\documentstyle[12pt,twoside,alltt,psfig]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of Proof:}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\font\BbbNormal = msbm10
\font\BbbScript= msbm7
\newfam\Bbbfam \def\Bbb{\fam\Bbbfam\BbbNormal}
\textfont\Bbbfam=\BbbNormal
\scriptfont\Bbbfam=\BbbScript
\def\Z{{\Bbb Z}}	% The integers
\def\Q{{\Bbb Q}}	% The rationals
\def\R{{\Bbb R}}	% The reals
\def\C{{\Bbb C}}	% The complex

\newcounter{lecnum}
\renewcommand{\thepage}{\thelecnum-\arabic{page}}
\renewcommand{\thesection}{\thelecnum.\arabic{section}}
\renewcommand{\theequation}{\thelecnum.\arabic{equation}}
\renewcommand{\thefigure}{\thelecnum.\arabic{figure}}
\renewcommand{\thetable}{\thelecnum.\arabic{table}}



\newcommand{\lecture}[6]{
   \pagestyle{myheadings} \thispagestyle{plain} \newpage
\setcounter{lecnum}{#1} \setcounter{page}{1} \noindent \begin{center}
\framebox{ \vbox{ \hbox to 5.8in { {\bf Advanced Algorithms
\hfill Lecture #1: #2} } \vspace{4mm} 
\vspace{2mm} \hbox to 5.8in { {\it
Lecturer: #3 \hfill Scribe: #4} } } } \end{center}
\markboth{Lecture #1: #2}{Lecture #1: #2} \vspace*{4mm} }



\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecture
%		date of the lecture
%		lecturer
%		scribe---that is you.
%
% Fill out the next line with this information !!!
\lecture{7}{April 5, 18 and 19, 1995}{Johan H{\aa}stad}{Lars Arvestad} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% {\theorem{...}}, {\lemma{...}}, {\definition{...}}, etc.
% For proofs, use \begin{proof} ... \end{proof}
%
% For figures use the following block:
%
% \begin{figure}
% \begin{center}
% \mbox{\psfig{figure=lecture-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:picture}
% \end{center}
% \end{figure}
%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\section{Factoring polynomials over the integers}
Given is a polynomial $g(x)=\sum_{i=0}^ng_ix^i, g_i\in\Z$. What is the
factorization of $G$?


A question to start with is how such a factorization looks like.
We assume
that $\gcd(g_0, \ldots, g_n)=1$, because if that is not the case, we
can always cancel that factor out, getting the polynomial in the
desired form.  Can the factors of
$g$ have rational coefficients for instance? The problem is settled
with the following lemma.

{\lemma{If $g(x)$ can be written as a product $h_1(x)h_2(x)$ then
$h_1$ and $h_2$ have integer coefficients.}}

This is disregarding such ``cheating'' as writing the factors as
$\frac{1}{7}h_1(x)\cdot 7h_2(x)$, of course.

\begin{proof}
Suppose that $h_1$ has integer coefficients with greatest common
divisor 1. If not, multiply $h_1$ with a suitable rational and divide
 $h_2$ with the same. We now claim that $h_2$ also has integer
coefficients. For contradiction, assume $h_2$ does not have integer
coefficients and that the least common denominator of the coefficients
in $h_2$ is $M$. Let $p$ be a prime factor in $M$ and consider the
following equation.
\[
M\cdot g(x)=h_1(x)\cdot Mh_2(x)
\]
The part $Mh_2(x)$ is now an integer polynomial.
If we look at this modulo $p$, we can say that $Mg(x)\equiv0$, but
 $h_1(x)\not\equiv0$ since the greatest common divider of the
coefficients of $h_1$ is 1. This also applies for $Mh_2$, so we have
reached a contradiction.
\end{proof}

Another question is how large the coefficients of $h_1$ and $h_2$ can
be. They can considerable larger than the coefficients in $g$! We can
estimate how large the coefficients of a polynomial can be in terms of
the size of the complex roots of the polynomial. Let
 $M=\max\{|g_0|,\ldots,|g_n|\}$ and
write $g$ as $g(x)=g_n\prod_{i=1}^n(x-x_i)$ where $x_i$ is the complex
roots of $g(x)=0$.

