\documentclass[amsthm]{elsart}
%\usepackage[verbatim, verbatim, verbatim, verbatim, english]{babel}
\usepackage[english]{babel}
\usepackage{yjsco,natbib}
\usepackage{amsmath,amssymb,graphicx,bbm,hyperref,xcolor}
\usepackage{stmaryrd,textcomp}
%% \usepackage{geometry}
%\geometry{letterpaper}

% Algorithms
\usepackage[ruled, linesnumbered, noend, noline]{algorithm2e}
\SetKwInput{Input}{Input}\SetKwInOut{Output}{Output}
\DontPrintSemicolon
\LinesNumbered
\SetNlSty{textbf}{}{:}

%%%%%%%%%% Start TeXmacs macros
\catcode`\<=\active \def<{
\fontencoding{T1}\selectfont\symbol{60}\fontencoding{\encodingdefault}}
\catcode`\>=\active \def>{
\fontencoding{T1}\selectfont\symbol{62}\fontencoding{\encodingdefault}}
\newcommand{\Tau}{\mathrm{T}}
\newcommand{\assign}{:=}
\newcommand{\nobracket}{}
\newcommand{\nocomma}{}
\newcommand{\tmem}[1]{{\em #1\/}}
\newcommand{\tmmathbf}[1]{\ensuremath{\boldsymbol{#1}}}
\newcommand{\tmname}[1]{\textsc{#1}}
\newcommand{\tmop}[1]{\ensuremath{\operatorname{#1}}}
\newcommand{\tmsamp}[1]{\textsf{#1}}
\newcommand{\tmstrong}[1]{\textbf{#1}}
\newcommand{\tmstrongb}[1]{\bf{\textrm{#1}}}
\newcommand{\tmtextbf}[1]{{\bfseries{#1}}}
\newcommand{\tmtextit}[1]{{\itshape{#1}}}
\newcommand{\tmtexttt}[1]{{\ttfamily{#1}}}
\newcommand{\tmverbatim}[1]{{\ttfamily{#1}}}
\newcommand{\um}{-}
%% \newenvironment{itemizeminus}{\begin{itemize} \renewcommand{\labelitemi}{$-$}\renewcommand{\labelitemii}{$-$}\renewcommand{\labelitemiii}{$-$}\renewcommand{\labelitemiv}{$-$}}{\end{itemize}}
%% \theoremstyle{plain}
%% \newtheorem{corollary}{Corollary}
%% \theoremstyle{plain}
%% \newtheorem{definition}{Definition}
%% \theoremstyle{remark}
%% \newtheorem{example}{Example}
%% \theoremstyle{plain}
%% \newtheorem{lem}{lem}
%% \theoremstyle{plain}
%% \newtheorem{proposition}{Proposition}
%% \theoremstyle{remark}
%% \newtheorem{remark}{Remark}
%% \theoremstyle{plain}
%% \newtheorem{thm}{thm}
%%%%%%%%%% End TeXmacs macros

\newcommand{\sh}{\mathrm{sh}}

\begin{document}



\begin{frontmatter}
  \title{Relaxed Hensel lifting of triangular sets}
  
  \thanks{This work has been partly supported by the ANR grant HPAC
  (ANR-11-BS02-013).}
  
  \author{Romain Lebreton}
  \address{University of Waterloo \\
  Waterloo, ON, Canada}
  \ead{rlebreton@uwaterloo.ca}
  
  \begin{abstract}
    In this paper, we present a new lifting algorithm for triangular sets over
    general $p$-adic rings. Our contribution is to give, for any $p$-adic
    triangular set, a shifted algorithm of which the triangular set is a fixed
    point. Then we can apply the relaxed recursive $p$-adic framework and
    deduce a relaxed lifting algorithm for this triangular set.
    
