%COPYRIGHT
%SHERMAN IP 2018

\documentclass[10pt]{proc}
%\usepackage[a4paper, total={15cm, 20cm}]{geometry}

\usepackage{amsmath}
\usepackage{amsthm}
\usepackage{amssymb}
\usepackage{amsbsy}
\usepackage{graphicx}
\usepackage{natbib}
\usepackage{url}
\usepackage{subcaption}
\usepackage[nottoc]{tocbibind}
\usepackage[bookmarks=true]{hyperref}
\usepackage{bookmark}
\usepackage{hyphenat}
\usepackage{listings}
\lstset{basicstyle=\ttfamily,breaklines=true}
%\usepackage{rotating}
\usepackage{color} %red, green, blue, yellow, cyan, magenta, black, white
\usepackage[dvipsnames]{xcolor}
\usepackage{epstopdf}

\definecolor{mygreen}{RGB}{28,172,0} % color values Red, Green, Blue
\definecolor{mylilas}{RGB}{170,55,241}
\definecolor{bck}{RGB}{239,240,241}

\DeclareMathOperator{\expfamily}{ExpFamily}
\DeclareMathOperator{\expectation}{\mathbb{E}}
\DeclareMathOperator{\variance}{\mathbb{V}ar}
\DeclareMathOperator{\cov}{\mathbb{C}ov}
\DeclareMathOperator{\corr}{\mathbb{C}orr}
\DeclareMathOperator{\bernoulli}{Bernoulli}
\DeclareMathOperator{\betaDist}{Beta}
\DeclareMathOperator{\dirichlet}{Dir}
\DeclareMathOperator{\bin}{Bin}
\DeclareMathOperator{\MN}{Multinomial}
\DeclareMathOperator{\prob}{\mathbb{P}}
\DeclareMathOperator{\trace}{Tr}
\DeclareMathOperator{\normal}{N}
\DeclareMathOperator{\gammaDist}{Gamma}
\DeclareMathOperator{\poisson}{Poisson}

\newcommand{\RSS}{\mathrm{RSS}}
\newcommand{\euler}{\mathrm{e}}
\newcommand{\diff}{\mathrm{d}}
\newcommand{\T}{^\textup{T}}
%\newcommand{\dotdotdot}{_{\phantom{.}\cdots}}
\newcommand{\dotdotdot}{...}
\newcommand{\BIC}{\textup{BIC}}

\newcommand{\vect}[1]{\mathbf{#1}}
\newcommand{\vectGreek}[1]{\boldsymbol{#1}}
\newcommand{\matr}[1]{\mathsf{#1}}

\newtheorem{theorem}{Theorem}
\newtheorem{algorithm}{Algorithm}

\author{Sherman Ip - September 2018}
\title{A Review of Fusion Energy, Metropolis Hastings, Hamiltonian Monte Carlo and the No U-Turn Sampler}

\begin{document}\sloppy

\maketitle

\section{Fusion Energy}
A review of nuclear fusion will be given here. Most of the fundamental maths and physics here are covered in undergraduate textbooks such as \cite{riley2006mathematical}, \cite{serway2018physics} and \cite{martin2006nuclear}. Advanced topics in tomamkas are covered in \cite{wesson2004tokamaks}.

An example of nuclear fusion is the fusion of deuterium $_{2}^{1}\textrm{H}$ and tritium $_{3}^{1}\textrm{H}$ atoms in the following reaction
\begin{equation}
  ^{2}_{1}\textrm{H} + ^{3}_{1}\textrm{H} \rightarrow
  ^{1}_{0}\textrm{n} + ^{4}_{2}\textrm{He} \ .
\end{equation}
High temperatures of $\sim 10^8 \text{K}$ are required for the fusion reaction to occur by overcoming the Coulomb barrier. In this reaction, the kinetic energy of the $\alpha$ particle and the neutron are 3.5 MeV and 14.1 MeV respectively. The energy can be harnessed using neutron absorbing material such as lithium.

At such high temperatures, atoms are ionized to form plasma and this must be contained for the purpose of fusion energy. A tokamak, a doughnut-like shaped container, contains the plasma using magnetic coils which forms a helical magnetic field.

Achieving ignition, that is when the power generated is greater than the rate of energy lost, is difficult to achieve. The Lawson's criterion \citep{lawson1957some} describes that high ion density and high confinement time are required for ignition.

The plasma with charge density vector field $\mathbf{j}$ interacts with the magnetic vector field $\mathbf{B}$. For high confinement time, the force exerted by the magnetic field must balance with the outward pressure scalar field, $p$, of the plasma; this is known as the equilibrium state. A description of the equilibrium state can be obtained from Maxwell's equations
\begin{equation}
  \mu_0\mathbf{j}=\nabla \times \mathbf{B}
\end{equation}
\begin{equation}
  \nabla \cdot \mathbf{B} = 0
\end{equation}
and the force density
\begin{equation}
  \mathbf{j}\times\mathbf{B} = \nabla p \ .
\end{equation}

Axis symmetry was assumed here so that a poloidal cross section of the tokamak is only relevant. A further definition can be made to simplify future calculations. Using the magnetic potential $\mathbf{A}$, then
\begin{equation}
  \mathbf{B} = \nabla \times \mathbf{A}
\end{equation}
which in cylindrical coordinates $(r,\phi,z)$ is
\begin{equation}
  \mathbf{B} =
  \dfrac{1}{r}
  \left \|\begin{matrix}
  \widehat{\mathbf{e}}_r & \partial/\partial r & A_r \\
  r \widehat{\mathbf{e}}_\phi & \partial/\partial\phi & rA_\phi \\
  \widehat{\mathbf{e}}_z & \partial/\partial z & A_z
  \end{matrix}\right \| \ .
\end{equation}
Because of axis symmetry, the poloidal magnetic field is
\begin{equation}
  \mathbf{B_p} = -\dfrac{1}{r}\dfrac{\partial \psi}{\partial z}\widehat{\mathbf{e}}_r + \frac{1}{r}\dfrac{\partial\psi}{\partial r}\widehat{\mathbf{e}}_z
\end{equation}
where
\begin{equation}
\psi = rA_\phi
\end{equation}
is the poloidal magnetic flux function. Similarly the poloidal charge density is
\begin{equation}
  \mathbf{j_p} = -\dfrac{1}{r}\dfrac{\partial f}{\partial z}\widehat{\mathbf{e}}_r + \frac{1}{r}\dfrac{\partial f}{\partial r}\widehat{\mathbf{e}}_z
\end{equation}
where
\begin{equation}
  f = r B_\phi /\mu_0
\end{equation}
is the current flux function. It can be verified that these satisfy Maxwell's equations. The poloidal magnetic and charge density can be rewritten as
\begin{equation}
  \mathbf{B_p} = \dfrac{1}{r}\left(\nabla\psi\times\widehat{\mathbf{e}}_\phi\right)
  \label{eq:poloidal_magnetic}
\end{equation}
and
\begin{equation}
  \mathbf{j_p} = \dfrac{1}{r}\left(\nabla f\times\widehat{\mathbf{e}}_\phi\right)
  \label{eq:poloidal_current}
\end{equation}
respectively.

Again in cylindrical coordinates, assuming axis symmetry and $(\nabla p)\cdot\widehat{\mathbf{e}}_\phi=0$, the force density is
\begin{equation}
  \mathbf{j}\times\mathbf{B} =
  B_\phi\left(\mathbf{j_p}\times\widehat{\mathbf{e}}_\phi\right)
  +j_\phi\left(\widehat{\mathbf{e}}_\phi\times\mathbf{B_p}\right) \ .
\end{equation}
Using Equations \eqref{eq:poloidal_magnetic} and \eqref{eq:poloidal_current}, with the triple vector product $\mathbf{a}\times(\mathbf{b}\times\mathbf{c}) = (\mathbf{c}\cdot\mathbf{a})\mathbf{b} - (\mathbf{a}\cdot\mathbf{b})\mathbf{c}$, then
\begin{equation}
  \nabla p = -\dfrac{f\mu_0}{r^2}\nabla f+\dfrac{j_\phi}{r}\nabla \psi \ .
\end{equation}
Using the chain rule
\begin{equation}
\dfrac{\diff p}{\diff \psi} = \dfrac{\partial p}{\partial z}\dfrac{\diff z}{\diff \psi} + \dfrac{\partial p}{\partial r}\dfrac{\diff r}{\diff \psi}
\end{equation}
then
\begin{equation}
j_\phi = r\dfrac{\diff p}{\diff \psi}+\dfrac{\mu_0}{r}f\dfrac{\diff f}{\diff \psi} \ .
\label{eq:j_psi}
\end{equation}

Using the fact that $\mu_0j_\phi=\left(\nabla\times\mathbf{B}\right)\cdot\widehat{\mathbf{e}}_\phi$ then
\begin{equation}
  \mu_0j_\phi = -\dfrac{1}{r}\dfrac{\partial^2\psi}{\partial z^2}-\dfrac{\partial}{\partial r}
    \left(
      \dfrac{1}{r}\dfrac{\partial\psi}{\partial r}
    \right)
  \ .
\end{equation}
This can be combined with Equation \eqref{eq:j_psi} to get the Grad-Shafranov equation \citep{lust1957axialsymmetrische} \citep{grad1958hydromagnetic} \citep{shafranov1958magnetohydrodynamical, shafranov1966plasma}
\begin{equation}
\dfrac{\partial^2 \psi}{\partial z^2}+r\dfrac{\partial}{\partial r}\left(\dfrac{1}{r}\dfrac{\partial\psi}{\partial r}\right)
=
-r^2\mu_0\dfrac{\diff p}{\diff \psi}-\mu_0^2f\dfrac{\diff f}{\diff \psi}
\ .
\end{equation}
The Grad-Shafranov equation can be solved numerically, for example to solve for the current density spatially in a tokamak \citep{lao1985reconstruction}. This is known as the equilibrium problem.

Current tomography divides the tokamak cross section into a grid and solves for each grid element the current density under the equilibrium problem given measurements or diagnostics \citep{svensson2008current}. Diagnostics include the magnetic field strength from and of the coils, temperature readings and particles undergoing Thomson scattering \citep{svensson2004integrating} \citep{ford2009bayesian}. This can quickly turn into a high dimensional problem. By connecting all of the diagnostics and ingredients of the Grad-Shafranov equation together, a hierarchical model can be built. Bayesian inference can be used on the hierarchical model to make predictions, along with error bars, variables of interest such as the current density. There exist software which builds such a hierarchical model \citep{svensson2007large} \citep{ svensson2008current, svensson2010connecting}. However exact methods for Bayesian inference is  very hard and approximate methods such as MCMC are required here \citep{ford2010tokamak}.

\section{Metropolis Hastings}
Bayesian inference is the study of the posterior distribution, for example the posterior distribution can be $\mathbf{X} = j_\phi\text{ for all grid elements}|\text{diagnostics}$. The aim of Markov chains using Monte Carlo (MCMC) is to simulate the posterior distribution, otherwise known as sampling the target distribution. Suppose the MCMC samples are $\mathbf{X}_1,\mathbf{X}_2,\dotdotdot\mathbf{X}_n$, then useful summary statistics can be obtained such as the mean
\begin{equation}
\widehat{\vectGreek{\mu}} = \dfrac{1}{n}\sum_{i=1}^n \mathbf{X}_i
\end{equation}
and the covariance
\begin{equation}
\widehat{\matr{\Sigma}} = \dfrac{1}{n-1}\sum_{i=1}^n \left[\mathbf{X}_i-\widehat{\vectGreek{\mu}}\right]
\left[\mathbf{X}_i-\widehat{\vectGreek{\mu}}\right]\T
\end{equation}
which can be used to obtain error bars. To make sampling easier, MCMC sample samples which are Markovian $\{\mathbf{X}_n|\mathbf{X}_{n-1},\mathbf{X}_{n-2},\dotdotdot,\mathbf{X}_{1}\} = \{\mathbf{X}_n|\mathbf{X}_{n-1}\}$.

The random walk Metropolis-Hastings (RWMH) algorithm \citep{metropolis1953equation} \citep{hastings1970monte} is an example of a MCMC. Suppose a sample $\vect{X}_n = \vect{x}_n$ was obtained. Define the proposal to be $\vect{Y}_{n+1}|\vect{X}_n=\vect{x}_n \sim \normal\left(\vect{x}_n,\matr{\Theta}\right)$ which is a random walk. The transition from $\vect{X}_n=\vect{x}_n$ to $\vect{X}_{n+1}$ is
\begin{multline}
\vect{X}_{n+1}|\vect{Y}_{n+1} = \vect{y}_{n+1}, \vect{X}_{n} = \vect{x}_n
\\=
	\begin{cases}
	\vect{y}_{n+1} & \text{with probability } \alpha\left(\vect{x}_n,\vect{y}_{n+1}\right) \\
	\vect{x}_n & \text{otherwise}
	\end{cases}
\end{multline}
where
\begin{equation}
\alpha\left(\vect{x}_{n},\vect{y}_{n+1}\right)=\min\left(1,\dfrac{\pi(\vect{y}_{n+1})}{\pi(\vect{x}_{n})}\right)
\end{equation}
is the acceptance rate and $\pi(\vect{x})$ is the target density function. Suppose $\vect{X}_1=\vect{x}_1$ was defined or selected by the user, then the samples $\vect{X}_2,\vect{X}_3,\dotdotdot$ can be obtained. It can be shown that under mild conditions, such a transition will make the Markov chain converge to, or sample correctly, the target distribution \citep{roberts1994simple}.

The proposal covariance $\matr{\Theta}$ must be selected however and this does affect the acceptance rate and the performance of the RWMH. Acceptance rates too small or too large will cause the chain to not explore the target well \citep{gelman1996efficient}. Under some strong assumptions and in high dimension $d$, the optimal acceptance rate is about 0.234 \citep{gelman1996efficient} \citep{roberts1997weak} \citep{rosenthal2011optimal}. In the Gaussian example, the optimial covariance is $\matr{\Theta}={2.38^2}\matr{\Sigma}/d$ where $\matr{\Sigma}$ is the covariance of the target.

$\matr{\Sigma}$ is usually unknown. There exist adaptive methods \citep{haario2001adaptive} \citep{roberts2009examples} which adapts $\matr{\Theta}$ on the go. Let the proposal be $\vect{Y}_{n+1}|\vect{X}_n=\vect{x}_n\sim \normal\left(\vect{x}_n,\matr{\Theta}_n\right)$. The adaptive RWMH sets $\matr{\Theta}_{n}=\matr{\Theta}_0$ for $n<n_0$, otherwise
\begin{equation}
\matr{\Theta}_{n} =
\begin{cases}
2.38^2 \widehat{\matr{\Sigma}}_n/d & \text{with probability }1-\beta \\
\matr{\Theta}_0 & \text{otherwise}
\end{cases}
\end{equation}
where $\matr{\Theta}_0$ is some small initial proposal covariance, $n_0$ is an integer determining the number of initial non-adaptive steps, $\widehat{\matr{\Sigma}}_n$ is the unbiased sample covariance estimator of the chain $\vect{X}_1,\vect{X}_2,\dotdotdot,\vect{X}_n$ and $0\leqslant\beta\leqslant 1$ is some small number \citep{roberts2009examples}. For example it was selected that $n_0= 2d$ and $\beta = 0.05$. It can be shown that under some conditions, these adaptive methods will still sample the target correctly \citep{rosenthal2007coupling}.

