\subsection{Analytical solution}
Will not work because of how \eqref{line} is defined. It would have to be the line between the two points that is on the spherical surface.
\begin{equation}
    g(s)=K(f(s))
\end{equation}
\begin{equation}
    g'(s) = \underbrace{K'(f(s))}_{\text{3$\times$2 Matrix}}\cdot\underbrace{f'(s)}_{\text{2$\times$1 Vector}}=\text{3$\times$1 Vector}
\end{equation}
\begin{equation}
    g'(a,b,s) = K'(f(a,b,s))\cdot f'(a,b,s)
\end{equation}
\begin{equation}
    g'(\theta_1,\varphi_1,\theta_2,\varphi_2,s)
\end{equation}
\begin{equation}
    K'(f(s))=K'
    \begin{pmatrix}
        (1-s)\cdot\theta_1 + s\cdot\theta_2 \\
        (1-s)\cdot\varphi_1 + s\cdot\varphi_2
    \end{pmatrix}
\end{equation}
given:
\begin{equation*}
    A\dbinom{\theta_1}{\varphi_1}, B\dbinom{\theta_2}{\varphi_2}, C\dbinom{\theta_3}{\varphi_3}
\end{equation*}
\begin{equation}
    \cos(\alpha)=\frac{\langle g'(A,B,0), g'(A,C,0)\rangle}{\|g'(A,B,0))\|\cdot \|g'(A,C,0)\|}
\end{equation}
\begin{equation}
    \cos(\beta)=\frac{\langle g'(B,A,0), g'(B,C,0)\rangle}{\|g'(B,A,0))\|\cdot \|g'(B,C,0)\|}
\end{equation}
\begin{equation}
    \cos(\gamma)=\frac{\langle g'(C,A,0), g'(C,B,0)\rangle}{\|g'(C,A,0))\|\cdot \|g'(C,B,0)\|}
\end{equation}
\begin{lstlisting}[escapechar=@]
    def f(a, b, s) {
        res[0] = (1-s)@$\cdot$@a[0] + s@$\cdot$@b[0]
        res[1] = (1-s)@$\cdot$@a[1] + s@$\cdot$@b[1]
        return res
    }
\end{lstlisting}
Parameters tp representing $\theta\varphi$
\begin{lstlisting}[escapechar=@]
    def k'(tp) {
        res[0, 0] = cos(tp[0])@$\cdot$@cos(tp[1])
        res[1, 0] = cos(tp[0])@$\cdot$@sin(tp[1])
        res[2, 0] = -sin(tp[0])
        res[0, 1] = -sin(tp[0])@$\cdot$@sin(tp[1])
        res[1, 1] = sin(tp[0])@$\cdot$@cos(tp[1])
        return res
    }
\end{lstlisting}
\begin{lstlisting}[escapechar=@]
    def f'(a, b) {
        res[0] = b[0] - a[0]
        res[1] = b[1] - a[1]
        retrun res
    }
\end{lstlisting}
Use $f(a, b, s)$ as tp in $k'(tp)$ and multiply resulting matrix with vector $f'(a, b)$. Resulting in an 3$\times$1 Vector.
\begin{equation*}
    \begin{pmatrix}
        a && b \\
        c && d \\
        e && f
    \end{pmatrix}
    \cdot
    \begin{pmatrix}
        u \\
        v
    \end{pmatrix}
    =
    \begin{pmatrix}
        a\cdot u + b\cdot v \\
        c\cdot u + d\cdot v \\
        e\cdot u + f\cdot v
    \end{pmatrix}
\end{equation*}
\begin{lstlisting}[escapechar=@]
    def g'(a, b, s) {
        res[0] = (cos((1-s)@$\cdot$@a[0] + s@$\cdot$@b[0])@$\cdot$@
            cos((1-s)@$\cdot$@a[1] + s@$\cdot$@b[1]))@$\cdot$@(b[0] - a[0]) +
            (-sin((1-s)@$\cdot$@a[0] + s@$\cdot$@b[0])@$\cdot$@
            sin((1-s)@$\cdot$@a[1] + s@$\cdot$@b[1]))@$\cdot$@(b[1] - a[1])
        res[1] = (cos((1-s)@$\cdot$@a[0] + s@$\cdot$@b[0])@$\cdot$@
            sin((1-s)@$\cdot$@a[1] + s@$\cdot$@b[1]))@$\cdot$@(b[0] - a[0]) +
            (sin((1-s)@$\cdot$@a[0] + s@$\cdot$@b[0]))@$\cdot$@
            cos((1-s)@$\cdot$@a[1] + s@$\cdot$@b[1]))@$\cdot$@(b[1] - a[1])
        res[2] = (-sin((1-s)@$\cdot$@a[0] + s@$\cdot$@b[0]))@$\cdot$@
            (b[0] - a[0])
        return res
    }
\end{lstlisting}
For $s$ being $0$:
\begin{lstlisting}[escapechar=@]
    def g'(a, b) {
        res[0] = cos(a[0])@$\cdot$@cos(a[1])@$\cdot$@(b[0] - a[0]) -
            sin(a[0])@$\cdot$@sin(a[1])@$\cdot$@(b[1] - a[1])
        res[1] = cos(a[0])@$\cdot$@sin(a[1])@$\cdot$@(b[0] - a[0]) +
            sin(a[0])@$\cdot$@cos(a[1])@$\cdot$@(b[1] - a[1])
        res[2] = -sin(a[0])@$\cdot$@(b[0] - a[0])
        return res
}
\end{lstlisting}


\section{The Euler-Lagrange Equation}
\subsection{Derivation of the Equation}
We now move on to the most important theorem of the course, which gives a necessary condition to extremise a functional in the form
$$F[y]=\int_\alpha^\beta f(x,y,y^\prime)\,\mathrm dx$$
where $f$ is given.
In contexts of geometry and physics, $y$ is most likely to carry the meaning of the trajectory of some point.\\
We first assume that a extremum $y$ exists, then when we apply a small perturbation $y\mapsto y+\epsilon\eta$ with $\eta(\alpha)=\eta(\beta)=0$ to keep the endpoint fixed.
Now we want to compute $F[y+\epsilon\eta]$, but first of all we will need a lemma.
\begin{lemma}\label{fund_lemma}
    If $g:[\alpha,\beta]\to\mathbb R$ is continuous on $[\alpha,\beta]$ and
    $$\int_\alpha^\beta g(x)\eta(x)\,\mathrm dx=0$$
    for all $\eta\in C([\alpha,\beta])$ with $\eta(\alpha)=\eta(\beta)=0$, then $\forall x\in [\alpha,\beta],g(x)=0$.
\end{lemma}
\begin{proof}
    Assume for sake of contradiction that there exists some $\bar{x}$ on $(\alpha,\beta)$ such that $g(\bar{x})\neq 0$.
    WLOG $g(\bar{x})>0$, then by continuity there is an interval $[x_1,x_2]\subset[\alpha,\beta]$ such that $\exists c>0,\forall x\in [x_1,x_2],g(x)>c$.
    Set
    $$\eta(x)=\begin{cases}
        (x-x_1)(x_2-x)\text{, if $x\in [x_1,x_2]$}\\
        0\text{, otherwise}
    \end{cases}$$
    Then
    \begin{align*}
        \int_\alpha^\beta g(x)\eta(x)\,\mathrm dx
        &=\int_{x_1}^{x_2}g(x)(x-x_1)(x_2-x)\,\mathrm dx\\
        &\ge\int_{x_1}^{x_2}c(x-x_1)(x_2-x)\,\mathrm dx\\
        &>0
    \end{align*}
    Contradiction.
    So $g$ is zero on $(\alpha,\beta)$, and it is also zero at $\alpha,\beta$ by continuity, hence $g$ is zero on $[\alpha,\beta]$.
\end{proof}
The $\eta$ we have used above is called a bump function, which is $C^2$ as one can verify.
One can also make a $C^k$ bump function by considering
\footnote{It is also easy to construct a $C^{\infty}$ bump function.}
$$\eta(x)=\begin{cases}
    ((x-x_1)(x_2-x))^{k+1}\text{, if $x\in [x_1,x_2]$}\\
    0\text{, otherwise}
\end{cases}$$
Now back at $F[y+\epsilon\eta]$, then
\begin{align*}
    F[y+\epsilon\eta]&=\int_\alpha^\beta f(x,y+\epsilon\eta,y^\prime+\epsilon\eta^\prime)\,\mathrm dz\\
    &=F[y]+\epsilon\int_\alpha^\beta\left( \frac{\partial f}{\partial y}\eta+\frac{\partial f}{\partial y^\prime}\eta^\prime \right)\,\mathrm dx+O(\epsilon^2)
\end{align*}
We will analysis the $O(\epsilon^2)$ remainder later.
For now, we just observe that for $y$ to be an extremum, the first-order term shall vanish, so we want something like $\partial F[y+\epsilon\eta]/\partial\epsilon=0$.\\
Integrate the vanishing first-order coefficient by part,
\begin{align*}
    0&=\left.\frac{\partial f}{\partial y^\prime}\eta\right|_\alpha^\beta+\int_\alpha^\beta\left( \frac{\partial f}{\partial y}\eta-\frac{\mathrm d}{\mathrm dx}\frac{\partial f}{\partial y^\prime}\eta \right)\,\mathrm dx\\
    &=\int_\alpha^\beta\left( \frac{\partial f}{\partial y}-\frac{\mathrm d}{\mathrm dx}\frac{\partial f}{\partial y^\prime} \right)\eta\,\mathrm dx
\end{align*}
By the preceding lemma, we must have
$$\frac{\partial f}{\partial y}-\frac{\mathrm d}{\mathrm dx}\frac{\partial f}{\partial y^\prime}=0$$
This is known as the Euler-Lagrange equation, which is the necessary condition for an extremum.
This equation is first developed in 1745 in a letter from Lagrange to Euler.
\begin{remark}
    1. The Euler-Lagrange equation is a second-order ODE with initial conditions $y(\alpha)=y_1,y(\beta)=y_2$.\\
    2. Sometimes the LHS is denoted $\delta F[y]/\delta y(x)$ and is called the functional derivative.
    Some author also write $\epsilon\eta=\delta y$, allowing one to write $F[y+\delta y]=F[y]+\delta F[y]$ where
    $$\delta F[y]=\int_\alpha^\beta\frac{\delta F[y]}{\delta y(x)}\delta y(x)\,\mathrm dx$$
    3. Other kinds of boundary conditions (e.g. those on $y^\prime$) are possible.\\
    4. Be careful with derivatives as the notation can be a bit confusing.
    The $x,y,y^\prime$ are independent variables when we are talking about partial derivatives of $f(x,y,y^\prime)$.\\
    5. For any $h(x,y,y^\prime)$, a somewhat useful formula is
    $$\frac{\mathrm dh(x,y(x),y^\prime(x))}{\,\mathrm dx}=\frac{\partial h}{\partial x}+\frac{\partial h}{\partial y}y^\prime+\frac{\partial h}{\partial y^\prime}y^{\prime\prime}$$
    For example, for $f(x,y,y^\prime)=x((y^\prime)^2-y^2)$, we have $\mathrm df/\mathrm dx=(y^\prime)^2-y^2-2xyy^\prime+2y^{\prime\prime}y^\prime x$.
\end{remark}
\subsection{First Integrals of the Euler-Lagrange Equation}
Now we move on to solve the Euler-Lagrange equations, which is a second order ODE.
In some special cases, this is a quite easy thing to do.
In particular, if $f$ does not explicitly depend on some of its variables, then we can simplify the equation to something that is easier to solve.
These simplifications are often in the form of something being constant.
Expressions like these are called the first integrals of the equations.
Not only are they tools we can use to solve the equation, we can also view them as a conserved quantity of something that is described by a variational problem.
We will discuss the former in this section.
The latter will be mentioned later, when we discuss Noether's Theorem.\\
Assume that $f$ does not explicitly depend on $y$, then $\partial f/\partial y=0$, so the Euler-Lagrange equation can be rewritten as
$$\frac{\mathrm d}{\mathrm dx}\frac{\partial f}{\partial y^\prime}=0\implies \frac{\partial f}{\partial y^\prime}=\text{const.}$$
which is a first order ODE.
\begin{example}[Geodesics on the Plane]
    Consider the geodesics on the Euclidean plane.
    We know that we want to extremise the functional
    $$F[y]=\int_\alpha^\beta\sqrt{1+(y^\prime)^2}\,\mathrm dx$$
    In this case, the apparent $f$ does not depend on $y$, hence we can obtain the solution by just solving the first integral
    $$\frac{y^\prime}{\sqrt{1+(y^\prime)^2}}=\text{const.}$$
    One can solve this to get $y=mx+c$ for some constants $m,c$, which is our familiar formulation of a straight line, the geodesics of the plane.
\end{example}
\begin{example}[Geodesics on a Sphere]
    Consider the two-dimensional unit sphere $S^2$ in $\mathbb R^3$.
    Use the spherical polar coordinates
    $$x=\sin\theta\sin\phi,y=\sin\theta\cos\phi,z=\cos\theta,\theta\in [0,2\pi),\theta\in[0,\pi)$$
    The line element on $S^2$ inherited from $\mathbb R^3$ then gives
    $$\mathrm ds^2=\mathrm dx^2+\mathrm dy^2+\mathrm dz^2=\mathrm d\theta^2+\sin^2\theta\,\mathrm d\phi^2$$
    A path restricted on the sphere can then be parameterized in terms of $\theta,\phi$.
    Suppose we parameterize the curve by $\phi(\theta)$, then the length functional is
    $$F[\phi]=\int_{\theta_1}^{\theta_2}\sqrt{1+(\phi^\prime)^2\sin^2\theta}\,\mathrm d\theta$$
    We observe that the integral inside does not depend on $\phi$, so we can rewrite the equation to
    $$\frac{\phi^\prime\sin^2\theta}{\sqrt{1+(\phi^\prime)^2\sin^2\theta}}=\frac{\partial f}{\partial \phi^\prime}=\text{const.}=K$$
    Seperating the variables yields
    $$(\phi^\prime)^2=\frac{K^2}{\sin^2\theta(\sin^2\theta-K^2)}\implies\phi=\pm\int\frac{K\,\mathrm d\theta}{\sin\theta\sqrt{\sin^2\theta-K^2}}$$
    which shall produce two solutions, each going one way round.
    To evaluate the integral, we do the substitution $u=\cot\theta$ which produces
    $$\pm\frac{\sqrt{1-K^2}}{K}\cos(\phi-\phi_0)=\cot\theta$$
    for a constant $\phi_0$.
    By considering the geometrical meaning of this equation, it then follows that $\phi(\theta)$ describes a great circle, i.e. a circle in $\mathbb R^3$ which exists as the intersection of $S^2$ and a plane that goes through the origin.
\end{example}
Now, consider for general case of $f(x,y,y^\prime)$, we have
\begin{align*}
    \frac{\mathrm d}{\mathrm dx}\left( f-y^\prime\frac{\partial f}{\partial y^\prime} \right)&=\frac{\partial f}{\partial x}+\frac{\partial f}{\partial y}y^\prime+\frac{\partial f}{\partial y^\prime}y^{\prime\prime}-y^\prime\frac{\mathrm d}{\mathrm dx}\frac{\partial f}{\partial y^\prime}-y^{\prime\prime}\frac{\partial f}{\partial y^\prime}\\
    &=y^\prime\left( \frac{\partial f}{\partial y}-\frac{\mathrm d}{\mathrm dx}\frac{\partial f}{\partial y^\prime} \right)+\frac{\partial f}{\partial x}
    &=\frac{\partial f}{\partial x}
\end{align*}
If $y$ satisfies the Euler-Lagrange Equation.
So if $f$ does not depend explicitly on $x$, then the above indicates that
$$f-y^\prime\frac{\partial f}{\partial y^\prime}=\text{const.}$$
\begin{example}[The Brachistochrone Problem]
    Consider the functional in the Brachistochrone Problem we defined before, with the initial point assumed to be the origin:
    $$F[y]=\frac{1}{\sqrt{2g}}\int_0^\beta\frac{\sqrt{1+(y^\prime)^2}}{\sqrt{-y}}\,\mathrm dx$$
    As $f$ in this case does not depend explicitly on $x$, we know that
    $$\frac{\sqrt{1+(y^\prime)^2}}{\sqrt{-y}}-y^\prime\frac{y^\prime}{\sqrt{1+(y^\prime)^2}\sqrt{-y}}=\text{const.}=K$$
    So
    $$y^\prime=\pm\frac{\sqrt{1+K^2y}}{K\sqrt{-y}}\implies x=\pm K\int\frac{\sqrt{-y}}{\sqrt{1+K^2y}}\,\mathrm dy$$
    Set $y=-K^{-2}\sin^2(\theta/2)$, so $\mathrm dy=-K^{-2}\sin(\theta/2)\cos(\theta/2)$, so
    \begin{align*}
        x&=\pm K\int(-1)\frac{1}{K^3}\frac{\sin^2(\theta/2)\cos(\theta/2)}{\sqrt{1-\sin^2(\theta/2)}}\,\mathrm d\theta\\
        &=\mp\frac{1}{2K^2}\int(1-\cos\theta)\,\mathrm d\theta\\
        &=\mp\frac{1}{2K^2}(\theta-\sin\theta)+C
    \end{align*}
    where $C$ is a constant.
    By our initial condition, $\theta(0)=0$, so $C=0$.
    Substitute $\theta$ for both $x,y$ and we get the parameterised equations
    $$\begin{cases}
        x=(\theta-\sin\theta)/(2K^2)\\
        y=-K^{-2}\sin^2(\theta/2)
    \end{cases}$$
    which is the equation of a cycloid, i.e. the path traversed by a fixed point on a wheel which rolls on the $x$-axis.
    Hence, the Brachistochrone is a cycloid.
\end{example}
\subsection{Fermat's Principle}
Fermat's Principle postulates that light (or sound) travels along paths between two points that are stationary points of the time variation.
\footnote{In its original form, however, it said that light travels the path that requires the least time, which is not necessarily true in all cases.}
Suppose the light way is described by $y=y(x)$, then the time functional is
$$F[y]=\int\frac{\mathrm dl}{c}=\int_\alpha^\beta\frac{\sqrt{1+(y^\prime)^2}}{c(x,y)}\,\mathrm dx$$
where $c$ is the speed of light in the medium.\\
First assume that $c=c(x)$ does not depend on $y$, then $f$ does not explicitly depend on $y$, in which case we have the first integral
$$\frac{y^\prime}{\sqrt{1+(y^\prime)^2}c(x)}=\frac{\partial f}{\partial y^\prime}=\text{const.}$$
Suppose the light ray has an initial incident angle of $\theta_1$ upwards, then $\tan\theta_1=y^\prime(\alpha)$.
Let $\tan\theta=y^\prime$ in general, then the above first integral indicates that $\sin\theta/c(x)$ is constant.
This is Snell's Law.
If $c$ is increasing, then the path is concave and if $c$ is decreasing it is convex.
Also, if the light goes through a barrier, to the left of which $c$ is constant at $c_F$ and to the right of which $c_S$ with $c_S<c_F$, then the light ray will refract in the way we all expect.


