% !TEX root = ../zeth-protocol-specification.tex

\section{Definitions}\label{preliminaries:definitions}

\subsection{Negligible function}\label{preliminaries:definitions:neg-func}

\begin{definition}[Negligible function, {\cite[Definition 3.4]{katz2014introduction}}]
    A function $f$ from $\NN$ to $\RR^{+}$ (positive real numbers) is negligible if for every positive polynomial $p$ there exists $N$ such that for all integers $n>N$ it holds that $f(n)< \frac{1}{p(n)}$.
\end{definition}

\subsection{Basic algebra notions}\label{preliminaries:definitions:basic-algebra}

\begin{definition}[Group, {see~\cite[Section I.4]{bourbaki2003elements}}]
    A group is given by a tuple $(\gset, \otimes)$, where $\gset$ is a set and $\otimes$ is a binary operation in $\gset$, i.e. $\otimes:\gset\times\gset\to \gset$, with the following properties:
    \begin{itemize}
        \item $(\gel{g} \otimes \gel{h}) \otimes \gel{k} = \gel{g} \otimes (\gel{h} \otimes \gel{k})$ (associativity)
        \item There exists an element $\gel{\epsilon} \in \gset$ \suchthat{} for each $\gel{g} \in \gset$, $\gel{g} \otimes \gel{\epsilon} = \gel{\epsilon} \otimes \gel{g} = \gel{g}$ (identity element).
        \item For each $\gel{g} \in \gset$ there exist $\gel{h} \in \gset$ \suchthat{} $\gel{g} \otimes \gel{h} = \gel{h} \otimes \gel{g} = \epsilon$ (inverse element).
    \end{itemize}
\end{definition}

For simplicity, we may also use the additive notation for groups: $\otimes$ is denoted as $+$, the identity element as $\gel{0}$ and the inverse element of $\gel{g}$ as $-\gel{g}$. Given $\gel{g} \in \gset$ and $x \in \mathbb{Z}$, we have that:
\[x \cdot \gel{g} =
\begin{cases}
    \gel{0} & \mbox{if } x = 0\\
    \gel{g} + \ldots + \gel{g}, (x \mbox{ times}) & \mbox{if } x > 0 \\
    -\gel{g} + \ldots + (-\gel{g}), (x \mbox{ times}) & \mbox{if } x < 0
\end{cases}.
\]
\begin{definition}[Finite Cyclic Group, {adapted from~\cite[Sections 7.1.3, 7.3.2]{katz2014introduction}}]
    A finite cyclic group is given by a tuple $(q, \gset, \ggen, \otimes)$, called the \emph{group description}, where $\gset$ represents the set of group elements, $\ggen$ is a generator and $q$ is the order. The generator $\ggen$ generates the group; namely, each $h \in \gset$ can be expressed by the generator as $\gel{h} = \ggen \otimes \ldots \otimes \ggen $.
    Given a scalar $x$, we denote by $\groupenc{x}$ the \emph{encoding} of $x$ in $\gset$: i.e. $\groupenc{x} = \ggen \otimes \ldots \otimes \ggen$ ($x$ times). As consequence, $\groupenc{1} = \ggen$.
\end{definition}

For theoretical purposes, we introduce the \groupSetup{} algorithm that for a given security parameter \secpar{} outputs a cyclic group, formally:
\begin{definition}[Group Setup Algorithm, {taken from~\cite[Sections 7.1.3, 7.3.2]{katz2014introduction}}]
    A group setup algorithm \groupSetup{} is a \ppt{} algorithm which takes as input a security parameter \secparam{} and outputs a group description $(q, \gset, \ggen, \otimes)$, where the binary representation of $q$ is given by $\secpar$ bits and each group element can be represented by $\groupLen(\secpar)$ bits. Note that \groupLen{} is \poly.\footnote{For simplicity we may denote \groupLen(\secpar) as \groupLen{}.}
\end{definition}

\subsection{Symmetric Encryption}\label{preliminaries:definitions:sym-enc}

\begin{definition}[Symmetric Encryption,{\cite[Definition 3.8]{katz2014introduction}}]
    A symmetric encryption scheme \sym{} is given by a tuple of \ppt{} algorithms $(\kgen,\enc, \dec)$ where:
\begin{itemize}
    \item \kgen{}, the key generation algorithm, takes a security parameter \secparam{} and outputs a secret key \ek; we assume, without loss of generality, that $\symKeyLen (\secpar) = \len{\ek}\geq \secpar$. Note that $\symKeyLen(\secpar)$ is a polynomial function in \secpar.\footnote{For simplicity we may denote \symKeyLen(\secpar) as \symKeyLen{}.}
    \item \enc{}, the encryption algorithm, takes a key \ek{}, a plaintext $\msg\in\bin^{*}$ and returns a ciphertext $\ct$.
    \item \dec{}, the decryption algorithm, takes a key \ek{} and a ciphertext $\ct$, and returns a message $\msg$. We assume, without loss of generality, that \dec{} is deterministic.
\end{itemize}
    For every security parameter $\secpar{}$, key $\ek$ output by $\kgen{(\secparam{})}$, and message $\msg \in \bin^{*}$, it holds that $\dec(\ek, \enc(\ek, \msg)) = \msg$ (\emph{correctness property}).
\end{definition}

If $(\kgen,\enc, \dec)$ is such that for key $\ek$ output by $\kgen{(\secparam)}$, algorithm $\enc(\ek, \cdot)$ is only defined for messages $\msg\in\bin^{l(\secpar)}$, then we say that $(\kgen,\enc, \dec)$ is a \emph{fixed-length symmetric encryption scheme} with \emph{length parameter} $l(\secpar)$ ($l$ is $\poly$). A security notion for \sym{} follows:

\begin{figure}[h!]
    \centering
    \procedure[syntaxhighlight=auto, space=auto]{$\indcpa (\secpar)$}{
        \ek\gets\kgen{(\secparam{})} \\
        (\msg_0, \msg_1, \state)\gets{} \adv^{\oracle{\enc_{\ek}}}\ \mbox{with}\ \len{\msg_0} = \len{\msg_1}\\
        b \sample{}\bin{} \\
        \ct\gets{} \enc(\ek,\msg_b) \\
        \widetilde{b}\gets{} \adv^{\oracle{\enc_{\ek}}} (\ct, \state)\\
        \pcreturn{} \widetilde{b} = b\\
    }
    \caption{\indcpa{} game for \sym.}\label{fig:indcpa}
\end{figure}

\begin{definition}[\indcpa]
    Let $\sym$ be a symmetric encryption scheme and let \adv{} be an adversary. Consider the \indcpa{} game described in Figure~\ref{fig:indcpa}.
    We define the \indcpa{} advantage of \adv{} as follows:
    \[
        \advantage{\indcpa}{\sym, \adv} =  \abs{2\cdot\prob{\indcpa(\secpar) = 1} - 1}.
    \]
    \sym{} is said to be \indcpa{} secure if, for every \ppt{} adversary \adv{}, the advantage \advantage{\indcpa}{\sym, \adv} is a negligible function.
\end{definition}

\subsection{Asymmetric Encryption}\label{preliminaries:definitions:asym-enc}

\begin{definition}[Asymmetric encryption, {\cite[Definition 10.1]{katz2014introduction}}]
    An \emph{asymmetric encryption scheme} \aSym{} is given by a tuple of \ppt{} algorithms $(\kgen,\enc,\dec)$ where:
    \begin{itemize}
        \item \kgen{}, the key generation algorithm, takes a security parameter $\secparam{}$ and returns a pair of keys $(\sk,\pk)$. We refer to the first of these as \emph{private key} and the second as \emph{public key}. We assume for convenience that $\pk$ and $\sk$ each have length at least $\secpar{}$, and that $\secpar{}$ can be determined from $\pk$, $\sk$;
        \item \enc{}, the encryption algorithm, takes a public key $\pk$, a plaintext $\msg$, from some underlying plaintext space (that may depend on \pk) and returns a ciphertext $\ct$;
        \item \dec{}, the decryption algorithm, takes a private key $\sk$ and a ciphertext $\ct$, and returns a message $\msg$ or a special symbol $\bot$ denoting the decryption failure. We assume, without loss of generality, that \dec{} is deterministic.
    \end{itemize}
    We require that for all $(\sk,\pk)$ returned by $\kgen$, and every message $\msg$ in the appropriate underlying plaintext space, it holds that $\dec(\sk, \enc(\pk,\msg)) = \msg$ (\emph{correctness property}).
\end{definition}

Secure communication usually requires ciphertext indistinguishability  (e.g. \indccaii{}~\cite[Definition 8]{abdalla1999dhaes}). In \zeth, however, the key privacy property \ikcca{}~\cite{bellare2001key} is also required: it ensures indistinguishability of the key under which an encryption is performed.

\begin{figure}[h!]
    \centering
    \procedure[syntaxhighlight=auto, space=auto]{$\ikcca (\secpar)$}{
        (\sk_0,\pk_0), (\sk_1,\pk_1) \gets\kgen{(\secparam{})}\\
        (\msg, \state)\gets{} \adv^{\oracle{\dec_{\sk_0}}, \oracle{\dec_{\sk_1}}} (\pk_0,\pk_1)\\
        b \sample{} \bin{} \\
        \ct \gets{} {} \enc(\pk_b, \msg)\\
        \widetilde{b}\gets{} {} \adv^{\oracle{\dec_{\sk_0}}, \oracle{\dec_{\sk_1}}} {(\ct,\state)}\\
        \pcreturn{} \widetilde{b} = b
    }
\caption{\ikcca{} game.}\label{fig:ikcca}
\end{figure}

\begin{definition}[\ikcca]\label{preliminaries:def:ikcca}
    Let $\aSym = (\kgen,\enc, \dec)$ be an asymmetric encryption scheme and let \adv{} be an adversary. Given the \ikcca{} game described in Figure~\ref{fig:ikcca}, with the condition that \adv{} cannot query $\oracle{\dec_{\sk_0}}$ or $\oracle{\dec_{\sk_1}}$ on the challenge ciphertext $\ct$\footnote{$\state$ is some state information that the adversary outputs after the choice of the message to encrypt. It can be some preprocessed information that can be helpful to win the game}, we define the \ikcca{} advantage of \adv{} as follows:
    \[
        \advantage{\ikcca}{\aSym,\adv} =  \abs{2\cdot\prob{\ikcca(\secpar) = 1} - 1}
    \]
    We say that \aSym{} is \ikcca{} secure if for every \ppt{} adversary \adv{} the advantage \advantage{\ikcca}{\aSym,\adv} is a negligible function.
\end{definition}

\subsection{(Block-cipher-based) Compression functions}\label{preliminaries:definitions:hashcomp}

\begin{definition}
    Let $\kl, \il > 1$. A \emph{block cipher} is a map $\Enc \colon \bin^{\kl} \times \bin^{\il} \to \bin^{\il}$ where, for each key $\key \in \bin^{\kl}$, the function $\Enc_\key(\cdot) = \Enc(\key, \cdot)$ is a permutation on $\bin^{\il}$. If \Enc~is a block cipher then $\Dec$ is its inverse, that on input $(\key, y)$ returns $\msg$ such that $\Enc_\key(\msg) = y$.
\end{definition}

Let $\blockSet(\kl, \il)$ be the set of all block ciphers $\Enc \colon \bin^{\kl} \times \bin^{\il} \to \bin^{\il}$. In order to analyze the security properties of block-cipher based cryptographic constructions it is common to use a security model denoted \emph{the ideal cipher model (ICM)}. Informally speaking, in ICM attackers are allowed to query an oracle simulating a random block cipher and they have no information on the internal structure. We formalize this notion in the following definition:

\begin{definition}[Ideal Cipher Model~\cite{holenstein2011equivalence}]\label{preliminaries:def:ICM}
    The Ideal Cipher Model (ICM), is a security model where all parties are granted access to an ideal cipher $\Enc \colon \bin^{\kl} \times \bin^\il \to \bin^\il$, a random primitive such that the restrictions $\Enc (\key, \cdot )$ for $\key \in \bin^{\kl}$ are $2^{\kl}$ independent random permutations.
\end{definition}

For fixed $\kl$ and $\il$, each party is given access to the oracles \oracleEnc{} and \oracleDec{}, simulating $\Enc$ and $\Dec$, which can be queried for encryption and decryption a polynomial number of times. The encryption oracle takes as input a key, $\key\in \bin^{\kl}$, and a preimage, $\msg \in \bin^{\il}$, and returns a tuple comprising the image, $y \in \bin^{\il}$, along with the inputs, $\key$ and $\msg$. If $(\key, \msg)$ is queried for the first time, the image, $y$, is taken uniformly at random and added to the oracle's table. Otherwise, the oracle returns the $y$ associated with query $(\key, \msg)$ in its table. The decryption oracle is defined similarly with the image and key defined as inputs and the preimage chosen randomly (see:~\cref{preliminaries:fig:icm-oracles}).

\begin{figure}
    \begin{pchstack}[center]
        \procedure[syntaxhighlight=auto]{$\oracleEnc (\key, \msg)$}{
            if (\key, \msg, \cdot) \notin\text{Table}_{\oracle{}} \\
            \t y \sample \bin^\il \\
            \t \text{Table}_{\oracle{}}\text{.append} (\key, \msg, y)\\
            \pcelse{} y = \text{Table}_{\oracle{}} (\key, \msg) \\
            return (\key, \msg, y) \\
        }
        \procedure[syntaxhighlight=auto]{$\oracleDec (\key, y)$}{
            if (\key, \cdot, y) \notin\text{Table}_{\oracle{}}\\
            \t \msg \sample \bin^\il\\
            \t \text{Table}_{\oracle{}}\text{.append} (\key, \msg, y)\\
            \pcelse{} \msg = \text{Table}_{\oracle{}} (\key, y)\\
            return (\key, \msg, y)
        }
    \end{pchstack}
    \caption{Oracles of an ideal block cipher, with $\text{Table}_{\oracle{}}$ being a table of tuples (key, preimage, image) of queries already answered by the oracle.}\label{preliminaries:fig:icm-oracles}
\end{figure}

\begin{definition}[Block-cipher based compression function~\cite{black2002black}]\label{preliminaries:definitions:compression-function}
    A \emph{block cipher-based compression function} is a map $\fFunc$ such that
    \[
        \fFunc \colon \blockSet(\kl, \il) \times \bin^a \times \bin^b \to \bin^c
    \]
    where $\kl,\ \il,\ a,\ b,\ c > 1$ and $a+b > c$. The function \fFunc, given $\msg \in \left ( \bin^a \times \bin^b \right )$, computes $\fFunc(\Enc, \msg)$ using an \Enc-oracle.
\end{definition}

\begin{remark}
    We use the notation \FEnc{} if a compression function \fFunc{} is defined over a given block-cipher \Enc, i.e. $\FEnc: \bin^a \times \bin^b \to \bin^c$ and $\FEnc = \fFunc(\Enc, \cdot)$, for $a, b, c$ as given in the definition above.
\end{remark}

Let \fFunc{} be a compression function based on a block-cipher. Fix a constant $h_0 \in \bin^c$ and an adversary \adv. We define the advantage in finding a collision in \fFunc{} as the real number
\[
    \advColl =
    \prob{
        \begin{aligned}
            &\Enc \sample \blockSet(\kl, \il); ((\key,\msg), (\key',\msg')) \gets \adv^{\oracleEnc, \oracleDec}(\FEnc, h_0):\\
            &((\key, \msg) \neq (\key',\msg') \land \FEnc(\key, \msg) = \FEnc(\key', \msg')) \lor \FEnc(\key, \msg) = h_0
        \end{aligned}
    }.
\]

The previous definition gives credit for finding an $(\key, \msg)$ such that $\FEnc(\key, \msg) = h_0$ for a fixed $h_0 \in \bin^c$.