\section{Hamiltonian Monte Carlo}
Hamiltonian Monte Carlo (HMC) \citep{neal2011mcmc} improves the random walk behaviour in RWMH by using Hamiltonian dynamics to guide the direction of the chain. The Hamilton's equations are
\begin{equation}
\dfrac{\diff x_i}{\diff t}=\dfrac{\partial H}{\partial p_i}
\qquad\&\qquad
\dfrac{\diff p_i}{\diff t}=\dfrac{\partial H}{\partial x_i}
\end{equation}
where $x_i$ and $p_i$ are components of the position and momentum vector respectively and $H$ is the Hamiltonian. Let $\matr{M}$ be a mass matrix which is symmetric and positive definite, then the Hamiltonian is
\begin{equation}
H(\vect{x},\vect{p})=U(\vect{x}) + \dfrac{1}{2}\vect{p}\T\matr{M}^{-1}\vect{p}
\end{equation}
where $U(\vect{x})$ is the potential energy. The potential energy for a target is given as
\begin{equation}
U(\vect{x}) = -\ln\pi(\vect{x})
\end{equation}
which comes from the Boltzmann's factor.

The algorithm requires the following parameters, a positive integer for number of leap frog steps $L$ and a positive number for the step size $\Delta t$. Suppose the chain is at $\vect{X}_n=\vect{x}_n$. Let $\vect{x}_n(0) = \vect{x}_n$. First a random momentum $\vect{p}_n(0)$ is drawn from $\normal\left(\vect{0},\matr{M}\right)$. Next the particle will run under Hamiltonian dynamics for time $L\Delta t$, this is done by solving the Hamilton's equations numerically using the leap frog algorithm. The equations required for the leap frog algorithm are:
\begin{equation}
\vect{p}_n\left(t+\dfrac{\Delta t}{2}\right) = \vect{p}_n(t) - \dfrac{\Delta t}{2}\nabla \left.U(\vect{x})\right|_{\vect{x} = \vect{x}_n(t)}
\label{eq:leapfrog1}
\end{equation}
\begin{equation}
\vect{x}_n(t+\Delta t) = \vect{x}_n(t)+\Delta t \matr{M}^{-1}\vect{p}_n\left(t+\dfrac{\Delta t}{2}\right)
\label{eq:leapfrog2}
\end{equation}
\begin{multline}
\vect{p}_n(t+\Delta t) =
\vect{p}_n\left(t+\dfrac{\Delta t}{2}\right)
\\
- \dfrac{\Delta t}{2}\nabla \left.U(\vect{x})\right|_{\vect{x} = \vect{x}_n(t+\Delta t)}
\ .
\label{eq:leapfrog3}
\end{multline}
Equations \eqref{eq:leapfrog1}, \eqref{eq:leapfrog2} and \eqref{eq:leapfrog3} are to be applied to $\vect{x}_n(0)$ and $\vect{p}_n(0)$ $L$ times to obtain $\vect{x}_n(L\Delta t)$ and $\vect{p}_n(L\Delta t)$.

Because the leap frog algorithm is a numerical method and does not solve the Hamilton's equations exactly, a Metropolis-Hastings step is used. The transition from $\vect{X}_n = \vect{x}_n$ to $\vect{X}_{n+1}$ is
\begin{multline}
\vect{X}_{n+1}|\vect{X}_{n}=\vect{x}_n
\\=
	\begin{cases}
	\vect{x}_{n}(L\Delta t) & \text{with prob. } \alpha\left(\vect{x}_{n}(0),\vect{x}_{n}(L\Delta t)\right) \\
	\vect{x}_n(0) & \text{otherwise}
	\end{cases}
\end{multline}
where
\begin{multline}
\alpha\left(\vect{x}_{n}(0)_n,\vect{x}_{n}(L\Delta t)\right)=
\\
\min\left(
1,
\dfrac{
  \exp\left[
    -H(
      \vect{x}_n(L\Delta t),\vect{p}_n(L\Delta t)
    )
  \right]
}
{
  \exp\left[
    -H(
      \vect{x}_n(0),\vect{p}_n(0)
    )
  \right]
}
\right) \ .
\end{multline}

Because HMC improves on the random walk behaviour, HMC produce samples which are less correlated and explore the target well. There are a few disadvantages however, for example the parameters $\matr{M}$, $\Delta t$ and $L$ must be sensible for HMC to even work. There are strategies on tuning these parameters \citep{neal2011mcmc}. HMC also requires the derivative of the potential $\nabla U(\vect{x})$ which may not be available in closed form. Numerical differentiation is possible however HMC requires the partial derivative of every dimension at every leap frog, which can get computationally costly. Inaccuracies due to the numerical differentiation should automatically be taken care of in the Metropolis-Hastings step.

\section{No U-Turn Sampler}

The No U-Turn Sampler (NUTS) \citep{hoffman2014no} controls $L$ automatically. Tuning $L$ is critical. For example in the one dimensional $\normal(0,1/\sqrt{k})$ case the potential is $U(x)=kx^2/2$ which corresponds to the potential of a simple harmonic oscillator. For $L$ too large, the particle will oscillate and this waste computational time. For $L$ too small, the particle will behave like a random walk.

Loosely, NUTS runs the Hamiltonian dynamics both forwards and backwards in time randomly until a U-Turn condition is satisfied. When that happens, a random point from the path is chosen for the MCMC sample and the process is repeated from that new point.

In detail, a binary tree is constructed to trace the path of the leap frog steps. To produce a MCMC sample, an iterative procedure is conducted. A slice variable $U_n\sim\text{Uniform}(0,\exp(-H(\vect{x}_n(0),\vect{p}_n(0)))$ is sampled. Let $\vect{x}_n^+$ and $\vect{p}_n^+$ be the position and momentum of the forward particle respectively. Similarly $\vect{x}_n^-$ and $\vect{p}_n^-$ for the backward particle. In each iteration, the binary tree selects at random uniformly to move the forward particle forwards in time or the backward particle backwards in time. Also for each iteration, the number of leap frog steps increase by a factor of 2. For example in the first iteration the forward particle moves forwards in time using 1 leap frog step. In the next iteration the backward particle moves backwards in time using 2 leap frog steps.

The iterative procedure continues until the U-Turn condition is met, that is
\begin{equation}
(\vect{x}_n^+ - \vect{x}_n^-)\cdot \vect{p}_n^- < 0
\quad \text{or} \quad
(\vect{x}_n^+ - \vect{x}_n^-)\cdot \vect{p}_n^+ < 0
\end{equation}
or when the Hamiltonian becomes inaccurate
\begin{equation}
\exp\left[-H(\vect{x}_n^{+},\vect{p}_n^{+})+\delta\right]<U_n
\end{equation}
or
\begin{equation}
\exp\left[-H(\vect{x}_n^{-},\vect{p}_n^{-})+\delta\right]<U_n
\end{equation}
where for example $\delta = 1000$.

Once the U-Turn condition is met, the next MCMC sample, $\vect{x}_{n+1}$, is obtained by sampling uniformly the leap frog path traced out by the binary tree $\{\vect{x}_n^-,\dotdotdot,\vect{x}_n(-\Delta t),\vect{x}_n(0),\vect{x}_n(\Delta t),\dotdotdot,\vect{x}_n^+\}$ which satisfies
\begin{equation}
U_n<\exp\left[-H(\vect{x_{n+1}},\vect{p_{n+1})}\right] \ .
\label{eq:slice}
\end{equation}
This is usually satisfied if the remaining HMC parameters are sensible.

\section{Diagnostics}
A small example will be given here. A MCMC has been constructed to estimate the current density of a cross section of a tokamak, modelled by a $3\times 3$ grid. A grid element will be studied here. This particular model has 205 dimensions. Diagnostics are presented here to judge the performance of the adaptive RWMH with initial covariance $10^{-6}/205 \times \matr{I}$ where $\matr{I}$ is the identity matrix. The chain initial point is at the maximum of the posterior and ran for 10\,000 iterations.

A slight adjustment was made to the adaptive RWMH in this example. A biased sample covariance was used rather than the unbiased version. It is given as
\begin{equation}
\widehat{\matr{\Sigma}}_n=\dfrac{\sum_{i=0}^n\left[\vect{x}_i-\widehat{\vectGreek{\mu}}_n\right]\left[\vect{x}_i-\widehat{\vectGreek{\mu}}_n\right]\T}{n}
\end{equation}
where
\begin{equation}
\widehat{\vectGreek{\mu}}_n = \dfrac{1}{n+1}\sum_{i=0}^n \vect{x}_i
\end{equation}
and $\vect{x}_0$ is a vector of zeros. This helps the covariance to be non-singular if not enough acceptance steps were taken due to a poor choice of the initial covariance.

A trace plot is a plot of the MCMC sample $x_1,x_2,\dotdotdot,x_n$ and it gives some indication on how the MCMC explore the state space, ideally exploring the space rapidly at each iteration with a sensible acceptance rate \citep{rosenthal2011optimal}. The acceptance rate should be monitored and values such as 0.234 in \cite{roberts1997weak} is a good rule of thumb. An example of a good trace plot is shown in Figure \ref{fig:trace}. The acceptance rate, shown in Figure \ref{fig:accept}, does converge but to a value other than 0.234. This may be fine as the result in \cite{roberts1997weak} does depend on strong assumptions, such as independence between dimensions.

\begin{figure}[ht]
  \centering
  \includegraphics[width=0.45\textwidth]{chain_1.png}
  \caption{Trace plot of chain 1}
  \label{fig:trace}
\end{figure}
\begin{figure}[ht]
  \centering
  \includegraphics[width=0.45\textwidth]{accept.png}
  \caption{Acceptance rate of chain 1}
  \label{fig:accept}
\end{figure}

The autocorrelation \citep{geyer2011mcmc} indicates the correlation between MCMC samples. The autocorrelation with lag $k$ is
\begin{equation}
\widehat{\rho}(k)=\dfrac
{
  \sum_{i=1}^{n-k}(x_i-\bar{x})(x_{i+k}-\bar{x})
}
{
  \sum_{i=1}^{n}(x_i-\bar{x})^2
}
\end{equation}
where $\bar{x}=\sum_{i=1}^nx_i/n$. The autocorrelation should be as small as possible in magnitude as this would mean future samples won't be influenced as much by previous samples which may indicate how the MCMC explore the state space. If the samples are uncorrelated, then the autocorrelation should be $\|\widehat{\rho}(k)\|<1/\sqrt{n}$ for the majority of $k=1,2,3,\dotdotdot$. The autocorrelation is shown in Figure \ref{fig:acf} with low autocorrelation at around lag 40 and above.

\begin{figure}[ht]
  \centering
  \includegraphics[width=0.45\textwidth]{acf.png}
  \caption{Autocorrelation of chain 1; red line = $\|{1/\sqrt{n}}\|$}
  \label{fig:acf}
\end{figure}

It may be convenient to combine the autocorrelation for different lags into a single number, the efficiency does that and is given as
\begin{equation}
\widehat{\text{efficiency}}=\left[1+2\sum_{i=1}^K\widehat{\rho}(i)\right]^{-1}
\end{equation}
where $K$ is the first odd positive integer for which $\widehat{\rho}(K + 1) + \widehat{\rho}(K + 2)$ is negative \citep{gelman2014bayesian}.

Burn-in \citep{geyer1992practical, geyer2011mcmc} is the discarding of samples at the start of the chain. This practice is done because the chain does need a number of iterations to converge to the target from some initial value and also for the adaptation to settle down. The Gelman-Rubin $F$ statistic \citep{gelman1992inference} is a rule of thumb for how many samples to discard for burn-in. This is done by starting multiple chains at different initial points and judging how long it takes for all of these chains to have similar sample means. The $F$ statistic is obtained by comparing the within and between chain variances using the second half of the chain, similar to the one-way ANOVA. Let $x_1^{(j)}, x_2^{(j)},\dotdotdot,x_n^{(j)}$ be the $j$th chain for $j=1,2,\dotdotdot,k$. Let
\begin{equation}
\bar{x}^{(j)}(n_b)=\dfrac{\sum_{i=n_b+1}^{2n_b}x_i^{(j)}}{n_b}
\end{equation}
and
\begin{equation}
\bar{x}^*(n_b) = \dfrac{\sum_{j=1}^k\sum_{i=n_b+1}^{2n_b}x_i^{(j)}}{kn_b}
\ .
\end{equation}
The within chain variance is
\begin{equation}
s_W^2(n_b) = \dfrac{
  \sum_{j=1}^k \sum_{i=n_b+1}^{2n_b} \left(
    x_i^{(j)} - \bar{x}^{(j)}(n_b)
  \right)^2
}
{
  kn_b - k
}
\end{equation}
and the between chain variance is
\begin{equation}
s_B^2(n_b) = \dfrac{
  \sum_{j=1}^k  n_b \left(
    \bar{x}^{(j)}(n_b) - \bar{x}^*(n_b)
  \right)^2
}
{
  k-1
}
\ .
\end{equation}
The $F$ statistic is
\begin{equation}
F(n_b) = s_B^2(n_b) / s_W^2(n_b) \ .
\end{equation}
The value of $n_b$ which makes $F$ closest to 1 is the amount of samples to discard for burn in. Unlike ANOVA though, the $F$ distribution cannot be used as independence cannot be assumed within chains. This implies that the $F$ statistic may converge to a value which is not 1. Various chains with different initial points, using random samples from the chain in Figure \ref{fig:trace}, are shown in Figure \ref{fig:chains}. The $F$ statistic is shown in Figure \ref{fig:grs}.  The statistic starts stabilising after the adaptation step, that is after 410 iterations. A burn-in of 410 was used.

\begin{figure}[ht]
  \centering
  \includegraphics[width=0.45\textwidth]{f.png}
  \caption{Gelman Rubin's $F$ statistic}
  \label{fig:grs}
\end{figure}

\begin{figure}[ht]
  \centering
  \includegraphics[width=0.45\textwidth]{batch_acf.png}
  \caption{Autocorrelation of the batches $b_1,b_2,...,b_Q$; red line = $\|{1/\sqrt{n}}\|$}
  \label{fig:batch_acf}
\end{figure}

\begin{figure*}[htp]
\centering
\begin{subfigure}[t]{0.49\textwidth}
  \includegraphics[width=\textwidth]{chain_2.png}
  \caption{Chain 2}
\end{subfigure}
\begin{subfigure}[t]{0.49\textwidth}
  \includegraphics[width=\textwidth]{chain_3.png}
  \caption{Chain 3}
\end{subfigure}
\begin{subfigure}[t]{0.49\textwidth}
  \includegraphics[width=\textwidth]{chain_4.png}
  \caption{Chain 4}
\end{subfigure}
\begin{subfigure}[t]{0.49\textwidth}
  \includegraphics[width=\textwidth]{chain_5.png}
  \caption{Chain 5}
\end{subfigure}
\caption{Various chains with different initial points}
\label{fig:chains}
\end{figure*}

The error in the sample mean of the chain is called the Monte Carlo error, similar to the standard error. However independence between samples cannot be assumed here so batching is one way to cater for this \citep{geyer2011mcmc}. In batching, the chain is spilt into $Q$ non-overlapping batches of sizes $l_1,l_2,\dotdotdot,l_Q$. Let $b_1,b_2,\dotdotdot,b_Q$ be the sample mean for each of the batches, then the Monte Carlo error is
\begin{equation}
\widehat{\sigma}_{\text{ME}}=
\sqrt{
  \dfrac{
    \sum_{i=1}^Ql_i(b_i-\bar{x})^2
  }
  {
    Qn
  }
}
\ .
\end{equation}

The number of batches should increase with $n$. A good rule of thumb is to set $Q=\text{round}(\sqrt{n})$ and the batch sizes to be as similar as possible \citep{jones2006fixed}. The batch means $b_1,b_2,\dotdotdot,b_Q$ should be as uncorrelated as possible and an autocorrelation plot can be used to judge this, as shown in Figure \ref{fig:batch_acf}.