Let us estimate the magnitude of the roots.
{\lemma{$|x_i|\le2M/|g_n|$}}

\begin{proof}
The idea is to show that if $|x_i|$ is larger than the given bound,
then $g_nx^n$ is the dominant term and cannot be cancelled. Suppose
$x$ is a root for $g$. 
\begin{eqnarray*}
|g(x)|
	=\left|\sum_{i=0}^ng_ix^i\right|
	= |g_nx^n|-\left|\sum_{i=0}^{n-1}g_ix^i\right|
	\ge |g_n||x^n| - M\sum_{i=0}^{n-1}|x|^i
\end{eqnarray*}
The sum in the last term is a geometric series with quotient $>2$
if we would assume that $|x|>2M/|g_n|$. Therefore, 
\begin{eqnarray*}
|g_n||x^n| - M\sum_{i=0}^{n-1}|x|^i 
	> |g_n||x^n| - 2M|x|^{n-1}
	\ge |x|^{n-1}(|g_n||x|-2M)\ge 0
\end{eqnarray*}
which is a contradiction and the lemma holds.
\end{proof}

We can use this estimate for giving an upper bound on the sizes of the
coefficients of the factors of $g$.
Let $h_1(x)=h_1^{led}\prod_{i\in S}(x-x_i)$ where
 $h_1^{led}$ is the leading coefficient in $h_1$ and $S$ is the set of
roots of $g$ that also solve $h_1(x)=0$. We know that $h_1^{led}$
divides $g_n$, so $|h_1^{led}|\le |g_n|$.

If $h_1$ has degree $m$ then the coefficient for degree $i$ is bounded
by
$$
 h_1^{led}{m\choose i}\left(\frac{2M}{|g_n|}\right)^{m-i}\le|g_n|\cdot
 2^m\cdot\left(\frac{2M}{|g_n|}\right)^m\le(4M)^m\le(4M)^n.
$$

One idea would be to factorize modulo the upper bound we have. In other words, find $h_1, h_2\in \Z[x]$
such that $g(x)=h_1(x)h_2(x)$ and with coefficients less than $(4M)^n$. 
We could do the factorization modulo a prime $p>(4M)^n$ so we study
 $g(x)=\prod_{i=1}^s q_i(x) \pmod p$ and $h_1(x)=\prod_{i\in S}q_i(x)\pmod p$,
 $h_2(x)=\prod_{i\not\in S}q_i(x)\pmod p$. 

A straightforward algorithm would be to try $h_1=\prod_{i\in S}q_i(x)$
for every $S$ and see if $h_1$ divides $g$. This actually works
reasonable in practice, but in the worst case we will get in the order
of $n$ linear factors of $g$ modulo $p$ and this would give us $2^n$
ways of choosing $h_1$. We will give an algorithm that is polynomial
even in the worst case.

\subsection{The algorithm}
A high level description of our algorithm is as follows.
\begin{enumerate}
\item
Find factors $g(x)=h_1(x)h_2(x)$ modulo $p^k$ for some $p$ and
 $k$. Think of $p$ as small and  $k$ as large. Here $h_1$ is an
irreducibel polynomial and $h_2$ is ``the rest''. 

\item
Find a polynomial $h(x)=h_1(x)z(x)\pmod {p^k}$ where $deg(h)<deg(g)$. 
The coefficients of $h$ shall be small, say less than $M'$.

