\subsection{Descriptions of Error}\label{sec:set-error}
If we assume $\observed$ is absolutely continuous with respect to $\dmeas$, we can describe $\observed$ with a density $\observedP$. Then, for any partition $\set{D_\idisc}_{\idisc=1}^{\ndiscs}$ of $\dspace$,
\[
\observed (D_\idisc) = \int_{D_\idisc} \observed \, \dmeas, \quad \text{ for } \idisc = 1, \hdots, \ndiscs.
\]

We often use Monte Carlo approximations to compute the approximations $p_{\dspace, \idisc}=\observed(D_\idisc)$ in the first for-loop in Algorithm~\ref{alg:inv_density}.
These samples are generated on $\dspace$ and do not require numerical solutions to the model.
We therefore assume that for any discretization of $\dspace$, these approximations can be made sufficiently accurate and neglect the error in this computation.

We denote the exact solution to the SIP associated with this partitioning of $\dspace$ by $\PP_{\pspace, \ndiscs}$.
In situations where $\qoi(\param^{(\iparam)})$ is estimated (e.g. by application of a functional on a finite-element solution to a PDE), the approximate solutions to the SIP given in the final for-loop of Algorithm~\ref{alg:inv_density} are denoted by $\PP_{\pspace, \ndiscs, \nsamps, h}$.
Here, the $h$ is in reference to a mesh or other numerical parameter that determines the accuracy of the numerical solution $u_h(\param^{(\iparam)})\approx u(\param^{(\iparam)})$, and subsequently the accuracy in the computations of $\qoi_\iparam = \qoi(\param^{(\iparam)})$ in Algorithm~\ref{alg:inv_density}.
Then, by repeated application of the triangle inequality,
\begin{equation}
\label{eq:set-triangleineq}
d(\PP_{\pspace, \ndiscs, \nsamps, h}, \paramP) \leq
\underset{ \text{(E1)} }{\underbrace{d(\PP_{\pspace, \ndiscs, \nsamps, h},\PP_{\pspace, \ndiscs, \nsamps})}} +
\underset{ \text{(E2)} }{\underbrace{d(\PP_{\pspace, \ndiscs, \nsamps}, \PP_{\pspace, \ndiscs}) }}+
\underset{ \text{(E3)} }{\underbrace{d(\PP_{\pspace, \ndiscs}, \paramP) }}.
\end{equation}

The term (E1) describes the effect of the error in the numerically evaluated $\qoi_\iparam$ on the solution to the SIP.
The term (E2) describes the effect of finite sampling error in $\pspace$ on the solution to the SIP and (E3) describes the effect of discretization error of $\observed$ on the solution to the SIP.

We assume that $h$ is tunable so that for any $A\in \pborel$,
\[
\lim\limits_{h \downarrow 0} \PP_{\pspace, \ndiscs, \nsamps, \imesh} (A) = \PP_{\pspace, \ndiscs, \nsamps} (A).
\]
It is possible to prove the convergence of $\PP_{\pspace, \ndiscs, \nsamps, \imesh} (A) \to \paramP (A)$ for some $A\in \pborel$ and on estimating the error in $\PP_{\pspace, \ndiscs, \nsamps, h}(A)$.
For example, in \cite{BGE+15}, adjoint-based a posteriori estimates in the computed QoI are combined with a statistical analysis to both estimate and bound the error in $\PP_{\pspace, \ndiscs, \nsamps, \imesh} (A)$.
In \cite{JNME19}, adjoints are used to compute both error and derivative estimates of $\qoi(\param^{(\iparam)})$ to improve the accuracy in $\PP_{\pspace, \ndiscs, \nsamps, \imesh} (A)$.
Since the error due to $\imesh$ can be estimated as described in previous studies, and $\ndiscs$ can be made arbitrarily large, we neglect (E1) and (E3) here.
Thus, we limit our focus to (E2), where certain geometric properties of the QoI map (namely, skewness), are known to significantly impact this term.

\FloatBarrier


\documentclass{beamer}
\usepackage[utf8]{inputenc}

\input{../../shared.tex}

\title{Newton's and Quasi-Newton Methods}
\date{\today}

\begin{document}
\maketitle
\frame{\tableofcontents[]}

\section{Introduction}

\begin{frame}
  \frametitle{$1$-dimensional case: Newton-Raphson method}
  \textcolor{blue}{Objective:} Find zero of differentiable $f: \R \to \R$.
  \vspace{0.3cm}
  \begin{minipage}{0.48\textwidth}
    \textcolor{blue}{Strategy:} Solve
    \begin{equation}
      f(x_k) + f'(x_k) (x - x_k) = 0.
    \end{equation}
    \textcolor{blue}{Method:} Gives
    \begin{equation}
      x_{k+1} = x_k - \frac{f(x_k)}{f'(x_k)}
    \end{equation}
  \end{minipage}
  \hfill
  \begin{minipage}{0.48\textwidth}
    \begin{figure}[ht]
      \centering
      \includegraphics[width=\textwidth,height=\textheight,keepaspectratio]{newton-raphson}
      % \caption{\label{fig:label} }
    \end{figure}
  \end{minipage}
\end{frame}

\begin{frame}
  \frametitle{The Babylonian method}
  \begin{itemize}
    \item \textcolor{blue}{compute square root} of $R \in \R_+$
    \item find zero of $f(x) = x^2 - R$
    \item use Newton-Raphson:
          \begin{equation}
            x_{k+1} = x_k - \frac{f(x_k)}{f'(x_k)} = x_k - \frac{x_k^2 - R}{2 x_k} = \frac12 \left( x_k + \frac{R}{x_k} \right)
          \end{equation}
    \item Starting from $x_0 > 0$ we have
          \begin{equation}
            x_{k+1} = \frac12 \left( x_k + \frac{R}{x_k} \right) \ge \frac{x_k}{2}.
          \end{equation}
    \item Starting from $x_0 = R \ge 1$, it takes $\mathcal{O}(\log R)$ steps to get to $x_k - \sqrt{R} < \frac12$.
  \end{itemize}
\end{frame}

\begin{frame}
  \frametitle{The Babylonian method - Takeoff}
  \onslide<1>{%
    Note that
    \begin{equation}
      x_{k+1} - \sqrt{R} = \frac12 \left( x_k + \frac{R}{x_k} \right) - \sqrt{R} = \frac{x_k}{2} + \frac{R}{2 x_k} - \sqrt{R} = \frac{1}{2 x_k} {\left( x_k - \sqrt{R} \right)}^2
    \end{equation}
    For simplicity $R \ge 1/4$, then $x_k \ge \sqrt{R} \ge 1/2$. Hence
    \begin{equation}
      x_{k+1} - \sqrt{R} = \frac{1}{2 x_k} {\left( x_k - \sqrt{R} \right)}^2 \le {\left( x_k - \sqrt{R} \right)}^2
    \end{equation}
  }

  \onslide<2->{%
    If $x_0 - \sqrt{R} < \frac12$ (ensured after $\mathcal{O}(\log R)$ steps).
    \begin{equation}
      x_{k} - \sqrt{R} \le {\left( x_0 - \sqrt{R} \right)}^{2^k} \le {\left(\frac12\right)}^{2^k}
    \end{equation}
    To achieve $x_k - \sqrt{R} < \epsilon$ we only need $k = \log \log (\epsilon^{-1})$ steps!
  }
\end{frame}

\begin{frame}
  \frametitle{The Babylonian method - Example}
  $R=1000$, in double arithmetic
  \begin{itemize}
    \item $7$ steps to get to $x_7 - \sqrt{1000} < 1/2$
          \item $3$ steps to get to $\sqrt{1000}$ up to \textit{machine precision}
          \item First phase: $\approx$ \textcolor{blue}{one more correct digit} per iteration
          \item Second phase: $\approx$ \textcolor{blue}{double the number of correct digits} per iteration
  \end{itemize}

  \begin{center}
    In practice: $\log \log x \le 5$.
  \end{center}

\end{frame}

\section{Newton's method}%

\begin{frame}
  \frametitle{Newton's method for optimization}
  \begin{itemize}
    \item \textcolor{blue}{Goal:} Find global minimum $x^*$ of convex, differentiable function $f$.
    \item \textcolor{blue}{Strategy:} Search for zero of derivative.
    \item \textbf{$1$-dimensional case:} Apply Newton-Raphson method to $f'$:
          \begin{equation}
            x_{k+1} = x_k - \frac{f'(x_k)}{f''(x_k)} = x_k - {f''(x_k)}^{-1} f(x_k)
          \end{equation}
          (requires \textcolor{blue}{twice} differentiable and $f'' > 0$)

    \item \textbf{$d$-dimensional case:} Newtons methods for minimizing convex $f: \R^d \to \R$:
          \begin{equation}
            x_{k+1} = x_k - \nabla^2 f(x_k) \nabla f(x_k).
          \end{equation}
  \end{itemize}
\end{frame}

\begin{frame}
  \frametitle{Newton's method as adaptive gradient descent}
  General update scheme:
  \begin{equation}
    x_{k+1} = x_k - H(x_k) \nabla f(x_k)
  \end{equation}
  for some matrix $H(x) \in \R^{d \times d}$.
  \begin{itemize}
    \item \textcolor{blue}{Newton's method}: $H = {\nabla^2 f(x_k)}^{-1}$.
    \item \textcolor{blue}{Gradient descent}: $H = \alpha \Id$
  \end{itemize}
  \vspace{1cm}
 \begin{block}{}
  Newton's methods \textbf{adapts} to the local geometry of $f$ at $x_k$ \\
 \end{block}
  $\rightarrow$ \textit{no need for choosing a stepsize}.
\end{frame}

\begin{frame}
  \frametitle{Convergence in one step on quadratic functions}
  A \textcolor{blue}{quadratic} function
  \begin{equation}
    f(x) = \frac12 x^T M x + q^T x + c
  \end{equation}
  is called \textit{nondegenerate} if $M \in \R^{d \times d}$ is invertible.
  \begin{itemize}
    \item $x^* := M^{-1}q$ is the unique solution of $\nabla f(x) = 0$
    \item $x^*$ is the unique global minimum if $f$ is convex
  \end{itemize}
  \begin{lemma}%
    On nondegenerate quadratic functions with arbitrary starting point $x_0$, Newtons method yields $x_1=x^*$
  \end{lemma}
  \begin{proof}
    We have $\nabla f(x) = Mx -q$ and $\nabla^2 f(x) = M$. Therefore
    \begin{equation}
      x_1 = x_0 - \nabla^2 f(x_0) \nabla f(x_0) = x_0 - M^{-1}(M x_0 - q) = M^{-1}q = x^*. \qed\qedhere
    \end{equation}
  \end{proof}
\end{frame}

\begin{frame}
  \frametitle{Affine Invariance}
  Newton’s method is \textcolor{blue}{affine invariant}
  (invariant under any invertible affine transformation):
  Denote the Newton step for $h$ by
  \begin{equation}
    N_h(x) := x - {\nabla^2 h }^{-1} \nabla h(x).
  \end{equation}
  \begin{lemma}%
    Let $f: \R^d \to \R$ be twice differentiable, $A \in \R^{d \times d}$ an invertible matrix and $b \in \R^d$.
    \begin{equation}
      g(x) = Ax + b.
    \end{equation}
    Then
    \begin{equation}
      N_{f \circ g} = g^{-1} \circ N_f \circ g
    \end{equation}
  \end{lemma}
\end{frame}

\begin{frame}
  \frametitle{}
  \begin{figure}[ht]
    \centering
    \includegraphics[width=\textwidth,height=\textheight,keepaspectratio]{newton_aff_invariance}
    % \caption{\label{fig:label} }
  \end{figure}
  Gradient descent suffers if coordinates are at different scales; Newton's method doesn't.
\end{frame}

\begin{frame}
  \frametitle{Minimizing the second-order Taylor approximation}
  Alternative interpretation of Newton's method:
  Minimize (local) \textcolor{blue}{quadratic model} of $f$.
  \begin{lemma}%
    Let $f$ be conve, twice differentiable and $\nabla^2 f(x) \succ 0$. Then $x_{k+1}$ resulting from \textbf{Newton's step} satisfies
    \begin{equation}
      x_{k+1} = \argmin_{x \in \R^d} f(x_k) + \langle \nabla f(x_k), x-x_k \rangle + \frac12 \langle x-x_k, \nabla^2 f(x_k) (x-x_k)  \rangle
    \end{equation}
  \end{lemma}
\end{frame}

\begin{frame}
  \frametitle{Local Convergence}
  We will prove:\\
  Under suitable conditions on $f$ and \textcolor{blue}{close to the minimum} Newton's method approximates solution up to an error $\epsilon$ in \textcolor{blue}{$\log \log (1/\epsilon)$} iterations.
  \begin{itemize}
    \item much faster than anything so far..
    \item only locally
  \end{itemize}
  We call this a \textcolor{blue}{local convergence} result.\\

  \textcolor{blue}{Global convergence} statements are more difficult to obtain (some only recently).
\end{frame}

\section{Convergence analysis}%

\begin{frame}
  \frametitle{Theorem + Technical conditions }
  \begin{theorem}
    Let $f$ be convex with unique global minimum $x^*$, and $X$ a ball around $x^*$ s.t.
    \begin{enumerate}
      \item \textcolor{blue}{Bounded inverse Hessians:} There exists $\mu > 0$
            \begin{equation}
              \Vert {\nabla^2 f(x)}^{-1} \Vert \le \frac{1}{\mu}, \quad \forall x \in X
            \end{equation}
      \item \textcolor{blue}{Lipschitz continuous Hessians:} There exists $B>0$
            \begin{equation}
              \Vert \nabla^2 f(x) - \nabla^2 f(y) \Vert \le B \Vert x-y \Vert, \quad \forall x,y \in X
            \end{equation}
    \end{enumerate}
    Then, for $x_{k+1} = N_f(x_k)$ we have
    \begin{equation}
      \Vert x_{k+1} -x^* \Vert \le \frac{B}{2 \mu} \Vert x_k - x^* \Vert^2
    \end{equation}
  \end{theorem}
\end{frame}

\begin{frame}
  \frametitle{Super-exponential speed}
  \begin{corollary}%
    In the setting of previous theorem, if
    \begin{equation}
      \Vert x_k - x^* \Vert \le \frac{\mu}{B},
    \end{equation}
    then
    \begin{equation}
      \Vert x_k -x^*  \Vert \le \frac{\mu}{B} {\left( \frac{1}{2} \right)}^{2^k-1}
    \end{equation}
  \end{corollary}
  Close to the global minimum, we will reach distance to the minumum less than $\epsilon$ in at most $\log \log (1/\epsilon)$ steps.