The Monte Carlo error can be used to judge how long a chain should run. The longer the chain, the smaller the Monte Carlo error is. It can be argued that not much can be gained if the Monte Carlo error is smaller than the sample standard deviation of the chain $s$ by an order of magnitude of 2. Following from this, a threshold can be used to stop the chain, for example if $\widehat{\sigma}_{\text{ME}}/s<10^{-2}$ or $\ln(s)-\ln(\widehat{\sigma}_{\text{ME}}) > 4.6$.

The posterior mean and error, efficiency and the log Monte Carlo error are shown in Table \ref{table:diagnostic}. All 5 chains agree the estimate of the current density is $(-4.96 \pm 0.02) \text{ MA.m}^{-2}$.

\begin{table*}[htp]
\centering
\begin{tabular}{c|c|c|c}
Chain Number & Current Density $\text{ MA.m}^{-2}$ & Efficiency & $\ln(s)-\ln(\widehat{\sigma}_{\text{ME}})$ \\
\hline
1 & $-4.96 \pm 0.02$ & 0.07 & 3.4\\
2 & $-4.96 \pm 0.02$ & 0.01 & 3.2\\
3 & $-4.96 \pm 0.01$ & 0.07 & 3.4\\
4 & $-4.96 \pm 0.02$ & 0.04 & 3.2\\
5 & $-4.96 \pm 0.02$ & 0.07 & 3.3\\
\end{tabular}
\caption{Various diagnostics of the chains. The current density and the Monte Carlo error calculations discarded the first 410 samples.}
\label{table:diagnostic}
\end{table*}

\section{Java Implementation}

\begin{figure}[ht]
  \centering
  \includegraphics[width=0.45\textwidth]{NoUTurnSampler.eps}
  \caption{UML diagram of the inner class \texttt{Tree}}
  \label{fig:tree_uml}
\end{figure}

\begin{figure*}[htp]
\centering
\begin{subfigure}[t]{0.49\textwidth}
  \includegraphics[width=\textwidth]{processing_rwmh.png}
  \caption{Adaptive RWMH}
\end{subfigure}
\begin{subfigure}[t]{0.49\textwidth}
  \includegraphics[width=\textwidth]{processing_hmc.png}
  \caption{HMC with sensible $L$}
\end{subfigure}
\begin{subfigure}[t]{0.49\textwidth}
  \includegraphics[width=\textwidth]{processing_hmc2.png}
  \caption{HMC with insensible $L$}
\end{subfigure}
\begin{subfigure}[t]{0.49\textwidth}
  \includegraphics[width=\textwidth]{processing_nuts.png}
  \caption{NUTS}
\end{subfigure}
\caption{Various screen-shots of the visual simulation of MCMC targeting a 2D Gaussian. a) A rejected step is shown in red. b) c) Leap frog steps are shown in yellow. d) The proposal position is shown in blue.}
\label{fig:processing}
\end{figure*}

RWMH, adaptive RWMH, HMC and NUTS all have been implemented in Java. Libraries were used such as Efficient Java Matrix Library \citep{abeles2018ejml} for matrices and Apache Commons Mathematics \citep{apache2016math} for the Mersenne Twister random number generator \citep{matsumoto1998mersenne} and the one-way ANOVA. Implementation is straight forward except for NUTS because \cite{hoffman2014no} presented the algorithm using functions which returns multiple values.

Within the spirit of Java, object oriented programming was used to implement the binary tree used in NUTS. In particular the class \texttt{Tree} is an inner class of \texttt{NoUTurnSampler}. This means that an instant of \texttt{Tree} can only be instantiated by an instance of \texttt{NoUTurnSampler}. An instantiated \texttt{Tree} can access all member variables of the \texttt{NoUTurnSampler} instance which instantiated it. The \texttt{Tree} class is presented in Figure \ref{fig:tree_uml}. A short description of the class \texttt{Tree} is given here, the full source code of both classes can be found in the repository.

The objective of the \texttt{Tree} class is to grow a binary tree recursively, keep track of variables such as the forward/backward position/momentum $\vect{x}_n^-,\vect{p}_n^+,\vect{x}_n^+,\vect{p}_n^+$ and the proposal $\vect{x}_{n+1}$. It also keep tracks if the particle has satisfy the U-Turn condition.

The class has two constructors. The first one requires two parameters: the position $\vect{x}$ and momentum $\vect{p}$. It simply calls the method \texttt{plantSeed} which instantiate and initialise $\vect{x}_n^-, \vect{x}_n^+, \vect{x}_{n+1} \leftarrow \vect{x}$ and $\vect{p}_n^-, \vect{p}_n^+ \leftarrow \vect{p}$. The second constructor requires in addition a boolean to indicate the direction of growth and an integer which indicate the height of the tree. It calls the method \texttt{buildTree} which is similar to the function with the same name in \cite{hoffman2014no}. It recursively updates the forward/backward position/momentum member variables using leap frog steps and updates the proposal position accordingly.

Next the \texttt{grow} and \texttt{bloom} methods are described, both required by the \texttt{buildTree} method. The \texttt{grow} method requires a boolean parameter which indicates the direction of the growth. The method instantiate a \texttt{Tree} which grows from $\vect{x}_n^{+/-}, \vect{p}_n^{+/-}$, depending on the direction of the growth, of height \texttt{height}. This instantiated \texttt{Tree} is saved as a member variable \texttt{subTree} and is used to update the member variables  $\vect{x}_n^{+/-}, \vect{p}_n^{+/-}$ and $\vect{x}_{n+1}$. The \texttt{bloom} method is used to update the member variables \texttt{height} and \texttt{hasNoUTurn} and should be called after every \texttt{grow} call. They are in separate methods so that calculations can be done between the calls.

In the NUTS implementation, an instance of \texttt{NoUTurnSampler} instantiate a \texttt{Tree}. A while loop is used to check if \texttt{tree.hasNoUTurn}. At each iteration, a random boolean is generated to set the direction of growth. The method \texttt{tree.grow(boolean)} is called and set \texttt{tree.positionProposal = tree.subTree.positionProposal}. This is followed by a \texttt{tree.bloom()} call ready for the next iteration.

The Processing library \citep{reas2007processing} was used to create a visual simulation of the different types of MCMC targeting a 2D Gaussian. Screen-shots are shown in Figure \ref{fig:processing}.

\section{Discussion}
HMC and NUTS do struggle here because the potential energy of the posterior is not available in closed form yet. In particular it is difficult to get the numerical differentiation right for all dimensions for HMC to even work. Numerical differentiation can also be slow as it requires the evaluation of the target density for every dimension for every leap frog step, these evaluations could be put to better use in adaptive RWMH.

It should be noted that when comparing HMC with RWMH, the number of times the density or potential are evaluated should be considered, for example HMC evaluates the potential $L$ times for each sample. A fair comparison would be to comparing HMC with RWMH with thinning of $L$, that is discarding $L$ samples for every sample. In practice, thinning is not recommended \citep{geyer1992practical}.

The tuning of the mass matrix $\matr{M}$ and the step size $\Delta t$ was omitted here but discussed by \cite{hoffman2014no}. A good $\matr{M}$ would be equal to the covariance of the target so that proposal momenta are similar to the target in scale. A preliminary run using RWMH could be used to get a good value of $\matr{M}$. The tuning of $\Delta t$ was proposed using dual averaging by \cite{hoffman2014no}.

There exist extensions to HMC such as the Riemann manifold HMC \citep{girolami2011riemann} and relativistic HMC \citep{lu2016relativistic}. Outside of Java, software such as Stan \citep{carpenter2017stan} implemented and uses HMC and NUTS for the purpose of full Bayesian statistical inference and market itself as a probabilistic programming language. It can be interacted through MATLAB, C++, Python, R and other languages but Java.

The number of dimensions in current tomography under the assumption of equilibrium can get very large quickly, especially for grids finer than $3\times 3$. At that stage, long MCMC runs are required overnight. Other MCMC methods should be investigated such as for example the zig-zag process \citep{bierkens2016zig}, bouncy particle filter \citep{bouchard2018bouncy} and the scalable Langevin exact algorithm \citep{pollock2016scalable}.

\section{Code Repository}
The code is available in the repository under the Apache License 2.0 \url{https://github.com/shermanip/oxwasp_exchange_mcmc}. There exist two branches, one for visualising MCMC \url{https://github.com/shermanip/oxwasp_exchange_mcmc/tree/processing}, the other implements MCMC on the equilibrium problem but requires software and data only available to staff at Culham Centre for Fusion Energy \url{https://github.com/shermanip/oxwasp_exchange_mcmc/tree/ccfe}.

\bibliographystyle{apalike}
\bibliography{bib}

\end{document}


\subsection{Pick-a-point proofs}
\begin{frame}
\frametitle{Reasoning about UBDDs}

Why do we care?

\SmallSkip
No ACL2 reasoning is needed for equivalence checking
\begin{itemize}
\item Build a UBDD for the circuit (execution)
\item Build a UBDD for the specification (execution)
\item Check if they are equal (execution)
\end{itemize}

\SmallSkip

But there are other, critical uses of UBDDs
\begin{itemize}
\item Parameterization --- partitions an input space into UBDDs
\item AIG conversion --- builds a UBDD from an AIG
\item G System --- represents symbolic objects as lists of UBDDs
\end{itemize}

\end{frame}

\begin{frame}[fragile]
\frametitle{The direct approach}

The ``recursion and induction'' approach does not work very well

\SmallSkip
Some problems
\begin{itemize}
\item Finding workable induction schemes
\item Case-splits in UBDD construction (\Code{q-car}, \Code{q-cdr}, \Code{q-cons})
\end{itemize}

\SmallSkip
It also ``feels wrong''
\begin{itemize}
\item Structural, low-level view of Boolean functions
\item Not applicable to other representations (AIGs, ...)
\end{itemize}

\SmallSkip
Similar to the problem of reasoning about ordered sets

\end{frame}

\begin{frame}[fragile]
\begin{verbatim}
(defthm q-and-equiv
  (implies (and (normp x)
                (normp y))
           (equal (q-and x y)
                  (q-ite x y nil))))
\end{verbatim}
ACL2 can do the proof directly (0.7s)
\begin{itemize}
\item Merges induction schemes of \Code{normp} and \Code{q-ite}
\item *1/22 inductive subgoals
\item Many subsequent case splits
\end{itemize}

\end{frame}

\begin{frame}[fragile]
\begin{verbatim}
(defun q-xor (x y)
  (cond ((atom x)
         (if x (q-not y) y))
        ((atom y)
         (if y (q-not x) x))
        ((hons-equal x y)
         nil)
        (t
         (qcons (q-xor (car x) (car y))
                (q-xor (cdr x) (cdr y))))))

(defthm q-xor-equiv
  (implies (and (normp x)
                (normp y))
           (equal (q-xor x y)
                  (q-ite x (q-not y) y))))
\end{verbatim}
\end{frame}

\begin{frame}[fragile]
\small{\begin{verbatim}
Subgoal *1/7.97.164.8'
(IMPLIES (AND (CONSP X)
              Y (CONSP Y)
              (NOT (EQUAL X (Q-NOT Y)))
              (NOT (EQUAL (Q-NOT Y) Y))
              (EQUAL (Q-ITE (CAR X) (CAR (Q-NOT Y)) NIL)
                     T)
              (NOT (EQUAL (Q-ITE (CDR X) (CDR (Q-NOT Y)) (CDR Y))
                          T))
              (NOT (CAR Y))
              (CDR Y)
              (CONSP (CDR Y))
              (EQUAL (Q-XOR (CDR X) (CDR Y))
                     (Q-ITE (CDR X) (Q-NOT (CDR Y)) (CDR Y)))
              (NORMP (CAR X))
              (NORMP (CDR X))
              (CONSP (CAR X))
              (NORMP (CDR Y))
              (NOT (EQUAL (Q-NOT Y) T)))
         (NOT (Q-NOT Y)))
\end{verbatim}}
\end{frame}

\begin{frame}
\frametitle{Pick-a-point proofs}

{\bf Prove}: $(A \cup B) \cap C = (A \cap C) \cup (B \cap C)$

\SmallSkip
{\bf Proof}: Let $x$ be an arbitrary element.  We will show $x$ is in $(A \cup B)
\cap C$ exactly when it is in $(A \cap C) \cup (B \cap C)$.

\begin{eqnarray*}
x \in \Red{(A \cup B)} \cap \Green{C}
  &\leftrightarrow& \Red{(x \in A \cup B)} \wedge \Green{x \in C} \\
  &\leftrightarrow& \Red{(x \in A \vee x \in B)} \wedge \Green{x \in C}
\end{eqnarray*}
\begin{eqnarray*}
x \in \Red{(A \cap C)} \cup \Green{(B \cap C)}
  &\leftrightarrow& \Red{x \in A \cap C} \vee \Green{x \in B \cap C} \\
  &\leftrightarrow& \Red{(x \in A \wedge x \in C)} \vee \Green{(x \in B \wedge x \in C)} \\
  &\leftrightarrow& (\Red{x \in A} \vee \Green{x \in B}) \wedge x \in C
\end{eqnarray*}
Q.E.D.
\end{frame}

\begin{frame}
\frametitle{Pick-a-point proofs of UBDDs}

{\bf Sets} \[x = y \leftrightarrow \forall a : \mathit{has}(x, a) = \mathit{has}(y, a)\]

