin{pmatrix}
x \\ y \\ z
\end{pmatrix}
\end{equation}

Light rays travel through the pinhole camera's aperture to the image plane that is $f$ units behind the pinhole.
The result can be derived from similar triangles with a common vertex at the aperture.
Sometimes the sign is inverted, which results in a plane between the pinhole (i.e.~camera origin) and the actual point, where the image is not rotated; this can be more convenient to analyse.
\cite{hartley03multiview}

Setting the camera to origin and using homogeneous coordinates, the mapping is given with a camera matrix as

\begin{equation}
\begin{pmatrix}
u \\ v \\ 1
\end{pmatrix}
=
\begin{pmatrix}
x \\ y \\ z/f
\end{pmatrix}
=
\begin{pmatrix} \label{eq:cmat}
	1 & 0 & 0 & 0 \\
	0 & 1 & 0 & 0 \\
	0 & 0 & 1/f & 0
\end{pmatrix}
\begin{pmatrix}
x \\ y \\ z \\ 1
\end{pmatrix}
\end{equation}

The camera position and rotation in a global coordinate frame can be encoded in a matrix so that the point $(x,y,z)$ in global coordinate frame is first transformed relative to the camera's origin; section \ref{sec:coord} discusses this in more detail.

\subsection{Optics}

In practice, no actual camera works ideally; imperfections in the lenses project points to positions that differ from those predicted by straight lines in this linear case.
Lens distortions deviate the rays, and no system is in perfect focus, so that one light ray spreads out as a circle.
In reconstructing, methods that estimate the points and minimize errors are used, as no model predicts the camera perfectly.

Construction of optical systems is well studied. \cite{kingslake1989history}
Actual camera lenses consist of not only a single glass element but many, especially in the case of zoom lenses. In this work, the inner workings of these systems are ignored and equations assume a simple projective model, which is a safe assumption when the image is in focus.

The following equation applies for a thin lens while capturing sharp images:

\begin{equation}
	\frac{1}{a} + \frac{1}{b} = \frac{1}{f} \label{eq:focal}
\end{equation}

where f is the focal length of the lens, a is the distance between the lens and the film, and b is the distance between the lens and the imaged source.

%The focal length has a direct influence to field of view, as given in figure TODO. Longer focal length (long-focus lens, often referred to as telephoto lens) results to a more zoomed in picture, as opposed to a wide-angle lens.

All practical optical systems (lenses) introduce some non-linear distortion that affects the performance of the ideal pinhole model.
Common distortions are the purely radial so-called barrel and pincushion distortions, where the magnification is a nonlinear function of image ray distance from the center of the lens.
Fisheye lenses are commonly known to have this kind of effect.
Tangential distortion is less common, particularly in great magnitudes, and is often ignored. Its cause is small misalignments in separate elements in a single optical system; lenses being offset from each other and not parallel to the image plane. \cite{kingslake1989history}

Wilson \cite{wilson2004anton} discusses optical systems' relation to depth of field, focus and distortions.

It should be noted that the nonlinear optical distortions are different from the inevitable perspective projection distortion that happens when projecting a 3D scene to a 2D plane, which is taken into account in the reconstruction.

\simplefig{h}{%
\includegraphics[width=0.2\textwidth]{gfx/barrel-distortion}
\includegraphics[width=0.2\textwidth]{gfx/pincushion-distortion}
}{fig:distortions}
{Barrel (left) and pincushion distortions that would show up in an image of a grid of straight lines. For a lens with no distortion, the lines would not be curved.}

Distortion should be corrected in software, as the following stereo algorithms assume that the images are free of nonlinear errors, i.e. straight lines in the world should remain straight in 2D images after the projective transformation.
%In particular, image rectification (discussed later in \ref{sec:rectification} won't work if this straightness does not remain; the assumption that similar features should be found on horizontal lines wouldn't hold on distorted images. \cite{hartley03multiview}

The radial correction used by the OpenCV library to create a new image of the original pixel values at new positions \cite{opencv} is

\begin{align}
	x_{corr} &= x(1 + k_1 r^2 + k_2 r^4 + k_3 r^6)\\
	y_{corr} &= y(1 + k_1 r^2 + k_2 r^4 + k_3 r^6)
\end{align}

Trucco and Verri \cite{trucco1998introductory} use only the two first coefficients. For tangential distortion:

\begin{align}
x_{corr} &= x + (2 p_1 x y + p_2 (r^2 + 2 x^2))\\
y_{corr} &= y + (2 p_2 x y + p_1 (r^2 + 2 y^2))
\end{align}

$x$ and $y$ are the original coordinates in the distorted image, $x_{corr}$ and $y_{corr}$ are the corrected ones, $k_1$, $k_2$, $k_3$, $p_1$ and $p_2$ are coefficients specific to the distortion, and $r$ equals to the distance to image center located at $(x_c,~y_c)$:

\begin{equation}
r = \sqrt{(x - x_c)^2 + (y - y_c)^2}
\end{equation}

\subsection{Shutter}

In dynamic (i.e.~moving) environments, the process of acquiring several images consecutively is an important thing to consider.
When a group of cameras are capturing the same target, they should operate synchronously and grab images at same infinitesimally small points in time.
In reality, there is some error: the cameras do not work in perfect sync, and their sensors take some time to acquire an image.

Moreover, a CCD sensor should be used in place of a chaper CMOS sensor; CCDs incorporate a ``global shutter'', i.e.~the whole sensor images the scene at once.
A phenomenon called ``rolling shutter'' is common in CMOS sensors: the reading happens linearly, and moving objects get distorted when several pixels see the same object occurring at the same time.
This should be avoided, but it can be also taken into account and fixed. \cite{ait2006simultaneous,bradley2009synchronization}
Uniform lightning is also usually assumed: when comparing pixel intensities, some figures might not look the same in different brightnesses, which is one of many reasons to use cameras that do as little automatic improvements as possible.

\subsection{Video}

Humans perceive motion when a previously seen object is seen again in a nearby location or similar position.
Current digital video technology encodes motion in a sequence of still images, usually displayed in constant rate.
Three dimensional motion is usually no different: it is encoded as discrete poses in sequence.
In order to do object capture in stereo, video material from two or more of cameras is used to initially capture a sequence of still photos.

When scanning a scene continuously, a camera grabs frames using the same principles as in photos, but does it in sequence, at a speed that is called frame rate.
Another notable point from the capture viewpoint is the shutter speed; in movies, the shutter is often open deliberately so long that fast motion is blurred, because it is considered aesthetically pleasing to human eye; even though the motion is blurred, more information about the scene movement is encoded per frame than when grabbing infinitesimally short times.
\cite{wilson2004anton}
For sharp images that are preferred in reconstruction, this is to be avoided.

Synchronizing all the cameras that shoot the same scene might not a trivial issue in practice, depending on the gear used.
Professional grade cameras can be synced to a single clock generator, so that they all operate on the same frequency and phase.
The same method is used when shooting with machine vision cameras that have external trigger input.
This still leaves a small phase difference caused by unequal transmission paths from the clock generator.
Synchronizable camcorders are very expensive, though, and consumer-grade hardware usually lacks all possibilities to properly sync frequency or phase, not to mention frequency drift or frame jitter.
Clapperboard is a ubiquitous and simple way to sync video and audio, but it still leaves a maximum of half a frame lag between the camera sequences; this is illustrated in figure \ref{fig:syncproblems}.
When cameras open their shutter in a different time, they effectively shoot a different scene, breaking one of the most fundamental assumptions of stereo vision: that the images encode geometrically same objects.
This can be compensated to some degree with optical flow \cite{bradley2009synchronization}.

