Iteration of Quadratic Polynomials Over Finite Fields

TL;DR

This paper investigates the iteration behavior of quadratic polynomials over finite fields, demonstrating that such sequences typically recur after a logarithmic number of steps relative to the field size, with specific results for certain polynomials.

Contribution

It provides bounds on the recurrence time of quadratic polynomial iterates over finite fields and discusses limitations of the Birthday Paradox model for cubic polynomials.

Findings

Quadratic polynomial iterates recur after O(q/log log q) steps

For X^2+1, recurrence occurs for any starting value

The Birthday Paradox model is unsuitable for X^3+c when q ≡ 2 mod 3

Abstract

For a finite field of odd cardinality $q$, we show that the sequence of iterates of $aX^2+c$, starting at $0$, always recurs after $O(q/\log\log q)$ steps. For $X^2+1$ the same is true for any starting value. We suggest that the traditional "Birthday Paradox" model is inappropriate for iterates of $X^3+c$, when $q$ is 2 mod 3.

Tables

Table 1. Table 1: Distribution of scaled cycle lengths

Prime	100019	100043
$(0,\frac{1}{10}]$	10030	9936
$(\frac{1}{10},\frac{2}{10}]$	9944	9730
$(\frac{2}{10},\frac{3}{10}]$	9992	9976
$(\frac{3}{10},\frac{4}{10}]$	10122	10232
$(\frac{4}{10},\frac{5}{10}]$	10212	10034
$(\frac{5}{10},\frac{6}{10}]$	9830	10000
$(\frac{6}{10},\frac{7}{10}]$	9902	10086
$(\frac{7}{10},\frac{8}{10}]$	9904	10012
$(\frac{8}{10},\frac{9}{10}]$	10070	9946
$(\frac{9}{10},1]$	10012	10090

Equations

$$f^j(X)=a^j\{X+b(a-1{)}^{-1}\}-b(a-1{)}^{-1}.$$

$$1-\prod _{j=0}^{N-1}\left(1-\frac{j}{q}\right)$$

$$\#f^r({\mathbb{F}}_q)={\mu }_{r}q+O(2^{4^r}\sqrt{q})$$

$${\mu }_{r+1}={\mu }_r-\frac{1}{2}{\mu }_r^2.$$

$$r\le \frac{\log \log p}{\log 2}-\frac{\log \log (A+C)}{\log 2}.$$

$$i<j\ll \frac{q}{\log \log q}.$$

$$\#f^r({\mathbb{F}}_q)={\mu }_{r}q+O(2^{4^r}\sqrt{q})$$

$$i<j\ll \frac{q}{\log \log q}.$$

$${\nu }_{r+1}={\nu }_r+1+\frac{1}{{\nu }_r-1}.$$

$${\nu }_r\le r+2+\sum _{j=1}^r{j}^{-1},(r\ge 1),$$

$${\rho }_r(m)=\#\{x\in {\mathbb{F}}_q:f^r(x)=m\}.$$

$$N(r;k):=\sum _{m\in {\mathbb{F}}_q}{\rho }_r(m{)}^k$$

$$N(r;2)=\#\{(x,y)\in {\mathbb{F}}_q^2:f^r(x)=f^r(y)\}.$$

$$f^r(X)-f^r(Y)=\left(f^{r-1}(X)+f^{r-1}(Y)\right)\left(f^{r-1}(X)-f^{r-1}(Y)\right),$$

$$f^r(X)-f^r(Y)=(X-Y)\prod _{j=0}^{r-1}\left(f^j(X)+f^j(Y)\right).$$

$$F^j(U,W)=W^D{f}^j(U/W),$$

$$\nabla (F^j(U,W)+F^j(V,W))$$

$$W^{D-1}(f^j{)}^{\prime }(U/W)=(2a{)}^j\prod _{s=0}^{j-1}{F}^s(U,W).$$

$$F^s(u,0)=a^{2^s-1}{u}^{2^s}\text{mbox}and{F}^t(v,0)=a^{2^t-1}{v}^{2^t}$$

$$N(r;2)\le q+\sum _{j=0}^{r-1}\#\{(x,y)\in {\mathbb{F}}_q^2:f^j(x)+f^j(y)\},$$

$$N(r;2)\ge q+\sum _{j=0}^{r-1}\#\{(x,y)\in {\mathbb{F}}_q^2:f^j(x)+f^j(y)\}-\sum _{0\le j\le r-1}{A}_j-\sum _{0\le i<j\le r-1}{B}_{ij},$$

$$X-Y=0\text{mbox}and{f}^j(X)+f^j(Y)=0,$$

$$f^i(X)+f^i(Y)=0\text{mbox}and{f}^j(X)+f^j(Y)=0.$$

$$f^j(y)=f^{j-i}(f^i(y))=f^{j-i}(-f^i(x))=f^j(x),$$

$$\sum _{0\le j\le r-1}{A}_j\le 2^r\text{mbox}and\sum _{0\le i<j\le r-1}{B}_{ij}\le 2^{2r}.$$

$$N(r;2)=q+\sum _{j=0}^{r-1}\#\{(x,y)\in {\mathbb{F}}_q^2:f^j(x)+f^j(y)\}+O(4^r).$$

$$|N_r-(q+1)|\le (D-1)(D-2)\sqrt{q}.$$

$$\left|\#\{(x,y)\in {\mathbb{F}}_q^2:f^j(x)+f^j(y)\}-q\right|\le D^2\sqrt{q}.$$

$$\sum _{j=0}^{r-1}\#\{(x,y)\in {\mathbb{F}}_q^2:f^j(x)+f^j(y)\}=rq+O(4^r\sqrt{q}).$$

$$N(r;2):=\sum _{m\in {\mathbb{F}}_q}{\rho }_r(m{)}^2=(r+1)q+O(4^r\sqrt{q}).$$

Full text

Iteration of Quadratic Polynomials Over Finite Fields

D.R. Heath-Brown

Mathematical Institute, Oxford

1 Introduction

Let $f(X)\in\mathbb{F}_{q}[X]$ and define the iterates $f^{j}(X)$ by setting $f^{0}(X)=X$ and $f^{j+1}(X)=f(f^{j}(X))$. Let $m\in\mathbb{F}_{q}$, and consider the sequence of values $f^{0}(m),f^{1}(m),f^{2}(m),\ldots$. Since the field $\mathbb{F}_{q}$ is finite, the sequence eventually recurs, and one enters a closed cycle. We are interested in the questions:- How long is it before one enters the cycle? How long is the cycle? In general we can construct a directed graph $\Gamma_{f}=\Gamma_{f}(\mathbb{F}_{q})$, whose vertices are the elements $m$ of $\mathbb{F}_{q}$, and with edges $(m,f(m))$. The trajectory $f^{0}(m),f^{1}(m),f^{2}(m),\ldots$ then consists of a pre-cyclic “tail”, followed by a cycle.