\SmallSkip
{\bf UBDDs} \[x = y \leftrightarrow \forall a : \mathit{eval\textrm{-}bdd}(x,
a) = \mathit{eval\textrm{-}bdd}(y, a)\]

\SmallSkip
Some familiar set-theory operations
\begin{itemize}
\item \Code{NIL}, the empty set
\item \Code{T}, the universal set
\item \Code{Q-NOT}, set complement
\item \Code{Q-AND}, set intersection
\item \Code{Q-OR}, set union
\end{itemize}
\end{frame}

\begin{frame}[fragile]
\frametitle{Osets-style automation}

Suppose \Code{(bdd-lhs)}, \Code{(bdd-rhs)}, and \Code{(bdd-hyp)} satisfy
\begin{verbatim}
  (implies (and (bdd-hyp)
                (normp (bdd-lhs))
                (normp (bdd-rhs)))
           (equal (eval-bdd (bdd-lhs) vals)
                  (eval-bdd (bdd-rhs) vals)))
\end{verbatim}

\SmallSkip
Then, we can prove
\begin{verbatim}
  (implies (and (bdd-hyp)
                (normp (bdd-lhs))
                (normp (bdd-rhs)))
           (equal (bdd-lhs) (bdd-rhs)))
\end{verbatim}

\SmallSkip
A default hint functionally instantiates this theorem when our goal is to show
two \Code{normp}'s are equal (and other approaches have failed)
\end{frame}

\begin{frame}[fragile]
\frametitle{Preparing for pick-a-point proofs}

For ordered sets
\begin{itemize}
\item \Code{(setp (union x y))}
\item \Code{(in a (union x y))} $=$ \Code{(in a x)} $\vee$ \Code{(in a y)}
\end{itemize}

\SmallSkip

For UBDDs
\begin{itemize}
\item \Code{(normp x)}, \Code{(normp y)} $\rightarrow$ \Code{(normp (q-or x y))}
\item \Code{(eval-bdd (q-or x y) a)} $=$ \Code{(eval-bdd x a)} $\vee$ \Code{(eval-bdd y a)}
\end{itemize}

\SmallSkip
These proofs are done in the ``recursion and induction'' style

They tend to be easy

\end{frame}

\begin{frame}[fragile]

{\footnotesize \begin{verbatim}
(add-bdd-fn q-and)

(defthm q-and-equiv
  (implies (and (normp x)
                (normp y))
           (equal (q-and x y)
                  (q-ite x y nil))))

We now appeal to EQUAL-BY-EVAL-BDDS in an attempt to show that (Q-AND X Y)
and (Q-ITE X Y NIL) are equal because all of their evaluations under
EVAL-BDD are the same.  (You can disable EQUAL-BY-EVAL-BDDS to avoid
this.  See :doc EQUAL-BY-EVAL-BDDS for more details.)

We augment the goal with the hypothesis provided by the :USE hint.
The hypothesis can be derived from EQUAL-BY-EVAL-BDDS via functional
instantiation, provided we can establish the constraint generated;
the constraint can be simplified using case analysis.  We are left
with the following two subgoals.
\end{verbatim}}

\end{frame}

\begin{frame}[fragile]

{\footnotesize \begin{verbatim}

Subgoal 2
(IMPLIES (AND (IMPLIES (AND (AND (NORMP X) (NORMP Y))
                            (NORMP (Q-AND X Y))
                            (NORMP (Q-ITE X Y NIL)))
                       (EQUAL (EQUAL (Q-AND X Y) (Q-ITE X Y NIL))
                              T))
              (NORMP X)
              (NORMP Y))
         (EQUAL (Q-AND X Y) (Q-ITE X Y NIL))).

But simplification reduces this to T, using the :executable-counterparts
of EQUAL and NORMP, primitive type reasoning, the :rewrite rules NORMP-
OF-Q-AND and NORMP-OF-Q-ITE and the :type-prescription rule NORMP.

\end{verbatim}}
\end{frame}

\begin{frame}[fragile]

{\footnotesize \begin{verbatim}
Subgoal 1
(IMPLIES (AND (NORMP X)
              (NORMP Y)
              (EQUAL (LEN ARBITRARY-VALUES)
                     (MAX (MAX-DEPTH (Q-AND X Y))
                          (MAX-DEPTH (Q-ITE X Y NIL))))
              (BOOLEAN-LISTP ARBITRARY-VALUES)
              (NORMP (Q-AND X Y))
              (NORMP (Q-ITE X Y NIL)))
         (EQUAL (EVAL-BDD (Q-AND X Y) ARBITRARY-VALUES)
                (EVAL-BDD (Q-ITE X Y NIL) ARBITRARY-VALUES))).

But simplification reduces this to T, using the :definition MAX, the
:executable-counterpart of NORMP, primitive type reasoning, the :rewrite
rules EVAL-BDD-OF-NON-CONSP-CHEAP, EVAL-BDD-OF-Q-AND, EVAL-BDD-OF-Q-
ITE, NORMP-OF-Q-AND and NORMP-OF-Q-ITE and the :type-prescription rule
NORMP.

Q.E.D.
\end{verbatim}}
\end{frame}


% !TEX root = ../zeth-protocol-specification.tex

\section{Instantiate $\sigscheme_{\otsig}$}\label{instantiation:otsig}

\zeth~uses the one-time Schnorr-based signature scheme introduced by Bellare and Shoup~\cite{bellare2007two} for its long proven security, simplicity, speed and size. Its security relies on the one-more discrete log problem (see~\cref{preliminaries:def:om-dlog}) and the collision resistance of the underlying hash function $\crh$ (see~\cref{preliminaries:def:collision-resistance}) that we instantiate with \sha{256}.

Note that no signature operations or data are used in the arithmetic circuit describing the \zeth~statement. Hence the curve used for the signature scheme can be chosen independently of \Curve (the scalar field of which is used for the arithmetic circuit, and consequently for commitments and bit string encodings described in \cref{instantiation:prf-comm-crh} and \cref{instantiation:mkhash}). $\BNCurve$ is used since it is supported by the \evm, in the form of precompiled contracts. This allows a gas-efficient implementation in the \mixer~contract.

This one-time signature scheme (see~\cref{preliminaries:def:ot-sig}) is defined by the two-tier signature scheme over a cyclic group $(p, \gset, \langle \ggen \rangle, \otimes)$.
In the two-tier signature scheme, the hash function $\crh$ only needs to be collision resistant (the random oracle model is not used). Similarly, the variable $\hk$ represents the key of the hash function (a particular instance).

To turn this two-tier signature scheme into a one-time signature scheme, one simply has to define the one-time signature key generation \kgen~as the combination of both primary and secondary key generations of the two-tier (see~\cite[Section 6]{bellare2007two}). The one-time signing key (respectively verification key) of the one time signature scheme is defined as both the primary and secondary signing key (respectively verification key) of the two-tier scheme,~\cref{instantiation:fig:ots-from-two-tier-sig}

% Local macros to align with Bellare and Shoup notations in
% https://eprint.iacr.org/2007/273.pdf
\newcommand{\ppk}{\ensuremath{\varstyle{ppk}}\xspace}
\newcommand{\psk}{\ensuremath{\varstyle{psk}}\xspace}
\newcommand{\spk}{\ensuremath{\varstyle{spk}}\xspace}
\newcommand{\ssk}{\ensuremath{\varstyle{ssk}}\xspace}

\begin{figure*}[ht]
    \begin{minipage}[t]{0.33\textwidth}
        \begin{align*}
            & \underline{\kgen(\secparam):} \\
            & \hk \sample \BB^{\kl} \\
            & \ggen \sample \gset^* \\
            & x \sample \FFx{p} \\
            & \ppk = (\hk, \ggen, \groupenc{x}) \\
            & \psk = (\hk, \ggen, x) \\
            & y \sample \FFx{p} \\
            & \spk =  \groupenc{y} \\
            & \ssk = (y, \groupenc{y}) \\
            & \pk = (\ppk, \spk) \\
            & \sk = (\psk, \ssk) \\
        \end{align*}
    \end{minipage}%
    \begin{minipage}[t]{0.33\textwidth}
        \begin{align*}
            & \underline{\sig(\sk, \msg):}\\
            & \hk, \ggen, x = \sk.\psk \\
            & y, \groupenc{y} = \sk.\ssk \\
            & c = \crh(\hk, \groupenc{y} \concat \msg) \\
            & \sigma = y \bmod p \\
            & \sigma\ \text{+=}\ c \cdot x \bmod p \\
            & \pcreturn \sigma
        \end{align*}
    \end{minipage}%
    \begin{minipage}[t]{0.33\textwidth}
        \begin{align*}
        & \underline{\verify(\pk, \msg, \sigma):}\\
        &  \hk, \ggen, \groupenc{x} = \pk.\ppk \\
        &  \groupenc{y} = \pk.\spk \\
        &  c = \crh(\hk, \groupenc{y} \concat \msg)\\
        &  \pcif \sigma = \groupenc{y} \otimes c \cdot \groupenc{x} \pcthen \\
        &  \pcind \pcreturn 1\\
        &  \pcelse\\
        &  \pcind \pcreturn 0\\
        &  \pcendif
        \end{align*}
    \end{minipage}
\caption{One-time signature scheme from two tier Schnorr based signature scheme by Bellare and Shoup~\cite{bellare2007two}}\label{instantiation:fig:ots-from-two-tier-sig}
\end{figure*}

\subsection{Security requirements satisfaction}

We now prove that this signature scheme satisfies all the security requirements listed in~\cref{zeth-protocol:sec-req}.

\begin{theorem}
    The One-Time Schnorr signature is strongly unforgeable under chosen-message attacks $(\sufcma)$ assuming that the \omdlog~problem is hard in \gset~and that the hash function $\crh$ is collision resistant.

\begin{proof}
    See~\cite[Theorems 5.1, 5.2 and 6.1]{bellare2007two}.
\end{proof}

\end{theorem}

\subsection{Data types}\label{instantiation:otsig:data-types}

We now describe the data types and operations associated with this signature scheme.

\begin{description}
    \item[\vkOtsDType] Denotes the verification key associated with the one-time signature scheme.
        \begin{table}[H]
        \centering
        \begin{tabular}{cp{20em}c}
            Field & Description & Data type\\ \toprule
            $\ppk$ & Encoding of the scalar $x$ in the group & $\gsetBN$ \\ \midrule
            $\spk$ & Encoding of the scalar $y$ in the group & $\gsetBN$ \\ \bottomrule
        \end{tabular}
        \caption{\vkOtsDType~data type}\label{instantiation:tab:vk-ots-dtype}
        \end{table}
    \item[\skOtsDType] Denotes the signing key associated with the one-time signature scheme.
        \begin{table}[H]
        \centering
        \begin{tabular}{cp{20em}c}
            Field & Description & Data type\\ \toprule
            $\psk$ & Scalar element $x$ & $\FFx{\rBN}$ \\ \midrule
            $\ssk$ & Scalar element $y$ and its encoding in the group & $\FFx{\rBN} \times \gsetBN$ \\ \midrule
        \end{tabular}
        \caption{\skOtsDType~data type}\label{instantiation:tab:sk-ots-dtype}
        \end{table}
    \item[\sigOtsDType] Denotes the signature data type associated with the one-time signature scheme. $\sigOtsDType$ is an alias for $\FFx{\rBN}$.
\end{description}


    \filetitle{companion}{Matrices of first-order companion VAR}{VAR/companion}

	\paragraph{Syntax}\label{syntax}

\begin{verbatim}
[A,B,K,J] = companion(V)
\end{verbatim}

\paragraph{Input arguments}\label{input-arguments}

\begin{itemize}
\itemsep1pt\parskip0pt\parsep0pt
\item
  \texttt{V} {[} VAR {]} - VAR object for which the companion matrices
  will be returned.
\end{itemize}

\paragraph{Output arguments}\label{output-arguments}

\begin{itemize}
\item
  \texttt{A} {[} numeric {]} - First-order companion transition matrix.
\item
  \texttt{B} {[} numeric {]} - First-order companion coefficient matrix
  in front of reduced-form residuals.
\item
  \texttt{K} {[} numeric {]} - First-order compnaion constant vector.
\end{itemize}

\paragraph{Description}\label{description}

\paragraph{Example}\label{example}


\chapter{Security}\label{chap:security}

\section{Expected Strength}

Non-repudiation and unforgeability can be broken by finding any SHA-256 collision, since messages are SHA-256-hashed before being signed.
\gravity may also be broken if \hashx and \hashy are not collision resistant.
This puts \gravity in NIST's security category 2: ``Any attack that breaks the relevant security definition must require computational resources comparable to or greater than those required for collision search on a 256-bit hash function (e.g. SHA256/ SHA3-256)''.

Attacks that would break \gravity by searching for a subset of known subkeys fall into NIST's category 5, however: ``Any attack that breaks the relevant security definition must require computational resources comparable to or greater than those required for key search on a block cipher with a 256-bit key (e.g. AES 256)''.

Below we detail the later type of attacks.

\section{Known Attacks}\label{sec:attacks}

The main attack on \gravity works as follows:
\begin{enumerate}

    \item Observe $N$ signatures in order to collect at most $N\times K$ subkeys, and on average $(T^{NK} - (T-1)^{NK}) / T^{NK-1}$. Call the corresponding subset of indices $\mathcal{I}$.
    \item Search for a message $M$ and a signature seed $S$ such that the $K$ indices obtained by subset generation belong to $\mathcal I$, which happens with probability $(\vert\mathcal{I}\vert / T)^K$.
    \item Once a pair $(M,S)$ is found at step 2, construct the signature using the subkeys collected in step 1. The signature will be valid even though the signature seed was not derived from the secret key.
\end{enumerate}

Classically, the expected number of attempts before forging a signature is therefore
\[
\left(\frac{T}{\vert \mathcal I\vert}\right)^K = \frac{T^{NK^2}}{(T^{NK} - (T-1)^{NK})^K}
\]
where each attempt involves approximately $K/2$ AES calls in order to generate $K$ indices (since a 16-byte blocks provides at most 4 indices).

The classical security level against this attack is therefore, in bits:
\[
NK^2 \log T - K \log(T^{NK} - (T-1)^{NK}) + \log K - 2
\]
where $N$ is the number of messages signed.