  As for the last phase of Babylonian method.
\end{frame}

\begin{frame}
  \frametitle{Super-exponential speed - intuition}

  \begin{itemize}
    \item Almost constant Hessians close to optimality...
    \item so $f$ behaves almost like a quadratic
    \item on which Newton's converge in one step
  \end{itemize}

  \begin{lemma}%
    If
    \begin{equation}
      \Vert x_0 - x^* \Vert \le \frac{\mu}{B}
    \end{equation}
    the Hessians in Newton's method satisfy the \textcolor{blue}{relative error bound}
    \begin{equation}
      \frac{\Vert  \nabla^2 f(x_k) - \nabla^2 f(x^*) \Vert}{\Vert \nabla^2 f(x^*) \Vert} \le {\left( \frac12 \right)}^{2^k-1}.
    \end{equation}
  \end{lemma}
\end{frame}

\begin{frame}
  \frametitle{Proof of convergence theorem}
  We abbreviate $H = \nabla^2 f(x_k)$, $x=x_k$, $x^+ = x_{k+1}$
  \begin{equation}
    \begin{aligned}
      x^+ - x^* &= x - x^* - H^{-1} \nabla f(x) \\
      &= x - x^* + H^{-1}( \nabla f(x^*) - \nabla f(x)) \\
      &= x - x^* + H^{-1} \int_{0}^{1} H(x + t(x^* - x))(x^* - x) \diff t,
    \end{aligned}
  \end{equation}
  \onslide<2->{%
    where we used the fundamental theorem of calculus
    \begin{equation}
      \int_{a}^{b} h' (t) \diff t
    \end{equation}
    with
    \begin{align}
      h(t)  &= \nabla f(x + t(x^* -x )) \\
      h'(t) &= \nabla^2f (x + t(x^* -x ))(x^*-x).
    \end{align}
  }
\end{frame}

\begin{frame}
  \frametitle{Proof of convergence theorem II}
  So far
  \begin{equation}
      x^+ - x^* = x - x^* + H^{-1} \int_{0}^{1} H(x + t(x^* - x))(x^* - x) \diff t
  \end{equation}
  With
  \begin{equation}
    x- x^* = {H(x)}^{-1} \int_{0}^{1} - H(x)(x^*-x)
  \end{equation}
  we get
  \begin{equation}
    x^+ - x^* =  H^{-1} \int_{0}^{1} (H(x + t(x^* - x))- H(x))(x^* - x) \diff t.
  \end{equation}
  Using norms
  \begin{equation}
    \Vert x^+ - x^*  \Vert \le  \Vert H^{-1} \Vert \left\Vert  \int_{0}^{1} H(x + t(x^* - x))- H(x)(x^* - x) \diff t \right\Vert
  \end{equation}
\end{frame}

\begin{frame}
  \frametitle{Proof of convergence theorem III}

  \begin{align}
    \Vert x^+ - x^*  \Vert &=  \Vert H^{-1} \Vert \left\Vert  \int_{0}^{1} (H(x + t(x^* - x))- H(x))(x^* - x) \diff t \right\Vert \\
    &\le \Vert H^{-1} \Vert  \Vert x^* - x \Vert \int_{0}^{1} \left\Vert  (H(x + t(x^* - x))- H(x)) \right\Vert \diff t
  \end{align}
  Use \textbf{bounded inverse Hessians} and \textbf{Lipschitz continuity} of the Hessian to conclude
  \begin{align}
    \Vert x^+ - x^*  \Vert  &\le \frac{1}{\mu} \Vert x^* - x \Vert \int_{0}^{1} B \Vert t(x^*-x) \Vert \diff t  \\
    &= \frac{B}{\mu} \Vert x^*-x \Vert^2 \int_{0}^{1}t \diff t = \frac{B}{2\mu} \Vert x-x^* \Vert^2. \qed
  \end{align}

\end{frame}

\begin{frame}
  \frametitle{Strong convexity $\Rightarrow$ Bounded inverse Hessians}

  \begin{itemize}
    \item How to ensure bounded inverse Hessians?
  \end{itemize}

  \begin{lemma}%
    Let $f: \R^d \to \R$ be $C^2$ and \textbf{strongly convex} with parameter $\mu$, i.e.\
    \begin{equation}
      f(y) \ge f(x) \langle \nabla f(x), y-x \rangle + \frac{\mu}{2} \Vert y-x \Vert^2, \quad \forall x,y.
    \end{equation}
  Then, $\nabla^2 f(x)$ is invertible and $\Vert \nabla^2 f(x) \Vert^{-1} \le 1/\mu$ for all $x$.
  \end{lemma}

\end{frame}

\begin{frame}
  \frametitle{Downside of Newton's method}
  \textcolor{blue}{Computational bottleneck} in every step:
  \begin{itemize}
    \item compute Hessian
    \item invert Hessian or solve $\nabla^2 f(x_k) \Delta x = - \nabla f(x_k)$
  \end{itemize}
  \vspace{1cm}
  Matrix has size $d\times d$, taking $\mathcal{O}(d^3)$ to invert.\\
  In many applications the dimension $d$ is large (too large to even store Hessian).

  \vspace{1cm}
  When training a ML model $d$ is the \textit{number or parameters} of our ML model (number of features for linear model).
\end{frame}

\section{Quasi-Newton methods}%

\begin{frame}
  \frametitle{The secant method}
  Another iterative method for finding zeros in $1$-d.
  Recall Newton-Raphson:
  \begin{equation}
    x_{k+1} = x_k - \frac{f(x_k)}{f'(x_k)}
  \end{equation}
  Use \textcolor{blue}{finite difference approximation} of $f'(x_k)$:
  \begin{equation}
    f'(x_k) \approx \frac{f(x_k) - f(x_{k-1})}{x_k - x_{k-1}}.
  \end{equation}
  We obtain the \textcolor{blue}{\textbf{secant method}}:
  \begin{equation}
    x_{k+1} = x_k - f(x_k) \frac{x_k - x_{k-1}}{f(x_k) - f(x_{k-1})}.
  \end{equation}

\end{frame}

\begin{frame}
  \frametitle{The secant method II}
  \begin{figure}[ht]
    \centering
    \includegraphics[width=0.7\textwidth,keepaspectratio]{secant_method}
  \end{figure}
  Constructs the line through $(x_{k-1}, f(x_{k-1}))$ and $(x_k, f(x_k))$.
\end{frame}

\begin{frame}
  \frametitle{The secant method III}
  \begin{itemize}
    \item is a \emph{derivative-free} version of the Newton-Raphson method.
    \item \textcolor{blue}{For optimization}: Apply secant method to $f'$ to optimize $f$:
          \begin{equation}
            x_{k+1} = x_k - f'(x_k) \frac{x_k - x_{k-1}}{f'(x_k) - f'(x_{k-1})}.
          \end{equation}
    \item yields a \textcolor{blue}{second-derivative free} version of Newton's method.
  \end{itemize}

  \vspace{1cm}

  \onslide<2->{%
    \begin{center}
      \textit{What abouthigher dimensions? Can't divide vectors..}
    \end{center}
  }
\end{frame}

\begin{frame}
  \frametitle{The secant condition}
  In $1$-d:
  \begin{align}
    H_k &:= \frac{f'(x_k) - f'(x_{k-1})}{x_k - x_{k-1}} \approx f''(x_k) \\
    &\Leftrightarrow f'(x_k) - f'(x_{k-1}) = H_k (x_k - x_{k-1}),
  \end{align}
  the \textcolor{blue}{secant condition}.
  \begin{itemize}
    \item Newton's method: $x_{k+1} = x_k - {f''(x_k)}^{-1} f'(x_k)$
    \item Secant method: $x_{k+1} = x_k - {H_k}^{-1} f'(x_k)$
  \end{itemize}
\end{frame}

\begin{frame}
  \frametitle{Quasi-Newton methods}

  \begin{equation}
    \nabla f(x_k) - \nabla f(x_{k-1}) = H_k (x_k - x_{k-1}) \approx \nabla^2 f(x_k) (x_k - x_{k-1})
  \end{equation}
  We therefore hope that $H_k \approx \nabla^2 f(x_k)$.

  \begin{equation}
    \text{Secant:} \quad x_{k+1} = x_k = H_k^{-1} \nabla f(x_k)
  \end{equation}

  \begin{itemize}
    \item $d=1$: unique number $H_k$ satisfying the secant condition
    \item $d>0$: secant condition $\nabla f(x_k) - \nabla f(x_{k-1}) = H_k (x_k - x_{k-1})$ has \textbf{infinitely} many \textit{symmetric} solutions
  \end{itemize}

  \begin{block}{}
    \textit{Any scheme of choosing in each step of the secant method a symmetric $H_k$ that satisfies the secant condition defines a \textcolor{blue}{Quasi-Newton method}.}
  \end{block}

\end{frame}

\begin{frame}
  \frametitle{Quasi-Newton methods II}

  \begin{itemize}
    \item Newton’s method is a Quasi-Newton method if and only if f is a nondegenerate \textbf{quadratic} function.
    \item Hence, Quasi-Newton methods \textit{do not generalize} Newton’s method but form a
          family of \textit{related} algorithms.
    \item First Quasi-Newton method by William Davidon in 1956
    \item But the paper got rejected for lacking a convergence analysis,
    \item was finally officially published in 1991
    \item \textcolor{blue}{methods of choice} in a number of relevant machine learning applications
  \end{itemize}

\end{frame}

\begin{frame}
  \frametitle{Developing a Quasi-Newton method}
  \begin{itemize}
    \item We want to avoid matrix inversion
          $\Rightarrow$ directly deal with the inverse $H_k^{-1}$
    \item \textcolor{blue}{Given:} iterates $x_{k-1}, x_k$ and matrix $H_{k-1}^{-1}$
    \item \textcolor{blue}{Seeking:} next matrix $H_k^{-1}$ needed in next Quasi-Newton step
          \begin{equation}
            x_{k+1} = x_k = H_k^{-1} \nabla f(x_k)
          \end{equation}
    \item How to choose $H_k^{-1}$?
    \item Newton’s method: $\nabla^2 f(x_k)$ fluctuates only very little in the region of very fast convergence.
    \item Makes sense to have $H_k \approx H_{k-1}$ or $H_k^{-1} \approx H_{k-1}^{-1}$
  \end{itemize}
\end{frame}

\begin{frame}
  \frametitle{Greenstadt's family of Quasi-Newton methods}
  Greenstadt [Gre70]: Update
  \begin{equation}
    H_k^{-1} = H_{k-1}^{-1} + E_k,
  \end{equation}
  with $E_k$ an error matrix.
  \begin{itemize}
    \item Try to \textcolor{blue}{minimize error} subject to $H_k$ satisfying the \textbf{secant condition}!
  \end{itemize}

  Simple error measure: Frobenius norm
  \begin{equation}
    \Vert E \Vert_F^2 := \sum_{i=1}^{d} \sum_{j=1}^{d} E_{ij}^2
  \end{equation}
\end{frame}

\begin{frame}
  \frametitle{BFGS method}
  \begin{itemize}
    \item special version of Greenstadt
    \item is named after Broyden, Fletcher, Goldfarb and Shanno
          who all came up with it independently around 1970. Greenstadt’s name is
          mostly forgotten.
    \item Newton’s method needs to compute and invert
          Hessians $\rightarrow$ cost of $\mathcal{O}(d^3)$ per iteration
    \item Any method in Greenstadt’s family avoids computation of Hessian.
          \textbf{Only gradients are needed}.
    \item In the BFGS method, the cost per iteration drops to $\mathcal{O}(d^2)$.
    \item even this can be prohibitive $\rightarrow$ limited memory BFGS
    \item uses observation that we do not need $H_{k}^{-1}$, only $H_{k}^{-1} \nabla f(x_k)$
  \end{itemize}

\end{frame}
\end{document}


\section{The Generic MST Algorithm}	\label{section:mst-generic-alg}

%%%%%%%%%%%%%%%%%%%%
\begin{frame}{The Generic MST Algorithm}
  \begin{description}
	\setlength{\itemsep}{5pt}
	\item<1->[Overview:] Grow the MST one edge at a time
	\item<2->[State:] Manage a set of edges $X$
	\item<3->[\textcolor{red}{\bf Invariant:}] $X$ is a subset of some MST
	\item<4->[Init:] $X = \emptyset$
	\item<5->[Iteration:] Find \only<5>{an edge}\only<6->{a \textcolor{red}{\bf safe} edge} $e$ {\it s.t.}
	  \\ $X \cup \set{e}$ is also a subset of some MST
	\item<7->[Termination:] $(n-1)$ iterations
  \end{description}

  \vspace{0.20cm}
  \uncover<8->{
	\begin{center}
	  \textcolor{brown}{\large How to find a safe $e$ for $X$ in each iteration?}
	\end{center}
  }
\end{frame}
%%%%%%%%%%%%%%%%%%%%
\begin{frame}{The Cut Property}
	Given that $X$ is part of some MST $T$:
	\vspace{0.10cm}
    \begin{itemize}
	  \setlength{\itemsep}{3pt}
      \item<2-> A cut $(S, V \setminus S)$ \textcolor{red}{\bf respecting} $X$ ($X$ does not cross $(S, V \setminus S)$)
	  \item<6-> $e$: a lightest edge across $(S, V \setminus S)$
	\end{itemize}
	\vspace{0.10cm}
	Then, $X + \set{e}$ is also a part of some MST $T'$.