\subsection{Hash functions}\label{preliminaries:definitions:hash-function}

\begin{definition}[Hash function, {\cite[Definition 4.9]{katz2014introduction}}]
    A hash function \hashSet{} is a pair of algorithms $(\hashSetup, \hash)$ fulfilling the following properties:
    \begin{itemize}
        \item \hashSetup{} is a \ppt{} algorithm which takes as input a security parameter \secparam{} and outputs a key $\hk$. We assume that \secparam{} is included in $\hk$.
        \item $\hash$ is (deterministic) polynomial-time algorithm that takes as input a key $\hk$ and any string $x\in\bin^{*}$, and outputs a string $\hash(\hk, x) = \hash_{\hk}(x)\in\bin^{\hashLen}$, where $\hashLen$ is a polynomial function in \secpar.\footnote{For simplicity we may denote \hashLen(\secpar) as \hashLen{}.}
    \end{itemize}
    If for every \secpar{} and \hk{}, $\hash_{\hk}$ is defined only over inputs of length $\hashInpLen(\secpar)$ and $\hashInpLen(\secpar) > \hashLen(\secpar)$, then we say that \hashSet{} is a \emph{fixed-length hash function} with length parameter $\hashInpLen$. Note that $\hashInpLen(\secpar)$ is a polynomial function in \secpar.
\end{definition}

Informally, for a given function $f$ we say that $(x,y)$ is a \emph{collision} if $f(x) = f(y)$ and $x \neq y$. In the following, we formalize this notion for a hash function $\hashSet$.

\begin{definition}[Collision Resistance{~\cite[Definitions 4.10]{katz2014introduction}}]\label{preliminaries:def:collision-resistance}
    A hash function $\hashSet = (\hashSetup, \hash)$ is collision resistant if for all probabilistic polynomial-time adversaries $\adv$ there exists a negligible function $\negl$ such that:
\[
    \advantage{\colres}{\hashSet, \adv} = \prob{
        \hk \gets \hashSetup(\secparam), (x, y) \gets \adv(\hk): \ x \neq y \land \hash_{\hk}(x) = \hash_{\hk}(y)
    }
\]
\end{definition}

\subsubsection{\hdhi{} and \hdhii{} assumptions}

The Hash Diffie-Helmann Independence (\hdhi{}) assumption states that, given \hash{} in \hashSet{} and a group description $(p, \gset, \ggen, \otimes)$, for $\groupenc{u}$ and $\groupenc{v}$, with $u,v$ sampled at random, it is hard for an attacker to distinguish $\hash(\groupenc{u} \concat \groupenc{uv})$ from a random string of the same size.\footnote{Note that \hash{} takes as inputs bit strings, so technically we should make use of an encoding function from \gset to $\bin{}^{\groupLen}$ but we may omit this step through the document to improve readability.} This is formalized in \cref{def:hdhi}, where an attacker can also access an oracle $\oracleHdhi{v}$ that on inputs $x \in \gset$ returns $\hash(x \concat v\cdot x)$ (queries on $\groupenc{u}$ are forbidden).\footnote{In~\cite[Section 3.2.1]{abdalla1999dhaes} this notion is denoted as adaptive HDH independence assumption. Since we only introduce the adaptive version we denote it as \hdhi{}.}. In other words, the \hdhi{} assumption measures the sense in which \hash{} is ``independent'' of the underlying Diffie-Hellman problem.

\begin{definition}[\hdhi, {\cite[Definition 7]{abdalla1999dhaes}}]\label{def:hdhi}
    Let $\hashSet$ be a hash function, $\groupSetup$ be a group generation algorithm and \adv{} be an adversary. Consider the \hdhi{} game described in Figure~\ref{fig:hdhi}. We define the advantage of \adv{} in violating the \hdhi{} assumption as follows:
    \[
        \advantage{\hdhi}{\hashSet,\groupSetup, \adv} =  \abs{2\cdot\prob{\hdhi(\secpar) = 1} - 1}.
    \]

\end{definition}
Note that above definition corresponds to~\cite[Section 3.2.1, Definition 3]{abdalla1999dhaes}. In the following, we introduce a similar notion denoted as \hdhii{} (this is an adaptation of \odhii{} notion in~\cite[Section 6]{abdalla2010robust}) and it will be useful in the \ikcca{} proof~\cref{instantiation:enc:security}.

\begin{definition}[\hdhii]\label{preliminaries:definitions:hdhii}
    Let $\hashSet$ be a hash function, $\groupSetup$ a group generation algorithm and let \adv{} be an adversary. Consider the \hdhii{} game described in Figure~\ref{preliminaries:fig:hdhii}. We define the advantage of \adv{} in violating the \hdhii{} assumption as follows:
    \[
        \advantage{\hdhii}{\hashSet, \groupSetup, \adv} =  \abs{2 \cdot \prob{\hdhii(\secpar) = 1} - 1}.
    \]
\end{definition}

\begin{figure}[ht]
    \begin{minipage}[t]{0.5\textwidth}
        \centering
        \procedure[syntaxhighlight=auto, space=auto]{$\hdhi (\secpar)$}{
            \hk \gets{} \hashSet.\hashSetup{(\secparam{})}\\
            (q, \gset, \ggen, \otimes) \gets{} \groupSetup(\secparam{})\\
            u,v \sample{} [q] \\
            w_{0} \gets{} \hashSet.\hash_{\hk} (\groupenc{u} \concat \groupenc{uv})\\
            w_{1} \sample{} \bin^{\hashLen}\\
            b \sample{} \bin{} \\
            \widetilde{b} \gets{} \adv^{\oracleHdhi{v}} (\groupenc{u},\groupenc{v},w_{b})\\
            \pcreturn{}\widetilde{b} = b
        }
        \caption{\hdhi{} game.}\label{fig:hdhi}
    \end{minipage}%
    \begin{minipage}[t]{0.5\textwidth}
        \centering
        \procedure[syntaxhighlight=auto, space=auto]{$\hdhii (\secpar)$}{
            \hk \gets{} \hashSet.\hashSetup{(\secparam{})}\\
            (q, \gset, \ggen, \otimes) \gets{} \groupSetup(\secparam{})\\
            u,v_0, v_1 \sample{} [q] \\
            w_{0,0}\gets{} \hashSet.\hash_\hk (\groupenc{u} \concat \groupenc{uv_0}), w_{0,1}\gets{} \hashSet.\hash_\hk(\groupenc{u} \concat \groupenc{uv_1})\\
            w_{1,0} \sample{} \bin^{\hashLen}, w_{1,1} \sample{} \bin^{\hashLen}\\
            b \sample{} \bin{} \\
            \widetilde{b} \gets{} \adv^{\oracleHdhi{v_0}, \oracleHdhi{v_1}} (\groupenc{u}, \groupenc{v_0}, \groupenc{v_1}, w_{b,0}, w_{b,1})\\
            \pcreturn{}\widetilde{b} = b
        }
        \caption{\hdhii{} game.}\label{preliminaries:fig:hdhii}
    \end{minipage}%
\end{figure}

\begin{lemma}\label{preliminaries:lemma:hdhi_hdhii}
    Let \adv{} be an adversary with advantage \advantage{\hdhii}{\hashSet, \groupSetup, \adv}[] in solving the \hdhii{} problem. Then there exists an adversary \bdv{} such that
    \[
        \advantage{\hdhii}{\hashSet, \groupSetup{}, \adv} \leq 2 \cdot \advantage{\hdhi}{\hashSet, \groupSetup{}, \bdv}.
    \]
\end{lemma}
\begin{proof}
    We can reuse the proof described in~\cite[Lemma 6.1]{abdalla2010robust} by applying minor modifications. In fact, \hdhi{} and \hdhii{} are, respectively, slightly different from \odh{} and \odhii{} notions: in the related security games, if $b=0$ the challenges are constructed as $\hash{(\groupenc{u} \concat \groupenc{uv})}$ and $\{\hash{(\groupenc{u} \concat \groupenc{uv_0})}, \hash{(\groupenc{u} \concat \groupenc{uv_1})}\}$ instead of $\hash{(\groupenc{uv})}$ and $\{\hash{(\groupenc{uv_0})}, \hash{(\groupenc{uv_1})}\}$. By accordingly changing the instances of $\hash{}$ in the games $\gamestyle{G_0},\gamestyle{G_1}, \gamestyle{G_2}$ of~\cite[Lemma 6.1]{abdalla2010robust} our lemma follows.
\end{proof}

\subsection{Pseudo Random Functions}\label{preliminaries:definitions:prfs}

Informally speaking, a pseudorandom function family $\prfSet = \indexedset{\prf_{\key}: \mathit{D} \to \mathit{C}}{\key \in \keyspace}$ is a collection of functions such that for randomly chosen $\key \in \keyspace$, the function $\prf_{\key}$ is indistinguishable from a random function that maps $\mathit{D}$ to $\mathit{C}$.

\begin{definition}[PRF Family{~\cite[Definition 3.24]{katz2014introduction}}]
Let $\funcSet: \bin^* \times \bin^* \to \bin^*$ be an efficient, length-preserving, keyed function. We say $\funcSet$ is a pseudo random function if for all probabilistic polynomial-time distinguishers $\distinguisher$, there exists a negligible function $\negl[]$ such that:

\[
	\advantage{\prf}{\funcSet, \distinguisher} = \abs*{\prob{ \distinguisher^{\funcSet_k(\cdot)}(\secparam)=1 } - \prob{ \distinguisher^{f_\secpar(\cdot)}(\secparam)=1 }} \leq \negl
\]

where $k \sample \keyspace = \bin^\secpar$ is chosen uniformly at random and $f_\secpar$ is chosen uniformly at random from the set of functions mapping $\secpar$-bit strings to $\secpar$-bit strings.
\end{definition}

\subsection{Commitment scheme}\label{preliminaries:definitions:commitment-sc}

\begin{definition}[Non-interactive commitment scheme{~\cite[Section 2.1]{bootle2015short}}]
    A non-interactive commitment scheme $\comm$ is defined by the following algorithms:
    \begin{itemize}
        \item $\setup$, is a \ppt{} algorithm that takes a security parameter \secparam{} and outputs public parameters $\pparams$.
        \item $\commit{}{}$, is a polynomial-time algorithm that takes a message $m \in\BB^\il $, a random coin $r \in \BB^\nl$ and outputs a commitment $\cm{} \in \BB^\ol$.
    \end{itemize}
\end{definition}

We assume that $\pparams$ is implicitly passed to $\commit{}{}$.

\begin{definition}[Computationally Hiding]\label{preliminaries:definitions:commitment-hiding}
We say that a commitment scheme is computationally hiding if for all \ppt{} adversary \adv{} the following:
\[
\abs*{
    \prob{
    \begin{aligned}
        & \pparams \gets{} \setup(\secparam), (\msg_0,\msg_1) \gets \adv(pp), b \sample \bin,\\
        & r \sample \BB^\nl, \cm{} \gets \commit{\msg_b}{r}, \widetilde{b} \gets \adv(\cm{}), b=\widetilde{b}
    \end{aligned}
    }
    - \frac{1}{2}
}
\]
is at most negligible in $\secpar$.
\end{definition}

\begin{definition}[Computationally Binding]\label{preliminaries:def:comp-binding}
We say that a commitment scheme is computationally binding if for all \ppt{} adversary \adv{} the following:
\[
    \prob{
    \begin{aligned}
        & pp \gets{} \setup(\secparam), (\msg_0, r_0,\msg_1, r_1) \gets \adv(pp)\\
        & m_0 \neq m_1 \land \commit{\msg_0}{r_0} = \commit{\msg_1}{r_1}
    \end{aligned}
    }
\]
is at most negligible in $\secpar$.
\end{definition}

Note that the previous definitions can be made \emph{statistical} if we consider unbounded attackers \adv.