A quantum attack using Grover's algorithm would require quadratically fewer attempts (approximately, and using a quantum circuit), thus a lower bound is
\[
(NK^2 \log T - K \log(T^{NK} - (T-1)^{NK}))/2 + \log K - 2
\]

For \gravity instances in Table~\ref{tab:instances}, with $N$ set to the defined message limit, instances S, M, L respectively have
\begin{itemize}
    \item Classical security levels 243.76, 253.82, 248.72
    \item Quantum security bounds 123.86, 128.79, 126.36
\end{itemize}
Figure~\ref{fig:security} shows the degradation of security as the number of signatures grows.

\begin{figure}
%\includegraphics[width=14cm]{graph_classical}
%\includegraphics[width=14cm]{graph_quantum}
\centering\input{img/security_classical.tikz}
\centering\input{img/security_quantum.tikz}
\caption{Security level in bits of \gravity instances against classical and quantum attacks exploiting the subkeys revealed in previous signatures. Quantum attacks use Grover search to get a quadratic speed-up over classical attacks.}
\label{fig:security}
\end{figure}

\section{Other Attacks}

Fault attacks or side-channel attacks could recover $\sk_1$ in the subset generation if the AES implementation is not protected.
Likewise $\sk_2$ could be recovered during the computation of $S=\hashz(\sk_2 \Vert \hashx(M))$ if $\hashz$ is not protected.

Fault attacks could also force subset generation to return indices of specific subkeys.

Timing attacks are unlikely if the implementations of functions processing $\sk_1$ and $\sk_2$ are time-constant (AES, Haraka-v2).

\section{Forgery Detection}\label{sec:detection}

In the attack described in \S\ref{sec:attacks} the attacker chooses the signature seed $S$ but can't pick $S=\hashz(\sk_2 \Vert \hashx(M))$, as prescribed by the signing procedure.
Yet the signature will be verified, and only the legitimate signer can determine that $S$ wasn't properly chosen using $\sk_2$.
EdDSA (and Ed25519) have a similar property of invalid-yet-valid signatures.

This property allows a signer to detect signatures forged after exploiting a (too) high number of issued signatures, compared with legitimately computed signatures.
But it can't be used to prove the existence of forgeries to a third-party, since the signer could have themselves used an invalid signature seed in order to break non-repudiation.
If the signer is trusted, however, then they can reveal $\sk_2$ privately in order to show evidence of a forgery.


\mainsection{FHE Security}\label{sec:fhe}
In this chapter we detail how FHE parameters are selected.
The first part deals with how the basic ``sizes'' are derived,
and the second part gives the mathematical justification (i.e.
noise analysis) for the equations used in the code for setting
up parameters.
Before proceeding it is perhaps worth detailing how
different security parameters are used within the code.

\begin{itemize}
\item $\Sacsecp$ (default $80$):
This defined how many sacrifices we do per triple,
to get the precise number you compute $\ceil{\Sacsecp/\log_2 p}$.
Thus this statistical security parameter is effectively
$\log_2 p$ unless $p$ is very small.
\item $\Macsecp$ (default $80$):
For the full threshold case this defines how many MACs are held
per data item, again to get the precise number you compute
$\ceil{\Macsecp/\log_2 p}$.
Thus, again, this statistical security parameter is effectively
$\log_2 p$ unless $p$ is very small.
\item $\Soundsecp$ (default $128$):
This defines the soundness error of the ZKPoKs below,
the value of $2^{-\Soundsecp}$ defines the probability
that an adversary can cheat in a single ZKPoK.
\item $\ZKsecp$ (default $80$):
This defines the statistical distance between the
coefficients of the ring elements in an honest ZKPoK
transcript and one produced by a simulation.
\item $\DDsecp$ (default $80$):
This defines the statistical distance between the
coefficients of the ring elements in the distribution produced
in the distributed decryption protocol below to the uniform
distribution.
\item \verb+comp_sec+ (default $128$):
This defines the computational security parameter for the
FHE scheme.
\item $\epsilon$ (default $55$):
This defines the noise bounds for the FHE scheme below in
the following sense.
A FHE ciphertext in the protocol is gauranteed to decrypt
correctly, even under adversarial inputs assuming the
ZKPoKs are applied correctly, with probability $1-2^{-\epsilon}$.
In fact this is an under-estimate of the probability.
From $\epsilon$ we define $e_i$ such that
$\mathsf{erfc}(e_i)^i \approx 2^{-\epsilon}$ and then we set $\gc_i = e_i^i$.
\item \verb+NewHopeB+ (default $1$):
This defines how Gaussians are selected in the FHE system for
Full Threshold. We use the NewHope approximation of
$\sum b_i - b_i'$, where $b_i, b_i' \in \{0,1\}$,
with the sum being over \verb+NewHopeB+ values of $i$.
This gives an approximation to a discrete Gaussian with
standard deviation $\sigma = \sqrt{\texttt{NewHopeB}/2}$.
\item \verb+HwtSK+ (default $64$):
The Hamming weight of the secret key. If this zero
then the discrete Gaussian is used for the secret key.
\end{itemize}
All of these parameters can be tweaked in the file
\verb+config.h+.

\subsection{Main Security Parameters}
Our Ring-LWE samples are (essentially) always from an
approximate Gaussian distribution with standard deviation
$\sigma=\sqrt{\texttt{NewHopeB}/2}$
and from a ring with a two-power degree of $N$.
This is not strictly true as some noise samples come
from (possibly) small Hamming Weight distributions, and some come
from distributions over $\{-1,0,1\}$.
But the above are the main parameters, and have been used in prior works to
estimate Ring-LWE security in SHE settings.

Given these settings we need to determine the maximum
(ciphertext) ring modulus $q$ that still gives us security.
For this we use Martin Albrecht's estimator which can
be found at
\begin{center}
\url{https://bitbucket.org/malb/lwe-estimator}
\end{center}
For various values of $n$ and (symmetric equivalent)
security levels \verb+comp_sec+, we then find the maximum secure
value of $q$.
This is done by running the following \verb+sage+ code
\begin{verbatim}
load("estimator.py")
import sys

for n in range(10,17):
  N = 2^n
  #for B in [1,2,4,8,16,20]:
  for B in [1]:
    sigma=sqrt(B/2.0)
    ans=[1,1,1]
    cnt=0
    for sec in [80,128,256]:
      bot=0
      top=40
      if N>5000:
	top=100
      if N>20000:
	top=256
      if N>40000:
	top=900
      repeat=true
      while repeat:
        repeat=false
        q=2^top
        costs = estimate_lwe(N, RealField(512)(sigma*sqrt(2*pi)/q), q, \
                             reduction_cost_model=BKZ.sieve, skip=["arora-gb", \
                             "bkw", "dec", "mitm"])
        if not any([cost.values()[0]<2^sec for cost in costs.values()]):
	     bot=top
             top=2*top
	     repeat=true
      while top <> bot:
         mid=round((top+bot)/2-.5)
         if (mid==bot):
		break
         sys.stdout.flush()
         q = 2^mid
         costs = estimate_lwe(N, RealField(512)(sigma*sqrt(2*pi)/q), q, \
                              reduction_cost_model=BKZ.sieve, skip=["arora-gb", \
                              "bkw", "dec", "mitm"])
         if any([cost.values()[0]<2^sec for cost in costs.values()]):
	     top=mid
         else:
	     bot=mid
      sys.stdout.flush()
      ans[cnt]=bot
      cnt=cnt+1
    print N,"&",B,"&",sigma,"&",ans[0],"&",ans[1],"&",ans[2],"\\\\"
    sys.stdout.flush()
\end{verbatim}
When run via
\begin{center}
  \verb+sage < SCALE-Est.py > Res.txt+
\end{center}
this will produce lines of the form
\begin{center}
\verb+1024 & 1 & 0.707106781186548 & 40 & 25 & 12 \\+
\end{center}
This that for ring dimension $1024$, with \verb+NewHopeB+ equal to
one, and so $\sigma=0.707$, that at the 80-bit security level any $q < 2^{40}$ will
be ``secure'' by the above definition of secure.
Note that producing the table for \verb+NewHopeB+ equal to one produces
values which remain secure when a higher value of \verb+NewHopeB+ is selected.

We did this in Oct 2019 and obtained the following table of values, giving maximum
values of $q$ in the form of $2^x$ for the value $x$ from the following table.
\begin{center}
\begin{tabular}{|c|c|c|c||c|c|}
\hline
$N$   & \verb+NewHopeB+ & $\sigma$ &  \verb+comp_sec+=80 & \verb+comp_sec+=128 & \verb+comp_sec+=256 \\
\hline
1024 & 1 & 0.707106781186548 & 40 & 25 & 12 \\
2048 & 1 & 0.707106781186548 & 82 & 52 & 26 \\
4096 & 1 & 0.707106781186548 & 167 & 106 & 56 \\
8192 & 1 & 0.707106781186548 & 340 & 215 & 115 \\
16384 & 1 & 0.707106781186548 & 686 & 436 & 235 \\
32768 & 1 & 0.707106781186548 & 1392 & 879 & 473 \\
65536 & 1 & 0.707106781186548 & 2830 & 1778 & 953 \\
\hline
\end{tabular}
\end{center}
Any updates to this table needs to be duplicated in
the file \verb+FHE_Params.cpp+ in the code base.

\subsection{Distributions and Norms}
Given an element $a \in R = \Z[X]/(X^{N}+1)$ (represented as a polynomial)
where $X^N+1$ is the $m=2 \cdot N$-th cyclotomic polynomial
(recall $N$ is always a power of two).
We define $\norm{a}_p$ to be the standard $p$-norm
of the coefficient vector (usually for $p=1, 2$ or $\infty$).
We also define $\norm{a}_p^\can$ to be the $p$-norm
of the same element when mapped into the canonical embedding
i.e.
\[  \norm{a}_p^\can = \norm{\kappa(a)}_p \]
where $\kappa(a): R \longrightarrow \C^{\phi(m)}$ is the
canonical embedding.
The key three relationships are that
\[ \norm{a}_\infty \le c_m \cdot \norm{a}_\infty^\can \quad
   \mbox{  and  } \quad
   \norm{a}_\infty^\can \le \norm{a}_1  \quad
   \mbox{  and  } \quad
   \norm{a}_1 \le \phi(m) \cdot \norm{a}_\infty.
\]
for some constant $c_m$ depending on $m$.
Since in our protocol we select $m$ to be a power of two, we have $c_m=1$.
In particular (which will be important later in measuring the
noise of potentially dishonestly generated ciphertexts) we have
\[ \norm{a}_{\infty}^{\can} \le \phi(m) \cdot \norm{a}_{\infty}. \]
We also define the \emph{canonical embedding norm reduced modulo~$q$}
of an element $a\in R$ as the smallest canonical embedding norm of any
$a'$ which is congruent to $a$ modulo~$q$. We denote it as
\[
|a|_q^{can} = \min
  \{~\norm{a'}_\infty^\can :~ a'\in R,~ a' \equiv a \pmod{q}~\}.
\]
We sometimes also denote the polynomial where the minimum is obtained
by $[a]_q^{\can}$, and call it the {\em canonical reduction} of
$a$ modulo $q$.

Following \cite{GHS12c}[Appendix A.5] we examine the variances
of the different distributions utilized in our protocol.
\begin{itemize}
\item $\HWT(h,N)$: This generates a vector of length $N$
      with elements chosen at random from $\{-1,0,1\}$ subject to
      the condition that the number of non-zero elements is equal to $h$.
\item $\ZO(0.5,N)$:  This generates a vector of length $N$
      with elements chosen from $\{-1,0$, $1\}$ such that the
      probability of coefficient is $p_{-1}=1/4$, $p_0=1/2$
      and $p_1=1/4$.
\item $\dN(\sigma^2,N)$: This generates a vector of
      length $N$ with elements chosen according to the NewHope
      approximation to the discrete Gaussian distribution with variance $\sigma^2$.
\item $\RC(0.5,\sigma^2,N)$: This generates a triple of
      elements $(v,e_0,e_1)$ where $v$ is sampled from $\ZO_s(0.5,N)$
      and $e_0$ and $e_1$ are sampled from $\dN_s(\sigma^2,N)$.
\item $\calU(q,N)$: This generates a vector of length $N$
      with elements generated uniformly modulo $q$.
\end{itemize}
Let $\zeta_m$ denote any complex primitive $m$-th root of unity.
Sampling $a \in R$ from $\HWT(h,\phi(m))$ and looking at $a(\zeta_m)$
produces a random variable with variance $h$, when sampled
from $\ZO(0.5,\phi(m))$ we obtain variance $\phi(m)/2$,
when sampled from $\dN(\sigma^2,\phi(m))$ we obtain variance
$\sigma^2 \cdot \phi(m)$ and when sampled from $\calU(q,\phi(m))$
we obtain variance $q^2 \cdot \phi(m)/12$.
We let in what follows $V_\sk$ denote $\sqrt{\texttt{HwtSK}}$ in the case
when \verb|HwtSK| is positive, and $\sigma \cdot \sqrt{\phi(m)}$ otherwise.
By the law of large numbers we can use $\gc_1 \cdot \sqrt{V}$,
where $V$ is the above variance, as a high probability bound
on the size of $a(\zeta_m)$ (the probability is $1-2^{-\epsilon}$,
and this provides a bound on the canonical embedding norm of $a$.

If we take a product of $t$ such
elements with variances $V_1, V_2, \ldots, V_t$
then we use $\gc_t \cdot \sqrt{V_1 \cdot V_2 \cdots V_t}$
as the resulting high probability bounds.
In our implementation we approximate $\dN(\sigma^2,n)$ using
the above binomial method from the NewHope paper, this means
any vector sampled from $\dN(\sigma^2,n)$ will have
infinity norm bounded by \verb+NewHopeB+.

\subsection{The FHE Scheme and Noise Analysis}
Note that whilst the scheme is ``standard'' some of the
analysis is slightly different from that presented in the \cite{SPDZ2} paper
and that presented in the \cite{GHS12c} paper.
We use the notation of the \cite{SPDZ2} paper in this section,
and assume the reader is familiar with prior work.
The key differences are:
\begin{itemize}
\item Unlike in SPDZ-2 we assume a perfect distributed key generation method
amongst the $n$ players.
\item Unlike in SPDZ-2 we are going to use an actively secure ZKPoK (see later),
which will make the actual noise analysis much more complex.
\end{itemize}
The TopGear zero-knowledge proof is parametrized by two
parameters $U$ and $V$.
The parameter $U$ defines the amount of ciphertexts we prove in
each iteration, i.e. the amount of ciphertext amortization.
Whereas $V$ is the number of auxillary ciphertexts which are used.
We set $U = 2 \cdot V$, and $V= (\Soundsecp+2)/\log_2 (2 \cdot N+1)$
for normal proofs.
For the diagonal proofs we set $U$ to be the number of different
MAC keys being used, and $V=16$.

