Efficient Simulation for Branching Linear Recursions

Abstract: We consider a linear recursion of the form $$R^{(k+1)}\stackrel{\mathcal D}{=}\sum_{i=1}^{N}C_iR^{(k)}_i+Q,$$ where $(Q,N,C_1,C_2,\dots)$ is a real-valued random vector with $N\in\mathbb{N}=\{0, 1, 2, \dots\}$, $\{R^{(k)}_i\}_{i\in\mathbb{N}}$ is a sequence of i.i.d. copies of $R^{(k)}$, independent of $(Q,N,C_1,C_2,\dots)$, and $\stackrel{\mathcal{D}}{=}$ denotes equality in distribution. For suitable vectors $(Q,N,C_1,C_2,\dots)$ and provided the initial distribution of $R^{(0)}$ is well-behaved, the process $R^{(k)}$ is known to converge to the endogenous solution of the corresponding stochastic fixed-point equation, which appears in the analysis of information ranking algorithms, e.g., PageRank, and in the complexity analysis of divide and conquer algorithms, e.g. Quicksort. Naive Monte Carlo simulation of $R^{(k)}$ based on the branching recursion has exponential complexity in $k$, and therefore the need for efficient methods. We propose in this paper an iterative bootstrap algorithm that has linear complexity and can be used to approximately sample $R^{(k)}$. We show the consistency of estimators based on our proposed algorithm.

\section{Introduction}
\label{sec:intro}

The complexity analysis of divide and conquer algorithms such as Quicksort \cite{Rosler_91,Fill_Jan_01,Ros_Rus_01} and the more recent analysis of information ranking algorithms on complex graphs (e.g., Google's PageRank) \cite{Volk_Litv_08,Jel_Olv_10,Chen_Litv_Olv_14} motivate the analysis of the stochastic fixed-point equation
\begin{equation}\label{eq:SFPE}
    R\stackrel{\mathcal D}{=} \sum_{r=1}^{N} C_r R_r + Q,
\end{equation}
where $(Q, N, C_1, C_2, \dots)$ is a real-valued random vector with $N \in \mathbb{N}$, and $\{R_i\}_{i \in \mathbb{N}}$ is a sequence of i.i.d. copies of $R$, independent of $(Q, N, C_1, C_2, \dots)$. More precisely, the number of comparisons required in Quicksort for sorting an array of length $n$, properly normalized, satisfies in the limit as the array's length grows to infinity a distributional equation of the form in \eqref{eq:SFPE}. In the context of ranking algorithms, it has been shown that the rank of a randomly chosen node in a large directed graph with $n$ nodes converges in distribution, as the size of the graph grows, to $R$, where $N$ represents the in-degree of the chosen node and the $\{C_i\}_{i \geq 1}$ are functions of the out-degrees of its neighbors.

Although equation \eqref{eq:SFPE} is known to have multiple solutions, and an extensive amount of literature has been devoted to their characterization (see e.g. \cite{Als_Big_Mei_10,Als_Big_Mei_10,Alsm_Mein_10b} and the references therein), in applications we are often interested only in the so-called endogenous solution. This solution can be shown to be the unique limit under iterations of the distributional recursion
\begin{equation} \label{eq:Iterations}
R^{(k+1)} \stackrel{\mathcal D}{=} \sum_{i=1}^{N} C_i R^{(k)}_i + Q,
\end{equation}
where $(Q,N,C_1,C_2,\dots)$ is a real-valued random vector with $N\in\mathbb{N}$, and $\{R^{(k)}_i\}_{i\in\mathbb{N}}$ is a sequence of i.i.d. copies of $R^{(k)}$, independent of $(Q,N,C_1,C_2,\dots)$, provided one starts with an initial distribution for $R^{(0)}$ with sufficient finite moments (see, e.g., Lemma 4.5 in \cite{Jel_Olv_12b}).  Moreover, asymptotics for the tail distribution of the endogenous solution $R$ are available under several different sets of assumptions for $(Q, N, C_1, C_2, \dots)$ \cite{Jel_Olv_10,Jel_Olv_12a,Jel_Olv_12b,Olvera_12}. However, no approximations exist for the distribution of $R$  besides its tail behavior, and even the calculation of its non-integer/absolute moments can be difficult. Hence the need to design efficient numerical methods to compute relevant statistics.

As will be discussed later, the endogenous solution to \eqref{eq:SFPE} can be explicitly constructed on a weighted branching process. Thus, drawing some similarities with the analysis of branching processes, and the Galton-Watson process in particular, one could think of using the Laplace transform of $R$ to obtain its distribution. Unfortunately, the presence of the weights $\{C_i\}$ in the Laplace transform
\[
 \varphi(s) =   E\left[ \exp\left( -s R \right) \right] = E\left[\exp\left( -sQ \right) \prod_{i=1}^N \varphi( sC_i)     \right]
\]
 makes its inversion problematic, making a simulation approach even more important.

 The first observation we make regarding the simulation of $R$, is that when $P(Q = 0) < 1$ it is enough to be able to approximate $R^{(k)}$ for fixed values of $k$, since both $R^{(k)}$ and $R$ can be constructed in the same probability space in such a way that the difference $|R^{(k)} - R|$ is geometrically small. More precisely, under very general conditions (see Proposition \ref{P.MomentsR} in Section \ref{sec:wbp}), there exist positive constants $K < \infty$ and $c < 1$ such that
 \begin{equation} \label{eq:geometricTail}
E\left[ \left| R^{(k)} - R \right|^\beta \right] \leq K c^{k+1}.
\end{equation}
Our goal is then to simulate $R^{(k)}$ for a suitably large value of $k$.

The simulation of $R^{(k)}$ is not that straightforward either, since naive Monte Carlo using \eqref{eq:Iterations} starting from some initial distribution $R^{(0)}$ implies the computation of a geometric number of copies of $(Q, N, C_1, C_2, \dots)$, of order $(E[N])^k$ when $E[N] > 1$, which is usually the case in the applications we are interested in. Hence, the naive simulation approach  can be prohibitive. Instead, we propose in this paper an iterative bootstrap algorithm that outputs a sample pool of observations $\{ \hat R^{(k,m)}_i \}_{i=1}^m$ whose empirical distribution converges, in the Kantorovich-Rubinstein distance, to that of $R^{(k)}$ as the size of the pool $m \to \infty$. This mode of convergence is equivalent to weak convergence and convergence of the first absolute moments (see, e.g., \cite{Villani_2009}). Moreover, the complexity of our proposed algorithm is linear in $k$.

The paper is organized as follows. Section~\ref{sec:wbp} describes the weighted branching process and the linear recursion. The algorithm itself is given in Section~\ref{sec:algorithm} .
Section~\ref{sec:convergence} introduces the Kantorovich-Rubinstein distance and proves the convergence properties of our proposed algorithm. Numerical examples to illustrate the precision of the algorithm are presented in Section~\ref{sec:numerical}.

\section{Linear recursions on weighted branching processes} \label{sec:wbp}

As mentioned in the introduction, the endogenous solution to \eqref{eq:SFPE} can be explicitly constructed on a weighted branching process. To describe the structure of a weighted branching process, let  $\mathbb{N}_+ = \{1, 2, 3, \dots\}$ be the set of positive integers and let $U = \bigcup_{k=0}^\infty (\mathbb{N}_+)^k$ be the set of all finite sequences ${\bf i} = (i_1, i_2, \dots, i_n)$, $n\ge 0$, where by convention $\mathbb{N}_+^0 = \{ \emptyset\}$ contains the null sequence $\emptyset$. To ease the exposition, we will use $({\bf i}, j) = (i_1,\dots, i_n, j)$ to denote the index concatenation operation.

Next, let $(Q, N, C_1, C_2, \dots)$ be a real-valued vector with $N \in \mathbb{N}$. We will refer to this vector as the generic branching vector. Now let $\{ (Q_{\bf i}, N_{\bf i}, C_{({\bf i}, 1)}, C_{({\bf i}, 2)}, \dots ) \}_{{\bf i} \in U}$ be a sequence of i.i.d. copies of the generic branching vector. To construct a weighted branching process we start by defining a tree as follows: let $A_0 = \{ \emptyset\}$ denote the root of the tree, and define the $n$th generation according to the recursion
$$A_n = \{ ({\bf i}, i_n) \in U:  {\bf i} \in A_{n-1}, 1 \leq i_n \leq N_{\bf i} \}, \quad n \geq 1.$$
Now, assign to each node ${\bf i}$ in the tree a weight $\Pi_{\bf i}$ according to the recursion
$$\Pi_\emptyset \equiv 1, \qquad \Pi_{({\bf i}, i_n)} = C_{({\bf i}, i_n)} \Pi_{\bf i}, \qquad n \geq 1, $$
see Figure \ref{F.Tree}. If $P(N< \infty)=1$ and $C_i \equiv 1$ for all $i \geq 1$, the weighted branching process reduces to a Galton-Watson process.

\begin{figure}[t]
\centering
\begin{picture}(350,110)(0,0)
\put(0,0){\includegraphics[scale = 0.75, bb = 30 560 510 695, clip]{TreeW}}
\put(145,105){\footnotesize $\Pi_\emptyset = 1$}
\put(30,59){\footnotesize $\Pi_{1} = C_1$}
\put(145,59){\footnotesize $\Pi_{2} = C_2$}
\put(270,59){\footnotesize $\Pi_{3} = C_3$}
\put(0,0){\footnotesize $\Pi_{(1,1)} = C_{(1,1)} C_1$}
\put(62,17){\footnotesize $\Pi_{(1,2)} = C_{(1,2)} C_1$}
\put(129,0){\footnotesize $\Pi_{(2,1)} = C_{(2,1)} C_2$}
\put(182,17){\footnotesize $\Pi_{(3,1)} = C_{(3,1)} C_3$}
\put(252,0){\footnotesize $\Pi_{(3,2)} = C_{(3,2)} C_3$}
\put(318,17){\footnotesize $\Pi_{(3,3)} = C_{(3,3)} C_3$}
\end{picture}
\caption{Weighted branching process}\label{F.Tree}
\end{figure}

For a weighted branching process with generic branching vector $(Q, N, C_1, C_2, \dots)$, define the process $\{ R^{(k)} : k \geq 0\}$ as follows:
\begin{equation} \label{eq:RkDef}
    R^{(k)} = \sum_{j=0}^k \sum_{{\bf i} \in A_j} Q_{\bf i} \Pi_{\bf i}, \quad k \geq 0.
\end{equation}
By focusing on the branching vector belonging to the root node, i.e., $(Q_\emptyset, N_\emptyset, C_1, C_2, \dots)$ we can see that the process
$\{ R^{(k)} \}$ satisfies the distributional equations
\begin{align}
    R^{(0)}&=Q_{\emptyset}\stackrel{\mathcal D}{=}Q\nonumber\\
    R^{(k)} &= \sum_{r=1}^{N_\emptyset} C_r \left( \sum_{j=1}^k \sum_{(r,{\bf i}) \in A_j} Q_{(r,{\bf i})} \Pi_{(r,{\bf i})}/ C_r  \right) + Q_\emptyset \stackrel{\mathcal{D}}{=} \sum_{r=1}^{N} C_r R^{(k-1)}_r + Q, \qquad k \geq 1,\label{eq:dist-equation}
\end{align}
where $R^{(k-1)}_r$ are i.i.d. copies of $R^{(k-1)}$, all independent of $(Q, N, C_1, C_2, \dots)$.  Here and throughout the paper the convention is that $XY/Y \equiv 1$ if $Y = 0$. Moreover, if we define
\begin{equation} \label{eq:EndogenousSol}
R = \sum_{j=0}^\infty \sum_{{\bf i} \in A_j} Q_{\bf i} \Pi_{\bf i},
\end{equation}
we have the following result. We use $x \vee y$ to denote the maximum of $x$ and $y$.

\begin{proposition} \label{P.MomentsR}
Let $\beta \geq 1$ be such that $E[|Q|^\beta] < \infty$ and $E\left[ \left( \sum_{i=1}^N |C_i| \right)^\beta \right] < \infty$. In addition, assume either (i) $(\rho_1 \vee \rho_\beta) < 1$ , or (ii) $\beta = 2$, $\rho_1 = 1$, $\rho_\beta  < 1$ and $E[Q] = 0$. Then, there exist constants $K_\beta > 0$ and $0 < c_\beta < 1$ such that for $R^{(k)}$ and $R$ defined according to \eqref{eq:RkDef} and \eqref{eq:EndogenousSol}, respectively, we have
$$\sup_{k \geq 0} E\left[ |R^{(k)}|^\beta \right] \leq K_\beta < \infty \qquad \text{and} \qquad E\left[ | R^{(k)} - R|^\beta \right] \leq K_\beta c_\beta^{k+1}.$$
\end{proposition}

\begin{proof}
For the case $\rho_1 \vee \rho_\beta < 1$, Lemma 4.4 in \cite{Jel_Olv_12b} gives that for $W_n = \sum_{{\bf i} \in A_n} Q_{\bf i} \Pi_{\bf i}$ and some finite constant $H_\beta$ we have
$$E\left[ \left| W_n \right|^\beta \right] \leq H_\beta (\rho_1 \vee \rho_\beta)^n.$$
Let $c_\beta = \rho_1 \vee \rho_\beta$. Minkowski's inequality then gives
$$\left|\left| R^{(k)} \right|\right|_\beta \leq \sum_{n=0}^k \left|\left| W_n \right|\right|_\beta \leq \sum_{n=0}^\infty \left( H_\beta c_\beta^n \right)^{1/\beta} = \left( \frac{H_\beta}{1- c_\beta^{1/\beta}} \right)^{1/\beta} \triangleq \left( K_\beta \right)^{1/\beta} < \infty.$$
Similarly,
$$\left|\left| R^{(k)} - R \right|\right|_\beta \leq \sum_{n=k+1}^\infty \left|\left| W_n \right|\right|_\beta \leq \sum_{n=k+1}^\infty \left( H_\beta c_\beta^n \right)^{1/\beta} = c_\beta^{(k+1)/\beta} \left( \frac{H_\beta}{1- (\rho_1 \vee \rho_\beta)^{1/\beta}} \right)^{1/\beta} = \left( K_\beta c_\beta^{k+1} \right)^{1/\beta}.$$