\item
Compute $gcd(g(x), h(x))$.
\end{enumerate}
Now, why would this work? We want the $gcd$ to be non-trivial and
there is a simple condition for that. Say $deg(f)=n$ and $deg(g)=m$.
\begin{lemma}
 $gcd(f(x), g(x))$ is non-trivial if and only if there is a
non-trivial solution to $f(x)h_1(x)+g(x)h_2(x)=0$ with
 $deg(h_1)<m$ and $deg(h_2)<n$.
\end{lemma}
\begin{proof}
Say $gcd(f(x), g(x))=d(x)$. Then $h_1(x)=g(x)/d(x)$ and $h_2(x)=-f(x)/d(x)$. 
Inversly, if $gcd(f(x), g(x))=1$ then every irreducible factor in $g$
divides $h_1(x)$ which in turn means that $g(x)|h_1(x)$. This is a
contradiction because $deg(h_1)\ge deg(g)$.
\end{proof}

This condition is therefore a matter of solvability of a homogenous
linear equation system and we can check this efficiently by looking at
the {\em Sylvester resultant}. 

\subsubsection{The Sylvester resultant}
Define the matrix $S$ as
\begin{eqnarray*}
&\left(
\underbrace{
\begin{array}{cccccccccc}
f_0 & f_1 & f_2 &\ldots & f_{n-1}&  f_n   &  0  & \ldots & 0 \\
0   & f_0 & f_1 &\ldots & f_{n-2}& f_{n-1}& f_n & \ldots & 0\\
\vdots &  &     &       &        &        &     &        &\\
  0 & 0   &  0  &\ldots &  f_0   & f_1    & f_2 &\ldots& f_n \\
g_0 & g_1 & g_2 &\ldots &   g_m  &   0    &  0  & \ldots & 0\\
  0 & g_0 & g_1 &\ldots & g_{m-1}& g_m    &  0  & \ldots & 0\\
\vdots &  &     &       &        &        &     &        &\\
  0 &  0  &  0  &\ldots &  g_0   & g_1    & g_2 &\ldots & g_m
\end{array}}
\right)&\\
&\mbox{$n+m$ elements}&
\end{eqnarray*}
What we want to check is wether the system 
\[
S^T\left(
\begin{array}{c}
h_1^{(0)}\\
h_1^{(1)}\\
\vdots\\
h_1^{(m-1)}\\
h_2^{(0)}\\
h_2^{(1)}\\
\vdots\\
h_2^{(n-1)}\\
\end{array}
\right) =
\left(
\begin{array}{c}
0\\
0\\
\vdots\\
0
\end{array}
\right)
\]
is solvable. 
The Sylvester resultant $R(f,g)$ is defined as the determinant of $S$
and the system is solvable by a non-trivial solution if $R(f,g)=0$. So
by the above lemma,  $gcd(f(x), g(x))$ is non-trivial if and only if
$R(f,g)=0$ and this 
applies both over the integers, modulo $p$ and modulo $p^k$.
\begin{example}
We are given polynomials $f(x)=1+2x+x^3$ and $g(x)=5+x^2$. Does there
exist polynomials $h_1(x)=h_1^0+h_1^1x$ and
 $h_2(x)=h_2^0+h_2^1x+h_2^2x^2$ such that $h_1(x)f(x)+h_2(x)g(x)=0$?
We get the linear system
\[
\left(\begin{array}{ccccc}
1 & 0 & 5 & 0 & 0\\
2 & 1 & 0 & 5 & 0\\
0 & 2 & 1 & 0 & 5\\
1 & 0 & 0 & 1 & 0\\
0 & 1 & 0 & 0 & 1
\end{array}
\right) \left(
\begin{array}{c}
h_1^0\\
h_1^1\\
h_2^0\\
h_2^1\\
h_2^2\\
\end{array}
\right) = \bar0
\]
which is solvable if \[
R(f,g)=\left|
\begin{array}{ccccc}
1 & 2 & 0 & 1 & 0\\
0 & 1 & 2 & 0 & 1\\
5 & 0 & 1 & 0 & 0\\
0 & 5 & 0 & 1 & 0\\
0 & 0 & 5 & 0 & 1
\end{array}\right|=0.
\]
In this case, $R(f,g)=46$ and the system has therefore no solution
except the zero vector.
\end{example}

We can now see that the outlined algorithm should work, because with
 $h_1(x)$ dividing both $h(x)$ and $g(x)$ modulo $p^k$, the Sylvester
resultant will be 0 modulo $p^k$ and thereby announcing that
 $gcd(h(x), g(x))$ modulo $p^k$ is non-trivial. 