\subsection{Digital Signature}\label{preliminaries:definitions:digital-signature}

\begin{definition}[Digital signature{~\cite[Definition 12.1]{katz2014introduction}}]
    A digital signature scheme $\sigscheme$ is defined by the tuple of functions $\sigscheme = (\kgen, \sig, \verify)$,
    \begin{itemize}
        \item $(\sk, \vk) \gets \kgen(\secparam)$. Key Generation randomized algorithm takes as input the security parameter \secparam~and returns a signing key \sk~and verifying key \vk.
        \item $\sigma \gets \sig(\sk, \msg)$. Given a signing key \sk~and a message $\msg$, the $\sig$ algorithm computes and outputs a signature $\sigma$.
        \item $\bin \gets \verify(\vk, \msg, \sigma)$. Given a verification key \vk, a message $\msg$ and a signature $\sigma$, the $\verify$ algorithm returns 1 if $\sigma$ is a valid signature else 0.
    \end{itemize}
\end{definition}

A signature scheme must satisfy the \emph{correctness property} (i.e~$\verify(\vk, \msg, \sig(\sk, \msg)) = \true$, where $(\sk, \vk) \gets \kgen(\secparam)$) and unforgeable (i.e.~it is intractable to produce a signature, without knowing the signing key $\sk$, on a message that has not been signed yet). In addition to these properties, certain digital signature schemes have an additional property called ``one-timeness''.

\begin{figure}
    \begin{minipage}[t]{.5\textwidth}
        \centering
        \procedure[linenumbering]{$\ufcma(\secparam, \timeBound, \queryBound)$}{%
            (\sk, \vk) \gets~\kgen(\secparam) \\
            \state \gets~\adv^{\oracleSig} (\vk,\cdot) \\
            \pccomment{$\state = \indexedset{(\msg_i, \sigma_i)}{i \in [\queryBound]}$ where $\msg_i$ denotes} \\
            \pccomment{the ith query made to $\oracleSig$ and} \\
            \pccomment{$\sigma_i$ denotes the ith oracle answers} \\
            (\msg^{*}, \sigma^{*}) \gets~\adv(\state) \\
            \pcreturn \verify(\vk, \msg^{*}, \sigma^{*}) = 1 \\
            \t \land \msg^{*} \not \in \indexedset{\msg_i}{i \in [\queryBound]}
        }
        \caption{\ufcma~game}\label{preliminaries:fig:uf-cma-game}
    \end{minipage}%
    \begin{minipage}[t]{.5\textwidth}
        \centering
        \procedure[linenumbering]{$\sufcma(\secparam, \timeBound, \queryBound)$}{%
            (\sk, \vk) \gets \kgen(\secparam) \\
            \state \gets \adv^{\oracleSig} (\vk,\cdot) \\
            \pccomment{$\state = \indexedset{(\msg_i, \sigma_i)}{i \in [\queryBound]}$ where $\msg_i$ denotes} \\
            \pccomment{the ith query made to $\oracleSig$ and} \\
            \pccomment{$\sigma_i$ denotes the ith oracle answers} \\
            (\msg^{*}, \sigma^{*}) \gets~\adv(\state) \\
            \pcreturn \verify(\vk, \msg^{*}, \sigma^{*}) = 1 \\
            \t \land (\msg^{*}, \sigma^{*}) \not \in \indexedset{(\msg_i, \sigma_i)}{i \in [\queryBound]}
        }
        \caption{\sufcma~game}\label{preliminaries:fig:suf-cma-game}
    \end{minipage}%
\end{figure}

\begin{definition}[Unforgeability (\ufcma){~\cite[Definition 12.2]{katz2014introduction}}]\label{preliminaries:def:ufcma}
A digital signature scheme $\sigscheme$ is \ufcma{} if the probability for any \ppt~adversary $\adv$ to win the \ufcma~game depicted in~\cref{preliminaries:fig:uf-cma-game} is negligible.
\end{definition}

\begin{definition}[Strong Unforgeability (\sufcma)]\label{preliminaries:def:sufcma}
A digital signature scheme $\sigscheme$ is \sufcma{} if the probability for any \ppt~adversary $\adv$ to win the \sufcma~game depicted in~\cref{preliminaries:fig:suf-cma-game} is negligible.
\end{definition}

\begin{definition}[One-Time (OT) Signature{~\cite[Definition 12.6]{katz2014introduction}}]\label{preliminaries:def:ot-sig}
    A one-time signature scheme is a digital signature scheme that uses each key-pair at most once.
\end{definition}

\begin{remark}
    It is worth noting that users may use one-time signing keys to sign multiple messages. In this case no security guarantees can be ensured.
\end{remark}
\subsection{Message Authentication Code}
A message authentication code is a scheme that enables users to tag data for the purpose of authenticity and integrity. Formally:

\begin{definition}[Message Authentication Code,{\cite[Definition 4.1]{katz2014introduction}}]
A message authentication code \mac{} is given by a tuple of \ppt{} algorithms $(\kgen,\tagg, \verify)$ where:
    \begin{itemize}
        \item \kgen{}, the key generation algorithm, takes a security parameter \secparam{}, and returns a key $\mk \in \bin^{\macKeyLen(\secpar)}$.\footnote{For simplicity we may denote \macKeyLen(\secpar) as \macKeyLen{}.}
        \item \tagg{}, the tag generation algorithm, takes a key $\mk$ and a message $ y\in\bin^{*} $ and returns a string $\tau\in\bin^{*}$, called \emph{tag}.
        \item  \verify{}, the tag verification algorithm, takes a key $\mk$, a message $ y \in \bin^{*} $ and a tag $\tau \in \bin^{*}$. It returns a value in $\bin$ where: $0$ denotes that the message was rejected (i.e.~is deemed unauthentic) and $1$ denotes that the message was accepted (i.e.~is deemed authentic).
    \end{itemize}
    We require that for all $\mk \in \bin^{\secpar}$ and $y \in \bin^{*}$ we have $\verify(\mk, y, \tagg(\mk,y)) = 1$. If $\tagg(\mk,\cdot)$ is defined only over messages of length $l(\secpar)$ and $\verify(\mk,y,\tau)$ outputs $0$ for every $y$ that is not of length $l(\secpar)$, then we say that $(\kgen,\tagg, \verify)$ is a \emph{fixed-length} \mac{} with length parameter $l(\secpar)$.
\end{definition}

A security notion for \mac{} follows:

\begin{figure}
    \centering
    \procedure[syntaxhighlight=auto, space=auto]{\sufcma(\secpar)}{
        \mk\gets{} \kgen{(\secparam{})}\\
        (\overline{y}, \overline{\tau})\gets{} \adv^{\oracle{\tagg_{\mk}}, \oracle{\verify_{\mk}}}\\
        \pcreturn{} \verify(\mk, \overline{y}, \overline{\tau}) = 1
    }
    \caption{\sufcma{} game.}\label{fig:sufcma}
\end{figure}

\begin{definition}[\sufcma,{\cite[Section 3.2.3]{abdalla1999dhaes}}]
    Let $\mac = (\kgen,\tagg, \verify)$ be a message authentication scheme and let \adv{} be an adversary. Consider the \sufcma{} game described in Figure~\ref{fig:sufcma}, with the condition that $\tagg (\mk, \overline{y}) \neq \overline{\tau}$. We say adversary \adv{} has \emph{forged} when it outputs a pair $(\overline{y}, \overline{\tau})$ such that $\verify_k(\overline{y},\overline{\tau}) = 1$ and $(\overline{y},\overline{\tau})$ was not previously obtained via a query to the tag oracle.

    We define the \sufcma{} advantage of \adv{} as follows:
    \[
        \advantage{\sufcma}{\mac, \adv} =  \prob{\sufcma(\secpar) = 1}
    \]

    We say that \mac{} is \sufcma{} secure if for every \ppt{} adversary \adv{} the advantage \advantage{\sufcma}{\mac, \adv} is a negligible function.
\end{definition}


\section{Matplotlib} % (fold)
\label{sec:matplotlib}
\begin{questions}
\titledquestion{Plotting a function} % (fold)
\label{sub:plotting_a_function}

Plot the function
\[
    f(x) = \sin^2(x-2)e^{-x^2}
\]
over the interval $[0,2]$.
Add proper axis labels, a title, etc.

% titledquestion plotting_a_function (end)

\titledquestion{Data} % (fold)
\label{sub:data}

Create a data matrix $X$ with 20 observations of 10 variables.
Generate a vector $b$ with parameters
Then generate the response vector $y = Xb + z$ where $z$ is a vector with
standard normally distributed variables.

Now (by only using y and X), find an estimator for $b$, by solving
\[
    \hat b = \arg\min_b \|Xb - y\|_2
\]

Plot the true parameters $b$ and estimated parameters $\hat b$.
See Figure~\ref{fig:param_plot} for an example plot.

\begin{figure}
    \centering
    \includegraphics[width=.45\textwidth]{img/param_plot.pdf}
    \caption{Parameter plot}
    \label{fig:param_plot}
\end{figure}

% titledquestion data (end)

\titledquestion{Histogram and density estimation} % (fold)
\label{sub:histogram_and_density_estimation}

Generate a vector $z$ of $10000$ observations from your favorite exotic distribution.
Then make a plot that shows a histogram of $z$ (with 25 bins), along with an estimate for the density,
using a Gaussian kernel density estimator (see scipy.stats).
See Figure~\ref{fig:hist} for an example plot.

\begin{figure}
    \centering
    \includegraphics[width=.45\textwidth]{img/hist_plot.pdf}
    \caption{Histogram}
    \label{fig:hist}
\end{figure}

% titledquestion histogram_and_density_estimation (end)
\end{questions}
% section matplotlib (end)


\chapter{(Discrete) Martingale}
\emph{Life is a super-martingale. You should take your money and run.}
\newpage

\section{Definition of a Martingale}
    \subsection{Definition}
        \begin{definition}[Martingale]\label{def:Martingale}
            A stochastic process is a \textbf{Martingale} if
            \[ \forall t \ge 0 \quad \mathbb{E}[X_{t+1}|X_0,\dots,X_t] = X_t \]
        \end{definition}

        For conciseness in this chapter we use
        \[ X_{(m,n)} = (X_m,\dots,X_n) \]
        to denote a portion of the stochastic process from time $m$ to $n$.

        \begin{definition}[Generalized Martingale]\label{def:GeneralizedMartingale}
            Given two stochastic processes $X_t$ and $Z_t$. $Z_t$ is a \textbf{martingale} \emph{with respect to} $X_t$ if
            \[ \forall t \ge 0 \quad \mathbb{E}[Z_{t+1} | X_{(0,t)}] = Z_t \]
        \end{definition}
        \begin{remark}
            definition \ref{def:Martingale} is a special case of \ref{def:GeneralizedMartingale} where $Z_t = X_t$.
        \end{remark}

    \subsection{Fancier Definitions}
        Recall measure theory stuff in the first lecture.
        Let $\mathcal{F}_n = (X_0,\dots,X_n)$ be the smallest $\mathcal{F}$-measurable $\sigma$-algebra.
        \begin{definition}[Filteration]
            $\{\mathcal{F}_n\}$ is called a \textbf{filteration} if
            \[ \mathcal{F}_0 \subseteq \mathcal{F}_1 \subseteq \cdots \subseteq \mathcal{F}_n \]
        \end{definition}

        \begin{definition}[Martingale (Fancy)]\label{def:FancyMartingale}
            $\{Z_t\}$ is a \textbf{martingale} \emph{w.r.t. a filteration} $\{\mathcal{F}_t\}$ if
            \begin{enumerate}
                \item $\forall t \ge 0$, $Z_t$ is $\mathcal{F}_t$-measurable.
                \item $\mathbb{E}[Z_{t+1}|\mathcal{F}_t] = Z_t$. Or equivalently $\mathbb{E}[Z_{t+1}] = \mathbb{E}[Z_t]$
            \end{enumerate}
        \end{definition}

        \begin{remark}
            If $\mathbb{E}[X_{t+1}|\mathcal{F}_t] \le X_t$, then it is called a \textbf{Super-martingale}.

            If $\mathbb{E}[X_{t+1}|\mathcal{F}_t] \ge X_t$, then it is called a \textbf{Sub-martingale}.
        \end{remark}

    \subsection{Examples}
        \subsubsection{Random Walk on 1-d Integers}
        Consider the random walk on $\mathbb{Z}$. Let $X_t \in \{-1, 1\}$ be a uniform-at-random r.v. denoting the direction of the $t$-th move.

        Let $Z_t = \sum_{i=1}^tX_i$ and $Z_0=0$, then $Z_t$ is a martingale w.r.t. $X_t$.

        \[ \mathbb{E}[Z_{t+1}|X_{(0,t)}] = \mathbb{E}[Z_t + X_{t+1}|X_{(0,t)}] = Z_t + \mathbb{E}[X_{t+1}|X_{(0,t)}] = Z_t \]

        \subsubsection{Branching Process}
        The branching process is introduced in section \ref{sub:BranchingProcess}.

        Let $Z_t$ be the number of people in the $t$-th generation, let $X_{ti}$ be the children of the $i$-th people in the $t$-th generation.

        Assume $\mathbb{E}[X_{ti}] = \mu$.

        Notice that we have
        \[ Z_{t+1} = \sum_{i=1}^{Z_t}X_{ti} \]

        \[ \mathbb{E}[Z_{t+1}|\mathcal{F}_t] = \mathbb{E}[Z_{t+1}|Z_t] \]

        Since
        \[ \mathbb{E}[Z_{t+1}|Z_t=z] = \mathbb{E}[\sum_{i=1}^zX_{ti}|Z_t=z] = \mu z \]

        Therefore
        \[ \mathbb{E}[Z_{t+1}|\mathcal{F}_t] = \mu Z_t \]

        $Z_t$ is \emph{not} a martingale because of the scaling factor $\mu$.
        \[ \mathbb{E}[Z_{t+1}|Z_t] \neq Z_t \]

        However if we let
        \[ M_t = \mu^{-t}Z_t \]

        Then $\{M_t\}$ is a martingale w.r.t. $\{\mathcal{F}_t\}$

        \subsubsection{Polya's Urn}
        Suppose we have an urn (buskets/bottles/whatever) containing two kinds of balls: black balls and white balls.

        Suppose we start from time $t=2$ (so that the urn contains $t$ balls at time $t$); suppose the urn has one black ball and one white ball at the beginning.

        Each time we draw a ball at random and replace it together with a ball of the same color.