For the case $\beta = 2$, $\rho_1 = 1$, $\rho_\beta < 1$ and $E[Q] = 0$ we have that
\begin{align*}
E\left[ W_n^2 \right] &= E\left[ \left( \sum_{r=1}^{N_\emptyset} C_r W_{n-1,r} \right)^2 \right]  = E\left[ \sum_{r=1}^{N_\emptyset} C_r^2 (W_{n-1,r})^2 + \sum_{1\leq r \neq s \leq N_\emptyset} C_r C_s W_{n-1,r} W_{n-1,s} \right] ,
\end{align*}
where $W_{n-1,r} = \sum_{(r,{\bf i}) \in A_n} Q_{(r,{\bf i})} \Pi_{(r,{\bf i})} / C_r$, and the $\{W_{n-1,r}\}_{r \geq 1}$ are i.i.d. copies of $W_{n-1}$, independent of $(N_\emptyset, C_1, C_2, \dots)$. Since $E[ W_{n} ] = 0$ for all $n \geq 0$, it follows that
$$E[W_n^2] = \rho_2 E[W_{n-1}^2] = \rho_2^n E[W_0^2] = {\rm Var} \mspace{1mu}(Q) \rho_2^n.$$
The two results now follow from the same arguments used above with $H_2 = {\rm Var} \mspace{1mu}(Q)$ and $c_2 = \rho_2$.
\end{proof}

It follows from the previous result that under the conditions of Proposition  \ref{P.MomentsR}, $R^{(k)}$ converges to $R$ both almost surely and in $L^\beta$-norm. Similarly, if we ignore the $Q$ in the generic branching vector, assume that $C_i \geq 0$ for all $i$, and define the process
$$W^{(k)} = \sum_{{\bf i} \in A_k} \Pi_{\bf i} = \sum_{r=1}^{N_\emptyset} C_r \left( \sum_{(r,{\bf i}) \in A_k} \Pi_{(r,{\bf i})}/ C_r \right) \stackrel{\mathcal{D}}{=} \sum_{r=1}^N C_r W_r^{(k-1)},$$
where the $\{W_r^{(k-1)}\}_{r \geq 1}$ are i.i.d. copies of $W^{(k-1)}$ independent of $(N, C_1, C_2, \dots)$, then it can be shown that $\{ W^{(k)}/\rho_1^k : k \geq 0\}$ defines a nonnegative martingale which converges almost surely to the endogenous solution of the stochastic fixed-point equation
$$W \stackrel{\mathcal D}{=}  \sum_{i=1}^N \frac{C_i}{\rho_1} \, W_i,$$
where the $\{W_i\}_{i \geq 1}$ are i.i.d. copies of $W$, independent of $(N, C_1, C_2, \dots)$. We refer to this equation as the homogeneous case.

As mentioned in the introduction, our objective is to generate a sample of $R^{(k)}$ for values of $k$ sufficiently large to suitably approximate $R$. Our proposed algorithm can also be used to simulate $W^{(k)}$, but due to space limitations we will omit the details.

\section{The algorithm}\label{sec:algorithm}

Note that based on \eqref{eq:RkDef}, one way to simulate $R^{(k)}$ would be to simulate a weighted branching process starting from the root and up to the $k$ generation and then add all the weights $Q_{\bf i} \Pi_{\bf i}$ for ${\bf i} \in \bigcup_{j=0}^k A_j$. Alternatively, we could generate a large enough pool of i.i.d. copies of $Q$ which would represent the $Q_{\bf i}$ for ${\bf i} \in A_k$, and use them to generate a pool of i.i.d. observations of $R^{(1)}$ by setting
$$R^{(1)}_i = \sum_{r=1}^{N_i} C_{(i,r)} R^{(0)}_r + Q_i,$$
where $\{ (Q_i, N_i, C_{(i,1)}, C_{(i,2)}, \dots)\}_{i \geq 1}$ are i.i.d. copies of the generic branching vector, independent of everything else, and the $R^{(0)}_r$ are the $Q$'s generated in the previous step. We can continue this process until we get to the root node. On average, we would need $(E[N])^k$ i.i.d. copies of $Q$ for the first pool of observations, $(E[N])^{k-1}$ copies of the generic branching vector for the second pool, and in general, $(E[N])^{k-j}$ for the $j$th step. This approach is equivalent to simulating the weighted branching process starting from the $k$th generation and going up to the root, and is the result of iterating \eqref{eq:Iterations}.

Our proposed algorithm is based on this ``leaves to root" approach, but to avoid the need for a geometric number of ``leaves", we will resample from the initial pool to obtain a pool of the same size of observations of $R^{(1)}$. In general, for the $j$th generation we will sample from the pool obtained in the previous step of (approximate) observations of $R^{(j-1)}$ to obtain conditionally independent (approximate) copies of $R^{(j)}$. In other words, to obtain a pool of approximate copies of $R^{(j)}$ we bootstrap from the pool previously obtained of approximate copies of $R^{(j-1)}$. The approximation lies in the fact that we are not sampling from $R^{(j-1)}$ itself, but from a finite sample of conditionally independent observations that are only approximately distributed as $R^{(j-1)}$. The algorithm is described below.

Let $(Q,N,C_1,C_2,\dots)$ denote the generic branching vector defining the weighted branching process. Let $k$ be the depth of the recursion that we want to simulate, i.e., the algorithm will produce a sample of random variables approximately distributed as $R^{(k)}$. Choose $m\in \mathbb N_+$ to be the bootstrap sample size.  For each $0 \leq j \leq k$, the algorithm outputs $\mathcal P^{(j,m)} \triangleq \left(\hat R^{(j,m)}_1, \hat R^{(j,m)}_2,\dots,\hat R^{(j,m)}_m\right)$, which we refer to as the sample pool at level $j$.

\begin{enumerate}
 \item[1.] \emph{Initialize}: Set $j=0$. Simulate a sequence $\{Q_i\}_{i = 1}^m$ of i.i.d. copies of $Q$ and let $\hat R^{(0,m)}_i=Q_i$ for $i=1,\dots,m$. Output $\mathcal P^{(0,m)}=\left(\hat R^{(0,m)}_1, \hat R^{(0,m)}_2,\dots,\hat R^{(0,m)}_m\right)$ and update $j = 1$.

\item[2.] While $j \leq k$:

\begin{enumerate}
\item[i)] Simulate a sequence $\{ (Q_i, N_i, C_{(i,1)}, C_{(i,2)}, \dots) \}_{i =1}^m$ of i.i.d. copies of the generic branching vector, independent of everything else.

\item[ii)] Let
        \begin{equation}
            \hat R^{(j,m)}_i = \sum_{r=1}^{N_i} C_{(i,r)} \hat R^{(j-1,m)}_{(i,r)} + Q_i, \qquad i=1,\dots,m,\label{eq:bootstrap-recur}
        \end{equation}
        where the $\hat R^{(j-1,m)}_{(i,r)}$ are sampled uniformly with replacement from the pool $\mathcal P^{(j-1,m)}$.

\item[iii)] Output $\mathcal P^{(j,m)}=\left(\hat R^{(j,m)}_1, \hat R^{(j,m)}_2,\dots,\hat R^{(j,m)}_m\right)$ and update $j = j+1$.

\end{enumerate}

\end{enumerate}

    Bootstrapping refers broadly to any method that relies on random sampling with replacement \cite{bootstrap1993efron}. For example, bootstrapping can be used to estimate the variance of an estimator, by constructing samples of the estimator from a number of resamples of the original dataset with replacement.
    With the same idea, our algorithm draws samples uniformly with replacement from the previous bootstrap sample pool.
    Therefore, the $\hat R^{(j-1,m)}_{(i,r)}$ on the right-hand side of \eqref{eq:bootstrap-recur} are only conditionally independent given $\mathcal P^{(j-1,m)}$. Hence, the samples in $\mathcal P^{(j,m)}$ are identically distributed but not independent for $j\ge 1$.

    As we mentioned earlier, the distribution of the $\{ \hat R_i^{(j,m)}\}$ in $\mathcal{P}^{(j,m)}$ are only approximately distributed as $R^{(j)}$, with the exception of the $\{\hat R_i^{(0,m)}\}$ which are exact. The first thing that we need to prove is that the distribution of the observations in $\mathcal{P}^{(j,m)}$ does indeed converge to that of $R^{(j)}$. Intuitively, this should be the case since the empirical distribution of the $\{\hat R_i^{(0,m)}\}$ is the empirical distribution of $m$ i.i.d. observations of $R^{(0)}$, and therefore should be close to the true distribution of $R^{(0)}$ for suitably large $m$. Similarly, since the $\{ \hat R_i^{(1,m)}\}$ are constructed by sampling from the empirical distribution of $\mathcal{P}^{(0,m)}$, which is close to the true distribution of $R^{(0)}$, then their empirical distribution should be close to the empirical distribution of $R^{(1)}$, which in turn should be close to the true distribution of $R^{(1)}$. Inductively, provided the approximation is good in step $j-1$, we can expect the empirical distribution of $\mathcal{P}^{(j,m)}$ to be close to the true distribution of $R^{(j)}$. In the following section we make the mode of the convergence precise by considering the Kantorovich-Rubinstein distance between the empirical distribution of $\mathcal{P}^{(j,m)}$ and the true distribution of $R^{(j)}$.

    The second technical aspect of our proposed algorithm is the lack of independence among the observations in $\mathcal{P}^{(k,m)}$, since a natural estimator for quantities of the form $E[ h(R^{(k)}) ]$ would be to use
    \begin{equation} \label{eq:hEstimator}
\frac{1}{m} \sum_{i=1}^m h (\hat R_i^{(k,m)}).
\end{equation}
    Hence, we also provide a result establishing the consistency of estimators of the form in \eqref{eq:hEstimator} for a suitable family of functions $h$.

    We conclude this section by pointing out that the complexity of the algorithm described above is of order $k m$, while the naive Monte Carlo approach has order $(E[N])^k m$. This is a huge gain in efficiency.

\section{Convergence and consistency}
\label{sec:convergence}

In order to show that our proposed algorithm does indeed produce observations that are approximately distributed as $R^{(k)}$ for any fixed $k$, we will show that the empirical distribution function of the observations in $\mathcal{P}^{(k,m)}$ , i.e.,
\[
    \hat F_{k,m}(x) = \frac{1}{m} \sum_{i=1}^{m} 1( \hat R_{i}^{(k,m)}\le x )
\]
converges as $m \to \infty$ to the true distribution function of $R^{(k)}$, which we will denote by $F_k$. We will show this by using the Kantorovich-Rubinstein distance, which is a metric on the space of probability measures. In particular, convergence in this sense is equivalent to weak convergence plus convergence of the first absolute moments.

\begin{definition} \label{d.wasserstein}
    let $M(\mu, \nu)$ denote the set of joint probability measures on $\mathbb R \times \mathbb R$  with marginals $\mu$ and $\nu$. then, the Kantorovich-Rubinstein distance between $\mu$ and $\nu$ is given by
$$d_1(\mu, \nu) = \inf_{\pi \in M(\mu, \nu)} \int_{\mathbb R\times \mathbb R} | x - y | \, d \pi(x, y).$$
\end{definition}

We point out that $d_1$ is only strictly speaking a distance when both $\mu$ and $\nu$ have finite first absolute moments. Moreover, it is well known that
  \begin{equation} \label{eq:Explicit}
  d_1(\mu, \nu) = \int_{0}^1 | F^{-1}(u) - G^{-1}(u) | du = \int_{-\infty}^\infty | F(x) - G(x) | dx,
  \end{equation}
where $F$ and $G$ are the cumulative distribution functions of $\mu$ and $\nu$, respectively, and $f^{-1}(t) = \inf\{ x \in \mathbb{R}: f(x) \geq t\}$ denotes the pseudo-inverse of $f$. It follows that the optimal coupling of two real random variables $X$ and $Y$ is given by $(X, Y) = (F^{-1}(U), G^{-1}(U))$, where $U$ is uniformly distributed in $[0, 1]$.

\begin{remark}
The Kantorovich-Rubinstein distance is also known as the Wasserstein metric of order 1. In general, both the Kantorovich-Rubinstein distance and the more general Wasserstein metric of order $p$ can be defined in any metric space; we restrict our definition in this paper to the real line since that is all we need. We refer the interested reader to \cite{Villani_2009} for more details.
\end{remark}

With some abuse of notation, for two distribution functions $F$ and $G$ we use $d_1(F,G)$ to denote the Kantorovich-Rubinstein distance between their corresponding probability measures.

The following proposition shows that for i.i.d. samples, the expected value of the Kantorovich-Rubinstein distance between the empirical distribution function and the true distribution converges to zero.

\begin{proposition}\label{P.empirical_d1}
  Let $\{ X_i\}_{i \geq 1}$ be a sequence of i.i.d. random variables with common distribution $F$. Let $F_n$ denote the empirical distribution function of a sample of size $n$. Then, provided there exists $\alpha\in (1,2)$ such that $E\left[ |X_1|^{\alpha} \right]< \infty$, we have that
$$E\left[ d_1(F_n,F) \right]\le n^{-1 + 1/\alpha}\left( \frac{2\alpha}{\alpha-1}+\frac{2}{2-\alpha} \right) E[|X_1|^\alpha].$$
\end{proposition}

Proposition~\ref{P.empirical_d1} can be proved following the same arguments used in the proof of Theorem 2.2 in \cite{del1999central} by setting $M=1$, and thus we omit it.

We now give the main theorem of the paper, which establishes the convergence of the expected Kantorovich-Rubinstein distance between $\hat F_{k,m}$ and $F_k$. Its proof is based on induction and the explicit representation \eqref{eq:Explicit}. Recall that $\rho_\beta = E\left[ \sum_{i=1}^N |C_i|^\beta \right]$.

\begin{theorem}\label{T.d1-l1-convergence}
    Suppose that the conditions of Proposition \ref{P.MomentsR} are satisfied for some $\beta > 1$. Then, for any $\alpha \in (1, 2)$ with $\alpha \leq \beta$, there exists a constant $K_\alpha < \infty$ such that
\begin{equation} \label{eq:InductionHyp}
E\left[ d_1(\hat F_{k,m}, F_{k}) \right] \leq K_\alpha m^{-1+1/\alpha} \sum_{i=0}^k \rho_1^i.
\end{equation}
\end{theorem}

\begin{proof}
By Proposition \ref{P.MomentsR} there exists a constant $H_\alpha$ such that
$$H_\alpha = \sup_{k \geq 0} E\left[ |R^{(k)}|^\alpha \right] \leq \sup_{k \geq 0} \left( E\left[ |R^{(k)}|^\beta \right] \right)^{\alpha/\beta} < \infty.$$
Set $K_\alpha = H_\alpha \left( \frac{2\alpha}{\alpha-1} + \frac{2}{2-\alpha} \right)$. We will give a proof by induction.