\section{Conclusions and Future Work}
\label{sec:conclusion}

By translating only at the level of specifications, \RZ provides a
useful middle ground between ad-hoc implementations and
machine-generated implementations.  It allows much more flexible
implementation strategies, but relies on programmers to
verify properties of their code.

Further, \RZ can serve as a means of explaining constructive
mathematics to programmers.  Programmers who are not knowledgeable
about constructive mathematics can still understand the output of the
translation, which involves familiar concepts such as abstract types
and (classical) first-order logic.   Looking at such examples can
provide the necessary intuition behind the original logic, and better
explain why one might want to work with constructive rather than
classical logic to begin with.

Axioms parameterized by models (e.g., initiality) currently translate
into signatures of ML functors.  We have experimented with an
alternative translation of such axioms into polymorphic types.  In
this case the \Verb|initial| axiom of the natural numbers yields
the specification
\begin{Verbatim}
   val initial: 'a -> ('a -> 'a) -> N.s -> 'a
\end{Verbatim}
which is exactly the familiar iterator for natural numbers (i.e.,
given an initial value, a function, and a natural number, apply the
function that many times to the initial value).  Such types can be
much more natural and much simpler for programmers to understand.  The
theory behind the translation is well understood, being the
phase-splitting translation of Harper, Mitchell, and Moggi
\cite{harper+:popl90}.  Because of limitations of ML not every
parameterized axiom can be turned into polymorphism; ML allows only
prenex quantifiers, and the quantifiers can range over types but not
type operators.  However we would like to do so where it is possible
(the common case).  As an alternative, we could attempt to retarget
the output to a language like Haskell~\cite{haskell} which supports
the necessary polymorphic types, though Haskell's support of modules
is much weaker.

Another possible extension would be to allow dependent families in the
input language. Fortunately, this does not require finding a target
language that supports dependent types; we can use the underlying
(non-dependent) types, and then express the dependencies as additional
properties that must be verified for the implementation.

%%% Local Variables:
%%% mode: latex
%%% TeX-master: "case"
%%% End:


\documentclass{report}

\title{explain-math example}
\author{Matt Gleich}
\date{}

\makeindex

\usepackage{explain-math}

\begin{document}
    \maketitle

    \section{Basic Math Example}
        \begin{align*}
            \statement{-2(x + 2) = 6}
            \explain{Distribute out -2}{
                \step{ (-2 \cdot x) + (-2 \cdot 2) = 6 }
                \step{ -2x - 4 = 6 }
            }
            \explain{Remove -4 from the left}{
                \step{ -2x - 4 + 4 = 6 + 4 }
                \step{ -2x = 10 }
            }
            \explain{Remove -2 from the left}{
                \step{ \frac{-2x}{-2} = \frac{10}{-2} }
                \step{ \frac{-2x}{-2} = \frac{10}{-2} }
                \step{ x = -5 }
            }
            \sol{x = -5}
        \end{align*}

    \section{Basic Physics Example}
        \begin{align*}
            \formula{p = mv}
            \variables{
                \varu{p}{\text{?}}{kg $ \frac{\text{m}}{\text{s}} $}
                \varu{m}{3.0}{k.g}
                \varu{v}{5.0}{m/s East}
            }
            \explain{Plug \& solve}{p = 3 \cdot 5}
            \sol{p = 15 \text{ kg} \cdot \frac{\text{m}}{\text{s}}}
        \end{align*}
\end{document}


\section{Application: Cryptography}

Cryptography is about encoding a message so that it is hard for a
third party to read. The original message is called the
\textbf{plaintext}%
\index{plaintext}%
\index{cipher!plaintext} and the encrypted message is called the
\textbf{ciphertext}%
\index{ciphertext}%
\index{cipher!ciphertext}. The process of turning a plaintext into the
corresponding ciphertext is called \textbf{encryption}%
\index{encryption}%
\index{cipher!encryption}, and the process of turning a ciphertext
into the corresponding plaintext is called \textbf{decryption}%
\index{decryption}%
\index{cipher!decryption}. An encryption and decryption method is also
called a \textbf{cipher}%
\index{cipher}.  Modern ciphers are designed in such a way that the
cipher itself is not secret, but the encryption depends on a secret
\textbf{key}%
\index{key!cryptography}%
\index{cipher!key}. A cipher should be designed so that decryption is
easy for a person who knows the key, but difficult for everybody
else. The art of designing ciphers is called \textbf{cryptography}%
\index{cryptography}, and the art of breaking ciphers is called
\textbf{cryptanalysis}%
\index{cryptanalysis}.

In order to be able to define ciphers using algebraic operations, we
start by encoding strings as sequences of numbers. To that end, we
assign a number to each letter of the alphabet, as well as the special
symbols ``space'', ``comma'', and ``period'', according to the
following scheme.
\begin{center}
  \tabcolsep=2.5ex
  \begin{tabular}{|c|c|c|c|c|c|c|c|c|}
    \hline
    Space & \qq{A} & \qq{B} & \qq{C} & \qq{D} & \ldots & \qq{Z} & Comma & Period \\\hline
    0 & 1 & 2 & 3 & 4 & \ldots & 26 & 27 & 28 \\\hline
  \end{tabular}
\end{center}
In practical applications, one would probably use a larger set of
symbols and a standard encoding such as ASCII or UTF-8. But the above
29 symbols will be sufficient for our purposes. It will also come in
handy that 29 is prime.

\begin{example}{Representing strings as sequences of numbers}{string-encoding}
  Convert the string ``Attack at dawn'' to a sequence of
  numbers. Convert the sequence of numbers
  $9,0,12,9,11,5,0,3,15,4,5,19,28$ to a string.
\end{example}

\begin{solution}
  We have $\qq{A}=1$, $\qq{T}=20$, $\qq{T}=20$, $\qq{A}=1$, $\qq{C}=3$,
  $\qq{K}=11$, $\mbox{Space}=0$, and so on. Continuing in this way, the
  encoding of ``Attack at dawn'' is
  $1,20,20,1,3,11,0,1,20,0,4,1,23,14$.  Conversely, we have $9=\qq{I}$,
  $0=\mbox{Space}$, $12=\qq{L}$, $9=\qq{I}$, $11=\qq{K}$, $5=\qq{E}$, and so
  on. We find that the decoded string is ``I like codes.''
\end{solution}

There are many different ways to define ciphers. Some of the oldest
known ciphers date back thousands of years.  An example of such a
``classic'' cipher is a \textbf{substitution cipher}%
\index{substitution cipher}%
\index{cipher!substitution cipher}, where each letter of the alphabet
is replaced by a different letter, for example $\qq{A}\mapsto\qq{D}$,
$\qq{B}\mapsto\qq{E}$, and so on. Substitution ciphers have the property
that changing one letter of the plaintext always changes exactly one
letter of the ciphertext. This is not a desirable property, because it
makes the cipher easy to break. Therefore, modern ciphers are designed
to satisfy a property called \textbf{diffusion}%
\index{diffusion}%
\index{cipher!diffusion}: changing one letter of the plaintext should
change many letters of the ciphertext.

