Computable one-way functions on the reals

Abstract

A major open problem in computational complexity is the existence of a one-way function, namely a function from strings to strings which is computationally easy to compute but hard to invert. Levin (2023) formulated the notion of one-way functions from reals (infinite bit-sequences) to reals in terms of computability, and asked whether partial computable one-way functions exist. We give a strong positive answer using the hardness of the halting problem and exhibiting a total computable one-way function.

1 Introduction

A function is one-way if it is computationally easy to compute but hard to invert, even probabilistically. Many aspects of computer science such as computational complexity, pseudorandom generators and digital signatures rely on one-way functions from strings (finite binary sequences) to strings [13]. Although their existence is not known, much research effort has focused on their implications and relations with other fundamental problems in computation [10, 9, 7]. Recent research has established strong connections between one-way functions and Kolmogorov complexity [19, 14, 15, 8].

Levin [2] asked for the existence of a one-way function from reals (infinite binary sequences) to reals, which he defined in terms of computability and randomized computations. These are partial computable functions $f$ in the standard sense of computable analysis [6] which preserve algorithmic randomness and for each randomized oracle Turing machine $M$ the probability that $M$ inverts $f$, namely $f(M(y))=y$, is zero.

We give a strong positive answer to Levin’s question:

Theorem.

There exists a total surjective one-way function $f$.

The hardness of inverting $f$ is based on the hardness of the halting problem $\emptyset^{\prime}$, which is used in the definition of $f$ via an effective enumeration of it. This allows to establish a stronger property: every randomized continuous inversion of $f$ computes $\emptyset^{\prime}$.

We also show that one-way functions are highly non-injective.

Theorem.

The inverse images $f^{-1}(y)$ of one-way functions $f$ are uncountable perfect sets almost everywhere in their range.

Finally we construct ‘nearly injective’ functions which are hard to invert deterministically or almost surely.

Independently Gács [5] constructed $f:\subseteq 2^{\omega}\to 2^{\omega}$ which is ‘one-way’ with respect to the domain of $f$ instead of its range:

• $f$ is partial computable with domain of positive uniform measure

• $\mu\big{(}{\{\hskip 0.85355pt{(x,r)}:{f(g(f(x),r))=f(x)}\hskip 0.85355pt\}}\big{)}=0$ for each partial computable $g$.

This is a weaker condition since it is met by (a) some functions that do not map to any randoms; (b) all total random-preserving one-way functions.

2 Preliminaries

Let $\mathbb{N}$ be the set of natural numbers, represented by $n,m,i,j,t,s$. Let $2^{\omega}$ be the set of reals, represented by variables $x,y,z,v,w$, and $2^{<\omega}$ the set of strings which we represent by $\sigma,\tau,\rho$. We index the bits $x(i)$ of $x$ starting from $i=0$. The prefix of $x$ of length $n$ is $x(0)x(1)\cdots x(n-1)$ and is denoted by $x\upharpoonright_{n}$. Let $\preceq$, $\prec$ denote the prefix and strict prefix relation between two strings or a string and a real. Similarly $\succeq,\succ$ denote the suffix relations and $\sigma\mid\tau$ denote $\sigma\not\preceq\tau\ \wedge\ \tau\not\preceq\sigma$. Given $x,y$ let

$$x\oplus y:=z z(2n)=x(n) z(2n+1)=y(n)$$ where and

and similarly for strings of the same length.

The Cantor space is $2^{\omega}$ with the topology generated by the basic open sets

$$\llbracket\sigma\rrbracket:=\{\hskip 0.85355pt{z\in 2^{\omega}}:{\sigma\prec z}\hskip 0.85355pt\}\hskip 8.5359pt\textrm{for $\sigma\in 2^{<\omega}$}$$

which we call neighborhoods. Let $\mu$ be the uniform measure on $2^{\omega}$, determined by $\mu(\llbracket\sigma\rrbracket)=2^{-|\sigma|}$. Probability in $2^{\omega}\times 2^{\omega}$ is reduced to $2^{\omega}$ via the measure-preserving $(x,y)\mapsto x\oplus y$. Classes of $\mu$-measure 0 are called null.

A tree is a downward $\preceq$-closed $T\subseteq 2^{<\omega}$, is pruned if every $\sigma\in T$ has an extension in $T$ and is perfect if every $\sigma\in T$ has two extensions $\tau|\rho$ in $T$. A real is a path through $T$ if all of its prefixes belong to $T$.

Computability. We use the standard notion of relative computability in terms of Turing machines with oracles from $2^{\omega}$. Turing reducibility $x\leq_{T}z$ means that $x$ is computable from $z$ (is $z$-computable) and is a preorder calibrating $2^{\omega}$ according to computational power in the Turing degrees.

Effectively open sets are of the form $\bigcup_{i}\llbracket\sigma_{i}\rrbracket$ where $(\sigma_{i})$ is computable, and are also known as $\Sigma^{0}_{1}$ classes. Effectively closed sets, also known as $\Pi^{0}_{1}$ classes, are the complements of $\Sigma^{0}_{1}$ classes and are representable as the set of paths through a computable tree. The paths through a computable pruned tree form a $\Delta^{0}_{1}$ or decidable class. If $(\sigma_{n,i})$ is computable then

• classes $V_{n}=\bigcup_{i}\llbracket\sigma_{n,i}\rrbracket$ are called uniformly $\Sigma^{0}_{1}$

• $\bigcap_{n}V_{n}$ is called a $\Pi^{0}_{2}$ class and its complement is a $\Sigma^{0}_{2}$ class.

A Martin-Löf test is a uniformly $\Sigma^{0}_{1}$ sequence $(V_{n})$ such that $\mu(V_{n})\leq 2^{-n}$. A real $x$ is random if $x\notin\bigcap_{n}V_{n}$ for any Martin-Löf test $(V_{n})$. A real is weakly $n$-random if it is in every $\Sigma^{0}_{n}$ set of measure $1$. Relativizations to oracle $r$ define $\Sigma^{0}_{1}(r)$ classes, weakly $r$-random reals and so on.

Computable analysis. A Turing machine with a one-way infinite output tape and access to an oracle from $2^{\omega}$ may eventually print an infinite binary sequence, hence defining a partial map from reals to reals. This standard notion of computability of real functions [17] is almost as old as computability itself [6] and implies that computable real functions are continuous. Let

• $f:\subseteq 2^{\omega}\to 2^{\omega}$ denote that $f$ is a partial map from $2^{\omega}$ to $2^{\omega}$

• $f(x)\downarrow,f(x)\uparrow$ denote that $f(x)$ is defined or undefined.

Let $f(x;n)$ denote bit $n$ of $f(x)$ and

$$f(2^{\omega}):=\{\hskip 0.85355pt{y}:{\exists x,\ h(x)=y}\hskip 0.85355pt\}\hskip 8.5359pt\textrm{and}\hskip 8.5359ptf^{-1}(y):=\{\hskip 0.85355pt{x}:{f(x)=y}\hskip 0.85355pt\}$$

denote the range and the inverse images of $f$. If $f$ is total, the sets

$$f^{-1}(\llbracket\sigma\rrbracket):=\{\hskip 0.85355pt{x}:{\sigma\prec f(x)}\hskip 0.85355pt\}$$

are closed if $f$ is continuous and effectively closed if $f$ is computable.