\simplefig{h!}{
\begin{tikzpicture}[scale=1.5]
	\draw (0,0) rectangle (6,-1);
	\draw (0,-1) rectangle (6,-2);
	\foreach \x in {0,...,5} {
		\draw (\x*1, 0) -- (\x*1, -2.5);
		\node at (\x*1, -2.6) {{\x}t};

		\draw [fill=red] (\x*1, 0) rectangle (\x*1+0.4, -1);
		\draw [fill=green] (\x*1+0.3, -1) rectangle (\x*1+0.3+0.4, -2);
	}
	\draw (0.3, 0) -- (0.3, -2.5);
	\node at (0.3, -2.6) {e};
	\node at (-0.3, -0.5) {A};
	\node at (-0.3, -1.5) {B};
	% P, Z
\end{tikzpicture}
}{fig:syncproblems}
{Video phase difference.
Red rectangles illustrate exposure times of camera A, green rectangles the same for camera B.
Frame period is t, and the cameras have a constant exposure time offset of an arbitrary e.}

Faster frame rate encodes information more often, which is preferable as longer distances of pixels of same objects are more difficult to match when tracking objects; faster shutter speeds help to reduce motion blur.
Fast shutter (i.e.~short exposure) obviously needs to be compensated by using more sensitive sensors or more light to get equivalently bright images.
Noise vs. motion blur is a common tradeoff that has to be made when building a stereo vision system.

Video recording and motion tracking are best considered orthogonal issues; while a single static case can be scanned in three dimensions, so can be also each frame of a sequence, separately.
While this sounds tempting, it might not be computationally feasible, though, because the reconstruction must be started all over again for each frame and the topology is uncorrelated between the frames.
% Assumptions that the scene is locally almost the same can help and speed up computations. [?]

%Section \ref{sec:tracking} will


%!TEX root = ../TTT4150-Summary.tex
\section{Loxodromes}

A \emph{loxodrome} curve is an Earth course of constant bearing (also called a rhumb). Generally not a great circle, and therefore not the shortest route, but easy to use, as great circles require continuous change of bearing.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{Conformal maps}

A \emph{conformal map} distorts east-west and north-south by the same amount, which means that it preserves angles. Distortion depends only on position (actually only latitude). The \emph{Mercator map} is a special conformal map, on which a rhumb/loxodrome is a straight line.

\begin{figure}[htbp]
	\centering
	\includegraphics[width=\linewidth]{img/esa_mercator_map}
	\caption{A Mercator map}
\end{figure}


\chapter{Introduction}
\label{chpr:intro}
\section{Problem under analysis}

Bitcoin \cite{BTC} is a decentralized network whose aim is to provide a peer-to-peer electronic payment system. In recent years it has astonished people who had the opportunity to study it, with an increasing number of supporters and detractors worldwide: it has been called a bubble, a Ponzi scheme, it has been labelled as sound money and store of value. But labels can be dangerous, and excessive labelling is usually useless: for this reason the present work does not aim at settling the dispute. Bitcoin is hard to understand, being at the crossroad of various disciplines, going from networking theory to cryptography, from economics to game theory. Among this multitude, mathematics and cryptography are perhaps the easiest way to approach Bitcoin, being difficult to misinterpret these two disciplines: of course there are engineering trade-offs and debates around them, but the technical foundations are sound.
\\
For this reason, the present work wants to give a brief but satisfactory introduction to the mathematical structures and the cryptographic primitives behind Bitcoin, focusing in particular on the role played by the digital signature scheme. We will outline the problems presented by ECDSA, the scheme actually implemented, and show how they could be solved by Schnorr, a scheme that might be introduced in the protocol in the coming years. On top of that, we will delve into the technicalities of higher level constructions enabled by Schnorr, that will help in solving some of the key problems of Bitcoin, namely privacy and fungibility\footnote{Fungibility is the property of a good or a commodity whose individual units are interchangeable.}. Bitcoin was intended to be anonymous, but it is not: it is pseudonymous, in the sense that it is possible to link transactions to a unique identity through blockchain analysis. If this digital identity is unveiled, connecting to a real identity, that person could be persecuted for his involvement in Bitcoin (e.g. in authoritarian regimes). The lack of privacy contributes to the lack of fungibility, allowing to distinguish between different bitcoins\footnote{Typically Bitcoin identifies the protocol, while bitcoins are the coins transferred using the protocol.}. These problems affects heavily the monetary use case and in general have to be properly addressed: their improvement will be the \textit{leitmotiv} of this present work.

\bigskip
\noindent
The present thesis has been written during the author's fellowship at the Digital Gold Institute, a research and development center focused on teaching, consulting, and advising about scarcity in digital domain (Bitcoin and crypto-assets) and the underlying blockchain technology. The author has actively contributed to the development of the Python library that can be found at \url{https://github.com/dginst/BitcoinBlockchainTechnology}: for this reason, some optimization procedures are presented throughout the thesis.

\bigskip

\bigskip

\section{Thesis structure}
In Chapter \ref{chpr:math} we will start presenting the mathematical foundations of the cryptography underpinning the Bitcoin protocol: in particular we will recall the concepts of group and field (Section \ref{groupsfields}), we will introduce the general idea of elliptic curve (EC, Section \ref{ec}) and show how to induce a group structure on an EC through a proper definition of the addition operation (Section \ref{grouplaw}).

\bigskip
\noindent
In Chapter \ref{chpr:ecc} we will give an overview of the public key cryptography based on elliptic curves: thanks to the mathematical introduction of Chapter \ref{chpr:math} we will be able to understand what an elliptic curve over a finite field is (Section \ref{ecoverff}); then we will discuss elliptic curves' parameters selection and validation (Section \ref{ecparam}), we will present the basic idea behind asymmetric cryptography based on EC (Section \ref{keypairs}) and we will show how to improve the core operation of asymmetric elliptic curve cryptography (ECC), scalar multiplication, through a proper change of coordinates (Section \ref{jac}). As a practical use case the section will be concluded with the presentation of the Bitcoin curve (secp256k1, Section \ref{btccurve}). The chapter will be concluded by the description of the hard problem at the basis of elliptic curves' widespread adoption in recent years, the so called discrete logarithm problem (DLP in Section \ref{dlp}).

\bigskip
\noindent
Chapter \ref{chpr:dss} will deal with ECDSA (Section \ref{ecdsa}) and Schnorr (Section \ref{schnorr}). Throughout the chapter many topics will be touched, among which the issues of ECDSA, Schnorr's solutions and multi-signature schemes.

\bigskip
\noindent
Finally in Chapter \ref{chpr:application} we will delve in the technicalities of Schnorr's applications: we will study a multi-signature scheme that recovers key aggregation (MuSig, Section \ref{musig}), a threshold signature scheme (Section \ref{threshold}) and the benefits arising from the use of adaptor signatures (Section \ref{adaptor}) for cross-chain atomic swaps (Section \ref{atomic}) and for the Lightning Network (Section \ref{ln}).

\bigskip
\noindent
Chapter \ref{chpr:conclusion} will conclude the thesis with a summary in which we will draw interesting conclusions.
\bigskip