For $j = 0$, we have that
$$\hat F_{0,m}(x) = \frac{1}{m} \sum_{i=1}^m 1(Q_i \leq x),$$
where $\{Q_i\}_{i \geq 1}$ is a sequence of i.i.d. copies of $Q$. It follows that $\hat F_{0,m}$ is the empirical distribution function of $R^{(0)}$, and by Proposition \ref{P.empirical_d1} we have that
$$
E\left[ d_1(\hat F_{0,m}, F_0) \right] \leq K_\alpha m^{-1+1/\alpha}.
$$

Now suppose that \eqref{eq:InductionHyp} holds for $j-1$. Let $\{U_{r}^i \}_{i,r \geq 1}$ be a sequence of i.i.d. Uniform$(0,1)$ random variables, independent of everything else. Let $\{(Q_i, N_i, C_{(i,1)}, C_{(i,2)}, \dots)\}_
{i \geq 1}$ be a sequence of i.i.d. copies of the generic branching vector, also independent of everything else. Recall that $F_{j-1}$ is the distribution function of $R^{(j-1)}$ and define the random variables
    \begin{align*}
        \hat R_{i}^{(j,m)} = \sum_{r=1}^{N_i} C_{(i,r)} \hat F_{j-1,m}^{-1}(U_r^i)+Q_i \qquad \text{and} \qquad R_{i}^{(j)} = \sum_{r=1}^{N_i} C_{(i,r)} F_{j-1}^{-1}(U_r^i)+Q_i
    \end{align*}
for each $i  = 1, 2, \dots, m$. Now use these random variables to define
$$\hat F_{j,m}(x) = \frac{1}{m} \sum_{i=1}^m 1(\hat R_i^{(j,m)} \leq x) \qquad \text{and} \qquad F_{j,m}(x) = \frac{1}{m} \sum_{i=1}^m 1(R_i^{(j)} \leq x).$$
Note that $F_{j,m}$ is an empirical distribution function of i.i.d. copies of $R^{(j)}$, which has been carefully coupled with the function $\hat F_{j,m}$ produced by the algorithm.

 By the triangle inequality and Proposition \ref{P.empirical_d1} we have that
  \begin{align*}
    E\left[ d_1(\hat F_{j,m}, F_{j} )\right] &\leq E\left[ d_1(\hat F_{j,m},  F_{j,m})\right] + E\left[ d_1(F_{j,m}, F_{j}) \right]  \leq  E\left[ d_1(\hat F_{j,m},  F_{j,m})\right] + K_\alpha m^{-1+1/\alpha}.
 \end{align*}
  To analyze the remaining expectation note that
 \begin{align*}
E\left[ d_1(\hat F_{j,m}, F_{j,m}) \right] &=  E\left[ \int_{-\infty}^\infty | \hat F_{j,m} (x) -  F_{j,m}(x) | dx \right] \\
&\leq \frac{1}{m} \sum_{i=1}^m E\left[ \int_{-\infty}^\infty  \left| 1(\hat R_i^{(j,m)} \leq x ) - 1( R_i^{(j)} \leq x) \right| dx \right] \\
&=  \frac{1}{m} \sum_{i=1}^m E\left[\left| \hat R_i^{(j,m)} - R_i^{(j)} \right|  \right]\\
&= \frac{1}{m} \sum_{i=1}^mE\left[\left| \sum_{r=1}^{N_i} C_{(i,r)} ( \hat F_{j-1,m}^{-1}(U_r^i) - F_{j-1}^{-1}(U_r^i) ) \right|  \right]\\
&\le  E\left[ \sum_{r=1}^N |C_r| \right] E\left[ d_1(\hat F_{j-1,m},F_{j-1}) \right],
\end{align*}
where in the last step we used the fact that $ (N_i, C_{(i,1)}, C_{(i,2)}, \dots)$ is independent of $\left\{ U_r^i \right\}_{r \geq 1}$ and of $\hat F_{j-1,m}$, combined with the explicit representation of the Kantorovich-Rubinstein distance given in \eqref{eq:Explicit}.   The induction hypothesis now gives
\begin{align*}
E\left[ d_1(\hat F_{j,m}, F_{j} )\right] &\leq \rho_1 E\left[ d_1(\hat F_{j-1,m},F_{j-1}) \right] + K_\alpha m^{-1+1/\alpha} \\
&\leq K_\alpha m^{-1+1/\alpha} \rho_1 \sum_{i=0}^{j-1} \rho_1^i  + K_\alpha m^{-1+1/\alpha} \\
&= K_\alpha m^{-1+1/\alpha} \sum_{i=0}^{j} \rho_1^i.
\end{align*}
This completes the proof.
\end{proof}

Note that the proof of Theorem~\ref{T.d1-l1-convergence} implies that  $\hat R_i^{(j,m)} \to R_i^{(j)} = \sum_{r=1}^{N_i} C_{(i,r)} F_{j-1}^{-1}(U_r^i) + Q_i \stackrel{\mathcal{D}}{=} R^{(j)}$ in $L^1$-norm for all fixed $j \in \mathbb{N}$, and hence in distribution. In other words,
\begin{equation} \label{eq:WeakConvergence}
    P\left( \hat R^{(k,m)}_i \le x \right) \to F_k(x) \qquad \text{as } m \to \infty,
\end{equation}
for all $i= 1, 2, \dots, m$, and for any continuity point of $F_k$. This also implies that
\begin{equation} \label{eq:MeansConverge}
E\left[ \hat F_{k,m}(x) \right] = P\left( \hat R^{(k,m)}_1 \le x \right) \to F_k(x) \qquad \text{as } m \to \infty,
\end{equation}
for all continuity points of $F_k$.

Since our algorithm produces a pool $\mathcal P^{(k,m)}$ of $m$ random variables approximately distributed according to $F_k$, it makes sense to use it for estimating expectations related to $R^{(k)}$. In particular, we are interested in estimators of the form in \eqref{eq:hEstimator}. The problem with this kind of estimators is that the random variables in $\mathcal P^{(k,m)}$ are only conditionally independent given $\hat F_{k-1,m}$.

\begin{definition}
We say that $\Theta_n$ is a consistent estimator for $\theta$ if $\Theta_n \stackrel{P}{\to} \theta$ as $n \to \infty$, where $\stackrel{P}{\to}$ denotes convergence in probability.
\end{definition}

Our second theorem shows the consistency of estimators of the form in \eqref{eq:hEstimator} for a broad class of functions.

\begin{theorem} \label{thm:estimator}
    Suppose that the conditions of Proposition \ref{P.MomentsR} are satisfied for some $\beta > 1$. Suppose $h: \mathbb{R} \to \mathbb{R}$  is continuous and $|h(x)| \le C(1+|x|)$ for all $x\in \mathbb R$ and some constant $C>0$. Then, the estimator
$$\frac{1}{m} \sum_{i=1}^m h(\hat R^{(k,m)}_i) = \int_{\mathbb{R}} h(x) d \hat F_{k,m}(x),$$
where $\mathcal{P}^{(k,m)} = \left( \hat R_1^{(k,m)}, \hat R_2^{(k,m)}, \dots, \hat R_m^{(k,m)}\right)$, is a consistent estimator for $E[h(R^{(k)})]$.
\end{theorem}

\begin{proof}

For any $M>0$, define $h_M(x)$ as
\[
    h_M(x)=h(-M)1(x\le -M)+h(x)1(-M<x\le M)+h(M)1(x>M),
\]
and note that $h_M$ is uniformly continuous.
We then have
\begin{align}
    \left|\int_{\mathbb R} h(x)d\hat F_{k,m}(x)-\int_{\mathbb R} h(x)dF_{k}(x)\right|&\le
    2C\int_{|x| > M}(1+|x|)dF_k(x)+2C\int_{|x| > M} (1+|x|)d\hat F_{k,m}(x)\nonumber\\
    &\quad +\left|\int_{\mathbb R} h_M(x)d\hat F_{k,m}(x)-\int_{\mathbb R}  h_M(x)dF_{k}(x)\right|.\label{eq:truncation}
\end{align}
Fix $\epsilon > 0$ and choose $M_\epsilon > 0$ such that $E\left[ (|R^{(k)}| + 1) 1(|R^{(k)}| > M_\epsilon) \right] \leq \epsilon/(4C)$ and such that $-M_\epsilon$ and $M_\epsilon$ are continuity points of $F_k$. Define  $(\hat R^{(k,m)}, R^{(k)}) = (\hat F_{k,m}^{-1}(U), F_k^{-1}(U))$, where $U$ is a uniform $[0,1]$ random variable independent of $\mathcal{P}^{(k,m)}$. Next, note that $g(x) = 1 + |x|$ is Lipschitz continuous with Lipschitz constant one and therefore
\begin{align*}
\int_{|x| > M_\epsilon} (1+|x|)d\hat F_{k,m}(x) &=  (1+M_\epsilon) \left( \hat F_{k,m}(-M_\epsilon) + 1 - \hat F_{k,m}(M_\epsilon) \right) \\
&\hspace{5mm} + \int_{x < -M_\epsilon} \hat F_{k,m}(x) \, dx +  \int_{x > M_\epsilon} (1- \hat F_{k,m}(x) )dx \\
&\leq (1+M_\epsilon) \left( \hat F_{k,m}(-M_\epsilon) + 1 - \hat F_{k,m}(M_\epsilon) \right) +  d_1(\hat F_{k,m}, F_k) \\
&\hspace{5mm} + \int_{x < -M_\epsilon} F_{k}(x) \, dx +  \int_{x > M_\epsilon} (1- F_{k}(x) )dx \\
&= (1+M_\epsilon) \left(\hat F_{k,m}(-M_\epsilon) - F_k(-M_\epsilon) + F_k(M_\epsilon) - \hat F_{k,m}(M_\epsilon) \right) + d_1(\hat F_{k,m}, F_k) \\
&\hspace{5mm} + E\left[ (|R^{(k)}| + 1) 1(|R^{(k)}| > M_\epsilon) \right].
\end{align*}
Finally, since $h_{M_\epsilon}$ is bounded and uniformly continuous, then $\omega(\delta) = \sup\{ | h_{M_\epsilon}(x) - h_{M_{\epsilon}}(y) | : |x-y| \leq \delta\}$ converges to zero as $\delta \to 0$. Hence, for any $\gamma > 0$,
\begin{align*}
\left| \int_{\mathbb{R}} h_{M_\epsilon}(x) d\hat F_{k,m}(x) - \int_{\mathbb{R}} h_{M_\epsilon}(x) dF_k(x) \right| &\leq E\left[ \left. \left| h_{M_\epsilon}(\hat R^{(k,m)}) - h_{M_\epsilon}(R^{(k)}) \right| \right| \hat F_{k,m} \right] \\
&\leq \omega( m^{-\gamma}) + K_\epsilon E\left[ \left. 1\left( |\hat R^{(k,m)} - R^{(k)} | > m^{-\gamma} \right) \right| \hat F_{k,m} \right] \\
&\leq \omega(m^{-\gamma}) + K_\epsilon m^\gamma d_1(\hat F_{k,m}, F_k),
\end{align*}
where $2K_\epsilon = \sup\{ |h_{M_\epsilon}(x)|: x \in \mathbb{R}\}$. Choose $0 < \gamma < 1 - 1/\alpha$ for the $\alpha \in (1, 2)$ in Theorem  \ref{T.d1-l1-convergence} and combine the previous estimates to obtain
\begin{align*}
&E\left[ \left| \int_{\mathbb{R}} h(x) d \hat F_{k,m}(dx) - \int_{\mathbb{R}} h(x) dF_k(dx) \right| \right] \\
&\leq 2C(1+M_\epsilon) \left( E[\hat F_{k,m}(-M_\epsilon)] - F_k(-M_\epsilon) + F_k(M_\epsilon) - E[\hat F_{k,m}(M_\epsilon)] \right) \\
&\quad + \epsilon  + \omega(m^{-\gamma}) + (2 C + K_\epsilon m^\gamma) E\left[ d_1(\hat F_{k,m}, F_k) \right].
\end{align*}
Since
$$E[\hat F_{k,m}(-M_\epsilon)]  \to F_k(-M_{\epsilon}) \qquad \text{and} \qquad E[\hat F_{k,m}(M_\epsilon)]  \to F_k(M_{\epsilon})$$
by \eqref{eq:MeansConverge}, and $m^\gamma E\left[ d_1(\hat F_{k,m}, F_k) \right] \to 0$ by Theorem~ \ref{T.d1-l1-convergence}, it follows that
$$\limsup_{m \to \infty} E\left[ \left| \int_{\mathbb{R}} h(x) d \hat F_{k,m}(dx) - \int_{\mathbb{R}} h(x) dF_k(dx) \right| \right] \leq \epsilon.$$
Since $\epsilon > 0$ was arbitrary, the convergence in $L^1$, and therefore in probability, follows.
\end{proof}

\section{Numerical examples}\label{sec:numerical}

This last section of the paper gives a numerical example to illustrate the performance of our algorithm. Consider a generic branching vector $(Q, N, C_1, C_2, \dots)$ where the $\{C_i\}_{i \geq 1}$ are i.i.d. and independent of $N$ and $Q$, with $N$ also independent of $Q$.