We would wish that having $R(h,g)=0\pmod {p^k}$ would imply that
 $R(h,g)=0$ over the integers. This can be achieved if we choose $p$
and $k$ appropriately. There is a rough upper bound on $R(h,g)$ that
we can use. Say $m=deg(h)$ and $n=deg(g)$.
We are computing a determinant with $m$ rows of numbers
that are less than $M$ and have $n$ rows with elements smaller than $M'$. 
This give us that $|R(h,g)|\le(n+m)!M^mM'^n$. We should choose $p^k$
to be larger than this number, because $R(h,g)$ in the integers would
then be the same as modulo $p^k$.

\subsection{Finding a factorization of $g(x)$ modulo $p^k$}
The first task in the algorithm is to find factors $h_1(x)$ and
 $h_2(x)$ such that $g(x)=h_1(x)h_2(x)$ modulo some $p^k$. 
We can do that as follows.
\begin{enumerate}
\item[$(i)$] Choose $p$ such that $g(x)$ is square free modulo $p$.
\item[$(ii)$] Factorize $g(x)$ modulo $p$.
\item[$(iii)$] For $i:=1$ to $k-1$, ``lift'' the factorization modulo
 $p^i$ to modulo $p^{i+1}$. 
\end{enumerate}

We know from previous lectures how to do item $(ii)$. 
Item $(iii)$ is simplified by having $g(x)$ square free, which
explains why we do item $(i)$.
Having $g(x)$ square free is equivalent to $gcd(g, g')$ being trivial,
which in it's turn is equivalent to $R(g, g')\not=0$, so we want to
choose a $p$ that does not divide $R(g, g')$. 
We can use that $R(g, g')\le M^{2n}(2n)!$ to find such a prime
number. If the resultant would be divisible by every prime up to some $x$,
then $R(g,g')$ would be in the order of $e^x$, so
there must be a $p<\log(M^{2n}(2n)!)=2n\log M+2n\log n$
we can use, and we can find it by simply compute the resultant over
the integers and then try all small primes.
Note that we can assume $g(x)$ to be square free over the integers,
because if that was not the case, we can easily get a factor of $g(x)$
by computing $gcd(g, g')$.

\subsubsection{Hensel lifting}
The third task can be done with a procedure called Hensel lifting. We
have $g(x)=h_1^{(i)}(x)h_2^{(i)}(x)$ modulo $p^i$ and want
 $g(x)=h_1^{(i+1)}(x)h_2^{(i+1)}(x)$ modulo $p^{i+1}$. 
Consider  $h_1^{(i+1)}(x)=h_1^{(i)}(x)+p^ih_1'(x)$ 
and $h_2^{(i+1)}(x)=h_2^{(i)}(x)+p^ih_2'(x)$.
Then  $$
h_1^{(i+1)}(x)h_2^{(i+1)}(x) = h_1^{(i)}(x)h_2^{(i)}(x)
	+ h_1^{(i)}(x)p^ih_2'(x) 
	+ h_2^{(i)}(x)p^ih_1'(x)
	+ p^{2i}h_1'(x)h_2'(x)
$$ 
would hopefully equal $g(x)$ modulo $p^{i+1}$. This can be written as
the equation 
\begin{eqnarray*}
p^ig'(x) = h_1^{(i)}(x)p^ih_2'(x) + h_2^{(i)}(x)p^ih_1'(x) \bmod {p^{i+1}}
\end{eqnarray*}
if we let $p^ig'(x)=g(x) - h_1^{(i)}(x)h_2^{(i)}(x)$.
Then we can divide by $p^i$ everywhere and get
$$
h_1^{(i)}(x)h_2'(x)+h_1'(x)h_2^{(i)}(x) = g'(x) \pmod p
$$
This is a linear equation system modulo $p$ and if it is solvable,
then it is computationally easy to do that. It turns out that this
system is always solvable when $g(x)$ is square free.
There are $n+2$ unknowns in $h_1'$ and $h_2'$ so we can fix one
parameter, say the 
leading coefficient of $h_1'$, and solve.