Linear polynomials are easily handled. When $f(X)=X+b$ one has $f^{j}(X)=X+bj$, so that if $b=0$ the cycles are singleton sets, and if $b\not=0$ then $\Gamma_{f}$ is a union of cycles of length $p$, the characteristic of the field. For linear polynomials $f(X)=aX+b$ with $a\not=0,1$ one finds that

[TABLE]

Thus $\Gamma_{f}$ consists of cycles of length ord$(a)$ together with a cycle $\{-b(a-10^{-1}\}$ of length 1.

The situation is much more interesting for higher degree polynomials, and forms the basis for Pollard’s famous “Rho Algorithm” for integer factorization [4]. If one wishes to factor $N$ the algorithm calculates successive iterates $f^{j}(m)$ and $f^{2j}(m)$ modulo $N$, until one reaches a value for which ${\rm g.c.d.}(f^{j}(m)-f^{2j}(m),N)>1$. If this highest common factor is different from $N$ then one has obtained a non-trivial factor of $N$. When $p$ is a prime divisor of $N$, the sequence of iterates modulo $p$ will have an initial segment of length $t$ say, (the “tail” of the letter rho) followed by a cycle of length $c$ say. Thus $p\mid f^{j}(m)-f^{2j}(m)$ when $j$ is the smallest multiple of $c$ for which $j>t$. In particular the first such $j$ is at most $t+c$. If $p^{\prime}$ is some other prime divisor of $N$ there will be a corresponding value $j^{\prime}$ for which $p\mid f^{j^{\prime}}(m)-f^{2j^{\prime}}(m)$. Unless the two values $j$ and $j^{\prime}$ are the same, the method will produce a nontrivial divisor ${\rm g.c.d.}(f^{j}(m)-f^{2j}(m),N)$ of $N$. The efficiency of the algorithm depends on $t$ and $c$ being small.

A crude probabilistic argument predicts that, over the field $\mathbb{F}_{q}$, the sequence $f^{0}(m),f^{1}(m),f^{2}(m),\ldots$ is likely to complete a cycle after roughly $O(q^{1/2})$ steps. This is a version of the “Birthday Paradox”. Specifically, if one imagines the sequence as taking values in $\mathbb{F}_{q}$ independently and uniformly at random, then the chance of having a repetition within $N$ steps, say, is

[TABLE]

and when $N$ is of order $\sqrt{q}$ this is roughly $1-\exp\{N^{2}/2q\}$. Thus there is a positive probability of a repetition as soon as $N\gg\sqrt{q}$.

Unfortunately there are examples in which this heuristic clearly fails. Thus if $f(X)=X^{2}$ one has $f^{j}(m)=m^{2^{j}}$, and if $m$ has odd order $r$ one gets a pure cycle of length $l$, where $l$ is the order of 2 modulo $r$. Thus if $q$ is a prime of the shape $2r+1$, with $r$ a prime for which 2 is a primitive root, then the cycle length will be $r-1=(q-3)/2$ whenever $m$ has order $r$ modulo $q$. While it is not known that infinitely many such primes $q$ exist it is certainly conjectured to be so. Thus we will expect to get cycles of length $\gg q$ for a positive proportion of initial values $m$.

A second example is provided by the polynomial $f(X)=X^{2}-2$. If $m=a+a^{-1}$ for some $a\in\mathbb{F}_{q}$, then $f^{j}(m)=a^{2^{j}}+a^{-2^{j}}$, and we have a situation similar to that described above. If $q=2r+1$ with $r$ a prime for which 2 is a primitive root, then again we will have cycles of length $\gg q$ for a positive proportion of initial values $m$.

Thirdly one can consider polynomials of the shape $f(X)=X^{3}+c$, in the case in which $q$ is a prime with $q\equiv 2\;(\text{mod}\;3)$. Here one sees that $f$ induces a permutation of $\mathbb{F}_{q}$, since $X^{3}=a$ has a unique solution in $\mathbb{F}_{q}$, for every $a\in\mathbb{F}_{q}$. If $m\in\mathbb{F}_{q}$ is given, the trajectory $f^{0}(m),f^{1}(m),\ldots$ is therefore completely cyclic, and our question merely concerns the length of the cycle. However the proportion of permutations in the symmetric group $S_{q}$ for which $m$ belongs to a cycle of given length $k$, is exactly $q^{-1}$. Thus one might expect all cycle lengths to occur equally often, and that one should get a cycle of length at least $q/2$, say, with probability around $1/2$. The numerical evidence seems to support this. For a given prime $p\equiv 2\;(\text{mod}\;3)$ and every $c=1,\ldots p-1$ we compute the length, $l(c,p)$ say, of the cycle which starts at $m=0$. We then see for how many values of $c$ the scaled cycle length $p^{-1}l(c,p)$ falls into each of the intervals $((k-1)/10,k/10]$, for $k=1,\ldots 10$. If the permutations induced by the various polynomials $X^{3}+c$ were genuinely random we would expect roughly the same number of scaled cycle lengths in each such interval. The data for the first two primes $p\equiv 2\;(\text{mod}\;3)$ beyond $10^{5}$ are presented in Table 1. The figures appear to support the random permutation model well.

The main goal of the present paper is to describe a quite different theory for the iterates of quadratic polynomials in odd characteristic, in which it is clear why the anomalous cases above must be excluded. In contrast to the situation with $f(X)=X^{3}+1$, when $f(X)=aX^{2}+bX+c$, the equation $f(x)=s$ typically has either 2 solutions or none at all, the latter case holding for roughly half the possible values of $s$ (those for which $b^{2}-4a(c-s)$ is a non-square). When $f(x)=s$ has two solutions $x=t_{1}$ and $x=t_{2}$, the equations $f(x)=t_{1}$ and $f(x)=t_{2}$ will again typically have either 2 solutions or none. In this way, considering solutions of $f^{r}(x)=m$, one sees that $\Gamma_{f}$ is potentially much more complicated than a series of cycles.

Our main result demonstrates this distinction clearly.

Theorem 1

Let $\mathbb{F}_{q}$ be a finite field of characteristic $p\not=2$, and let $f(X)=aX^{2}+c\in\mathbb{F}_{q}[X]$ with $a\not=0$. Suppose that $f^{i}(0)\not=f^{j}(0)$ for $0\leq i<j\leq r$. Then

[TABLE]

uniformly in $a$ and $c$, where the constant $\mu_{r}$ is defined recursively by taking $\mu_{0}=1$ and

[TABLE]

Moreover we have $\mu_{r}\sim 2/r$ as $r\rightarrow\infty$.