Figure \ref{fig:numerical1} plots the empirical cumulative distribution function of 1000 samples of $R^{(10}$, i.e., $F_{10,1000}$ in our notation, versus the functions $\hat F_{10,200}$ and $\hat F_{10,1000}$ produced by our algorithm, for the case where the $C_i$ are uniformly distributed in $[0, 0.2]$, $Q$ uniformly distributed in $[0,1]$ and $N$ is a Poisson random variable with mean 3. Note that we cannot compare our results with the true distribution $F_{10}$ since it is not available in closed form. Computing $F_{10,1000}$ required 883.3 seconds using Python with an Intel i7-4700MQ $2.40$ GHz processor and $8$ GB of memory, while computing $\hat F_{10,1000}$ required only 2.1 seconds.  We point out that in applications to information ranking algorithms $E[N]$ can be in the thirties range, which would make the difference in computation time even more impressive.

\begin{figure}[t]
    \centering
    \includegraphics[scale=1.2]{numerical1.pdf}
    \caption{The functions $F_{10,1000}(x)$, $\hat F_{10,200}(x)$ and $\hat F_{10,1000}(x)$.}
    \label{fig:numerical1}
\end{figure}

Our second example plots the tail distribution of the empirical cumulative distribution function of $R^{(10)}$ for 10,000 samples versus the tail of $\hat F_{10,10000}$ for an example where $N$ is a zeta random varialbe with a probability mass function $P(N=k)\propto k^{-2.5}$, $Q$ is an exponential random variable with mean 1, and the $C_i$ have a uniform distribution in $[0,0.5]$. In this case the exact asymptotics for $P(R^{(k)} > x)$ as $x \to \infty$ are given by
$$P(R^{(k)} > x) \sim  \frac{(E[C_1] E[Q])^\alpha}{(1-\rho_1)^\alpha} \sum_{j=0}^{k} \rho_\alpha^j (1-\rho_1^{k-j})^\alpha P(N > x),$$
where $P(N > x) = x^{-\alpha} L(x)$ is regularly varying (see Lemma 5.1 in \cite{Jel_Olv_10}), which reduces for the specific distributions we have chosen to
$$G_{10}(x) \triangleq \frac{(0.25)^{2.5}}{(1 - (0.49))^{2.5}} \sum_{j=0}^{10}(0.07)^{j}(1-(0.49)^{10-j})^{2.5}      P(N > x) = (0.365) \, P(N>x).$$
Figure \ref{fig:numerical2} plots the complementary distributions of $F_{10,10000}$, $\hat F_{10,10000}$ and compares them to $G$. We can see that the tails of both $F_{10,10000}$ and $\hat F_{10,10000}$ approach the asymptotic roughly at the same time.

\begin{figure}[t]
    \centering
    \includegraphics[scale=1.2]{numerical2.pdf}
    \caption{The functions $1 - F_{10,10000}(x)$, $1- \hat F_{10,10000}(x)$ and $G_{10}(x)$, where $G_{10}$ is evaluated only at integer values of $x$ and linearly interpolated in between.}
    \label{fig:numerical2}
\end{figure}

\bibliographystyle{plain}


Nakayama automorphisms of Frobenius algebras

Abstract: We show that the Nakayama automorphism of a Frobenius algebra $R$ over a field $k$ is independent of the field (Theorem 4). Consequently, the $k$-dual functor on left $R$-modules and the bimodule isomorphism type of the $k$-dual of $R$, and hence the question of whether $R$ is a symmetric $k$-algebra, are independent of $k$. We give a purely ring-theoretic condition that is necessary and sufficient for a finite-dimensional algebra over an infinite field to be a symmetric algebra (Theorem 7).Key words: Nakayama automorphism, Frobenius algebra, Frobenius ring, symmetric algebra, dual module, dual functor, bimodule, Brauer Equivalence.

\section{Introduction}

Let $R$ be a finite-dimensional algebra over a field $k$.  The $k$-dual $\Rd := \Hom{k}(R,k)$ has a natural structure as an \bimod.  We say $R$ is a {\em Frobenius algebra} if $R \isom \Rd$ as \leftmods, and $R$ is a {\em symmetric $k$-algebra} if $R \isom \Rd$ as \bimods.  It is well-known that $\Rd$ is isomorphic to the injective hull of $\Rrad$ as \leftmods, so $R$ is Frobenius iff $R \isom E(\R(\Rrad))$ as \leftmods.  This purely ring-theoretic criterion shows that the property of $R$ being Frobenius is independent of the field $k$ over which we are considering $R$ as an algebra.  Motivated by this property,  an arbitrary artinian ring $S$ is defined to be a {\em Frobenius ring} if \(S \isom E(_S(S/\mbox{rad }S))\) as left $S$-modules, and this definition has led to a rich theory of Frobenius rings (see, for example, Section 16 in \lomar) that is not dependent on the framework of linear algebra.

The facts above naturally raise several questions.  Is the property of $R$ being a symmetric $k$-algebra independent of $k$?  If $R$ is symmetric, we know by Brauer's Equivalence Theorem (16.70 in \lomar) that the $k$-dual functor $\Hom{k}(-,k)$ from \leftmods\ to \rightmods\ is independent of $k$, i.e. the two functors defined by different fields are naturally equivalent.  On the level of modules, this means that the \rightmod\ isomorphism type of the $k$-dual of any left module $\R X$ is independent of $k$.  Do these facts remain true if $R$ is only Frobenius?  The result above shows only that the isomorphism type of the dual of the left regular module $\R R$ is independent of $k$.

The key to all of these questions is the Nakayama automorphism, a distinguished $k$-algebra automorphism of a Frobenius algebra $R$ that measures how far $R$ is from being a symmetric algebra.  (The automorphism is the identity iff $R$ is symmetric.)  We will show that the Nakayama automorphism is independent of $k$ and derive affirmative answers to the questions above as corollaries.  We will give a purely ring-theoretic condition that is equivalent to the property of $R$ being symmetric at least in the case when $k$ is infinite.  We hope that this will promote a ring-theoretic development of properties of symmetric algebras that parallels the theory of Frobenius rings.

F. G. Frobenius himself pioneered the idea of comparing an algebra with its dual in \cite{frobenius}.  The main properties of Frobenius algebras and symmetric algebras were developed by Nakayama in \cite{nak1}, \cite{nak2}, and \cite{nak3}.  They have been the subject of continued interest because of connections to such diverse areas as group representations, topological quantum field theories, Gorenstein rings in commutative algebra, Hopf algebras, coding theory, and the Yang-Baxter Equation.  For an excellent reference on the subject, see \lomar.

\section{The Nakayama automorphism}

In this section we show that the \nakaut\ of a Frobenius algebra is independent of the ground field.  As a corollary to the proof, we derive a simple ring-theoretic characterization of local symmetric algebras.

Let $R$ be a finite-dimensional algebra over a field $k$.  In \lomar, Theorem 3.15, we have:

\begin{theorem} \label{Frobdef}The following are equivalent:
\begin{description}
\item[1.]  $R$ is a Frobenius algebra, i.e.\  \(R \isom \Rd\) as \leftmods.
\item[2.]  There exists a linear functional \(\lambda: R \rightarrow k\) whose kernel contains no nonzero
left ideals.
\item[3.]  There exists a hyperplane $H \subset R$ (i.e. a subspace of codimension 1) containing no nonzero left ideals.
\item[4.]  There exists a nondegenerate associative bilinear form \(B: R \times R \rightarrow k\).  (``Associative'' means \(B(rs,t) = B(r,st)\).)
\end{description}
\end{theorem}

The equivalence of the first two conditions follows from taking \(\lambda\) to be the image of 1 under the module isomorphism and vice versa.  The equivalence of the second and fourth condition follows from defining \(B(r,s):=\lambda(rs)\) and \(\lambda(r):= B(r,1)\).  Since the last condition is right-left symmetric, we could also include the right-handed analogues of the other conditions above.

Given one isomorphism \(\hi:R \isommap \Rd\), any other isomorphism $\hi'$ is obtained by composition with an automorphism of the left regular module $_R R$, which corresponds to right multiplication by a unit $u \in U(R)$.  This affects the other conditions above as follows:  the new functional is \(\lambda' = u\lambda: r \mapsto \lambda(ru)\); the new hyperplane is \(H' = \ker \lambda' = Hu\inv\); and the new form is \(B'(r,s) = B(r,su)\).

A similar theorem (\lomar, Theorem 16.54) applies to symmetric $k$-algebras:

\begin{theorem} \label{symdef}The following are equivalent:
\begin{description}
\item[1.]  $R$ is a symmetric algebra, i.e.\  \(R \isom \Rd\) as \bimods.
\item[2.]  There exists a functional \(\lambda: R \rightarrow k\) such that \(\ker \lambda\) contains no nonzero left ideals and \(\lambda(rs) = \lambda(sr) \; \forall r,s \in R\).
\item[3.]  There exists a hyperplane $H \subset R$ containing the commutators \([R,R] = \{\sum_i (r_is_i - s_ir_i):r_i, s_i \in R\}\) and containing no nonzero left ideals.
\item[4.]  There exists a nondegenerate associative symmetric bilinear form \(B: R \times R \rightarrow k\).
\end{description}
\end{theorem}

If the conditions of Theorem~\ref{Frobdef} hold, the nondegeneracy of the form $B$ implies that there is a unique $k$-linear map \(\sigma: R \rightarrow R\) defined by \(B(r,s)=B(s,\sigma(r)) \; \forall r,s \in R\).  It is easy to check that $\sigma$ is actually a $k$-algebra automorphism of $R$; we call it the {\em \nakaut} of $R$.  Replacing $B$ with a new form $B'$ defined by the unit $u$ gives us the new automorphism \(\sigma':r \mapsto u\sigma(r)u\inv\).  So the \nakaut\ is determined up to composition with inner automorphisms; equivalently, it is a well-defined element of the group of outer automorphisms of $R$.  The algebra is symmetric iff \sig\ can be taken to be the identity, iff the \nakaut\ determined by an arbitrary nondegenerate associative bilinear form is an inner automorphism.

If we use the linear functional $\lambda$ to define \sig\ instead of the form $B$, then \sig\ is defined by the equation

\[
\lambda(rs) = \lambda(s\sigma(r)) \all r,s \in R).
\]

We are now ready to prove that the \nakaut\ is independent of the base field.  We warm up with the local case.  The argument is similar to that for the general case but much easier, and it gives us a criterion for a local algebra to be symmetric.

\begin{theorem}\label{theorem-local}
If $R$ is a local Frobenius k-algebra then $\sigma$ is independent of $k$.
\end{theorem}

\textit{Proof}.
Let $k_1$ and $k_2$ be two fields over which $R$ is a finite-dimensional algebra, and suppose $\sigma_1$ is a Nakayama automorphism of $R$ as a $k_1$-algebra.  Then $\sigma_1$ arises from a $k_1$-linear functional \(\lambda_1:R \rightarrow k_1\) via the equation
\[
\lambda_1(rs) = \lambda_1(s \sigma_1(r)) \all r,s \in R).
\]

Thus \(C:= \{\sum(r_is_i - s_i\sigma_1(r_i)) :\; r_i, s_i \in R\} \subseteq \ker \lambda_1\).  Note that $C$ is closed under multiplication by any element from the center $Z(R)$, and in particular that $C$ is a subspace with respect to both $k_1$ and $k_2$.

Now since $R$ is local Frobenius, $\R R$ is the only principal indecomposable \leftmod, and so $\R R$ has a simple socle $S$ by Theorem 16.4 in \lomar.  Then \(S \not\subset \ker \lambda_1\), so
\(
S \not\subset C.
\)

Since $S$ and $C$ are both $k_2$-subspaces, we can define a $k_2$-linear functional \(\lambda_2:R \rightarrow k_2\) that is $0$ on $C$ but not on $S$.  Then since \(S \not\subset \ker\lambda_2\), \(\ker\lambda_2\) contains no nonzero left ideals, and the Nakayama automorphism $\sigma_2$ of $R$ as a Frobenius $k_2$-algebra is defined by
\[
\lambda_2(rs) = \lambda_2(s \sigma_2(r)) \all r,s \in R).
\]
In other words, $\sigma_2(r)$ is uniquely defined by
\[
rs - s \sigma_2(r) \in \ker\lambda_2 \all s \in R).
\]
But \( rs - s \sigma_1(r) \in C \subseteq \mbox{ ker}\lambda_2 \; (\forall s)\), so \(\sigma_2(r) = \sigma_1(r) \; \forall r \in R\), as desired.
  \qed

The proof above gives us the promised ring-theoretic characterization of local symmetric algebras.  Recall that the property of $R$ being Frobenius over $k$ is independent of $k$, and in fact, is equivalent to a ring-theoretic property.

\begin{corollary}\label{corollary-localsym}
Let $R$ be a local $k$-algebra.  Then $R$ is a symmetric $k$-algebra iff $R$ is a Frobenius $k$-algebra and \( \lsoc \not\subset [R,R]\).  In particular, the truth of $R$ being a symmetric $k$-algebra is independent of $k$.
\end{corollary}

\textit{Proof}.
This follows from the proof of the theorem above.  If $R$ is symmetric, then we can take $\sigma_1$ to be the identity, so \(S \not\subset C = [R,R]\).  Conversely, if \(S \not\subset [R,R]\), then we can define $\lambda_2$ as we did above to be $0$ on $[R,R]$ but not on $S$.  The resulting $\sigma_2$ will be the identity, proving that $R$ is a symmetric algebra.
  \qed

We now pass to the general case and show that the \nakaut\ with respect to the two fields remains the same.  This turns out to be easy if the fields are both finite-dimensional over their intersection (necessarily a field).   The case in which there is no convenient intersection is harder and uses the assumption that the fields be infinite, so we do not have a single proof to cover both cases.

Let $R$ be a Frobenius ring with Jacobson radical $J$ and \(\Rbar = R/J\).  Suppose, as above, that $R$ can be considered as a finite-dimensional algebra over two different fields $k_1$ and $k_2$, with respective \nakauts\ $\sigma_1$ and $\sigma_2$.

\begin{theorem}  \label{theorem-nakind}The Nakayama automorphism of $R$ is independent of the ground field.
\end{theorem}

\textit{Proof of Part I}.
Assume that the two fields are both finite-dimensional over some common ground field.  This case can be handled by a transfer-type argument, as suggested to me by T.Y. Lam.  By passing down to the common ground field and then up again, we can reduce to the case in which \(k_2 \subseteq k_1\).