The whole procedure of finding a factorization of $g(x)$  modulo $p^k$
involves $k$ equation systems modulo $p$ of size $n+1\times n+1$.

\subsection{Finding a small polynomial with a factor in common with $g(x)$}
We now want to do task 2 in the algorithm, finding a polynomial
 $h(x)=h_1(x)z(x)$ modulo $p^k$, $deg(h)\le n-1$, with small
coefficients. The tool here is Lov\'asz' algorithm for finding short
vectors in a lattice. Given a set of vectors $b_i$, the corresponding
lattice is defined as all integer combinatitions of these vectors
i.e.\ all vectors of the form $\sum a_ib_i, a_i\in\Z$.
To use this notation, we view our polynomials as
vectors. 

A polynomial $f(x)=\sum_{i=0}^mf_ix^i$ has a corresponding vector
 $(f_0, f_1, \ldots, f_m, 0, 0, \ldots, 0)$ in an $n$-dimensional space.
Some consequences:
\begin{eqnarray*}
xf &\leftrightarrow& (0, f_0, f_1, \ldots)\\
x^{n-m-1}f &\leftrightarrow& (0, 0, \ldots, 0, f_0, \ldots, f_m)
\end{eqnarray*}
In our application, $L_{h_1}$ is the lattice spanned by the vectors
corresponding to $x^ih_1, 0\le i\le n-m-1$ and $p^ke_i$, where $e_i$
are the unit vectors. The vectors in this lattice corresponds exactly
to the multiples of $h$ modulo $p^k$.
 If we can find a short 
vector in $L_{h_1}$, then we have found the polynomial $h$ with small
coefficients. 

Lov\'asz' algorithm finds a vector of length less than
 $2^{(n-1)/2}\lambda$ in a lattice where $\lambda$ is the length of the
shortest vector. With input vectors of length $B$, the running time
comes to $O(n^5\log B)$. (See also notes from lecture 8.)

Having the length of the shortest vector bounded by $\sqrt{n}(4M)^n$
since the coefficients are smaller than $(4M)^n$,
the length of the output vector is at worst $2^{n/2}\sqrt{n}(4M)^n\le (8M)^n$. 
This output vector can be translated into a polynomial $h$ that is a
multiple of $h_1$, but with coefficients bounded by $(8M)^n$. 
Thus if we choose $p^k>(n+m)!M^mM'^n\sim(8M)^{n^2}$ we are guaranteed
that $gcd(g,h)$ will be non-trivial and this greatest common divisor
can of course be calculated efficiently.

The length of the input vectors is in the order of $p^k\sim(8M)^{n^2}$. 
Therefore, the running time of Lov\'asz' algorithm, which also
dominates the whole factorization, comes to
 $O(n^5\cdot\log((8M)^{n^2}))=O(n^7\log M)$. This 
running time can be improved with a more careful implementation and analysis.

\begin{thebibliography}{1}
\bibitem{LeLeLo}
Lenstra, Lenstra, Lov\'asz:
\newblock{Factoring Polynomials with Rational Coefficients}
Math. Ann. 261, pp 515--534, 1982
\end{thebibliography}
\end{document}