        Let $X_t$ be the number of white balls after time $t$. Let $Z_t = X_t/t$ be the ratio of white balls. We claim that $\{Z_t\}$ is a martingale.

        \begin{align*}
            \mathbb{E}\left[Z_{t+1}|X_{(2,t)}\right] &= \frac{1}{t+1}\mathbb{E}[X_{t+1}|X_{(2,t)}]\\
            &= \frac{1}{t+1}\left(\frac{X_t}{t}\left(X_t+1\right) + \frac{t-X_t}{t}\left(X_t\right)\right)\\
            &= \frac{1}{t+1}\frac{X_t + tX_t}{t} = \frac{X_t}{t} = Z_t
        \end{align*}

        \subsubsection{Likelihood Ratio}
        Suppose we have a ``dataset'' $X_1,\dots,X_t$ that has a (true) underlying pdf $f$; suppose we have a hypothesis (or estimation) $g$.

        Let
        \[ M_t \triangleq \frac{g(X_1)\cdot \cdots \cdot g(X_t)}{f(X_1)\cdot \cdots \cdot f(X_t)} \]

        We claim that $\{M_t\}$ is a martingale.

        \begin{align*}
            \mathbb{E}[M_{t+1}|X_{(1,t)}] &= M_t\cdot\mathbb{E}\left[\frac{g(X_{t+1})}{f(X_{t+1})}|X_{(1,t)}\right]\\
            &= M_t \cdot \mathbb{E}\left[\frac{g(X_{t+1})}{f(X_{t+1})}\right]\\
            &= M_t \int \frac{g(x)}{f(x)}\mathrm{d}x \\
            &= M_t
        \end{align*}

\section{Stopping Time}
    \subsection{Introduction}
        By definition \ref{def:FancyMartingale},
        \[ \forall t \ge 0 \quad \mathbb{E}[Z_t] = \mathbb{E}[Z_0] \]

        If $\tau$ is a random variable, will the result still hold?
        \[\mathbb{E}[Z_{\tau}] \questeq \mathbb{E}[Z_0]\]
        Unfortunately the answer is no. But in some cases it does hold.

    \subsection{Stopping Time and Optional Stopping Theorem}
        \begin{definition}[Stopping Time]\label{def:StoppingTime}
            A random variable $\tau \in \mathbb{N}$ is a \textbf{stopping time} if
            \[ \forall t \in \mathbb{N} \quad [\tau \le t] \text{ is $\mathcal{F}_t$-measurable.} \]
        \end{definition}
        \begin{remark}
            The definition says that $\tau$ is a stopping time with respect to a martingale $X_1,\dots$ if for each integer $k$, the indicator r.v. $\mathbb{I}[\tau = k]$ is a function of $W_{(0,k)}$.

            That is, $\mathbb{I}[\tau = k]$ can be determined by the values of $W_{(0,k)}$.
        \end{remark}

        \begin{theorem}[Optional Stopping Theorem]\label{thm:OptionalStoppingTheorem}
            Let $\{X_t\}$ be a matringale, let $\tau$ be a stopping time w.r.t. $\{\mathcal{F}_t\}$. Then $\mathbb{E}[X_{\tau}] = \mathbb{E}[X_0]$ if \emph{at least one of the following holds}.
            \begin{enumerate}
                \item $\tau$ is bounded.
                \item $\mathbb{P}[\tau < \infty] = 1$ and $\exists M$ s.t. $|X_t| \le M$ for all $t < \tau$.
                \item $\mathbb{E}[\tau] < \infty$ and $\exists c$ s.t. $\mathbb{E}[|X_{t+1} - X_{t}||\mathcal{F}_t] \le c$. (Expectation of $\tau$ is bounded and the changing rate of $X_t$ can be bounded)
            \end{enumerate}
        \end{theorem}
        \begin{remark}
            For super-martingale or sub-martingale, similar conclusions hold as well, $\mathbb{E}[X_{\tau}] < \mathbb{E}[X_0]$ or $\mathbb{E}[X_{\tau}] > \mathbb{E}[X_0]$.
        \end{remark}

    \subsection{Examples}
        \subsubsection{Birth Rate of Boys and Girls}
            Suppose a politically incorrect village has a policy: Each family keep having children until they give birth to a boy. We examine the stopping time $\tau$.

            Let $X_t \in \{-1, 1\}$ denote the gender of the child, and $1$ stands for boy and $-1$ stands for girl. Let $Z_t$ denote the difference in number of boys and girls.
            \[ Z_t = Z_{t-1} + X_t \]

            Obviously
            \[ \mathbb{E}[\tau] = 1/2 + 2 \times 1/4 + \cdots = \sum_n \frac{n}{2^n} < \infty \]
            and the changing rate is obviously bounded, so the third condition of theorem \ref{thm:OptionalStoppingTheorem} holds, and
            \[ \mathbb{E}[Z_t] = \mathbb{E}[Z_0] = 0 \]

            Although this policy seems 重男轻女, it actually does not break the balance of birth sex ratio.

            However\footnote{“我前段时间还在论坛上和别人对线”--Chihao}, if the village uses an even more politically incorrect policy: keep having children until the number of boys is larger than the number of girls by 1. i.e.
            \[ \tau = \min\{n|Z_n=1\} \]

            Notice that if we model $X_t$ with the random walk on integers with probability $1/2$. Recall that this random walk is null recurrent so the hitting time of the null recurrent state $1$ is infinity $\mathbb{E}[\tau] = \infty$. So the theorem cannot be applied.

            Actually
            \[ \mathbb{E}[Z_t] = 1 \]

            Further, if the villagers are not extremely 头铁 and they will stop if they have 10 girls in a row without having a boy.
            \[ \tau = \min\{\min\{n|Z_n=1\}, 10\} \]
            Then condition (3) of Theorem \ref{thm:OptionalStoppingTheorem} holds again and $\mathbb{E}[Z_t] = 0$.

        \subsubsection{Random Walk on Integers with Absorbing Barriers}
            Consider a random walk $X_t \in \{-1, 1\}$ on integers with two absorbing barriers at $-a$ and $b$. Let $Z_t$ be the position at $t$, let $\tau$ be the r.v. denoting the time when we arrive at either $-a$ or $b$.
            \[ Z_{t+1} = Z_t + X_{t+1} \]

            Obviously $|Z_t| \le M$, and obviously $\mathbb{P}[\tau < \infty]=1$ because we have a positive probability to walk $(a+b)$ steps toward $b$ and thus we will always stop. So condition (2) of OST \ref{thm:OptionalStoppingTheorem} holds.

            \[ \mathbb{E}[Z_t] = \mathbb{E}[Z_0] = 0 \Rightarrow -aP_a + b(1-P_a) = 0 \]

            So $P_a = \frac{b}{a+b}$ and $P_b = \frac{a}{a+b}$.

            And we proceed to compute the stopping time. Let
            \[ Y_t \triangleq Z_t^2 - t \]

            We claim that $Y_t$ is a martingale.
            \begin{align*}
                \mathbb{E}[Y_{t+1}|\mathcal{F}_t] &= \mathbb{E}[Z_{t+1}^2 - (t+1)|\mathcal{F}_t]\\
                &= \mathbb{E}[(Z_t + X_{t+1})^2 - (t+1) | \mathcal{F}_t]\\
                &= Z_t^2 + 2Z_t\mathbb{E}[X_{t+1}] + \mathbb{E}[X_{t+1}^2] - (t+1)\\
                &= Z_t^2 - t = Y_t
            \end{align*}

            It can be shown that $\{Y_t\}$ satisfies (3) of OST \ref{thm:OptionalStoppingTheorem}. Therefore
            \[ \mathbb{E}[Y_{\tau}] = \mathbb{E}[Y_0] = 0 \]
            And since
            \[ \mathbb{E}[Y_{\tau}] = \mathbb{E}[Z_{\tau}^2] - \mathbb{E}[\tau] = \frac{a^2b}{a+b} + \frac{b^2a}{a+b} + \mathbb{E}[\tau] \]
            We can solve for
            \[ \mathbb{E}[\tau] = ab \]

        \subsubsection{Pattern Occurence}
            Suppose we flip a fair coin, let $\{X_t\}$ be the sequence of results.

            Given a sequence $p = (p_1,p_2,\dots,p_N) \in \{0,1\}^N$, we want to know the expected throws before the pattern occurs (as a subsequence) in the result sequence.

            Notice that the expectation depends on $p$. For example it is easier to get sequence $10$ than to get $11$. Because the probability of succeeding, given the previous flip is $1$, is equal, but
            \begin{itemize}
                \item For $11$, if we fail and get $0$ in the second flip (got $10$), we will have to start from the beginning.
                \item For $10$, if we fail and get $1$ in the second flip, (got $11$), we only need to start from the second bit.
            \end{itemize}

            We construct a martingale, let $A_t$ be a person who joins a gambling at time $j$, and acts as follows
            \begin{itemize}
                \item Bet \$1 on $X_t=p_1$.
                \item If win, bet \$2 on $X_{t+1}=p_2$.
                \item If win, bet \$4 on $X_{t+2}=p_3$.
                \item \dots (doubles the bet each time)
                \item Whenever loses, quit the game.
            \end{itemize}

            Let $j \in \{1, 2, \dots, N\}$, let $G_j(t)$ be the total money (can be negative) of person $A_j$ at time $t$. Obviously $G_j(t)$ is a martingale, because this is a fair gamble.

            Let $Z(t) = \sum_j G_j(t)$ be the total number of money in the game at time $t$. By linearity of expectation, $Z(t)$ is also a martingale.

            Let $\tau$ be the first time that pattern $p$ occurs in $\{X_t\}$.

            It can be verified that $Z(t)$ satisfies (3) of OST \ref{thm:OptionalStoppingTheorem}.
            \[ \mathbb{E}[Z(\tau)] = \mathbb{E}[Z(1)] = 0 \]

            Now suppose the pattern occurs, we compute the expected money for each person $A_j$ (which is another way of computing the LHS).

            All people before $\tau - N$ have all lost the gamble (or otherwise the pattern would have appeared earlier than $\tau$). If a person loses, the total money he has will be $-1$.

            The person who joined the gamble at $t = \tau-N$ kept winning until the very end\footnote{“肯定赢麻了。”--Chihao}, and he will have earned
            \[ 1 + 2 + \cdots + 2^{N-1} = 2^N-1 \]

            The situation of the remaining people depens on $p$. For the $l$-last person, he did not lose until the end if and only if the first $l$ bits he betted equals to the first $l$ bits of $p$, i.e. the last $l$ bits of $p$ equals to the first $l$ bits of $p$. To indicate this, let $\chi_j$ denote whether $j$ winned money.
            \[ \chi_j = \mathbb{I}[p_{(1,j)} = p_{(N-j+1,N)}] \]
            where $N$ is the length of the pattern.

            Therefore
            \[Z(\tau) = -\left(\tau - \sum_{j=1}^N \chi_j\right) + \sum_{j=1}^N \chi_j(2^j-1)\]

            Take expectations on both sides and solve for $\mathbb{E}[\tau]$
            \[\mathbb{E}[\tau] = \sum_{j=1}^m\chi_j \cdot 2^j\]

            For a 4-bit pattern $0101$, $\chi_1=0$, $\chi_2 = 1$, $\chi_3=0$, $\chi_4=1$.

\section{Convergence of Non-negative Super-Martingales}
    \begin{proposition}\label{prop:BoundOnSuperMartingale}
        Let $\{X_t\}$ be a nonnegative super-martingale. Suppose $X_0 \le a $, $\forall b > a$, let
        \[ T_b \triangleq \inf\{ X_t \ge b \} \]
        then
        \[ \mathbb{P}[T_b < \infty] \le a/b \]
    \end{proposition}

    Intuitively, when we are playing a super-martingale starting with money $a$, and we will stop whenever we reach $b$ (if it ever happens), then the larger $b$ is, the less likely we are to reach $b$ within finite steps (because we are expected to lose money in a super-martingale).

    \begin{proof}
        Let $T_b \wedge t \triangleq \min\{T_b, t\}$. Since $T_b$ is not necessarily bounded, we cannot apply OST on $T_b$. However, for a fixed $t$, $T_b \wedge t$ is bounded.

        By OST \ref{thm:OptionalStoppingTheorem}, for each non-negative $t$,
        \[ \mathbb{E}[X_{T_b \wedge t}] < \mathbb{E}[X_0] \le a \]

        Notice that
        \[ X_{T_b \wedge t} = \begin{cases}
            X_t &\quad T_b > t\\
            b &\quad T_b < t
        \end{cases} \]

        Therefore we can rewrite $X_{T_b \wedge t}$ into
        \[ X_{T_b \wedge t} \ge b\mathbb{I}[T_b \le t] \]

        Take expectation on both sides
        \[ a \ge \mathbb{E}[X_{T_b \wedge t}] \ge b\mathbb{P}[T_b \le t] \]

        Since $t$ is arbitrary,
        \[ \mathbb{P}[T_b < \infty] \le \mathbb{P}[T_b \le t] \le a/b \]
    \end{proof}

    \begin{theorem}[Convergence of Super-martingale]\label{thm:ConvergenceOfSuperMartingale}
        Any non-negative super-martingale converges with probability 1.
    \end{theorem}
    \begin{proof}
        To prove the theorem, we only need to prove that it neither diverges nor oscillitates. Proving a non-negative super-martingale does not diverge is trivial, because it is lower-bounded. So we only prove that it does not have two sub-sequences that converges to different values.

        The intuition is, since $b > a$, whenever the super-martingale jumps from $a$ to $b$, the probability is $a/b$, if the super-martingale oscillitates, then it would have to jump from $a$ to $b$ for infinitely many times, and this probability would be zero.