    We compare our algorithm to the existing technique and report on
    implementations inside the \tmverbatim{C++} library
    {\tmname{{\tmname{Geomsolvex}}}} of {\tmname{Mathemagix}} {\cite{mmx}}.
    Our new relaxed algorithm is competitive and compare favorably on some
    examples.
  \end{abstract}
  
  \begin{keyword}
    polynomial system solving, online algorithm, relaxed algorithm, triangular
    set, univariate representation, $p$-adic integer, power series
  \end{keyword}
\end{frontmatter}

\section{Introduction}

The introduction is made of five subsections. We present the setting of
triangular sets with $p$-adic coefficients in
Section~\ref{subsec:statementpb}, together with the statement of our lifting
problem. We present in Section~\ref{subsec:model} our model of computation for
algorithms on $p$-adics. Section~\ref{subsec:onlineandrecursive} introduces
the framework in which online algorithms are used to lift triangular sets.
Finally, our results and contributions are stated in
Section~\ref{subsec:contributions}, followed by an outline of the paper in
Section~\ref{subsec:outline}.

\subsection{Statement of the problem}\label{subsec:statementpb}

Our goal in this paper is to extend a growing body of work on {\tmem{relaxed
algorithms}} to the context of lifting techniques for {\tmem{univariate
representations}} and {\tmem{triangular sets}}.

It is well-known that, under some regularity conditions, techniques such as
Newton iteration can be used to compute a power series root of an equation such as
$f (T, x (T)) = 0$,\linebreak with $f$ in $\mathbbm{k} [T, X]$, or a $p$-adic
integer root of an equation of the form $f (x) = 0$ with $f$ in $\mathbbm{Z}
[X]$.

Relaxed methods, introduced by van der Hoeven {\citep{Hoeven2002}}, offer an
alternative to Newton iteration. The case of computing one power series root,
or one $p$-adic root, of a {\tmem{system}} of polynomial equations was worked
out in {\citep{Hoeven2011,BeLe12}}; for this problem, the relaxed algorithm was
seen to behave better than Newton iteration in some cases, for instance for
multivariate systems with a large number of equations.

In this paper, we go beyond the case of lifting a single root of a
multivariate system: we deal with all roots at once, introducing relaxed
algorithms that deal with objects such as univariate and triangular
representations. This paper is based on the Ph.D. thesis \citep{Le12}.

\begin{exmp}
  We consider the polynomial system $\tmmathbf{f}= (f_1, f_2)$ in $\mathbbm{Z}
  [X_1, X_2]$ with
  \begin{eqnarray*}
    f_1 & \assign & 33 X_2^3 + 14699 X_2^2 + 6761112 X_2 + 276148 X_1 -
    11842820\\
    f_2 & \assign & X_2^2 + 66 X_1 X_2 - 75 X_2 - 94 X_1 - 22.
  \end{eqnarray*}
  Let $\tmmathbf{t}_0$ be the triangular set of $(\mathbbm{Z}/ 7\mathbbm{Z})
  [X_1, X_2]$, that is a lexicographical Gr{\"o}bner basis for $X_1 < X_2$,
  given by
  %% \begin{eqnarray*}
  \[
  \tmmathbf{t}_0 \assign \left( X_1^2 + 5 X_1, \ X_2^2 + 3 X_1
  X_2 + 2 X_2 + 4 X_1 + 6 \right) .
  \]
  %% \end{eqnarray*}
  We lift the triangular set $\tmmathbf{t}_0$ defined modulo 7 to triangular
  sets $\tmmathbf{t}$ defined modulo $7^2 \nocomma \nocomma, 7^3$ and so on.
  At the first step, we have
  \begin{eqnarray*}
    \tmmathbf{t}_1 & = & (X_1^2 + (5 + 5 \cdot 7) X_1 + 7, \\
    &  & X_2^2 + (3 + 2 \cdot 7) X_1 X_2 + (2 + 3 \cdot 7) X_2 + 4 X_1 + (6 + 3 \cdot 7))
  \end{eqnarray*}
  in $(\mathbbm{Z}/ 7^2 \mathbbm{Z}) [X_1, X_2]$. We iterate again and find
  \begin{eqnarray*}
    \tmmathbf{t}_2 & = & (\nobracket X_1^2 + (5 + 5 \cdot 7 + 6 \cdot 7^2) X_1
    + (7 + 7^2), \ X_2^2 + (3 + 2 \cdot 7 + 7^2) X_1 X_2 + \\
    &  & \phantom{(}  (2 + 3 \cdot 7 +
    5 \cdot 7^2) X_2 + (4 + 5 \cdot 7^2) X_1 + (6 + 3 \cdot 7 + 6 \cdot 7^2))
  \end{eqnarray*}
  in $(\mathbbm{Z}/ 7^3 \mathbbm{Z}) [X_1, X_2]$. The precision is enough to
  recover the integer triangular set
  \[
  \tmmathbf{t} \assign \left( X_1^2 - 9 X_1 + 56, \ X_2^2 + 66
    X_1 X_2 - 75 X_2 - 94 X_1 - 22 \right) \in \mathbbm{Z} [X_1, X_2] .
    \]
\end{exmp}