\subsubsection{Key Generation:}
The main distinction between the assumptions here and those used in
the \cite{SPDZ2} paper, is that in the latter a specific distributed
key generation protocol for the underlying threshold FHE keys was
assumed. In SCALE we assume a `magic black box' which distributes
these keys, which we leave to the application developer to create.
The secret key $\sk$ is either selected from a distribution with
Hamming weight $h$, i.e. $\HWT(h,\phi(m))$ or from
$\dN(\sigma^2,N)$ (depending on what was selected in \verb|config.h|).
Then the secret key is distributed amongst the $n$ parties by simply producing a random
linear combination, and assigning each party one of the sums.
The switching key data is produced in the standard way, i.e.
in a non-distributed trusted manner.
We assume a two-leveled scheme with moduli $p_0$ and $p_1$ with $q_1=p_0 \cdot p_1$
and $q_0=p_0$.
We require
\begin{align*}
   p_1 & \equiv 1 \pmod{p}, \\
   p_0 - 1 & \equiv p_1-1 \equiv p-1 \equiv 0 \pmod{\phi(m)}.
\end{align*}
In particular the public key is of the form $(a,b)$ where
\[ a \asn \calU(q,\phi(m)) \quad \mbox{ and } \quad b = a \cdot \sk + p \cdot \epsilon \]
where $\epsilon \asn \dN(\sigma^2,\phi(m))$
and the switching key data $(a_{\sk,\sk^2},b_{\sk,\sk^2})$ is of the form
\[ a_{\sk,\sk^2} \asn \calU(q,\phi(m)) \quad \mbox{ and } \quad
   b_{\sk,\sk^2} =   a_{\sk,\sk^2} \cdot \sk + p \cdot e_{\sk,\sk^2} - p_1 \cdot \sk^2 \]
where $e_{\sk,\sk^2} \asn \dN(\sigma^2,\phi(m))$.

\subsubsection{Encryption:}
To encrypt an element $m\in R$, we choose $v, e_0, e_1 \asn \RC(0.5,\sigma^2,n)$, i.e.
\[
v \asn \ZO(0.5, \phi(m)) ~~~\mbox{and}~~ e_0,e_1 \asn \dN(\sigma^2,\phi(m))
\]
Then we set $c_0 = b \cdot v + p \cdot e_0+m$,~ $c_1=a\cdot v+p\cdot
e_1$, and set the initial ciphertext as $\ct'=(c_0,c_1)$.
We calculate a bound (which holds with high probability) on the output noise of
an honestly generated ciphertext to be
\begin{align*}
  \norm{c_0 - \sk \cdot c_1}_\infty^\can
     &= \norm{((a \cdot \sk+ p \cdot \epsilon) \cdot v +p \cdot e_0 +m
                - (a \cdot v+ p \cdot e_1) \cdot \sk }_\infty^\can \\
     &= \norm{m + p \cdot (\epsilon \cdot v +e_0 - e_1 \cdot \sk)}_\infty^\can \\
     &\le \norm{m}_\infty^\can
         +p \cdot \left( \norm{\epsilon\cdot v}_\infty^\can
                       + \norm{e_0}_\infty^\can
                       + \norm{e_1 \cdot \sk}_\infty^\can
                  \right) \\
     &\le \phi(m) \cdot p/2
	  + p \cdot \sigma \cdot
             \left( \gc_2 \cdot \phi(m) / \sqrt{2}
			  + \gc_1 \cdot \sqrt{\phi(m)}
			  + \gc_2 \cdot \sqrt{\phi(m)} \cdot V_\sk
		    \right) = B_\clean.
\end{align*}
Note this is a probablistic bound and not an absolute bound.

\vspace{5mm}

\noindent
However, below (using the TopGear protocol)
we will only be able to guarantee the $m, v, e_0$ and $e_1$
values of a {\bf sum} of $n$ fresh ciphertexts
(one from each party) are selected subject to
\[ \norm{2 \cdot v}_\infty \le 2^{\ZKsecp + 3} \cdot n \quad
    \mbox{  and  } \quad
   \norm{2 \cdot e_0}_\infty, \norm{2 \cdot e_1}_\infty \le \texttt{NewHopeB} \cdot 2^{\ZKsecp + 2} \cdot n \quad
    \mbox{  and  } \quad
   \norm{2 \cdot m}_\infty \le 2^{\ZKsecp + 1} \cdot n \cdot p,
\]
where $\ZKsecp$ is our soundness parameter for the
zero-knowledge proofs and $U$ is selected so that
$(2 \cdot \phi(m))^U > 2^\Soundsecp$.
Thus in TopGear we double the generated ciphertext
(which is the sum of the input players ciphertext)
to obtain a ciphertext $(c_0,c_1)$ which even in the
case of dishonest players has a noise bound in the
infinity norm in the canonical embedding of,
\begin{align*}
  \norm{c_0 - \sk \cdot c_1}_\infty^\can
  &\le \sum_{i=1}^n
  	\norm{2 \cdot m_i}_\infty^\can
	+ p \cdot \Big(\norm{\epsilon}_\infty^\can \cdot \norm{2 \cdot v_i}_\infty^\can
	+ \norm{2 \cdot e_{0,i}}_\infty^\can \\
  &\hspace{3.5cm}
	+ \norm{\sk}_\infty^\can \cdot \norm{2 \cdot e_{1,i}}_\infty^\can \Big) \\
   &\le 2 \cdot \phi(m) \cdot 2^{\ZKsecp+1} \cdot n \cdot p  \\
   & \hspace{2cm}
	+ p \cdot \Big(
	 \gc_1 \cdot \sigma \cdot \phi(m)^{3/2} \cdot 2 \cdot 2^{\ZKsecp+2} \cdot n\\
  &\hspace{3cm}
	  + \phi(m) \cdot 2 \cdot  2^{\ZKsecp+2} \cdot n \cdot \texttt{NewHopeB}  \\
  &\hspace{3cm}
	  +  \gc_1 \cdot V_\sk \cdot \phi(m) \cdot 2 \cdot 2^{\ZKsecp+2} \cdot n \cdot \texttt{NewHopeB}
	\Big)  \\
  &=\phi(m) \cdot 2^{\ZKsecp+2} \cdot n \cdot p
	\cdot \Big( \frac{41}{2} + \gc_1 \cdot \sigma \cdot \phi(m)^{1/2}
	           +  \texttt{NewHopeB} \cdot \gc_1 \cdot V_\sk
	\Big)   \\
  & = B_\clean^\dishonest.
\end{align*}
Again this is a probabilistic bound (assuming validly
distributed key generation), but assumes the {\em worst case}
ciphertext bounds.

\subsubsection{$\SwitchModulus((c_0,c_1))$:}
This takes as input a ciphertext modulo $q_1$ and outputs a ciphertext mod $q_0$.
The initial ciphertext is at level $q_1=p_0 \cdot p_1$, with $q_0=p_0$.
If the input ciphertext has noise bounded by $\nu$
in the canonical embedding
then the output ciphertext will have noise bounded by $\nu'$ in
the canonical embedding, where
\[ \nu' = \frac{\nu}{p_1} + B_\scale. \]
The value $B_\scale$ is an upper bound on the quantity
$\norm{\tau_0+\tau_1 \cdot \sk}_\infty^\can$, where
$\kappa(\tau_i)$ is drawn from a distribution
which is close to a complex Gaussian with variance $\phi(m)\cdot p^2/12$.
We therefore, we can (with high probability) take the upper
bound to be
\begin{align*}
    B_\scale
	&= c_1 \cdot p \cdot \sqrt{ \phi(m)/12}
	+  c_2 \cdot p \cdot \sqrt{ \phi(m)/12} \cdot V_\sk, \\
\end{align*}
This is again a probabilistic analysis, assuming validly generated
public keys.

\subsubsection{$\Dec_{\sk}(\ct)$:}
As explained in \cite{SPDZ2,GHS12c} this procedure works when the noise
$\nu$ (in the canonical embedding) associated with a ciphertext satisfies $c_m \cdot \nu  < q_{0}/2$.
However, as we always take power of two cyclotomics we have $c_m=1$

\subsubsection{$\DistDec_{\{\sk_i\}}(\ct)$:}
There are two possible distributed decryption protocols.
The first one is from \cite{SPDZ} is for when we want to obtain a
resharing of an encrypted value, along with a fresh ciphertext.
The second version is from \cite{KPR}, where we do not need to
obtain a fresh encryption of the value being reshared.

\begin{Boxfig}{The sub-protocol for additively secret sharing a plaintext $\vm \in (\F_{p^k})^s$ on input a ciphertext $e_\vm=\Enc_\pk(\vm)$.}{reshare}{$\mathsf{Reshare-1}$}
Input is $e_\vm$, where $e_\vm=\Enc_\pk(\vm)$ is a public ciphertext.

Output is a share $\vm_i$ of $\vm$ to each player $P_i$; and a ciphertext $e'_\vm$.

The idea is that $e_\vm$ could be a product of two ciphertexts, which
$\mathsf{Reshare}$ converts to a ``fresh'' ciphertext $e'_\vm$. Since $\mathsf{Reshare}$ uses distributed decryption (that may return an incorrect result), it is not guaranteed that $e_\vm$ and $e'_\vm$ contain the same value, but it
{\em is} guaranteed that $\sum_i \vm_i$ is the value contained in $e'_\vm$.
\begin{enumerate}
\item Each player $P_i$ samples a uniform $\vf_i\in (\F_p)^N$. Define $\vf:=\sum_{i=1}^{n}\vf_i$.
\item Each player $P_i$ computes and broadcasts $e_{\vf_i}\asn\Enc_\pk(\vf_i)$.\label{reshare:enc}
\item Each player $P_i$ runs the proof below as a prover on $e_{\vf_i}$. The protocol aborts if any proof fails
and if successful each player obtains $e_\vf\asn e_{\vf_1}\boxplus\dots\boxplus e_{\vf_n}$.
\item The players compute $e_{\vm+\vf}\asn e_\vm\boxplus e_\vf$.
\item The players decrypt $e_{\vm+\vf}$ as follows:
\begin{enumerate}
\item Player one computes $\vv_1 = e_{\vm+\vf}^{(0)}-\sk_1 \cdot e_{\vm+\vf}^{(1)}$ and player $i \ne 1$ computes.
$\vv_i = -\sk_i \cdot e_{\vm+\vf}^{(1)}$.
\item All players compute $\vt_i = \vv_i + p \cdot \vr_i$ for some random element
with infinity norm given by $2^\DDsecp \cdot B_\dec/p$, where $\DDsecp$ is the parameter defining statistical distance for the distributed decryption.
\item The parties broadcast $\vt_i$.
\item The parties compute $\vm+\vf = \sum \vt_i \pmod{p}$.
\end{enumerate}
\item $P_1$ sets $\vm_1\asn \vm+\vf-\vf_1$, and
each player $P_i$ ($i\neq 1$) sets $\vm_i\asn -\vf_i$.
%\item Each player $P_i$ now holds a share $m_i$ of the secret value $m$.
\item All players set $e'_\vm \asn \Enc_{pk}(\vm+\vf)\boxminus e_{\vf}$,
where a default value for the randomness is used when computing $\Enc_{pk}(\vm+\vf)$.
\end{enumerate}
\end{Boxfig}

\paragraph{Reshare Version 1:}
This is described in \figref{reshare}.
The value $B_\dec$ in the protocol is an upper bound on the noise in the canonical embedding
$\nu$ associated with a ciphertext we will decrypt in our protocols.
To ensure valid distributed decryption we require
\[ 2 \cdot (1+n \cdot 2^\DDsecp) \cdot B_\dec < q_{0}. \]

Given a value of $B_\dec$, we therefore will obtain a lower bound
on $p_0$ by the above inequality.
The addition of a random term with infinity norm bounded by
$2^\DDsecp \cdot B_\dec/p$ in the distributed decryption procedure
ensures that the individual {\em coefficients} of the sum
$\vt_1+\cdots+\vt_n$ are statistically indistinguishable from
random, with probability $2^{-\DDsecp}$.
This does not imply that the adversary has this probability of
distinguishing the simulated execution in \cite{SPDZ} from the
real execution; since each run consists of the exchange of
$\phi(m)$ coefficients, and the protocol is executed many times
over the execution of the whole protocol.
We however feel that setting concentrating solely on the
statistical indistinguishability of the coefficients is valid
in a practical context.

\paragraph{Reshare Version 2:}
This is given in \figref{distdec}.
This protocol is simpler as it does not require the resharing to a
new ciphertext.
So in particular players do not need to provide encryptions of
their $\vf_i$ values, and hence there is no need
to execute the ZKPoK needed in the previous protocol.

\begin{Boxfig}{Distributed decryption to secret
    sharing}{distdec}{$\mathsf{Reshare-2}$}
Furthermore, let $B_\dec$ denote a bound on the noise, that is $\norm{c_0 - s \cdot c_1}_\infty$.
\begin{enumerate}
\item Party $i$ samples $\vf_i \asn [0,B_\dec \cdot 2^\DDsecp]^N$.
\item Party $1$ computes
  $\vv_i := (c_0 - s_1 \cdot c_1) - \vf_1 \bmod q$, and every other
  party $i$ computes $\vv_i :=  -s_i \cdot c_1- \vf_i$.
\item Party $i$ broadcasts $\vv_i$.
\item Party 1 outputs
  $\vm_1 := (\sum_{i=1}^n \vv_i \bmod q + \vf_1) \bmod p$, and
  every other party $i$ outputs $\vm_i := \vf_i \bmod p$.
\end{enumerate}
\end{Boxfig}

\subsubsection{$\SwitchKey(d_0,d_1,d_2)$:}
In order to estimate the size of the output noise term
in the canonical embedding we need first to estimate the size of the term
(again probabilistically assuming validly generated public
keys)
\[ \norm{p \cdot d_2 \cdot \epsilon_{\sk,\sk^2}}_\infty^\can. \]
Following \cite{GHS12c} we assume heuristically that $d_2$
behaves like a uniform polynomial with coefficients drawn from
$[-q_0/2,\ldots,q_0/2]$ (remember we apply $\SwitchKey$ at level
zero).
So we expect
\begin{align*}
 \norm{ p \cdot d_2 \cdot e_{\sk,\sk^2}}_\infty^\can
     &\le p \cdot \gc_2 \cdot \sqrt{q_0^2/12 \cdot \sigma^2 \cdot \phi(m)^2} \\
     & = p \cdot \gc_2 \cdot q_0 \cdot \sigma \cdot \phi(m)/\sqrt{12} \\
     & = B_\KS \cdot q_0.
\end{align*}
Thus
\[ B_\KS = p \cdot \gc_2 \cdot \sigma \cdot \phi(m)/\sqrt{12}. \]
Then if the input to $\SwitchKey$ has noise bounded by $\nu$ then the output
noise value in the canonical embedding will be bounded by
\[ \nu+\frac{B_\KS \cdot p_0}{p_1} + B_\scale. \]

\subsubsection{$\Mult(\ct,\ct')$:}
Combining the all the above, if we take two ciphertexts of level one
with input noise in the canonical embedding bounded by $\nu$ and $\nu'$, the output noise level
from multiplication will be bounded by
\[ \nu'' =      \left( \frac{\nu}{p_1} + B_\scale \right)
	  \cdot
                \left( \frac{\nu'}{p_1} + B_\scale \right)
		+ \frac{B_\KS \cdot p_0}{p_1}+B_\scale.
\]

\subsubsection{Application to the Offline Phase:}
In all of our protocols the most complext circuit we will be evaluating
is the following one:
We first add $n$ ciphertexts together and perform a multiplication, giving a
ciphertext with respect to modulus $p_0$ with noise in the canonical
embedding bounded by
\[
  U_1 = \left( \frac{B_\clean^\dishonest}{p_1}+B_\scale \right)^2
		+ \frac{B_{\KS} \cdot p_0}{p_1} + B_\scale.
\]
Recall that $B_\clean^\dishonest$ is the bound for a sum of
$n$ ciphertexts, one from each party.
We then add on another $n$ ciphertexts, which are added at
level one and then reduced to level zero.
We therefore obtain a final upper bound on the noise
in the canonical embedding for our adversarially generated ciphertexts of
\[ U_2 = U_1 +  \frac{B_\clean^\dishonest}{p_1} + B_\scale. \]
To ensure valid (distributed) decryption, we require
\[ 2 \cdot U_2 \cdot (1+n \cdot 2^\DDsecp) < p_0, \]
i.e. we take $B_\dec=U_2$ in our distributed decryption protocol.
Note, that here we take the worst case bound for the ciphertext
noise, but probabilistic analysis everywhere else. Since
the key generation is assumed to be honestly performed.