Definition 2.1.

We say $\hat{f}$ is a representation of $f:\subseteq 2^{\omega}\to 2^{\omega}$ if

• $\hat{f}:2^{<\omega}\to 2^{<\omega}$  and $\hat{f}(\lambda)=\lambda$ and $\big{(}{\sigma\preceq\tau\ \Rightarrow\ \hat{f}(\sigma)\preceq\hat{f}(\tau)}\big{)}$

• $f(x)\downarrow\iff\lim_{\tau\prec x}\hat{f}(\tau)=f(x)\iff\lim_{\tau\prec x}|{\hat{f}(\tau)}|=\infty$

where $\lim_{\tau\prec x}\hat{f}(\tau)=z$ means $\big{(}{\forall\tau\prec x,\ \hat{f}(\tau)\prec z\ \wedge\ \ \lim_{\tau\prec x}|{\hat{f}(\tau)}|=\infty}\big{)}$.

Every continuous $f:\subseteq 2^{\omega}\to 2^{\omega}$ has a representation $\hat{f}$. If $f$ is partial computable then it has a computable representation $\hat{f}$. We fix an effective coding of the graphs of representations $\hat{f}$ into $2^{\omega}$ and identify representations with their real codes.

There is no canonical way to assign a representation to each continuous $f$: by [16] there are continuous $f$ such that for each representation $z$ of $f$ there exists another one of lesser Turing degree. So it is not possible to classify the computational power of continuous functions in the Turing degrees. This will not be an issue in our results as we only need:

Definition 2.2.

We say that a continuous $f:\subseteq 2^{\omega}\to 2^{\omega}$ computes $z$ and denote it by $z\leq_{T}f$ if every representation of $f$ computes $z$.

3 Deterministic inversions

Given continuous $f:\subseteq 2^{\omega}\to 2^{\omega}$ we say that $g:\subseteq 2^{\omega}\to 2^{\omega}$:

• inverts $f$ on $y$ if $g(y)\downarrow$ and $f(g(y))\downarrow=y$

• is an inversion of $f$ if it is continuous and inverts $f$ on all $y\in f(2^{\omega})$.

Injective total computable functions $f$ have a computable inversion. This is because each $f^{-1}(y)$ is representable as the set consisting of the unique path through a $y$-computable pruned tree. In general:

Theorem 3.1.

If $f:2^{\omega}\to 2^{\omega}$ is total computable, then there exists partial computable $g:\subseteq 2^{\omega}\to 2^{\omega}$ which inverts $f$ in $E:=\{\hskip 0.85355pt{y}:{|{f^{-1}(y)}|=1}\hskip 0.85355pt\}$.

Proof..

Let $\hat{f}$ be a computable representation of $f$. By compactness

$$\forall k\ \ \exists n_{0}\ \ \forall n>n_{0}\ \ \forall\sigma\in 2^{n}:\ |{\hat{f}(\sigma)}|>k.$$ (1)

We define a computable representation $\hat{g}$ of the required $g$. Let

$$B_{\tau}^{n}:=\{\hskip 0.85355pt{\rho\in 2^{n}}:{\hat{f}(\rho)\preceq\tau}\hskip 0.85355pt\}\hskip 8.5359pt\textrm{and}\hskip 8.5359ptp_{\tau}:=\max\{\hskip 0.85355pt{n}:{|{B_{\tau}^{n}}|=1}\hskip 0.85355pt\}$$

and define $\hat{g}(\tau)$ to be the unique string in $B^{p_{\tau}}_{\tau}$. Then $p_{\tau}$ is nondecreasing, $\hat{g}$ is $\preceq$-monotone and by (1) both $p_{\tau},\hat{g}$ are computable. So $\hat{g}$ is a computable representation of a partial computable $g:\subseteq 2^{\omega}\to 2^{\omega}$.

If $\lim_{\tau\prec y}p_{\tau}=m<\infty$ then there are distinct $\sigma,\tau\in 2^{m}$ such that there are arbitrarily long suffixes $\rho$ of both $\sigma$ and $\tau$ with $f(\rho)\prec y$, so $|{f^{-1}(y)}|>1$ by compactness and continuity. Hence

$$|{f^{-1}(y)}|=1\ \Rightarrow\ \lim_{\tau\prec y}p_{\tau}=\infty$$

which means that $\lim_{n}|{\hat{g}(y\upharpoonright_{n})}|=\infty$ and $g(y)\downarrow$ for $y\in E$. By the definition of $\hat{g}$ we also have $\forall\tau\prec y,\ \hat{f}(\hat{g}(\tau))\preceq\tau$ so $f(g(y))=y$ for $y\in E$. ∎

Corollary 3.2.

Every total computable injection $f:2^{\omega}\to 2^{\omega}$ has a total computable inversion $g:2^{\omega}\to 2^{\omega}$.

Continuously inverting computable non-injective functions is usually hard as they require the commitment of a neighborhood in $f(2^{\omega})$ into an area in the domain of $f$, potentially forbidding the inversion of $f$ on a different neighborhood of $f(2^{\omega})$. We show how to produce such hardness in a simple modification of the zero function by encoding the truth of a $\Sigma^{0}_{1}$ statement into all continuous inversions of a computable $f:2^{\omega}\to 2^{\omega}$.

Example. Let $\exists s,\ E(s)$ be a $\Sigma^{0}_{1}$ formula where $E(s)$ is a computable predicate where $E(s)$ holds for at most one $s$.

We show that any inversion of the computable

$$f(x):=\begin{cases}0^{s}\ x(0)\ 0^{\omega}&\textrm{if $E(s)$;}\\ 0^{\omega}&\textrm{otherwise.}\end{cases}$$

encodes the answer to whether $\exists s,\ E(s)$ holds.

Let $g$ be a continuous inversion of $f$ and $x:=g(0^{\omega})$. Since $0^{\omega}\in f(2^{\omega})$:

1. $x$ is defined and $\exists u,\ g(\llbracket 0^{u}\rrbracket)\subseteq\llbracket x(0)\rrbracket$

2. $E(s)$ holds iff $0^{s}10^{\omega}\in f(2^{\omega})$ iff $g(0^{s}10^{\omega})\downarrow$.

We show that $u$ is an upper bound on the $s$ that can satisfy $E(s)$.

By (b) and the continuity of $g$, if $E(s)$ holds:

• $\hat{g}$ would have to map $0^{s}10^{t}$ into $\llbracket 1\rrbracket$ for some $t$

• this cannot be done if $\hat{g}$ has already mapped $0^{s+1}$ into $\llbracket 0\rrbracket$.

If $x(0)=0$, by (a) we have $\forall s>u,\ \neg E(s)$

If $x(0)=1$, since $f(x)=f(g(0^{\omega}))=0^{\omega}$ we have $\forall s,\ \neg E(s)$.

Since $u,x(0)$ is are decidable in $g$, the same is true of $\exists s,\ E(s)$. $\blacktriangleleft$

Let $\langle\cdot,\cdot\rangle:\mathbb{N}\times\mathbb{N}\to\mathbb{N}$ be a computable bijection with $\langle n,s\rangle\geq s$ and let $(\emptyset^{\prime}_{s})$ be an effective enumeration of $\emptyset^{\prime}$ without repetitions. We show:

Theorem 3.3.