Let \(\mbox{Tr}:k_1 \rightarrow k_2\) be any nonzero $k_2$-linear map.  Considering $R$ as a Frobenius $k_1$-algebra, we have a $k_1$-linear functional \(\lambda_1:R \rightarrow k_1\) whose kernel contains no nonzero left ideals.  Then \(\lambda_2 := \Tr \circ \lambda_1: R \rightarrow k_2\) is a $k_2$-linear map, and we claim that \(\ker \lambda_2\) also contains no nonzero left ideals.  Indeed, if $r \in R\setminus\{0\}$, then \(\exists s \in R\) such that \(\lambda_1 (sr) \neq 0\), so \(\exists \alpha \in k_1\) such that \(0 \neq \Tr (\alpha \lambda_1(sr)) = \Tr (\lambda_1 (\alpha sr)) = \lambda_2 (\alpha sr).\)

Now $\sigma_i(r)$ is defined (\(\forall r \in R\)) by the equation
\[
rs - s \sigma_i(r) \in \ker \lambda_i \all s \in R).
\]
But \(\ker \lambda_1 \subseteq \ker \lambda_2\), so (\(\forall r \in R\)),
\[
rs - s \sigma_1(r) \in \ker \lambda_1 \subseteq \ker \lambda_2 \all s \in R),
\]
showing that $\sigma_2(r)$ must be equal to $\sigma_1(r)$.  This finishes Part I\@.
  \qed

For Part II we first need two facts from linear algebra.

\begin{lemma}\label{hyperplane}
Let $U \subsetneq V$ be finite-dimensional vector spaces over a field $k$ and suppose $V$ decomposes into subspaces \(V = V_1 \oplus V_2 \oplus \cdots \oplus V_n\) with each \(V_i \not\subset U\).  Suppose that $|k| \geq n$.  Then $U$ can be enlarged to a hyperplane $U'$ such that \(V_i \not\subset U'\) for \(i = 1,2,\dots, n\).
\end{lemma}

\textit{Proof}.
By enlarging $U$ one dimension at a time, we may assume that $U$ is maximal with respect to the property that no \(V_i \subseteq U\).  We claim that now \(\dim_k V/U = 1\).  If not, there exist
at least $|k| + 1$ linear subspaces of $V/U$ corresponding to one-dimensional extensions $U_i \supset U$.  By the maximality of $U$ and the Pigeonhole Principle, some $V_i$ is contained in two different extensions, say $U_1$ and $U_2$.  But this implies \(V_i \subseteq U_1 \cap U_2 = U\), a contradiction.
  \qed

(The assumption that $|k| \geq n$ cannot be omitted.  A three-dimensional vector space over the field of two elements contains the subspace \(U = \{0, (1,1,1)\}\), which cannot be extended to a hyperplane without including one of the three coordinate axes.)

\begin{lemma}\label{lemma-commutators}
Let $D$ be a division ring, $n$ a positive integer, and $S = \mathbb M_n(D)$.  If $I \subseteq S$ is any nonzero left ideal, then $I + [S,S] = S$.
\end{lemma}

\textit{Proof}.
Let $U = I + [S,S]$ and let $E_{ij}$ denote the matrix units in $S$.  Using a nonzero element of $I$, we can obtain a matrix in $U$ that is nonzero in the $(i,i)$ position and $0$ off the $i$-th row.  For all $d \in D$ and $i \neq j$, \(dE_{ij} =  (dE_{ii})(E_{ij}) - (E_{ij})(dE_{ii}) \in U\), and \(d(E_{ii} - E_{jj}) = (dE_{ij})(E_{ji}) - (E_{ji})(dE_{ij}) \in U\).  Repeated use of these identities shows that an arbitrary matrix in $S$ is a sum of matrices in $U$.
  \qed

\textit{Proof of Theorem~\ref{theorem-nakind}, Part II}.  We assume that there is no common ground field over which $k_1$ and $k_2$ are both finite-dimensional.  We need this assumption only because we will need to assume that both fields are infinite so that we can apply Lemma~\ref{hyperplane}.

Fix a $k_1$-linear functional \(\lambda_1: R \rightarrow k_1\) with kernel $H_1$ containing no nonzero left ideals.  Then the \nakaut\ of $R$ as a $k_1$-algebra is defined (\(\forall r \in R\)) by
\[
rs - s \sigma_1(r) \in H_1 \all s \in R).
\]
As in the proof of Theorem~\ref{theorem-local}, we set
\[
C:= \left\{\sum_i(r_is_i - s_i\sigma_1(r_i)) :\; r_i, s_i \in R\right\} \subseteq H_1
\]
and note that $C$ is closed under multiplication from the center $Z(R)$.  In particular, $C$ is a subspace over both $k_1$ and $k_2$.  Let \(S:= \lsoc\) and note that since \(C \subseteq H_1\), $S \cap C$ contains no nonzero left ideals.  Also \(S \cap C \subseteq S \cap H_1\), which is a $k_1$-subspace of $S$ of codimension 1.  (This is because \(\dim_{k_1} R/H_1 = 1\) and \(S \cap H_1 \neq S\) because $H_1$ contains no nonzero left ideals.)

By Theorem 16.14 in \lomar, we have an isomorphism \(\hi: \R S \isommap \R \Rbar\), which is also an isomorphism of left \Rbar-modules.  Now \(S \cap H_1 \subset S\) contains no nonzero left ideals of $R$, hence no minimal left ideals, hence no nonzero \Rbar-submodules.  So \(\hi(S \cap H_1)\) is a $k_1$-hyperplane in \Rbar\ containing no nonzero left ideals.

Since $R$ is a finite-dimensional algebra (over either field), \Rbar\ is semisimple (by Theorem 4.14 in \cite{fc}), hence a symmetric algebra by Example 16.59 in \lomar.  We consider \Rbar\ now as a symmetric $k_1$-algebra.  By Theorem~\ref{symdef}, \Rbar\ contains another $k_1$-hyperplane $H$ that contains no nonzero left ideals and contains the commutator subspace \([\Rbar, \Rbar]\).  Now by the discussion following Theorem~\ref{Frobdef}, we know that \(H = (\hi(S \cap H_1))u\) for some \(u \in U(\Rbar).\)

Now \((\hi(S \cap C))u \subseteq \hi(S \cap H_1))u = H\), so \(U:=(\hi(S \cap C))u + [\Rbar, \Rbar] \subseteq H\).  Since $H$ contains no nonzero left ideals in \Rbar, $U$ also contains no nonzero left ideals.  But since both \(\hi(S \cap C))u\) and \([\Rbar, \Rbar]\) are $k_2$-subspaces of $\Rbar$, $U$ is a $k_2$-subspace of \Rbar.  Our goal is to enlarge $U$ to a $k_2$-hyperplane containing no nonzero left ideals.

Let \Rbar\ have Artin-Wedderburn decomposition
\(
\mathbb M_{n_1} (D_1) \times \cdots \times \mathbb
M_{n_r} (D_r),
\)
where the $D_i$'s are division rings.  We decompose each \(R_i:= \mathbb M_{n_i} (D_i)\) into a sum of simple left ideals $V_{i,j}$, where $V_{i,j}$ consists of matrices that are 0 except in the $j$-th column.  This gives a decomposition of \Rbar\ into simple left ideals:
\[
\Rbar = V_{1,1} \oplus \cdots \oplus V_{1,n_1} \oplus \cdots \oplus V_{r,1} \oplus \cdots \oplus V_{r,n_r}.
\]
Now we know that for all $i,j$, \(V_{i,j} \not\subset U\).  So by Lemma~\ref{hyperplane} we can enlarge $U$ to a $k_2$-hyperplane \(U' \subset \Rbar\) while preserving \(V_{i,j} \not\subset U' \forall i,j\).  We claim that $U'$ still contains no nonzero left ideal of \Rbar.  Indeed, assume that $U'$ does contain a nonzero left ideal of \Rbar; then it contains a minimal left ideal of one of the $R_i$'s, say $R_1$.  But $U'$ also contains the commutators $[R_1,R_1]$ since \([R_1,R_1] \subseteq [\Rbar, \Rbar] \subseteq U \subseteq U'\).  Then by Lemma~\ref{lemma-commutators}, $U'$ contains all of $R_1$, hence all the $V_{1,j}$'s, a contradiction.  So $U'$ is indeed a $k_2$-hyperplane of \Rbar\ containing no nonzero left ideals.

We now consider the $k_2$-hyperplane \(U'u\inv \subset \Rbar\), which also contains no nonzero left ideals of \Rbar.  Moreover, since \((\hi(S \cap C))u \subseteq U \subseteq U'\), we have \(\hi(S \cap C) \subseteq U'u\inv\).  We now pull \(U'u\inv\) back through the isomorphism \(\hi: \R S \isommap \R \Rbar\) to get a $k_2$-hyperplane \(H_2':= \hi\inv(U'u\inv) \subset S\) containing no nonzero left \Rbar-submodules of $S$, hence no nonzero left ideals of $R$.  Also, since \(\hi(S \cap C) \subseteq U'u\inv\), \(H_2'\) contains $S \cap C$.

To finish the proof, we will extend $H_2'$ to a $k_2$-hyperplane $H_2 \subset R$ that contains $C$ and still contains no nonzero left ideals.  We can then use $H_2$ to define the \nakaut\ with respect to $k_2$.

\setlength{\unitlength}{.1in}

\begin{figure}
\begin{center}
\begin{picture}(23,18)(0,0)

\put(0,0){\framebox(23,18)[tl]{}}

\put(5,5){\oval(6,6)[bl]}
\put(6,5){\oval(6,6)[br]}
\put(6,13){\oval(6,6)[tr]}
\put(5,13){\oval(6,6)[tl]}
\put(5,2){\line(1,0){1}}
\put(5,16){\line(1,0){1}}
\put(2,5){\line(0,1){8}}
\put(9,5){\line(0,1){8}}

\put(5,5){\oval(4,4)[bl]}
\put(7,5){\oval(4,4)[br]}
\put(7,13){\oval(4,4)[tr]}
\put(5,13){\oval(4,4)[tl]}
\put(5,3){\line(1,0){2}}
\put(5,15){\line(1,0){2}}
\put(3,5){\line(0,1){8}}
\put(9,5){\line(0,1){8}}

\put(10,9){\oval(10,8)}

\put(12,9){\oval(6,4)}

\put(15,9){\oval(12,12)}

\put(2,15.5){$S$}
\put(3.2,13){$H_2'$}
\put(5.2,10){\small $S \cap C$}
\put(12,9.5){$C'$}
\put(12,11.5){$C$}
\put(17,13.5){$S'$}
\put(.2,16.7){$R$}

\end{picture}
\end{center}
\caption{$k_2$-subspaces of $R$.}\label{figure-subspaces}
\end{figure}

To extend $H_2'$, consider $S, C, H_2',$ and $R$ just as $k_2$-vector spaces as in Fig. ~\ref{figure-subspaces}.  As in the picture below, decompose $C$ as a $k_2$-vector space into \(C = (S \cap C) \oplus C'\).  Then since \(C' \cap S = 0\), we can extend $C'$ to a $k_2$-vector space \(S' \supseteq C'\) such that \(R = S \oplus S'\).  Define \(H_2 := H_2' \oplus S'\), a $k_2$-hyperplane of $R$ since \(\dim_{k_2}(S/H_2') = 1\).  Moreover, $H_2$ contains no nonzero left ideals, since any nonzero left ideal \({_R} L \subseteq H_2\) would contain a minimal left ideal \({_R} L' \subseteq H_2 \cap S = H_2'\).  Most importantly, $H_2$ contains $C$.

We now define a $k_2$-functional \(\lambda_2: R \rightarrow k_2\) with \(\ker \lambda_2 = H_2\).  Then the \nakaut\ $\sigma_2$ of $R$ as a $k_2$-algebra is defined (\(\forall r \in R\)) by
\[
rs - s \sigma_2(r) \in \ker \lambda_2 = H_2 \all s \in R).
\]
But since \(rs - s\sigma_1(r) \in C \subseteq H_2\), we have \(\sigma_2(r) = \sigma_1(r)\) for all $r \in R$.  This concludes the proof of Part II\@.
  \qed

\section{Corollaries}

We can now answer the questions posed in the introduction.  We begin with a theorem that does not require the Frobenius assumption.  Let $R$ be a ring that is a finite-dimensional algebra over two fields $k_1$ and $k_2$.  We denote by \lcat\ and \rcat\ the categories of \leftmods\ and \rightmods\ respectively.

Let $\F_i: \lcat \rightarrow \rcat$ be the $k_i$-dual functor:  \(\F_i(\R X) = \rXdi := \Hom{k_i}(X, k_i)\).  Let \biRdi\ be the bimodule \(\Hom{k_i}(R, k_i)\).

\begin{theorem}\label{theorem-bifun}
\(\biRda \simeq \biRdb\) as bimodules iff the functors $\F_1$ and $\F_2$ are naturally equivalent.
\end{theorem}

\textit{Proof}.
By Brauer's Equivalence Theorem (16.70 in \lomar), the functor $\F_i$ is naturally equivalent to the functor \(\G_i:= \Hom{R}(-,\lRdi)\) on \leftmods, proving the forward direction.  The converse is essentially identical to Theorem 16.71 in \lomar.  We apply the equivalence \(\G_1 \simeq \G_2\)
to the \leftmod\ homomorphism \(\rho_r: \R R \rightarrow \R R\), where \(\rho_r\) is right multiplication by some fixed $r \in R$, as in Fig. ~\ref{figure-brauer}.  Then the map
\[
\G_i(\rho_r) : \Hom{R}(\R R,\lRdi) \rightarrow \Hom{R}(\R R,\lRdi)
\]
takes $\alpha$ to the map \( (s \mapsto \alpha (sr)) = r\alpha\), so \(\G_i (\rho_r)\) is {\em left} multiplication by $r$ on \(\Hom{R}(\R R,\lRdi)\).  This gives us a commutative diagram of \rightmods\ as in Fig.~\ref{figure-brauer}.

\setlength{\unitlength}{1in}
\begin{figure}

\begin{center}
\begin{picture}(4.0,1.0)(0,0)

\put(0,0){\(\G_1(\R R)=\Hom{R}(\R R,\lRda)\)}

\put(0,.85){\(\G_1(\R R)=\Hom{R}(\R R,\lRda)\)}

\put(2.2,0){\(\G_2(\R R)=\Hom{R}(\R R,\lRdb)\)}

\put(2.2,.85){\(\G_2(\R R)=\Hom{R}(\R R,\lRdb)\)}

\put(1.8,.05){\vector(1,0){.3}}
\put(1.9,.05){$\sim$}

\put(1.8,.9){\vector(1,0){.3}}
\put(1.9,.9){$\sim$}

\put(.6,.75){\vector(0,-1){.5}}
\put(.7,.45){\(\G_1(\rho_r) = r \cdot\)}
\put(2.8,.75){\vector(0,-1){.5}}
\put(2.9,.45){\(\G_2(\rho_r) = r \cdot\)}

\end{picture}
\end{center}
\caption{The equivalence \(\G_1 \simeq \G_2\) applied to \(\rho_r: \R R \rightarrow \R R\).}\label{figure-brauer}
\end{figure}

However, \(\Hom{R}(\R R,\lRdi) \simeq \rRdi\) as \rightmods\ under the isomorphism \(\alpha \mapsto \alpha(1) \), so the isomorphism on the top and bottom rows is \(\rRda \simeq \rRdb\).  The commutativity of the diagram shows that this isomorphism respects the left $R$-action as well, so we have \(\biRda \simeq \biRdb\) as bimodules, as desired.
  \qed

To apply this theorem, let \sig\ be any automorphism of $R$ and let $M_R$ be a \rightmod.  We define the twisted \rightmod\ $M_{R^\sigma}$ to be the same abelian group as $M$ with the $R$-action defined by
\[
m*r := m\sigma(r) \all r \in R, m \in M).
\]

(Thanks to Mark Davis for suggesting this
definition.)  Now let $\R X$ be a \leftmod\ with $k$-dual \(\rXd := \Hom{k} (X,k)\).  Let $(X^*)_R$ denote the $R$-dual $\Hom{R}(\R X,\R R),$ the isomorphism type of which is, of course, independent of $k$.

\begin{theorem}\label{theorem-twistmodule}  Let $R$ be a Frobenius $k$-algebra with Nakayama automorphism \sig.  Then there is a natural \rightmod\ isomorphism \(\rXd \isom (X^*)_{R^\sigma}\).
\end{theorem}

\textit{Proof}.
We have an isomorphism \(\R R \simeq \lRd\), say given by \(1 \mapsto \lambda\).
Then \(\forall r \in R\),

\[
(\lambda r)(s) = \lambda(rs) = \lambda(s \sigma(r)) = (\sigma(r)\lambda)(s)\all s \in R),
\]

so \(\lambda r = \sigma(r) \lambda\) in \Rd.  Now By Brauer's Theorem, we have a natural isomorphism \(\rXd \simeq \Hom{R}(\R X, \lRd) \) of \rightmods.
The isomorphism \(\R R \simeq \lRd\) of \leftmods\ then gives us an abelian group isomorphism
\(
\Hom{R}(\R X, \R R) \simeq \Hom{R}(\R X, \lRd),
\)
which we denote by \(\alpha \mapsto \widehat{\alpha}\).  Then \(\widehat{\alpha}\) is given by
\begin{equation}\label{alphahat}
\widehat{\alpha}(x) =  (\alpha(x))\lambda \in \Hat{R}.
\end{equation}

We claim that although `` $\widehat{}$ '' is not in general an isomorphism of \rightmods,  it satisfies \(\widehat{\alpha r} = \widehat{\alpha}\sigma\inv(r)\).  The theorem then follows by identifying \Xd\ with \(\Hom{R}(\R X, \lRd)\) and taking \(f: \Xd \rightarrow \Hom{R}(\R X, \R R)\) to be the inverse of `` $\widehat{}$ ''.