This lower bound on $p_0$ ensure valid decryption in our offline phase.
To obtain a valid and secure set of parameters, we search over
all tuples $(N,p_0,p_1)$ satisfying our various constraints for
a given ``size'' of plaintext modulus $p$; including the upper bound
on $q_1=p_0 \cdot p_1$ obtained from the Albrecht's tool via
the table above.

The above circuit is needed for obtaining the sharings of the $c$
value, where we need to obtain a fresh encryption of $c$ in order
to be able to obtain the MAC values.
For the obtaining of the MAC values of the $a$ and $b$ values
we need a simpler circuit, and we use the Distributed Decryption
protocol from \cite{KPR}[Appendix A].

\subsection{Zero Knowledge Proof}
The precise ZKPoK we use is from TopGear \cite{TopGear}, which
is an extension of the HighGear prtoocol from \cite{KPR}.
The precise protocol is given in \figref{PZK1}.
This is an amortized version of the proof from \cite{SPDZ}, in the sense
that the input ciphertexts from all players are simultaneously proved to be
correct.
The proof takes as input a variable $\flag$, which if set to $\Diag$
imposes the restriction that the input plaintexts are ``diagonal'' in
the sense that they encrypt they same value in each slot.
This is needed to encrypt the MAC values at the start of the protcol.
Being diagonal equates to the input plaintext polynomial being the constant
polynomial.

\input{FigZKPoK}

Note the soundness security in the case of $\flag=\Diag$ is only
equal to $2^{-V}$ as opposed to $(2 \cdot \phi(m)+1)^{-V}$.
However, by repeating the ZKPoK a number of times we obtain
the desired soundness security. As this is only done for
the ciphertexts encrypting the MAC keys this is not a problem in
practice.


\documentclass[10pt, a4paper, twoside]{basestyle}

\usepackage[backend=biber,firstinits=true,maxnames=100,style=alphabetic,maxalphanames=4,doi=true,isbn=false,url=false,eprint=true]{biblatex}
\bibliography{bibliography}

\usepackage[Mathematics]{semtex}
\usepackage{chngcntr}
\counterwithout{equation}{section}

%%%% Shorthands.

\newcommand{\p}{\AssociatedLegendreFunctionAstro}

%%%% Title and authors.

\title{%
\textdisplay{%
Geopotential%
}%
}
\author{Pascal~Leroy (phl)}
\begin{document}
\maketitle
\begin{sloppypar}
\noindent
This document describes the computations that are performed by the method \texttt{GeneralSphericalHarmonicsAcceleration} of class \texttt{Geopotential} to determine the acceleration exerted by a non-spherical celestial on a point mass.
\end{sloppypar}

\subsection*{Notation}
Let $\vr$ be the vector going from the centre of the celestial to the point mass.  Let $\tuple{\hat{\vx}, \hat{\vy}, \hat{\vz}}$ be a (direct) base whose $\hat{\vz}$ axis is along the axis of rotation of the celestial and whose $\hat{\vx}$ axis points toward a reference point on the celestial.  In this base $\vr$ has coordinates $\tuple{x, y, z}$ which can be expressed in terms of the latitude $\gb \in \intclos{\frac{\Pi}{2}}{\frac{\Pi}{2}}$ and the longitude
$\gl \in \intclos{0}{2 \Pi}$:
\[
\vr=\begin{pmatrix}
x \\ y \\ z
\end{pmatrix}
=\begin{pmatrix}
r \cos \gb \cos \gl\\
r \cos \gb \sin \gl\\
r \sin \gb
\end{pmatrix}
\]
where $r$ is the norm of $\vr$.  Note that $\cos \gb > 0$, which will come handy when simplifying expressions like $\sqrt{1 - \sin^2 \gb}$.

\subsection*{Potential and acceleration}
The gravitational potential due to the celestial has the form\cite{IERSConventions2010}:
\[
U\of\vr = -\frac{\gm}{r}\pa{1 + \sum{n = 1}[\infty] \sum{m = 0}[n]
\pa{\frac{R}{r}}^n \p{n}{m}\of{\sin \gb}
\pa{C_{n m} \cos m \gl + S_{n m} \sin m \gl}
}
\]
where $\p{n}{m}$ is the associated Legendre function defined as\cite[appendix]{RiesBettadpurEanesKangKoMcCulloughNagelPiePooleRichterSaveTapley2016}:
\[
\p{n}{m} = \pa{1 - t^2}^{\frac{m}{2}} \deriv[m] t {\LegendrePolynomial n\of t}
\]
The terms that are relevant for evaluating the acceleration exerted by the spherical harmonics on the point mass have the form:
\[
V_{n m}\of\vr = \frac{1}{r}\pa{\frac{R}{r}}^n \p{n}{m}\of{\sin \gb}
\pa{C_{n m} \cos m \gl + S_{n m} \sin m \gl}
\]
and the acceleration itself is proportional to $\grad V_{n m}\of\vr$.

$V_{n m}\of\vr$ can be written as the product of a radial term, a latitudinal term and a longitudinal term, dependent of $r$, $\gb$, and $\gl$, respectively:
\[
V_{n m}\of\vr = {\mathfrak R\of r}\,{\mathfrak B\of \gb}\,{\mathfrak L\of \gl}
\]
where:
\[
\begin{dcases}
\mathfrak R\of r &= \frac{1}{r}\pa{\frac{R}{r}}^n\\
\mathfrak B\of \gb &= \p{n}{m}\of{\sin \gb}\\
\mathfrak L\of \gl &= C_{n m} \cos m \gl + S_{n m} \sin m \gl
\end{dcases}
\]
The overall gradient can then be written as:
\[
\grad V_{n m}\of\vr =
{\grad \mathfrak R\of r}\,{\mathfrak B\of \gb}\,{\mathfrak L\of \gl} +
{\mathfrak R\of r}\,{\grad \mathfrak B\of \gb}\,{\mathfrak L\of \gl} +
{\mathfrak R\of r}\,{\mathfrak B\of \gb}\,{\grad \mathfrak L\of \gl}
\]
\subsection*{Lemmata}
To compute the acceleration, we first determine the gradient of various elements appearing in the potential.  The following lemma determines the gradient of the $\mathfrak R$ term:
\begin{lemma}
\[
\grad r^n = n r^{n - 2} \vr\text.
\]
\begin{proof}
We have trivially:
\[
\grad r = \grad \sqrt{x^2 + y^2 + z^2} = \frac{\vr}{r}
\]
from which we deduce:
\[
\grad r^n = n r^{n - 1} \grad r = n r^{n - 2} \vr
\]
\end{proof}
\end{lemma}
The following lemma is useful for computing the gradient of the $\mathfrak B$ term:
\begin{lemma}
\[
\grad \sin \gb =\frac{\cos \gb}{r}\begin{pmatrix}
-\sin \gb \cos \gl \\
-\sin \gb \sin \gl \\
\cos \gb
\end{pmatrix}\text.
\]
\begin{proof}
Noting that $\grad z = \hat{\vz}$ we have:
\[
\grad \sin \gb = \grad \frac{z}{r}
= \frac{r \hat{\vz} - z r^{-1} \vr}{r^2} = \frac{r^2 \hat{\vz} - z \vr}{r^3}
\]
which can be written, in coordinates:
\[
\grad \sin \gb =\frac{1}{r^3}\begin{pmatrix}
-x z \\ -y z \\ x^2 + y^2
\end{pmatrix}
=\frac{1}{r^3}\begin{pmatrix}
-r^2 \sin \gb \cos \gb \cos \gl \\
-r^2 \sin \gb \cos \gb \sin \gl \\
r^2 \cos^2 \gb
\end{pmatrix}
=\frac{\cos \gb}{r}\begin{pmatrix}
-\sin \gb \cos \gl \\
-\sin \gb \sin \gl \\
\cos \gb
\end{pmatrix}
\]
\end{proof}
\end{lemma}
For the $\mathfrak L$ term, we will need to evaluate the quantities:
\[
\begin{cases}
\grad \cos m \gl &= -m \sin m \gl \, \grad \gl \\
\grad \sin m \gl &= m \cos m \gl \, \grad \gl
\end{cases}
\]
The following lemma helps with that computation:
\begin{lemma}
\[
\grad \gl = \frac{1}{r \cos \gb}\begin{pmatrix}
-\sin \gl \\
\cos \gl \\
0
\end{pmatrix}\text.
\]
\begin{proof}
The angle $\gl$ is $\arctan\frac{y}{x}$ thus:
\[
\grad \gl = \frac{1}{1 + \pa{\frac{y}{x}}^2} \grad\of{\frac{y}{x}}
= \frac{1}{1 + \pa{\frac{y}{x}}^2}\frac{x \hat{\vy} - y \hat{\vx}}{x^2}
= \frac{x \hat{\vy} - y \hat{\vx}}{x^2 + y^2}
\]
which can be written, in coordinates:
\[
\grad \gl = \frac{1}{x^2 + y^2}\begin{pmatrix}
-y \\
x \\
0
\end{pmatrix}
= \frac{1}{r^2 \cos^2 \gb}\begin{pmatrix}
-r \cos \gb \sin \gl \\
r \cos \gb \cos \gl \\
0
\end{pmatrix}
= \frac{1}{r \cos \gb}\begin{pmatrix}
-\sin \gl \\
\cos \gl \\
0
\end{pmatrix}
\]
\end{proof}
\end{lemma}
Finally, we will need the gradient of the associated Legendre polynomial, given by the following lemma:
\begin{lemma}
\[
\p{n}{m}'\of{t}
= \pa{1 - t^2}^{\frac{m}{2}}\deriv[m + 1]{t}{\LegendrePolynomial{n}\of t} -
m t \pa{1 - t^2}^{\frac{m - 2}{2}} \deriv[m]{t}{\LegendrePolynomial{n}\of t}\text.
\]
\begin{proof}
This follows trivially from the definition:
\[
\p{n}{m}'\of{t} = \frac{m}{2} \pa{1 - t^2}^{\frac{m}{2} - 1}
\pa{-2 t} \deriv[m]{t}{\LegendrePolynomial{n}\of t} +
\pa{1 - t^2}^{\frac{m}{2}} \deriv[m + 1]{t}{\LegendrePolynomial{n}\of t}
\]
\end{proof}
\end{lemma}
\subsection*{Gradients}
We can now compute the gradient of the three terms that make up $V_{n m}\of\vr$.  First, the radial term:
\[
\grad \mathfrak R\of r = R^n \grad r^{-\pa{n + 1}} = -\pa{n + 1} R^n r^{-\pa{n + 3}} \vr
=-\pa{n + 1}\frac{\mathfrak R\of r}{r^2} \vr
\]
For the latitudinal term, the chain rule yields:
\[
\grad \mathfrak B\of \gb = \p{n}{m}\of{\sin \gb} \, \grad \sin \gb
= \p{n}{m}'\of{\sin \gb} \frac{\cos \gb}{r}\begin{pmatrix}
-\sin \gb \cos \gl \\
-\sin \gb \sin \gl \\
\cos \gb
\end{pmatrix}
\]
Substituting $\sin \gb$ for the argument of $\p{n}{m}$ and its derivative we obtain:
\[
\begin{dcases}
\p{n}{m}\of{\sin \gb} = {\cos^m \gb}
\Evaluate{\deriv[m]{t}{\LegendrePolynomial{n}\of t}}{t = \sin \gb} \\
\p{n}{m}'\of{\sin \gb}
= {\cos^m \gb} \Evaluate{\deriv[m + 1]{t}{\LegendrePolynomial{n}\of t}}{t = \sin \gb} -
m \sin \gb \pa{\cos \gb}^{m - 2}
\Evaluate{\deriv[m]{t}{\LegendrePolynomial{n}\of t}}{t = \sin \gb}
\end{dcases}
\]
and thus:
\[
\begin{dcases}
\mathfrak B\of \gb = {\cos^m \gb}
\Evaluate{\deriv[m]{t}{\LegendrePolynomial{n}\of t}}{t = \sin \gb} \\
\grad \mathfrak B\of \gb = \frac{1}{r}
\pa{\pa{\cos \gb}^{m + 1}
\Evaluate{\deriv[m + 1]{t}{\LegendrePolynomial{n}\of t}}{t = \sin \gb} -
m \sin \gb \pa{\cos \gb}^{m - 1}
\Evaluate{\deriv[m]{t}{\LegendrePolynomial{n}\of t}}{t = \sin \gb}\qquad\ \,}
\begin{pmatrix}
-\sin \gb \cos \gl \\
-\sin \gb \sin \gl \\
\cos \gb
\end{pmatrix}
\end{dcases}
\]
For the longitudinal term we have:
\[
\grad \mathfrak L\of \gl = \pa{-m C_{n m} \sin m \gl + m S_{n m} \cos m \gl} \grad \gl
= \frac{m}{r \cos \gb} \pa{S_{n m} \cos m \gl - C_{n m} \sin m \gl} \begin{pmatrix}
-\sin \gl \\
\cos \gl \\
0
\end{pmatrix}
\]
\subsection*{Singularities}
While the above formulæ are all we need to compute the gradient of the geopotential, they present a number of singularities that require some care for implementation purposes.

There is obviously a pole when $r = 0$.  This one is not very interesting as we are never going to compute the acceleration at the centre of the celestial.

There are however removable singularities that arise when $\cos \gb$ appears at the denominator: any point on the axis of rotation of the celestial has $\cos \gb = 0$, but clearly the acceleration there is finite.