In a \textbf{block cipher}%
\index{block cipher}%
\index{cipher!block cipher}, the plaintext is first divided into
blocks of equal size, and then each block is encrypted separately. The
\textbf{block size}%
\index{block size} is the number of plaintext symbols in each
block. If the length of the plaintext is not divisible by the block
size, we pad the final block with additional spaces. In the context of
a block cipher, the diffusion property means that changing one symbols
of a plaintext block potentially affects every symbol of the
ciphertext block. The following is an example of a block cipher.

\begin{definition}{Hill cipher}{hill-cipher}
  The \textbf{Hill cipher}%
  \index{Hill cipher}%
  \index{cipher!Hill cipher} of block size $n$ has as its key an
  invertible $n\times n$-matrix $A$ with scalars from $\Z_{29}$. Each
  ciphertext block $c_1,\ldots,c_n$ is computed from the corresponding
  plaintext block $p_1,\ldots,p_n$ by matrix multiplication modulo
  $\Z_{29}$:
  \begin{equation*}
    \begin{mymatrix}{c}c_1\\\vdots\\c_n\end{mymatrix}
    ~=~ A\begin{mymatrix}{c}p_1\\\vdots\\p_n\end{mymatrix}.
  \end{equation*}
  The matrix $A$ is called the \textbf{encryption matrix}%
  \index{encryption matrix}%
  \index{matrix!encryption} of the cipher. It inverse $A^{-1}$ is
  called the \textbf{decryption matrix}%
  \index{decryption matrix}%
  \index{matrix!decryption}.
\end{definition}

\begin{example}{Hill cipher: encryption}{hill-cipher-encryption}
  Encrypt the message ``Meet me tomorrow'' using the Hill cipher with
  block size $3$ and encryption matrix
  \begin{equation*}
    A ~=~ \begin{mymatrix}{ccc}
      2 & 4 & 1 \\
      3 & 1 & 5 \\
      1 & 3 & 2 \\
    \end{mymatrix}.
  \end{equation*}
\end{example}

\begin{solution}
  We start by converting the message ``Meet me tomorrow'' to a sequence
  of scalars. We have $\qq{M}=13$, $\qq{E}=5$, and so on. The encoded
  plaintext is $13,5,5,20,0,13,5,0,20,15,13,15,18,18,15,23$. Next, we
  divide the plaintext into blocks of length 3. Since the length of
  the plaintext is not a multiple of three, we pad the final block
  with spaces, i.e., with zeros.
  \begin{equation*}
    \mbox{Plaintext blocks:}\quad
    (13,5,5),\
    (20,0,13),\
    (5,0,20),\
    (15,13,15),\
    (18,18,15),\
    (23,0,0).
  \end{equation*}
  To compute the ciphertext, we regard each plaintext block as a
  $3$-dimensional column vector and multiply by the encryption matrix
  $A$. All calculations are done modulo $29$. For example, for the
  first block, we have
  \begin{equation*}
    A \begin{mymatrix}{c} 13 \\ 5 \\ 5 \end{mymatrix}
    ~=~ \begin{mymatrix}{ccc}
      2 & 4 & 1 \\
      3 & 1 & 5 \\
      1 & 3 & 2 \\
    \end{mymatrix}
    \begin{mymatrix}{c} 13 \\ 5 \\ 5 \end{mymatrix}
    ~=~ \begin{mymatrix}{c} 22 \\ 11 \\ 9 \end{mymatrix},
  \end{equation*}
  so the first ciphertext block is $(22,11,9)$. We repeat the same
  with the remaining plaintext blocks.
  \begin{align*}
    &A \begin{mymatrix}{c} 20 \\ 0 \\ 13 \end{mymatrix}
    = \begin{mymatrix}{c} 24 \\ 9 \\ 17 \end{mymatrix},
    \quad
    A \begin{mymatrix}{c} 5 \\ 0 \\ 20 \end{mymatrix}
    = \begin{mymatrix}{c} 1 \\ 28 \\ 16 \end{mymatrix},
    \quad
    A \begin{mymatrix}{c} 15 \\ 13 \\ 15 \end{mymatrix}
    = \begin{mymatrix}{c} 10 \\ 17 \\ 26 \end{mymatrix},
    \\\\[-2ex]
    &A \begin{mymatrix}{c} 18 \\ 18 \\ 15 \end{mymatrix}
    = \begin{mymatrix}{c} 7 \\ 2 \\ 15 \end{mymatrix},
    \quad
    A \begin{mymatrix}{c} 23 \\ 0 \\ 0 \end{mymatrix}
    = \begin{mymatrix}{c} 17 \\ 11 \\ 23 \end{mymatrix}.
  \end{align*}
  Therefore, we have found the following ciphertext blocks:
  \begin{equation*}
    \mbox{Ciphertext blocks:}\quad
    (22,11,9),\
    (24,9,17),\
    (1,28,16),\
    (10,17,26),\
    (7,2,15),\
    (17,11,23).
  \end{equation*}
  Finally, we can convert the ciphertext to a list of symbols:
  $\q{VKIXIQA.PJQZGBOQKW}$.
\end{solution}

\begin{example}{Hill cipher: decryption}{hill-cipher-decryption}
  Decrypt the message $\q{RNOLFPHHCIGH DE}$ using the Hill cipher with
  block size $3$ and encryption matrix
  \begin{equation*}
    A ~=~ \begin{mymatrix}{ccc}
      2 & 4 & 1 \\
      3 & 1 & 5 \\
      1 & 3 & 2 \\
    \end{mymatrix}.
  \end{equation*}
\end{example}

\begin{solution}
  The process is analogous to encryption, except that we need to use
  the decryption matrix $A^{-1}$ instead of $A$. We first calculate
  $A^{-1}$, keeping in mind that scalars are from the field $\Z_{29}$.
  The method is the same as in Example~\ref{exa:matrix-inverse-z7}; we
  skip the individual steps in the interest of brevity.
  \begin{equation*}
    \mat{A\mid I}
    ~=~
    \begin{mymatrix}{ccc|ccc}
      2 & 4 & 1  &  1 & 0 & 0 \\
      3 & 1 & 5  &  0 & 1 & 0 \\
      1 & 3 & 2  &  0 & 0 & 1 \\
    \end{mymatrix}
    ~\roweq~\ldots~\roweq~
    \begin{mymatrix}{ccc|ccc}
      1 & 0 & 0  &  23 & 20 & 11 \\
      0 & 1 & 0  &   4 & 17 & 28 \\
      0 & 0 & 1  &  26 &  8 & 11 \\
    \end{mymatrix}
    ~=~
    \mat{I\mid A^{-1}}.
  \end{equation*}
  Next, we convert the 15 ciphertext symbols $\q{RNOLFPHHCIGH DE}$ to
  scalars and divide them into blocks of length 3:
  \begin{equation*}
    \mbox{Ciphertext blocks:}\quad
    (18,14,15),\
    (12,6,16),\
    (8,8,3),\
    (9,7,8),\
    (0,4,5).
  \end{equation*}
  Now we decrypt each ciphertext block by a matrix multiplication
  with $A^{-1}$.
  \begin{align*}
    &A^{-1} \begin{mymatrix}{c} 18 \\ 14 \\ 15 \end{mymatrix}
    = \begin{mymatrix}{c} 18 \\ 5 \\ 20 \end{mymatrix},
    \quad
    A^{-1} \begin{mymatrix}{c} 12 \\ 6 \\ 16 \end{mymatrix}
    = \begin{mymatrix}{c} 21 \\ 18 \\ 14 \end{mymatrix},
    \quad
    A^{-1} \begin{mymatrix}{c} 8 \\ 8 \\ 3 \end{mymatrix}
    = \begin{mymatrix}{c} 0 \\ 20 \\ 15 \end{mymatrix},
    \\\\[-2ex]
    &A^{-1} \begin{mymatrix}{c} 9 \\ 7 \\ 8 \end{mymatrix}
    = \begin{mymatrix}{c} 0 \\ 2 \\ 1 \end{mymatrix},
    \quad
    A^{-1} \begin{mymatrix}{c} 0 \\ 4 \\ 5 \end{mymatrix}
    = \begin{mymatrix}{c} 19 \\ 5 \\ 0 \end{mymatrix}.
  \end{align*}
  This yields the following plaintext blocks:
    \begin{equation*}
    \mbox{Plaintext blocks:}\quad
    (18,5,20),\
    (21,18,14),\
    (0,20,15),\
    (0,2,1),\
    (19,5,0).
  \end{equation*}
  Converting these back to letters, and omitting the trailing space,
  we find that the plaintext is ``return to base''.
\end{solution}

It is important to note that, despite its good diffusion properties,
the Hill cipher is not secure. The cipher has many weaknesses. For
one, because $A\vect{0}=\vect{0}$, a block of spaces in the plaintext
will always be encrypted as a block of spaces in the ciphertext,
regardless of the encryption matrix $A$. More importantly, the cipher
is subject to a so-called \textbf{known plaintext attack}%
\index{known plaintext attack}%
\index{cipher!known plaintext attack}.  If an eavesdropper intercepts
some ciphertext for which a small amount of the corresponding
plaintext happens to be known, it is immediately possible to recover
the key and therefore decrypt the rest of the ciphertext. Carrying out
this attack only requires some basic knowledge of linear algebra. The
following example illustrates how this is done.

\begin{example}{Cryptanalysis of the Hill cipher: known plaintext attack}{hill-cipher-cryptanalysis}
  Eve intercepts the following encrypted message sent by Alice:%
  \index{cryptanalysis}
  \begin{center}
    \q{EFNOR.AHIFNEPL.TSZS,RSKT.ZBBRFVUPFVZLFHNTV}.
  \end{center}
  Eve knows that Alice uses a Hill cipher with block length 3, but she
  does not know the secret encryption matrix. Eve also knows that
  Alice begins all of her correspondence with ``My dear
  love''. Decrypt the message.
\end{example}

\begin{solution}
  The first three blocks of the ciphertext are $\q{EFNOR.AHI}$, i.e.,
  \begin{equation*}
    \mbox{Ciphertext blocks:}\quad
    (5,6,14),\
    (15,18,28),\
    (1,8,9).
  \end{equation*}
  Eve also knows that the first three blocks of the plaintext are
  $\q{MY DEAR L}$, i.e.,
  \begin{equation*}
    \mbox{Plaintext blocks:}\quad
    (13,25,0),\
    (4,5,1),\
    (18,0,12).
  \end{equation*}
  These facts allow Eve to deduce the following information about the
  unknown decryption matrix $A^{-1}$:
  \begin{equation*}
    A^{-1} \begin{mymatrix}{c} 5 \\ 6 \\ 14 \end{mymatrix}
    = \begin{mymatrix}{c} 13 \\ 25 \\ 0 \end{mymatrix},\quad
    A^{-1} \begin{mymatrix}{c} 15 \\ 18 \\ 28 \end{mymatrix}
    = \begin{mymatrix}{c} 4 \\ 5 \\ 1 \end{mymatrix},\quad
    A^{-1} \begin{mymatrix}{c} 1 \\ 8 \\ 9 \end{mymatrix}
    = \begin{mymatrix}{c} 18 \\ 0 \\ 12 \end{mymatrix}.
  \end{equation*}
  Since Eve remembers the column method of matrix multiplication, she
  knows that these three equations can be written as a single equation
  in matrix form:
  \begin{equation*}
    A^{-1} \begin{mymatrix}{ccc}
      5 & 15 & 1 \\
      6 & 18 & 8 \\
      14 & 28 & 9 \\
    \end{mymatrix}
    = \begin{mymatrix}{ccc}
      13 & 4 & 18 \\
      25 & 5 & 0 \\
      0 & 1 & 12 \\
    \end{mymatrix}.\quad
  \end{equation*}
  Note that this equation is of the form $A^{-1}C=P$. (Here, $C$
  stands for ``ciphertext'' and $P$ for ``plaintext''). Multiplying
  both sides of the equation by $C^{-1}$ on the right, we get
  $A^{-1} = PC^{-1}$. Thus, assuming that $C$ is invertible, Eve can
  easily compute the decryption matrix $A^{-1}$. Eve computes:
  \begin{equation*}
    C^{-1}
    =
    \begin{mymatrix}{ccc}
      5 & 15 & 1 \\
      6 & 18 & 8 \\
      14 & 28 & 9 \\
    \end{mymatrix}^{-1}
    =
    \begin{mymatrix}{ccc}
      19 & 8 & 23 \\
      0 & 5 & 2 \\
      22 & 1 & 0 \\
    \end{mymatrix}.
  \end{equation*}
  This allows Eve to compute the decryption matrix:
  \begin{equation*}
    A^{-1}
    =
    PC^{-1}
    =
    \begin{mymatrix}{ccc}
      13 & 4 & 18 \\
      25 & 5 & 0 \\
      0 & 1 & 12 \\
    \end{mymatrix}
    \begin{mymatrix}{ccc}
      19 & 8 & 23 \\
      0 & 5 & 2 \\
      22 & 1 & 0 \\
    \end{mymatrix}
    =
    \begin{mymatrix}{ccc}
      5  & 26 & 17 \\
      11 & 22 & 5 \\
      3  & 17 & 2 \\
    \end{mymatrix}.
  \end{equation*}
  Armed with the decryption matrix $A^{-1}$, Eve can now decrypt
  Alice's entire message, using the same method as in
  Example~\ref{exa:hill-cipher-decryption}. The plaintext is ``My dear
  love, run away with me at midnight''.
\end{solution}