  \importikznocaption{0.50\textwidth}{0.50\textwidth}{tikz-in-beamer/cut-property-example-overlay.tex}
\end{frame}
%%%%%%%%%%%%%%%%%%%%
\begin{frame}{The Cut Property}
  \begin{enumerate}
	\item<1-> $X \subseteq T, \textcolor{blue}{e \in T} \Rightarrow X + \set{e} \subseteq T$
	\item<2-> $X \subseteq T, \textcolor{red}{e \notin T} \Rightarrow X + \set{e} \subseteq T'$.
  \end{enumerate}

  \vspace{-0.30cm}

  \importikznocaption{0.35\textwidth}{0.35\textwidth}{tikz-in-beamer/cut-property-proof-clrs-overlay.tex}

  \begin{itemize}
	\item<5-> $T + \set{e} \Longrightarrow$ cycle $C$ ($uv + P_{u \leadsto v}$)
	\item<6-> $\exists e' \in P_{u \leadsto v} \colon e'$ across the cut; $w(e') \geq w(e)$
    \item<7-> $T' = T + \set{e} - \set{e'}$ is an ST
    \item<8-> $w(T') \le w(T) \Rightarrow T' \textrm{ is an MST}$
	\item<9-> $e' \notin X {\scriptsize (\textcolor{red}{\bf respect})} \Rightarrow X + \set{e} \subseteq T'$
  \end{itemize}
\end{frame}
%%%%%%%%%%%%%%%%%%%%


\documentclass[12pt]{cdblatex}
\usepackage{exercises}
\usepackage{fancyhdr}
\usepackage{footer}

\begin{document}

% --------------------------------------------------------------------------------------------
\section*{Exercise 2.5 Combining rules -- a solution}

\begin{cadabra}
   {a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u#}::Indices(position=independent).

   \nabla{#}::Derivative.
   \partial{#}::PartialDerivative.

   # rules for covariant derivatives of v

   deriv1 := \nabla_{a}{v^{b}} -> \partial_{a}{v^{b}}
                                + \Gamma^{b}_{d a} v^{d}.

   deriv2 := \nabla_{a}{\nabla_{b}{v^{c}}} -> \partial_{a}{\nabla_{b}{v^{c}}}
                                            + \Gamma^{c}_{d a} \nabla_{b}{v^{d}}
                                            - \Gamma^{d}_{b a} \nabla_{d}{v^{c}}.

   # second covariant derivative of v

   expr := v^{c}_{b a} -> \nabla_{a}{\nabla_{b}{v^{c}}}.  # cdb (ex-0205.101,expr)
   save := @(expr).

   # apply the rules, then simplify

   substitute     (expr,deriv2)       # cdb (ex-0205.102,expr)
   substitute     (expr,deriv1)       # cdb (ex-0205.103,expr)
   distribute     (expr)              # cdb (ex-0205.104,expr)
   product_rule   (expr)              # cdb (ex-0205.105,expr)
   canonicalise   (expr)              # cdb (ex-0205.107,expr)
   substitute     (expr,save)         # cdb (ex-0205.108,expr)
\end{cadabra}

The trick here is to introduce in line 17 a dummy left hand side, \verb|v^{c}{}_{b a}|,
that is invisible with respect to the substitution rules of lines 8 and 11. Thus lines 22
and 23 will only target the right hand side of \verb|expr|.

Notice how a copy of the initial expression is made in 18. This is used later in line 27 to
replace the dummy object \verb|v^{c}{}_{b a}| with \verb|\nabla_{a}{\nabla_{b}{v^{c}}}|
but this time acting on the left hand side of the rule. The result is a rule for second
covariant deriavtives.

\clearpage

\begin{align*}
   & \Cdb{ex-0205.101} \\
   & \Cdb{ex-0205.102} \\
   & \Cdb{ex-0205.103} \\
   & \Cdb{ex-0205.104} \\
   & \Cdb{ex-0205.105} \\
   & \Cdb{ex-0205.107} \\
   & \Cdb{ex-0205.108}
\end{align*}

\end{document}


\section{Translation}
\label{sec:translation}

\iflong
Having shown the input and output languages for RZ,
we now explain how the translation from one to the other works.
A theory is translated to a
specification, where the theory elements are translated as follows.
\fi % \iflong

\subsection{Translation of sets and terms}
\label{sec:transl-sets-terms}

A set declaration $\iParameter{s}{\iSet}$ is translated to
%
\begin{source}
type s
predicate (\iPer{s}) : s \iTo s \iTo bool
assertion symmetric_s :  \iForall x:s, y:s, x \iPer{s} y \iTo y \iPer{s} x
assertion transitive_s : \iForall x:s, y:s, z:s, x \iPer{s} y \iAnd y \iPer{s} z \iTo x \iPer{s} z
predicate \iT{s} : s \iTo bool
assertion support_def_s :  \iForall x:s,  x : \iT{s} \iIff x \iPer{s} x
\end{source}
%
This says that the programmer should define a type~$s$ and a per
$\per_s$ on~$\values{s}$. Here~$\per_s$ is \emph{not} an OCaml value
of type $s \to s \to \mathtt{bool}$, but an abstract relation on the
set $\values{s} \times \values{s}$.  The relation may be uncomputable.

\iflong
The translation of the declaration of a dependent set
$\iParameter{\f{t}}{\f{s} \to \iSet}$ follows the interpretation of dependent
sets as uniform families (Section~\ref{sec:uniform-families}):
%
\begin{source}
type t
predicate \iPer{t} : s \iTo t \iTo t \iTo bool
assertion strict_t :  \iForall x:s, y:t, z:t, y \iPer{t x} z \iTo x : \iT{s}
assertion extensional_t :
  \iForall x:s, y:s, z:t, w:t, x \iPer{s} y \iTo z \iPer{t x} w \iTo z \iPer{t y} w
assertion symmetric_t : \iForall x:s, y:t, z:t, y \iPer{t x} z \iTo z \iPer{t x} y
assertion transitive_t :
  \iForall x:s, y:t, z:t, w:t, y \iPer{t x} z \iAnd z \iPer{t x} w \iTo y \iPer{t x} w
predicate \iT{t} : s \iTo t \iTo bool
assertion support_def_t :  \iForall x:s, y:t, y : \iT{t x} \iIff y \iPer{t x} y
\end{source}
%
The underlying output type~$\f{t}$ is still non-dependent, but the per is
parameterized by~$\f{s}$.
\else % \iflong
The translation of the declaration of a dependent set
$\iParameter{\f{t}}{\f{s} \to \iSet}$ uses uniform families
(Section~\ref{sec:uniform-families}). The underlying type~$\f{t}$ is
non-dependent, but the per $\per_{\f{t}}$ receives an additional
parameter $\f{x} : \values{\f{s}}$.
\fi % \iflong

A value declaration $\iParameter{x}{s}$ is translated to
%
\begin{source}
val x : s
assertion x_support : x : \iT{s}
\end{source}
%
which requires the definition of a value~$\f{x}$ of type~$\f{s}$ which is in
the support of~$\f{s}$.
\iflong
When $\f{s}$ is not a basic set, RZ computes the
interpretation of the underlying type and support.
\fi

A value definition $\iDefinition{\f{x}}{e}$ where~$e$ is an expression
denoting an element of~$\f{s}$ is translated to
%
\newcommand{\iE}{$e$}
\begin{source}
val x : s
assertion x_def : x \iPer{s} \iE
\end{source}
%
The assertion does \emph{not} force~$\f{x}$ to be defined as~$e$, only
to be equivalent to it with respect to~$\per_{\f{s}}$. This is
useful, as often the clearest or easiest ways to define a value are not the most
efficient ways to compute it.

Constructions of sets in the input language are translated to
corresponding constructions of modest sets.
%
\iflong
In Section~\ref{sec:modest-sets-pers} we saw how products,
exponentials and their dependent versions are formed. We briefly
review the remaining constructions of modest sets. We only consider
those constructions of terms that are not entirely straightforward.
%
\else
%
We comment on those that are least familiar.
%
\fi

\iflong
\paragraph{Disjoint union.}
%
A disjoint union of modest sets $\isum{\il_1}{A}{\il_2}{B}$ is the
modest set whose underlying type is the sum of underlying types,
%
\begin{equation*}
  \typeOf{\isum{\il_1}{A}{\il_2}{B}} =
  \osumtyx{\il_1}{\typeOf{A}}{\il_2}{\typeOf{B}},
\end{equation*}
%
and the per is the disjoint union of pers $\per_{A}$ and $\per_{B}$, so
that we have
%
\begin{align*}
  \oper{\isum{\il_1}{A}{\il_2}{B}}{\oinj{\il_1}{u}}{\oinj{\il_1}{v}}
  &\iff \oper{s_1}{u}{v},
  \\
  \oper{\isum{\il_1}{A}{\il_2}{B}}{\oinj{\il_2}{u}}{\oinj{\il_2}{v}}
  &\iff \oper{s_2}{u}{v}.
\end{align*}
\fi % \iflong

\paragraph{Subsets.}
%
\iflong
%
The construction of subsets may look surprising at first, but
it makes sense computationally.
\fi
Given a predicate~$\phi$ on a per~$A$, the sub-per $\set{x : A
  \such \phi}$ has underlying type $\typeOf{A} \times \typeOf{\phi}$
where $(u_1,v_1) \per_{\set{x : A \such \phi}} (u_2,v_2)$ when $u_1
\per_A u_2$, $v_1 \rz \phi(u_1)$ and $v_2 \rz \phi(u_2)$. The point is
that a realizer for an element of $\set{x : A
  \such \phi}$ carries information about \emph{why} the element
belongs to the subset, just like a predicate $\phi$ carries
information of type $\typeOf{\phi}$ about why a particular instance of~$\phi$ holds.

A type coercion $\icoerce{e}{t}$ can convert an element of the subset $s =
\set{x : t \such \phi(x)}$ to an element of~$t$. At the level of
realizers this is achieved by the first projection, which keeps a
realizer for the element but forgets the one for~$\phi(e)$. The
opposite type coercion $\icoerce{e'}{s}$ takes an $e' \in t$ and converts it
to an element of the subset. This is only well-formed when $\phi(e')$
is valid. Then, if $u \rz_t e'$ and $v \rz \phi(e')$, a realizer for
$\icoerce{e'}{s}$ is $(u, v)$. However, since RZ cannot in general know
a~$v$ which validates~$\phi(e')$, it emits the pair $(u,
(\ooblig{v}{\typeOf{\phi}}{\oapp{\oapp{\phi}{u}}{v}}{v}))$.

\paragraph{Quotients.}
%
\iflong
%
The category of modest sets has coequalizers, hence a quotient modest
set $A/\rho$ may be constructed for an any equivalence relation~$\rho$
on~$A$. However, because equality does not carry any computational
content, equality of equivalence classes $\ieclass{x}{\rho} =
\ieclass{y}{\rho}$ implies only $\inot{\inot{\rho(x,y)}}$, not the
usual~$\rho(x,y)$. As this may cause confusion
and mistakes, it is better to permit only quotients by \emph{stable}
equivalence relations, which behave as expected.

%
\else
%
Even though we may form quotients of pers by arbitrary equivalence
relations, only quotients by $\lnot\lnot$-stable relations behave as
expected.\footnote{The trouble is that from equality of equivalence
  classes $[x]_{\rho} = [y]_{\rho}$ we may conclude only
  $\lnot\lnot\rho(x,y)$ rather than the expected $\rho(x,y)$.}
%
\fi
A stable equivalence relation on a per~$A$ is the same thing as a
partial equivalence relation~$\rho$ on~$\typeOf{A}$ which satisfies
$x \per_A y \implies \rho(x,y)$. Then the quotient $A/\rho$ is the per
with $\typeOf{A/\rho} = \typeOf{A}$ and $x \per_{A/\rho} y \iff
\rho(x,y)$.