\bigskip

\section{Notation}
\begin{itemize}
\item Prime numbers: the lowercase letter $p$ is used to represent an odd prime number;
\item Fields: in Chapter \ref{chpr:math} for a general field the letter $K$ is used, while the finite fields of order $q = p^k$, where $p$ is an odd prime and $k$ an integer, are represented as $\mathbb{F}_q$;
\item Elliptic curves: in general an elliptic curve over a field $K$ is denoted by $E(K)$, which represents the set of points satisfying the generalized Weierstrass equation with coefficients in $K$ plus the point at infinity. From Chapter \ref{chpr:ecc} onward, we will deal with EC over finite fields: in this case lowercase letters are used to denote scalars, while the uppercase equivalent denotes the linked EC point, e.g. $qG = Q = (x_Q, y_Q)$ ($G$ is reserved to the generator of the group). Whenever a second generator is needed we use the capital letter $H$: this does not constitute a conflict with the cofactor $h$ of the group since typically the two generators are NUMS (\textit{nothing up my sleeves}), meaning that we do not know the discrete logarithm of one with respect to the other and viceversa;
\item Elliptic curve's key pair: the pair of private and public key is denoted as $\{q, Q\}$, where $Q = qG$. Whenever a second point is needed we use the couple $\{r, R\}$; if more key pairs are needed subscripts are used, e.g. $q_1G = Q_1 = (x_1, y_1)$, $q_2G = Q_2 = (x_2, y_2)$ and $q_3G = Q_3 = (x_3, y_3)$. Notice that, for the sake of clarity, also the coordinate representation is adapted.
\item Algorithms:
    \begin{itemize}
		\item $||$ refers to byte array concatenation;
		\item $a \gets b$ refers to the operation of assignment;
		\item $z \xleftarrow{\text{\$}} Z$ denotes uniform sampling from the set $Z$ and assignment to $z$;
		\item The function $\text{bytes}(x)$, where $x$ is an integer, returns the byte encoding of $x$;
		\item The function $\text{bytes}(Q)$, where $Q$ is an EC point, returns $bytes(0\text{x}02 + (y_Q \& 1))$ $ || \ bytes(x_Q)$\footnote{Here \& denotes the bitwise AND operator, thus $y_Q \& 1$ checks whether $y_Q$ is even (prepend 0x02) or odd (prepend 0x03), following the standard proposed in \cite{RefWork:2} about the compressed representation of an EC point. An EC point can be expressed in compressed or uncompressed form: the compressed form requires the $x$ coordinate and one additional byte to make explicit the $y$ coordinate, while the uncompressed form requires both the coordinates.};
		\item The function $\text{int}(x)$, where $x$ is a byte array, returns the unsigned integer whose byte encoding is $x$;
		\item The function $\text{hash}(x)$, where $x$ is a byte array, returns the hash of $x$. In particular, when dealing with the Schnorr signature, it returns the 32 bytes SHA-256 of $x$;
		\item The function $\text{jacobi}(x)$, where $x$ is an integer, returns the Jacobi symbol $\left(\frac{x}{p}\right)$. In general we have (gcd here stands for greatest common divisor): $$\left(\frac{x}{p}\right)= \begin{cases} 0, & \text{if gcd}(x, p) \neq 1 \\ \pm 1, & \mbox{if gcd}(x, p) = 1 \end{cases}$$
		Moreover we have that if $\left(\frac{x}{p}\right) = - 1$ then $x$ is not a quadratic residue modulo $p$ (i.e. it has not a square root modulo $p$) and that if $x$ is a quadratic residue modulo $p$ and $\text{gcd}(x, p) = 1$, then $\left(\frac{x}{p}\right) = 1$. However, unlike the Legendre symbol, if $\left(\frac{x}{p}\right) = 1$ then $x$ may or may not be a quadratic residue modulo $p$. Fortunately enough, since $p$ is an odd prime we have that the Jacobi symbol is equal to the Legendre symbol. Thus we can check only whether $\left(\frac{x}{p}\right) = 1$ to assess if $x$ is or is not a quadratic residue modulo $p$.
		\\
		Moreover, by Euler's criterion we have that $\left(\frac{x}{p}\right) = x^{\frac{p - 1}{2}} \ (\text{mod} \ p)$, so that we have an efficient way to compute the Jacobi symbol.
	\end{itemize}
\end{itemize}


This chapter studies an embedded Domain Specific Language for logic
programming.  First, we give a quick introduction of \textit{$\mu$Kanren}, a
purely functional implementation of this language and, second, we extend the
HOL Light theorem prover in order to introduce the relational paradigm in its
tactics mechanism.

\section{$\mu$Kanren and relational programming}

The central tenet of relational programming is that \textit{programs
corresponds to relations that generalize mathematical functions}; our interest
here is to deepen our understanding of the underlying concepts and data
structures of languages in the \textit{miniKanren} family. The main reference
that drives our work is \citep{Friedman:Reasoned:Schemer} and advanced topics
are discussed in Byrd's dissertation \citep{Byrd:PhD}.

The heavy use of higher order functions, infinite streams of objects and
unification \`a-la Robinson makes possible to implement $\mu$Kanren
\citep{Hemann:muKanren}, a purely functional core of miniKanren; we repeat the
exercise of coding it using different programming languages, in particular
\begin{description}
\item[Python]
    we provide both a complete implementation of the abstract definition and a
    test suite that stresses our functions against \textit{all} questions in the
    reference book. Moreover, we characterize our code with a \textit{fair}
    enumeration strategy based on the \textit{dovetail} techniques used in the
    enumeration of the Rationals numbers; precisely, the monadic function
    \verb|mplus(streams, interleaving)| enumerates the states space
    \verb|streams|, using different strategies according to the argument
    \verb|interleaving|.

    In order to understand states enumeration can be helpful to use a "matrix
    notation", that associates a row to each stream α of states in
    \verb|streams|, which is an \textit{iterable} object over a \textit{countably},
    possibly infinite, set of \textit{states streams}, so the matrix could have
    infinite rows.  In parallel, since each states stream α lying on a row is an
    \textit{iterable} object over a \textit{countably}, possibly infinite, set of
    \textit{satisfying states}, the matrix could have infinite columns too;
    therefore, the matrix we are building could be infinite in both dimensions.
    So, let \verb|streams| be represented as
    \begin{displaymath}
        \left(\begin{array}{ccccc}
        s_{00} & s_{01} & s_{02} & s_{03} & \ldots \\
        s_{10} & s_{11} & s_{12} & \ldots &        \\
        s_{20} & s_{21} & \ldots &        &        \\
        s_{30} & \ldots &        &        &        \\
        \ldots &        &        &        &        \\
        \end{array}\right)
    \end{displaymath}
    where each $s_{i,j}$ is a state that carries a substitution which satisfies
    the relation under study.  Such states are visited according to the
    \textit{dovetail} techniques which enumerates by interleaving \verb|state|
    objects lying on the same \textit{rising diagonal}, resulting in a
    \textit{fair, complete scheduler} in the sense that \textit{every} satisfying
    \verb|state| object will be reached, eventually. For the sake of clarity,
    enumeration proceeds as follows
    \begin{displaymath}
    s_{00}, s_{10}, s_{01}, s_{20}, s_{11}, s_{02}, s_{30}, s_{21},
    s_{12}, s_{03}, \ldots
    \end{displaymath}
    with respect to its implementation
    \begin{minted}[baselinestretch=0.8]{python}
    def mplus(streams, interleaving):

        if interleaving:

            try: α = next(streams)
            except StopIteration: return
            else: S = [α]

            while S:

                for j in reversed(range(len(S))):
                    β = S[j]
                    try: s = next(β)
                    except StopIteration: del S[j]
                    else: yield s

                try: α = next(streams)
                except StopIteration: pass
                else: S.append(α)

        else:

            for α in streams: yield from α
    \end{minted}

\item[Scheme] we provide our implementation using the same language that
original authors use for their canonical version. We diverge from them in the
way we represent substitutions, choosing an \textit{union-find}  data structure
that allows us to maintain a balanced tree to track associations.
The overhead work that was necessary to implement a fully-flagged
$\mu$Kanren yield a Scheme library to define and manipulate infinite streams of
objects, and this allows us to have another way to define Riordan arrays for free, such as
\begin{minted}[baselinestretch=0.8]{scheme}
(test '((1)
        (1 1)
        (1 2 1)
        (1 3 3 1)
        (1 4 6 4 1)
        (1 5 10 10 5 1)
        (1 6 15 20 15 6 1)
        (1 7 21 35 35 21 7 1)
        (1 8 28 56 70 56 28 8 1)
        (1 9 36 84 126 126 84 36 9 1))
 ((list○take 10) (riordan-array stream:1s stream:1s)))
\end{minted}
lying on the procedural abstraction \verb|riordan-array| that consumes two
formal power series and produces a stream of lists, each one denoting a
triangle's row; its definition is clear and elegant in our opinion,
\begin{minted}[baselinestretch=0.8]{scheme}
(define riordan-array
 (Λ (d h)
  (stream:dest/car+cdr (d ∅)
   ((dcar dcdr) (stream:cons
                 (list dcar)
                 ((stream:zip-with cons)
                  dcdr (riordan-array (series:× d h) h)))))))
\end{minted}
where \verb|stream:×| denotes the \textit{series convolution operator} and
the syntactic abstraction \verb|Λ| is defined as an "augmented lambda" form
that allows us to define delayed by means of \verb|delay-force|,
\begin{minted}[baselinestretch=0.8]{scheme}
(define-syntax Λ
 (syntax-rules ()
  ((Λ args body ...)
   (lambda args (delay-force (begin body ...))))))
\end{minted}

\item[Smalltalk] this implementation is an exercise in object-oriented
programming and its coding has been driven by a test-first approach
\citep{beck:TDD} and it is a literal port of the canonical one.