        Formally, fix $a$ and $b$ s.t. $a < b$. Let $S_i$ denote the $i$-th time to reach $a$, and let $T_i$ denote the $i$-th time to reach $b$.
        \[ S_1 = \inf\{ t > T_0 | X_t = a \} \]
        \[ T_1 = \inf\{ t > S_1 | X_t = b \} \]
        \[ S_2 = \inf\{ t > T_1 | X_t = a \} \]

        $S_i$ and $T_i$ are not necessarily bounded, so OST cannot be directly applied. However, we can use the same trick and fix a upper bound: $\forall n \in \mathbb{N}$, the OST implies that
        \[ \mathbb{E}[X_{S_k \wedge n}] > \mathbb{E}[X_{T_k \wedge n}] \]

        Notice that
        \[ X_{T_k \wedge n} = \begin{cases}
            b &\quad T_k \le n\\
            X_n &\quad T_k > n
        \end{cases} \]
        Then
        \[ X_{T_k \wedge n} = b\mathbb{I}[T_k \le n] + X_n\mathbb{I}[T_k > n] \]

        Similarly
        \[ X_{S_k \wedge n} = a\mathbb{I}[S_k \le n] + X_n \mathbb{I}[S_k > n] \]

        Subtract the two equations,
        \[ X_{T_k \wedge n} - X_{S_k \wedge n} = b\mathbb{I}[T_k \le n] - a\mathbb{I}[S_k \le n] + X_n \left( \mathbb{I}[T_k > n] - \mathbb{I}[S_k > n] \right) \]

        Recall that by our definition, $S_k > T_k$ (if $S_k > n$, then $T_k >n$), so the latter term is non-negative and can thus be safely dropped.

        \[ X_{T_k \wedge n} - X_{S_k \wedge n} \ge b\mathbb{I}[T_k \le n] - a\mathbb{I}[S_k \le n]  \]

        Take expectation on both sides,
        \[ \mathbb{E}[X_{T_k \wedge n} - X_{S_k \wedge n}] \ge b\mathbb{P}[T_k \le n] - a\mathbb{P}[S_k \le n] \]

        By result from the OST we know that $\mathbb{E}[X_{S_k \wedge n}] - \mathbb{E}[X_{T_k \wedge n}] > 0$. Therefore
        \[ \mathbb{P}[T_k \le n] < \frac{a}{b}\mathbb{P}[S_k \le n] \]

        Since $n$ is arbitrary,
        \[ \mathbb{P}[T_k < \infty] < \frac{a}{b}\mathbb{P}[S_k < \infty] < \frac{a}{b}\mathbb{P}[T_{k-1} < \infty] \]

        So if $k \to \infty$, then $\mathbb{P}[T_k < \infty] \to 0$, so the super-martingale cannot oscillitate.
    \end{proof}

\section{Stochastic Approximation}
    Consider the problem of finding the root of $f(x)=0$. Usually, a binary search or the Newton's method can be applied. However, suppose we do not know what $f$ is, and we cannot observe the exact value of $f(x)$.

    $f(x)$ is sealed in a black box with noise, given an input query $x$, what we get is $\tilde{f}(x) + \eta$, where $\eta$ is some kind of random noise. Here we assume the noise has a Gaussian distribution with mean $0$ and variance $1$.

    So we hope to find a sequence of input $\{X_n\}$ such that $X_n \to x^*$ as $n \to \infty$. In the following we assume $f(x)<0$ for $x < x^*$ and $f(x)>0$ for $x>x^*$.

    This problem can be solved using an iterative method. Let $X_n$ denote our $n$-th input, let $Y_n = f(X_n) + \eta_n$ be the output we get. In each iteration we update the input by
    \[ X_{n+1} = X_n - a_nY_n \]

    The problem is to determine $\{a_n\}$. Firstly it is obvious that $a_n$ should converge to $0$, or otherwise, suppose $a_n \to \delta$, and suppose the solution is $X^* = 0$, then even if we have reached the solution $X_n$, the algorithm will still perform an update $X_{n+1} = -\delta \eta_n$, and we moves away from the answer.

    \begin{theorem}[Stochastic Approximation]\label{thm:StochasticApproximation}
        Let $f: \mathbb{R} \mapsto \mathbb{R}$ be a real-valued function. Suppose $\mathbb{E}[(X_0)^2] < \infty$. Consider the sequence generated by
        \[ Y_n = f(X_n) + \eta_n \]
        \[ X_{n+1} = X_n - a_n Y_n \]
        where we assume the following conditions
        \begin{enumerate}
            \item $X_0$, $\eta_1$, $\eta_2$, \dots, are independent, with $\eta_i$ having mean $0$ and variance $1$.
            \item For some $1 < |c| < \infty$, $|f(x)| \le c|x|$ for all $x$. (Notice that this implies $f(0)=0$).
            \item $\forall \delta > 0$, $\inf_{|x|>\delta} xf(x) > 0$. ($f(x) < 0$ for $x < x^*$ and $f(x) > 0$ for $x>x^*$).
            \item Each $a_n$ is non-negative and $\sum_n a_n = \infty$. ($a_n$ cannot decrease too fast)
            \item $\sum_n a_n^2 < \infty$. ($a_n$ cannot decrease too slowly)
        \end{enumerate}

        Then $X_n \to 0$ as $n \to \infty$.
    \end{theorem}
    \begin{proof}
        If we somehow proves that $X_n$ is a super-martingale, then by Theorem \ref{thm:ConvergenceOfSuperMartingale}, we will be very close to success.

        Consider $\mathbb{E}[X_{n+1}^2 | X_{(0,n)}]$.\footnote{“不要问我为什么，我们经过一番尝试发现$X_n$的期望不太对。”--Chihao}
        \begin{align*}
            \mathbb{E}[X_{n+1}^2|X_{(0,n)}] &= \mathbb{E}[(X_n - a_n(f(X_n) + \eta_n))^2 | X_{(0,n)}]\\
            &= \mathbb{E}[X_n^2|X_{(0,n)}] - \mathbb{E}[2a_nX_n(f(X_n)+\eta_n)|X_{(0,n)}] + \mathbb{E}[a_n^2(f(X_n) + \eta_n)^2|X_{(0,n)}]\\
            &= X_n^2 - 2a_nX_nf(X_n) + a_n^2(f(X_n))^2 + a_n^2 \quad \text{($\eta_n$ has zero mean)}\\
            &\le X_n^2 + a_n^2\left(c^2 X_n^2 + 1\right) \quad \text{(all terms are non-negative and Assumption 2)}\\
            &\le X_n^2 + a_n^2\left(c^2 X_n^2 + c^2\right) \quad \text{(Assumption 2: $c > 1$)}\\
            &= \left( 1 + a_n^2c^2 \right)X_n^2 + a_n^2c^2
        \end{align*}

        define
        \[ W_n \triangleq b_n(X_n^2 + 1) \]
        where
        \[ b_n = \prod_{k=1}^{n-1}(1 + a_k^2 c^2)^{-1} \]

        It can be verified that $W_n$ is a super-martingale.
        \begin{align*}
            \mathbb{E}[W_{n+1}|X_{(0,1)}] &= b_{n+1}\mathbb{E}[X_{n+1}^2|X_{(0,n)}] + b_{n+1}\\
            &\le b_{n+1}\left( X_n^2 \left( 1+a_n^2c^2 \right) + a_n^2c^2 \right) + b_{n+1}\\
            &= b_{n+1}(1+a_n^2c^2)(X_n^2+1) = b_n(X_n^2+1) = W_n
        \end{align*}

        So $W_n$ is a super-martingale and it will converge, by Theorem \ref{thm:ConvergenceOfSuperMartingale}.

        Recall that
        \[ W_n \triangleq b_n(X_n^2 + 1) = \frac{(X_n^2 + 1)}{\prod_{k=1}^{n-1}(1 + a_k^2 c^2)} \]
        $\sum_n a_n^2 < \infty$ implies that the denominator also converges, and therefore $X_n^2$ converges.

        We then show that $X_n^2 \to 0$. Let $\delta > 0$ and let $D \triangleq \{x:|x| > \delta\}$. To show $X_n^2 \to 0$, it suffices to show that for any $m$, a ``bad event'' $B_m \triangleq \bigcap_{n \ge m}^{\infty} \{X_n \in D\}$ has probability 0.

        Suppose $m < n$.

        By Assumption 3, $\forall \delta > 0$, $\inf_{|x|>\delta} xf(x) \ge \epsilon > 0$. Therefore
        \[ X_nf(X_n) \ge \epsilon\mathbb{I}[X_n \in D] \ge \epsilon\mathbb{P}[B_m] \]

        Take expectation
        \[ \mathbb{E}[X_nf(X_n)] \ge \epsilon\mathbb{P}[X_n \in D] \]

        Notice that in the previous derivation of $\mathbb{E}[X_{n+1}^2|X_{(0,n)}]$, we dropped a term $- 2a_nX_nf(X_n)$, and if we add the term back,
        \[ \mathbb{E}[X_{n+1}^2|X_{(0,n)}] \le W_n - 2a_nb_{n+1}X_nf(X_n) \]

        Take expectations on both sides
        \[ \mathbb{E}[W_{n+1}] < \mathbb{E}[W_n] - 2a_nb_{n+1}\mathbb{E}[X_nf(X_n)] \]

        Therefore
        \[ \mathbb{E}[W_{n+1}] < \mathbb{E}[W_n] -2a_nb_{n+1}\epsilon\mathbb{P}[B_m] \]

        Using this result iteratively,
        \[ \mathbb{E}[W_{n+1}] < \mathbb{E}[W_m] - 2\epsilon\sum_{k=m}^n a_nb_{n+1}\mathbb{P}[B_m] \]

        So we have a upperbound for $\mathbb{P}[B_m]$
        \[ \mathbb{P}[B_m] \le \frac{\mathbb{E}[W_m]}{2\epsilon\sum_{k=m}^na_nb_{n+1}} \]

        The denominator goes to infinity, and therefore $\mathbb{P}[B_m]$ converges to 0, so we are done.
    \end{proof}


\documentclass{article}
\usepackage{physics}
\usepackage{graphicx}
\usepackage{float}
\usepackage{amsmath}
\usepackage{mathtools}
% Please add the following required packages to your document preamble:
\usepackage[table,xcdraw]{xcolor}
% If you use beamer only pass "xcolor=table" option, i.e. \documentclass[xcolor=table]{beamer}
\usepackage[normalem]{ulem}
\useunder{\uline}{\ul}{}

\author{Philip Renkert}
\date{6/15/2021}

\newcommand{\defeq}{\vcentcolon=}

\begin{document}
	\section*{Coordinate System and Attitude Representation}
	Two coordinate frames are employed to describe the state of the quadrotor:
	\begin{itemize}
		\item Earth Coordinate Frame ($o_e x_e y_e z_e$): The initial position of the quadrotor defines the origin $o_e$ of this coordinate frame.  The $0_e x_e$ axis points in a given fixed direction in the horizontal plane, the $o_e z_e$ axis points downward toward the earth's center, and the $o_e y_e$ axis is determined according to the right hand rule.
		\item Body Coordinate Frame ($o_b x_b y_b z_b$): This coordinate frame is attached to the quadrotor, and the quadrotor's center of gravity is chosen as its origin $o_b$. The $o_bx_b$ axis points in the nose direction as indicated in Figure~\ref{fig:body_frame}.  The $o_b z_b$ axis points downward perpendicular to the $o_b x_b$ axis.  The $o_b y_b$ axis is determined from the right hand rule.
	\end{itemize}

	The relationship between the two coordinate systems is depicted in Figure~\ref{fig:coord_sys}.  A left superscript is used to indicate the frame to which a vector is relative, i.e. ${}^e \mathbf{x}$ is a vector relative to the earth frame and ${}^b \mathbf{x}$ is a vector relative to the body frame.  We must also define a standard basis with unit vectors $\mathbf{e}_1 \defeq \left[1,0,0\right]^\top$, $\mathbf{e}_2 \defeq \left[0,1,0\right]^\top$, and $\mathbf{e}_3 \defeq \left[0,0,1\right]^\top$.  In the earth frame, the axes $o_e x_e$, $o_e y_e$, and $o_e z_e$ are expressed with $\mathbf{e}_1$, $\mathbf{e}_2$, and $\mathbf{e}_3$ respectively. Body unit vectors $\mathbf{b}_1 \defeq o_b x_b$, $\mathbf{b}_2 \defeq o_b y_b$, and $\mathbf{b}_3 \defeq o_b z_b$ can be expressed relative to the body frame as ${}^b \mathbf{b}_i = \mathbf{e}_i$ and relative to the earth frame as ${}^e \mathbf{b}_i$ for all $i \in \left\{1,2,3\right\}$.

	\begin{figure}[H]
		\centering
		\begin{minipage}[t]{0.48\linewidth}
			\centering
			\includegraphics[height = \linewidth]{3DCoordinateSystems.png}
			\caption{Coordinate system representation}
			\label{fig:coord_sys}
		\end{minipage}
		\begin{minipage}[t]{0.48\linewidth}
			\centering
			\includegraphics[height = \linewidth]{BodyFrameDiagram.png}
			\caption{Body frame coordinate system, top-down view}
			\label{fig:body_frame}
		\end{minipage}
	\end{figure}