At this point we should mention some closely related work. Shao [5, Theorem 1.6] handles the case $f(X)=X^{2}+1$ by a method which generalizes readily to other quadratics. The condition in his theorem is stronger than ours (that $f^{i}(0)\not=f^{j}(0)$ for $0\leq i<j\leq r$) but an examination of the proof shows that he only needs something like our condition. His result does not include an explicit dependence on $r$. Juul, Kurlberg, Madhu and Tucker [3] handle general rational functions rather than restricting to quadratic polynomials. Their emphasis is on the reductions of a given rational function $\phi(X)\in\mathbb{Q}(X)$ modulo different primes, but they show under quite general conditions that the sum of all cycle lengths is $o(p)$ as $p\rightarrow\infty$. (See Corollary 2 below.)

Before discussing the implications of the theorem, let us examine the condition that $f^{i}(0)\not=f^{j}(0)$ for $0\leq i<j\leq r$. The critical points of a polynomial $f(X)$ are the roots $\xi$ of $f^{\prime}(X)$, and $f$ is said to be “post-critically finite” if the iterates $f^{j}(\xi)$ eventually enter a cycle, for every critical point $\xi$. In dynamics in general post-critically finite maps are a very important subclass. Of course, over a finite field every polynomial is post-critically finite. However our condition can be viewed as saying that, in an approximate sense, $f$ fails to be post-critically finite. (When $f(X)=aX^{2}+c$ the only critical point is $\xi=0$.)

Certainly the condition that $f^{i}(0)\not=f^{j}(0)$ for $0\leq i<j\leq r$ fails for the polynomials $f(X)=X^{2}$ and $f(X)=X^{2}-2$, with $i=0,j=1$ and $i=2,j=3$ respectively. Suppose next that $f$ is the reduction of a polynomial $F(X)=AX^{2}+C\in\mathbb{Z}[X]$, with $A,C>0$, then the sequence $F^{0}(0),F^{1}(0),F^{2}(0),\ldots$ is strictly monotonic, with $F^{j}(0)\leq(A+C)^{2^{j}-1}$. Thus if $p\geq(A+C)^{2^{r}}$ we cannot have $p\mid F^{j}(0)-F^{i}(0)$ with $0\leq i<j\leq r$. The condition of the theorem will therefore hold when

[TABLE]

In following this paper the reader may wish to bear in mind the archetypal example $f(X)=X^{2}+1$, for which $r\leq\tfrac{1}{2}\log\log p$ suffices.

Our main theorem above has the following immediate consequences.

Corollary 1

Let $\mathbb{F}_{q}$ be a finite field of characteristic $p\not=2$, and let $f(X)=aX^{2}+c\in\mathbb{F}_{q}[X]$ with $a\not=0$. Then $f^{i}(0)=f^{j}(0)$ for some $i,j$ with

[TABLE]

Corollary 2

Let $\mathbb{F}_{p}$ be a finite field with $p>2$ prime, and let $f(X)=aX^{2}+c\in\mathbb{F}_{q}[X]$ be the reduction of $AX^{2}+C\in\mathbb{Z}[X]$, where $A,C>0$. Then the sum of all the cycle lengths in $\Gamma_{f}$ will be $O_{A,C}(p(\log\log p)^{-1})$. Similarly the length of any pre-cyclic path in $\Gamma_{f}$ will be $O_{A,C}(p(\log\log p)^{-1})$.

The first corollary gives an unconditional bound $o(q)$ for the first recurrence in the sequence $f^{0}(0),f^{1}(0),f^{2}(0),\ldots$. The second corollary proves a similar result for arbitrary initial values for the reductions of fixed positive definite quadratic polynomials $AX^{2}+C$. Moreover it highlights the difference in behaviour between such polynomials and the cubic case $f(X)=X^{3}+1$, where the cycle lengths can sum to $q$.

To prove Corollary 1 we choose $r=[(\log\log q)/(\log 4)]-1$, so that $2^{4^{r}}\sqrt{q}\ll q/r$. Then, according to Theorem 1, we have either $f^{i}(0)=f^{j}(0)$ for some $i<j\leq r$, or $\#f^{r}(\mathbb{F}_{q})\ll q/r$. Writing the latter bound as $\#f^{r}(\mathbb{F}_{q})\leq Cq/r$ for an appropriate constant $C$ we deduce in the latter case that if $k=[Cq/r]$ then the values $f^{r}(0),f^{r+1}(0),\ldots,f^{r+k}(0)$ cannot be distinct, since they all lie in $f^{r}(\mathbb{F}_{q})$ and $k+1>Cq/r$. In either case there must therefore be acceptable values $i<j\leq r+k$. The claim then follows.

For Corollary 2 we observe as above that the condition of the theorem holds under the assumption (3). The choice $r=[(\log\log p)/(\log 4)]-1$, will satisfy (3) when $p\gg_{A,C}1$, and the theorem then yields $\#f^{r}(\mathbb{F}_{p})\ll p/r$. All cycles lie inside $f^{r}(\mathbb{F}_{p})$, giving the first assertion of the corollary. Moreover if $f^{0}(m),\ldots,f^{t}(m)$ is a pre-cyclic path then $f^{r}(m),\ldots,f^{t}(m)$ are distinct elements in $f^{r}(\mathbb{F}_{p})$, so that $t-r\ll p/r$. We then see that $t\ll r+p/r$, from which the second assertion follows.

We should explain the restriction to polynomials $aX^{2}+c$. For an arbitrary polynomial $f$, if we define $g(X):=f(X+d)-d$, then we will have $g^{j}(X)=f^{j}(X+d)-d$. Thus $\Gamma_{g}$ may be obtained from $\Gamma_{f}$ by relabelling each vertex $m$ as $m-d$. Since the two graphs are isomorphic in this sense, it suffices to study $f(X+d)-d$ for a suitably chosen $d$. In the case in which $f(X)=aX^{2}+bX+c$ (and $\mathbb{F}_{q}$ has odd characteristic) we can choose $d=-b/(2a)$ to produce a polynomial $g(X)$ of the shape $aX^{2}+c^{\prime}$. Thus we may translate our results into statements about general quadratic polynomials as follows.

Corollary 3

Let $\mathbb{F}_{q}$ be a finite field of characteristic $p\not=2$, and let $f(X)=aX^{2}+bX+c\in\mathbb{F}_{q}[X]$ with $a\not=0$. Suppose that $f^{i}(-b/(2a))\not=f^{j}(-b/(2a))$ for $0\leq i<j\leq r$. Then

[TABLE]

uniformly in $a,b$ and $c$, with the same $\mu_{r}$ as before.