As the example shows, the Hill cipher is not secure at all. The main
problem is that the cipher is {\em linear}, i.e., each component of a
ciphertext block is a simple linear combination of the components of
the plaintext block. This linearity property enables Eve to break the
cipher by solving a system of linear equations.

For this reason, all modern block ciphers have a non-linear
component. Often this takes the form of so-called \textbf{S-boxes}%
\index{S-box}%
\index{cipher!S-box}. An S-box is an operation that scrambles the
symbols of the alphabet in a non-linear way.  For example, consider
the following S-box, which is an operation from $\Z_{29}$ to
$\Z_{29}$:
\begin{center}
  \tabcolsep=0.4ex\def\arraystretch{1.4}
  \begin{tabular}{|c|c|c|c|c|c|c|c|c|c|c|c|c|c|c|c|c|c|c|c|c|c|c|c|c|c|c|c|c|c|}
    \hline
    $x$ & 0 & 1 & 2 & 3 & 4 & 5 & 6 & 7 & 8 & 9 & 10 & 11 & 12 & 13 & 14 & 15 & 16 & 17 & 18 & 19 & 20 & 21 & 22 & 23 & 24 & 25 & 26 & 27 & 28 \\\hline
    ~$S(x)$~ & 17 & 9 & 27 & 2 & 20 & 12 & 21 & 26 & 16 & 18 & 4 & 24 & 23 & 7 & 19 & 14 & 28 & 29 & 1 & 15 & 10 & 22 & 6 & 5 & 25 & 11 & 13 & 3 & 8 \\\hline
  \end{tabular}
\end{center}
The inputs of the S-box are shown in the top row, and the
corresponding outputs in the bottom row.  For example, this S-box maps
the input $7$ to the output $26$. We write $S(7)=26$.

\begin{definition}{A toy block cipher}{toy-block-cipher}
  Consider the following block cipher on the alphabet $\Z_{29}$ with
  block size $3$. The key consists of $12$ elements $k_1,\ldots,k_{12}$
  of $\Z_{29}$. To encrypt a plaintext block, regard the block as a
  $3$-dimensional column vector. Then repeat the following steps $3$
  times. All operations are carried out modulo $29$.
  \begin{itemize}
  \item Key mixing: add the next three components of the key to the
    components of the vector.
  \item Diffusion: multiply the vector by the fixed $3\times 3$-matrix
    $A = \begin{mymatrix}{ccc}
      1 & 2 & 3 \\
      3 & 1 & 2 \\
      2 & 3 & 1 \\
    \end{mymatrix}$.
  \item S-box application: apply the S-box to each component of the
    vector.
  \end{itemize}
  Finally, apply one more key mixing step at the end. The resulting
  vector is the ciphertext block. The cipher can be visualized as
  follows:
  \begin{equation*}
    \begin{tikzpicture}[xscale=1.1,
      a/.style={fill=red!20},
      s/.style={fill=yellow!30},
      k/.style={fill=green!20}]
      \draw (0,2) -- (11,2);
      \draw (0,1) node[left=2ex]{plaintext} -- (11,1) node[right=2ex]{ciphertext};
      \draw (0,0) -- (11,0);
      \draw[k] (1,2) +(-0.35,-0.35) rectangle node{$k_1$} +(0.35,0.35);
      \draw[k] (1,1) +(-0.35,-0.35) rectangle node{$k_2$} +(0.35,0.35);
      \draw[k] (1,0) +(-0.35,-0.35) rectangle node{$k_3$} +(0.35,0.35);
      \draw[a] (2,0) +(-0.35,-0.35) rectangle node{$A$} +(0.35,2.35);
      \draw[s] (3,2) +(-0.35,-0.35) rectangle node{$S$} +(0.35,0.35);
      \draw[s] (3,1) +(-0.35,-0.35) rectangle node{$S$} +(0.35,0.35);
      \draw[s] (3,0) +(-0.35,-0.35) rectangle node{$S$} +(0.35,0.35);
      \draw[k] (4,2) +(-0.35,-0.35) rectangle node{$k_4$} +(0.35,0.35);
      \draw[k] (4,1) +(-0.35,-0.35) rectangle node{$k_5$} +(0.35,0.35);
      \draw[k] (4,0) +(-0.35,-0.35) rectangle node{$k_6$} +(0.35,0.35);
      \draw[a] (5,0) +(-0.35,-0.35) rectangle node{$A$} +(0.35,2.35);
      \draw[s] (6,2) +(-0.35,-0.35) rectangle node{$S$} +(0.35,0.35);
      \draw[s] (6,1) +(-0.35,-0.35) rectangle node{$S$} +(0.35,0.35);
      \draw[s] (6,0) +(-0.35,-0.35) rectangle node{$S$} +(0.35,0.35);
      \draw[k] (7,2) +(-0.35,-0.35) rectangle node{$k_7$} +(0.35,0.35);
      \draw[k] (7,1) +(-0.35,-0.35) rectangle node{$k_8$} +(0.35,0.35);
      \draw[k] (7,0) +(-0.35,-0.35) rectangle node{$k_9$} +(0.35,0.35);
      \draw[a] (8,0) +(-0.35,-0.35) rectangle node{$A$} +(0.35,2.35);
      \draw[s] (9,2) +(-0.35,-0.35) rectangle node{$S$} +(0.35,0.35);
      \draw[s] (9,1) +(-0.35,-0.35) rectangle node{$S$} +(0.35,0.35);
      \draw[s] (9,0) +(-0.35,-0.35) rectangle node{$S$} +(0.35,0.35);
      \draw[k] (10,2) +(-0.35,-0.35) rectangle node{$k_{10}$} +(0.35,0.35);
      \draw[k] (10,1) +(-0.35,-0.35) rectangle node{$k_{11}$} +(0.35,0.35);
      \draw[k] (10,0) +(-0.35,-0.35) rectangle node{$k_{12}$} +(0.35,0.35);
  \end{tikzpicture}
\end{equation*}
\end{definition}

Note that the three basic steps (key mixing, diffusion, and S-box
application) are repeated several times; each such repetition is
called a \textbf{round}%
\index{cipher!round}%
\index{rounds of a cipher} of the block cipher.  The more rounds a
block cipher has, the better its diffusion and non-linearity
properties. The final round is short: it only consists of a key
mixing step, with no final diffusion or S-box application. The reason
is that performing a final diffusion and S-box application would not
add anything to the security of the cipher. An attacker could simply
undo these last two steps, since they do not depend on the key.

The matrix $A$ is called the \textbf{diffusion matrix}%
\index{diffusion matrix}%
\index{matrix!diffusion}%
\index{cipher!diffusion matrix} of the cipher. Note that, unlike for
the Hill cipher, the matrix $A$ is fixed once and for all and is not
part of the key. Instead, the key consists of scalars that are added
to the current block at the beginning of each round.

\begin{example}{Toy block cipher: encryption}{toy-block-cipher-encryption}
  Encrypt the message ``I like math'' using the block cipher of
  Definition~\ref{def:toy-block-cipher} and the key
  $1,1,3,3,5,5,7,7,9,9,11,11$.
\end{example}

\begin{solution}
  We first represent the plaintext as a sequence of blocks, padding
  the final block with zeros:
  \begin{equation*}
    \mbox{Plaintext blocks:}\quad
    (9,0,12),\
    (9,11,5),\
    (0,13,1),\
    (20,8,0).
  \end{equation*}
  To encrypt the first block, we start with the vector
  $\mat{9,0,12}^T$ and apply the following steps:

  \noindent{\bf Round 1:}
  \begin{itemize}
  \item Key mixing: the first three components of the key are
    $1,1,3$. We add them to the plaintext.
    \begin{equation*}
      \begin{mymatrix}{c} 9 \\ 0 \\ 12 \end{mymatrix}
      +
      \begin{mymatrix}{c} 1 \\ 1 \\ 3 \end{mymatrix}
      ~=~
      \begin{mymatrix}{c} 10 \\ 1 \\ 15 \end{mymatrix}.
    \end{equation*}
  \item Diffusion: multiply by the matrix $A$.
    \begin{equation*}
      \begin{mymatrix}{ccc}
        1 & 2 & 3 \\
        3 & 1 & 2 \\
        2 & 3 & 1 \\
      \end{mymatrix}
      \begin{mymatrix}{c} 10 \\ 1 \\ 15 \end{mymatrix}
      ~=~
      \begin{mymatrix}{c} 28 \\ 3 \\ 9 \end{mymatrix}.
    \end{equation*}
  \item S-box application: apply the S-box to each component of the
    vector.
    \begin{equation*}
      \begin{mymatrix}{c} S(28) \\ S(3) \\ S(9) \end{mymatrix}
      ~=~
      \begin{mymatrix}{c} 8 \\ 2 \\ 18 \end{mymatrix}.
    \end{equation*}
  \end{itemize}

  \noindent{\bf Round 2:}
  \begin{itemize}
  \item Key mixing: the next three components of the key are
    $3,5,5$.
    \begin{equation*}
      \begin{mymatrix}{c} 8 \\ 2 \\ 18 \end{mymatrix}
      +
      \begin{mymatrix}{c} 3 \\ 5 \\ 5 \end{mymatrix}
      ~=~
      \begin{mymatrix}{c} 11 \\ 7 \\ 23 \end{mymatrix}.
    \end{equation*}
  \item Diffusion:
    \begin{equation*}
      \begin{mymatrix}{ccc}
        1 & 2 & 3 \\
        3 & 1 & 2 \\
        2 & 3 & 1 \\
      \end{mymatrix}
      \begin{mymatrix}{c} 11 \\ 7 \\ 23 \end{mymatrix}
      ~=~
      \begin{mymatrix}{c} 7 \\ 28 \\ 8 \end{mymatrix}.
    \end{equation*}
  \item S-box application:
    \begin{equation*}
      \begin{mymatrix}{c} S(7) \\ S(28) \\ S(8) \end{mymatrix}
      ~=~
      \begin{mymatrix}{c} 26 \\ 8 \\ 16 \end{mymatrix}.
    \end{equation*}
  \end{itemize}

  \noindent{\bf Round 3:}
  \begin{itemize}
  \item Key mixing: the next three components of the key are
    $7,7,9$.
    \begin{equation*}
      \begin{mymatrix}{c} 26 \\ 8 \\ 16 \end{mymatrix}
      +
      \begin{mymatrix}{c} 7 \\ 7 \\ 9 \end{mymatrix}
      ~=~
      \begin{mymatrix}{c} 4 \\ 15 \\ 25 \end{mymatrix}.
    \end{equation*}
  \item Diffusion:
    \begin{equation*}
      \begin{mymatrix}{ccc}
        1 & 2 & 3 \\
        3 & 1 & 2 \\
        2 & 3 & 1 \\
      \end{mymatrix}
      \begin{mymatrix}{c} 4 \\ 15 \\ 25 \end{mymatrix}
      ~=~
      \begin{mymatrix}{c} 22 \\ 19 \\ 20 \end{mymatrix}.
    \end{equation*}
  \item S-box application:
    \begin{equation*}
      \begin{mymatrix}{c} S(22) \\ S(19) \\ S(20) \end{mymatrix}
      ~=~
      \begin{mymatrix}{c} 6 \\ 15 \\ 10 \end{mymatrix}.
    \end{equation*}
  \end{itemize}