Luckily, it seems that many equivalence relations occurring in
computable mathematics are stable, or can be made stable.
%
\iflong For example, Cauchy sequences (of rational numbers)
$(a_n)_{n\in\NN}$ and $(b_n)_{n\in\NN}$ represent the same real number
when
%
\begin{equation}
  \label{eq:cauchy}%
  \xall{i}{\NN}{
    \xsome{j}{\NN}{
      \forall m,n \geq j.\,|a_m - b_n| \leq 2^{-i}
    }
  } \;.
\end{equation}
%
This defines an equivalence relation on the set of Cauchy sequences
which does not seem to be stable; intuitively a realizer for this
equivalence would be a computation telling us at what point
in the sequence the terms will be within~$2^{-i}$ of each other.
%
However, if we restrict attention just to the \emph{rapid} Cauchy
sequences, i.e., those satisfying $\xall{i}{\NN}{|a_{i+1} - a_i| \leq
  2^{-i}}$, then the equivalence relation becomes
%
\begin{equation*}
  \xall{i}{\NN}{|a_i - b_i| \leq 2^{-i+3}},
\end{equation*}
%
which is a negative formula; the above realizer is rendered
unnecessary.
%
\else % iflong
%
For example, the coincidence relation on Cauchy sequences is expressed
by a $\forall\exists\forall$~formula, but if we consider \emph{rapid}
Cauchy sequences (those sequences $a$ satisfying
$\xall{i}{\NN}{|a_{i+1} - a_i| \leq 2^{-i}}$), it becomes a (negative)
$\forall$~formula.
%
\fi % iflong
It is interesting that most practical implementations of
real numbers follow this line of reasoning and represent real numbers in a
way that avoids annotating every sequence with its rate of convergence.

Translation of an equivalence class $\ieclass{e}{\rho}$ is quite
simple, since a realizer for~$e$ also realizes its equivalence class
$\ieclass{e}{\rho}$. The elimination term
$\ileteclass{x}{\rho}{\xi}{e}$, means ``let $x$ be any element of
$\rho$-equivalence class $\xi$ in~$e$''. It is only well-formed when
$e$ does not depend on the choice of~$x$, but this is something RZ
cannot check. Therefore, if $u$ realizes $\xi$, RZ uses $u$ as a
realizer for~$x$ and emits an obligation saying that the choice of a
realizer for~$x$ does not affect~$e$.

\paragraph{The underlying set of realizers.}
%
Another construction on a per~$A$ is the underlying
per of realizers $\irz{A}$, defined by
%
\iflong
\begin{align*}
  \typeOf{\irz{A}} &= \typeOf{A} \\
  u \per_{\irz{A}} v &\iff u \in \support{A} \land u = v,
\end{align*}
%
\else  % \iflong
$\typeOf{\irz{A}} = \typeOf{A}$ and
$u \per_{\irz{A}} v u \in \support{A} \land \iff u = v$,
\fi % \iflong
%
where by $u = v$ we mean observational equality of values~$u$ and~$v$.
%
An element $r \in \irz{A}$ realizes a unique element $\irz{r} \in A$.
The elimination term $\iletrz{x}{e_1}{e_2}$, which means ``let $x$ be
any realizer for~$e_1$ in $e_2$'', is only well-formed if $e_2$ does
not depend on the choice of~$x$. This is an uncheckable condition,
hence RZ emits a suitable obligation in the output, and uses for $x$
the same realizer as for~$e_1$.

The construction $\irz{A}$ validates the Presentation Axiom (see
Section~\ref{sec:axiom-choice}). In the input language it gives us
access to realizers, which is useful because many constructions in
computable mathematics, such as those in Type Two
Effectivity~\cite{Wei00}, are explicitly expressed in terms of
realizers.

\iflong
\paragraph{Definite description.}
%
Russell's definite description operator $\ithe{x}{s}{\phi(x)}$ denotes
the unique element of $\isubset{x}{s}{\phi(x)}$. In case such an~$x$
does not exist, or if there are several, the term is not well formed.
The RZ translation essentially just asks the programmer to provide
suitable realizers for $x$ and for $\phi(x)$, and to check uniqueness,
%
\begin{equation*}
  \ooblig{x{:}s,b}{\typeOf{\phi}}{
    (\ototal{x}{s} \land \oapp{\oapp{\phi}{x}}{b} \land
    \oforall{x'}{s}{
      \oforall{c}{\typeOf{\phi}}{
        (\oimply{\oapp{\oapp{\phi}{x'}}{c}}{\oper{s}{x}{x'}})
      }
    })
    }{(x,b)}.
\end{equation*}
%
This is the best RZ can do, since in general it can check neither
that~$x$ exists, nor that it is unique.
\fi

\subsection{Translation of propositions}
\label{sec:transl-prop}

The driving force behind the translation of logic is a theorem
\cite[4.4.10]{Troelstra:van-Dalen:88:1} that says that under the
realizability interpretation every formula~$\phi$ is equivalent to one
that says, informally speaking, ``there exists~$u \in \typeOf{\phi}$,
such that $u$ realizes $\phi$''. Furthermore, the formula ``$u$
realizes $\phi$'' is computationally trivial. The translation of a
predicate $\phi$ then consists of its underlying type $\typeOf{\phi}$
and the relation $u \rz \phi$, expressed as a negative formula.

Thus an axiom $\iAxiom{\f{A}}{\phi}$ in the input is translated to
%
\newcommand{\iTypeOfPhi}{$|\phi|$}
\newcommand{\iPhi}{$\phi$}
\begin{source}
val u : \iTypeOfPhi
assertion A : u \iRz \iPhi
\end{source}
%
which requires the programmer to validate~$\phi$ by providing a
realizer for it. When $\phi$ is a compound statement RZ computes the
meaning \iflong of $u \rz \phi$ \fi as described in
Figure~\ref{fig:rz-logic}.

In RZ we avoid the explicit realizer notation $u \rz \phi$ in order to
make the output easier to read.
%
\iflong
%
A basic predicate declaration $\iParameter{p}{\iarrow{s}{\iProp}}$ is
translated to
%
\begin{source}
type ty_p
predicate p : s \iTo ty_p \iTo bool
assertion strict_p :  \iForall x:s, a:ty_p, p x a \iTo x : \iT{s}
assertion extensional_p :
   \iForall x:s, y:s, a:ty_p, x \iPer{s} y \iTo p x a \iTo p y a
\end{source}
%
We see that the predicate~$p$ has gained an additional argument of
type $\f{ty\_p}$ (which the programmer is supposed to define in an
implementation), and we write $\oapp{\oapp{p}{x}}{a}$ instead of $a
\rz \oapp{p}{x}$. The two assertions require that $p$ be strict and
extensional with respect to $\per_s$.
%
\else % iflong
%
A basic predicate declaration $\iParameter{p}{\iarrow{s}{\iProp}}$ is
translated to a type declaration $\otyspec{\f{ty\_p}}$ and a predicate
declaration $\opropspec{p}{s \to \f{ty\_p} \to \oProp}$ together with
assertions that~$p$ is strict and extensional.
%
\fi % iflong

\iflong
Frequently we know that a predicate is stable, which can be taken into
account when computing its realizability interpretation. For this
purpose the input language has the subkind $\iStable$ of $\iProp$.
When RZ encounters a predicate which is declared to be stable, such as
$p : \iarrow{s}{\iStable}$, it does not generate a declaration of
$\f{ty\_p}$ and it does not give $p$ an extra argument.

Another special kind in the RZ input language is the kind $\iEquiv{s}$ of
stable equivalence relations on a set~$s$. When an equivalence
relation is declared with $\iParameter{p}{\iEquiv{s}}$, RZ will output
assertions stating that $p$ is strict, extensional,
reflexive, symmetric and transitive.
\fi % \iflong

%%% Local Variables:
%%% mode: latex
%%% TeX-master: "cie"
%%% End:


\chapter{$\tau$ Model of Star Formation}
\label{chap:tau_model}
Our galaxy models are constructed from the simple stellar population
(SSP) library of \citet{Bruzual03} with an initial mass function from
\citet{Chabrier03}. These SSPs rely on the STELIB stellar library
\citep{LeBorgne03}. The goal of any regularized galaxy model is to
assign individual SSP weights based on a modeled star formation
history (SFH). Our SSP basis set is normalized to \val{1}{M_{\odot}}
and thus the SSP weights will be the total mass of stars in a give
population. We let the mass of a model galaxy at lookback time, $t$,
be
\begin{equation}
\label{TM:eq:M(t)}
M(t) = \int_{t_{\rm form}}^t \psi(t') dt',
\end{equation}
where $\psi(t)$ is the amount of mass in stars produced at loockback time
$t$. Equation \ref{TM:eq:M(t)} is generally true for any star formation
history. For a $\tau$ model we use
\begin{equation}
\label{TM:eq:taumodel}
\psi(t) = \psi_0 e^{-t/\tau_{SF}}.
\end{equation}

Taking the above, our galaxy flux, $G(\lambda)$, is constructed by
weighting the spectra of individual SSPs, $f_i(\lambda)$, by the mass
formed during their formation age:
\begin{equation}
G(\lambda) = \sum_i^N f_i(\lambda) M_i,
\end{equation}
where
\begin{equation}
M_i = \int_{t_2}^{t_1} \psi(t') dt'.
\end{equation}

In practice our SSP ages are discreet and we need to choose a range of time
($t_2 - t_1$) over which SSP contributes to star formation. We set these
limits of integration such that an equal amount of mass is formed in each half
of a logarithmically-spaced SSP age bin. In other words, given an SSP of age
$t_i$, the limits of integration are
\begin{equation}
t_{2,i} = \frac{\log (t_{i+1}) - \log (t_i)}{2} = t_{1,i+1}.
\end{equation}
We set the end points $t_{1,0} = 0$ and $t_{2,N} = t_{\rm form}$.

In the situation where $t_{\rm form}$ is less than the oldest SSP in
our library the SSP mass bins will be unevenly spaced in age. To fix
this problem we assign each SSP an age that is weighted by the amount
of mass formed during the time assigned to its bin. In other words,
the weighted age of an SSP with age $t_i$ is the midpoint of mass bin
$M_i$. This weighted age, $t_{i,w}$, is defined such that
\begin{equation}
\int_{t_1}^{t_{i,w}} \psi(t') dt' = \int_{t_{i,w}}^{t_2} \psi(t') dt'.
\end{equation}
If we assume the $\tau$ model described in Eq. \ref{TM:eq:taumodel} the weighted age is
\begin{equation}
t_{i,w} = \tau_{SF} \log\left( 0.5 \left( e^{t_1/\tau_{SF}} + e^{t_2/\tau_{SF}} \right)\right).
\end{equation}

Finally, we adopt the extinction law of \citet{Charlot00} with a value
of $A_V=1.63$, which defines a reddening term that is constant across all SSPs,
\begin{equation}
R(\lambda) = e^{-\frac{A_V}{1.086} \left(\lambda/\val{5500}{\AA}\right)^{-0.7}},
\end{equation}
 so our final galaxy is given by
\begin{equation}
G(\lambda) = R(\lambda)\sum_i^N f_i(\lambda) M_i.
\end{equation}

As a proxy for star formation history we define the mean light-weighted age as
\begin{equation}
\label{TM:eq:MLWA}
\tau_L = \frac{\sum_k\left[S(\lambda_K) R(\lambda_k) \sum_i f_i(\lambda_k) M_i t_i\right]}{\sum_{k}\left[S(\lambda_k) R(\lambda_k) \sum_i f_i(\lambda_k) M_i\right]}
%% \tau_L = \frac{\sum_k S(\lambda_k)\left(\frac{\sum_{i,j} \psi(t_i,Z_j) f(\lambda, t_i,Z_j) t_i}{\sum_{i,j} \psi(t_i,Z_j) f(\lambda, t_i, Z_j)} \right)}{\sum_k S(\lambda_k)},
\end{equation}
where $S(\lambda_j)$ defines the bandpass over which the age is computed. We
set $S(\lambda_j)$ to be flat over \val{5450}{\AA} $\leq\lambda\leq$
\val{5550}{\AA} and zero everywhere else.

\bibliographystyle{thesis}
\bibliography{ms_n891_paper}


\section{Nets and Optimal Search}

\subsection{British Museum procedure}

Find all possible paths and select the best one from them.