	The aircraft's attitude will be expressed with Euler angles $\psi$ (yaw angle), $\theta$ (pitch angle), and $\phi$ (roll angle).  The body orientation is achieved by three successive rotations about the $z$, $y$, and $x$ axes around a fixed point. Let the frame resulting from the first elemental rotation be $k$ with unit vectors $\mathbf{k}_i$ and that of the second elemental rotation be $n$ with unit vectors $\mathbf{n}_i$. Frame $k$ is achieved by a yaw rotation about the $\mathbf{e}_3$ axis by $\psi$. Frame $n$ is achieved by a pitch rotation about the $\mathbf{k}_2$ axis by $\theta$.  The final body frame is achieved by a roll rotation about the $\mathbf{n}_1$ axis by $\phi$.  The combined rotation can be expressed as the product of three rotation matrices.  Denote a rotation matrix that performs a change of basis from frame $a$ to frame $b$ (rotation of frame $a$ relative to fixed frame $b$) as $\mathbf{R}_a^b$. The elemental rotation matrices are,
	\begin{align}
		\begin{split}
		\mathbf{R}_z(\psi) &=
		\left(
		\begin{array}{ccc}
			\cos (\psi ) & \sin (\psi ) & 0 \\
			-\sin (\psi ) & \cos (\psi ) & 0 \\
			0 & 0 & 1 \\
		\end{array}
		\right)
		\\
		\mathbf{R}_y(\theta) &=
		\left(
		\begin{array}{ccc}
			\cos (\theta ) & 0 & -\sin (\theta ) \\
			0 & 1 & 0 \\
			\sin (\theta ) & 0 & \cos (\theta ) \\
		\end{array}
		\right)\\
		\mathbf{R}_x(\phi) &=
		\left(
		\begin{array}{ccc}
			1 & 0 & 0 \\
			0 & \cos (\phi ) & \sin (\phi ) \\
			0 & -\sin (\phi ) & \cos (\phi ) \\
		\end{array}
		\right)
		\end{split}
	\end{align}
	The combined rotation matrix that transforms a vector $\mathbf{x}$ expressed in the earth frame ${}^e \mathbf{x}$ into a vector expressed in the body frame ${}^b \mathbf{x}$ is then,
	\begin{equation}
		{}^b \mathbf{x} = \mathbf{R}_n^b \mathbf{R}_k^n \mathbf{R}_e^k\left( {}^e \mathbf{x}\right) =\mathbf{R}_e^b\left( {}^e \mathbf{x}\right)
	\end{equation}
	Where $\mathbf{R}_n^b = R_x(\phi)$, $\mathbf{R}_k^n = R_y(\theta)$, and $\mathbf{R}_e^k = R_z(\psi)$.  Performing the matrix multiplication gives,
	\begin{equation}
		\mathbf{R}_e^b = \left(
		\begin{array}{ccc}
			\text{c} (\theta ) \text{c} (\psi ) & \text{c} (\theta ) \text{s}  (\psi ) & -\text{s}  (\theta ) \\
			\text{s}  (\theta ) \text{c} (\psi ) \text{s}  (\phi )-\text{s}  (\psi ) \text{c} (\phi ) & \text{s}  (\theta ) \text{s}  (\psi ) \text{s}  (\phi )+\text{c} (\psi ) \text{c} (\phi ) & \text{c} (\theta ) \text{s}  (\phi ) \\
			\text{s}  (\theta ) \text{c} (\psi ) \text{c} (\phi )+\text{s}  (\psi ) \text{s}  (\phi ) & \text{s}  (\theta ) \text{s}  (\psi ) \text{c} (\phi )-\text{c} (\psi ) \text{s}  (\phi ) & \text{c} (\theta ) \text{c} (\phi ) \\
		\end{array}
		\right)
	\end{equation}
	Where $\text{c}()$ is an abbreviation of $\cos()$ and $\text{s}()$ is n abbreviation of $\sin()$.
	\section*{Rigid-body Kinematic Model}
		In order to analyze the kinetics of the aircraft, we must first understand the relationship between the angular velocity of the body ${}^b\mathbf{\omega} = \left[p,q, r\right]^\top$ and the  attitude rate $\dot{\mathbf{\Theta}} = \left[\dot{\phi}, \dot{\theta}, \dot{\psi}\right]^\top$. To do so, we'll the theorem involving the time derivative of rotation matrices from Zhao in \cite{zhaoTimeDerivativeRotation2016} given in Equation~\ref{eq:rot_matrix_derivative}.
		\begin{equation}
			\dv{}{t}{\mathbf{R}_b^e} = \mathbf{R}_b^e \left[{}^b \mathbf{\omega}\right]_{\cross}
			\label{eq:rot_matrix_derivative}
		\end{equation}
		Where $\left[\cdot\right]_{\cross}$ is the skew symmetric operator used to convert a cross product of two vectors into a matrix-vector product.  Rearranging \ref{eq:rot_matrix_derivative} gives,
		\begin{equation}
			\left[{}^b \mathbf{\omega}\right]_{\cross} = {\mathbf{R}_b^e}^\top \dv{}{t}{\mathbf{R}_b^e} = {\mathbf{R}_e^b} \dv{}{t}{\mathbf{R}_b^e}
		\end{equation}
		We'll employ the chain rule to expand the derivative
		\begin{equation}
			\left[{}^b \mathbf{\omega}\right]_{\cross} = {\mathbf{R}_b^e}^\top \dv{}{t}{\mathbf{R}_b^e} = {\mathbf{R}_e^b} \left(\dv{\mathbf{R}_b^e}{\phi}\dot{\phi} + \dv{\mathbf{R}_b^e}{\theta}\dot{\theta} + \dv{\mathbf{R}_b^e}{\psi}\dot{\psi}\right)
		\end{equation}
		We'll simplify the expression to achieve a linear relationship between ${}^b \mathbf{\omega}$ and $\dot{\mathbf{\Theta}}$.
		\begin{equation}
			{}^b\mathbf{\omega} =
			\left(
			\begin{array}{ccc}
				1 & 0 & -\sin(\theta) \\
				0 & \cos (\phi ) & \cos(\theta)\sin (\phi ) \\
				0 & -\sin (\phi ) & \cos(\theta)\cos (\phi ) \\
			\end{array}
			\right) \dot{\mathbf{\Theta}} =\vcentcolon \mathbf{W}^{-1} \dot{\mathbf{\Theta}}
		\end{equation}
		Taking the inverse,
		\begin{equation}
			\dot{\mathbf{\Theta}} =\mathbf{W}\cdot{}^b\mathbf{\omega} = \left(
			\begin{array}{ccc}
				1 & \tan (\theta ) \sin (\phi ) & \tan (\theta ) \cos (\phi ) \\
				0 & \cos (\phi ) & -\sin (\phi ) \\
				0 & \sin{\phi}/\cos{\theta} & \cos (\phi ) / \cos (\theta ) \\
			\end{array}
			\right)
			{}^b\mathbf{\omega}
		\end{equation}
		Our kinematic equations for the quadrotor body can finally be written.  Let $\mathbf{p}$ represent the position of the quadrotor's center of gravity (i.e. $o_b$)  and $\mathbf{v}$ represent the linear velocity.
		\begin{align}
			\begin{split}
				{}^e \dot{\mathbf{p}} &= {}^e \mathbf{v} \\
				\dot{\mathbf{\Theta}} &= \mathbf{W} \cdot {}^b\mathbf{\omega}
			\end{split}
			\label{eq:kinematic_equations}
		\end{align}

		Note: We can also work directly with rotation matrices instead of Euler angles if it makes for a better starting point.
	\section*{Rigid-body Dynamic Model}
	\textit{Position Dynamic Model}:
	With level propellers producing thrust parallel to $\mathbf{b}_3$, the position dynamics are described by Equation~\ref{eq:pos_dyn_1}:
	\begin{equation}
		{}^e\dot{\mathbf{v}} = g \mathbf{e}_3 - \frac{f}{m}{}^e\mathbf{b}_3
		\label{eq:pos_dyn_1}
	\end{equation}
	where $g$ is the gravitational acceleration, $f$ is the combined thrust produced by the four propellers calculated in the control effectiveness model, and $m$ is the mass of the aircraft.  We can then use the rotation matrix $\mathbf{R}_b^e$ to find ${}^e\mathbf{b}_3$.  Since
	\begin{equation}
		{}^e \mathbf{v} =\mathbf{R}_b^e \cdot {}^b\mathbf{v}
		\label{eq:pos_dyn_2}
	\end{equation}
	we have,
	\begin{equation}
		{}^e\dot{\mathbf{v}} = g \mathbf{e}_3 + \frac{1}{m}\mathbf{R}_b^e\cdot{}^b\mathbf{f}_3
		\label{eq:pos_dyn_final}
	\end{equation}
	where ${}^b\mathbf{f}_3 \defeq -f\mathbf{e}_3$.
	\newline \newline \textit{Attitude Dynamic Model}:  We'll start with Euler's equation describing the rotation of a rigid body \cite{ClassicalDynamicsParticles1965}:
	\begin{equation}
		\mathbf{J} \cdot {}^b\dot{\mathbf{\omega}} + {}^b\mathbf{\omega} \cross \mathbf{J}\cdot{}^b\mathbf{\omega}= \mathbf{M}
		\label{eq:euler_eqn}
	\end{equation}
	Where $\mathbf{J}$ is the inertia tensor relative to the body frame, ${}^b\mathbf{\omega}$ is the angular velocity defined above, and $\mathbf{M}$ is the sum of the moments acting on the craft in the body frame.  For a simple quadrotor model, $\mathbf{M}$ comes from two primary sources: moments generated by the propellers $\mathbf{\tau} = \left[\tau_x, \tau_y, \tau_z\right]^\top$ and the gyroscopic torques associated with the rotors $\mathbf{G}_a = \left[G_{a,x}, G_{a,y}, G_{a,z}\right]$.  $\mathbf{\tau}$ is calculated in the control effectiveness model in the next section, as each of the moments is simply related to the square the rotor speed.
	\begin{equation}
		\mathbf{M} = \mathbf{\tau} + \mathbf{G}_a
	\end{equation}
	The gyroscopic torque of the $k_{th}$ rotor is found again by looking at the torque acting on the rotor in the rotating body frame,
	\begin{equation}
		\mathbf{G}_{a,k} = - \left(\dv{}{t}\left({}^b \mathbf{L}_k\right) + {}^b\mathbf{\omega} \cross {}^b \mathbf{L}_k\right)
		\label{eq:gyro_torque}
	\end{equation}
	Where ${}^b \mathbf{L}_k$ is the angular momentum contributed by rotor $k$ relative to the body frame. The quantity in parenthesis in the right-hand side of Equation~\ref{eq:gyro_torque} represents the external moments in the body frame acting on rotor $k$ given the body's angular velocity ${}^b\mathbf{\omega}$.  $\mathbf{G}_{a,k}$ is therefore the torque exerted on the body by rotor $k$. ${}^b \mathbf{L}_k$ is simply the rotor's inertia about its central axis $J_r$ times its angular velocity vector in the body frame ${}^b \mathbf{\omega}_k$.
	\begin{equation}
		{}^b \mathbf{L}_k = J_r \cdot {}^b \mathbf{\omega}_k = J_r\left(-1^k\right) \tilde{\omega}_k \mathbf{e}_3
		\label{eq:rotor_momentum}
	\end{equation}
	where $\tilde{\omega}_k$ is the unsigned angular speed of rotor $k$.  Note that $\dv{}{t}\left({}^b \mathbf{L}_k\right)$ is zero if we assume that $\tilde{\omega}_k$ is constant.  This allows us to write,
	\begin{equation}
		\mathbf{G}_{a,k} = - \left({}^b\mathbf{\omega} \cross {}^b \mathbf{L}_k\right) = {}^b \mathbf{L}_k \cross {}^b\mathbf{\omega}
		\label{eq:rotor_gyro_torque_simple}
	\end{equation}
	Substituting \ref{eq:rotor_momentum} into \ref{eq:rotor_gyro_torque_simple} gives,
	\begin{equation}
		\mathbf{G}_{a,k} = J_r\left(-1^k\right) \tilde{\omega}_k \mathbf{e}_3 \cross {}^b\mathbf{\omega}
	\end{equation}
	The total gyroscopic torque is then,
	\begin{equation}
		\mathbf{G}_a = \sum_{k=1}^{N_r}{\mathbf{G}_{a,k}} = J_r\left(\mathbf{e}_3\cross{}^b\mathbf{\omega}\right)\sum_{k=1}^{N_r}{\left(-1^k\right) \tilde{\omega}_k} = J_r\left(\sum_{k=1}^{N_r}{\left(-1^k\right) \tilde{\omega}_k}\right)  \left[\mathbf{e}_3\right]_{\cross}{}^b\mathbf{\omega}
	\end{equation}
	It remains to calculate the inertia tensor.
	\section*{Parametric Inertia Tensor}
		A dynamic model for design optimization must be parametrized by the design variables.  Because the inertial properties of the quadrotor will change depending on the motor, propeller, and battery design, the inertial tensor must be expressed as a function of these elements.  Most examples of quadrotor dynamics and simulation in the literature determine the inertia tensor  by 1) conducting physical experiments such as a bifilar pendulum \cite{quanIntroductionMulticopterDesign2017} or 2) building a detailed CAD model of the system.  Though accurate, neither of these approaches can account for changes in the physical design and therefore aren't compatible with design optimization.
		\par We can, however, use a hybrid numerical and analytical approach.  First, the inertial tensor $\mathbf{J}_{f}$ of the 'fixed' system (i.e. excluding the battery, motors, and propellers) is calculated via CAD or physical experiments. Then, the inertia matrix for each of the optimization components $\mathbf{J}_{c,i}^{\prime}$ is calculated analytically about the component's center of mass. Then, the generalized parallel axis theorem is used to calculate each components' inertia about the system's center of mass $\mathbf{J}_{c,i}$.  The formula for the generalized parallel axis theorem is given in \cite{ParallelAxisTheorem2021} as Equation~\ref{eq:parallel_axis_theorem}:
		\begin{equation}
			\mathbf{J}_{c,i} = \mathbf{J}_{c,i}^{\prime} + m_{c,i}\left(\norm{\mathbf{r}_{c,i}}^2 I_3 - \mathbf{r}_{c,i} \otimes \mathbf{r}_{c,i} \right)
			\label{eq:parallel_axis_theorem}
		\end{equation}
		Finally, the system inertia tensor $\mathbf{J}$ is found by summing each individual inertia tensor:
		\begin{equation}
		\mathbf{J} = \mathbf{J}_f + \sum_{c,i}{\mathbf{J}_{c,i}}
		\label{eq:system_inertia_tensor}
		\end{equation}

		For now, we'll simplify Equations~\ref{eq:parallel_axis_theorem} and~\ref{eq:system_inertia_tensor} by assuming the motor and propeller are point masses at the end of each arm and the battery is a point mass at the system's center of gravity.  Though these assumptions make for a very rough approximation, they should capture the general trend of how design changes impact the real system's inertial properties.  Applying Equation~\ref{eq:parallel_axis_theorem} to the rotors $r$ gives
		\begin{equation}
			\mathbf{J}_{r,k} = \left(m_{\text{prop}} + m_{\text{motor}}\right) \left(\norm{\mathbf{r}_{r,k}}^2 I_3 - \mathbf{r}_{r,k} \otimes \mathbf{r}_{r,k} \right)
			\label{eq:parallel_axis_theorem_rotor}
		\end{equation}
		The displacement from the system's center of mass to the rotors' center of mass $\mathbf{r}_{r,k}$ is approximately
		\begin{align}
		\begin{split}
			\mathbf{r}_{r,1} &= d\frac{\sqrt{2}}{2}\begin{bmatrix} -1 & 1 & 0\end{bmatrix}^\top \\
			\mathbf{r}_{r,2} &= d\frac{\sqrt{2}}{2}\begin{bmatrix} 1 & 1 & 0\end{bmatrix}^\top \\
			\mathbf{r}_{r,3} &= d\frac{\sqrt{2}}{2}\begin{bmatrix} 1 & -1 & 0\end{bmatrix}^\top \\
			\mathbf{r}_{r,4} &= d\frac{\sqrt{2}}{2}\begin{bmatrix} -1 & -1 & 0\end{bmatrix}^\top
		\end{split}
		\end{align}

		Where $d$ is the distance from the system's center of mass to that of the rotor as shown in Figure~\ref{fig:body_frame}.
		Applying Equation~\ref{eq:parallel_axis_theorem_rotor} and summing over all four rotors gives the moments of inertia contributed by the rotors.
		\begin{equation}
			\mathbf{J}_r = \sum_{k=1}^{4}{\mathbf{J}_{r,k}} = \left(m_{\text{prop}} + m_{\text{motor}}\right)d^2
			\begin{bmatrix}
				2 & 0 & 0 \\ 0 & 2 & 0 \\ 0 & 0 & 4
			\end{bmatrix}
		\end{equation}
		By assuming the battery is a point mass at the system's center of mass, the battery's inertia $\mathbf{J}_b = 0$. Therefore, we can write a simplified version of the system's inertia tensor in Equation~\ref{eq:system_inertia_tensor} as,
		\begin{equation}
			\mathbf{J} = \mathbf{J}_f + \mathbf{J}_r
		\end{equation}
		I'm currently working on a CAD model to calculate $\mathbf{J}_f$, though I anticipate its contribution will be small relative to that of $\mathbf{J}_r$.