Our techniques of $p$-adic lifting applies to general $p$-adic rings. Let $R$
be a commutative domain with unit. We consider an element $p \in R - \{ 0 \}$,
and we write $R_p$ for the completion of the ring $R$ for the $p$-adic
valuation. We will assume that $R / (p)$ is a field (equivalently, that $p$
generates a maximal ideal). This is not compulsory but will be useful later on
when we deal with linear algebra modulo $(p)$. We also assume that $\cap_{i
\in \mathbbm{N}} (p^i) = \{ 0 \}$, so that $R$ can be seen as a subset of
$R_p$. Note that the set of natural numbers $\mathbbm{N}$ contains $0$ in this
paper.

Two classical examples of $p$-adic rings are the formal power series ring
$\mathbbm{k} [[T]]$, which is the completion of the ring of polynomials
$\mathbbm{k} [T]$ for the ideal $(T)$, and the ring of $p$-adic integers
$\mathbb{Z}_p$, which is the completion of the ring of integers $\mathbb{Z}$
for the ideal $(p)$, with $p$ a prime number.

\

Consider a system of polynomial equations $\tmmathbf{f}= (f_1, \ldots, f_s)
\in R [X_1, \ldots, X_s]$. Denote by $\mathcal{I}$ the ideal generated by
$(f_1, \ldots, f_s)$ in $Q [X_1, \ldots, X_s]$, where $Q$ is the total field
of fractions of $R$. In what follows, we make the following assumptions,
denoted $\left( \mathsf{H} \right)$:
\begin{enumerate}
  \item the algebraic set $V = V (\mathcal{I}) \subset \overline{Q}^s$ has
  dimension zero in an algebraic closure $\overline{Q}$;
  
  \item the Jacobian determinant of $(f_1, \ldots, f_s)$ vanishes nowhere on
  $V$.
\end{enumerate}
Let $d$ be cardinality of $V$; due to our non-vanishing assumption on the
Jacobian of $\tmmathbf{f} \nocomma$, the extension $Q \rightarrow A \assign Q
[X_1, \ldots, X_s] /\mathcal{I}$ is a product of separable field extensions.
As a result, $A$ has dimension $d$ over $Q$.

\

In order to describe $V$, we will consider two data structures, which we
briefly describe now. These data structures encode $\mathbbm{k}$-algebras $A$
of finite dimension as vector spaces, $\mathbbm{k}$ being any field.