\subsection{Branch and Bound}

\begin{itemize}
  \item Form a one-element queue consisting of a zero-length path
    that contains only the root node
  \item Until the first path in the queue terminates at the
    goal node or the queue is empth:
    \begin{itemize}
      \item Remove the first path from the queue; create new paths
        by extending the first path to all the neighbors
        of the terminal node
      \item Reject all new paths with loops
      \item add the remaining new paths, if any, to the queue
      \item Sort the entire queue by path length with
        least-cost paths in front
    \end{itemize}
  \item If the goal node is gound, annouce success; otherwise,
    annouce failure
\end{itemize}

\subsection{Branch and Bound with lower-bound estimate}

\begin{itemize}
  \item Form a one-element queue consisting of a zero-length path
    that contains only the root node
  \item Until the first path in the queue terminates at the
    goal node or the queue is empth:
    \begin{itemize}
      \item Remove the first path from the queue; create new paths
        by extending the first path to all the neighbors
        of the terminal node
      \item Reject all new paths with loops
      \item Add the remaining new paths, if any, to the queue
      \item Sort the entire queue by \textbf{the sum of the path
        length and a lower-bound estimate of the cost
        remaining, with least-cost paths in front}
    \end{itemize}
  \item If the goal node is gound, annouce success; otherwise,
    annouce failure
\end{itemize}

\subsection{Branch and Bound with dynamic programming}

\begin{itemize}
  \item Form a one-element queue consisting of a zero-length path
    that contains only the root node
  \item Until the first path in the queue terminates at the
    goal node or the queue is empth:
    \begin{itemize}
      \item Remove the first path from the queue; create new paths
        by extending the first path to all the neighbors
        of the terminal node
      \item Reject all new paths with loops
      \item Add the remaining new paths, if any, to the queue
      \item \textbf{if two or more paths reach a common node,
        delete all those paths except the one that reaches the
        common node with the minimum cost}
      \item Sort the entire queue by \textbf{the sum of the path
        length with least-cost paths in front}
    \end{itemize}
  \item If the goal node is gound, annouce success; otherwise,
    annouce failure
\end{itemize}

\subsection{A* procedure - Branch and bound with Underestimates
and Dynamic Programming}

\begin{itemize}
  \item Form a one-element queue consisting of a zero-length path
    that contains only the root node
  \item Until the first path in the queue terminates at the
    goal node or the queue is empth:
    \begin{itemize}
      \item Remove the first path from the queue; create new paths
        by extending the first path to all the neighbors
        of the terminal node
      \item Reject all new paths with loops
      \item Add the remaining new paths, if any, to the queue
      \item \textbf{if two or more paths reach a common node,
        delete all those paths except the one that reaches the
        common node with the minimum cost}
      \item Sort the entire queue by \textbf{the sum of the path
        length and a lower-bound estimate of the cost
        remaining, with least-cost paths in front}
    \end{itemize}
  \item If the goal node is gound, annouce success; otherwise,
    annouce failure
\end{itemize}

\subsection{Which optimal search method is good for me?}
\begin{itemize}
  \item The British Museum procedure is good only when the
    search tree is small
  \item Branch-and-bound search is good when the tree is big
    and bad paths turn distinctly bad quickly
  \item Branch-and-bound search with a guess is good when
    there is a good lower-bound estimate of the distance
    remaining to the goal
  \item Dynamic programming is good when many paths convers
    on the same place
  \item The A* procedure is good when both branch-and-bound
    search with a guess and dynamic programming are good
\end{itemize}


\documentclass{article}
\usepackage{amsmath}
\usepackage{amsfonts}
\usepackage{geometry}
\usepackage[utf8]{inputenc}
\usepackage{enumitem}
\usepackage{physics}
\setlength{\parindent}{0pt}
\setlength{\parskip}{1em}
\relpenalty=10000
\binoppenalty=10000
\DeclareMathOperator{\lcm}{lcm}

\begin{document}
\section*{Diophantine equations}
\begin{enumerate}
	\item
	Diophantine equations are polynomial equations, usually in two or more unknowns, such that only integer solutions are sought.
	\item
	A Diophantine equation equates two or more monomials, each of degree $1$ in one of the variables, to a constant.
	\item
	An exponential Diophantine equation is one in which exponents on terms can be unknowns.
\end{enumerate}
\section*{Problems}
\begin{enumerate}
	\item
	Given integers $a,b,c$, find the conditions on $a,b,c$ such that there is an integer solution $x,y$ to
	$ax+by=c$.
	\item % andreescu 3.2.intro
	Prove that for every positive integer $m$ there is a positive integer $n$ such that $m+n+1$ is a perfect square and $mn+1$ is a perfect cube.

	\item % andreescu 3.2.intro
	Show that if $a,b$ are non-negative integers such that $\tfrac{a^2+b^2}{1+ab}$ is also an integer, then $\tfrac{a^2+b^2}{1+ab}$ is a perfect square.

	\item % aops
	Solve in integers
	$$x^3 +x^2 + x + 1 = y^2$$

	\item % andreescu 3.5.9
	Prove that the equation $y^2=x^5-4$ has no integer solutions.

	\item % stevens 4.2.3
	Prove that there are no integer solutions to
	$$x^3 + y^4 = 19^{19}$$

	\item % andreescu 3.6.intro
	Find the positive integer solutions to the equation
	$3^x+4^y=5^z$

	\item % andreescu 3.2.15
	Prove that if there exists a triple of positive integers $(x,y,z)$ such that
	$$x^2 + y^2+1 = xyz$$
	then $z=3$ and find all such triplets.

	\item % andreescu 3.6.4.b
	Given an odd prime $p$, find all pairs of nonnegative integers $x,y$ that solve the equation
	$$p^x - y^p =1$$

\end{enumerate}

\end{document}


\chapter{Background}

In this chapter the theoretical background of electrical conductivity measurement will be explained. A market research was conducted to compare commercially available solutions of sensor systems and components that could be used to develop one.

\section{Theoretical Background}

The following section is summarized and translated from \textcite{trankler2015sensortechnik} and \textcite{gevatter2000automatisierungstechnik}.\\

The conductivity $ \kappa $  is the ability of a certain volume of a substance to conduct electricity. It is measured in the unit \unitfrac{S}{m} and is a specific parameter normalized to the length and cross section of the volume. Conductivity in a liquid depends on ions as charge carrier and can therefore be used to measure its concentration.

To better understand conductivity, an equivalent circuit diagram, shown in figure \ref{fig:ecd}, of an electrode system shown in figure \ref{fig:elec}, can be used. This method is called conductometry and in this form a two-electrode-cell is used. In this measurement configuration, two electrodes are submerged in the liquid to be measured and a voltage is applied. The resistance $ R $ of the substance is determined by measuring the potential drop $U_R$ given a constant voltage $ U $, current $ I $ and internal resistance $ R_i$. \\

\begin{figure}
	\begin{center}
		\begin{circuitikz}[european voltages]
			\draw
  			(0,0) to [short, *-] (2,0)
  			to [R, l=$R$] (2,2)
  			(0,0) to [open, v^<=$U$] (0,4)
  			to [short, *- ,i=$I$] (2,4)
  			to [R, l_=$R_i$] (2,2)
  			(2.25,0) to [open, v<=$U_R$] (2.25,2);
		\end{circuitikz}
		\caption[The equivalent circuit diagram]{The equivalent circuit diagram - A voltage drop $U_R$ over the resistance of the fluid relative to the internal resistance $R_i$ is driven by the applied voltage $U$.}
		\label{fig:ecd}
	\end{center}
\end{figure}

\begin{figure}
	\begin{center}
    	\tikzset{external/export next=false}
		\begin{tikzpicture}
  		    % Draw electrode
 	   		\fill [black!25] (0.5,2) node[left, black] {$A$} rectangle (1.5,-1);
	    		% draw voltmeter
 	   		\draw[join = round, thick] (1,2) -- (1,2.5) -- (2.4,2.5);
 	   		\draw[join = round, thick] (3.1,2.5) -- (4.5,2.5) -- (4.5,2);
 	   		\draw (2.75,2.5) node [circle, draw] {V};
  	  		%Draw electrode
  	  		\fill [black!25] (4,2) node[left, black] {$A$}  rectangle (5,-1);

		\draw [darrow] (1.5,-0.5) -- (4,-0.5) node[above, pos=0.5] {$d$};
    		%Draw water
    		\fill [blue!75, opacity=0.3] (-0.5,1) rectangle (6,-2);
		\end{tikzpicture}
		\caption[Two electrodes submerged in the solution]{Two electrodes submerged in the solution - the electrode of area $A$ are placed within the distance $d$. A voltmeter is used to measure the voltage drop $U_R$.}
		\label{fig:elec}
	\end{center}
\end{figure}

The resistance $ R $ is
\begin{equation}
	R = \dfrac{U_R}{I}
\label{eq:R}
\end{equation}

The inverse of the resistance $ R $ is the conductance $ G $
\begin{equation}
	G = \dfrac{I}{U_R}
\label{eq:G}
\end{equation}

The cell constant $ C $ describes the geometry of the sensor
\begin{equation}
	C = \dfrac{d}{A}
\label{eq:C}
\end{equation}
where $ d $ is the distance between the electrodes and $ A $ the surface area thereof.

Considering the cell constant $ C $ finally yields the conductivity $\kappa$
\begin{equation}
	\kappa = G \cdot C
\label{eq:kappa}
\end{equation}

In electrolytes, the electrical conduction is a result of mass transfer, where ions are carrying the charges. If the measurement is conducted with direct current, this mass transfer leads to changes in the measured solution and the electrode surface, negatively impacting the measurement. Furthermore, polarization effects create additional resistance, leading to lower than actual results. To avoid this, alternating current is used. The fast, periodical swap of polarity eliminates the net mass flow and its effects. Polarization is a result of the current flowing through the electrode, thereby its effects can be minimized by minimizing this current. One method to do so is replacing the two-electrode-cell with a four-electrode-cell.
This separates the current flow from the potential measurement by using one electrode pair to apply the current, and a separate pair to measure the potential drop. \\

The electrolyte's temperature affects the mobility of the ions and thereby also has a big influence on the conductivity. It has to be taken into account when comparing two measurements. If the temperature $ T $ is known, the conductivity at that temperature $ \kappa_{T} $ can be normalized to a reference temperature $ T_{ref} $ using equation \eqref{eq:kref}, resulting in the reference conductivity $ \kappa_{ref} $.

\begin{equation}
	\kappa_{ref} = \kappa_{T} \frac{1}{1 + C_{T} \cdot (T - T_{ref})}
\label{eq:kref}
\end{equation}

The temperature coefficient $ C_{T} $ assumes a linear correlation and is only valid in a narrow temperature range. For bigger ranges the denominator can be replaced with a polynomial using higher order coefficients, resulting in equation \eqref{eq:kref+}.

\begin{equation}
	\kappa_{ref} = \kappa_{T} \frac{1}{\sum\limits_{i=0}^n C_{Ti} \cdot (T - T_{ref})^{i}}
\label{eq:kref+}
\end{equation}

\section{Market Research}

Conductivity meters can be readily bought and range from prices of over \euro{1000} for lab equipment \parencite{expcm} to \euro{100} for simple field water quality monitors \parencite{cheapcm}. Even cheaper water quality testers from no-name manufacturers can be found for as little as \euro{10} from online vendors.

\begin{figure}[H]
	\begin{center}
    	\tikzset{external/export next=false}
		\includegraphics[scale=0.6]{images/ccm.jpg}
		\caption{Fisher Scientific™ Traceable™ Salinity Meter Pen \parencite{cheapcm}}
		\label{fig:ccm}
	\end{center}
\end{figure}

Figure \ref{fig:ccm} shows a field conductivity meter from a quality manufacturer as an example for the typical traits most available solutions share:
\begin{itemize}
	\item a single electrode pair
	\item a display to report measurements
	\item designed to perform singular reads with high quality
\end{itemize}

While field conductivity meters have the electrodes integrated to form one compact device, the more expensive lab equipment often has the electrodes attached to the device with a cable, allowing for a more flexible use.\\

A different option was found in the MinieC I2C eC interface from Sparky's Widgets \parencite{uec}. The MinieC interface is an Open Hardware project providing a conductivity sensor, licensed under Creative Commons \parencite{cc}. This license allows to study the original design files and build modified versions. Ready-made boards can be purchased for about \euro{25}. The design approach of this solution is also more modular than that the other products. The MinieC offers an interface to connect external electrodes and can be controlled and read by a microcontroller.\\

Table \ref{tab:feat} shows a comparison of the strengths and weaknesses of the different systems with respect to the use case in this project. Both the lab and field conductivity meters offer complete solutions with high accuracy. They do however lack the modularity of the MinieC as well as the machine interface, both of which are more important for the intended purpose than the accuracy. The complete solutions which are offered simply are solutions for a different case than ours, while the MinieC is positioned as a flexible building block to be used in whatever way needed. While it means that more work has to be done in designing a system around it, this is exactly the trait that allows us to build a device fit for our tasks.

\begin{table}[H]
    \centering

    \caption[]{Feature comparison table of different conductivity sensor solutions. Strengths and weaknesses are indicated by + and - signs.}
    \label{tab:feat}
    \begin{tabular}{l  c  c  c}
        	\toprule
         Feature & Lab Conductivity Meter & Field Conductivity Meter & MinieC \\
        	\midrule
		Modularity & - & - - & ++ \\
		Completeness & ++ & ++ & - \\
		Interface & - & - & ++ \\
		Accuracy & ++ & + & - \\
		Price & - - & - & + \\
        \bottomrule
    \end{tabular}
\end{table}