\item[OCaml] finally, this version is preparatory for the extension of the HOL
Light theorem prover which we are going to describe in the rest of this
chapter.

\end{description}

All these prototypes can be found in \citep{Nocentini:kanrens} and some
examples follows using the Scheme implementation to show the power of the
present paradigm.

\begin{example} The \textit{context free grammar} $\mathcal{D}$
that defines the set of \textit{Dyck paths}
\begin{displaymath}
\mathcal{D} = \varepsilon\,|\,\circ\,\mathcal{D}\,\bullet\,\mathcal{D}
\end{displaymath}
is encoded in the relation \verb|dyckº| defined by the $\mu$Kanren goal
\begin{minted}[baselinestretch=0.8]{scheme}
(define dyckº
 (lambda (α)
  (condº/§
   ((nullº α))
   ((fresh (β γ) (∧
                  (dyckº β)
                  (dyckº γ)
                  (appendº `(○ . ,β) `(● . ,γ) α)))))))
\end{minted}
and an enumeration is reported in Table \ref{tbl:kanren:dyck:path}.
\begin{margintable}
\begin{minted}[baselinestretch=0.8]{scheme}
        (()
         (○ ●)
         (○ ○ ● ●)
         (○ ● ○ ●)
         (○ ○ ○ ● ● ●)
         (○ ● ○ ○ ● ●)
         (○ ○ ● ● ○ ●)
         (○ ● ○ ● ○ ●)
         (○ ○ ● ○ ● ●)
         (○ ● ○ ○ ○ ● ● ●)
         (○ ○ ● ● ○ ○ ● ●)
         (○ ● ○ ● ○ ○ ● ●)
         (○ ○ ○ ● ● ● ○ ●)
         (○ ● ○ ○ ● ● ○ ●)
         (○ ○ ● ● ○ ● ○ ●)
         (○ ● ○ ● ○ ● ○ ●)
         (○ ○ ○ ○ ● ● ● ●)
         (○ ● ○ ○ ● ○ ● ●)
         (○ ○ ● ● ○ ○ ○ ● ● ●)
         (○ ● ○ ● ○ ○ ○ ● ● ●)
         (○ ○ ○ ● ● ● ○ ○ ● ●)
         (○ ● ○ ○ ● ● ○ ○ ● ●)
         (○ ○ ● ● ○ ● ○ ○ ● ●)
         (○ ● ○ ● ○ ● ○ ○ ● ●)
         (○ ○ ● ○ ● ● ○ ●)
         (○ ● ○ ○ ○ ● ● ● ○ ●)
         (○ ○ ● ● ○ ○ ● ● ○ ●)
         (○ ● ○ ● ○ ○ ● ● ○ ●)
         (○ ○ ○ ● ● ● ○ ● ○ ●)
         (○ ● ○ ○ ● ● ○ ● ○ ●)
         (○ ○ ● ● ○ ● ○ ● ○ ●)
         (○ ● ○ ● ○ ● ○ ● ○ ●)
         (○ ○ ● ○ ○ ● ● ●)
         (○ ● ○ ○ ○ ○ ● ● ● ●)
         (○ ○ ● ● ○ ○ ● ○ ● ●)
         (○ ● ○ ● ○ ○ ● ○ ● ●)
         (○ ○ ○ ● ● ● ○ ○ ○ ● ● ●)
         (○ ● ○ ○ ● ● ○ ○ ○ ● ● ●)
         (○ ○ ● ● ○ ● ○ ○ ○ ● ● ●)
         (○ ● ○ ● ○ ● ○ ○ ○ ● ● ●)
         (○ ○ ● ○ ● ● ○ ○ ● ●)
         (○ ● ○ ○ ○ ● ● ● ○ ○ ● ●))
\end{minted}
\caption{First $42$ Dyck paths enumerated by relation \texttt{dyckº}.}
\label{tbl:kanren:dyck:path}
\end{margintable}
\end{example}

\begin{example}
The recurrence relation for the Fibonacci numbers
\begin{displaymath}
f_{n+2} = f_{n+1} + f_{n}, \quad n \geq 0
\end{displaymath}
is encoded in the relation \verb|fibonacciº| defined by the goal
\begin{minted}[baselinestretch=0.8]{scheme}
(define fibonacciº
 (lambda (depth n α)
  (cond
   ((zero? depth) (≡ α (list n)))
   (else (fresh (β γ)
          (∧
           (fibonacciº (sub1 depth) (sub1 n) β)
           (fibonacciº (sub1 depth) (sub2 n) γ)
           (appendº β γ α)))))))
\end{minted}
which enumerates the following identities
\begin{displaymath}
    \begin{array}{c}
      f_{n+2} = f_{n} + f_{n+1} \\
      f_{n+2} = f_{n-2} + 2\,f_{n-1} + f_{n}  \\
      f_{n+2} = f_{n-4} + 3\,f_{n-3} + 3\,f_{n-2} + f_{n-1} \\
      f_{n+2} = f_{n-6} + 4\,f_{n-5} + 6\,f_{n-4} + 4\,f_{n-3} + f_{n-2} \\
      f_{n+2} = f_{n-8} + 5\,f_{n-7} + 10\,f_{n-6} + 10\,f_{n-5} + 5\,f_{n-4} + f_{n-3} \\
      f_{n+2} = f_{n-10} + 6\,f_{n-9} +15\,f_{n-8} + 20\,f_{n-7} +15\,f_{n-6} + 6\,f_{n-5} + f_{n-4} \\
      %((-12 1) (-11 7) (-10 21) (-9 35) (-8 35) (-7 21) (-6 7) (-5 1))
      %((-14 1) (-13 8) (-12 28) (-11 56) (-10 70) (-9 56) (-8 28) (-7 8) (-6 1))
    \end{array}
\end{displaymath}
compacted in $\displaystyle f_{n} = \sum_{i=0}^{j}{{
{j}\choose{i} }\,f_{n-2\,j+i}}$ where
$\displaystyle j\leq \frac{n}{2}$.
\end{example}