In particular $f^{i}(-b/(2a))=f^{j}(-b/(2a))$ for some $i,j$ with

[TABLE]

If $q$ is prime, and $f$ is the reduction of a positive definite quadratic polynomial $AX^{2}+BX+C\in\mathbb{Z}[X]$, then the sum of all the cycle lengths in $\Gamma_{f}$ will be $O_{A,B,C}(q(\log\log q)^{-1})$. Similarly the length of any pre-cyclic path in $\Gamma_{f}$ will be $O_{A,B,C}(q(\log\log q)^{-1})$.

In much the same way one can show that it would suffice to prove our theorem for polynomials $f(X)=X^{2}+d$. One could then deduce the corresponding result for $aX^{2}+d/a$ by considering iterates of $g(X):=a^{-1}f(aX)$.

Theorem 1 gives us an asymptotic formula $\#f^{r}(\mathbb{F}_{q})\sim\mu_{r}q$. We proceed to give a probabilistic argument showing why one might expect this, and how the recurrence relation (2) arises. When $r=0$ we have $\#f^{0}(\mathbb{F}_{q})=q$, so that $\mu_{0}=1$. Suppose now that we have a relation $\#f^{r}(\mathbb{F}_{q})\sim\mu_{r}q$. We will use an inductive argument to produce the corresponding result for $f^{r+1}$.

To have $m\in f^{r+1}(\mathbb{F}_{q})$ it is necessary and sufficient that $m\in f(\mathbb{F}_{q})$ and that $n\in f^{r}(\mathbb{F}_{q})$ for at least one solution $n$ of $f(x)=m$. Since $\mathbb{F}_{q}$ contains $(q+1)/2$ squares one has $m\in f(\mathbb{F}_{q})$ in exactly $(q+1)/2$ cases, and except for the value $m=f(0)$ there will then be precisely two possible values of $n$. Let these be $n_{1}$ and $n_{2}$. If the probability of these lying in $f^{r}(\mathbb{F}_{q})$ were $\mu_{q}$ each, independently, one might expect that the probability of at least one being in $f^{r}(\mathbb{F}_{q})$ should be $2\mu_{q}-\mu_{q}^{2}$, by the inclusion-exclusion principle. It would then follow that $m$ belongs to $f^{r+1}(\mathbb{F}_{q})$ with probability around $\tfrac{1}{2}(2\mu_{q}-\mu_{q}^{2})$. One would therefore produce an asymptotic expression $\#f^{r+1}(\mathbb{F}_{q})\sim\mu_{r+1}q$ with $\mu_{r+1}$ as in (2).

We next explain why $\mu_{r}\sim 2r^{-1}$, as claimed in Theorem

1. Writing $\nu_{r}=2/\mu_{r}$ we see that $\nu_{0}=2$ and

[TABLE]

An easy induction then shows that $\nu_{r}\geq r+2$ for all $r\geq 0$, whence $\nu_{r+1}\leq\nu_{r}+1+1/(r+1)$. Another induction shows that

[TABLE]

so that $\nu_{r}\leq r+3+\log r$ for $r\geq 1$. Together with the lower bound $\nu_{r}\geq r+2$ this shows that $\nu_{r}\sim r$ and hence $\mu_{r}\sim 2/r$.

Acknowledgments The author would particularly like to extend his thanks to Giacomo Micheli, for a number of interesting conversations introducing the author to the subject of polynomial iteration. Joe Silverman also provided a number of helful comments. Thanks are also due to Tim Browning, for elucidating a technical point in Section 3, to Maksym Radziwiłł  for some preliminary computational results, and to Ben Green, Rafe Jones, Tom Tucker and Michael Zieve for some useful references.

2 A Second Moment Calculation

Fundamental to our treatment of Theorem 1 will be moments of the functions

[TABLE]

Our first task is to estimate the moments

[TABLE]

for $r=0,1,2,\ldots$ and $k=1,2,\ldots$. Trivially we have $\rho_{0}(m)=1$ for all $m$ so that $N(0;k)=q$ for every $k$. Moreover it is also clear that $N(r;1)=q$ for every $r$.

Before moving to the general situation it may be helpful to think first about the case $k=2$, for which

[TABLE]

The equation $f^{r}(X)-f^{r}(Y)=0$ defines a curve in $\mathbb{A}^{2}$. An absolutely irreducible curve $C$ over $\mathbb{F}_{q}$ will have $q+O_{C}(\sqrt{q})$ points, by Weil’s “Riemann Hypothesis”. However our curve is far from being irreducible.

Indeed

[TABLE]

whence a trivial induction produces

[TABLE]

Thus we obtain $r+1$ factors. However it is not immediately clear when polynomials of the form $f^{j}(X)+f^{j}(Y)$ are absolutely irreducible over $\mathbb{F}_{q}$.

In general, suppose that $\phi(X,Y)$ is a polynomial of degree $D$, over a field $K$, and let $\Phi(U,V,W)=W^{D}\phi(U/W,V/W)$ be the corresponding form. If $\Phi$ factors as $\Phi_{1}\Phi_{2}$ over the algebraic completion $\overline{K}$ then there will necessarily be triple $(u,v,w)\not=(0,0,0)\in\overline{K}^{3}$ such that $\Phi_{1}(u,v,w)=\Phi_{2}(u,v,w)=0$. For any such triple we then have $\nabla\Phi=\Phi_{1}\nabla\Phi_{2}+\Phi_{2}\nabla\Phi_{1}=\mathbf{0}$. This gives us a simple criterion for absolute irreducibility, which is sufficient, though not necessary: If $\nabla\Phi$ vanishes only at the origin in $\overline{K}^{3}$, then $\Phi$ must be absolutely irreducible.