\chapter{SCIARA-fv3 - Model Formalization}\label{sect:SCIARA_MODEL}

\section{Model Overview}
Sciara-fv3 is the latest release of the Sciara family of
Complex Cellular Automata Models for simulating basaltic
lava flows. As its predecessor, Sciara-fv2, it is
based on a Bingham-like rheology. However, unlike fv2, it explicitly
computes the flow momentum and the time corresponding
to the computational step (CA clock). In formal terms, it is
defined as:
\[
SCIARA-fv3=<R,X,Q,P,\tau,L,\gamma>
\]

where:

\begin{enumerate}
  \item R is the cellular space, the set of square cells that define the
  bi-dimensional finite region where the phenomenon evolves.
  \item X is the pattern of cells belonging to the Moore
neighborhood that influence the cell state change (see fig.
\ref{fig:mooreNeighModel})
  \item \(Q= Q_z \times Q_h  \times Q_T  \times  Q_{\overrightarrow{p}}  \times
  Q_f^9 \times  Q_{\overrightarrow{vf}}^9  \) is the finite set of states,
  considered as Cartesian product of substates. Their meanings are: cell altitude a.s.l.,
cell lava thickness, cell lava temperature, momentum
(both x and y components), lava thickness outflows
(from the central cell toward the adjacent cells) and
flows velocities (both x and y components), respec-
tively;
  \item \(P = w,t_0, P_T,P_d,P_{hc},\delta,\rho,\epsilon,\sigma,c_v\) is the finite set
of parameters (invariant in time and space), whose
meaning is illustrated in Tab. \ref{tab:parameters}; note that \(P_T , P_d\) ,
and \(P_{hc}\) are set of parameters;
\item \(\tau : Q^9 \longmapsto Q\) is the cell deterministic transition
function; it is splitted in \textit{``elementary processes''}  which, are described
in section \ref{sect:ElementaryProcesses};
\item \(L \subseteq R \) specifies the emitted lava thickness from the source
cells (i.e. craters);
\item \(\gamma : Q_h \times \mathbb{N} \longmapsto Q_h\) specifies the emitted
lava thickness from the source cells at each step \(k \in \mathbb{N}\)

\end{enumerate}

\begin{figure}
\begin{center}
  \includegraphics[scale=0.65]{./images/mooreNeighSciaraModel}
  \caption{Example of Moore neighborhood and decomposition of momentum
along the cellular space directions. Cells are indexes from 0 (the central cell,
in grey) to 8. Cells integer coordinates are omitted for a better readability.}
  \label{fig:mooreNeighModel}
\end{center}
\end{figure}

\begin{table}[!t]
% increase table row spacing, adjust to taste
\renewcommand{\arraystretch}{1.3}
% if using array.sty, it might be a good idea to tweak the value of
% \extrarowheight as needed to properly center the text within the cells
\caption{List of parameters of SCIARA-fv3 with values considered for the simulation of the 2006 Etnean lava flow.}
\label{tab:parameters}
\centering
%% Some packages, such as MDW tools, offer better commands for making tables
%% than the plain LaTeX2e tabular which is used here.
\begin{tabular}{l l l l}
\hline
Parameter & Meaning & Unit & Best value\\
\hline
$w$ & Cell side & [m] & 10\\
$t_0$ & Initial CA clock & [s] & 1\\
$t_{\max}$ & Upper value for the CA clock & [s] & 120\\
$P_T$\\
	$\;\;\: T_{sol}$ & Temperature of solidification & [K] & 1143\\
	$\;\;\: T_{vent}$ & Temperature of extrusion & [K] & 1360\\
$P_d$\\
	$\;\;\: dP_{T_{sol}}$ & Dissipation factor at solidification & - & 0.5\\
	$\;\;\: dP_{{T_vent}}$ & Dissipation at extrusion & - & 0.315\\
$P_{hc}$\\
	$\;\;\: hc_{T_{sol}}$ & Critical height at solidification & [m] & 23.066\\
	$\;\;\: hc_{{T_{vent}}}$ & Critical height at extrusion & [m] & 1.014\\
$r$ & Relaxation rate & - & 0.5\\
$\delta$ & Cooling parameter & - & 1.5070\\
$\rho$ & Lava density & [Kg m$^{-3}$] & 2600\\
$\epsilon$ & Lava emissivity & - & 0.9\\
%$\sigma$ & Stephan-Boltzmann constant & [J m$^{-2}$ s$^{-1}$ K$^{-4}$] & $5.68 \cdot 10^{-8}$\\
$c_v$ & Specific heat & [J kg$^{-1}$ K$^{-1}$] & 1150\\
\hline
\end{tabular}
\end{table}

\section{Elementary process}\label{sect:ElementaryProcesses}
\subsection{Elementary process \(\tau_1\): lava flows computation}
The elementary process $\tau_1$ computes lava outflows and their velocities. It is formally defined as:
$$
\tau_1: Q_z^9 \times Q_h^9 \times Q_{\overrightarrow{p}} \to Q_f^9 \times Q_{\overrightarrow{v_f}}^9
$$

Lava flows are computed by a two-step process: the first computes the CA clock,
$t$, i.e. the physical time corresponding to a CA computational step, while the
second the effective lava outflows, $h_{(0,i)}$, their velocities
$v_{f_{(0,i)}}$ and displacements $s_{(0,i)}$ $(i=0,1,...,8)$. The elementary
process $\tau_1$ is thus executed two times, the first one in ``time evaluation
mode'', the second in ``flow computing mode''. Both modes compute the so called
``minimizing outflows'', $\phi_{(0,i)}$, i.e. those which minimize the unbalance
conditions within the neighborhood, besides their final velocities and
displacements. In ``time evaluation mode'', $t$ is preliminary set to a large
value, $t_{\max}$, and the computed displacement, $s_{(0,i)}$, is compared with
the maximum allowed value, $d_{(0,i)}$, which is set to the distance between the
central cell and the neighbor that receives the flow. In case of
over-displacement, the time $t$ must be opportunely reduced in order to avoid
the overflow condition. In case no over-displacement are obtained, $t$ remains
unchanged. Eventually, in ``flow computing mode'', effective lava outflows,
$h_{(0,i)}$, are computed by adopting the CA clock obtained in ``time evaluation
mode'', by guarantying no overflow condition.

\subsubsection{Computation of the minimizing outflows $\phi_{(0,i)}$}\label{sec:min-ouflows}
As in \cite{xxx, xxx}, the initial velocity of the lava inside the cell,
$\overrightarrow{v_{0}}_{_{(0)}}$, is obtained from the momentum components. In
turn, it is decomposed in two components laying over the two directions of the
CA cellular space which are the nearest with respect to
$\overrightarrow{v_{0}}_{_{(0)}}$ itself. These latter directions, which will be
indicated by $e^\circlearrowleft$ and $e^\circlearrowright$, can be found by
moving in counterclockwise and clockwise directions starting from the direction
of $\overrightarrow{v_{0}}_{_{(0)}}$, respectively, as shown in Fig.
\ref{fig:mooreNeighModel}. Thus, if $i$ denotes the $i$-th direction of the cellular
space, $v_{0_{(0)}}^\circlearrowleft$ and $v_{0_{(0)}}^\circlearrowright$ the
modules of the components of $\overrightarrow{v_{0}}_{_{(0)}}$ along the
directions $e^\circlearrowleft$ and $e^\circlearrowright$, respectively, then
the modules of the components of $\overrightarrow{v_{0}}_{_{(0)}}$ along the
directions of the cellular space can be expressed as:
$$ v_{0_{(0,i)}}=
	\begin{cases}
		v_{0_{(0)}}^\circlearrowleft, & \mbox{if }i = e^\circlearrowleft \\
		v_{0_{(0)}}^\circlearrowright, & \mbox{if }i = e	^\circlearrowright \\
		0, & \mbox{otherwise}
	\end{cases}
$$
Moreover, let ${h_k}_{(0,i)} = {v_0}_{(0,i)}^2/2g$ denote the kinetic head associated to the $i$-th component of velocity.

Viscosity effects are modeled in terms of velocity dissipation mechanism, by means of the function $dP$. It depends on temperature and vary according to a power law of the type $\log dP = a+bT$, where $T \in Q_T$ is the lava temperature and $a$ and $b$ are coefficients determined by solving the system (cf. Tab. \ref{tab:parameters}):
$$
\begin{cases}
	\log dP_{T_{sol}} = a+bT_{sol}\\
	\log dP_{T_{vent}} = a+bT_{vent}\\
\end{cases}
$$
Similarly, the relation between critical height and lava temperature can be described by a power law of the kind $\log hc = c+dT$ whose coefficients are obtained by solving the system (cf. Tab. \ref{tab:parameters}):
$$
\begin{cases}
	\log hc_{T_{sol}} = c+dT_{sol}\\
	\log hc_{T_{vent}} = c+dT_{vent}\\
\end{cases}
$$

Before applying the minimization algorithm of the differences for computing the
minimizing outflows, a preliminary control was performed to eliminating cells
that cannot receive lava due to their energy conditions. As in
\cite{Spataro2010}, a topographic correction is considered for flow symmetry
reason. In addition, in Sciara-fv3 the concepts of effective height,
$h_{e_{(0,i)}}$, and apparent height, $h_{a_{(0,i)}}$, was introduced. The first
is the part of $h_{(0)}$ that can really flow out of the cell toward its $i$-th
neighborhood, while the second one is the part which is constrained inside the
cell due to energy conditions. There are three cases (see Fig. \ref{fig:cases}):
\begin{enumerate}
\item if $z_{(0)} + h_{k_{(0,i)}} + h_{(0)} \leq z_{(i)} + h_{(i)}$, then \\
$\begin{cases}
	h_{e_{(0,i)}} = 0\\
	h_{a_{(0,i)}} = h_{(0)}\\
\end{cases}$
\item if $z_{(0)} + h_{k_{(0,i)}} < z_{(i)} + h_{(i)} < z_{(0)} + hk_{(0,i)} + h_{(0)}$, then \\
$\begin{cases}
	h_{e_{(0,i)}} = (z_{(0)} + h_{k_{(0,i)}} + h_{(0)}) - (z_{(i)} + h_{(i)})\\
	h_{a_{(0,i)}} = h_{(0)} - h_{e_{(0,i)}}\\
\end{cases}$
\item if $z_{(i)} + h_{(i)} \leq z_{(0)} + h_{k_{(0,i)}}$, then \\
$\begin{cases}
	h_{e_{(0,i)}} = h_{(0)}\\
	h_{a_{(0,i)}} = 0\\
\end{cases}$
\end{enumerate}
Thus, if denoting with $\theta_{(0,i)} = \arctan ((z_{(0)} + h_{a_{(0,i)}} + h_{e_{(0,i)}}/2) - (z_{(i)} + h_{(i)}))$ the slope angle between the central cell and its $i$-th neighbor (see Fig. \ref{fig:cases}), according to the concept of critical height, the cells for which
$$
h_{e_{(0,i)}} \leq hc \cos \theta_i
$$
are eliminated and cannot receive flow.

The minimization algorithm of the differences is therefore applied to the following quantities, in order to compute the minimizing outflows:

\begin{tabular}{l}
$u_{(0)} = z_{(0)}$\\
$m = h_{(0)}$\\
$u_{(i)} = z_{(i)} + h_{(i)}$
\end{tabular}

The application of the algorithm determines the computation of the minimizing flows, $\phi_{(0,i)}$, from the central cell to the $i$-th neighbor, where $\phi_{(0,0)}$ represents the residual flow which does not leave the cell. Eventually, final velocities and displacements are computed. As a first step, final velocities are computed for each outflow $\phi_{(0,i)}$ $(i=1,2, \ldots, 8)$, by taking into account dissipation:
$$
v_{f_{(0,i)}} = (v_{0_{(0,i)}} + a t)(1-dP)
$$
Here, $a = g \sin \theta$ is the acceleration of gravity, and does not take into account dissipation, which is modeled by the function $dP$. Instead, the final velocity of $\phi_{(0,0)}$ is computed as:
$$
v_{f_{(0,0)}} = v_{0_{(0)}}(1-dP)
$$
In order to compute the displacement, a mean acceleration is computed, which also takes into account dissipation effects: $\overline{a} = (v_{f_{(0,i)}} - v_{0_{(0,i)}})/t$. Therefore, the displacements $s_{(0,i)}$ $(i = 1,2, \ldots, 9)$ are computed as:
$$
s_{(0,i)} = v_{0_{(0,i)}} t + \frac{1}{2} \overline{a} t^2
$$
while, a null displacement is assigned to $\phi_{(0,0)}$:
$$
s_{(0,0)} = 0
$$
since, even if in the real case a movement can occur, inside the discrete context of the cellular space, it is always located at the center of the cell. This is a model simplification which is much more correct as the smaller the size of the cell is.

\begin{figure}[!t]
\centering
\includegraphics[scale=0.8]{./images/fig2PDP}
\caption{Cases in which the generic neighbor (\textit{cell} $i$) is
eliminated or not eliminated by the minimization algorithm of the difference. If the neighbor is eliminated (\textit{Case} 1), the overall amount of debris inside the central cell is considered as apparent ($h=h_a$), and can not generate an outflow. If the neighbor is not eliminated (\textit{Case} 2 and 3), a part (\textit{Case} 2) or the entire amount of debris (\textit{Case} 3) on the central cell is considered effective ($h \geq h_e$) and can generate outflows. Note that the slope angle $\theta$, considered in the critical height computation, is also shown.}
\label{fig:cases}
\end{figure}