\begin{example}
The recurrence relation for the Pascal triangle
\begin{displaymath}
\begin{split}
d_{0,0} &= 1, \\
d_{n+1, 0} &= d_{n,0}, \quad n \geq 0 \\
d_{n+1, k+1} &= d_{n,k} + d_{n,k+1}, \quad n,k \geq 0 \\
\end{split}
\end{displaymath}
is encoded in the relation \verb|tartagliaº| defined by the goal
\begin{minted}[baselinestretch=0.8]{scheme}
(define tartagliaº
 (lambda (depth n k α)
  (cond
   ((zero? depth) (≡ α (list (list n k))))
   (else (fresh (β γ)
          (∧
           (tartagliaº (sub1 depth) (sub1 n) (sub1 k) β)
           (tartagliaº (sub1 depth) (sub1 n) k γ)
           (appendº β γ α)))))))
\end{minted}
which enumerates the following identities
\begin{displaymath}
    \begin{array}{c}
      d_{n+1,k+1} = d_{n,k+1} + d_{n,k} \\
      d_{n+1,k+1} = d_{n-1, k+1} + 2\,d_{n-1,k} + d_{n-1,k-1}  \\
      d_{n+1,k+1} = d_{n-2, k+1} + 3\,d_{n-2,k} + 3\,d_{n-2,k-1} + d_{n-2,k-2} \\
      d_{n+1,k+1} = d_{n-3, k+1} + 4\,d_{n-3,k} + 6\,d_{n-3,k-1} + 4\,d_{n-3,k-2} + d_{n-2,k-3} \\
      d_{n+1,k+1} = d_{n-4, k+1} + 5\,d_{n-4,k} + 10\,d_{n-4,k-1} + 10\,d_{n-4,k-2} + 5\,d_{n-4,k-3} + d_{n-4,k-4} \\
      d_{n+1,k+1} = d_{n-5, k+1} + 6\,d_{n-5,k} +15\,d_{n-5,k-1} + 20\,d_{n-5,k-2} +15\,d_{n-5,k-3} + 6\,d_{n-5,k-4} + d_{n-5,k-5} \\
    \end{array}
\end{displaymath}
compacted in $\displaystyle { {p+m}\choose{r+m} } = \sum_{j=0}^{m-1}{{
{m-1}\choose{j} }{ {p-1+m}\choose{r-j+m} }}$ for $p,r,m\in\mathbb{N}$
-- recall that $\displaystyle d_{n,k}={ {n}\choose{k} }$.
\end{example}

\section{Toward certified computation}
\label{sec:introduction}

Theorem provers are employed to construct logically verified truths.
In this work, we propose an extended language of tactics which support
the derivation of formally verified theorems in the spirit of the
logic programming paradigm.

Our setup, is based on the HOL Light theorem prover, in which we
extend the currently available tactics mechanism with three basic
features: (i)~the explicit use of meta-variables, (ii)~the ability to
backtrack during the proof search, (iii)~a layer of tools and
facilities to interface with the underlying proof mechanism.

The basic building block of our framework are ML procedures that we
call \emph{solvers}, which are a generalization of HOL tactics and
are~--as well as tactics-- meant to be used compositionally to define
arbitrarily complex proof search strategies.

We say that our approach is \emph{semi-certified} because
\begin{itemize}
\item on one hand, the produced solutions are formally proved
  theorems, hence their validity is guaranteed by construction;
\item on the other hand, the completeness of the search procedure
  cannot be enforced in our framework and consequently has to be
  ensured by a meta-reasoning.
\end{itemize}

At the present stage, our implementation \citep{Maggesi:Nocentini:kanrenlight}
is intended to be a test bed for experiments and further investigation on this
reasoning paradigm.

\section{A simple example}
\label{sec:an-simple-example}

To give the flavor of our framework, we show how to perform simple
computations on lists.

Consider first the problem of computing the concatenation of two lists
\verb|[1; 2]| and \verb|[3]|.  One natural way to approach this
problem is by using rewriting.  In HOL Light, this can be done by using
\emph{conversions} with the command
\begin{minted}[baselinestretch=0.8]{ocaml}
# REWRITE_CONV [APPEND] `APPEND [1;2] [3]`;;
\end{minted}
where the theorem
\begin{minted}[baselinestretch=0.8]{ocaml}
# APPEND;;
val it : thm =
  |- (!l. APPEND [] l = l) /\
     (!h t l. APPEND (h :: t) l = h :: APPEND t l)
\end{minted}
gives the recursive equations for the operator \verb|APPEND|.

Our implementation allows us to address the same problem from a
logical point of view.  We start by proving two theorems
\begin{minted}[baselinestretch=0.8]{ocaml}
# APPEND_NIL;;
val it : thm = |- !l. APPEND [] l = l

# APPEND_CONS;;
val it : thm =
  |- !x xs ys zs. APPEND xs ys = zs
                  ==> APPEND (x :: xs) ys = x :: zs
\end{minted}
that gives the logical rules that characterize the \verb|APPEND|
operator.  Then we define a \emph{solver}
\begin{minted}[baselinestretch=0.8]{ocaml}
let APPEND_SLV : solver =
  REPEAT_SLV (CONCAT_SLV (ACCEPT_SLV APPEND_NIL)
                         (RULE_SLV APPEND_CONS));;
\end{minted}
which implements the most obvious strategy for proving a relation of
the form \verb|`APPEND x y = z`| by structural analysis on the list
\verb|`x`|.  The precise meaning of the above code will be clear later
in this note; however, this can be seen as the direct translation of
the Prolog program
\begin{minted}[baselinestretch=0.8]{ocaml}
append([],X,X).
append([X|Xs],Ys,[X|Zs]) :- append(Xs,Ys,Zs).
\end{minted}

Then, the problem of concatenating the two lists is described by the
term
\begin{minted}[baselinestretch=0.8]{ocaml}
`??x. APPEND [1;2] [3] = x`
\end{minted}
where the binder \verb|`(??)`| is a syntactic variant of the usual
existential quantifier \verb|`(?)`|, which introduces the
\emph{meta-variables} of the \emph{query}.

The following command
\begin{minted}[baselinestretch=0.8]{ocaml}
list_of_stream
  (solve APPEND_SLV
         `??x. APPEND [1; 2] [3] = x`);;
\end{minted}
runs the search process where the \verb|solve| function starts the
proof search and produces a stream (i.e., a lazy list) of
\emph{solutions} and the outermost \verb|list_of_stream| transform the
stream into a list.

The output of the previous command is a single solution which is
represented by a pair where the first element is the instantiation for
the meta-variable \verb|`x`|and the second element is a HOL theorem
\begin{minted}[baselinestretch=0.8]{ocaml}
val it : (term list * thm) list =
  [([`x = [1; 2; 3]`], |- APPEND [1; 2] [3] = [1; 2; 3])]
\end{minted}

Now comes the interesting part: as in logic programs, our search
strategy (i.e., the \verb|APPEND_SLV| solver) can be used for backward
reasoning.

Consider the variation of the above problem where we want to enumerate
all possible splits of the list \verb|[1; 2; 3]|.  This can be done by
simply changing the goal term in the previous query:
\begin{minted}[baselinestretch=0.8]{ocaml}
# list_of_stream
    (solve APPEND_SLV
           `??x y. APPEND x y = [1;2;3]`);;

val it : (term list * thm) list =
  [([`x = []`; `y = [1; 2; 3]`],
    |- APPEND [] [1; 2; 3] = [1; 2; 3]);
   ([`x = [1]`; `y = [2; 3]`],
    |- APPEND [1] [2; 3] = [1; 2; 3]);
   ([`x = [1; 2]`; `y = [3]`],
    |- APPEND [1; 2] [3] = [1; 2; 3]);
   ([`x = [1; 2; 3]`; `y = []`],
    |- APPEND [1; 2; 3] [] = [1; 2; 3])]
\end{minted}

\section{A library of solvers}
\label{sec:library-solvers}

Our framework is based on ML procedures called \emph{solvers}.  Solvers
generalizes classical HOL tactics in two ways, (i)~they facilitate the
manipulation of meta-variables in the goal and (ii)~they allows us to backtrack
during the proof search. We observe that the tactics mechanism currently
implemented in HOL Light already provides basic support for meta-variables in
goals; however, it seems to be used only internally in the implementation of
the intuitionistic tautology prover \texttt{ITAUT\_TAC}.

We provide a library of basic solvers with the convention that their names end
in \verb|_SLV| as in \verb|REFL_SLV|, for instance.

Every HOL tactic can be `promoted' into a solver using the ML function
\begin{minted}[baselinestretch=0.8]{ocaml}
TACTIC_SLV : tactic -> solver
\end{minted}
A partial list of solvers approximately corresponding to classical HOL
tactics are \verb|ACCEPT_SLV|, \verb|NO_SLV|, \verb|REFL_SLV|,
\verb|RULE_SLV| (corresponding to \verb|MATCH_MP_TAC|).