There exists a total computable $f:2^{\omega}\to 2^{\omega}$ such that any inversion of $f$ computes $\emptyset^{\prime}$.

Proof..

We show that the following $f$ has the required properties:

$$f(x;\langle n,s\rangle):=\begin{cases}x(n)&n\in\emptyset^{\prime}_{s+1}-\emptyset^{\prime}_{s}\\ 0&\rm{otherwise.}\end{cases}$$

Clearly $f$ is total computable. Assuming that $g:\subseteq 2^{\omega}\to 2^{\omega}$ is an inversion of $f$, we show how to decide if $n\in\emptyset^{\prime}$ using the computation of $g(0^{\omega};n)$.

Since $y:=0^{\omega}$ is in the range of $f$, the real $x:=g(y)$ is defined. Let $u_{n}$ be the oracle-use in the computation of $g(y;n)$. It remains to show that

1. $x(n)=1\ \Rightarrow\ n\not\in\emptyset^{\prime}$

2. if $x(n)=0$ then $n\in\emptyset^{\prime}\iff n\in\emptyset^{\prime}_{u_{n}}$.

If $x(n)=1$ then $\forall s\ f(x;\langle n,s\rangle)=y(\langle n,s\rangle)=0$ so $\forall s\ n\not\in\emptyset^{\prime}_{s}$ and $n\not\in\emptyset^{\prime}$.

For (b) assume that $x(n)=0$ and for a contradiction let $n\in\emptyset^{\prime}_{s}-\emptyset^{\prime}_{s-1}$ for some $s>u_{n}$. Then there exists $z\in 2^{\omega}$ with

$$z=f(0^{n-1}1\ast 0^{\omega})=0^{\langle n,s\rangle}10^{\omega}.$$

Since $u_{n}$ is the oracle-use of $g(y;n)\downarrow$ and $\langle n,s\rangle\geq s$ we get $0^{u_{n}}\prec z$ and:

$$g(z;n)=g(0^{\omega};n)=x(n)=0.$$

This gives the contradiction $1=z(\langle n,s\rangle)=f(g(z),\langle n,s\rangle)=g(z;n)=0$. ∎

4 Randomized inversions

A computable function may be invertible probabilistically by $g:\subseteq 2^{\omega}\times 2^{\omega}\to 2^{\omega}$ where the secondary argument is viewed as access to a randomness source with respect to $\mu$. Then ‘$g$ inverts $f$’ is the probabilistic event that $g(y,z)\downarrow$, $f(g(y,z))\downarrow=y$ on randomly chosen $y\in f(2^{\omega})$, $z\in 2^{\omega}$.

According to Levin [2] a partial computable $f:\subseteq 2^{\omega}\to 2^{\omega}$ is one-way if no partial computable $g:\subseteq 2^{\omega}\times 2^{\omega}\to 2^{\omega}$ inverts $f$ with positive probability. The case $\mu(f(2^{\omega}))=0$ is trivial so it is excluded.

Definition 4.1 (Levin [2]).

Given $f:\subseteq 2^{\omega}\to 2^{\omega}$, $g:\subseteq 2^{\omega}\times 2^{\omega}\to 2^{\omega}$ let

$$L_{f}(g):=\{\hskip 0.85355pt{(y,r)}:{g(y,r)\downarrow\ \wedge\ \ f(g(y,r))\downarrow=y}\hskip 0.85355pt\}\subseteq 2^{\omega}\times 2^{\omega}.$$

Given $f,g$ the probability that $g$ inverts $f$ refers to $\mu(L_{f}(g))$. If $f$ is partial computable we say that $g$ is a randomized inversion of $f$ if $\mu(L_{f}(g))>0$. We say that $f$ is one-way if $\mu(f(2^{\omega}))>0$ and it does not have any partial computable randomized inversion.

Following Levin [2], instead of $\mu(f(2^{\omega}))>0$ we can require the stronger condition that one-way functions $f$ are random-preserving:

Definition 4.2.

We say that $f:\subseteq 2^{\omega}\to 2^{\omega}$ is random-preserving if $f(x)$ is random for each random $x$ in the domain of $f$.

We define random-preserving surjections based on:

Lemma 4.3.

If $p:\mathbb{N}\to\mathbb{N}$ is a computable injection then $f:2^{\omega}\to 2^{\omega}$ with $f(x;n):=x(p(n))$ is a total computable random-preserving surjection.

Proof..

Clearly $f$ is total computable. For each $y$ the real

$$x(m):=\begin{cases}y(n)&\textrm{if $m=p(n)$}\\ 0&\rm{otherwise.}\end{cases}$$

satisfies $f(x)=y$. So $f$ is surjective. Let $(V_{i})$ be a universal Martin-Löf test with prefix-free and uniformly c.e. members $V_{i}\subseteq 2^{<\omega}$. Then

$$f^{-1}(\llbracket V_{i}\rrbracket)=\bigcup_{\tau\in V_{i}}f^{-1}(\llbracket\tau\rrbracket)$$

Since $p$ is computable the sets $f^{-1}(\llbracket V_{i}\rrbracket)$ are uniformly $\Sigma^{0}_{1}$. Also

$$f^{-1}(\llbracket\tau\rrbracket)=\{\hskip 0.85355pt{x}:{\forall i<|\tau|,\ x(p(i))=\tau(i)}\hskip 0.85355pt\}$$

and since $p$ is injective, $\mu(f^{-1}(\llbracket\tau\rrbracket))=2^{-|\tau|}=\mu(\llbracket\tau\rrbracket)$. So

$$\mu\big{(}{f^{-1}(\llbracket V_{i}\rrbracket)}\big{)}\leq\sum_{\tau\in V_{i}}\mu\big{(}{f^{-1}(\llbracket\tau\rrbracket)}\big{)}=\sum_{\tau\in V_{i}}\mu\big{(}{\llbracket\tau\rrbracket}\big{)}=\mu(V_{i}).$$

and $(f^{-1}(\llbracket V_{i}\rrbracket))$ is a Martin-Löf test. Since the reals $f$-map** into $V_{i}$ are in $f^{-1}(\llbracket V_{i}\rrbracket)$ and $(V_{i})$ is universal, every real $f$-map** to a non-random real is non-random. So $f$ is random-preserving. ∎

4.1 Construction of a one-way function

We build on Theorem 3.3 using the Lebesgue density theorem ([4, Theorem 1.2.3]). The density of $x\in 2^{\omega}$ in a measurable $G\subseteq 2^{\omega}$ is

$$\lim_{n\to\infty}\frac{\mu(\llbracket x\upharpoonright_{n}\rrbracket\cap G)}{\mu(\llbracket x\upharpoonright_{n}\rrbracket)}$$

assuming that the limit exists. Lebesgue’s density theorem states that the $\mu$-measure of the $x$ with density $1$ in $G$ is $\mu(G)$.

Theorem 4.4.

There is a total computable surjective random-preserving one-way function.

Proof..