Consider $\grad \mathfrak B\of \gb$.  When $m = 0$ it includes a term in $\pa{\cos \gb}^{-1}$.  However, that term is multiplied by $m$, so it vanishes.  Thus, for $m = 0$ we must use the special formula:
\[
{\grad \mathfrak B\of \gb}_{m = 0} =  \frac{\cos \gb}{r}
\Evaluate{\deriv{t}{\LegendrePolynomial{n}\of t}}{t = \sin \gb}\qquad\begin{pmatrix}
-\sin \gb \cos \gl \\
-\sin \gb \sin \gl \\
\cos \gb
\end{pmatrix}
\]
Similarly $\grad \mathfrak L\of \gl$ has $\cos \gb$ as its denominator.  To eliminate this term we note that $\grad \mathfrak L\of \gl$ always occurs in a product involving $\mathfrak B\of \gb$.  Let's write this product:
\[
{\mathfrak B\of \gb}{\grad \mathfrak L\of \gl} = \frac{m \pa{\cos \gb}^{m - 1}}{r}
\Evaluate{\deriv[m]{t}{\LegendrePolynomial{n}\of t}}{t = \sin \gb}
\pa{S_{n m} \cos m \gl - C_{n m} \sin m \gl}\begin{pmatrix}
-\sin \gl \\
\cos \gl \\
0
\end{pmatrix}
\]
When $m = 0$ this expression has a term in $\pa{\cos \gb}^{-1}$ so we need to special-case it:
\[
{\mathfrak B\of \gb}{\grad \mathfrak L\of \gl}_{m = 0} = 0
\]
\subsection*{Implementation considerations}
A naïve implementation of the preceding formulæ yields poor performance because of the computation of trigonometric functions, powers and polynomials.  It is advantageous
to use simple geometric identities and recurrence formulæ to avoid these computations, at the expense of a small amount of storage.  First, we note that:
\[
x^2 + y^2 = r^2 \cos^2 \gb
\]
and therefore we obtain the trigonometric functions for $\gb$:
\[
\begin{dcases}
\cos \gb = \frac{\sqrt{x^2 + y^2}}{r} \\
\sin \gb = \frac{z}{r}
\end{dcases}
\]
and for $\gl$:
\[
\begin{dcases}
\cos \gl = \frac{x}{\sqrt{x^2 + y^2}} \\
\sin \gl = \frac{y}{\sqrt{x^2 + y^2}}
\end{dcases}
\]
In the case where $\sqrt{x^2 + y^2}$ is $0$, any value will do for $\gl$, so we can for instance pick $\cos \gl = 1$ and $\sin \gl = 0$.

The value of $\cos^m \gb$ may be computed by recurrence with a relative error growing like $\BigO\of m$.  If $m$ is even, we have:
\[
\begin{dcases}
h = \frac m 2 \\
\cos^m \gb = \pa{\cos^h \gb}^2
\end{dcases}
\]
and if $m$ is odd:
\[
\begin{dcases}
h_1 = \Floor{\frac m 2} \\
h_2 = m - h_1 \\
\cos^m \gb = \pa{\cos^{h_1} \gb}\pa{\cos^{h_2} \gb}
\end{dcases}
\]
The value of $\cos m \gl$ and $\sin m \gl$ may similarly be computed using elementary trigonometric identities with an absolute error growing like $\BigO\of {m^2}$.  If $m$ is even, we have:
\[
\begin{dcases}
h = \frac m 2 \\
\cos m \gl = \pa{\cos h \gl + \sin h \gl}\pa{\cos h \gl - \sin h \gl} \\
\sin m \gl = 2 \sin h \gl \cos h \gl
\end{dcases}
\]
and if $m$ is odd:
\[
\begin{dcases}
h_1 = \Floor{\frac m 2} \\
h_2 = m - h_1 \\
\sin m \gl = \sin h_1 \gl \cos h_2 \gl + \cos h_1 \gl \sin h_2 \gl \\
\cos m \gl = \cos h_1 \gl \cos h_2 \gl - \sin h_1 \gl \sin h_2 \gl
\end{dcases}
\]
For the Legendre polynomials, we are looking for a recurrence relationship among terms of the form $\deriv[m]{t}{\LegendrePolynomial{n}\of t}$.  First note that these terms are $0$ when $m > n$.  We start with the recurrence defining the polynomials themselves:
\[
n \LegendrePolynomial{n}\of t = \pa{2 n - 1} t \LegendrePolynomial{n - 1}\of t - \pa{n - 1} \LegendrePolynomial{n - 2}\of t
\]
and we derive $m$ times:
\[
n \deriv[m]{t}{\LegendrePolynomial{n}\of t} = \pa{2 n - 1} \deriv[m]{t}{\pa{t \LegendrePolynomial{n - 1}\of t}} - \pa{n - 1} \deriv[m]{t}{\LegendrePolynomial{n - 2}\of t}
\]
It's easy to verify, by recurrence, that:
\[
\deriv[m]{t}{\pa{t \LegendrePolynomial{n}\of t}} = t \deriv[m]{t}{\LegendrePolynomial{n}\of t} + m \deriv[m - 1]{t}{\LegendrePolynomial{n}\of t}
\]
so we end up with:
\[
n \deriv[m]{t}{\LegendrePolynomial{n}\of t} =
\pa{2 n - 1}\pa{t \deriv[m]{t}{\LegendrePolynomial{n - 1}\of t} + m \deriv[m - 1]{t}{\LegendrePolynomial{n - 1}\of t}} -
\pa{n - 1} \deriv[m]{t}{\LegendrePolynomial{n - 2}\of t}
\]
This recurrence starts with ${\LegendrePolynomial{0}\of t} = 1$, ${\LegendrePolynomial{1}\of t} = t$ and ${\deriv{t}{\LegendrePolynomial{1}\of t}} = 1$.  It is similar to \cite[eqn. (12)]{Westra2017} and makes it possible to efficiently evaluate $\Evaluate{\deriv[m]{t}{\LegendrePolynomial{n}\of t}}{t = \sin \gb}$ for increasing values of $n$ and $m$.
\printbibliography
\end{document}


% Created 2017-06-21 Wed 19:07
% Intended LaTeX compiler: pdflatex
\documentclass[11pt]{article}
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\usepackage{graphicx}
\usepackage{grffile}
\usepackage{longtable}
\usepackage{wrapfig}
\usepackage{rotating}
\usepackage[normalem]{ulem}
\usepackage{amsmath}
\usepackage{textcomp}
\usepackage{amssymb}
\usepackage{capt-of}
\usepackage{hyperref}
\usepackage{xfrac}
\let\originalleft\left
\let\originalright\right
\renewcommand{\left}{\mathopen{}\mathclose\bgroup\originalleft}
\renewcommand{\right}{\aftergroup\egroup\originalright}
\author{Kevin Orr}
\date{1/1/1111}
\title{Project 1 Analysis}
\hypersetup{
 pdfauthor={Kevin Orr},
 pdftitle={Project 1 Analysis},
 pdfkeywords={},
 pdfsubject={},
 pdfcreator={Emacs 25.2.2 (Org mode 9.0.7)},
 pdflang={English}}
\begin{document}

\maketitle

\section{Results}
\label{sec:org018e136}

The provided program was run with all combinations of the sorting algorithms selection sort,
insertion sort, merge sort, and quicksort; and input arrays that are strictly increasing, strictly
decreasing, constant, or randomized. From these results we derive four variables:
\(n_{min}, t_{min}, n_{max}, t_{max}\). They are defined as follows:

\begin{description}
\item[$n_{min}$] The smallest array that took at least 20 ms to sort
\item[$t_{min}$] The time it took to sort the array of size $n_{min}$
\item[$n_{max}$] The largest array that took no longer than 10 minutes to sort
\item[$t_{min}$] The time it took to sort the array of size $n_{max}$
\end{description}

\begin{center}
\begin{tabular}{llrrrr}
Algorithm & Input Type & \(n_{min}\) & \(t_{min}\) & \(n_{max}\) & \(t_{max}\)\\
\hline
selection & increasing & 10000 & 82 & 100000 & 8285\\
selection & decreasing & 10000 & 84 & 100000 & 8421\\
selection & constant & 10000 & 82 & 100000 & 8283\\
selection & random & 10000 & 84 & 100000 & 8420\\
\hline
insertion & increasing & 10000000 & 24 & 1000000000 & 2472\\
insertion & decreasing & 10000 & 46 & 1000000 & 463830\\
insertion & constant & 10000000 & 24 & 1000000000 & 2477\\
insertion & random & 10000 & 46 & 1000000 & 464006\\
\hline
mergesort & increasing & 1000000 & 42 & 1000000000 & 62201\\
mergesort & decreasing & 1000000 & 115 & 1000000000 & 172232\\
mergesort & constant & 1000000 & 43 & 1000000000 & 62500\\
mergesort & random & 1000000 & 115 & 1000000000 & 172469\\
\hline
quicksort & increasing & 1000000 & 33 & 1000000000 & 46599\\
quicksort & decreasing & 1000000 & 116 & 1000000000 & 170442\\
quicksort & constant & 10000 & 35 & 100000 & 3512\\
quicksort & random & 1000000 & 116 & 1000000000 & 170431\\
\end{tabular}
\end{center}

\section{Plots}
\label{sec:orgad55c5e}

The following plots show the behavior for our four sorting algorithms. Each algorithm was
tested with array sizes of \(n 10^m \le 10^9\) for
\(n \in \{1, 2, 3, 4, 5, 6, 7, 8, 9\}, m \in \{0, 1, 2, 3, 4, 5, 6, 7, 8, 9\}\).

\subsection{Selection Sort}
\label{sec:org20e9e2f}
\begin{center}
\includegraphics[width=10cm]{./output/selection.png}
\end{center}

\subsection{Insertion Sort}
\label{sec:orgc699f08}
\begin{center}
\includegraphics[width=10cm]{./output/insertion.png}
\end{center}

\subsection{Merge Sort}
\label{sec:org92d86f9}
\begin{center}
\includegraphics[width=10cm]{./output/mergesort.png}
\end{center}

\subsection{QuickSort}
\label{sec:org47cd91a}
\begin{center}
\includegraphics[width=10cm]{./output/quicksort.png}
\end{center}

\section{Analysis}
\label{sec:orgc51d159}

The results from section \ref{sec:org018e136} were then used in the following calculations to determine the
time complexity of the sorting algorithms. For each
\(f_i \in \left\{ f_1(n) = n, f_2(n) = n \lg n, f_3(n) = n^2 \right\}\),
I compared \(f_i(n_{max})/f_i(n_{min})\) to \(t_{max}/t_{min}\). Ideally, the first ratio should
be sufficiently close to the second when \(f_i(n)\) corresponds to the theoretical time complexity
of the algorithm of interest. These ratios are shown in the following table:

\begin{center}
\begin{tabular}{llrrrr}
Algorithm & Input Type & \(t_{max}/t_{min}\) & \(n_{max}/n_{min}\) & \(\frac{n_{max} \lg n_{max}}{n_{min} \lg n_{min}}\) & \(n_{max}^2/n_{min}^2\)\\
\hline
selection & increasing & 101.03658 & 10.0 & 12.5 & 100.0\\
selection & decreasing & 100.25 & 10.0 & 12.5 & 100.0\\
selection & constant & 101.01219 & 10.0 & 12.5 & 100.0\\
selection & random & 100.2381 & 10.0 & 12.5 & 100.0\\
\hline
insertion & increasing & 103.0 & 100.0 & 128.57143 & 10000.0\\
insertion & decreasing & 10083.261 & 100.0 & 150.0 & 10000.0\\
insertion & constant & 103.208336 & 100.0 & 128.57143 & 10000.0\\
insertion & random & 10087.087 & 100.0 & 150.0 & 10000.0\\
\hline
mergesort & increasing & 1480.9762 & 1000.0 & 1500.0 & 1000000.0\\
mergesort & decreasing & 1497.6696 & 1000.0 & 1500.0 & 1000000.0\\
mergesort & constant & 1453.4884 & 1000.0 & 1500.0 & 1000000.0\\
mergesort & random & 1499.7305 & 1000.0 & 1500.0 & 1000000.0\\
\hline
quicksort & increasing & 1412.091 & 1000.0 & 1500.0 & 1000000.0\\
quicksort & decreasing & 1469.3276 & 1000.0 & 1500.0 & 1000000.0\\
quicksort & constant & 100.34286 & 10.0 & 12.5 & 100.0\\
quicksort & random & 1469.2328 & 1000.0 & 1500.0 & 1000000.0\\
\end{tabular}
\end{center}

\subsection{Theoretical time complexities}
\label{sec:org3fa29e7}

\begin{center}
\begin{tabular}{llll}
Algorithm & Best-case & Average-case & Worst-case\\
\hline
selection & \(\Theta\left(n^2\right)\) & \(\Theta\left(n^2\right)\) & \(\Theta\left(n^2\right)\)\\
insertion & \(\Omega(n)\) & \(\Theta\left(n^2\right)\) & \(\textrm{O}\left(n^2\right)\)\\
mergesort & \(\Theta(n \lg n)\) & \(\Theta(n \lg n)\) & \(\Theta(n \lg n)\)\\
quicksort & \(\Omega(n \lg n)\) & \(\Theta(n \lg n)\) & \(\textrm{O}\left(n^2\right)\)\\
\end{tabular}
\end{center}

\subsection{Inferred time complexity of each case}
\label{sec:org194729f}

After comparing the two previous tables, the following conclusions were made:

\begin{center}
\begin{tabular}{llll}
Algorithm & Input Type & Complexity & Case\\
\hline
selection & increasing & \(\Theta\left(n^2\right)\) & Any\\
selection & decreasing & \(\Theta\left(n^2\right)\) & Any\\
selection & constant & \(\Theta\left(n^2\right)\) & Any\\
selection & random & \(\Theta\left(n^2\right)\) & Any\\
\hline
insertion & increasing & \(\Theta(n)\) & Best\\
insertion & decreasing & \(\Theta\left(n^2\right)\) & Worst\\
insertion & constant & \(\Theta(n)\) & Best\\
insertion & random & \(\Theta\left(n^2\right)\) & Average\\
\hline
mergesort & increasing & \(\Theta(n \lg n)\) & Any\\
mergesort & decreasing & \(\Theta(n \lg n)\) & Any\\
mergesort & constant & \(\Theta(n \lg n)\) & Any\\
mergesort & random & \(\Theta(n \lg n)\) & Any\\
\hline
quicksort & increasing & \(\Theta(n \lg n)\) & Best or Average\\
quicksort & decreasing & \(\Theta(n \lg n)\) & Best or Average\\
quicksort & constant & \(\Theta\left(n^2\right)\) & Worst\\
quicksort & random & \(\Theta(n \lg n)\) & Best or Average\\
\end{tabular}
\end{center}

\section{Remarks}
\label{sec:org35a8301}

Most of the timed results were quite spot-on when compared to the theoretical
time complexities. The most inaccurate ratio was quicksort with an increasing
input array, but this was only \textasciitilde{}5.9\% off.
\end{document}