An element $g$ of $A =\mathbbm{k} [X_1, \ldots, X_s] /\mathcal{I}$ will be
called {\tmem{primitive}} if the $\mathbbm{k}$-algebra $\mathbbm{k} [g]
\subset A$ spanned by $g$ in $A$ is equal to $A$ itself. If $\Lambda$ is a
primitive linear form in $A$, a {\tmem{univariate representation}} of $A$
consists of polynomials $\mathcal{U}= (q, r_1, \ldots, r_s)$ in $\mathbbm{k}
[Z]$, where $Z$ is a new variable, with $\deg (r_i) < \deg (q)$ for all $i$
and such that we have a $\mathbbm{k}$-algebra isomorphism
\[
  \begin{array}{clc}
    A =\mathbbm{k} [X_1, \ldots, X_s] /\mathcal{I} & \rightarrow & \mathbbm{k}
    [Z] / (q)\\
    X_1, \ldots, X_s & \mapsto & r_1, \ldots, r_s\\
    \Lambda & \mapsto & Z.
  \end{array}
\]
In particular, $q$ has degree $d$ in $Z$; we will say that $\mathcal{U}$ has
degree $d$.

Such representations, or slight modifications thereof (using for instance a
rational form for the $r_i$'s) have been used for decades in computer algebra,
under the names of Shape Lemma, Rational Univariate Representation, Geometric
Resolution, etc {\citep{GiMo89,GiHe90,GHHMMP97,Ro99,GLS01,HMW01}}. The oldest
trace of this representation is to be found in {\citep{Kr82}} and a few years
later in {\citep{Ko03}}. Different algorithms compute this representation, from
a geometric resolution {\citep{GHMP97,GHHMMP97,GLS01,HMW01}} or using
Gr{\"o}bner bases {\citep{Ro99}}.

\

On the other side, one finds triangular representations. A {\tmem{triangular
set}} is a set of $s$ polynomials $\tmmathbf{t}= (t_1, \ldots, t_s) \subseteq
\mathbbm{k} [X_1, \ldots, X_s]$ such that for all $i$, $t_i$ is in
$\mathbbm{k} [X_1, \ldots, X_i]$, monic and reduced with respect to $(t_1,
\ldots, t_{i - 1})$. This is thus a reduced Gr{\"o}bner basis for the
lexicographic order $X_1 \ll \cdots \ll X_s$. The notion of triangular set
comes from {\citep{Ri66}} in the context of differential algebra. Many similar
notions were introduced afterwards {\citep{Wu84,La91,Kalk93,ALM99}}; although
all these notions do not coincide in general, they are the same for
zero-dimensional ideals.

Assume that $\mathcal{I}$ admits a triangular family of generators
$\tmmathbf{t}$, and write $d_i \assign \deg_{X_i} (t_i)$ for all $i$. Then, we
have the equality $d = d_1 \cdots d_s$; we will say that $\tmmathbf{t}$ has
multi-degree $\tmmathbf{d}= (d_1, \ldots, d_s)$.

\

As it turns out, univariate representations can be seen as a special case of
triangular sets. Indeed, with the notations above, the family $(q (T), X_1 -
r_1 (T), \ldots, X_s - r_s (T))$ is a triangular set of generators of $(T -
\Lambda (X_1, \ldots, X_s), f_1, \ldots, f_s)$ in the algebra $R [T, X_1,
\ldots, X_s]$.

\

Both kinds of data structures have found numerous applications, and it is not
our purpose here to compare their respective merits. Univariate
representations always exist, provided the base field is large enough
{\citep{GiMo89}}. On the other hand, the ideal $\mathcal{I}$ may not admit a
triangular family of generators: such issues are handled using
{\tmem{triangular decompositions}} of $\mathcal{I}$ {\citep{DMSWX05a}}. We will
not enter this discussion here, and we will simply suppose when needed that
$\mathcal{I}$ admits one or the other such representation.

\

Let us for instance suppose that $\mathcal{I}$ admits a univariate
representation $\mathcal{U}$. By hypothesis $(p)$ is a maximal ideal in $R_p$,
with residual field $R / (p)$. We make the following assumptions, denoted by
$\left( \mathsf{H}' \right)_{\mathcal{U}, p}$:
\begin{enumerate}
  \item none of the denominators appearing in $\mathcal{U}$ vanishes modulo
  $p$;
  
  \item the polynomials $\tmmathbf{f} \tmop{mod} p$ still satisfy $\left(
  \mathsf{H} \right)$;
  
  \item $\mathcal{U}_0 =\mathcal{U} \, \tmop{mod} p$ is a univariate
  representation of $R / (p) [X_1, \ldots, X_s] / \left( \tmmathbf{f} \,
  \tmop{mod} p \right)$.
\end{enumerate}
Then, given $\mathcal{U}_0 =\mathcal{U} \, \tmop{mod} p$ and $\tmmathbf{f}
\nocomma$, our objective is to compute objects of the form $\mathcal{U}_{0
\ldots n} =\mathcal{U} \, \tmop{mod} p^n$, for higher powers of $n$.