Let $f(x;\langle n,s\rangle):=x(p(\langle n,s\rangle))$ where

$$p(\langle n,s\rangle):=\begin{cases}2n&\textrm{if $n\in\emptyset^{\prime}_{s+1}-\emptyset^{\prime}_{s}$}\\[3.69899pt] 2\langle n,s\rangle+1&\rm{otherwise}\end{cases}$$

so $f$ is total computable and

$$f(x;\langle n,s\rangle):=\begin{cases}x(2n)&\textrm{if $n\in\emptyset^{\prime}_{s+1}-\emptyset^{\prime}_{s}$}\\[3.69899pt] x(2\langle n,s\rangle+1)&\rm{otherwise.}\end{cases}$$

Since $p$ is a computable injection, Lemma 4.3 implies that $f$ is a total computable random-preserving surjection. It remains to show that $f$ is one-way. Given partial computable $g:\subseteq 2^{\omega}\times 2^{\omega}\to 2^{\omega}$ and

$$L:=\{\hskip 0.85355pt{y\oplus r}:{f(g(y,r))=y}\hskip 0.85355pt\},$$

to show that $g$ is not a randomized inversion of $f$ it suffices to show that:

$$\big{(}{y\oplus r\in L\ \textrm{ and $y\oplus r$ has density $1$ in $L$}}\big{)}\ \Rightarrow\ \emptyset^{\prime}\leq_{T}y\oplus r.$$ (2)

Indeed by [3, 18] we know that $\mu(\{\hskip 0.85355pt{z}:{\emptyset^{\prime}\leq_{T}z}\hskip 0.85355pt\})=0$, so the Lebesgue density theorem would then imply $\mu(L)=\mu(L_{f}(g))=0$.

Assuming the left-hand-side of (2) we fix $k$ such that

$$t\geq k\ \Rightarrow\ \frac{\mu(\llbracket(y\oplus r)\upharpoonright_{2t})\rrbracket)\cap L)}{\mu(\llbracket(y\oplus r)\upharpoonright_{2t})\rrbracket)}>\frac{1}{2}.$$ (3)

and it remains to show $\emptyset^{\prime}\leq_{T}y\oplus r$.

To decide if $n\in\emptyset^{\prime}$, since $g$ is partial computable and $g(y,r)\downarrow$, we can compute $g(y,r;2n)$ and the oracle-use $u$ of this computation. We show:

$$n\in\emptyset^{\prime}\iff n\in\emptyset^{\prime}_{\max\{u,k\}}.$$ (4)

For a contradiction assume that $n\in\emptyset^{\prime}_{s+1}-\emptyset^{\prime}_{s}$ for some $s>\max\{u,k\}$.

By the definition of $f$, $L$ and $u$ respectively, for all $z,w$ we have

1. $f(g(z,w);\langle n,s\rangle)=g(z,w;p(\langle n,s\rangle))=g(z,w;2n)$

2. $z\oplus w\in L\ \Rightarrow\ f(g(z,w);\langle n,s\rangle)=z(\langle n,s\rangle)$

3. $(z,w)\in\llbracket y\upharpoonright_{s}\rrbracket\times\llbracket r\upharpoonright_{s}\rrbracket\ \Rightarrow\ g(z,w;2n)=g(y,r;2n)$.

Combining (a), (b), (c) we get

$$z(\langle n,s\rangle)=g(y,r;2n)\hskip 8.5359pt\textrm{for all $z\oplus w\in\llbracket(y\oplus r)\upharpoonright_{2s}\rrbracket\cap L$}$$

so all reals in $\llbracket(y\oplus r)\upharpoonright_{2s}\rrbracket\cap L$ agree on position $2\langle n,s\rangle$. This contradicts (3) since $\langle n,s\rangle\geq s>k$. So (4) holds, which completes the proof of (2). ∎

Since $\mu(\{\hskip 0.85355pt{v}:{v\oplus w\geq_{T}\emptyset^{\prime}}\hskip 0.85355pt\})=0$ for $w\not\geq_{T}\emptyset^{\prime}$ ([4, Corollary 8.12.2]) the proof of Theorem 4.4 shows a stronger statement. Let $x\oplus y\oplus w:=(x\oplus y)\oplus w$.

Theorem 4.5.

There is a total computable random-preserving surjection $f:2^{\omega}\to 2^{\omega}$ such that every randomized inversion of $f$ computes $\emptyset^{\prime}$.

Proof..

Let $f,L$ be as in Theorem 4.4 and let $z$ be a real that computes a randomized inversion $g:\subseteq 2^{\omega}\times 2^{\omega}\to 2^{\omega}$ of $f$. Then $\mu(L)>0$ and

$$\big{(}{y\oplus r\in L\ \textrm{ and $y\oplus r$ has density $1$ in $L$}}\big{)}\ \Rightarrow\ \emptyset^{\prime}\leq_{T}y\oplus r\oplus z$$

as in the proof of Theorem 4.4. By the Lebesgue density theorem

$$\mu(\{\hskip 0.85355pt{x}:{x\oplus z\geq_{T}\emptyset^{\prime}}\hskip 0.85355pt\})>0.$$

Since $\mu(\{\hskip 0.85355pt{v}:{v\oplus w\geq_{T}\emptyset^{\prime}}\hskip 0.85355pt\})=0$ for $w\not\geq_{T}\emptyset^{\prime}$ we get $z\geq_{T}\emptyset^{\prime}$. ∎

Proposition 4.6.

There is a random-preserving computable $f:2^{\omega}\to 2^{\omega}$ such that for each $z$, $g:\subseteq 2^{\omega}\times 2^{\omega}\to 2^{\omega}$ satisfying one of:

1. $z$ is weakly 2-random and $g$ is partial computable

2. $z$ is weakly 1-random and $g$ is total computable

the probability that $g$ inverts $f$ on $z$ is 0.

Proof..

Let $f,L$ be as in Theorem 4.4 and

$$B_{q}\ :=\ \{\hskip 0.85355pt{y}:{\mu(\{\hskip 0.85355pt{r}:{y\oplus r\in L}\hskip 0.85355pt\})>q}\hskip 0.85355pt\}$$

so $\mu(L)=\mu(B_{q})=0$ for each $q>0$. Let $z$ be such that:

$$\mu(\{\hskip 0.85355pt{r}:{z\oplus r\in L}\hskip 0.85355pt\})>q>0$$

for a rational $q>0$ so $z\in B_{q}$. If $g$ is partial computable then $B_{q}$ is a null $\Pi^{0}_{2}$ class, so $z$ is not weakly 2-random. If $g$ is total computable then $B_{q}$ is a null $\Pi^{0}_{1}$ class, so $z$ is not weakly 1-random. ∎

We do not know if Proposition 4.6 (i) holds for incomplete random $z$.

Question.

Characterize the class of reals where arbitrary computable random-preserving $f:2^{\omega}\to 2^{\omega}$ can be inverted with positive probability.

4.2 Injectivity and one-way functions

We consider the extent to which one-way functions fail to be injective. Our observations hold more generally with respect to inversions on one variable.

Definition 4.7 (Weakly one-way).