Notice that these solvers are different from their corresponding
tactics because either
\begin{enumerate}
\item use the stream mechanism instead of OCaml exceptions to
  handle the control flow; or
\item perform some kind of unification.
\end{enumerate}

For (1), a very basic example is the solver \verb|NO_SLV| which,
instead of raising an exception, it returns the empty stream of
solutions.

One example of (2) is the \verb|REFL_SLV| solver: when it is applied
to the goal
\begin{minted}[baselinestretch=0.8]{ocaml}
?- x + 1 = 1 + x
\end{minted}
where \verb|x| is a meta-variable, closes the goal by augmenting the
instantiation with the substitution \verb|1/x| and
producing the theorem \verb!|- 1 + 1 = 1 + 1!.  Observe that the
corresponding \verb|REFL_TAC| fails in this case.

As for tactics, we have a collection of higher-order solvers.  Some of
them, are the analogous of the corresponding tacticals:
\verb|ASSUM_LIST_SLV|,
\verb|CHANGED_SLV|,
\verb|EVERY_SLV|,
\verb|MAP_EVERY_SLV|,
\verb|POP_ASSUM_LIST_SLV|,
\verb|POP_ASSUM_SLV|,
\verb|REPEAT_SLV|,
\verb|THENL_SLV|,
\verb|THEN_SLV|,
\verb|TRY_SLV|,
\verb|UNDISCH_THEN_SLV|.

Given two solvers $s_1$ and $s_2$ the solver combinator
\verb|CONCAT_SLV| make a new solver that collect sequentially all
solutions of $s_1$ followed by all solutions of $s_2$.  This is the
most basic construction for introducing backtracking into the proof
strategy.

From \verb|CONCAT_SLV|, a number of derived combinators are defined to
capture the most common enumeration patterns, here
we give a brief list of those combinators without an explicit
description. However, we hope that the reader can guess the actual
behaviour from both their name and their ML type:
\begin{minted}[baselinestretch=0.8]{ocaml}
COLLECT_SLV : solver list -> solver
MAP_COLLECT_SLV : ('a->solver) -> 'a list -> solver
COLLECT_ASSUM_SLV : thm_solver -> solver
COLLECT_X_ASSUM_SLV : thm_solver -> solver
\end{minted}

%% Solver 'bilanciati'?
%% % let MPLUS_SLV (slv1:solver) (slv2:solver) : solver =
%% %   fun g -> mplusf (slv1 g) (fun _ -> slv2 g);;
%%
%% % let INTERLEAVE_SLV (slvl:solver list) : solver =
%% %   if slvl = [] then NO_SLV else end_itlist MPLUS_SLV slvl;;
%%
%% % let MAP_INTERLEAVE_SLV (slvf:'a->solver) (lst:'a list) : solver =
%% %   INTERLEAVE_SLV (map slvf lst);;
%%
%% % let INTERLEAVE_ASSUM_SLV (tslv:thm_solver) : solver =
%% %   fun (mvs,(asl,w) as g) -> MAP_INTERLEAVE_SLV (tslv o snd) asl g;;
%%
%% % let INTERLEAVE_X_ASSUM_SLV (tslv:thm_solver) : solver =
%% %   INTERLEAVE_ASSUM_SLV (fun th -> UNDISCH_THEN_SLV (concl th) tslv);;

Solvers can be used interactively.  Typically, we can start a new goal
with the command \verb|gg| and execute solvers with \verb|ee|.  The
command \verb|bb| restore the previous proof state and \verb|pp|
prints the current goal state.  The stream of results is produced by
a call to \verb|top_thms()|.

Here is an example of interaction.  We first introduce the goal,
notice the use of the binder \verb|(??)| for the meta-variable \verb|x|:
\begin{minted}[baselinestretch=0.8]{ocaml}
# gg `??x. 2 + 2 = x`;;
val it : mgoalstack =
`2 + 2 = x`
\end{minted}
one possible solution is by using reflexivity, closing the proof
\begin{minted}[baselinestretch=0.8]{ocaml}
# ee REFL_SLV;;
val it : mgoalstack =
\end{minted}
we can now form the resulting theorem
\begin{minted}[baselinestretch=0.8]{ocaml}
# list_of_stream(top_thms());;
val it : thm list = [|- 2 + 2 = 2 + 2]
\end{minted}

Now, if one want to find a different solution, we can restore the
initial state
\begin{minted}[baselinestretch=0.8]{ocaml}
# bb();;
val it : mgoalstack =
`2 + 2 = x`
\end{minted}
then we use a different solver that allows us to unify with the
equation \verb?|- 2 + 2 = 4?
\begin{minted}[baselinestretch=0.8]{ocaml}
# ee (ACCEPT_SLV(ARITH_RULE `2 + 2 = 4`));;
val it : mgoalstack =
\end{minted}
and again, we take the resulting theorem
\begin{minted}[baselinestretch=0.8]{ocaml}
# list_of_stream(top_thms());;
val it : thm list = [|- 2 + 2 = 4]
\end{minted}

Finally, we can change the proof strategy to find both solutions by
using backtracking
\begin{minted}[baselinestretch=0.8]{ocaml}
# bb();;
val it : mgoalstack =
`2 + 2 = x`

# ee (CONCAT_SLV REFL_SLV (ACCEPT_SLV(ARITH_RULE `2 + 2 = 4`)));;
val it : mgoalstack =
# list_of_stream(top_thms());;
val it : thm list = [|- 2 + 2 = 2 + 2; |- 2 + 2 = 4]
\end{minted}

The function
\begin{minted}[baselinestretch=0.8]{ocaml}
solve : solver -> term -> (term list * thm) stream
\end{minted}
runs the proof search non interactively and produces a list of
solutions as already shown in Section~\ref{sec:an-simple-example}.  In
this last case it would be
\begin{minted}[baselinestretch=0.8]{ocaml}
# list_of_stream
    (solve (CONCAT_SLV REFL_SLV (ACCEPT_SLV(ARITH_RULE `2 + 2 = 4`)))
           `??x. 2 + 2 = x`);;
val it : (term list * thm) list =
  [([`x = 2 + 2`], |- 2 + 2 = 2 + 2);
   ([`x = 4`], |- 2 + 2 = 4)]
\end{minted}

%\section{Advanced solvers}
%\label{sec:advanced-solvers}

% - PROLOG_SLV (come chiamarla pero'?)
% - ITAUT_SLV (bug di ITAUT_TAC)

\section{Case study: Evaluation for a lisp-like language}
\label{sec:lisp-eval}

The material in this section is strongly inspired from the ingenious
work of Byrd, Holk and Friedman about the miniKanren system
\citep{Byrd:2012:MLU:2661103.2661105}, where the authors work with the
semantics of the Scheme programming language. Here, we target a lisp-like
language, implemented as an object language inside the HOL prover.
Our language is substantially simpler than Scheme; in
particular, it uses dynamic (instead of lexical) scope for variables.
Nonetheless, we believe that this example can suffice to illustrate
the general methodology.