To prove the claim, let \(x \in X, r \in R\).  Then in \Rd, we have
\begin{eqnarray*}
\widehat{\alpha r}(x) & = &  ((\alpha r) (x)) \lambda \mbox{ by Eq. \ref{alphahat}} \\
& = & (\alpha(x) r) \lambda  \mbox{ by the $R$-action on } \Hom{R}(\R X, \R R) \\
& = & \alpha (x) (r \lambda) \mbox{ by the associativity of the $R$-action on } \lRd \\
& = & \alpha (x) (\lambda \sigma\inv(r)) \mbox{ as shown above} \\
& = & (\alpha (x) \lambda) \sigma\inv(r) \mbox{ by associativity again} \\
& = & (\widehat{\alpha}(x)) \sigma\inv(r) \mbox{ by Eq. \ref{alphahat}} \\
& = & (\widehat{\alpha} \sigma\inv(r))(x) \mbox{ by the $R$-action on }\Hom{R}(\R X, \lRd).
\end{eqnarray*}
So
\(
\widehat{\alpha r} = \widehat{\alpha}\sigma\inv(r),
\)
proving our claim and the theorem.
  \qed

\begin{corollary}\label{corollary-funind}
If $R$ is a Frobenius $k$-algebra, then the $k$-dual functor \(\F:=\Hom{k}(-,k): \lcat \rightarrow \rcat\) is independent of $k$.
\end{corollary}

\textit{Proof}.
Apply Theorems~\ref{theorem-nakind} and ~\ref{theorem-twistmodule}.
  \qed

\begin{corollary}\label{corollary-biind}
If $R$ is a Frobenius $k$-algebra, then the bimodule isomorphism type of \biRd\ is independent of $k$.
\end{corollary}

\textit{Proof}.
Apply Corollary~\ref{corollary-funind} and Theorem~\ref{theorem-bifun}.
  \qed

Corollary~\ref{corollary-biind} suggests that there should be a ring-theoretic characterization of \biRd\ as a bimodule analogous to the fact that \(\rRd \isom E((\Rrad)_R)\) as \rightmods.  We do not yet have such a characterization.

\begin{corollary}\label{corollary-symind}
If $R$ is any finite-dimensional $k$-algebra, then the property of $R$ being a symmetric $k$-algebra is independent of $k$.
\end{corollary}

\textit{Proof}.
We have seen that the question of whether $R$ is a Frobenius $k$-algebra is independent of $k$.  Now apply Corollary~\ref{corollary-biind}.
  \qed

\section {Ring-theoretic characterization of symmetric algebras}

We have seen in Corollary~\ref{corollary-symind} that the property of a $k$-algebra being symmetric is independent of $k$, suggesting that it should be equivalent to a ring-theoretic property.  In the local case, we saw in Corollary~\ref{corollary-localsym} that an algebra is symmetric iff its left socle is not contained in the commutators.  In the general case, we have ring-theoretic conditions for symmetry if we assume that the ground field $k$ is infinite.

We continue to assume that $R$ is a finite-dimensional algebra over a field $k$.  As before, let \(J = \mbox{rad } R\) be the Jacobson radical and $\Rbar = R/J$.  The following theorem is similar to Theorem 16.14 in \lomar, which states that $R$ is Frobenius iff \(\rsoc \isom \Rbar_R\) and \(\lsoc \isom \R \Rbar\).  We use $S$ to denote $\lsoc$.

\begin{theorem}\label{theorem-symring}
Suppose $k$ is infinite.  Then $R$ is a symmetric $k$-algebra iff \(\R S_R \simeq \R \Rbar_R\) as $(R,R)$-bimodules and $[R,R]$ contains no nonzero left ideals of $R$.
\end{theorem}

\textit{Proof}.
If $R$ is symmetric, then we have a bimodule isomorphism \(\hi: \R R_R \isommap \biRd\).  Considering $\hi$ as an isomorphism of \leftmods\ and restricting it to $S$, we have an isomorphism \(\hi: S \isommap \mbox{soc}(\lRd)\).  Note, however, that $\hi$ still respects the right action of $R$ on $S$ and $\mbox{soc}(\lRd)$.  By Example 3.41 in \lomar, we have \(\mbox{soc}(\lRd) = \{f \in \Rd: f(J) = 0\}\), which is isomorphic as an $(R,R)$-bimodule to \(\Hom{k}(\Rbar, k)\).  But since \Rbar\ is a semisimple $k$-algebra, hence symmetric, \(\Hom{k}(\Rbar, k) \isom \Rbar\) as $(\Rbar, \Rbar)$-bimodules and hence also as $(R,R)$-bimodules.  Composing all these, we have an $(R,R)$-bimodule isomorphism $S \simeq \Rbar$.

The condition on $[R,R]$ follows from Theorem~\ref{symdef}, which gives us a $k$-linear functional \(\lambda: R \rightarrow k\) such that \([R,R] \subseteq \ker \lambda\), yet $\ker \lambda$ contains no nonzero left ideals of $R$.

Conversely, suppose \(\hi:\R S_R \isommap \R \Rbar_R\) as $(R,R)$-bimodules and $[R,R]$ contains no nonzero left ideals of $R$.  We consider \(\hi ([R,R] \cap S) \subset \Rbar\), which contains no nonzero left ideals of \Rbar\ since $[R,R]$ contains no nonzero left ideals of $R$.  Moreover we claim that \([\Rbar, \Rbar] \subseteq \hi ([R,R] \cap S) \).  Indeed, let \(\bar x, \bar y \in \Rbar\) (where $x,y \in R$), and suppose that \(\bar{y} = \hi(b)\) for some \(b \in S\).  Then using the fact that $\hi$ is a bimodule isomorphism, we have
\[
\bar x \bar y - \bar y \bar x = \bar x \hi(b) - \hi(b) \bar x = \hi (xb - bx) \in \hi([R,S]) \subseteq \hi ([R,R] \cap S).
\]
So \(\hi ([R,R] \cap S) \) is a $k$-subspace of \Rbar\ containing no nonzero left ideals and containing the commutators in \Rbar.  By the same argument used in the proof of Theorem~\ref{theorem-nakind}, Part II, we can enlarge \(\hi ([R,R] \cap S) \) to a $k$-hyperplane $U' \subset \Rbar$ containing no nonzero left ideals.  (Here we use the fact that $k$ is infinite.)  Then we can pull back to \(H':= \hi^{-1} (U')\), a $k$-hyperplane of $S$ containing \([R,R] \cap S\) but containing no nonzero left ideals of $R$.  Then, again by the same argument used in Theorem~\ref{theorem-nakind} (using $[R,R]$ in place of the $C$ that was used there), we can extend $H'$ to $H$, a $k$-hyperplane of $R$ containing $[R,R]$ but containing no nonzero left ideals.  Then by Theorem~\ref{symdef}, $R$ is a symmetric algebra.
  \qed

I do not know if Theorem~\ref{theorem-symring} holds without the assumption that $k$ is infinite.  The proof of the forward implication did not use this assumption, so that half certainly remains true.  Conversely, an old result by Nakayama (\cite{nak4}) states that for a finite-dimensional algebra $R$ over a field, \(\lsoc \isom \R\Rbar\) iff \(\rsoc \isom \Rbar_R\).  So if \(\R S_R \simeq \R \Rbar_R\) as $(R,R)$-bimodules, then $R$ is certainly Frobenius, but it does not seem obvious whether $R$ must be symmetric.

\small
\noindent {\bf Acknowledgements}  I would like to thank T.Y.\ Lam, Greg Marks, and Florence Newberger for valuable conversations about this work.
\normalsize


Deterministic Primality Proving on Proth Numbers

Abstract: We present an algorithm to decide the primality of Proth numbers, N=2^e t+1, without assuming any unproven hypothesis. The expected running time and the worst case running time of the algorithm are O ((t log t + log N)log N) and O ((t log t + log N) log^2 N) bit operations, respectively.

\section{Introduction}

A Proth number is a positive integer of the form
\begin{equation}\label{eqn-proth numbers}
N=2^e\cdot t+1
\qquad\text{for some odd }t\text{ with }2^e>t>0.
\end{equation}
In 1878,
a self-taught farmer,
Fran\c{c}ois Proth,
proved Theorem \ref{thm-Proth's} below.
As a consequence,
the primality of Proth numbers can be decided
by a simple, fast probabilistic primality test,
called Proth's test,
which randomly chooses an integer $a\not\equiv0\pmod{N}$
and then compute $b\equiv a^{(N-1)/2}\pmod{N}$.
If $b\equiv-1\pmod{N}$,
then $N$ is a prime by Theorem \ref{thm-Proth's}.
If $b^2\not\equiv 1\pmod{N}$,
then $N$ is composite by Fermat's Little Theorem.
However,
if $b\equiv 1\pmod{N}$,
the primality of $N$ remains unknown.
In the case that $b\equiv-1\pmod{N}$,
the choosen $a$ is a quaduatic nonresidue mod $N$.
Therefore,
when $N$ is prime,
Proth's test has $\frac{1}{2}$ probability being able to return $N$ prime.

\begin{theorem}[Proth's Theorem]\label{thm-Proth's}
Let $N$ be a Proth number defined in (\ref{eqn-proth numbers}).
If
\begin{equation}\label{eqn-proth}
a^{(N-1)/2}\equiv -1\pmod{N}
\end{equation}
for some $a$,
then $N$ is a prime.
\end{theorem}
See \cite{Williams1998} for a proof of Theorem \ref{thm-Proth's}.

\begin{theorem}\label{thm-primality}
Let $N$ be a Proth number defined in (\ref{eqn-proth numbers}).
There is a deterministic algorithm deciding the primality of $N$.
The expected running time and the worst case running time
of the algorithm
are
\[
\tilde{O}((t\log t+\log N)\log N)
\]
and
\[
\tilde{O}((t\log t+\log N)\log^2 N)
\]
bit operations,
respectively.
\end{theorem}

In this paper,
we prove Theorem \ref{thm-primality}
by showing Algorithm \ref{alg-randomized_primality}.
When $t$ is $O(\log N)$,
the expected running time and the worst case running time
are $\tilde{O}(\log^2 N)$
and $\tilde{O}(\log^3 N)$ bit operations,
respectively.
To the best of our knowledge,
Algorithm \ref{alg-randomized_primality} is the fastest
among all the known deterministic primality proving algorithms
which are applicable in this case.
The running time of AKS \cite{Agrawal2004}
and Lenstra-Pomerance's modified AKS algorithm \cite{Lenstra2009}
are $\tilde{O}(\log^{7.5} N)$ and $\tilde{O}(\log^6 N)$,
respectively.
Adleman-Pomerance-Rumely \cite{Adleman1983}
runs in sub-exponential time.
All the algorithms mentioned above have been proven unconditionally
to be deterministic.
With extra assumptions such as the Extended Riemann Hypothesis,
we have the following results:
The elliptic curve primality proving algorithm \cite{Atkin1993, Goldwasser1986}
runs in $\tilde{O}(\log^5N)$.
The running time of Miller's algorithm \cite{Miller1975} is
$\tilde{O}(\log^4N)$.
AKS can be improved \cite{Bernstein2003, MihailescuPreprint}
to $\tilde{O}(\log^4 N)$.
Proth's test becomes deterministic
and the running time is $\tilde{O}(\log^4 N)$
since it only has to check congruence equation (\ref{eqn-proth})
with $2\leq a\leq k$,
where $k$ is $O(\log^2 N)$
by the results from Ankeny \cite{Ankeny1952}.

We present the basic algorithm and the proof of it in
Section \ref{sect-Primality Proving} and Section \ref{sect-Square Root},
respectively.
In Section \ref{sect-randomized},
we improve the expected running time by randomization.
\section{Deterministic Primality Proving}\label{sect-Primality Proving}

Let $N>3$ be a Proth number defined in (\ref{eqn-proth numbers}).
We present a deterministic primality proving algorithm,
Algorithm \ref{alg-primality},
for this form of numbers in this section.
The correctness proof and the running time analysis
will be shown in the next section.

Denote a fixed square root of $x$ modulo $N$ by $\sqrt{x}\pmod{N}$.

\begin{algorithm}[Deterministic Primality Proving]\label{alg-primality}
The input is $N>3$, a Proth number defined in (\ref{eqn-proth numbers}).
This algorithm returns {\sf PRIME}\ if $N$ is a prime.
Otherwise, it returns {\sf COMPOSITE}.
\end{algorithm}
\begin{enumerate}
\item[I.]
Try finding $a_2=\sqrt{-1}\pmod{N}$ by Algorithm \ref{alg-sqrt(-1)}. \\
If Algorithm \ref{alg-sqrt(-1)} halts due to $N$ composite,
return {\sf COMPOSITE}.
\item[II.]
For each ($3\leq j \leq e$) \{ \\
\hspace*{1cm} Try computing $a_j=\sqrt{a_{j-1}}\pmod{N}$
by Algorithm \ref{alg-sqrt}. \\
\hspace*{1cm}
If Algorithm \ref{alg-sqrt} halts due to $N$ composite, \\
\hspace*{1cm}
return {\sf COMPOSITE}. \\
\}
\item[III.]
Return {\sf PRIME}.
\end{enumerate}

We discuss the first step below and the second step,
the crucial step of Algorithm \ref{alg-primality},
in the next section.