Given $f,h:\subseteq 2^{\omega}\to 2^{\omega}$ let

$$L_{f}(h):=\{\hskip 0.85355pt{y}:{h(y)\downarrow\ \wedge\ \ f(h(y))\downarrow=y}\hskip 0.85355pt\}.$$

A partial computable $f:\subseteq 2^{\omega}\to 2^{\omega}$ is weakly one-way if $\mu(f(2^{\omega}))>0$ and $\mu(L_{f}(h))=0$ for each partial computable $h:\subseteq 2^{\omega}\to 2^{\omega}$.

Clearly one-way functions are weakly one-way.

Corollary 4.8.

Every (weakly) one-way $f$ is almost nowhere injective.

Proof..

Let $f:2^{\omega}\to 2^{\omega}$ be computable and $E_{f}:=\{\hskip 0.85355pt{y}:{|{f^{-1}(y)}|=1}\hskip 0.85355pt\}$.

Assuming that $\mu(E_{f})>0$ it suffices to show that $f$ is not weakly one-way. By Theorem 3.1 there exists partial computable $h$ with domain $E_{f}$ and $\forall y\in E_{f},\ f(h(y))=y$. Then $f$ is not weakly one-way. ∎

We show that the inverse images $f^{-1}(y)$ of one-way functions $f$ are perfect uncountable sets almost everywhere in their range. For this proof, note that Theorem 3.1 relativizes to any neighborhood $\llbracket\sigma\rrbracket$.

Theorem 4.9.

If $f:2^{\omega}\to 2^{\omega}$ is (weakly) one-way then $f^{-1}(y)$ is uncountable for almost every $y\in f(2^{\omega})$.

Proof..

Given total computable $f:2^{\omega}\to 2^{\omega}$ with $\mu(D)>0$ where

$$D:=\{\hskip 0.85355pt{y}:{\textrm{$f^{-1}(y)$ is not perfect}}\hskip 0.85355pt\}$$

we show that $f$ is not weakly one-way. Since countable sets of reals are not perfect, this implies the statement.

For each $\sigma$ let $f_{\sigma}$ be the restriction of $f$ to $\llbracket\sigma\rrbracket$ and apply Theorem 3.1 to get a partial computable $g_{\sigma}$ which inverts $f_{\sigma}$ on $E_{\sigma}:=\{\hskip 0.85355pt{y}:{|{f_{\sigma}^{-1}(y)}|=1}\hskip 0.85355pt\}$.

If $y\in D$, then the closed set $f^{-1}(y)$ has an isolated path, so $\exists\sigma,\ y\in E_{\sigma}$. So

$$D\subseteq\bigcup_{\sigma}E_{\sigma}$$

and since $\mu(D)>0$, there exists $\sigma$ with $\mu(E_{\sigma})>0$. By the choice of $g_{\sigma}$:

$$\mu(\{\hskip 0.85355pt{y}:{g_{\sigma}(y)\downarrow\ \wedge\ \ f(g_{\sigma}(y))=y}\hskip 0.85355pt\})>0$$

so $f$ is not weakly one-way. ∎

5 Injectivity and hardness of inversion

We have seen in §3 that injective computable $f:2^{\omega}\to 2^{\omega}$ have computable inversion. This fails for partial computable functions.

Theorem 5.1.

There exists a partial computable injection $f:\subseteq 2^{\omega}\to 2^{\omega}$ such that any inversion of $f$ computes $\emptyset^{\prime}$.

Proof..

Let $f:\subseteq 2^{\omega}\to 2^{\omega}$ be defined by $f(x)\simeq p(x)\oplus q(x)$ where

$$p(x;\langle n,s\rangle):= \begin{cases}x(n)&\textrm{if $n\in\emptyset^{\prime}_{s+1}-\emptyset^{\prime}_{s}$}\\[2.84544pt] 0&\textrm{otherwise}\end{cases}$$

$$q(x;n):\simeq \begin{cases}0&\textrm{if $\forall i\leq n,\ \big{(}{x(i)=0\ \vee\ i\in\emptyset^{\prime}}\big{)}$}\\[2.84544pt] \uparrow&\textrm{otherwise}\end{cases}$$

and $\simeq$ denotes equality when both sides are defined. Then

• $f$ is partial computable

• $f(x)\downarrow$ iff $x$ (as a set of natural numbers) is a subset of $\emptyset^{\prime}$

• if $f(x)\downarrow$, $f(z)\downarrow$ and $x\neq z$ then $x,z$ can only differ on positions in $\emptyset^{\prime}$.

In the latter case $p(x)\neq p(z)$ and $f(x)\neq f(z)$, so $f$ is injective.

Given partial $g:\subseteq 2^{\omega}\to 2^{\omega}$ such that

$$f(g(y\oplus z))=y\oplus z\hskip 8.5359pt\textrm{ for all $y\oplus z\in f(2^{\omega})$}$$

we show $g\geq_{T}\emptyset^{\prime}$. Since $f(0^{\omega})\downarrow=0^{\omega}$ and $f$ is injective, $g(0^{\omega})\downarrow=0^{\omega}$.

To decide if $n\in\emptyset^{\prime}$ let $u$ be the oracle-use of $g(0^{\omega};n)=0$. We claim that

$$n\in\emptyset^{\prime}\iff n\in\emptyset^{\prime}_{u}.$$

Assuming otherwise, there is $s>u$ such that $n\in\emptyset^{\prime}_{s+1}-\emptyset^{\prime}_{s}$. Then

$$f(0^{n}10^{\omega})\downarrow=y\oplus z\hskip 8.5359pt\textrm{where $y=0^{\langle n,s\rangle}10^{\omega}$ and $z=0^{\omega}$.}$$

Since $f$ is injective and $f(g(y\oplus z))=y\oplus z$, we have $g(y\oplus z)=0^{n}10^{\omega}$.

But $y,0^{\omega}$ agree on positions $\langle n,s\rangle>s>u$ so

$$0=g(0^{\omega};n)=g(y\oplus z;n)=0^{n}10^{\omega}(n)=1$$

which is a contradiction. So $g$ computes $\emptyset^{\prime}$. ∎

Inverting a non-injective computable $f:2^{\omega}\to 2^{\omega}$ can be as hard as computing $\emptyset^{\prime}$. This was demonstrated in Theorem 3.3 by a simple definition of a highly non-injective $f$: $f^{-1}(y)$ is uncountable for each $y\in f(2^{\omega})$.

The extent that $f$ fails to be injective can be measured by the distribution of sizes of the $f^{-1}(y)$, $y\in f(2^{\omega})$. We wish to determine the extent that hard-to-invert computable functions $f$ fail to be injective.

Definition 5.2.

We say that $f:2^{\omega}\to 2^{\omega}$ is two-to-one if $\forall y,\ |{f^{-1}(y)}|\leq 2$.

At the cost of some complexity in $f$ we show:

Theorem 5.3.

There is a total computable $f:2^{\omega}\to 2^{\omega}$ such that:

• $f$ is a two-to-one random-preserving surjection

• $f$ is almost everywhere effectively invertible

• every $g:\subseteq 2^{\omega}\to 2^{\omega}$ that inverts $f$ computes $\emptyset^{\prime}$

and the latter holds for the restriction of $f$ in any neighborhood $\llbracket\sigma\rrbracket$.