First, we need to extend our HOL Light environment with an object
datatype \verb|sexp| for encoding S-expressions.
\begin{minted}[baselinestretch=0.8]{ocaml}
let sexp_INDUCT,sexp_RECUR = define_type
  "sexp = Symbol string
        | List (sexp list)";;
\end{minted}
For instance the sexp \verb|(list a (quote b))| is represented as HOL
term with
\begin{minted}[baselinestretch=0.8]{ocaml}
`List [Symbol "list";
       Symbol "a";
       List [Symbol "quote";
             Symbol "b"]]`
\end{minted}
This syntactic representation can be hard to read and gets quickly
cumbersome as the size of the terms grows.  Hence, we also introduce a
notation for concrete sexp terms, which is activated by the syntactic
pattern \verb|'(|\ldots\verb|)|.  For instance, the above example
is written in the HOL concrete syntax for terms as
\begin{minted}[baselinestretch=0.8]{ocaml}
`'(list a (quote b))`
\end{minted}

With this setup, we can easily specify the evaluation rules for our
minimal lisp-like language.  This is an inductive predicate with rules
for: (i) quoted expressions; (ii) variables; (iii) lambda
abstractions; (iv) lists; (v) unary applications.  We define a ternary
predicate \verb|`|$EVAL\ e\ x\ y\mathtt{}$\verb|`|, where $e$
is a variable environment expressed as associative list, $x$ is the
input program and $y$ is the result of the evaluation.
\begin{minted}[baselinestretch=0.8]{ocaml}
let EVAL_RULES,EVAL_INDUCT,EVAL_CASES = new_inductive_definition
  `(!e q. EVAL e (List [Symbol "quote"; q]) q) /\
   (!e a x. RELASSOC a e x ==> EVAL e (Symbol a) x) /\
   (!e l. EVAL e (List (CONS (Symbol "lambda") l))
                 (List (CONS (Symbol "lambda") l))) /\
   (!e l l'. ALL2 (EVAL e) l l'
             ==> EVAL e (List (CONS (Symbol "list") l)) (List l')) /\
   (!e f x x' v b y.
      EVAL e f (List [Symbol "lambda"; List[Symbol v]; b]) /\
      EVAL e x x' /\ EVAL (CONS (x',v) e) b y
      ==> EVAL e (List [f; x]) y)`;;
\end{minted}

We now use our framework for running a certified evaluation process
for this language.  First, we define a solver for a single step of
computation.
\begin{minted}[baselinestretch=0.8]{ocaml}
let STEP_SLV : solver =
  COLLECT_SLV
    [CONJ_SLV;
     ACCEPT_SLV EVAL_QUOTED;
     THEN_SLV (RULE_SLV EVAL_SYMB) RELASSOC_SLV;
     ACCEPT_SLV EVAL_LAMBDA;
     RULE_SLV EVAL_LIST;
     RULE_SLV EVAL_APP;
     ACCEPT_SLV ALL2_NIL;
     RULE_SLV ALL2_CONS];;
\end{minted}
In the above code, we collect the solutions of several different
solvers.  Other than the five rules of the \verb|EVAL| predicate, we
include specific solvers for conjunctions and for the two predicates
\verb|REL_ASSOC| and \verb|ALL2|.

The top-level recursive solver for the whole evaluation predicate is now easy to define:
\begin{minted}[baselinestretch=0.8]{ocaml}
let rec EVAL_SLV : solver =
   fun g -> CONCAT_SLV ALL_SLV (THEN_SLV STEP_SLV EVAL_SLV) g;;
\end{minted}

Let us make a simple test.  The evaluation of the expression
\begin{minted}[baselinestretch=0.8]{ocaml}
((lambda (x) (list x x x)) (list))
\end{minted}
can be obtained as follows:
\begin{minted}[baselinestretch=0.8]{ocaml}
# get (solve EVAL_SLV
             `??ret. EVAL []
                          '((lambda (x) (list x x x)) (list))
                          ret`);;

val it : term list * thm =
  ([`ret = '(() () ())`],
   |- EVAL [] '((lambda (x) (list x x x)) (list)) '(() () ()))
\end{minted}

Again, we can use the declarative nature of logic programs to run the
computation backwards.  For instance, one intriguing exercise is the
generation of \textit{quine} programs, that is, programs that evaluates to
themselves.  In our formalization, they are those terms $q$ satisfying
the relation \verb|`EVAL|~\verb|[]|~$q$~$q$\verb|`|.  The following command
computes the first two quines found by our solver.
\begin{minted}[baselinestretch=0.8]{ocaml}
# let sols = solve EVAL_SLV `??q. EVAL [] q q`);;
# take 2 sols;;

val it : (term list * thm) list =
  [([`q = List (Symbol "lambda" :: _3149670)`],
    |- EVAL [] (List (Symbol "lambda" :: _3149670))
       (List (Symbol "lambda" :: _3149670)));
   ([`q =
      List
      [List
       [Symbol "lambda"; List [Symbol _3220800];
        List [Symbol "list"; Symbol _3220800; Symbol _3220800]];
       List
       [Symbol "lambda"; List [Symbol _3220800];
        List [Symbol "list"; Symbol _3220800; Symbol _3220800]]]`],
    |- EVAL []
       (List
       [List
        [Symbol "lambda"; List [Symbol _3220800];
         List [Symbol "list"; Symbol _3220800; Symbol _3220800]];
        List
        [Symbol "lambda"; List [Symbol _3220800];
         List [Symbol "list"; Symbol _3220800; Symbol _3220800]]])
       (List
       [List
        [Symbol "lambda"; List [Symbol _3220800];
         List [Symbol "list"; Symbol _3220800; Symbol _3220800]];
        List
        [Symbol "lambda"; List [Symbol _3220800];
         List [Symbol "list"; Symbol _3220800; Symbol _3220800]]]))]
\end{minted}

One can easily observe that any lambda expression is trivially a quine
for our language.  This is indeed the first solution found by our
search:
\begin{minted}[baselinestretch=0.8]{ocaml}
([`q = List (Symbol "lambda" :: _3149670)`],
 |- EVAL []
         (List (Symbol "lambda" :: _3149670))
         (List (Symbol "lambda" :: _3149670)))
\end{minted}

The second solution is more interesting.  Unfortunately it is
presented in a form that is hard to decipher.  A simple trick can help
us to present this term as a concrete sexp term: it is enough to
replace the HOL generated variable (\verb|`_3149670`|) with a concrete
string.  This can be done by an ad hoc substitution.
\begin{minted}[baselinestretch=0.8]{ocaml}
# let [_; i2,s2] = take 2 sols;;
# vsubst [`"x"`,hd (frees (rand (hd i2)))] (hd i2);;

val it : term =
  `q = '((lambda (x) (list x x)) (lambda (x) (list x x)))`
\end{minted}

If we take one more solution from \verb|sols| stream, we get a new
quine, which, interestingly enough, is precisely the one obtained in
\citep{Byrd:2012:MLU:2661103.2661105}.
\begin{minted}[baselinestretch=0.8]{ocaml}
val it : term =
  `q =
   '((quote (lambda (x) (list x (list (quote quote) x))))
     (quote (quote (lambda (x) (list x (list (quote quote) x))))))`
\end{minted}

\section*{Conclusions}
\label{sec:conclusions}

We presented a rudimentary framework implemented on top of the HOL
Light theorem prover that enables a logic programming paradigm for
proof searching.  More specifically, it facilitates the use of
meta-variables in HOL goals and permits backtracking during the proof
construction.

It would be interesting to enhance our framework with more features:
\begin{itemize}
\item Implement higher-order unification such as Miller's higher-order
  patterns, so that our system can enable higher-order logic
  programming in the style of $\lambda$Prolog.
\item Support constraint logic programming, e.g., by adapting the data
  structure that represent goals.
\end{itemize}

Despite the simplicity of the present implementation, we have already
shown the implementation of some paradigmatic examples of
logic-oriented proof strategies.  In the code base, some further
examples are included concerning a quicksort implementation and a
simple example of a logical puzzle.