Step I can be computed as follows:
Suppose $N$ is a prime.
Let $H$ be the subgroup of ${\mathbb F}_N^\times$ with $2t$ elements,
where ${\mathbb F}_N^\times$ denotes the multiplicative group of
the finite field with $N$ elements.
For $1\leq i\leq 2t+1$,
there exists $i\not\in H$.
We have $i^{2t}\not\equiv1\pmod{N}$.
If $i^{2^kt}\equiv-1\pmod{N}$ for some $1\leq k\leq e-1$,
then $i^{2^{k-1}t}\equiv\sqrt{-1}\pmod{N}$.

Suppose $N$ is a prime or a composite number.
If $j^{2t}\equiv1\pmod{N}$ for all $1\leq j\leq 2t+1$,
we deduce that $N$ is composite
since there are $2t+1$ elements with order dividing $2t$.
For some $1\leq i\leq 2t+1$,
if $i^{2t}\not\equiv1\pmod{N}$
but $i^{2^kt}\not\equiv-1\pmod{N}$ for all $1\leq k\leq e-1$,
then either
\begin{enumerate}
\item[(1)]
$i^{2^et}\not\equiv1\pmod{N}$, or
\item[(2)]
$i^{2^kt}\not\equiv\pm1\pmod{N}$ and $i^{2^{k+1}t}\equiv1\pmod{N}$
for some $1\leq k\leq e-1$.
\end{enumerate}
In case (1),
$N$ is composite by Fermat's Little Theorem.
In case (2),
$\gcd(i^{2^kt}-1, N)$ is a non-trivial factor of $N$ and so $N$ is composite.

\begin{algorithm}[Computing $\sqrt{-1}\pmod{N}$]\label{alg-sqrt(-1)}
The input is $N=2^et+1$ for some integer $e>1$ and odd $t$.
If $N$ is a prime,
this algorithm returns $\sqrt{-1}\pmod{N}$.
Otherwise,
this algorithm either returns an integer congruent to $\sqrt{-1}\pmod{N}$
or halts due to $N$ composite.
\end{algorithm}
\renewcommand{\labelenumi}{I.\arabic{enumi}.}
\begin{enumerate}
\item
Compute $b_j=j^{2t}\pmod{N}$ for $1\leq j\leq 2t+1$.
\item
If $b_j\equiv1\pmod{N}$ for all $1\leq j\leq 2t+1$, \\
halt due to $N$ composite.
\item
Suppose $b_i\not\equiv1\pmod{N}$ for some $1\leq i\leq 2t+1$. \\
Compute $b_i^{2^k}\pmod{N}$ for $0\leq k\leq e-2$.
\item
If $b_i^{2^k}\not\equiv-1\pmod{N}$ for all $0\leq k\leq e-2$, \\
halt due to $N$ composite.
\item
Suppose $b_i^{2^{k_0}}\equiv-1\pmod{N}$ for some $0\leq k_0\leq e-2$. \\
Return $i^{2^{k_0}t}\pmod{N}$.
\end{enumerate}

Algorithm \ref{alg-sqrt(-1)} runs in
\[
\tilde{O}((t\log t+\log N)\log N)
\]
bit operations
since steps I.1, I.2 take $\tilde{O}(t\log t\log N)$ bit operations
and steps I.3, I.4, I.5 take $\tilde{O}(e\log N)=\tilde{O}(\log^2 N)$.
\section{Taking Square Roots}\label{sect-Square Root}

Given $\sqrt{-1}\pmod{N}$,
a square root of a fixed value,
we show how to compute the square roots of an arbitrary value
when $N$ is a prime.
For more details of computing square roots with this idea,
see \cite{stw_sqrt} and \cite{stw_phd}.

Suppose $N$ is a prime for the following.
Given a quadratic residue $\beta\pmod{N}$ with $1<\beta<N-1$,
we are going to find a square root of $\beta$ modulo $N$.
Suppose
\[
\beta\equiv\alpha^2\pmod N
\qquad\text{for some integer } \alpha.
\]
Define two sets $G_\alpha'$ and $G_\alpha$ as
\begin{eqnarray}
G_\alpha'&\DEF{=}& \SETR{\ELEMENT{a}}{a\not\equiv\pm\alpha\pmod{N}},\text{ and}\\
G_\alpha &\DEF{=}& G_\alpha'\cup\SET{\ELEMENT{\infty}}.
\end{eqnarray}
We denote the elements in $G_\alpha$ by $\ELEMENT{\,\cdot\,}$
for avoiding confusion with the elements in ${\cal Z}$,
where
\begin{eqnarray}\label{eqn-Z}
{\cal Z} &\DEF{=}& {\mathbb Z}\cup\SET{\infty},
\end{eqnarray}
where ${\mathbb Z}$ is the set of integers.
Two elements $\ELEMENT{a_1}, \ELEMENT{a_2}\inG_\alpha'$ are equal
if and only if $a_1\equiv a_2\pmod{N}$.
Therefore,
there are exactly $N-2$ and $N-1$ elements in $G_\alpha'$ and $G_\alpha$,
respectively.

Further,
define an operator $*$ as following:
For any $\ELEMENT{a}\inG_\alpha$
and any $\ELEMENT{a_1}, \ELEMENT{a_2}\inG_\alpha'$ with $a_1+a_2\not\equiv0\pmod{N}$,
\begin{eqnarray}
\label{eqn-a*infty}
\ELEMENT{a}*\ELEMENT{\infty}&=&\ELEMENT{\infty}*\ELEMENT{a}=\ELEMENT{a}, \\
\label{eqn-a*-a}
\ELEMENT{a_1}*\ELEMENT{-a_1}&=&\ELEMENT{\infty}, \\
\label{eqn-a_1*a_2}
\ELEMENT{a_1}*\ELEMENT{a_2}&=&\ELEMENT{(a_1a_2+\alpha^2)(a_1+a_2)^{-1}},
\end{eqnarray}
where $x^{-1}$ denotes the multiplicative inverse of $x\pmod{N}$
for integer $x$ with $\gcd(x,N)=1$.
Interestingly,
$(G_\alpha,*)$ is a well-defined group,
which is isomorphic to ${\mathbb F}_N^\times$.

\begin{proposition}\label{thm-G=F_N'}
When $N$ is prime,
$(G_\alpha,*)$ is isomorphic to ${\mathbb F}_N^\times$.
\end{proposition}
\begin{proof}
Define a bijective mapping
\begin{equation}\label{eqn-psi}
\psi:G_\alpha\longrightarrow{\mathbb F}_N^\times,
\qquad \ELEMENT{\infty}\longmapsto 1,
\qquad \ELEMENT{a}\longmapsto (a+\alpha)(a-\alpha)^{-1}
\end{equation}\label{eqn-psi^-1}
with inverse mapping
\begin{equation}
\psi^{-1}:{\mathbb F}_N^\times\longrightarrowG_\alpha,
\qquad 1\longmapsto \ELEMENT{\infty},
\qquad b\longmapsto \ELEMENT{\alpha(b+1)(b-1)^{-1}}.
\end{equation}
A straightforward calculation shows that $\psi$ is a homomorphism.
\end{proof}
In the rest of the paper,
we drop the symbol $*$
and denote the group operation of $G_\alpha$ by multiplication.
Algorithm \ref{alg-multiplication} below shows
how to perform the group operation.
In the algorithm,
the integer $N$ may be a prime or a composite number
since the algorithm is going to be used for deciding the primality of $N$.

\begin{algorithm}[Group Operation]\label{alg-multiplication}
The inputs are $N,\beta\in{\mathbb Z}$ and $a_1,a_2\in{\cal Z}$ such that
$0<\beta<N$
and either $a_i=\infty$ or $a_i^2\not\equiv\beta\pmod{N}$ for $i=1,2$.
If $N$ is a prime,
the input $\beta$ is guaranteed to be a quadratic residue modulo $N$
and this algorithm returns $a\in{\cal Z}$
such that $\ELEMENT{a}=\ELEMENT{a_1}\ELEMENT{a_2}\inG_\alpha$.
Otherwise,
this algorithm either returns some $a'\in{\cal Z}$
or halts due to $N$ composite.
\end{algorithm}
\renewcommand{\labelenumi}{\arabic{enumi}.}
\begin{enumerate}
\item If $a_1=\infty$, return $a_2$.
\item If $a_2=\infty$, return $a_1$.
\item If $a_1+a_2\equiv0\pmod{N}$, return $\infty$.
\item If $\gcd(a_1+a_2, N)\neq1$,
halt due to $N$ composite.
\item Compute $a\equiv(a_1a_2+\beta)(a_1+a_2)^{-1}\pmod{N}$.
\item
If $a^2\equiv\beta\pmod{N}$,
halt due to $N$ composite. \\
Otherwise,
return $a$.
\end{enumerate}

Algorithm \ref{alg-multiplication} basically follows
the group operation definitions
(\ref{eqn-a*infty}), (\ref{eqn-a*-a}) and (\ref{eqn-a_1*a_2}).
It also handles the case if $N$ is a composite number.
In such case,
$G_\alpha$ is no longer a well-defined group.
If the algorithm halts in Step 4,
a non-trivial factor of $N$ is discovered and so $N$ is a composite number.
If it halts in Step 6,
we have $(a_1a_2+\beta)^2\equiv\beta(a_1+a_2)^2\pmod{N}$,
which implies $(a_1^2-\beta)(a_2^2-\beta)\equiv0\pmod{N}$.
Since $a_i^2\not\equiv\beta\pmod{N}$ for $i=1,2$ by the assumption,
$a_1^2-\beta$ and $a_2^2-\beta$ are zero divisors,
which means that $N$ is composite.
Note that the value of $\alpha$ is not required
in Algorithm \ref{alg-multiplication}.

Equipped with $G_\alpha$ and Algorithm \ref{alg-multiplication},
we are ready to describe how to compute square roots modulo $N$,
which is the main ingredient of the Step II in Algorithm \ref{alg-primality}.
In Algorithm \ref{alg-sqrt} below,
the notation $\ELEMENT{x}^y$ means
using Algorithm \ref{alg-multiplication} and the successive squaring method
to compute $\ELEMENT{x}$ to the power $y$.
Algorithm \ref{alg-sqrt} halts due to $N$ composite
as soon as Algorithm \ref{alg-multiplication} does,
if it is the case.

\begin{algorithm}[Taking Square Root Modulo $N$]\label{alg-sqrt}
The inputs are integers $N$, $\beta$ and $b$
such that $1<\beta<N-1$ and $b^2\equiv-1\pmod{N}$,
where $N=2^et+1$ for some integer $e>1$ and odd $t$ as before.
If $N$ is a prime,
the input $\beta$ is guaranteed to be a quadratic residue modulo $N$
and this algorithm returns $\sqrt{\beta}\pmod{N}$.
If $N$ is a composite number,
this algorithm either returns an integer congruent to $\sqrt{\beta}\pmod{N}$
or halts due to $N$ composite.
\end{algorithm}
\renewcommand{\labelenumi}{II.\arabic{enumi}.}
\begin{enumerate}
\item
Check easy cases:
\begin{enumerate}
\item
If $\gcd(b+1,N)\neq 1$,
halt due to $N$ composite.
\item
If $j^2\equiv\beta\pmod{N}$ for some $1\leq j<2t$, return $j$.
\end{enumerate}
\item
Find $\ELEMENT{a}$ such that
$\ELEMENT{a}^2\neq\ELEMENT{\infty}$ and $\ELEMENT{a}^4=\ELEMENT{\infty}$
as below:
\begin{enumerate}
\item
Compute $\ELEMENT{c_j}=\ELEMENT{j}^{2t}$ for $1\leq j<2t$.
\item
If $\ELEMENT{c_j}=\ELEMENT{\infty}$ for all $1\leq j<2t$,
halt due to $N$ composite.
\item
Suppose $\ELEMENT{c_i}\neq\ELEMENT{\infty}$ for some $1\leq i<2t$. \\
Compute $\ELEMENT{c_i}^{2^k}$ for $0\leq k\leq e-2$.
\item
If $\ELEMENT{c_i}^{2^k}\neq\ELEMENT{0}$ for all $0\leq k\leq e-2$,
halt due to $N$ composite.
\item
Suppose $\ELEMENT{c_i}^{2^{k_0}}=\ELEMENT{0}$ for some $0\leq k_0\leq e-2$. \\
Compute $\ELEMENT{a}=\ELEMENT{i}^{2^{k_0}t}$.
\end{enumerate}
\item
Compute $\alpha$:
\begin{enumerate}
\item
Compute $\alpha\equiv a(b-1)(b+1)^{-1}\pmod{N}$.
\item
If $\alpha^2\not\equiv\beta\pmod{N}$,
halt due to $N$ composite. \\
Otherwise,
return $\alpha$.
\end{enumerate}
\end{enumerate}

\begin{proposition}
Algorithm \ref{alg-sqrt} is correct.
\end{proposition}
\begin{proof}
Step II.1 checks two easy cases.
Step II.1.(a) checks whether the inverse of $b+1\pmod{N}$ exists.
Let $d=\gcd(b+1,N)$.
We have $d\neq N$
since $b^2\equiv-1\pmod{N}$.
If $d\neq 1$,
then $d$ is a non-trivial factor of $N$.
In Step II.1.(b),
if $j$ is a square root of $\beta$ modulo $N$ for some $1\leq j<2t$,
we are done.

Step II.2 is similar to Algorithm \ref{alg-sqrt(-1)}.
If $N$ is a prime,
both of them compute an order 4 element:
Algorithm \ref{alg-sqrt(-1)} computes a square root of $-1\pmod{N}$,
an order $4$ element in ${\mathbb F}_N^\times$,
while an order $4$ element $\ELEMENT{a}$ in $G_\alpha$ is computed in Step II.2.
Note that $G_\alpha$ is isomorphic to ${\mathbb F}_N^\times$ as shown
in Proposition \ref{thm-G=F_N'}.
The identity and the order 2 element in $G_\alpha$
are $\ELEMENT{\infty}$ and $\ELEMENT{0}$,
respectively.