By Theorem 4.9 every computable two-to-one random-preserving surjection (including $f$ of Theorem 5.3) can be effectively inverted with positive probability. This leaves the possibility that a computable $f$ exists such that:

1. $f:2^{\omega}\to 2^{\omega}$ is two-to-one, random-preserving and surjective

2. no partial computable $g$ inverts $f$ with probability 1.

We give a strong positive answer:

Theorem 5.4.

There is a total computable $f:2^{\omega}\to 2^{\omega}$ such that:

• $f$ is a two-to-one random-preserving surjection

• every partial $g\not\geq_{T}\emptyset^{\prime}$ fails to invert $f$ with positive probability

and the latter holds for the restriction of $f$ in any neighborhood $\llbracket\sigma\rrbracket$.

We use the following relativization of Lemma 4.3:

Lemma 5.5.

Let $p$ be a total Turing functional such that $n\mapsto p^{z}(n)$ is injective for each oracle $z$ and define $f,g^{z}:2^{\omega}\to 2^{\omega}$ by

$$g^{z}(x;n):=x(p^{z}(n))\hskip 8.5359pt\textrm{and}\hskip 8.5359ptf(x\oplus z):=g^{z}(x)\oplus z.$$

Then $f$ is a total computable random-preserving surjection.

Proof..

Since $p$ is a total Turing functional, $(z,x)\mapsto g^{z}(x)$ and $f$ are computable. By the relativization of Lemma 4.3 to arbitrary oracle $z$:

$$g^{z} z$$ is a -random preserving surjection.

So $f$ is a surjection and if $x\oplus z$ is random, by van Lambalgen’s theorem:

$$\textrm{ $x$ is $z$-random}\ \Rightarrow\ \textrm{$g^{z}(x)$ is $z$-random}\ \Rightarrow\ \textrm{$g^{z}(x)\oplus z$ is random}$$

so $f$ is random-preserving. ∎

5.1 Construction of two-to-one functions

In Theorem 5.3 we define $f(x\oplus z):=h^{z}(x)\oplus z$ where

• $h^{z}$ selects positions of $x$-bits used in (i.e. copied into) $h^{z}(x)$

• all but at most one position are used in $h^{z}(x)$.

Figure 1: Definition of $f$ given a $z$-computable predicate $E^{z}_{s}(i)$.

Figure 1 depicts $f$ as an algorithm, where $y=h^{z}(x)$. Let $k^{z}_{s}$ be the candidate for the unique unused position at $s$, corresponding to the $k$ in the figure. The update of $k^{z}_{s}$ occurs if:

• either $k^{z}_{s}\in\emptyset^{\prime}_{s+1}$ which we call a $\emptyset^{\prime}$-permission

• or $E^{z}_{s+1}(k^{z}_{s})$ which we call a $z$-permission

in both cases candidate $k^{z}_{s}$ is eliminated. Since $k^{z}_{s}$ is non-decreasing:

1. if $\lim_{s}k^{z}_{s}=\infty$ all $x$-positions are used in $h^{z}(x)$

2. if $\lim_{s}k^{z}_{s}=k_{0}$ all $x$-positions except $k_{0}$ are used in $h^{z}(x)$.

So $|{f^{-1}(h^{z}(x)\oplus z)}|=1$ if (i) holds and $|{f^{-1}(h^{z}(x)\oplus z)}|=2$ if (ii) holds.

5.2 Proof of Theorem 5.3

We define $f$ according to §5.1 for predicate $z(\langle i,s\rangle)=1$ in place of $E^{z}_{s}(i)$. For each $z$ let $k^{z}_{0}=0$ and

$$k^{z}_{s+1}:=\begin{cases}s+1&\textrm{if $k^{z}_{s}\in\emptyset^{\prime}_{s}$ or $z(\langle k^{z}_{s},s\rangle)=1$}\\[3.69899pt] k^{z}_{s}&\textrm{otherwise.}\end{cases}$$ (5)

To select the next $x$-bit used in $f(x\oplus z)$ define:

$$p^{z}_{s}:=\begin{cases}s+1&\textrm{if $k^{z}_{s+1}=k^{z}_{s}$}\\[3.69899pt] k^{z}_{s}&\textrm{otherwise.}\end{cases}$$

Then $s\mapsto p^{z}_{s}$ is injective for each $z$. By Lemma 5.5 the $f$ given by

$$f(x\oplus z):=h^{z}(x)\oplus z\hskip 8.5359pt\textrm{where}\hskip 8.5359pth^{z}(x;s):=x(p^{z}_{s})$$

is a total computable random-preserving surjection. Also $f$ is two-to-one and

$$\forall k,\ |{\{\hskip 0.85355pt{i}:{z(\langle k,i\rangle)=1}\hskip 0.85355pt\}}|=\infty\ \Rightarrow\ \lim_{s}k^{z}_{s}=\infty\ \Rightarrow\ |{f^{-1}(h^{z}(x)\oplus z)}|=1$$

as discussed in §5.1. The condition is satisfied for all random $z$, so $f$ is almost everywhere injective and by Theorem 3.1 it has a partial computable almost everywhere inversion.

Assuming that $g:\subseteq 2^{\omega}\to 2^{\omega}$ inverts $f$ we show that $g\geq_{T}\emptyset^{\prime}$.

To decide if $n\in\emptyset^{\prime}$, we define $z$ so that $k^{z}_{t}$ gets stuck on $n$ unless $n\in\emptyset^{\prime}$:

$$z(\langle i,s\rangle):=\begin{cases}0&\text{if }i=n\\ 1&\text{if }i\neq n.\end{cases}$$ (6)

Then $k_{t}^{z}$ does not get stuck on any number $\neq n$ and

1. $k_{s}^{z}=n$ at $s:=n-1$

2. $k_{s}^{z}$ is updated at $t>s$ iff $n\in\emptyset^{\prime}_{t}-\emptyset^{\prime}_{t-1}$.

To decide if $n\in\emptyset^{\prime}$ we show $n\in\emptyset^{\prime}\iff n\in\emptyset^{\prime}_{\max\{u,s\}}$ where

$$g(0^{\omega}\oplus z;2n)\downarrow\hskip 8.5359pt\textrm{with oracle-use $u$.}$$

For a contradiction suppose $n\in\emptyset^{\prime}_{t}-\emptyset^{\prime}_{t-1}$ for $t>\max\{u,s\}$ so

$$\forall x,y\ \ \big{(}{f(x\oplus z)=y\oplus z\ \Rightarrow\ y(t)=x(n)}\big{)}$$ (7)

due to (b) and the definition of $f$. Let

$$y_{0}:=0^{\omega}\hskip 8.5359pt\textrm{and}\hskip 8.5359pty_{1}:=0^{t}10^{\omega}$$

so for $i=0,1$, $f(g(y_{i}\oplus z))=y_{i}\oplus z$ and by (7):

$$g(y_{0}\oplus z;2n)=y_{0}(t)=0\hskip 8.5359pt\textrm{and}\hskip 8.5359ptg(y_{1}\oplus z;2n)=y_{1}(t)=1.$$ (8)

Since $u$ is the oracle-use of $g(y_{0}\oplus z_{n};2n)$ and $t>u$ we have

$$(y_{0}\oplus z)\upharpoonright_{u}\prec y_{1}\oplus z\hskip 8.5359pt\textrm{so}\hskip 8.5359ptg(y_{0}\oplus z;2n)=g(y_{1}\oplus z;2n)$$

which contradicts (8). This concludes the proof of $n\in\emptyset^{\prime}\iff n\in\emptyset^{\prime}_{\max\{u,s\}}$.