  \noindent{\bf Round 4 (the final round is abbreviated):}
  \begin{itemize}
  \item Key mixing: the next three components of the key are
    $9,11,11$.
    \begin{equation*}
      \begin{mymatrix}{c} 6 \\ 15 \\ 10 \end{mymatrix}
      +
      \begin{mymatrix}{c} 9 \\ 11 \\ 11 \end{mymatrix}
      ~=~
      \begin{mymatrix}{c} 15 \\ 26 \\ 21 \end{mymatrix}.
    \end{equation*}
  \end{itemize}
  Therefore, the first ciphertext block is $(15,26,21)$. We repeat the
  same procedure with the remaining plaintext blocks, and obtain the
  following ciphertext blocks:
  \begin{equation*}
    \mbox{Ciphertext blocks:}\quad
    (15,26,21),\
    (7,24,1),\
    (2,16,23),\
    (7,20,22).
  \end{equation*}
  The corresponding ciphertext is $\q{OZUGXABPWGTV}$.
\end{solution}

Are ciphers like this actually used in the real world? The answer
is yes. While the cipher of Definition~\ref{def:toy-block-cipher} is
greatly simplified, it has the same basic structure as modern
real-world block ciphers (such as AES, the Advanced Encryption
Standard). Naturally, these real-world ciphers differ in some details,
such as the alphabet size, the block size, the number of rounds, the
design of the S-boxes, the way the key is computed, and the precise
order in which the operations are applied. However, their basic
structure is very similar to our toy cipher, and indeed, all such
ciphers rely on key mixing, diffusion, and non-linear S-boxes as
their key components.

For example, AES uses an alphabet size of $256$ instead of $29$ (i.e.,
it operates on bytes%
\index{byte}, rather than elements of $\Z_{29}$). Although $\Z_{256}$
is not a field (because $256$ is not prime), it nevertheless turns out
that there exists a field with $256$ elements, and AES uses it for its
algebraic operations. Our toy cipher's block size of $3$ is much too
small to achieve effective diffusion; modern real-world ciphers use
block sizes between $16$ and $32$ bytes ($128$ to $256$ bits). The
design of the S-boxes is a bit of a black art; at minimum, they must
be designed to withstand two common types of cryptanalysis known as
\textbf{linear cryptanalysis}%
\index{cryptanalysis!linear}%
\index{linear cryptanalysis} and \textbf{differential cryptanalysis}%
\index{cryptanalysis!differential}%
\index{differential cryptanalysis}.  Among other things, this means
that the S-box should be ``as far from linear'' as possible.

A detailed discussion of the design and cryptanalysis of modern block
ciphers is far beyond the scope of this book, but we hope that you
have gotten a taste of this fascinating subject, and the role that
linear algebra over finite fields plays in it.


\subsection{All smooth complex functions are analytic}


\section{Classifying spaces: the Grassmann model}\label{grassmannmodel}
We will now shift our focus somewhat and talk about classifying spaces for
principal bundles and for vector bundles. We will do this in two ways: the
first will be via the Grassmann model and the second via simplicial methods.
\begin{lemma}\label{embedding}
    Over a compact Hausdorff space, any $n$-plane bundle embeds in a trivial
    bundle.
\end{lemma}
\begin{proof}
    Let $\cU$ be a trivializing open cover of the base $B$; since $B$ is
    compact, we may assume that $\cU$ is finite with $k$ elements. There is no
    issue with numerability, so there is a subordinate partition of unity $\phi_i$.
    Consider an $n$-plane bundle $E\to B$. By trivialization, there is a
    fiberwise isomorphism $p^{-1}(U_i)\xrightarrow{f_i}\RR^n$ where the $U_i\in
    \cU$. A map to a trivial bundle is the same thing as a bundle map in the
    following diagram:
    \begin{equation*}
	\xymatrix{
	    E\ar[r]\ar[d] & \RR^N\ar[d]\\
	    B\ar[r] & \ast
	    }
    \end{equation*}
    We therefore define $E\to (\RR^n)^k$ via
    $$e\mapsto (\phi_i(p(e))f_i(e))_{i=1,\cdots,k}.$$
    This is a fiberwise linear embedding, generally called a ``Gauss map''.
    Indeed, observe that this map has no kernel on every fiber, so it is an
    embedding.
\end{proof}
The trivial bundle has a metric on it, so choosing the orthogonal complement of
the embedding of Lemma \ref{embedding}, we obtain:
\begin{corollary}
    Over a compact Hausdorff space, any $n$-plane bundle has a complement (i.e.
    a $\xi^\perp$ such that $\xi\oplus\xi^\perp$ is trivial).
\end{corollary}
Another way to say this is that if $B$ is a compact Hausdorff space with an
$n$-plane bundle $\xi$, there is a map $f:X\to\Gra_n(\RR^{kn})$; this is
exactly the Gauss map. It has the property that taking the pullback
$f^\ast\gamma^n$ of the tautologous bundle over $\Gra_n(\RR^{kn})$ gives back
$\xi$.

In general, we do not have control over the number $k$. There is an easy fix to
this problem: consider the tautologous bundle $\gamma^n$ over
$\Gra_n(\RR^\infty)$, defined as the union of $\Gra_n(\RR^m)$ and given the
limit topology. This is a CW-complex of finite type (i.e. finitely many cells
in each dimension). Note that $\Gra_n(\RR^m)$ are not the $m$-skeleta of
$\Gra_n(\RR^\infty)$!

The space $\Gra_n(\RR^\infty)$ is ``more universal'':
\begin{lemma}\label{universal}
    Any (numerable) $n$-plane bundle is pulled back from $\gamma^n\downarrow
    \Gra_n(\RR^\infty)$ via the Gauss map.
\end{lemma}
Lemma \ref{universal} is a little bit tricky, since the covering can be wildly
uncountable; but this is remedied by the following bit of point-set topology.
\begin{lemma}\label{sublemma}
    Let $\cU$ be a numerable cover of $X$. Then there's another numerable cover
    $\cU^\prime$ such that:
    \begin{enumerate}
	\item the number of open sets in $\cU^\prime$ is countable, and
	\item each element of $\cU^\prime$ is a disjoint union of elements of
	    $\cU$.
    \end{enumerate}
\end{lemma}
If $\cU$ is a trivializing cover, then $\cU^\prime$ is also a trivializing
cover.
\begin{proof}
    See \cite[Proposition 3.5.4]{husemoller}.
\end{proof}
It is now an exercise to deduce Lemma \ref{universal}. The main result of this
section is the following.
\begin{theorem}
    The map $[X,\Gra_n(\RR^\infty)]\to \Vect_n(X)$ defined by $[f]\mapsto
    [f^\ast\gamma^n]$ is bijective, where $[f]$ is the homotopy class of $f$
    and $[f^\ast\gamma^n]$ is the isomorphism class of the bundle
    $f^\ast\gamma^n$.
\end{theorem}
This is why $\Gra_n(\RR^\infty)$ is also called the \emph{classifying space}
for $n$-plane bundles. The Grassmannian provides a very explicit geometric
description for the classifying space of $n$-plane bundles. There is a more
abstract way to produce a classifying space for principal $G$-bundles, which
we will describe in the next section; the Grassmannian is the special case when
$G = \GL_n(\RR)$.
\begin{proof}
    We have already shown surjectivity, so it remains to prove injectivity.
    Suppose $f_0,f_1:X\to \Gra_n(\RR^\infty)$ such that $f_0^\ast\gamma^n$ and
    $f_1^\ast\gamma^n$ are isomorphic over $X$. We need to construct a homotopy
    $f_0\simeq f_1$. For ease of notation, let us identify $f_0^\ast\gamma^n$
    and $f_1^\ast\gamma_n$ with each other; call it $\xi:E\downarrow X$.

    The maps $f_i$ are the same thing as Gauss maps $g_i:E\to\RR^\infty$, i.e.,
    maps which are fiberwise linear embeddings. The homotopy $f_0\simeq f_1$ is
    created by saying that we have a homotopy from $g_0$ to $g_1$ through Gauss
    maps, i.e., through other fiberwise linear embeddings.

    In fact, we will prove a much stronger statement: \emph{any two} Gauss maps
    $g_0,g_1:E\to \RR^\infty$ are homotopic through Gauss maps. This is very far from
    true if I didn't have a $\RR^\infty$ on the RHS there.

    Let us attempt (and fail!) to construct an affine homotopy between $g_0$
    and $g_1$. Consider the map $tg_0 + (1-t)g_1$ for $0\leq t\leq 1$. In order
    for these maps to define a homotopy via Gauss maps, we need the following
    statement to be true: for all $t$, if $tg_0(v) + (1-t)g_1(v) =
    0\in\RR^\infty$, then $v=0$.  In other words, we need $tg_0+(1-t)g_1$ to be
    injective. Of course, this is not guaranteed from the injectivity of $g_0$
    and $g_1$!

    Instead, we will construct a composite of affine homotopies between $g_0$
    and $g_1$ using the fact that $\RR^\infty$ is an infinite-dimensional
    Euclidean space. Consider the following two linear isometries:
    \begin{equation*}
	\xymatrix{
	    & \RR^\infty = \langle
	    e_0,e_1,\cdots\rangle\ar[dl]^\alpha_{e_i\mapsto
	    e_{2i}}\ar[dr]_\beta^{e_i\mapsto e_{2i+1}} & \\
	    \RR^\infty & & \RR^\infty
	    }
    \end{equation*}
    Then, we have four Gauss maps: $g_0$, $\alpha\circ g_0$, $\beta\circ g_1$,
    and $g_1$. There are affine homotopies through Gauss maps:
    $$g_0\simeq \alpha \circ g_0\simeq \beta\circ g_1\simeq g_1.$$
    We will only show that there is an affine homotopy through Gauss maps $g_0
    \simeq \alpha \circ g_0$; the others are left as an exercise. Let $t$ and
    $v$ be such that $tg_0(v) + (1-t)\alpha g_0(v) = 0$. Since $g_0$ and
    $\alpha g_0$ are Gauss maps, we may suppose that $0<t<1$. Since $\alpha
    g_0(v)_i$ has only even coordinates, it follows by definition of the map
    $\alpha$ that $g_0(v)$ only had nonzero coordinates only in dimensions
    congruent to $0$ mod $4$. Repeating this argument proves the desired
    result.
\end{proof}


\documentclass{article}
\usepackage[utf8]{inputenc}
\usepackage{amsmath}
\usepackage{amssymb}
\usepackage[legalpaper, portrait, margin=1in]{geometry}

\title{2016 ISI Calculus Problem}

\author{Shreenabh Agrawal}

\date{\today}

\begin{document}

\maketitle

\section{Question}
Let $f$ be a differentiable function such that $f(f((x))=x \text { for all } x \in[0,1]$ Suppose $f(0)=1 .$ Determine the value of $\int\limits_{0}^{1}(x-f(x))^{2016} \: d x$
\section{Solution}
$$f(f(x))=x \implies
  f(x)=f^{-1}(x)$$
The graph of this is symmetric about $y=x$,
$$\therefore f(0) = 1 \implies f(1) = 0$$
Now, let us solve the integral (call it (i))
$${I}=\int\limits_{0}^{1}(x-f(x))^{2016}\:  d x$$
Taking substitution,
$$\begin{aligned}
f(x) &=t \\
x &=f^{-1}(t)=f(t) \\
d x &=f^{\prime}(t) \: d t
\end{aligned}$$
Plugging this in (call this (ii)),
$$\begin{aligned}
\therefore \quad I &=\int\limits_{1}^{0}(f(t)-t)^{2016} f^{\prime}(t)\: d t \\
&=-\int\limits_{0}^{1}(t-f(t))^{2016} f^{\prime}(t) \:d t
\end{aligned}$$
Now adding (i) and (ii),
$$2 I=\int\limits_{0}^{1}(x-f(x))^{2016}\left(1-f^{\prime}(x)\right) \: d x$$
Taking another substitution,
$$\begin{aligned}
(x - f(x)) &= u\\
(1 - f^{\prime}(x)) \: dx &= \: du
\end{aligned}
$$
Finally,
$$\begin{aligned}
\therefore \quad 2 I  & =  \int\limits_{-1}^{1}  u^{2016}\: d u \\
 2 I &=  2 \cdot\left[\frac{u^{2017}}{2017}\right]_{0}^{1}
\end{aligned}$$
Thus, the value of our original integral is:
$$\boxed{I = \frac{1}{2017}}$$
\end{document}

Calculus/Creative Math Solving's Problems/2016 ISI Calculus Problem.tex


\chapter{Model Selection}
\label{chp:subsel}

In the previous chapters the chosen number of predictors in the models have not been discussed very thoroughly. The p-value was used for selecting the best predictor in Lab 4.6.2 in section \ref{sec:lab462}. The question though remains how many predictors should be included when creating a model. This chapter discusses three different methods for selecting a subset of the predictors for a model.