	\section*{Combined Dynamic Model}
		Equations~\ref{eq:kinematic_equations},~\ref{eq:pos_dyn_final}, and~\ref{eq:euler_eqn} can be combined to give a nonlinear model for the system's dynamics:
		\begin{equation}
			\begin{bmatrix} {}^e \dot{\mathbf{p}} \\ {}^e \dot{\mathbf{v}} \\ \dot{\mathbf{\Theta}} \\ {}^b\dot{\mathbf{\omega}} \end{bmatrix}
			 =
			 \begin{bmatrix}
			 	{}^e \mathbf{v} \\
			 	g \mathbf{e}_3 + \frac{1}{m}\mathbf{R}_b^e\cdot{}^b\mathbf{f}_3 \\
			 	\mathbf{W} \cdot {}^b\mathbf{\omega} \\
			 	\mathbf{J}^{-1}\left(-{}^b\mathbf{\omega} \cross \mathbf{J}\cdot{}^b\mathbf{\omega} +  \mathbf{\tau} + \mathbf{G}_a\right)
			 \end{bmatrix}
		\end{equation}
		Recall that the inputs to the dynamic model are $f$ and $\mathbf{\tau}$.
	\section*{Control Effectiveness Model (Thrusts/Torques)}
		It remains to calculate $f$ and $\mathbf{\tau}$ as a function of the propeller speeds.  Let $C_T = k_T \rho D^4$ be the lumped thrust coefficient and $C_Q = k_Q \rho D^5$ be the lumped drag coefficient such that, for each propeller $k$, the thrust $T_k$ and torque $Q_k$ produced by each propeller is
		\begin{align}
			\begin{split}
				T_k &= C_T \tilde{\omega}_k^2 \\
				Q_k &= C_Q \tilde{\omega}_k^2
			\end{split}
		\end{align}
		The combined thrust $f$ is simply the sum of the thrusts generated by each propeller
		\begin{equation}
			f = C_T \sum_{k=1}^{N_r}{ \tilde{\omega}_k^2}
			\label{eq:combined_thrust}
		\end{equation}
		Similarly, the combined moment about the ${}^b \mathbf{b}_3$ axis $\tau_z$ is the sum of the torques generated by each propeller.
		\begin{equation}
			\tau_z = C_Q \sum_{k=1}^{N_r}{\left(-1\right)^{k-1} \tilde{\omega}_k^2}
		\end{equation}
		Where the alternating sign comes from the rotors' alternating directions.  To calculate $\tau_x$ and $\tau_y$, note from Figure~\ref{fig:body_frame} that the moment arm of each propeller about the ${}^b \mathbf{b}_1$ and ${}^b \mathbf{b}_2$ axis is,
		\begin{equation}
			l = d \sin{45^\circ} = \frac{\sqrt{2}}{2}d
		\end{equation}
		Therefore,
		\begin{align}
			\begin{split}
				\tau_x &= lC_T\left(\tilde{\omega}_1^2 - \tilde{\omega}_2^2 - \tilde{\omega}_3^2 + \tilde{\omega}_4^2\right)\\
				\tau_y &=  lC_T\left(\tilde{\omega}_1^2 + \tilde{\omega}_2^2 - \tilde{\omega}_3^2 - \tilde{\omega}_4^2\right)
			\end{split}
			\label{eq:horizontal_torques}
		\end{align}
		Equations~\ref{eq:combined_thrust} - \ref{eq:horizontal_torques} can be written in matrix form as,
		\begin{equation}
			\begin{bmatrix}f \\ \tau_x \\ \tau_y \\ \tau_z \end{bmatrix} =
			\begin{bmatrix}
				C_T & C_T & C_T & C_T \\
				lC_T & -lC_T & -lC_T & lC_T \\
				lC_T & lC_T & -lC_T & -lC_T \\
				C_Q & -C_Q & C_Q & -C_Q \\
			\end{bmatrix}
			\begin{bmatrix} \tilde{\omega}_1^2 \\ \tilde{\omega}_2^2 \\ \tilde{\omega}_3^2 \\ \tilde{\omega}_4^2 \end{bmatrix}
		\end{equation}

	\newpage
	\bibliography{ARGReferences}
	\bibliographystyle{plain}
\end{document}


\documentclass[12pt]{article}

\usepackage[a4paper]{geometry} %page size
\usepackage{parskip} %no paragraph indentation
\usepackage{fancyhdr} %fancy stuff in page header
\pagestyle{fancy}

\usepackage[utf8]{inputenc} %encoding
\usepackage[danish]{babel} %danish letters

\usepackage{graphicx} %import pictures
\graphicspath{ {images/} }
\usepackage{listings} %make lists

\usepackage{amsmath, amssymb, amsfonts, amsthm, mathtools} %doing math
\usepackage{algorithmicx, algpseudocode} %doing pseudocode

\title{
  Title\
  \large Subtitle
}
\author{Asger Andersen}
\date{\today}

\fancyhead{}
\lhead{This is the title}
\rhead{Asger Andersen}

%End of preamble
%*******************************************************************************

\begin{document}

\section{Diagonalizable matrices}

We say that a $n\times n$ matrix $A$ is diagonalizable, if and only if there exist an invertible matrix $P$, such that $P^{-1}AP$ is a diagonal matrix. This is equivalent to the sum of the dimensions of the eigenspaces of $A$ (in euivalent words: the sum of the geometric multiplicities of the eigenvalues of $A$) being equal to $n$. In that case, we can choose an eigenbasis $q_1,q_2,...,q_n$ for the space $A$ is operating on, and set $P$ to be the matrix with the chosen eigenbasis vectors as columns. Then $P^{-1}AP$ will be a diagonal matrix with the eigenvalues as columns.

If $A$ is hermetian (herunder symmetric), then $A$ is diagonalizable with an orthonormal eigenbasis. Additionally, all the eigenvalues of $A$ are real.

\section{Eigenvalues, eigenvectors and long term behaviour of homogeneous matrix systems}

Consider the system
\begin{align}
x_t = A^t x_0,\qquad A\in \mathbb{R}^{n \times n},\qquad x_0 \in \mathbb{R}^n
\end{align}
and assume that $A$ is diagonalizable. Let $\lambda_1,...,\lambda_n$ be the eigenvalues of $A$ (in this notation, some of them might be equal, if $A$ has one or more eigenvalues with eigenspace dimension larger than 1), and let $q_1,...,q_n$ be some corresponding eigenbasis of $\mathbb{R}^n$. We can decompose $x_0$
\begin{align}
x_0 = \sum_i c_i q_i
\end{align}
whereby we easily get that
\begin{align}
x_t = \sum_i \lambda_i^t c_i q_i
\end{align}
Assume that $A$ has a dominant eigenvalue $\lambda_j$ (that is, assume that one of the eigenvalues of $A$ are strictly larger in absolute value than all the other eigenvalues of $A$). Let $Q$ be eigenbasis vectors corresponding to $\lambda_j$ (if $\lambda_j$ has geometric multiplicity larger than 1, then there will be more than one vector in $Q$). In that case, we easily get that
\begin{align}
\frac{x_t}{\lambda^t} \to \sum_{q_i \in Q} c_i q_i, \qquad t\to \infty
\end{align}
If $\lambda_j$ has geometric multiplicity of 1, this simplifies to
\begin{align}
\frac{x_t}{\lambda^t} \to c_j q_j, \qquad t\to \infty
\end{align}
This means that $\lambda_j$ gives us the long term growth rate of each of the coordinates of $x_t$:
\begin{align}
\forall k \in \{1,...,n\}:\quad \frac{(x_{t+1})_k}{(x_{t})_k} \to \lambda_j, \quad t\to \infty
\end{align}
and we can also calculate the long term ratio of the coordinates of $x_t$:
\begin{align}
\forall k,l \in \{1,...,n\}:\quad \frac{(x_{t})_k}{(x_{t})_l} \to \frac{ \sum_{q_i \in Q} c_i (q_i)_k}{ \sum_{q_i \in Q} c_i (q_i)_l}, \quad t\to \infty
\end{align}
If $\lambda_j$ has geometric multiplicity of 1, this simplifies to
\begin{align}
\forall k,l \in \{1,...,n\}:\quad \frac{(x_{t})_k}{(x_{t})_l} \to \frac{ (q_i)_k}{ (q_i)_l}, \quad t\to \infty
\end{align}

\subsection{Eigenvalues and equilibriums of homogeneous matrix system}

A point $x\in \mathbb{R}^n$ is an equilibrium of the system, if and only if
\begin{align}
x = Ax
\end{align}
It is clear that the zero vector is an equilibrium of any matrix system. It is also clear that the zero vector is a locally stable equilibrium, if and only the dominant eigenvalue $\lambda_j$ is numerically strictly smaller than 1. This is because the dominant eigenvalue is the growth rate that the system tends to over time, and if this growth value is numerically strictly larger than 1, then any other starting point than the zero vector will grow exponentially to infinity. If the dominant eigenvalue and thereby the long term growth rate is equal to 1, then the system has infinitely many equilibriums, namely all the points in the eigenspace of 1. Let $x_0$ be the starting vector, and let it be decomposable in the eigenbasis as
\begin{align}
x_0 = \sum_i c_i q_i
\end{align}
and let $Q$ be the eigenvectors corresponding to the dominant eigenvalue 1. Then $x_t$ will converge to the equilibrium
\begin{align}
x_t \to \sum_{q_i \in Q} c_i q_i, \qquad t\to \infty
\end{align}
If the dominant eigenvalue $\lambda_j = 1$ has geometric multiplicity of 1, this simplifies to
\begin{align}
x_t \to c_j q_j, \qquad t\to \infty
\end{align}

\subsection{Perron-Frobenius' theorem \& long-term behaviour of positive, real matrices (hereunder transition matrices)}

Define an $n\times n$ (not necessarily or even real) matrix $A$ to be irreducible, if and only if for all $i,j \in \{1,...,n\}$ there exists a $t \in \mathbb{N}$ such that $A^t_{ij}\neq 0$. (This correponds to the graph of $A$ being strongly connected). It is clear that all matrices with no 0 entries (hereunder all positive matrices) are trivially irreducible.

Define the spectral radius of any square matrix to be the largest absolut value of any of its eigenvalues.

Perron-Frobenius theorem can be stated with weaker consequences for irreducible matrices in general. Here, I will just state it for non-negative, irreducible matrices.

Let $A$ be a non-negative, irreducible matrix $A$ with spectral radius $r$. Then we have that
\begin{itemize}
\item $r$ is strictly positive, and is the dominant eigenvalue of $A$.
\item $r$ is a simple eigenvalue, meaning that its eigenspace only has 1 dimension.
\item There exists an eigenvector $q$ with only strictly positive entries in the eigenspace of $r$
\item $\frac{1}{\lambda^t} A^t \to C, t\to \infty$ where all the columns of $C$ are multiplums of $q$.
\end{itemize}
All in all, this means that we can understand the long term behaviour of matrix systems defined by non-negative, irreducible matrices by just looking at their eigenvalues

For transition matrices we also know that if they are irreducible, then they have a dominant eigenvalue of $1$, meaning that they have infinitely many equilibriums (all the points in the 1-dimensional eigenspace of 1), and that for each starting vector $x_0$, then
\begin{align}
x_t \to cq,\qquad t\to \infty
\end{align}
where $q$ is some eigenvector in the eigenspace of 1, and $c$ is the proportion of $q$ in $x_0$ in the decomposition of $x_0$ in some basis with $q$ in it. If we pick the eigenvector $q$ be demanding that its coordinates be non-negative and sum to 1, and also only considers starting vectors $x_0$ satisfying the same conditions, then we get that $c=1$ for all $x_0$. Therefore, we get that
\begin{align}
x_t \to q,\qquad t\to \infty
\end{align}
This tells us that irreducible transition matrices has a unique probability distribution $q$ that all other probability distributions $x_0$ converge to over time.

Actually, THIS IS WRONG, since a markov chain also has to be aperiodic to converge. Therefore, I think that I have stated the Perron-Frobenius too liberally. We need to assume that there exists a natural number $t$ such that $A^t$ is strictly positive (all the entries need to be simultaniously strictly positive). I think this would correspond to the markov chain being both irreducible and aperiodic.