We apply this criterion to $f^{j}(X)+f^{j}(Y)$. Writing $D=2^{j}$ for convenience, and

[TABLE]

we have

[TABLE]

If $f(X)=aX^{2}+c$ then $(f^{j})^{\prime}(X)=2af^{j-1}(X)(f^{j-1})^{\prime}(X)$. It then follows by induction that

[TABLE]

In particular, if $\nabla(F^{j}(u,w)+F^{j}(v,w))$ vanishes, then there are indices $s,t\leq j-1$ for which $F^{s}(u,w)=F^{t}(v,w)=0$. Since

[TABLE]

we see that $w=0$ would imply $u=v=w=0$, which is excluded. We then see that we would have $f^{s}(x)=f^{t}(y)=0$ for some $x,y\in\overline{K}$ such that $f^{j}(x)+f^{j}(y)=0$. However $f^{j}(x)=f^{j-s}(f^{s}(x))=f^{j-s}(0)$, and similarly for $f^{j}(y)$. It follows that if $f^{j}(X)+f^{j}(Y)$ fails to be absolutely irreducible, then $f^{j-s}(0)+f^{j-t}(0)=0$ for some pair of non-negative integers $s,t\leq j-1$. If $s=t$ then since $\mathbb{F}_{q}$ has odd characteristic we have $f^{j-s}(0)=0=f^{0}(0)$ with $1\leq j-s\leq j$. Otherwise $f^{j-s+1}(0)=f^{j-t+1}(0)$ with distinct positive integers $j-s+1,j-t+1\leq j+1$. Since Theorem 1 assumes that the values $f^{0}(0),f^{1}(0),\ldots,f^{r}(0)$ are distinct we therefore conclude that the polynomial $f^{j}(X)+f^{j}(Y)$ is irreducible over the algebraic completion $\overline{\mathbb{F}_{q}}$, for every $j<r$.

We are now ready to estimate $N(r;2)$. In view of (4) and (5) we have

[TABLE]

there being $q$ solutions to $x-y=0$. To get a corresponding lower bound we may use the inclusion-exclusion principle to show that

[TABLE]

where $A_{j}$ is the number of common solutions to

[TABLE]

and $B_{ij}$ is the number of common solutions to

[TABLE]

However if $f^{j}(x)+f^{j}(y)=0$ with $x=y$ then $f^{j}(x)=0$, which has at most $2^{j}$ solutions. Thus $A_{j}\leq 2^{j}$. Similarly, if $(x,y)$ were to lie on two distinct curves $f^{j}(X)+f^{j}(Y)=0$ and $f^{i}(X)+f^{i}(Y)=0$ with $0\leq i<j\leq r-1$, then

[TABLE]

since $f^{j-i}$ is an even polynomial. We would then have $2f^{j}(x)=0$ so that $x$, and similarly $y$, would be a root of $f^{j}$. There are therefore at most $2^{j}$ choices for $x$, and since $y$ then satisfies $f^{i}(y)=-f^{i}(x)$ there are at most $2^{i}$ choices of $y$ for each possible $x$. Thus $B_{ij}\leq 2^{j+i}$. It follows that

[TABLE]

We therefore conclude that

[TABLE]

It remains to count points on the curves $f^{j}(X)+f^{j}(Y)=0$. We have already shown that these are absolutely irreducible, and indeed nonsingular, under the assumptions of Theorem 1. If we write $N_{r}$ for the number of projective points on the curve, and $D=2^{j}$ for its degree, then Weil’s “Riemann Hypothesis” tells us that

[TABLE]

There are at most $D$ points at infinity, so that

[TABLE]

Finally, summing for $0\leq j\leq r-1$ we find that

[TABLE]

We may therefore summarize the conclusions of this section as follows.

Lemma 1

Under the assumptions of Theorem 1 we have

[TABLE]

3 Higher Moments — Irreducible Curves

We now develop the ideas of the previous section to estimate $N(r;k)$ for $k\geq 3$. Here $N(r;k)$ is the number of solutions of

[TABLE]

in $\mathbb{F}_{q}$. These equations define a curve, but, as in the previous section, it is far from being an irreducible curve. Our task in this section is to identify the absolutely irreducible components, and to show that they are all defined over $F_{q}$.

In view of (5), for any solution of (7) and any pair of distinct indices $1\leq i,j\leq k$, there is a corresponding

[TABLE]

such that $\phi(x_{i},x_{j};d)=0$, where

[TABLE]

If there is more than one choice for $d(i,j)$ we choose the smallest.

We now make the following definition.

Definition 1

A “$(D,k)$-graph” is a weighted graph on $k$ vertices, for which any edge $ij$ has integral weight in the range $[-1,D]$. If some edge has weight equal to $D$ we say that we have a “strict $(D,k)$-graph”. If there is an edge between every pair of vertices we say we have a “complete $(D,k)$-graph”.

Thus each solution of (7) produces a complete $(D,k)$-weighted graph. We now introduce the following further definition.

Definition 2

Let $G$ be a complete $(D,k)$-graph. Then we say $G$ is “proper” if, whenever $a,b,c$ are distinct vertices, with $d(a,b)\leq d(a,c)\leq d(b,c)$, then either $d(a,b)=d(a,c)=d(b,c)=-1$ or $d(a,b)<d(a,c)=d(b,c)$.

We then have the following lemma.

Lemma 2

The graph associated to a solution of (7) is proper.

To prove the claim, observe firstly that if $d(a,b)=d(a,c)=-1$, then $x_{a}=x_{b}$ and $x_{a}=x_{c}$, whence $x_{a}=x_{c}$, so that $d(b,c)=-1$. Next we show that one cannot have $d(a,b)=d(a,c)\geq 0$. Writing $d=d(a,b)=d(a,c)$ this would imply that $f^{d}(x_{a})=-f^{d}(x_{b})$ and $f^{d}(x_{a})=-f^{d}(x_{c})$, whence

[TABLE]

The factorization (5) would then show that $\phi(x_{b},x_{c};e)=0$ for some $e<d\leq d(b,c)$. This however is impossible, since $d(b,c)$ was chosen minimally.

To complete the proof of the claim we show that if

[TABLE]

then $d(a,c)=d(b,c)$. In view of (5) the relation $\phi(x_{a},x_{b};d(a,b))=0$ would imply $f^{d(a,c)}(X_{a})-f^{d(a,c)}(X_{b})=0$. Since

[TABLE]

this would show that $f^{d(a,c)}(X_{b})+f^{d(a,c)}(X_{c})=0$ and the minimal choice of $d(b,c)$ then produces $d(b,c)\leq d(a,c)$, giving the required conclusion. This now establishes the lemma in full.

Thus each solution of (7) is associated to a unique proper weighted graph, such that

[TABLE]

However there is considerable redundancy in the equations (8). To investigate this we begin with the following result.

Lemma 3

Let $G$ be a proper strict $(D,k)$-graph, with $D\geq 0$. Then there is a unique partition $\{1,\ldots,k\}=A\cup B$ into non-empty sets $A$ and $B$ such that $d(a,b)=D$ when $a\in A$ and $b\in B$, while $d(i,j)<D$ whenever $i,j\in A$ or $i,j\in B$.