Finally we modify the above argument so that $g\geq_{T}\emptyset^{\prime}$ is obtained from the weaker assumption that $g$ inverts $f$ inside a neighborhood $\llbracket\upsilon\oplus\zeta\rrbracket$. Let

• $z$ be the extension of $\zeta$ given by (6) for $\langle i,s\rangle\geq|\zeta|$

• $u$ be the oracle-use of $g(\upsilon 0^{\omega}\oplus z;2n)\downarrow$

• $y_{0}:=\upsilon 0^{\omega}$ and $y_{1}:=\upsilon 0^{t-|\upsilon|}10^{\omega}$

for $n>|\zeta|$ and $t>u$ which are used for deciding if $n\in\emptyset^{\prime}$ as before.

Assuming $n>|\zeta|$ the modified $z$ satisfies (a), (b). So the above argument applies to the modified $y_{0},y_{1},u$ and proves $g\geq_{T}\emptyset^{\prime}$ as required.

5.3 Proof of Theorem 5.4

We construct a two-to-one total computable random-preserving surjection $f$ such that any any $g\not\geq_{T}\emptyset^{\prime}$ fails to invert $f$ with positive probability.

In §5.2 we relied on the fact that the given candidate $g$ for inverting $f$ was defined on certain specially constructed computable reals $y_{i}\oplus z_{n}$. This may no longer be the case since we can only assume that $g$ is defined on a set of measure 1. We restrict our considerations to sufficiently random reals.

The domain of a partial computable $g$ which is defined almost everywhere is a $\Pi^{0}_{2}$ class of measure 1 and includes all weakly 1-randoms. In general we only have $g\not\geq_{T}\emptyset^{\prime}$ so for some $r\not\geq_{T}\emptyset^{\prime}$ we use weakly $r$-randoms: reals that are members of every $\Sigma^{0}_{1}(r)$ class of measure 1.

Lemma 5.6.

Suppose that $f:2^{\omega}\to 2^{\omega}$ is a computable surjection and $g:\subseteq 2^{\omega}\to 2^{\omega}$ is an almost everywhere inversion of $f$. If $g\leq_{T}r$ then $g$ inverts $f$ on each weakly $r$-random real.

Proof..

The set of reals where $g$ inverts $f$ is the $\Pi^{0}_{2}(r)$ class

$$L_{f}(g):=\{\hskip 0.85355pt{y}:{g(y)\downarrow\ \wedge\ \ f(g(y))=y}\hskip 0.85355pt\}$$

which has measure 1 according to the hypothesis. Since weakly $r$-random reals belong to every $\Sigma^{0}_{1}(r)$ class of measure 1, they also belong to every $\Pi^{0}_{2}(r)$ class of measure 1. So $L_{f}(g)$ contains every weakly $r$-random real. ∎

Let $r\in 2^{\omega}$. A real $w$ is called $r$-generic if for every $\Sigma^{0}_{1}(r)$ class $G\subseteq 2^{\omega}$

$$\exists\sigma\prec w:\ \big{(}{\llbracket\sigma\rrbracket\subseteq G\ \vee\ \llbracket\sigma\rrbracket\cap G=\emptyset}\big{)}.$$

By [11] and [12] ([4, Theorem 8.11.7]) respectively, for each $r$:

• if $r\not\geq_{T}\emptyset^{\prime}$ and $z$ is $r$-generic then $z\oplus r\not\geq_{T}\emptyset^{\prime}$

• every $r$-generic is weakly $r$-random and not random.

Definition 5.7.

The $n$th column of $w$ is the real $w^{n}$ with $w^{n}(i):=w(\langle n,i\rangle)$.

Given $r\geq_{T}g$, we adapt §5.2 by choosing $y_{i},z$ so that the $y_{i}\oplus z$ are weakly $r$-random. We construct them from the $y,w$ given by:

Lemma 5.8.

For each $r\not\geq_{T}\emptyset^{\prime}$ there exist $y,w$ such that

1. $y\oplus w$ is weakly $r$-random and $y$ is random

2. no column $w^{n}$ of $w$ is random

3. $r\oplus y\oplus w\not\geq_{T}\emptyset^{\prime}$.

Proof..

Let $w$ be $r$-generic and $y$ be $(w\oplus r)^{\prime}$-random. Then

• $w\oplus r\not\geq_{T}\emptyset^{\prime}$

• $w$ is weakly $r$-random

• $y$ is weakly 2-random relative to $w\oplus r$.

By the latter two clauses and [1, Corollary 2.1] we get (i).

By [20, Proposition 2.2] each $w^{n}$ is $r$-generic. Since $r$-generics are not randoms we get (ii). Since $y$ is weakly 2-random relative to $w\oplus r$, by [12] ([4, Theorem 7.2.7]), $y$ is not a member of any $\Pi^{0}_{2}(w\oplus r)$ null class. The latter also holds for $\Sigma^{0}_{3}(w\oplus r)$ null classes which are countable unions of $\Pi^{0}_{2}(w\oplus r)$ classes. Since $w\oplus r\not\geq_{T}\emptyset^{\prime}$, by [4, Corollary 8.12.2] the class

$$G:=\{\hskip 0.85355pt{x}:{x\oplus w\oplus r\geq_{T}\emptyset^{\prime}}\hskip 0.85355pt\}$$

has measure 0. Since $G$ is a $\Sigma^{0}_{3}(w\oplus r)$ class we get $y\not\in G$ so (iii) holds. ∎

Fix $w,y$ as in Lemma 5.8 and let $U$ be a member of a universal Martin-Löf test with effective enumeration $(U_{s})$, $y\not\in U$ and $\forall n,\ w^{n}\in U$. For each $n$ we can $(w\oplus y)$-effectively define a weakly $r$-random $z=z_{n}$ consisting of the columns of $w$ except for the $n$th column which is $y$. This suggests defining $E^{z}_{s}(i)$ in the template of §5.1 in terms of the memberships $z^{i}\in U$.

A last hurdle in the adaptation of §5.1 is the requirement

from $$w\oplus y,n s_{n} k^{z}_{s_{n}} n\not\in\emptyset^{\prime}$$ compute such that is used iff (9)

so $k^{z}_{s_{n}}$ does not get $z$-permission. In §5.2 permissions of $k_{s}^{z}$ at $s$ depended entirely on the value of $k_{s}^{z}$ so (9) was achieved by defining $s_{n},z$ with $k_{s_{n}}^{z}=n$. This is no longer possible as we do not have control over the stages where the $w^{i}$ appear in $U$. The solution is to define permissions in terms of

$$d^{z}_{s}:=|{\{\hskip 0.85355pt{k^{z}_{t}}:{t\leq s}\hskip 0.85355pt\}}|$$

instead of $k_{s}^{z}$. This will allows to define the required $s_{n},z$ for (9).