\section{Long term behaviour of inhomogeneous linear systems}

Let a system be defined by
\begin{align}
x_{t+1} = Ax_t + b, \qquad x_0\in \mathbb{R}
\end{align}
An equilibrium of the system is any vector that satisfies
\begin{align}
x^* = Ax^* + b
\end{align}

By simple matrix calculations, we get that the system has an equilibrium $x^*$, if and only the matrix $(A - I)$ is invertible. In that case, the system has the unique equilibrium
\begin{align}
x^* = -(A-I)^{-1}b
\end{align}
This equilibrium is stable, if and only if all the eigenvalues of $A$ is strictly less than 1.

\section{Interpretation}

We can think about a real $n \times n$ matrix $A$ as a real weighted graph with $n$ nodes enumerated from $1,...,n$, where there is a link with weight $a_{ij}$ from node $j$ to node $i$, if and only if $A_{ij} = a_{ij}$. This corresponds to the transposed matrix $A^T$ being the weighted adjencency matrix of this graph. Hereby, we can think of any vector $x_0\in \mathbb{R}^n$ as a configuration of the nodes, and we can think of the vector $Ax_0 \in \mathbb{R}^n$ as the configuration, we would get by letting $x_0$ follow the weighted flow given by the graph. For any $t \in \mathbb{N}_0$, we therefore have that $A^t x_0$ can be interpreted as the configuration, we would get by starting with the configuration $x_0$ and then following $t$ steps of the weighted flow. This is exactly the same as $x_t$ in the particular solution to the homogeneous, linear system of difference equations
\begin{align}
\forall t\in \mathbb{N}_0: \quad x_t =  Ax_{t-1}, \quad x_t \in \mathbb{R}^n
\end{align}
with the starting condition $x_0\in \mathbb{R}$.

All in all, we can think of the set of all real $n \times n$ matrices, the set of real, homogeneous, linear systems of difference equations with $n$ equations, and the set of real weighted graphs with $n$ enumerated nodes as being in one-to-one correspondence with each other.

My goal is to interpret eigenvalues, spaces and vectors in the context of these to interpretations of matrices. Also inhomogeneous systems (these can be thought of as arrows comming from nowhere in the graph). And equilibriums and maybe also concepts from network analysis. For instance: communities. Can we think of this concept in terms of some long term dynamics on the network, for instance that diffusion collects the diffused quantity within these communities? Then maybe eigenvalues/vectors can be used to say something about them, since these objects says something about the long term behaviour of the matrix model.

Applied examples: Markov chains. Population dynamics. Wealth dynamics (so we both can have positive and negative numbers in oppose to the other examples).

\end{document}


\chapter{List of Symbols}
% chapter List of Symbols

\begin{tabular}{l l}
  $M_n(\mathbb{R})$  & set of $n \times n$ matrices over $\mathbb{R}$ \\
  $\mathbb{Z}_n^*$   & set of integers modulo $n$; each element has its multiplicative inverse \\
  $S_n$              & symmetry group of degree $n$ \\
  $D_{2n}$           & dihedral group of degree $n$; a subset of $S_n$ \\
  $K_n$              & Klein $n$-group \\
  $A_n$              & alternating group of degree $n$; a subset of $S_n$ \\
  $F[x]$             & polynomial ring over a field $F$ \\
  $\abs{D_{2n}}$     & order of the dihedral group; the size of the dihedral group \\
  $\begin{pmatrix} 1 & 2 & \hdots & n \end{pmatrix}$ & An $n$-cycle \\
  $\det A$           & determinant of matrix $A$ \\
  $GL_n(\mathbb{R})$ & \tworow{l}{general linear group of degree $n$;}{the set that contains elements of $M_n(\mathbb{R})$ with non-zero determinant} \\
  $SL_n(\mathbb{R})$ & \tworow{l}{special linear group of order $n$;}{the set that contains elements of $GL_n(\mathbb{R})$ with determinant of $1$} \\
  $Z(G)$             & center of group $G$ \\
  $\lra{g}$          & cyclic group with generator $g$; principal ideal with generator $g$ \\
  $\lra{h(x)}$       & principal ideal with generator $h(x) \in F[x]$ \\
  $n \mid d$         & $n$ divides $d$ \\
  $H \leq G$         & $H$ is a subgroup of $G$ (used sparsely in this notebook) \\
  $H \triangleleft G$& $H$ is a normal subgroup of $G$ \\
  $\faktor{G}{H}$    & quotient group of $G$ by $H \triangleleft G$ \\
  $\ker \alpha$      & kernel of $\alpha$ \\
  $\img \alpha$      & image of $\alpha$ \\
  $G^{(m)}$          & group of elements of $G$ with order $m$ \\
  $\ch(R)$           & characteristic of the ring $R$ \\
  $\gcd(a, b)$       & the greatest common divisor of $a$ and $b$ \\
  $\con(f)$          & the content of the polynomial $f(x)$
\end{tabular}

% chapter List of Symbols (end)


\chapter{Three Important Probability Distributions}

\section{Important/Useful Theorems}

\subsection{The Binomial Distribution}
For $n$ trials where the probability of success is $p$ and the probability of failure is $q=1-p$, the probability of their being $k$ successes is:
\begin{equation}
	p(k) = \binom{n}{k} p^k q^{n-k}
\end{equation}

\subsection{The Poisson Distribution}
For $n$ trials where the probability of success is $p$ and is very small and the number of trials is very large, the probability of their being $k$ successes is:
\begin{equation}
	p(k) = \frac{a^k}{k!}e^{-a}
\end{equation}
Where $a=np$, the average number of successes.

\subsection{The Normal Distribution}
As $n \rightarrow \infty$, the Binomial Distribution goes to:
\begin{equation}
	p(x) = \frac{1}{\sqrt{2 \piu \sigma^2}}e^{\frac{-(x-a)^2}{2 \sigma^2}}
\end{equation}

\section{Answers to Problems}

\subsection{}
%problem5.1
If you call tails, there are two possibilities for the outcome of the coin-toss experiment which, since they are not correlated to your guess, are both one-half; similarly for heads.  Therefore, no matter what you do, the probability of guessing correctly is one-half.

If, however, the coin is biased towards heads, there is a probability greater than one half that you'll win the trial if you call heads; therefore you should always call heads for a coin biased towards heads and similarly always call tails for a coin biased towards tails.

\end{equation}
\textbf{Answer not verified}

\subsection{}
%problem5.2

In order to avoid any blatant sexism, we shall define  ``success'' as having a boy... What?  Anyway, for a couple having $n$ children, the probability of having $k$ boys will clearly follow a binomial distribution:

\begin{equation}
	p_n(k) = \binom{n}{k} \frac{1}{2^n}
\end{equation}
\subsubsection{a}
\begin{equation}
	p_{10}(5) = \binom{10}{5} \frac{1}{2^{10}} = \frac{63}{256} = 0.246094
\end{equation}
\subsubsection{b}
\begin{equation}
	p_{10}(3\rightarrow 7) = \sum_{i = 3}^7 \binom{10}{i} \frac{1}{2^{10}} = \frac{57}{64} = 0.890625
\end{equation}
\textbf{Answer not verified}

\subsection{}
%problem5.3

Since $p=.001$ and $n=5000$ we can cautiously use the Poisson Distribution where $a=5$.  Since we want to know the probability of hitting 2 or more, we will take the probability of hitting either 0 or 1 and subtract from 1.

\begin{equation}
	p(k \geq 2) = 1 - p(0) - p(1) \approx 1 - \frac{5^0}{0!}e^{-5} - \frac{5^1}{1!}e^{-5} = 1 - 6e^{-5} \approx 0.96
\end{equation}

\textbf{Answer verified}

\subsection{}
%problem5.4

Again we cautiously use the Poisson Distribution since $p=\frac{1}{500}$ and $n=500$ and again use the same trick as before to get the chance of greater than two ``successes''.
\begin{equation}
	p(k \geq 2) = 1 - p(0) - p(1) \approx 1 - \frac{1^0}{0!}e^{-1} - \frac{1^1}{1!}e^{-1} = 1 - \frac{2}{e} \approx 0.264241
\end{equation}
Note that the book has most definitely got this problem wrong as:
\begin{equation}
	p(k \geq 3) = 1 - p(0) - p(1) - p(2) \approx 1 - \frac{1^0}{0!}e^{-1} - \frac{1^1}{1!}e^{-1}- \frac{1^2}{2!}e^{-1} = 1 - \frac{5}{2e} \approx .0803
\end{equation}

\textbf{Answer verified-ish}

\subsection{}
%problem5.5

Without any special cases, this problem is the good-old binomial distribution:

\begin{equation}
	p(k) = \binom{n}{k} p^k(1-p)^{n-k}
\end{equation}
So we simply sum up all the even probabilities:
\begin{equation}
	P_n = \sum_{i=0}^{\frac{n}{2}} p(2i) = \sum_{i=0}^{\frac{n}{2}} \binom{n}{2i} p^{2i}(1-p)^{2i-k}
\end{equation}
Which in the total lack of any skill in mathematics, I plug into Mathematica to get:
\begin{equation}
	P_n = \frac{1}{2} \left((1-2 p)^n+1\right)
\end{equation}

\textbf{Answer verified}

\subsection{}
%problem5.6
In an infinite series of Bernouli trials, let the event that the $i^{th}$ 3-tuple has the pattern SFS be $A_i$ and $P(A_i)=p_i$.  Since we've designed these tuples to not overlap, these trials are independent such that:
\begin{equation}
	P\left( \bigcup_{i=1}^{\infty} A_i \right) = \sum _{i=1}^{\infty} p_i \rightarrow \infty
\end{equation}
By the second Borel-Cantelli lemma.

\textbf{Answer not verified}

\subsection{}
%problem5.7

WE want the probability of 3 or more very rare events happening in a large number of trials: this is a Poisson distribution with $a=1000\cdot0.001=1$
\begin{equation}
	p(k \geq 3) = 1 - p(0) - p(1) - p(2) \approx 1 - \frac{1^0}{0!}e^{-1} - \frac{1^1}{1!}e^{-1}- \frac{1^2}{2!}e^{-1} = 1 - \frac{5}{2e} \approx .0803
\end{equation}

\textbf{Answer not verified}

\subsection{}
%problem5.8

We'll go ahead and call $p=\frac{1}{365}$ to be small and 730 to be big so that we can do Poisson with $a=2$.
\begin{equation}
	p(2) = \frac{2^2}{2!}e^{-2} = \frac{2}{e^2} \approx 0.270671
\end{equation}

\textbf{Answer not verified}

\subsection{}
%problem5.9

\begin{equation}
	\textbf{E}\xi = \sum_{k=0}^{\infty} k \frac{a^k}{k!}e^{-a} = e^{-a}a\sum_{k=0}^{\infty} \frac{a^{(k-1)}}{(k-1)!} = a
\end{equation}
\begin{equation}
	\textbf{E}\xi^2 = \sum_{k=0}^{\infty} k^2 \frac{a^k}{k!}e^{-a} = a^2 + a
\end{equation}
That last one I got lazy and used Mathematica, sorry!  Clearly, though $\sigma^2 = a$.
\begin{eqnarray}
	\frac{\textbf{E}(\xi - a)^3}{\sigma^3} = \frac{\textbf{E}(\xi^3 - 3\xi^2a + 3\xia^2 - a^3)}{a^{\frac{3}{2}}} \\
	 \textbf{E}\xi^3 = a^3+3 a^2+a \\
	 \textbf{E}(\xi^3 - 3\xi^2a + 3\xi a^2 - a^3) = (a^3+3 a^2+a) - 3a(a^2 + a) + 3a^3 - a^3 = a \\
	 \frac{\textbf{E}(\xi - a)^3}{\sigma^3} = \frac{a}{a^{\frac{3}{2}}} = \frac{1}{\sqrt{a}}
\end{eqnarray}
\textbf{Answer verified}

\subsection{}
%problem5.10

\textbf{SKIPPED}

\subsection{}
%problem5.11
Finally! something other than the Poisson distribution... back to... NORMAL!  Ha!
\begin{eqnarray}
	\textbf{E}x = np = 30 \\
	\textbf{D}x = npq = 30\cdot .7 = 21 \\
	p = \int_{20}^{40} \frac{1}{\sqrt{2 \pi 21}} e^{\frac{-(x-30)^2}{2 \cdot 21}} \approx 0.970904
\end{eqnarray}
\textbf{Answer verified}

\subsection{}
%problem5.12
We want to know at one $n$ does this integral
\begin{eqnarray}
	\int_{.3}^{.5} \frac{1}{\sqrt{2 \pi .24/n}} e^{\frac{-(x-.4)^2}{2 \cdot .24/n}} \approx 0.9
\end{eqnarray}
A first pass going at intervals of 10 identifies the number being between 60 and 70 and a further pass going by one reveals that going from 64 to 65 breaks the .89 barrier.  Therefore $n=65$.

Note that in order to get that $n$ in the denominator, we are taking the relative mean and the relative standard deviation: since both quantities get divided by $n$, the square of the standard deviation ends up with an $n$ in the denominator.
\textbf{Answer verified}

\subsection{}
%problem5.13

\begin{eqnarray}
	\textbf{E}x = 60 \cdot .6 = 36 \\
	\textbf{D}x = 36 \cdot .4 = 14.4 \\
	p = \int_{30}^{\infty} \frac{1}{\sqrt{2 \pi 14.5}} e^{\frac{-(x-36)^2}{2 \cdot 14.4}} \approx 0.943077
\end{eqnarray}

\textbf{Answer verified}

\subsection{}
%problem5.14
Perform the integrals as suggested.  Why can you?  Well, it feels right, doesn't it?  I found it impossible to come up with other than an intuitive reason for why this is true: sorry dear reader.

\textbf{Answer verified-ish}

\subsection{}
%problem5.15

\textbf{SKIPPED}

\subsection{}
%problem5.16
Convolute the two distributions and the intended expression will come out: BOM!

\textbf{Answer verified-ish}

%%answer template
%\subsection{}
%%problem n.n
%
%
%\begin{equation}
%
%\label{answern.n}
%\end{equation}
%\textbf{Answer [not] verified}