Firstly it is easy to see that such a partition must be unique. For if $A^{\prime}\cup B^{\prime}$ were a different partition then, after relabeling if necessary, we could find indices $i,j\in A$ with $i\in A^{\prime}$ and $j\in B^{\prime}$. We would then have both $d(i,j)<D$ (because $i,j\in A$) and $d(i,j)=D$ (because $i\in A^{\prime}$ and $j\in B^{\prime}$). This contradiction shows that such partitions are unique.

In order to show the existence of a suitable partition we fix a pair $i_{0},j_{0}$ with $d(i_{0},j_{0})=D$, and let

[TABLE]

Then $i_{0}\in A$ and $j_{0}\in B$, so that neither set is empty. If $a$, say, were in $A\cap B$, then

[TABLE]

contradicting Definition 2. For any $a\in\{1,\ldots,k\}$ Definition 2 shows that we must have either $d(a,i_{0})=D$ or $d(a,j_{0})=D$, so that $A\cup B$ is a partition of $\{1,\ldots,k\}$.

If $a_{1},a_{2}\in A$ had $d(a_{1},a_{2})=D$ then the triple $a_{1},a_{2},j_{0}$ would contradict Definition 2. Thus $d(a_{1},a_{2})<D$, and similarly $d(b_{1},b_{2})<D$ when $b_{1},b_{2}\in B$. Finally, if $a_{1}\in A$ then $d(a_{1},j_{0})=D$ if $a_{1}=i_{0}$. Otherwise Definition 2 applied to the triple $a_{1},i_{0},j_{0}$ shows that $d(a_{1},j_{0})=D$, since $d(a_{1},i_{0})<D$. Thus $d(a,j_{0})=D$ for all $a\in A$. Now, if $b\in B$ with $b\not=j_{0}$, Definition 2 applied to the triple $a,b,j_{0}$ shows that $d(a,b)=D$, since $d(b,j_{0})<D$. Hence $d(a,b)=D$ whenever $a\in A$ and $b\in B$. This completes the proof of the lemma.

We now show how a complete $(D,k)$-graph can be generated by a smaller graph.

Definition 3

Let $G$ be a complete $(D,k)$-graph, and suppose $G_{0}$ is a subgraph of $G$ with the same set of vertices but fewer edges. We then say that $G_{0}$ “generates” $G$ if $G=G_{n}$ for some $n$, where $G_{h+1}$ is obtained from $G_{r}$ by the following procedure:

Take three distinct vertices $a,b,c$ for which the edges $ab$ and $bc$ belong to $G_{r}$ but $ac$ does not, and for which either $d(a,b)=d(b,c)=-1$ or $d(a,b)<d(b,c)$. Then $G_{h+1}$ is obtained from $G_{h}$ by adding the edge $ac$ with weight $d(a,c)=d(b,c)$.

For our purposes it is not necessary to know whether, using a different sequence of edge additions, $G_{0}$ might generate two different complete $(D,k)$-graphs. All we need to know is whether there exist some sequence of edge additions resulting in $G$.

To motivate the definition we consider the ideal $I_{h}\subseteq\mathbb{F}_{q}[X_{1},\ldots,X_{k}]$ generated by those polynomials $\phi(X_{i},X_{j};d(i,j))$ for which the edge $ij$ is in $G_{h}$. Then trivially we have $I_{h}\subseteq I_{h+1}$, since $I_{h+1}$ is formed from $I_{h}$ by the addition of one further generator $\phi(X_{a},X_{c},d(a,c))$. However, if $d(a,b)=d(b,c)=-1$ in the procedure in Definition 3 we have

[TABLE]

and

[TABLE]

Hence if $d(a,c)=-1$ then

[TABLE]

so that $I_{h+1}=I_{h}$. Alternatively, if $d(a,c)=d(b,c)>d(a,b)$ in the procedure in Definition 3, we have

[TABLE]

Here we have $\phi(X_{a},X_{b};d(a,b))\mid f^{d(b,c)}(X_{a})-f^{d(b,c)}(X_{b})$ by (5), since $d(a,b)<d(b,c)$. Hence $\phi(X_{a},X_{c},d(a,c))$ is in the ideal generated by $\phi(X_{a},X_{b},d(a,b))$ and $\phi(X_{b},X_{c},d(b,c))$. We therefore see again that $I_{h+1}=I_{h}$. It follows that if $G$ is the proper complete $(D,k)$-graph associated to a system of equation (8), and $G$ is generated by $G_{0}$, then the system (8) has the same solutions as the smaller system

[TABLE]

We now introduce the small graphs we shall use.

Definition 4

A $(D,k)$-graph is said to be a “chain” if there is a permutation $\sigma\in S_{k}$ such that the edges are precisely the $k-1$ pairs

[TABLE]

and, for any $s<t\leq k-1$, the maximum of

[TABLE]

is either $-1$ or is attained at only one point.

We then have the following result.

Lemma 4

For any complete $(D,k)$-graph $G$ there is a chain $(D,k)$-graph $G_{0}$ which generates $G$.

We prove this by induction on $D$. If $D=-1$ we may take $G_{0}$ to consists of the edges $(1,2),\ldots,(k-1,k)$ with weights $-1$, which clearly generates $G$. Now assume the result is true for complete $(d,k)$ graphs with $d\leq D-1$. If $G$ is not a strict $(D,k)$-graph the conclusion is immediate from the induction hypothesis.

Thus we assume that $G$ is a strict complete $(D,k)$ graph with $D\geq 0$, so that Lemma 3 applies. Let $G_{A}$ be the restriction of $G$ to the vertices in $A$, so that $G_{A}$ is a complete $(D-1,m)$-graph, where $m=\#A$. The induction hypothesis then shows that there is a chain graph $G_{1}$ say, which generates $G_{A}$, in which one re-orders the vertices in $A$ as $i_{1},\ldots,i_{m}$ so as to satisfy the chain property in Definition 4. Similarly if $G_{B}$ is the restriction of $G$ to the vertices in $B$, we can obtain a subgraph $G_{2}$ of $G_{B}$ which is a chain, and which generates $G_{B}$. If $n=\#B$ there will again be an appropriate ordering $j_{1},\ldots,j_{n}$ of the indices in $B$.

We then take $G_{0}$ to be the graph with vertices $1,\ldots,k$ whose edges are the edges of $G_{A}$, the edges of $G_{B}$, and the additional edge $i_{m},j_{1}$. Moreover we permute the vertices into the order $i_{1},\ldots,i_{m},j_{1},\ldots,j_{n}$. We claim firstly that this ordering makes $G_{0}$ a chain, and secondly that $G_{0}$ generates $G$.