Similar questions can be asked for triangular representations: suppose that
$\mathcal{I}$ admits a triangular representation $\tmmathbf{t}$, and that the
natural analogue $\left( \mathsf{H}' \right)_{\tmmathbf{t}, p}$ of $\left(
\mathsf{H}' \right)_{\mathcal{U}, p}$ holds; we will show how to compute
$\tmmathbf{t}_{0 \ldots n} =\tmmathbf{t} \, \tmop{mod} p^n$, for high powers
of $n$, starting from $\tmmathbf{t}_0 =\tmmathbf{t} \, \tmop{mod} p$ and
$\tmmathbf{f} \nocomma$.

We remark that for both the univariate and the triangular case, assumption
$\left( \mathsf{H}' \right)_{\mathcal{U}, p}$, resp. $\left( \mathsf{H}'
\right)_{\tmmathbf{t}, p}$, holds for all values of $p$ except finitely many,
at least when $R_p =\mathbbm{k} [[T]]$ or $\mathbbm{Z}_p$: this is analyzed in
detail in {\citep{Schost03b,Schost03,DMSWX05a}}; thus, these are very mild
assumptions.

\

Let us say a few words about the applications of these kinds of techniques.
One direct application is naturally to solve polynomial systems with rational
(resp. rational function) coefficients: the techniques discussed here allow
one to compute a description of $V$ over $\mathbbm{Q}$ (resp. $\mathbbm{k}
(T)$) by computing it modulo a prime $p$ (resp. $(T - t_0)$) and lifting it to
a sufficient precision (and possibly applying rational reconstruction to
recover coefficients from their $p$-adic expansion).

Such lifting techniques are also at the core of many further algorithms: for
instance, it is used in the geometric resolution algorithm
{\citep{GLS01,HMW01}} that computes univariate representations. This algorithm
relies on an iterative lifting / intersection process: the lifting part
involves lifting univariate representations, as explained in this paper, while
the intersection part uses resultant computations. On the triangular side, a
similar lifting / intersection process is used in the change of order
algorithm of {\citep{DaJiMoSc08}}.

\subsection{Model of computation}\label{subsec:model}

We begin with a description of the representation of elements $a \in R_p$,
which are called {\tmem{$p$-adics}}. Any $p$-adic $a \in R_p$ can be written
(in a non unique way) $a = \sum_{i \in \mathbb{N}} a_i p^i$ with coefficients
$a_i \in R$. To get a unique representation of elements in $R_p$, we will fix
a subset $M$ of $R$ such that the projection $\pi : M \rightarrow R / (p)$ is
a bijection. Then, any element $a \in R_p$ can be uniquely written $a =
\sum_{i \in \mathbb{N}} a_i p^i$ with coefficients $a_i \in M$.

Regarding the two classical examples of $p$-adic rings, we naturally take $M
=\mathbbm{k}$ for $R =\mathbbm{k} [T]$; for $R =\mathbbm{Z}$, we choose $M =
\left\{ - \frac{p - 1}{2}, \ldots, \frac{p - 1}{2} \right\}$ if $p$ is odd and
$M = \{ 0, 1 \}$ for $p = 2$.