Construction and verification

Given $z$ let $k^{z}_{s}$ be the non-decreasing counter with $k^{z}_{0}=0$ and

$$k^{z}_{s+1}:=\begin{cases}s+1&\textrm{if $d^{z}_{s}\in\emptyset^{\prime}_{s}$ or $z^{d^{z}_{s}}\in U_{s}$}\\[3.69899pt] k^{z}_{s}&\textrm{otherwise}\end{cases}$$

where $d^{z}_{s}:=|{\{\hskip 0.85355pt{t<s}:{k^{z}_{t+1}\neq k^{z}_{t}}\hskip 0.85355pt\}}|$ counts the updates of $k^{z}$ and

$$p^{z}_{s}:=\begin{cases}s+1&\textrm{if $k^{z}_{s+1}=k^{z}_{s}$}\\[3.69899pt] k^{z}_{s}&\textrm{otherwise}\end{cases}$$

enumerates $\mathbb{N}$, omitting $k^{z}_{s}$ as long as it is not updated and including it if an update occurs. Updates of $k^{z}$ coincide with updates of $d^{z}$ and are due to:

• $d^{z}_{s}\in\emptyset^{\prime}_{s}$ which we call $\emptyset^{\prime}$-permission of $k^{z}_{s}$ at $s+1$; or

• $z^{d^{z}_{s}}\in U_{s}$ which we call $z$-permission of $k^{z}_{s}$ at $s+1$.

We say that $k^{z}_{s}$ receives permission at $s+1$ if one of the above clauses hold.

Both $d^{z},k^{z}$ are non-decreasing and $d^{z}$ increases by at most 1. The reason that $k^{z}$ is allowed to skip numbers is so that the range of $p^{z}$ misses at most one number $m$, which happens exactly when $\lim_{s}k^{z}_{s}=m$. So

$$k^{z}_{s} p^{z}_{t} d^{z}_{s}$$ becomes some iff receives permission at some stage.

Lemma 5.9.

Given $r\not\geq_{T}\emptyset^{\prime}$ let $y,w$ be as in Lemma 5.8. Effectively in $y\oplus w,n$ we can define $z$ and $s$ with

1. $d^{z}_{s}=n\ \wedge\ \ \big{(}{\lim_{t}k^{z}_{t}<\infty\iff\lim_{t}k^{z}_{t}=k^{z}_{s}\iff n\not\in\emptyset^{\prime}}\big{)}$

2. $y\oplus z$ is weakly $r$-random.

Proof..

Let $z$ be the real obtained from $w$ by replacing its $n$th column by $y$. Since $\forall d,\ w^{d}\in U$ each $d\neq n$ will receive $z$-permission at some stage. If $s$ is the stage where each $d<n$ have received permission, $d^{z}_{s}=n$. Since $z^{n}=y\not\in U$ it follows that $n$ will never receive $z$-permission. So $d^{z}$ gets stuck at $n$ if and only if $n$ does not receive $\emptyset^{\prime}$-permission. The required equivalence then follows, given that each $d>n$ receives $z$-permission. ∎

Define the computable $f:2^{\omega}\to 2^{\omega}$ by

$$f(x\oplus z):=h^{z}(x)\oplus z\hskip 8.5359pt\textrm{where}\hskip 8.5359pth^{z}(x;s):=x(p^{z}_{s})$$

so $h^{z}(x)$ outputs the bits of $x$ in some order determined by $(\emptyset^{\prime}_{s})$, $z$ with the exception of $\lim_{s}k^{z}_{s}$ in the case that the limit is finite. Then (i), (ii) of §5.1 hold and $f$ is two-to-one. Since $s\mapsto p^{z}_{s}$ is injective, Lemma 5.5 shows that $f$ is a computable random-preserving surjection.

Assuming that $g:\subseteq 2^{\omega}\to 2^{\omega}$ inverts $f$ with probability 1, we will show that $g\geq_{T}\emptyset^{\prime}$.

For a contradiction assume $g\not\geq_{T}\emptyset^{\prime}$, fix $r\not\geq_{T}\emptyset^{\prime}$ with $g\leq_{T}r$ and

fix $$y_{0},v,w y=y_{0} r$$ as in Lemma 5.8 for and

so $y_{0}\oplus w\oplus r\not\geq_{T}\emptyset^{\prime}$.

To decide if $n\in\emptyset^{\prime}$, from $y_{0}\oplus w\oplus r$ we effectively compute $z,s$ as in Lemma 5.9. Let $k:=k^{z}_{s}$ be the potential finite limit of $k^{z}$. Then $y_{0}\oplus z$ is weakly $r$-random, $d^{z}_{s}=n$ and

$$\forall t>s\ \big{(}{n\in\emptyset^{\prime}_{t}\ \Rightarrow\ p^{z}_{t}=k}\big{)}.$$

So by the definition of $f$, for each $x,y$:

$$\big{(}{f(x\oplus z)=y\oplus z\ \wedge\ \ t>s\ \wedge\ \ n\in\emptyset^{\prime}_{t}}\big{)}\ \Rightarrow\ y(t)=x(k).$$ (10)

Now we show $n\in\emptyset^{\prime}\iff n\in\emptyset^{\prime}_{\max\{u,s\}}$ where

$$g(y_{0}\oplus z;2k)\downarrow\hskip 8.5359pt\textrm{with oracle-use $u$.}$$ (11)

Since $y_{0}\oplus z$ is weakly $r$-random, by Lemma 5.6 and we have $g(y_{0}\oplus z)\downarrow$ so $u$ is well-defined. For a contradiction let $t$ be such that

$$t>\max\{u,s\}\ \wedge\ \ n\in\emptyset^{\prime}_{t}-\emptyset^{\prime}_{t-1}$$

and let $y_{1}$ be the real with $y_{1}(i)=y_{0}(i)\iff i\neq t$. Then $y_{1}\oplus z$ is weakly $r$-random, so by Lemma 5.6, for $i=0,1$

$$g(y_{i}\oplus z)\downarrow\ \wedge\ \ f(g(y_{i}\oplus z))=y_{i}\oplus z.$$ (12)

Since $t>u$ we have $(y_{0}\oplus z)\upharpoonright_{u}\prec y_{1}\oplus z$ so by (11):

$$g(y_{0}\oplus z;2k)=g(y_{1}\oplus z;2k).$$ (13)

By (12), (10) and $t>s$ we get

$$g(y_{0}\oplus z;2k)=y_{0}(t)\hskip 8.5359pt\textrm{and}\hskip 8.5359ptg(y_{1}\oplus z;2k)=y_{1}(t)$$

which contradicts (13) since $y_{0}(t)\neq y_{1}(t)$. We have shown that

$$n\in\emptyset^{\prime}\iff n\in\emptyset^{\prime}_{\max\{u,s\}}$$

which gives a decision procedure for $\emptyset^{\prime}$ from $y_{0}\oplus w\oplus r$, contradicting the choice of $y_{0},w,r$ such that $y_{0}\oplus w\oplus r\not\geq_{T}\emptyset^{\prime}$. We conclude that $g\geq_{T}\emptyset^{\prime}$ so every almost everywhere inversion of $f$ computes $\emptyset^{\prime}$. The same argument applies in the case that $g$ inverts $f$ almost everywhere in a neighborhood $\llbracket\sigma\rrbracket$.