To verify that $G_{0}$ is a chain we consider a sequence of consecutive pairs of the vertices from the sequence $i_{1},\ldots,i_{m},j_{1},\ldots,j_{n}$. If the sequence is entirely contained in the first $m$ terms the required chain property follows from that for $G_{1}$, and similarly if all the elements are taken from the last $n$ terms. However if one of the pairs is the edge $i_{m},j_{1}$ it suffices to note that this edge has weight $D$ while all other edges have weight at most $D-1$.

To check that $G_{0}$ generates $G$ we note that $G_{1}$ generates $G_{A}$ and $G_{2}$ generates $G_{B}$. Thus $G_{0}$ certainly generates the graph $G^{*}$ containing the edges of $G_{A}$, the edges of $G_{B}$ and the edge $i_{m},j_{1}$. Hence it suffices to show that $G_{*}$ generates $G$. Let $ij$ be an edge of $G$ which is not already an edge in $G^{*}$. Then, according to Lemma 3 we may assume that $i\in A$ and $j\in B$, and that $d(i,j)=D$. Applying the procedure in Definition 3 to the triple $i,i_{m},j_{1}$ we see that the edge $i,i_{m}$ is in $G^{*}$, since $i,i_{m}\in A$, and the edge $i_{m},j_{0}$ is also in $G^{*}$, by definition. Moreover $d(i,i_{m})<D=d(i_{m},j_{1})$. Thus the edge $i,j_{1}$ can be generated from $G^{*}$, with weight $d(i,j_{1})=d(i_{m},j_{1})=D$. We may then apply the procedure in Definition 3 to the triple $j,j_{1},i$. This time the edge $j,j_{1}$ is in $G^{*}$, since $j,j_{1}\in B$, and the edge $j_{1},i$ can be generated from $G^{*}$, as we have just shown. Moreover we have $d(j,j_{1})<D=d(j_{1},i)$, so that the edge $ji$ can also be generated from $G^{*}$, and is given weight $D$, as required. This completes the proof of the lemma.

As an immediate consequence of Lemma 4 we have the following.

Lemma 5

After a suitable relabelling of the variables, any solution to the equations (7) satisfies some system of equations of the type

[TABLE]

with $-1\leq d_{i}\leq k-1$. Moreover, if $1\leq i<j\leq k-1$, then the maximum of $d_{i},\ldots,d_{j}$ is either $-1$ or occurs at only one point.

We call a system of equations of the above type a “chain system”. The system defines a variety in $\mathbb{A}^{k}$. We set $\Phi(X,Y,Z;-1)=X-Y$ and

[TABLE]

so that the corresponding projective variety is given by

[TABLE]

The importance of the chain property is demonstrated by the following result.

Lemma 6

Suppose that $f^{i}(0)\not=f^{j}(0)$ for $0\leq i<j\leq r$. Then, for a chain system, the variety $\mathcal{C}$ is a nonsingular complete intersection. Hence $\mathcal{C}$ is an absolutely irreducible curve over $\mathbb{F}_{q}$, with degree at most $2^{(k-1)(r-1)}$.

To prove that $\mathcal{C}$ is a nonsingular complete intersection we need to show that the vectors $\nabla\Phi(x_{i},x_{i+1},x_{0};d_{i})$ are linearly independent at any point of $\mathcal{C}$. Suppose to the contrary that

[TABLE]

If the $c_{i}$ are not all zero we take $s$ to be the smallest index with $c_{s}\not=0$, and $t$ to be the largest index with $c_{t}\not=0$, so that

[TABLE]

The entries of this vector are labelled by the variables $X_{0},\ldots,X_{k}$, and one sees that the entry corresponding to $X_{s}$ is just $c_{s}(\partial/\partial x_{s})\Phi(x_{s},x_{s+1},x_{0};d_{s})$. We therefore conclude that $(\partial/\partial x_{s})\Phi(x_{s},x_{s+1},x_{0};d_{s})=0$, and similarly that $(\partial/\partial x_{t+1})\Phi(x_{t},x_{t+1},x_{0};d_{t})=0$. In particular we must have $d_{s},d_{t}\geq 1$. However

[TABLE]

in the notation (6). We therefore see that $F^{i}(x_{s},x_{0})=0$ for some index $i$ in the range $0\leq i\leq d_{s}-1$, and similarly $F^{j}(x_{t+1},x_{0})=0$ for some $j$ with $0\leq j\leq d_{t}-1$.

We next show that $x_{0}$ cannot vanish. If, on the contrary, we had $x_{0}=0$ then the relation $F^{i}(x_{s},x_{0})=0$ would yield $x_{s}=0$. In general, if $x_{i}=x_{0}=0$, then the relation $\Phi(x_{i},,x_{i+1},x_{0};d_{i})=0$ implies $x_{i+1}=0$, while $\Phi(x_{i-1},,x_{i},x_{0};d_{i-1})=0$ implies $x_{i-1}=0$. Thus, using both forwards and backwards induction we would have $x_{i}=0$ for all $i$, which is impossible.

We may therefore assume that $x_{0}=1$, taking us back to the affine situation. Thus we have $f^{i}(x_{s})=0$ and $f^{j}(x_{t+1})=0$ with $0\leq i<d_{s}$ and $0\leq j<d_{t}$. Since $d_{s}\geq 1$ the chain property shows that the maximum of $d_{s},d_{s+1},\dots,d_{t}$ occurs at only one point, $d_{u}=D$, say. Since $i<d_{s}\leq D$ we have $f^{D}(x_{s})=f^{D-i}(f^{i}(x_{s}))=f^{D-i}(0)$. Similarly we have $f^{D}(x_{t+1})=f^{D-j}(0)$. If $s\leq h<u$ then $d_{h}<D$, whence $\phi(X,Y;d_{h})\mid f^{D}(X)-f^{D}(Y)$. Thus $f^{D}(x_{h})=f^{D}(x_{h+1})$ for $s\leq h<u$. It follows that $f^{D}(x_{u})=f^{D}(x_{s})=f^{D-i}(0)$. Similarly, when $u<h\leq t$ we have $f^{D}(x_{h})=f^{D}(x_{h+1})$, whence $f^{D}(x_{u+1})=f^{D}(x_{t+1})=f^{D-j}(0)$. However $\phi(x_{u},x_{u+1};D)=0$ with $D\geq 1$, whence $f^{D}(x_{u})+f^{D}(x_{u+1})=0$. As in the previous section we therefore conclude that $f^{D-i}(0)+f^{D-j}(0)=0$ for some pair of non-negative integers $i,j<D$. This leads either to $f^{D-i}(0)=0$ (if $i=j$) or $f^{D}(0)=f^{D+i-j}(0)$ (if $i<j$, say). In either case we contradict the assumption of Theorem 1, since $D\leq r$. This completes the proof that $\mathcal{C}$ is a nonsingular complete intersection.