Once $M$ has been fixed, we have a well-defined notion of \tmtextit{length} of
a (non-zero) $p$-adic: if $a = \sum_{i \in \mathbbm{N}} a_i p^i$, then we
define $\lambda (a) \assign 1 + \sup (i \in \mathbbm{N} | \nobracket a_i \neq
0) \nocomma \nocomma$, so that $\lambda (a)$ is in $\mathbbm{N}_{> 0}^{} \cup
\{ \infty \}$; for $a = 0$, we take $\lambda (a) = 0$. We say that we have
computed a $p$-adic at precision $n$ if the result holds modulo $p^n$.

Throughout this paper, we choose to denote elements by small letters, e.g. $a
\in R_p$, vectors by bold fonts, e.g. $\tmmathbf{a} \in (R_p)^s$, and matrices
by bold capital letters, e.g. $\tmmathbf{A} \in \mathcal{M}_s (R_p)$.

\

Roughly speaking, we measure the cost of an algorithm by the number of
arithmetic operations with operands in $M$ it performs. More precisely, we
assume that we can do the following at unit cost:
\begin{enumerate}
  \item given $a_0, b_0$ in $M$, compute the coefficients $c_0, c_1$ of $c =
  a_0 b_0$ at unit cost, and similarly for the coefficients of $a_0 \pm b_0$
  
  \item given $a_0$ in $M - \{ 0 \}$, compute $b_0$ in $M - \{ 0 \}$ such that
  $a_0 b_0 = 1 \, \tmop{mod} p$.
\end{enumerate}
We remark that when $R =\mathbbm{k} [T]$, we are simply counting arithmetic
operations in $\mathbbm{k}$.

The main operations we will need on $p$-adics are sum, difference and
multiplication (of course, these algorithms only operate on truncated
$p$-adics). For the moment, we will simply define the problems, and introduce
notation for their complexity.

\

Addition of two $p$-adics takes linear time in the precision. For the
multiplication of $a$ and $b$ of length at most $n$, we will let $\mathsf{I} :
\mathbbm{N} \rightarrow \mathbbm{N}$ be such that all coefficients of $ab$ can
be computed in $\mathsf{I} (n)$ operations. We will assume that $\mathsf{I}
(n)$ satisfies the property that $\mathsf{I} (n) / n$ is non-decreasing. The
cost function $\mathsf{I} (n)$ depends on the $p$-adic ring $R_p$ but we can
always take $\mathsf{I} (n)$ {\tmem{quasi-linear}}, that is, linear up to
logarithmic factors {\cite[Proposition~4]{BeHoLe11}}.

As customary, let us denote by $\mathsf{M} (n)$ a function such that over any
ring, polynomials of degree at most $n - 1$ can be multiplied in $\mathsf{M}
(n)$ base operations, and such that $\mathsf{M} (n) / n$ is non-decreasing
(super-linearity hypothesis, see {\cite[Section 8.3]{GaGe03}}). It is
classical {\citep{ScSt71,CaKa1991}} that $\mathsf{M} (n) =\mathcal{O} (n \log
(n) \log (\log (n)))$ and thus $\mathsf{I} (n) =\mathcal{O} (n \log (n) \log
(\log (n)))$ when $R =\mathbbm{k} [T]$ and $p = T$.

The presence of carries when computing with integers complicates the situation
for all operations. Surprisingly, though, it is possible to obtain a slightly
faster plain multiplication than in the polynomial case; two integers with $n$
digits in base $p$ can be multiplied in bit-complexity $\mathcal{O} (n \log
(n) 2^{\log^{\ast} (n)})$ where $\log^{\ast}$ denotes the iterated logarithm
{\citep{Furer2007,DKSS08}}. Note that this result involves a different
complexity model than ours. It seems that the ideas of {\citep{DKSS08}} could
be adapted to give the same result in our complexity model; we would then have
$\mathsf{I} (n) =\mathcal{O} (n \log (n) 2^{\log^{\ast} (n)})$ when $R_p
=\mathbbm{Z}_p$.

\

The bulk of the computations will rely on {\tmem{modular}} arithmetic: we
will need to perform arithmetic operations, mostly additions and
multiplications, modulo either a univariate polynomial (in the case of
univariate representations) or a whole triangular set.