\subsubsection{Time evaluation}\label{sect:modeltimeEvaluation}
Once the minimizing outflows are computed, the CA clock can be determined. As stated above, when $\tau_1$ is executed in ``time evaluation mode'', $t$ is preliminary set to a large value, $t_{\max}$. As a consequence, the computed displacements, $s_{(0,i)}$, can overcome the maximum allowed distance, $w$, i.e. the distance between the central cell and the neighbor that receive the flow. In case of over-displacement, i.e. $s_{(0,i)} > w$, the time $t$ must be opportunely reduced in order to avoid the overflow. The new value of $t$ is determined as follows:

%As a consequence, the computed displacements, $s_{(0,i)}$, can overcome the maximum allowed distance, $d_{(0,i)}$, which is set equal to the distance between the central cell and the neighbor that receive the flow:
%$$
%d_{(0,i)}=
%	\begin{cases}
%		w, & \mbox{if }i \in \{1,2,3,4\} \\
%		w \sqrt{2}, & \mbox{otherwise }\\
%	\end{cases}
%$$
%In case of over-displacement, i.e. $s_{(0,i)} > d_{(0,i)}$, the time $t$ must be opportunely reduced in order to avoid the overflow. The new value of $t$ is determined as follows:

\begin{itemize}
%\item for each minimizing flow, $\phi_{(0,i)}$, a new time, $t_{(0,i)}$, is computed by imposing $s_{(0,i)} = d_{(0,i)}$ and by solving the equation with respect to $t$:
%$$
%t_{(0,i)} = t = \frac{ - v_{0_{(0,i)}} + \sqrt{v_{0_{(0,i)}}^2 + 2 \overline{a} d_{(0,i)}} }{\overline{a}}
%$$
%so that overflow is avoided between the central cell and its $i$-th neighbor;

\item for each minimizing flow, $\phi_{(0,i)}$, a new time, $t_{(0,i)}$, is computed by imposing $s_{(0,i)} = w$ and by solving the equation with respect to $t$:
$$
t_{(0,i)} = t = \frac{ - v_{0_{(0,i)}} + \sqrt{v_{0_{(0,i)}}^2 + 2 \overline{a} w} }{\overline{a}}
$$
so that overflow is avoided between the central cell and its $i$-th neighbor;

\item a new time, $t_j$, is computed in order to avoid overflow conditions along all the neighborhood as:
$$
t_c = \min_{i=1,2, \ldots ,8} t_{(0,i)}
$$
so that overflow is avoided in all the neighborhood;

\item a new minimal time, $t_{opt}$, is computed as:
$$
t_{opt} = \min_{c \in R} t_{c}
$$
in order to avoid overflow conditions over all the cellular space $R$;

\item $t_{opt}$ is multiplied by a relaxation rate factor, $0 < r \leq 1$, for smoothing the phenomenon, and the new CA clock, $\overline{t}$, is obtained:
$$
\overline{t} = t_{opt} r
$$
\end{itemize}

\subsubsection{Outflows computation}
In ``flow computing mode'', minimizing outflows, $\phi_{(0,i)}$, are re-computed by considering the new CA clock $\overline{t}$. Subsequently, lava outflows, $h_{(0,i)}$, are computed proportionally to the displacement, by simply multiplying the minimizing outflow by the ratio between the actual displacement and the maximum allowed:
$$
%h_{(0,i)} = \phi_{(0,i)} \frac{ s_{(0,i)} }{ d_{(0,i)} }
h_{(0,i)} = \phi_{(0,i)} \frac{ s_{(0,i)} }{ w }
$$
Final velocity and displacement are computed as in Section \ref{sec:min-ouflows}.

\subsection{Elementary process $\tau_2$: updating of mass and
momentum}\label{sect:sciaraModelTau2} The elementary process updates lava
thickness and momentum.
It is formally defined as:
$$
\tau_2: Q_f^9 \times Q_{\overrightarrow{v_f}}^9 \to Q_h \times Q_{\overrightarrow{p}}
$$
Once the outflows $h_{(0,i)}$ are known for each cell $c \in R$, the new lava thickness inside the cell can be obtained by considering the mass balance between inflows and outflows:
$$
h_{(0)} = \sum_{i=0}^9 (h_{(i,0)} - h_{(0,i)})
$$

Moreover, also the new value for the momentum can be updated by accumulating the contributions given by the inflows:
$$
\overrightarrow{p}_{(0)} = \sum_{i=0}^9 h_{(i,0)} \overrightarrow{v_f}_{_{(i,0)}}
$$
%while its components along the $x$ and $y$ directions can be simply obtained as:
%$$
%p_{x_{(0)}} = \sum_{i=0}^9 h_{(i,0)} v_{(i,0)} \cos \alpha_{(i,0)}
%$$
%$$
%p_{y_{(0)}} = \sum_{i=0}^9 h_{(i,0)} v_{(i,0)} \sin \alpha_{(i,0)}
%$$
%being $\alpha_{(i,0)}$ the angle which defines the direction of the velocity of the $i$-th inflow, $h_{(i,0)}$.

\subsection{Elementary process $\tau_3$: temperature variation and lava
solidification}\label{sect:temperatureDrop}

$$
\tau_3: Q_f^9 \times Q_T^9 \to Q_T \times Q_h
$$

As in the elementary process $\tau_1$, a two step process determines the new
cell lava temperature. In the first one, the temperature is obtained as weighted
average of residual lava inside the cell and lava inflows from neighboring ones:
$$
\overline{T} = \frac{ \sum_{i=0}^8 h_{(i,0)} T_i } { \sum_{i=0}^8 h_{(i,0)} }
$$ A further step updates the calculated temperature by considering thermal
energy loss due to lava surface radiation \cite{Park1984}:
$$ T = \frac{\overline{T}}  { \sqrt[3]{1 + \frac{3\overline{T}^3 \epsilon \sigma
\overline{t} \delta}{\rho c_v w^2 h}} } $$ where $\epsilon$, $\sigma$,
$\overline{t}$, $\delta$, $\rho$, $c_v$, $w$ and $h$ are the lava emissivity,
the Stephan-Boltzmann constant, the CA clock, the cooling parameter, the lava
density, the specific heat, the cell side and the debris thickness, respectively
(see Tab. \ref{tab:parameters}). When the lava temperature drops below the
threshold $T_{sol}$, lava solidifies. Consequently, the cell altitude increases
by an amount equal to lava thickness and new lava thickness is set to zero.

Lava flows are computed by a two-step process: the first computes the CA clock, $t$, i.e. the physical time corresponding to a CA computational step, while the second the effective lava outflows, $h_{(0,i)}$, their velocities $v_{f_{(0,i)}}$ and displacements $s_{(0,i)}$ $(i=0,1,...,8)$. The elementary process $\tau_1$ is thus executed two times, the first one in ``time evaluation mode'', the second in ``flow computing mode''. Both modes compute the so called ``minimizing outflows'', $\phi_{(0,i)}$, i.e. those which minimize the unbalance conditions within the neighborhood, besides their final velocities and displacements. In ``time evaluation mode'', $t$ is preliminary set to a large value, $t_{\max}$, and the computed displacement, $s_{(0,i)}$, is compared with the maximum allowed value, $d_{(0,i)}$, which is set to the distance between the central cell and the neighbor that receives the flow. In case of over-displacement, the time $t$ must be opportunely reduced in order to avoid the overflow condition. In case no over-displacement are obtained, $t$ remains unchanged. Eventually, in ``flow computing mode'', effective lava outflows, $h_{(0,i)}$, are computed by adopting the CA clock obtained in ``time evaluation mode'', by guarantying no overflow condition.


\documentclass{mrl}

\title{Dual linkable ring signatures}
\authors{Sarang Noether\footnote{\texttt{sarang.noether@protonmail.com}} and Brandon Goodell\footnote{\texttt{surae.noether@protonmail.com}}}
\affiliations{Monero Research Lab}
\date{\today}

\type{RESEARCH BULLETIN}
\ident{MRL-0008}

\begin{document}

\begin{abstract}
This bulletin describes a modification to Monero's linkable ring signature scheme that permits dual-key outputs as ring members. Key images are tied to both output one-time public keys in a dual, preventing both keys in that transaction from being spent separately. This method has applications to non-interactive refund transactions. We discuss the security implications of the scheme.
\end{abstract}

\section{Introduction}
The original CryptoNote protocol describes the use of a type of one-time linkable spontaneous anonymous group (LSAG) signature. A signer chooses a so-called ring of public output keys, one of which is her own, and fashions a signature on the message of her choice. The scheme is such that any verifier can be assured that one of the keys in the ring is the true signer (that is, the signer knows the corresponding private key), and that this key was not used to sign any other message with any other ring. For space efficiency, early Monero transactions used a ring-independent one-time version of the LSAG signature scheme in \cite{liu} to direct funds using the ring as a sender anonymity set.

To handle confidential transactions, Monero uses a variation of this scheme called multilayered linkable spontaneous anonymous group (MLSAG) signatures. These signatures allow the signer to include vectors of keys that include Pedersen commitments to amounts, as described in \cite{shen}.

In both LSAG and MLSAG signatures, ring members (with the exception of amount commitments) are output public keys, which are generated in Monero transactions. A given transaction typically has multiple outputs, where the sender directs a portion of funds from a previous output to some address, and sends the change back to herself so the transaction balances. In each case, the recipient can recover the output's private key and use it in a later ring signature.

In this research bulletin, we describe a modification to the construction of transaction outputs and to the construction of ring signatures. We first describe a change whereby a sender generates a dual-key output and a specified trigger block height that ``switches" the validity between the two. Further, we describe a modification to LSAG and MLSAG signatures, a dual linkable spontaneous anonymous group (DLSAG) signature scheme, that allows a sender to include one of these dual-key outputs in a linkable ring signature. When a dual, which is comprised of two separate output public keys, is the true spender, any verifier can link two ring signatures if they were computed by either of the keys in the dual. Additionally, it is possible to include both dual-key outputs and non-dual (that is, single) outputs as ring members in a DLSAG signature, ensuring that signers have the largest possible set of potential ring members available to them.

This signature scheme has applications to refund transactions in Monero, which themselves are important for certain second-layer solutions. To generate such a refund transaction, a sender generates a dual-key output and specifies a trigger block height. The consensus protocol could dictate that prior to the trigger height, only one of the keys in the dual is valid as a spender; after the trigger height, only the other key in the dual is valid. This allows the sender to reclaim the funds if they are not spent by the recipient in time.

A related version of this scheme was originally described in personal communication with Pedro Moreno-Sanchez, and was in collaboration with pseudonymous coauthor \texttt{donut}. This related scheme considered the use of commitments to block trigger heights in order to hide the actual switching height.

\section{Description}
Let $\mathbb{G}$ be an additive group of prime order $\ell$. Let $H_s: \{0,1\}^* \to \mathbb{Z}_\ell$ and $H_p: \{0,1\}^* \to \mathbb{G}$ be cryptographic hash functions. Let $G \in \mathbb{G}$ be a publicly-known group generator.

When sending funds in a Monero transaction, the sender uses the recipient's public user address $(A,B) := (aG,bG) \in \mathbb{G} \times \mathbb{G}$, along with a random nonce $r$, to generate a one-time output public key defined as $P := H_s(rA,t)G + B$, where $t$ is the output's index within the transaction. The recipient uses her private user key $(a,b)$ and the point $R := rG$ to recover the output private key $p := H_s(aR,t) + b$, which is used to spend the funds as part of a later ring signature.

To facilitate refund transactions, we assume that a sender has generated a modified output consisting of two one-time public keys. One such key is directed to the recipient's address, while the other is typically directed back to the sender. These one-time keys are called a \textit{dual}, and are designated as such in the transaction structure for later identification. The dual also has an associated trigger block height value, with the intent that prior to the trigger, only the first one-time key is valid and can be used to spend the associated funds, and after the trigger, only the second is valid. This has the effect of permitting the recipient to claim funds up to a certain time, after which the sender can reclaim them.

Despite the simplicity of generating separate outputs representing the spend authority of the same funds based on a given block height, it does not suffice to use a traditional LSAG or MLSAG ring signature that includes one of the public keys in a dual without modifying the key image computation. Because key images are computed for each output spent in a ring signature, it would be possible for both the pre-trigger and post-trigger keys to be used in separate signatures undetected. To combat this, we modify the LSAG scheme such that one-time output public keys come in pairs that share the same key image. We later discuss the MLSAG equivalent to the construction.