Suppose $N$ is a prime.
Denote the $2t$-torsion subgroup of $G_\alpha$ by $H_\alpha$.
The size of $H_\alpha$ is $2t$ since $G_\alpha$ is cyclic.
If $\ELEMENT{c_j}=\ELEMENT{j}^{2t}=\ELEMENT{\infty}$ for all $1\leq j<2t$,
all the $2t+1$ elements in the set
$\SET{\ELEMENT{\infty},\ELEMENT{0},\ELEMENT{1},\cdots,\ELEMENT{2t-1}}$
have order dividing $2t$ in $G_\alpha$,
which leads to a contradiction.
Suppose $\ELEMENT{c_i}\neq\ELEMENT{\infty}$ for some $1\leq i<2t$.
In Step II.2.(d),
if $\ELEMENT{c_i}^{2^k}\neq\ELEMENT{0}$ for all $0\leq k\leq e-2$,
then $\ELEMENT{i}^{2^{e-1}t}\neq\ELEMENT{0}$,
which implies $\ELEMENT{i}^{|G_\alpha|}\neq\ELEMENT{\infty}$,
a contradiction.
Therefore,
if the algorithm halts at Step II.2.(b) or Step II.2.(d),
then $N$ is composite.
The order of the element $\ELEMENT{a}\inG_\alpha$ computed in Step II.2.(e)
is exactly $4$
since $\ELEMENT{a}^2=\ELEMENT{0}\neq\ELEMENT{\infty}$
and $\ELEMENT{a}^4=\ELEMENT{\infty}$.
In ${\mathbb F}_N^\times$,
the only order 4 elements are $\pm b$.
By Proposition \ref{thm-G=F_N'},
we have $\psi(\ELEMENT{a})\equiv\pm b\pmod{N}$.
In Step II.3,
the integer $\alpha\equiv a(b-1)(b+1)^{-1}\pmod{N}$
is a square root of $\beta$
by the construction of $G_\alpha$.
If $\alpha^2\not\equiv\beta\pmod{N}$,
it means that $N$ is a composite number.

The Proposition follows.
\end{proof}

\begin{proposition}
Algorithm \ref{alg-sqrt} runs in
\[
\tilde{O}((t\log t+\log N)\log N)
\]
bit operations.
\end{proposition}
\begin{proof}
All the powers $\ELEMENT{x}^y$
are computed by Algorithm \ref{alg-multiplication}
and the successive squaring method,
which take $\tilde{O}(\log y\log N)$ bit operations.

Step II.1 takes $\tilde{O}(t\log N)$ bit operations.
In Step II.2,
the running time of parts (a) and (b) together is
$\tilde{O}(t\log t\log N)$,
parts (c) and (d) together take
$\tilde{O}(e\log N)=\tilde{O}(\log^2 N)$ bit operations,
and part (e) takes $\tilde{O}(\log^2 N)$ bit operations.
Therefore,
Step II.2 takes $\tilde{O}((t\log t+\log N)\log N)$ bit operations in total.
Step II.3 only takes $\tilde{O}(\log N)$ bit operations.

The Proposition follows.
\end{proof}

Finally,
we show the following propositions.

\begin{proposition}
Algorithm \ref{alg-primality} is correct.
\end{proposition}
\begin{proof}
If either Step I or Step II in Algorithm \ref{alg-primality} returns {\sf COMPOSITE},
the input $N$ must be {\sf COMPOSITE}\
by Algorithm \ref{alg-sqrt(-1)} and Algorithm \ref{alg-sqrt},
respectively.
Note that if $N$ is a prime,
the integer $a_{j-1}$ in Step II is a quadratic residue modulo $N$
for all $3\leq j\leq e$.

Otherwise,
Step III returns {\sf PRIME}.
In this case,
$N$ is indeed a prime by Theorem \ref{thm-Proth's} with $a=a_e$,
where $a_e$ is computed in Step II.

The Proposition follows.
\end{proof}

\begin{proposition}
Algorithm \ref{alg-primality} runs in
\[
\tilde{O}((t\log t+\log N)\log^2 N)
\]
bit operations.
\end{proposition}
\begin{proof}
Step I takes $\tilde{O}((t\log t+\log N)\log N)$
bit operations
by Algorithm \ref{alg-sqrt(-1)}.
By Algorithm \ref{alg-sqrt},
Step II takes
$\tilde{O}(e(t\log t+\log N)\log N)=\tilde{O}((t\log t+\log N)\log^2 N)$
bit operations.
Step III can be done in $\tilde{O}(\log N)$ bit operations.
The Proposition follows.
\end{proof}
\section{Randomization}\label{sect-randomized}

Algorithm \ref{alg-primality} first tries computing
$a_2\equiv\sqrt{-1}\pmod{N}$,
and then it repeatedly takes square roots to obtain
$a_3$, $a_4$, $\cdots$, $a_e$
such that $a_j\equiv\sqrt{a_{j-1}}\pmod{N}$ for $3\leq j\leq e$.
If $N$ is a prime,
all the computations success
and it ends up with $a_e$,
a quadratic nonresidue modulo $N$.
It totally takes $e-1=O(\log N)$ square roots,
which dominates the running time of the entire algorithm.
In this section,
we improve Algorithm \ref{alg-primality}
by repeatedly taking square roots on a randomly chosen integer,
instead of  the fixed integer $-1$.
We first randomly choose an integer $a$.
Then,
we compute $\sqrt{a}\pmod{N}$, $\sqrt{\sqrt{a}}\pmod{N}$
and so on.
If $N$ is a prime,
this process ends up with a quadratic nonresidue modulo $N$.

For prime $N=2^et+1$,
the multiplicative group ${\mathbb F}_N^\times$ being cyclic tells that
most of elements in ${\mathbb F}_N^\times$ have order with large 2-part.
Only a few number of square root computations are required
in order to obtain a quadratic nonresidue from these elements.
In fact,
there are half of the total number of elements in ${\mathbb F}_N^\times$
are quadratic nonresidues modulo $N$.
The order of a quadratic nonresidue is divisible by $2^e$.
In general,
for $1\leq k\leq e$,
there are exactly $2^{k-1}t$ elements having order divisible by $2^k$
but not $2^{k+1}$.
Only $e-k$ square root computations are required
for obtaining a quadratic nonresidue
from these $2^{k-1}t$ elements.
The randomized algorithm is presented below.

\begin{algorithm}[Randomized Deterministic Primality Proving]\label{alg-randomized_primality}
The input is $N>3$, a Proth number defined in (\ref{eqn-proth numbers}).
This algorithm returns {\sf PRIME}\ if $N$ is a prime.
Otherwise, it returns {\sf COMPOSITE}.
\end{algorithm}
\renewcommand{\labelenumi}{(\roman{enumi})}
\begin{enumerate}
\item
Find $b_k$ such that the order $b_k\pmod{N}$ is $2^k$
for $k\geq 2$ as below:
\begin{enumerate}
\item
Randomly choose an integer $1<a<N-1$ \\
until $a^{2t}\not\equiv 1\pmod{N}$. \\
If there are $2t-1$ distinct integers $1<a<N-1$ \\
such that $a^{2t}\equiv 1\pmod{N}$, return {\sf COMPOSITE}.
\item
Compute $a_0\equiv a^t\pmod{N}$. \\
If $a_0^{2^e}\not\equiv 1\pmod{N}$, return {\sf COMPOSITE}.
\item
Find the least $k\geq 2$ such that $a_0^{2^k}\equiv 1\pmod{N}$. \\
If $a_0^{2^{k-1}}\not\equiv -1\pmod{N}$, return {\sf COMPOSITE}.
\item
Set $b_2\equiv a_0^{2^{k-2}}\pmod{N}$. \\
Set $b_k=a_0$.
\end{enumerate}
\item
For each ($k+1\leq j \leq e$) \{ \\
\hspace*{1cm} Try computing $b_j=\sqrt{b_{j-1}}\pmod{N}$
by Algorithm \ref{alg-sqrt}. \\
\hspace*{1cm}
If Algorithm \ref{alg-sqrt} halts due to $N$ composite, \\
\hspace*{1cm}
return {\sf COMPOSITE}. \\
\}
\item
Return {\sf PRIME}.
\end{enumerate}

\begin{proposition}\label{prop-randomized_primality correctness}
Algorithm \ref{alg-randomized_primality} is correct.
\end{proposition}
\begin{proof}
In Step (i)(a),
we randomly choose an integer $a$ from the open interval $(1,N-1)$
without replacement
until $a^{2t}\not\equiv 1\pmod{N}$.
If there are $2t-1$ distinct integers $a$ in $(1,N-1)$
such that $a^{2t}\equiv 1\pmod{N}$,
then these $2t-1$ distinct integers together with $1$ and $N-1$
are totally $2t+1$ distinct integers with order modulo $N$ dividing $2t$.
Therefore,
$N$ is composite.
In Step (i)(b),
if $a_0^{2^e}\equiv a^{N-1}\not\equiv 1\pmod{N}$,
then $N$ is composite by Fermat's Little Theorem.
In Step (i)(c),
the least positive integer $k$ with $a_0^{2^k}\equiv 1\pmod{N}$ exists
since $a_0^{2^e}\equiv 1\pmod{N}$.
We also have $k\geq 2$ because $a^{2t}\not\equiv 1\pmod{N}$ by Step (i)(a).
If $a_0^{2^{k-1}}\not\equiv -1\pmod{N}$,
then $\gcd(a_0^{2^{k-1}}-1,N)$ is a non-trivial factor of $N$,
and so $N$ is composite.
If Step (i)(a), (i)(b) and (i)(c) do not return {\sf COMPOSITE},
we end up in Step (i)(d) that
$b_2\equiv a_0^{2^{k-2}}\equiv\pm\sqrt{-1}\pmod{N}$
and $b_k=a_0$ with $b_k^{2^{k-1}}\equiv-1\pmod{N}$.
Note that $b_2$ is required
as an input of Algorithm \ref{alg-sqrt} used in Step (ii).
We will show that the value of $k$ is large with high probability
later in the section.

Step (ii) and (iii) are similar to the Step II and III
in Algorithm \ref{alg-primality}
except that Step (ii) begins taking square roots with $b_k$.
If Algorithm \ref{alg-sqrt} does not halt due to $N$ composite,
the invariant $b_j^{2^{j-1}}\equiv-1\pmod{N}$ is maintained in the loop
for $k\leq j\leq e$.
If $b_e$ is obtained,
$N$ is a prime by Theorem \ref{thm-Proth's} with $a=b_e$.

The Proposition follows.
\end{proof}

\begin{proposition}\label{prop-randomized_primality running time}
The expected running time and the worst case running time
of Algorithm \ref{alg-randomized_primality}
are
\[
\tilde{O}((t\log t+\log N)\log N)
\]
and
\[
\tilde{O}((t\log t+\log N)\log^2 N)
\]
bit operations,
respectively.
\end{proposition}
\begin{proof}
Step (i)(a) requires $\tilde{O}(t\log t\log N)$ bit operations.
Steps (i)(b), (i)(c) and (i)(d) together take $\tilde{O}(\log^2 N)$
bit operations.
The running time of Step (ii) is
$\tilde{O}(m(t\log t+\log N)\log N)$ bit operations,
where $m$ is an upper bound of the number of iterations in the loop.
Step (iii) can be done in $\tilde{O}(\log N)$ bit operations.
The entire algorithm is dominated by Step (ii).
The total running time is
$\tilde{O}(m(t\log t+\log N)\log N)$ bit operations.

The value of $m$ depends on the integer $a$ chosen in Step (i)(a).
It is easy to see that the worst case is $m=O(\log N)$.
We will show that the expected value of $m$ is less than 1
in Lemma \ref{lem-E(m)=O(1)}.
The Proposition follows.
\end{proof}

Let $v_2(x)$ be the 2-adic valuation function.
For positive integer $x=2^rs$ with $s$ odd,
we have $v_2(x)=r$,
which is the exponent of the 2-part of $x$.
Let $\ORD_p(a)$ be the order of $a\pmod{p}$
for prime $p$ and $a\not\equiv 0\pmod{p}$.
We show in Lemma \ref{lem-E(v_2(ord_p a))} below that
the expected value of $v_2(\ORD_p a)$
for a random integer $a$ is bounded below by $v_2(p-1)-1$.

\begin{lemma}\label{lem-E(v_2(ord_p a))}
Let $p=2^{e'}t'+1$ be an odd prime for some odd $t'$ and $e'\geq 1$.
Let $a$ be an integer randomly chosen from the open interval $(1,p-1)$
such that $a^{2d}\not\equiv 1\pmod{p}$
for some positive divisor $d$ of $t'$.
Then the expected value
\begin{equation*}
E(v_2(\ORD_p a))>e'-1.
\end{equation*}
\end{lemma}
\begin{proof}
By counting the number of integers $a\in(1,p-1)$ such that $v_2(\ORD_p a)=i$
for $i=0,1,\cdots,e'$,
we have
\begin{eqnarray*}
\sum_{\substack{1<a<p-1 \\ a^{2d}\not\equiv 1\pmod{p}}}v_2(\ORD_p a)
&=&  0\cdot (t'-d) + 1\cdot (t'-d) + \sum_{i=2}^{e'}i\cdot 2^{i-1}t' \\
&=& (e'-1)(p-1)+t'-d.
\end{eqnarray*}
Then, the expected value is
\begin{eqnarray*}
E(v_2(\ORD_p a))
&=& e'-1+\frac{2d(e'-1)+t'-d}{p-1-2d} \\
&>& e'-1.
\end{eqnarray*}
The Lemma follows.
\end{proof}

\begin{lemma}\label{lem-E(m)=O(1)}
\[
E(m)<1.
\]
\end{lemma}
\begin{proof}
Suppose $N$ is a prime.
Recall that $a$ is a randomly chosen integer in Step (i)(a)
such that $a^{2t}\not\equiv1\pmod{N}$
and $k=v_2(\ORD_N a)$.
By Lemma \ref{lem-E(v_2(ord_p a))} with $d=t$,
we have $E(k) = E(v_2(\ORD_N a)) > e-1$.
Therefore,
\[
E(m)=E(e-k)<1.
\]

Suppose $N$ is composite.
Let $p$ be a prime divisor of $N$
such that $v_2(p-1)$ is the minimum among all the prime divisors of $N$.
Write $p=2^{e'}t'+1$.
Clearly,
we have $e'\leq e$.
If the algorithm does not discover $N$ composite in Step (i),
the maximum number of iterations is bounded above by $e'$,
i.e.\ $m\leq e'$.
Let $a$ be the integer chosen in Step (i)(a).
If $p$ divides $a$,
then Step (i)(b) will return {\sf COMPOSITE}\
since $a_0^{2^e}\equiv a^{2^et}\not\equiv 1\pmod{N}$ .
Suppose $p$ does not divide $a$.
By Lemma \ref{lem-E(v_2(ord_p a))} with $d=\gcd(t,t')$,
we have $E(v_2(\ORD_p a)) > e'-1$.
Finally,
\[
E(m)\leq E(e'-v_2(\ORD_p a))<1.
\]

The Lemma follows.
\end{proof}

\begin{proof}[Proof of Theorem \ref{thm-primality}]
It follows from Proposition \ref{prop-randomized_primality correctness}
and \ref{prop-randomized_primality running time}.
\end{proof}
\bibliographystyle{plain}
\bibstyle{plain}