In the former case, it is known that if $q \in R [Z]$ has degree $d$ (for
some ring $R$), additions and multiplications modulo $q$ can be done using
$\mathcal{O} \left( \mathsf{M} (d) \right)$ operations in $R$. When $R$ is a
field, inversion modulo $q$, when possible, can be done in time $\mathcal{O}
\left( \mathsf{M} (d) \log (d) \right)$ {\citep{GaGe03}}.

If $\tmmathbf{t}= (t_1, \ldots, t_s)$ is a triangular set in $R [X_1, \ldots,
X_s]$ with degrees $d_1, \ldots, d_s$, where $R$ is a ring, we will let
$\mathsf{MT} (\tmmathbf{d})$ denote an upper bound on the number of operations
in $R$ needed to perform multiplication modulo $\tmmathbf{t}$. If $R$ is a
field, we let $\mathsf{IT} (\tmmathbf{d})$ denote an upper bound for the cost
of inversion modulo $\tmmathbf{t}$ (when possible). These operations are less
straightforward than in the univariate case. Known upper bounds are
$\mathsf{MT} (\tmmathbf{d}) = \mathcal{O} (4^s d \log (d) \log (\log (d)))$
where $d = d_1 \cdots d_s$ and $\mathsf{IT} (\tmmathbf{d}) = \mathcal{O} (c^s
d \log (d)^3 )$, for some (large) constant $c$
{\citep{DaMoScXi06,DaJiMoSc08,LiMaSc09}}.

We seize the opportunity to state our first result. By modifying slightly the
algorithm of {\citep{LiMaSc09}}, we are able to improve its complexity (see
Section~\ref{section:fastmulquo}).

\begin{prop}
  \label{prop:costMT}The multiplication modulo a triangular set $\tmmathbf{t}$
  of multi-degree $\tmmathbf{d}$ can be done in $\mathsf{MT} (\tmmathbf{d}) =
  \mathcal{O} (3^s d \log (d) \log (\log (d)))$ operations in $R$.
\end{prop}

We will further need to solve linear systems over $p$-adic modular
multivariate polynomials. We denote by $\omega$ the exponent of linear algebra
on any field $\mathbbm{k}$, so that we can multiply and invert matrices in
$\mathcal{M}_m (\mathbbm{k})$ in $\mathcal{O} (m^{\omega})$ arithmetic
operations. Using the algorithms of {\citep{CoWi90,St10,Wi11}} for the
multiplication, one can take $\omega < 2.38$. We will also need to invert
matrices over rings that are not fields, e.g. in quotients of polynomial rings
$R [T] / (q)$. We denote by $\mathcal{O} (m^{\Omega})$ the arithmetic
complexity of the elementary operations on $m \times m$ matrices over any
commutative ring: addition, multiplication, determinant and adjoint matrix. In
fact, $\Omega$ can be taken less than $2.70$ {\citep{Berkowitz84,Ka92,KaVi04}}.

For the special case of matrix inversion in $(R_{} / (p)) [X_1, \ldots, X_n]
/ (\tmmathbf{t})$ for $\tmmathbf{t}$ a triangular set of multi-degree
$\tmmathbf{d}$, we add the costs of determinant and adjoint matrix $\left(
\mathcal{O} \left( m^{\Omega}  \mathsf{MT} (\tmmathbf{d}) \right) \right)$, of
the inversion of the determinant $\left( \mathsf{IT} (\tmmathbf{d}) \right)$
and multiplication of the adjoint by this inverse $\left( \mathcal{O} \left(
m^2  \mathsf{MT} (\tmmathbf{d}) \right) \right)$, to obtain a total cost of
$\mathcal{O} \left( \mathsf{IT} (\tmmathbf{d}) + m^{\Omega}  \mathsf{MT}
(\tmmathbf{d}) \right)$.