\section{Best Subset Selection}
Best subset selection is a method for choosing the best possible subset of predictors. In this approach a model is fitted for each possible combination of the predictors.

The algorithm for best subset selection is explained in Algorithm \ref{algo:bestsubset}. First the null models are created in step 1. In line 2 it iterates from 1 predictor and up to the number of available predictors. In line 3 all possible models with k predictors are fitted and in line 4 and 5 the best model with k predictors is chosen. When all iterations are done the single best model is chosen.

% Insert the algorithm
\begin{algorithm}
	\caption{Best subset selection}
	\label{algo:bestsubset}
	\begin{algorithmic}[1]
		\State Let $M_0$ denote null model, containing no predictors. Which means that $M_0$ contains the sample mean for each observation.
		\For {each $k$ from $1$ to $length(p)$}
		\State Fit all the different models with a combination of k predictors.
		\State \parbox[t]{\dimexpr\linewidth-\algorithmicindent}{Pick the best model with k predictors. Best can be defined as smallest RSS or largest $R^2$}
		\State $M_k = best\_model$
		\EndFor
		\State Choose a single best models from all the best models in $M_0,...M_k$. The best model is chosen based on $C_p$, $BIC$ or adjusted $R^2$ if the whole data set is used for training the models.
	\end{algorithmic}
\end{algorithm}

\subsection{Lab 6.5.1 - Best Subset Selection}
In this exercise a best subset selection is performed on a data set called \emph{Hitters}. The data set is used for predicting the salary of baseball players. Before performing best subset selection the data is split into predictors and the response variable.

A function for choosing the best subset is then defined in listing \ref{lst:best_subset_selection}. In line 3 it iterates through all combinations of the predictors with k number of predictors. A function \emph{process\_subset} is called which returns the subset with calculated model, RSS, $R^2$, BIC and $C_p$. In line 4 all the different combinations are appended to the \emph{models} array. In line 5 the best model is picked based on lowest RSS and then returned.

\begin{lstlisting}[language=Python, label=lst:best_subset_selection, caption=Function for choosing best subset]
def best_subset_selection(k):
	models = []
	for combo in combinations(X.columns, k):
		models.append(process_subset(combo))
	return models[np.argmin([r['RSS'] for r in models])]
\end{lstlisting}

The function in listing \ref{lst:process_subset} is called in listing \ref{lst:best_subset_selection} in line 4. It fits a linear regression model and computes RSS, $R^2$, $C_p$ and BIC for the model.

\begin{lstlisting}[language=Python, label=lst:process_subset, caption=Function for computing metrics for subset]
def process_subset(feature_set):
	d = len(feature_set)
	n = X.shape[0]
	model = lm.LinearRegression().fit(X[[i for i in feature_set]], Y)
	Y_hat = model.predict(X[list(feature_set)])

	rss = metricsUtil.RSS(Y, Y_hat)
	rsquared = metrics.r2_score(Y, Y_hat)
	cp = metricsUtil.Cp(rss, d, Y_hat, n)
	bic = metricsUtil.Bic(n, rss, d, Y_hat)

	return {"model":model, "features": feature_set,
			"RSS":rss, "rsquared": rsquared, "bic": bic, "cp":cp }
\end{lstlisting}

For calculating RSS, $R^2$, $C_p$ and BIC a python module called metricsUtil was implemented. The module has defined functions for calculating these values. After these functions are defined the best subset selection is computed. In listing \ref{lst:best_subset9} a best subset selection is performed for the 19 possible predictors.

\begin{lstlisting}[language=Python, label=lst:best_subset9, caption=Calculating the best subset from 1 to 19 predictors]
for i in xrange(1,20):
	subsets.loc[i] = best_subset_selection(i)
\end{lstlisting}

Plotting RSS, $R^2$, $C_p$ and BIC for the best models from 1-19 predictors gives the plotted graphs shown in figure \ref{fig:best_plottet}. It shows how RSS and $R^2$ respectively monotonically increases and decreases. This is caused by using the same data for both training and testing. When doing this Cp, BIC or adjusted $R^2$ can be used for estimating the optimal amount of predictorss. When calculating BIC and $C_p$ a penalty is added to the calculation. For adjusted $R^2$ the calculation takes into account that only small increases in RSS are often caused by adding a noise variable. Noise variables are added, which consequently leads to a decrease of $R^2$ \citep[pp. 598]{propandstats} \citep[pp. 210-213]{ISLR}.

\myFigure{subset_all_graph.PNG}{Plotted RSS, $R^2$, $C_p$ and BIC for best subset selection from 1-19 predictors}{fig:best_plottet}{1}
\FloatBarrier

BIC indicates that the best model contains 6 predictors. The best model with 6 predictors include: \emph{AtBat, Hits, Walks, CRBI, Division} and \emph{PutOuts}. $C_p$ indicates that the best model contains 10 predictors, this also makes sense as BIC generally places a heavier penalty \citep[pp. 212]{ISLR}. The best 10 predictors for a model included: \emph{AtBat, Hits, Walks, CAtBat, CRuns, CRBI, CWalks, PutOuts, Assists} and \emph{Division}. This also shows how the set of 6 predictors is not just a subset of the 10 predictors. This is because every combination is tried for every number of predictors. A drawback of the algorithm is therefore that it is computationally expensive. The models that must be computed for 19 predictors to find the best amount of predictors is calculated in equation (5.1) to 524,288.

\begin{equation}
2^{19} = 524,288
\end{equation}

The following section presents two different algorithms that can be used for selecting predictors with fewer computations than just described for best subset selection.

\section{Forward and Backward Stepwise Selection}
Forward and backward stepwise selection are two similar algorithms for stepwise selection of a subset. They are both more computationally efficient than the best subset selection.

The forward stepwise selection algorithm adds predictors to the model one by one. When computing the k+1'th model, the predictors chosen for the k'th model defines the first k predictors and then one new predictor is added. This means that the k'th best model will always be a subset of the k+n'th best model. The predictor that improves most upon the model is always the one added.

Backward stepwise selection works very similar to forward stepwise selection. However, the model instead starts by containing all predictors and at each step a predictor is removed. The predictor that is removed is chosen by which gives the best model. This means that instead of fitting 524,288 models with best subset selection, forward and backward stepwise selection only has to fit 191 models as calculated in equation (5.2). This is a significant difference in models that must be fitted.  This was also obvious when executing the exercises for best subset selection compared to forward and backward stepwise selection.

\begin{equation}
1+ \sum_{k=0}^{18}(19-k) = 191
\end{equation}

\subsection{Lab 6.5.2 - Forward and Backward Stepwise Selection}
The exercise for 6.5.3 is very similar to 6.5.2 and a function for forward and backward stepwise selection was implemented and used instead of \emph{best\_subset\_selection} implemented in listing \ref{lst:best_subset_selection}. The rest of the code could be reused. In listing \ref{lst:forwardselection} the implemented function for forward stepwise selection is shown. First the remaining predictors to choose from are extracted. \emph{X.columns} is all the predictors while \emph{already\_chosen\_predictors} is passed as a parameter. It then runs a for loop iterating through all the remaining predictors and adding them to the model. The best model is then selected based on RSS.

\begin{lstlisting}[language=Python, label=lst:forwardselection, caption=Function for forward stepwise selection]
def forward_stepwise_selection(already_chosen_predictors):
	remaining_predictors = [p for p in X.columns if p not in
		already_chosen_predictors]

	models = []
	for p in remaining_predictors:
		models.append(process_subset(already_chosen_predictors+[p]))
	return models[np.argmin([r['RSS'] for r in models])]
\end{lstlisting}

Similarly a function for backward stepwise selection was implemented. Comparing the models for best subset selection, forward and backward stepwise selection showed that some models were identical while others differed. For example the models with predictors from 1 to 6 for both best subset selection and forward stepwise selection were identical while the model with 7 predictors differed. This is not the case with backward stepwise selection which differs in all these. Actually the best model with 7 predictors differs in all three algorithms. The following 7 predictors were chosen:

\begin{itemize}
\item Forward stepwise: \emph{CRBI, Hits, PutOuts, Division, AtBat, Walks} and \emph{CWalks}
\item Best subset: \emph{Hits, Walks, CAtBat, CHits, ChMRun, PutOuts} \emph{Division}
\item Backward stepwise: \emph{AtBat, Hits, Walks, CRuns, CWalks, PutOuts} and \emph{Division}
\end{itemize}

\section{Validation Set Approach and Cross-Validation}
In the previous exercises $C_p$, AIC, BIC and adjusted $R^2$ was used for picking the right amount of predictors. This was needed because the models were trained on the complete data set and so the test error would provide an underestimate of the true error.

In this exercise the validation set approach and cross-validation are used. Therefore instead of using $C_p$, AIC, BIC and adjusted $R^2$ the test error can be directly calculated.
\subsection{Lab 6.5.3 - Choosing Among Models Using The Validation Set Approach and Cross-Validation}

Initially the validation set approach will be used in combination with best subset selection. This is shown in listing \ref{lst:validationsetapproach}. First the data is split into a training and testing set. When this is done the best subset selection is run from 1 to 19 predictors. A small modification of the functions were needed so that the training and test sets were used appropriately.

\begin{lstlisting}[language=Python, label=lst:validationsetapproach, caption=Validation set approach and best subset selection for choosing predictors]
train, test = train_test_split(data, test_size = 0.5)

.......

for i in xrange(1, 20):
	subsets.loc[i] = best_subset_selection(i, X_train, Y_train,
	X_test, Y_test)
\end{lstlisting}

The mean squared error for different numbers of predictors is shown in table \ref{table:mse_validation}. By using this validation set approach and best subset selection the optimal number of predictors is computed to 9. The optimal number of predictors is based on the model with lowest mean squared error. It is important to note that a different split of train and test data can give a different number of optimal predictors.

The validation set approach splits the data equally in two parts. This does not leave much data for training and the test error is therefore very likely an overestimate for the model fit on the entire data. Another approach is k-fold cross-validation. In this exercise a 10-fold cross-validation is executed on the data set in combination with best subset selection.