\subsection{Signature generation}
We show the steps of generating the DLSAG signature in Table \ref{table:dlsag_gen}, allowing for any of the ring members (including the real spender) to be either part of a dual or not. In the following notation, we assume the spender wishes to spend funds associated to a one-time key $P_\pi = p_\pi G$ with a ring size $n$, where $1 \leq \pi \leq n$ is a secret index. We also assume that any key $P_i$ that is part of a dual has a partner key $Q_i$. The roles of $P_i$ and $Q_i$ in a dual are arbitrary.

\begin{table}
\begin{center}
\begin{tabular}{lcl}
Dual-key & & Single-key \\
\hline
$m_\pi \equiv H_s(\textsf{txid},\textsf{index})$ \\
$J \equiv m_\pi p_\pi Q_\pi$ & & $J \equiv p_\pi H_p(P_\pi)$ \\
$F_\pi \equiv m_\pi Q_\pi$ & & $F_\pi \equiv H_p(P_\pi)$ \\
& choose random $u$ \\
& $c_{\pi+1} \equiv H_s(\textsf{txdata},uG,uF_\pi)$ \\
\hline
& for each $i \neq \pi$ \\
& choose random $s_i$ \\
$m_i \equiv H_s(\textsf{txid},\textsf{index})$ \\
$F_i \equiv m_iQ_i$ & & $F_i \equiv H_p(P_i)$ \\
& $c_{i+1} \equiv H_s(\textsf{txdata},s_iG + c_iP_i,s_iF_i+ c_iJ)$ \\
\hline
& $s_\pi \equiv u - c_\pi p_\pi$ \\
& output $(c_1,\{s_i\}_{i=1}^n,J)$
\end{tabular}
\caption{DLSAG signature generation}
\label{table:dlsag_gen}
\end{center}
\end{table}

Note that a DLSAG signature fully reduces to the LSAG case when all keys in the ring, including the true spender, are not part of a dual; that is, when the signature follows only the right-hand side of the above diagram.

The sender is free to sign with either type of key. However, she must consider a restriction on the allowed ring members. If a potential ring member is part of a dual, she must examine the original transaction and determine whether that key is valid at the current block height. If it is not, then she must choose the partner key within the dual. She may wish to further avoid keys whose trigger is very close to the current block height in case her transaction is not included in a new block quickly enough. These restrictions ensure that adversarial verifiers of the signature cannot easily eliminate invalid ring members when trying to determine the true spender.

Also observe that partner keys $P$ and $Q$ in a dual share the same key image when generated in the same transaction, since $mpQ = mqP = mpqG$ by construction. The inclusion of the hash $m$, which encodes both the originating transaction as well as the index of the output within that transaction, prevents one of the two recipients of a dual from burning the funds of the other by generating another dual with the same key image that the evil recipient spends first.

\subsection{Signature verification}
Verification of a DLSAG proceeds similarly to that of an LSAG signature, and may be done by any observer. When presented with a list of output public keys that are used in the ring signature, the verifier first ensures that for any keys that are part of a dual, the chosen key is valid at the transaction's block height. If not, the verifier rejects the signature. The verifier also examines the key image $J$; if it appears as part of any previous valid LSAG or DLSAG signature, the signature is rejected. The verifier next completes the steps in Table \ref{table:dlsag_ver}.

\begin{table}
\begin{center}
\begin{tabular}{lcl}
Dual-key & & Single-key \\
\hline
& for each $1 \leq i < n$ \\
$m_i \equiv H_s(\textsf{txid},\textsf{index})$ \\
$F_i \equiv m_i Q_i$ & & $F_i \equiv H_p(P_i)$ \\
& $c_{i+1} \equiv H_s(\textsf{txdata},s_iG + c_iP_i,s_iF_i + c_iJ)$ \\
\hline
$m_n \equiv H_s(\textsf{txid},\textsf{index})$ \\
$F_n \equiv m_n Q_n$ & & $F_n \equiv H_p(P_n)$ \\
& $c_1^* \equiv H_s(\textsf{txdata},s_nG + c_nP_n,s_nF_n + c_nJ)$ \\
& accept only if $c_1^* = c_1$
\end{tabular}
\caption{DLSAG signature verification}
\label{table:dlsag_ver}
\end{center}
\end{table}

\section{Application to refund transactions}
A useful application of the DLSAG scheme is to refund transactions. Some constructions of payment channels, which permit off-chain transactions between two parties that are later settled, require the use of non-interactive refund transactions as well. Suppose that Alice wishes to send funds to Bob, but wants to ensure that they are returned to her after an agreed-upon amount of time if Bob does not spend them. To do so, Alice constructs a transaction where the funds destined for Bob are part of a dual: one key $P$ is directed to Bob, and the partner key $Q$ is directed to her. The two keys in the dual share a range proof. A block height $h$ is included in the transaction data, where $h$ is greater than the current block height of the network.

If Bob wishes to claim the funds, he must spend them prior to block height $h$ in a transaction that uses the key $P$ in a DLSAG signature. Verifiers see that the transaction includes $P$ among its ring members, and that this output is still valid. The key image is of the form $J = mpQ$, which has not been used before. The verifiers accept the transaction as valid.

However, if Bob does not claim the funds prior to block height $h$, Alice may claim them by spending her key $Q$ using a DLSAG signature. Verifiers now see that the transaction includes $Q$, and that this key is now valid. The key image is $J = mqP$, which has not been used since Bob did not spend $P$. The verifiers accept this transaction as valid.

Notice that if Bob spent $P$ prior to height $h$ but Alice becomes evil and wishes to spend $Q$ after height $h$ (which would constitute a double spend), the process will properly fail. Verifiers will find Alice's key image $J = mqP = mpQ$ to be the same as Bob's, and will reject her transaction. This construction of a shared key image is essential, as otherwise verifiers would not reject Alice's evil transaction. On the other hand, if the chain on which Bob signed the transaction is later overtaken by a chain with greater cumulative difficulty that does not include Bob's transaction, Alice can always claim the funds later; we consider this possibility outside the scope of this work.

\section{Multi-input extension}
The DLSAG construction presented above applies only to the now defunct CryptoNote ring signature implementation. However, modern transactions require a more robust multi-key signature that can accommodate the amount commitments used in the Monero confidential transaction model. We therefore must ensure that there is an appropriate generalization of the DLSAG construction.

In a general MSLAG signature, each of the $k$ inputs has an associated ring containing $n$ public output keys (in addition to a separate amount commitment that we do not consider here). The sender chooses a secret index $1 \leq \pi \leq n$ such that she controls the public keys $P_{\pi,j} \equiv p_{\pi,j}G$ for $1 \leq j \leq k$. Signature generation proceeds according to the steps in Table \ref{table:general_gen}.

\begin{table}
\begin{center}
\begin{tabular}{lcl}
Dual-key & & Single-key \\
\hline
& for each $1 \leq j \leq k$ \\
$m_{\pi,j} \equiv H_s(\textsf{txid},\textsf{index})$ \\
$J_j \equiv m_{\pi,j}p_{\pi,j}Q_{\pi,j}$ & & $J \equiv p_{\pi,j}H_p(P_{\pi,j})$ \\
$F_{\pi,j} \equiv m_{\pi,j}Q_{\pi,j}$ & & $F_{\pi,j} \equiv H_p(P_{\pi,j})$ \\
& choose random $u_j$ \\
\hline
& $c_{\pi+1} \equiv H_s(\textsf{txdata},\{u_jG,u_jF_{\pi,j}\}_{j=1}^k)$ \\
\hline
& for each $i \neq \pi, 1 \leq j \leq k$ \\
& choose random $s_{i,j}$ \\
$m_{i,j} \equiv H_s(\textsf{txid},\textsf{index})$ \\
$F_{i,j} \equiv m_{i,j}Q_{i,j}$ & & $F_{i,j} \equiv H_p(P_{i,j})$ \\
& $c_{i+1} \equiv H_s(\textsf{txdata},\{s_{i,j}G + c_{i}P_{i,j},s_{i,j}F_{i,j}+ c_{i}J_j\}_{j=1}^k)$ \\
\hline
& for each $1 \leq j \leq k$ \\
& $s_{\pi,j} \equiv u_j - c_\pi p_{\pi,j}$ \\
\hline
& output $(c_1,\{s_{i,j}\}_{i,j=1}^{n,k},\{J_j\}_{j=1}^k)$
\end{tabular}
\caption{Generalized DLSAG signature generation}
\label{table:general_gen}
\end{center}
\end{table}

As before, this reduces completely to an MLSAG signature if no ring members are part of a dual. Further, it reduces entirely to the single-input DLSAG construction shown above in the case $k=1$. Given a signature and description of the corresponding set of public one-time output keys, signature verification follows the steps in Table \ref{table:general_ver}.

\begin{table}
\begin{center}
\begin{tabular}{lcl}
Dual-key & & Single-key \\
\hline
& for each $1 \leq i < n, 1 \leq j \leq k$ \\
$m_{i,j} \equiv H_s(\textsf{txid},\textsf{index})$ \\
$F_{i,j} \equiv m_{i,j}Q_{i,j}$ & & $F_{i,j} \equiv H_p(P_{i,j})$ \\
& $c_{i+i} \equiv H_s(\textsf{txdata},\{s_{i,j}G + c_{i}P_{i,j},s_{i,j}F_{i,j} + c_{i}J_j\}_{j=1}^k)$ \\
\hline
& for each $1 \leq j \leq k$ \\
$m_{n,j} \equiv H_s(\textsf{txid},\textsf{index})$ \\
$F_{n,j} \equiv m_{n,j}Q_{n,j}$ & & $F_{n,j} \equiv H_p(P_{n,j})$ \\
& $c_1^* \equiv H_s(\textsf{txdata},\{s_{n,j}G + c_{n}P_{n,j},s_{n,j}F_{n,j}+ c_{n}J_j\}_{j=1}^k)$ \\
& accept only if $c_1^* = c_1$
\end{tabular}
\caption{Generalized DLSAG signature verification}
\label{table:general_ver}
\end{center}
\end{table}

\section{Security}
The similarity between DLSAG signatures and the LSAG (from \cite{liu}) and MLSAG (from \cite{shen}) schemes leads to similar proofs of security. As in the cited cases, we want to show that our signatures are unforgeable, linkable, and signer-ambiguous. As the proofs are nearly identical to those presented for the original signature schemes, we highlight only the notable differences.

\subsection{Unforgeability}
The LSAG/MLSAG proofs of unforgeability use the number of calls to random oracles to establish bounds on a defined adversary's advantage in breaking the discrete logarithm problem in recovering a signer's private key. These oracles represent the behavior of the hash-to-scalar function $H_s$, hash-to-point function $H_p$, and valid signing. We observe that for a dual key image of the form $J = mpqG$, the value $m$ is uniformly distributed under the random oracle model. For a uniformly distributed value $xG$, the distributions of $(pG,qG,J)$ and $(pG,qG,xG)$ are computationally indistinguishable under the decisional Diffie-Hellman assumption.

The proof of unforgeability in \cite{shen} therefore holds with only minor modification, where we consider calls to the hash-to-point random oracle for dual keys replaced by calls to a decisional Diffie-Hellman oracle.

\subsection{Linkability}
If an adversary is able to create two signatures signed by key vectors sharing a common true signing key, there are two cases. If the common signing key is not part of a dual, the proof continues identically to \cite{shen}. If the common signing key is part of a dual, then we observe that $$\log_G(s_iG + c_iP_i) = \log_{m_iQ_i}(s_iF_i + c_iJ)$$ where $i$ is the index of the common signing key in one of the signatures; this leads to the same conclusion as in \cite{shen}.

\subsection{Signer ambiguity}
We observe that the ambiguity proof in \cite{shen} does not rely on the particular structure of the base point used in terms passed into the hash-to-scalar function $H_s$ to generate commitments. The proof is trivially modified to account for the $F_i$ terms presented here.

\subsection{Heuristic attacks}
The DLSAG scheme provides a guarantee that, absent external information, any public key referenced in a signature is equiprobable as the true signer. However, an adversary may use such external information to undermine this guarantee via heuristics.
\begin{itemize}
\item \textit{Spend time}. If Alice initiates a refund transaction to Bob and Bob does not spend the funds before the trigger height, Alice may attempt to spend the funds shortly after this occurs. If an adversary sees a ring containing a dual whose trigger was recently reached (or perhaps is about to be reached), the adversary may conclude that the dual is the true spender. Moreover, one of the keys in a dual is valid for only a small amount of time, while its partner is available in perpetuity. Such heuristics should be considered in relation to the suspected spend patterns discussed elsewhere, as in \cite{monerolink,monerolink2}.
\item \textit{Availability of dual outputs}. Dual outputs are trivially distinguishable from single outputs. If the number of available dual outputs in the blockchain is small relative to single outputs, they will be chosen less frequently as ring members. An adversary may conclude that any ring containing dual outputs is more likely to have such an output as the true spender.
\end{itemize}

\subsection{Key reuse}
The current Monero transaction implementation mitigates against both double-spending and one-time key reuse. If a user's wallet sees multiple outputs paying to the same one-time key, it chooses the one with the largest amount; otherwise, it risks losing a larger amount since all such outputs have the same key image. Note that the proposed construction separates these roles; the modified key image computation considered here will not inherently prohibit spending to the same one-time key. Alternate protocol-level rules involving one-time key reuse, or the inclusion of a second key image and more complex signature, would be required to retain this.

\section{Concluding remarks}
The signature scheme presented here offers an interesting and novel approach to non-interactive refund transactions for use in Monero. However, implementation choices like block height commitments and requirements for outputs would have an effect on transaction complexity, size, and adversarial heuristics. It is not known whether a space-efficient key generation method could be used to describe dual-key outputs in a more efficient way. The cost in verification complexity is likely to be unavailable without novel signature schemes.

\bibliographystyle{plain}
\bibliography{main}

\end{document}