The remainder of the lemma is now straightforward. In general a nonsingular complete intersection is necessarily absolutely irreducible, with degree equal to the product of the degrees of the defining forms, see Browning and Heath-Brown [1, Lemma 3.2] for details. In our case $\Phi(X_{i},X_{i+1},X_{0};d_{i})$ has degree at most $2^{r-1}$, since $d_{i}\leq r-1$, and the result follows.

4 Higher Moments — Counting Points, And Counting Curves

In this section we will firstly estimate the number of points on each curve $\mathcal{C}$, and then compute the number of such curves that the variety given by (7) produces. Putting these results together will give us an asymptotic formula for $N(r;k)$.

Since $\mathcal{C}$ is an absolutely irreducible curve defined over $\mathbb{F}_{q}$, Weil’s “Riemann Hypothesis” yields

[TABLE]

where $g$ is the genus of $\mathcal{C}$. In general, if $\mathcal{C}$ is an irreducible non-degenerate curve of degree $d$ in $\mathbb{P}^{k}$ (with $k\geq 2$), then according to the Castelnuovo genus bound [2], one has

[TABLE]

where $d-1=m(k-1)+\varepsilon$ with $0\leq\varepsilon<k-1$. This implies in particular that $g\leq(d-1)(d-2)/2$ irrespective of the degree of the ambient space in which $\mathcal{C}$ lies. We therefore deduce that

[TABLE]

since $\mathcal{C}$ has degree at most $2^{kr}$.

By inclusion-exclusion we see that

[TABLE]

For distinct curves of degree at most $2^{kr}$ we have

[TABLE]

by Bézout’s Theorem. Hence if there are $\mathcal{N}(r;k)$ different curves $\mathcal{C}$ we see that

[TABLE]

We can get a crude bound for $\mathcal{N}(r;k)$ by observing that there are $k!$ possible permutations describing a chain system, and for each of the $k-1$ edges one has $-1\leq d(\sigma(i),\sigma(i+1))\leq r-1$. Thus if $r\geq 1$ we have

[TABLE]

Applying (10) we then deduce the following result.

Lemma 7

If there are $\mathcal{N}(r;k)$ different curves $\mathcal{C}$ then

[TABLE]

Our task now is to investigate the number $\mathcal{N}(r;k)$. We have seen that each curve $\mathcal{C}$ arises from a proper $(r-1,k)$-graph. We proceed to show that different graphs $G,G^{\prime}$ cannot produce the same curve $\mathcal{C}$. The graphs $G$ and $G^{\prime}$ must differ on at least one edge, so that one would have both $\phi(X_{i},X_{j};d)=0$ and and $\phi(X_{i},X_{j};d^{\prime})=0$ on $\mathcal{C}$. If $d>d^{\prime}$ say, then $f^{d}(X_{i})+f^{d}(X_{j})=0$ and $f^{d}(X_{i})-f^{d}(X_{j})=0$, whence $f^{d}(X_{i})=0$ for all points on the curve. It then follows that $f^{r}(X_{i})=f^{r-d}(0)$. However $\mathcal{C}$ is an irreducible component of the curve (7), whence $f^{r}(X_{h})=f^{r}(X_{i})=f^{r-d}(0)$ for every index $h$. This gives us a contradiction since it would produce imply that $\mathcal{C}$ has dimension zero.

We therefore need to count proper $(r-1,k)$ graphs. For a proper strict $(D,k)$-graph, Lemma 3 produces a unique partition $A\cup B$, for which the corresponding graphs $G_{A}$ and $G_{B}$ will be proper $(D-1,k)$-graphs. There are $\mathcal{N}(r;k)-\mathcal{N}(r-1;k)$ proper strict $(r-1,k)$-graphs. Moreover the number of partitions $\{1,\ldots,k\}=A\cup B$ with $a=\#A<\#B=b$ is

[TABLE]

while, for even $k$, the number with $a=b=k/2$ is

[TABLE]

We then see that

[TABLE]

for $r\geq 1$ and $k\geq 2$. Indeed, since $\mathcal{N}(r;1)=1$ for every $r$ we see that this holds for $k=1$ too. If we now define $\mathcal{N}(r;0)=1$ for all $r\geq 0$ the above formula simplifies to give

[TABLE]

We therefore define power series

[TABLE]

for each $r\geq 1$. Since (11) yields $\mathcal{N}(r;k)/k!\leq(r+1)^{k}$ we see that this converges absolutely for $|X|<(r+1)^{-1}$. Now, after checking that we have the correct coefficient for $X^{0}$, we arrive at

[TABLE]

Since $\mathcal{N}(0;k)=1$ for all $k$ we have $E(X;0)=\exp(X)$, so that the coefficients $\mathcal{N}(r;k)$ can easily be calculated in general. Moreover it is clear by induction that

[TABLE]

with non-negative real coefficients $\nu(r;m)$ summing to 1. We then see that

[TABLE]

We clearly have have absolute convergence for small $X$, and we may rearrange to get

[TABLE]

We therefore deduce that

[TABLE]

We also see that the coefficient $\nu(r;0)$ satisfies the recurrence

[TABLE]

for $r\geq 1$, with $\nu(0;0)=0$. We can then check that $\mu_{r}=1-\nu(r;0)$ has the initial value $\mu_{0}=1$ and satisfies the recurrence $\mu_{r}=\mu_{r-1}-\mu_{r-1}^{2}/2$ described in Theorem 1.

Recall that our goal is to estimate

[TABLE]

Since the equation $f^{r}(x)=m$ has at most $2^{r}$ solutions we will always have $0\leq\rho_{r}(m)\leq 2^{r}$, whence

[TABLE]

Setting

[TABLE]

we then have

[TABLE]

Our plan is to substitute the approximate value for $N(k;r)$ given by Lemma 7.

We first investigate the contribution from the main term $\mathcal{N}(k,r)(q+1)$. This produces

[TABLE]

However the identity (12) shows that the inner sum vanishes for $1\leq m\leq 2^{r}$, and takes the value 1 for $m=0$. Thus the main term for (13) is just $\nu(r;0)(q+1)=(1-\mu_{r})(q+1)$, producing the leading term $\mu_{r}q$ in (1).

For the proof of Theorem 1 it remains to handle the contribution to (13) arising from the error term in Lemma 7, which will be

[TABLE]

with

[TABLE]

However it is clear from (12) that

[TABLE]

if $T\geq 0$, so that

[TABLE]

say. This suffices for Theorem 1.