The implementation of 10-fold cross-validation is shown in listing \ref{lst:crossvalidation}. First a 10-fold random split of the data is done. Then a for loop iterates through the folds and gives a train and test index for each iteration. These indexes are used to create a training and test set for each fold. For each fold a best subset selection is performed from 1 to 19 predictors. After performing the best subset selection 10 times, one for each fold, then a mean of the MSE is calculated for all the folds.

\begin{lstlisting}[language=Python, label=lst:crossvalidation, caption=Cross-validation and best subset selection for choosing predictors]
kf = KFold(n_splits=10, shuffle=True)
kf.get_n_splits(X)
j = 0
mse = np.zeros((kf.n_splits, 19))
for train_index, test_index in kf.split(X):
    X_train = X.iloc[train_index]
    Y_train = Y.iloc[train_index]
    X_test = X.iloc[test_index]
    Y_test = Y.iloc[test_index]
    for i in xrange(1, 20):
		subset = best_subset_selection(i, X_train, Y_train, X_test, Y_test)
        mse[j,i-1] = subset["mse"]
    j = j+1
\end{lstlisting}
\FloatBarrier

The results for cross-validation and best subset selection is shown in table \ref{table:mse_cross}. Using this approach the best model is achieved using a model with 10 predictors. Compared to the best subset selection, this method is even more computationally expensive because it runs the best subset selection one time for each fold.

\begin{table}
	\centering
	\begin{subtable}[t]{2in}
		\centering
		\begin{tabular}{ p{2.5cm} p{1.5cm}  }
			\textbf{Predictors} & \textbf{MSE} \\
			\hline
			\vspace{0.1px}
			7 & \vspace{0.1px} 90,133  \\\hline
			\vspace{0.03em}
			8 & \vspace{0.03em} 89,914  \\\hline
			\vspace{0.03em}
			\textbf{9} & \vspace{0.03em} \textbf{89,782}  \\\hline
			\vspace{0.03em}
			10 &\vspace{0.03em} 90,015  \\\hline
			\vspace{0.03em}
			11 & \vspace{0.03em} 90,192  \\\hline
			\vspace{0.03em}
			12 & \vspace{0.03em} 90,363  \\\hline
		\end{tabular}
		\caption{Validation set approach}\label{table:mse_validation}
	\end{subtable}
	\quad
	\begin{subtable}[t]{2in}
		\centering
	\begin{tabular}{ p{2.5cm} p{1.5cm}  }
		\textbf{Predictors} & \textbf{MSE} \\
		\hline
		\vspace{0.03em}
		7 & \vspace{0.03em} 78,360  \\\hline
		\vspace{0.03em}
		8 & \vspace{0.03em} 77,971  \\\hline
		\vspace{0.03em}
		9 & \vspace{0.03em} 77,944  \\\hline
		\vspace{0.03em}
		\textbf{10} & \vspace{0.03em} \textbf{77,895} \\\hline
		\vspace{0.03em}
		11 & \vspace{0.03em} 78,352  \\\hline
		\vspace{0.03em}
		12 & \vspace{0.03em} 78,795 \\\hline
	\end{tabular}
		\caption{Cross-validation}\label{table:mse_cross}
	\end{subtable}
	\caption{Calculated mean squared error from 7 to 12 predictors.}\label{table:mse}
\end{table}

When choosing among the different techniques for subset selection it is often a matter of how much computation power is available.  The best subset selection is a lot more expensive than forward and backward stepwise selection. Combining best subset selection with cross-validation also makes the process even more computationally expensive. If many predictors are available, then best subset selection might simply be too expensive, even for very fast modern computers. If more than 40 predictors are available, then best subset selection is rarely feasible and methods such as forward and backward stepwise selection could be used instead  \citep[pp. 207]{ISLR}.

An important aspect of subset selection is that the best model might be more complex than a simpler model performing approximately as good. When choosing subset of predictors complexity vs simplicity should also be included in the final choice of predictors


\chapter{\uppercase{Extensions and Applications of MUD Points and Skewness} \label{chapter:vector-valued}}
In Chapter~\ref{chapter:geometry}, we introduced the notion of skewness and showed examples of how it impacts the accuracy of approximating SIP solutions with finite sampling.
Here, we demonstrate how an awareness of skewness allows us to a priori define a QoI that will\---on average\---better resolve $\paramref$ by providing information in mutually distinct directions in $\pspace$.
We begin by revisiting the example in Section \ref{subsec:pde-example} involving the Poisson problem and uncertain Neumann boundary condition $g$.
Recall that $\qoi_\text{2D}$ is able to better resolve $\paramref$ (in this case, $\paramref$ is defined by a finite-dimensional representation of an exact $g$), than $\qoi_\text{1D}$.
The map $\qoi_\text{2D}$ is presented as an alternative option for aggregating the same $100$ measurements and using them to construct a more informative 2D map.
In this chapter, we present a more detailed study of the construction of this map, and perform a case-study in designing a problem where the data-constructed QoI map is more informative.

\input{extensions/mud_vector_map.tex}
\FloatBarrier

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\FloatBarrier
\input{extensions/mud_pde_geometry.tex}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\input{extensions/mud_pde_5d.tex}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\input{extensions/mud_pde_sequence.tex}
\FloatBarrier
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\section{Conclusions}

We have shown that when posing and solving SIPs, we are motivated to choose data-constructed QoI maps which have (a) as many components as possible (up to the dimension of $\pspace$), and (b) whose components exhibit high-degrees of mutually geometrically distinct information (i.e., low average skewness).
There is a dramatic reduction in the sensitivity to the measurement noise when the same hundred measurements are used to construct a map with lower skewness.
In the next chapter, we discuss some other considerations for constructing SIPs, including measurement precision and placement.
We show how different experimental setups can lead to parameter estimates which exhibit different levels of accuracy and precision.
We also introduce a novel method for leveraging the results shown here in a sequential manner to gain possible computational efficiency.


\section{Introduction}
Given a graph $G$ and $k$ agents, each of which is associated with an initial vertex and a goal vertex of $G$, \emph{Multi-Agent Pathfinding (MAPF)} is the problem of finding $k$ conflict-free paths which connect the initial vertex with the goal vertex of each agent.

There are a number of applications of MAPF, which range from industrial applications, in which the increase in automation may promote the need for dozens---perhaps hundreds---of robots navigating in indoor environments (e.g., warehouses), to aviation, underground mining, and multi-agent videogames \cite{WangB08}.

Solving MAPF optimally is NP-complete \cite{YuL13,MaK17}. When viewed as a standard AI search problem, it is straightforward to notice that the branching factor of MAPF is exponential on the number of agents since at each moment in time each agent can perform a number of actions, relatively fixed. It is not surprising, then, that building algorithms that scale reasonably well with the number of agents has been challenging.

For its most simple version, that is, MAPF over 4-connected grids, a number of approaches have been proposed, but two classes of solvers are the most relevant for the research we report here. A first class, is search-based solvers (e.g., \nbcite{Standley10}), which use heuristic search as the main component.
A state-of-the-art search-based solver is Conflict-Based Search (CBS) \cite{SharonSFS12,FelnerLB00KK18,LiFB0K19}, which uses A* at its core. A second class, is compilation-based solvers; for example which translate MAPF to Satisfiability Testing (SAT) (e.g., \nbcite{SurynekFSB16}; \nbcite{BartakZSBS17}; \nbcite{BartakS19}), and Answer-Set Programming \cite{ErdemKOS13,GebserOOS18}.

When seeking for an optimal solution for MAPF, different objective functions can be considered. Under \emph{sum-of-costs}, the most popular variant of MAPF, the objective is to minimize the moves agents perform before stopping at the goal. % This is variant is used in state-of-the-art solvers like CBS.

In this paper, we continue to explore the potential of ASP solvers for MAPF, and propose the first compilation that solves MAPF optimally under the sum-of-costs assumption. A second contribution consists of proposing the first compilation from MAPF to ASP that grows linearly with the number of agents, unlike existing compilations to ASP that are quadratic on the number of agents. In addition, we propose an optimization which uses information drawn from a search algorithm that is run as a preprocessing step to make the encoding more compact.

In our empirical evaluation, we evaluate our approach on synthetic square grids and warehouse grids with an increasing number of agents. We compare against MDD-SAT~\cite{SurynekFSB16}, a representative of the state of the art in SAT-based MAPF, and iCBS-h~\cite{FelnerLB00KK18}, a representative of the state-of-the-art in search-based MAPF. We observe that our approach outperforms both MDD-SAT and iCBS-h when congestion is high. Specifically, our approach has a greater coverage as the number of agents increase. We conclude that Answer-Set Programming is a viable approach to solving MAPF problems.


\documentclass[11pt]{article}

\usepackage{amsfonts}
\usepackage{fancyvrb}
\usepackage{url}
\usepackage{graphicx}
\usepackage{caption}
\usepackage{subcaption}
\usepackage{dsfont}

\setlength{\oddsidemargin}{0in}
\setlength{\evensidemargin}{0in}
\setlength{\textwidth}{6.5in}
\setlength{\topmargin}{0in}
\setlength{\headsep}{0.5in}
\setlength{\textheight}{8.5in}
\setcounter{page}{1}
%\pagestyle{empty}
%\hbadness=10000

\begin{document}
\huge
\noindent
{Discrete Optimization Assignment:}
\vspace{0.25cm}

\noindent
{\bf Facility Location}
\normalsize

\section{Problem Statement}

In this assignment you will design an algorithm to solve a problem faced by distribution companies, {\em The Facility Location Problem}. A distribution company uses bulk storage facilities to provide goods to many different customers.  The goal of this problem is to determine which facilities will be the most cost effective for serving the customers.  The complexity of the problem comes from the fact that each facility has different costs and storage capabilities.\footnote{Hint: The facility location problem is closely related to the warehouse location problem discussed in the lectures.}

%\begin{figure}[h]
%        \centering
%        \begin{subfigure}[b]{8.0cm}%{0.3\textwidth}
%                \centering
%                \includegraphics[width=8cm]{figures/coloring_1.pdf}
%                \caption{A graph.}
%                \label{fig:graph:input}
%        \end{subfigure}%
%        ~ %add desired spacing between images, e. g. ~, \quad, \qquad etc.
%          %(or a blank line to force the subfigure onto a new line)
%        \begin{subfigure}[b]{8.0cm}
%                \centering
%                \includegraphics[width=8cm]{figures/coloring_2.pdf}
%                \caption{A three-coloring of the graph.}
%                \label{fig:graph:coloring}
%        \end{subfigure}
%        \caption{A Graph Coloring Example}\label{fig:graph}
%\end{figure}

\section{Assignment}

Write an algorithm to solve the facility location problem.  The problem is mathematically formulated in the following way:  there are $N = 0 \ldots n-1$ facilities to choose from and $M = n \ldots n+m-1$ customers that need to be served.  Each facility, ${\it f} \in N$ has a setup cost $s_{\it f}$ and a capacity $cap_{\it f}$.  Each customer, $c \in M$, has a demand $d_c$.  Both the facilities and customers are located in a Euclidian space, $\langle x_i,y_i \rangle \; i \in N \cup M$.  The cost to deliver goods to a particular customer $c$ from a facility ${\it f}$ is the Euclidean distance between two locations, ${\it dist}({\it f},c)$.\footnote{${\it dist}(i,j) = \sqrt{(x_{i} - x_{j})^2 + (y_{i} - y_{j})^2}$}  Lastly, all customers must be served by exactly 1 facility.  Let $a_f$ be a set variable denoting the customers assigned to facility $f$.  Then the facility location problem is formalized as the following optimization problem:
$$
\begin{array}{ll}
\mbox{minimize:} & \displaystyle \sum_{f \in N} \left( (|a_{\it f}| > 0) s_{\it f} + \sum_{c \in a_{\it f}} {\it dist}({\it f},c) \right) \\
\mbox{subject to:} & \\
     & \displaystyle \sum_{c \in a_{\it f}}  d_c \leq cap_{\it f} \;\;\; ({\it f} \in N)\\
     & \displaystyle \sum_{{\it f} \in N}  (c \in a_{\it f}) = 1 \;\;\; (c \in M)
\end{array}
$$

\clearpage
\section{Data Format Specification}

The input consists of $|N| + |M| + 1$ lines.  The first line contains two numbers, $|N|$ followed by $|M|$.
The first line is followed by $|N|$ lines, where each line encodes the facility's setup cost $s_{\it f}$, capacity $cap_{\it f}$, and the location $x_{\it f}, y_{\it f}$.  The remaining $|M|$ lines capture the customer information, where each line encodes the customer's demand, $d_c$, and location $x_c, y_c$.

\vspace{0.2cm}
\noindent
Input Format
\vspace{-0.2cm}
\begin{Verbatim}[frame=single]
|N| |M|
s_0 cap_0 x_0 y_0
s_1 cap_1 x_1 y_1
...
s_|N|-1 cap_|N|-1 x_|N|-1 y_|N|-1
d_|N| x_|N| y_|N|
d_|N|+1 x_|N|+1 y_|N|+1
...
d_|N|+|M|-1  x_|N|+|M|-1 y_|N|+|M|-1
\end{Verbatim}
%
The output has two lines.  The first line contains two values: $obj$ and $opt$.  $obj$ is the cost of the customer to facility assignment (i.e. the objective value) as a real number.  $opt$ should be $1$ if your algorithm proved optimality and $0$ otherwise.  The next line is a list of $|M|$ values in $N$ -- this is the mapping of customers to facilities.

\vspace{0.2cm}
\noindent
Output Format
\vspace{-0.2cm}
\begin{Verbatim}[frame=single]
obj opt
c_0 c_1 c_2 ... c_|M|-1
\end{Verbatim}
%
%It is essential that the value order in the solution output matches the value order of the input.  Otherwise the grader will misinterpret the output.

\clearpage
\paragraph{Examples}
%\vspace{0.1cm}
%\noindent
%(based on Figure \ref{fig:graph})

\vspace{0.2cm}
\noindent
Input Example
\vspace{-0.2cm}
\begin{Verbatim}[frame=single]
 3 4
 100 100 1065.0 1065.0
 100 100 1062.0 1062.0
 100 500 0.0 0.0
 50 1397.0 1397.0
 50 1398.0 1398.0
 75 1399.0 1399.0
 75 586.0 586.0
\end{Verbatim}

\vspace{0.2cm}
\noindent
Output Example
\vspace{-0.2cm}
\begin{Verbatim}[frame=single]
2550.013 0
1 1 0 2
\end{Verbatim}
%
This output represents the assignment of customers to facilities, $a_0 = \{2\}, a_1 = \{0,1\}, a_2 = \{3\}$.  That is, customers 0 and 1 are assigned to facility 1, customer 2 is assigned to facility 0, and customers 3 is assigned to facility 2.