\section{Another Application and Outlook}
How can one obtain information about a Markov chain from the observations of it?
Suppose $(X_i)_{i=0,\ldots,n}$ is given as observations.
For any candidate $\tilde{P}=(\tilde{p}_{ij})$, we define
$$l(\tilde{P})=\log(\tilde{p}_{X_0X_1}\tilde{p}_{X_1X_2}\cdots\tilde{p}_{X_{n-1}X_n})=\sum_{i,j\in I}N_{ij}(n)\tilde{p}_{ij}$$
where $N_{ij}(n)=\sum_{m=0}^{n-1}1_{X_m=i,X_{m+1}=j}$.
The maximum likelihood estimator $\hat{P}=\hat{P}(n)$ is the maximiser of $l$.
\begin{lemma}
    We have $\hat{p}_{ij}(n)=N_{ij}(n)/V_i(n)$ where like in the last section $V_i(n)=\sum_{k=0}^{n-1}1_{X_k=i}$.
\end{lemma}
\begin{proof}
    Use your favourite optimisation method, like Lagrange multipliers.
\end{proof}
\begin{theorem}
    If $P$ is positive recurrent, then
    $$\mathbb P[\hat{p}_{ij}(n)\to p_{ij}\text{ as }n\to\infty]=1$$
\end{theorem}
\begin{proof}
    Consider $N_{ij}=\sum_{m=1}^{V_i}Y_m$ where $Y_m$ is the indicator of the $m^{th}$ transition being from $i$ to $j$ and $V_i=V_i(\infty)$.
    By the Markov property, $Y_i$ are i.i.d. with mean $p_{ij}$ and independent from $V_i$.
    As $P$ is positive recurrent, $\mathbb P[V_i(n)\to\infty,n\to\infty]=1$, so the strong law of large numbers gives
    $$\mathbb P\left[ \hat{p}_{ij}(n)=\frac{1}{V_i(n)}\sum_{i=1}^{V_i(n)}Y_i\to p_{ij}\text{ as }n\to\infty \right]=1$$
    as desired.
\end{proof}
The course is basically finished here.
We might as well take a outlook on the subject.\\
For an aperiodic and irreducible finite-state Markov chain, we have seen that $\mathbb P[X_n=i]\to\pi_i$ as $n\to\infty$.
Thus, conversely, to sample from a given distribution $\pi$ (on say $N$ states), one may try to find a Markov chain with $\pi$ as its invariant distribution and then run it for a long time.
This is known as a Markov Chain Monte Carlo (MCMC) studies in the 50s by Metropolis \& Ulam.
There are different ways to find such a Markov chain.
The most famous one is Metropolis' algorithm originated from an article by Metropolis, Rosenbluth, Rosenbluth, Teller \& Teller (1953).
We will not explain it here -- you can look it up elsewhere.\\
There is another question of theoretical and practical relevance, which is the rate of this convergence.
For example, we might want to know more about
$$\min\{n:\sum_i|\mathbb P[X_n=i]-\pi_1|<\epsilon\}$$
This depends very much on the particular structure of the Markov chain and is expected to be highly nontrivial.
In fact, this is a subject of current research interest.\\
There are other perspectives of Markov chains we can study, for example we can look at random walks on groups, or consider continuous time and mixing time of Markov chains.


\documentclass{report}
\usepackage{amsmath}
\usepackage{amssymb}
\usepackage{listings}
\begin{document}
\section{Logistic Regression}
\subsection{Abstract}
In this chapter, we will learn an algorithm for binary classification - soft output: Logistic regression. It mainly relies on an activation function: $sigmoid$. Since the range of the function is $(0,1)$, it can approximate the probability value.
\subsection{Origin}
The following is the explanation of sigmoid in $shuhuai$ teacher's handout.
\begin{quotation}
	Sometimes we only need to get the probability of a category, so we need a function that can output the value of $(0, 1)$ interval. Considering the two classification model, we hope to model $p(C|x)$ using the discriminant model and Bayesian theorem: $$p\left(C_{1} \mid x\right)=\frac{p\left(x \mid C_{1}\right) p\left(C_{1}\right)}{p\left(x \mid C_{1}\right) p\left(C_{1}\right)+p\left(x \mid C_{2}\right) p\left(C_{2}\right)}$$
	set $a=\ln \frac{p\left(x \mid C_{1}\right) p\left(C_{1}\right)}{p\left(x \mid C_{2}\right) p\left(C_{2}\right)}$, so:
$$
p\left(C_{1} \mid x\right)=\frac{1}{1+\exp (-a)}
$$
The above formula is called $Logistic\ Sigmoid$ function and its parameters denote the logarithm of the two types of the joint probability ratios. In the discriminant, we don't care the specific value of the parameter and we just use the form of the function.
\end{quotation}
Of course, it doesn't matter if we can't understand tearcher's advanced explanation. We just need to know that we have the activation function $sigmoid$ now, which can be used to get the probability of a category.
\subsection{Algorithm}
Firstly, we suppose the logistic regression model is:
$$
f(x)=\sigma(w^Tx)
$$
In the formula, $\sigma(a)=sigmoid(a)$, we usually denote the activation function by $\sigma$.\\
So, if we find out the best value of $w$, the best model under the assumption is determined.\\
The parameters of probability discrinant model is usually determined by maximum likelihood estimation.\\
To determine the likelihood function, we have to make some marks firstly:
$$
p_1=\sigma(w^Tx) \qquad p_0=1-p_1
$$
In the formula, $p_1$ is the probability of $x$ belonging to class $1$ and $p_0$ is the probability of class $0$.\\
Then we can obtain the likelihood function of the model:
$$
p(y|w;x)=p_1^yp_0^{1-y}
$$
The likelihood function seem to be a little obscure, but actually it's reasonable:
\begin{itemize}
	\item when $y$ is $1$: $p(y|w;x)=p_1^1p_0^0=p_1$
	\item when $y$ is $0$: $p(y|w;x)=p_1^0p_0^1=p_0$
\end{itemize}
Well, then we can determine the parameters via $MLE$.
\begin{equation}
\begin{aligned}
\hat{w}=argmax(J(w))&=argmax(p(Y|w;X))\\
&=argmax(log(p(Y|w;X)))\\
&=argmax(log(\prod_{i=1}^n p(y_i|w;x_i)))\\
&=argmax(\sum_{i=1}^n log(p(y_i)|w;x_i))\\
&=argmax(\sum_{i=1}^n y\ log\, p_1+(1-y)log\,p_0)
\end{aligned}
\end{equation}
Notes, the formula is the opposite of the cross entropy formula mutiplied by $N$ and the logarithm in $MLE$ also match the exponential function to obtain the stable gradient in a large interval.\\\\
By differentiating the above formula, we note that:
$$
p_1'=p_1(1-p_1)
$$
Of course, it's easy to obtain since it's just the chain rule. We only need to be a little bit careful.\\
Finally, we obtain the result:
$$
\frac{\partial}{\partial w}J(w)=\sum_{i=1}^{N}\left(y_{i}-p_{1}\right) x_{i}
$$
Last but not least, we are to obtain the maximun of $p(p|w;x)$, so we need to use gradient ascent instead of gradient descent. Certainly they are similar, just add a negative character.
\newpage
\subsection{Implement}
\begin{lstlisting}[language={python}]
import os
os.chdir("../")
from models.linear_models import Logistic_regression
import numpy as np
import warnings

epsilon = 1
num_test = 100
num_base = 1000
ratio = 0.6
k1, k2 = 3, 5
b1, b2 = 1, 2
X = np.linspace(0, 100, num_base)
X_train = X[:-num_test]
X_test = X[-num_test:]
v1 = X_train[:round(len(X_train) * ratio)] * k1 + b1
v2 = X_train[round(len(X_train) * ratio):] * k2 + b2
v1 += np.random.normal(scale=epsilon, size=v1.shape)
v2 += np.random.normal(scale=epsilon, size=v2.shape)
value = np.r_[v1, v2]
data = np.c_[X_train, value]
l1 = np.ones_like(v1)
l2 = np.zeros_like(v2)
label = np.r_[l1, l2]
v_test_c1 = X_test * k1 + b1
l_test_c1 = np.ones_like(v_test_c1)
data_test = np.c_[X_test, v_test_c1]

model = Logistic_regression(10, 1000, lr=1e-3)
model.fit(data, label)
print(model.get_params())
print(model.predict(data_test, l_test_c1))
\end{lstlisting}
\end{document}