\section{Instructions}

\input{instructions.tex}

%We use \texttt{stdout} for output.
%Output to other stream will be ignored (you may want to send runtime information to \texttt{stderr}). Your submission will be tested on a department linux machine. If your algorithm is a standalone program, please name it \texttt{nr},
%otherwise, please specify the compilation procedure,
%it is appreciated if you also provide a script that follows the above format to run the program.

\paragraph{Resources}
You will find several  facility location problem instances in the \texttt{data} directory provided with the handout.

%An example output file, \texttt{blabla.out}, is also provided.

%\section{Remarks}

\input{handin.tex}

\input{grading.tex}

\input{collaboration.tex}

%\paragraph{Questions} Please contact the class GTA Carleton (cjc@cs.brown.edu).

\input{warnings.tex}

%\paragraph{Hint}
%The optimal value for  \texttt{data/gc\_1000\_5} is near $85$.

\input{techReqs.tex}

\end{document}


\section{Case Study: Rössler System}

The well known Rössler system is given by the equations
\[
	\begin{array}{rcl}
		\dot x &=& -y - z \\
		\dot y &=& x + a \cdot y \\
		\dot z &=& b + z \cdot (x - c) \\
	\end{array}
\]
with parameters $a$, $b$, and $c$. For this example, $a$ and $b$
are fixed to $0.1$, while we are varying $c$.

The system has several periodic solutions for each value of $c$ with different
periodicities, though only one is stable at a time. We are interested in the origin and
branching of those solutions and, thus, drawing a bifurcation diagram using the map
\[
	\mathbf y \mapsto \{ \|\mathbf y(t)\|  \ | \ t \in [0, 2\pi), \ \mathbf y_1(t) = 0, \ \mathbf y'_1(t) > 0 \} \ .
\]
Here, $f$ denotes a single periodic solution. Note, that we use only the approximation
given by Galerkin's method.

The exploration of the bifurcations with the given tools follows roughly these steps:
\begin{enumerate}
	\item As a starting point, search for a value of $c$ such that the system has a
		stable, periodic solution and use the method described in
		\autoref{sec:initial} to find it. 4000 iterations in the transient part with step
		size of $0.01$, 120 generated intersections with the $(x=0)$-plane and tests for
		at most $30$ periods were sufficient for all initial solutions of the Rössler
		system. We started at $c=4$ with $64$ samples.
	\item Trace out the branch just by following the newly found solution in both directions
		using the predictor-corrector continuation method (\autoref{sec:cont}). The
		parameters $\kappa=0.4$, $\delta=3.0$, and $\alpha=10.0$ are a decent choice for
		the whole diagram as a good tradeoff between performance and accuracy.
	\item It is possible to detect a pitchfork bifurcation by doubling up the periodicity
		artificially. Using the described predictor-corrector method, the value
		of $c$ will eventually converge to the bifurcation point, i.e., a point with a
		singular tangent. Since the method is now stuck, reaching the doubly-periodic
		solution can be done by solving a slightly perturbed problem for a short time.
		A short perturbation of strength $0.2$ was enough to reach the doubly-periodic
		solution. Also, it might be necessary to increase the sample size due to increased
		complexity in the descending branch.
	\item Remove the perturbation and continue tracing out the bifurcation, i.e. start
		over in 1 or 2.
\end{enumerate}

\begin{figure}[!ht]
	\centering
	\subfloat[][]{\includegraphics[width=.4\textwidth]{img/roessler1a.pdf}}\quad
	\subfloat[][]{\includegraphics[width=.4\textwidth]{img/roessler1b.pdf}}\\
	\subfloat[][]{\includegraphics[width=.4\textwidth]{img/roessler1c.pdf}}\quad
	\subfloat[][]{\includegraphics[width=.4\textwidth]{img/roessler1d.pdf}}
	\caption{Tracing out the branch of solutions beginning with the solution for
	$c=4$ (a). The bifurcation point in $c \approx 5.376$ is avoided by using a permutation (b),
	and the two-periodic solutions can be traced out after removing the inaccurate values
	from before (c). Eventually, we reach (d), a widely traced out bifurcation diagram.
	Note the solutions with periodicity three and descendants, that do not originate in
	the periodicity-one branch.}
	\label{fig:reosslerseq}
\end{figure}

See figure \ref{fig:reosslerseq} for a visualization of this process, and figures \ref{fig:roesslerfull}, \ref{fig:roesslercut} for a depiction of the results.

%\begin{figure}[!ht]
	%\centering
	%\includegraphics[width=1\textwidth]{img/roessler2a.pdf}
	%\caption{The bifurcation diagram of the Rössler system for varying $c$. The
		%even-periodic solutions are colored red, the odd-periodic ones green.}
%\end{figure}
%
%
%\begin{figure}[!ht]
	%\centering
	%\includegraphics[width=1\textwidth]{img/roessler2b.pdf}
	%\caption{All found solutions for $c=\dots$ plotted into one diagram.
	%Observe how the odd-periodic and even-periodic solutions dodge since they do not
	%originate from each other.}
%\end{figure}

\newgeometry{top=0cm}

\begin{figure}
\centering\makebox[0pt]{\rotatebox{90}{\includegraphics{img/roessleroverview.png}}}
\caption{An overview of the Rössler bifurcation diagram.}
\label{fig:roesslerfull}
\end{figure}

\begin{figure}
\centering\makebox[0pt]{\rotatebox{0}{\includegraphics{img/roesslercut20.png}}}
\caption{The periodic orbits for $c=20$, together with an underlying trajectory obained through forward intergration (grey) in phase-space. The colors of the periodic solutions match the bifurcation diagram.}
\label{fig:roesslercut}
\end{figure}

\restoregeometry


% !TeX root = ./corona_contact_tracing.tex
% chktex-file 46
% !TeX spellcheck = en-GB
% !TeX encoding = utf8

\subsection{Probabilistic Health Prediction}

We model partially infected populations as a graph, where each individual (interchangeably called agent) is a node. Edges of this graph model contacts of two agents. We use graph convolution, as explained below, to update our assumptions on the current health state of all individuals.

The definition of a graph convolution~\cite{Kipf2017SemiSupervisedCW} for here is

\begin{equation}
	\label{eq:graph_convolution}
	h_{v_i}^{(l+1)} = \sum_{j\in A(i)} h_{v_j}^{(l)}
\end{equation}

with feature vector $h$ of node $i$ from iteration $(l)$ to $(l+1)$. This formulation is equivalent to the matrix formulation $h^{(l+1)} = A h^{(l)}$ with $A$ as adjacency matrix as shown in \cref{sec:consistency}. We consider here adjacency matrices without diagonal elements.

\begin{itemize}
    \item Each agent $i$ is modeled by $D$ features $h_{v_i} \in \mathbb{R}^D$. Therefore, the feature matrix, $h^{(l)}$, consists of all agents' features at time $(l)$ and is thereby of dimension $N\times D$ where there are $N$ agents in the population and each agent is described by $D$ features. A three dimensional feature space is used, $D=3$, modeling the three possible health states. The unit vectors of this space are interpreted as following:
	\begin{itemize}
		\item $\vec{e}_0$: susceptible state
		\item $\vec{e}_1$: infected state
		\item $\vec{e}_2$: recovered state
	\end{itemize}
	A uniform distribution over these possible states expresses complete uncertainty of the health state of an agent.
\end{itemize}

To accurately model the disease, there is graph contribution and an individual health contribution.

\subsubsection{Explanation of the graph contribution term}
The graph contribution models how infected agents spread the disease through contacts with susceptible agents.

\begin{equation}
    h_{v_i, m}^{(l+1)}
	=
	\underbrace{
		\sum_k \textcolor{red}{\frac{\hat{A}_{v_i, k}^{(l)}}{\sum_j \hat{A}_{v_i, j}^{(l)}}} h_{k, m}^{(l)} \textcolor{blue}{\delta_{m, e_I}}
	}_{\text{Graph}}
\end{equation}

\begin{itemize}
    \item A sum over all agents' features $h_{k,m}^{(l)}$ is weighted by the normalised infection-adjusted graph connections as shown in red.
    \item The Kronecker delta, as shown in blue, ensures that only the I feature is added as this is the only one that matters during social contacts between agents.
    \item The infection-adjusted adjacency matrix $\hat{A}$ is constructed from $A$ and $I$ which are the regular continuous adjacency matrix and the infection matrix, respectively. These three quantities are explained in the following:
    \begin{itemize}
        \item The adjacency matrix $A$ is time dependent, $A^{(l)}$, and inferred from data. In our use case, $A_{ij} = \frac{1}{dist(v_i, v_j)+\epsilon}$, hence $A_{ij}$ is large when persons $i$ and $j$ have been in contact. $\epsilon$ serves as regularization for small distances.
        \item The infection matrix is constructed as
        \begin{equation}
            I =
            \begin{pmatrix}
                0     &  0  & 0 \\
                \beta &  0  & \alpha \\
                0     &  0  & 0
            \end{pmatrix}
            =
            (I_{ij})_{i,j}
        \end{equation}
        with $i$ as the index of the host state and $j$ is the index of the contact person state. The states that we consider here are ordered as follows: susceptible, infected, recovered. $\beta$ denotes the probability of infection  after contact (also known as attack rate). $\alpha$ models the probability of being reinfected, which we assume to be zero ($\alpha=0$) based upon current medical \todo{cite!}research.
        \item $\hat{A}$, with $\hat{A}_{ij}\in [0, 1]$, is the adjacency matrix that takes the infection interactions into account and is computed as follows
        \begin{equation}
            \hat{A}_{ij} = A_{ij}\cdot \frac{ h_{v_1}^T I h_{v_2} + h_{v_2}^T I h_{v_1} }{\beta}.
        \end{equation}
        The weighted scalar product of the health states of agents $i$ and $j$ is used to evaluate whether the edge is relevant for the infection dynamics. Only when an infected person and a susceptible have contact, the edge $A_{ij}$ should be considered, otherwise it should be dropped.	The sum in the denominator comes from the fact that both, agent $i$ and $j$, can act as host during a contact. The division by $\beta$ normalises the factor to one to ensure $\hat{A}_{ij} \in [0, 1]$. Since $I$ is not symmetric, $p_a$ is a proper normalization because the sum is in $\{0, p_a\}$. Note that the fraction has the desired properties for pure $S$-, $I$- and $R$-persons.
    \end{itemize}
\end{itemize}

\subsubsection{Temporal}
% \item Explanation of the temporal term:
The transition of a persons' health state $h_{v_i}^{(l)}$ is determined by the following assumptions:
\begin{itemize}
	\item A susceptible person always stays susceptible
	\item An infected person has a probability $\gamma$, called recovery rate, to recover. The remaining probability $1-\gamma$ denotes that the person stays sick.
	\item A recovered person could have a probability to be re-infected, but we assume this to be zero. Thus a recovered person always stays recovered.
\end{itemize}
Thus the temporal transition matrix $T$ is:
\begin{equation}
	T =
	\begin{pmatrix}
		1 &     0    & 0      \\
		0 & 1-\gamma & \gamma \\
		0 &     0    & 1      \\
	\end{pmatrix}
\end{equation}
The temporal update rule based on the health status thus becomes:
\begin{equation}
	H^{(l+1)} = H^{(l)} T
\end{equation}

\subsubsection{Joint Model}

Our main propagation rule is based on the definition of a graph convolution shown in Eq.~\eqref{eq:graph_convolution} and reads as follows in component notation
\begin{equation}
	h_{v_i, m}^{(l+1)}
	=
	\underbrace{
		\sum_k \textcolor{red}{\frac{\hat{A}_{v_i, k}^{(l)}}{\sum_j \hat{A}_{v_i, j}^{(l)}}} h_{k, m}^{(l)} \textcolor{blue}{\delta_{m, e_I}}
	}_{\text{Graph}}
	+
	\underbrace{
		{(h_{v_i}^{(l)}\cdot T)}_m
	}_{\text{Temporal}}
\end{equation}
with $m$ being the index of the health state.

This propagation rule is based on the following aspects:

\begin{itemize}
	\item The propagation consists of two parts, first the graph contribution and second the temporal contribution. While the former captures the dynamics of infections based on the social contacts between agents, the former ensures that an infected agent heals over time and becomes resistant against the Corona virus.
\end{itemize}