\subsection{Online algorithms and recursive
$p$-adics}\label{subsec:onlineandrecursive}

The property of being {\tmem{online}} (or equivalently, {\tmem{relaxed}}) for
an algorithm with $p$-adic input and output controls the access to the
$p$-adic coefficients of the input during the computation. The notion of
on-line algorithm was introduced by {\citep{Hennie66}}. Informally, consider an
algorithm with at least one $p$-adic input $a = \sum_{i \geqslant 0} a_i p^i$
and whose output is another $p$-adic $c = \sum_{i \geqslant 0} c_i p^i$. We
say that this algorithm is {\tmem{online}} with respect to $a$ if, during the
computation of the $i$th $p$-adic coefficient $c_i$ of the output, the
algorithm reads at most the coefficients $a_0, \ldots, a_i$ of the input $a$.
We say that an algorithm is online if it is online with respect to all its
$p$-adic inputs.

\

The major advantage of online algorithms is that they enable the lifting of
{\tmem{recursive}} $p$-adics. A recursive $p$-adic $y$ is a $p$-adic that
satisfies $y = \Phi (y)$ for an operator $\Phi$ such that the $n$th
coefficient of the $p$-adic $\Phi (y)$ does not depend on the coefficients of
order greater or equal to $n$ of $y$. As a consequence, $y$ can be computed
recursively from its first coefficient $y_0$ and $\Phi$.

One can find in {\citep{Wa89,Hoeven2002}} an algorithm that computes $y$ from
its fixed point equation $y = \Phi (y)$ in the context of power series. A key
aspect of this algorithm is that {\tmem{its cost is the one of evaluating}}
$\Phi$ by an online algorithm. Using the fast online multiplication algorithm
of {\citep{Hoeven1997}}, it leads to an efficient framework for computing with
recursive $p$-adics. An issue about the correctness of relaxed recursive
$p$-adics was raised and solved in~{\citep{BeLe12}}, leading to the notion of
{\tmem{shifted algorithm}}. We will review in
Section~\ref{section:relaxedframework} the online framework for computing
recursive $p$-adics and generalize it to vectors of $p$-adics.

\

As van der Hoeven was apparently not aware of previous work on online
algorithms, he called his algorithm ``relaxed multiplication algorithm'' and
the subsequent algorithms for recursive $p$-adics were called relaxed
algorithms {\citep{Hoeven2002}}. Therefore we can retrospectively define a
{\tmem{relaxed algorithm}} to be a fast online algorithm. These definitions,
and their adaptation to general $p$-adic rings {\citep{BeHoLe11}}, will be used
from now on. Apart from Section~\ref{section:relaxedframework}, we will use
the terminology ``relaxed'' algorithms since our goal is to have
asymptotically fast algorithms.

\

The literature contains applications of the relaxed recursive $p$-adic
framework to standard and important systems of equations: linear
{\citep{Hoeven2002,BeLe12}}, algebraic {\citep{Hoeven2011,BeHoLe11,BeLe12}} and
differential {\citep{Hoeven2002,Hoeven2010,Hoeven2011,BCLSS2012}}.

This paper is the natural extension of {\citep{BeLe12}} and the relaxed
recursive $p$-adic framework is the cornerstone of our result. Our
contribution consists in finding a recursive equation of which the triangular
set we seek to lift is a fixed point. More precisely, the challenge was to
find a shifted algorithm that computes an operator $\Phi$ satisfying
$\tmmathbf{t}=\tmmathbf{\Phi} (\tmmathbf{t})$, which will be done in
Section~\ref{section:relaxlifttriangset}.

\

Let us know turn to the complexity of relaxed algorithm. We denote by
$\mathsf{R} : \mathbbm{N} \rightarrow \mathbbm{N}$ a function such that
{\tmem{relaxed}} multiplication of $p$-adics can be done at precision $n$ in
time $\mathsf{R} (n)$. Even though the algorithm of
{\citep{FiSt1974,Schroder1997,Hoeven1997,BeHoLe11}} performs multiplication
over any $p$-adic ring, its complexity bound $\mathsf{R} (n) = \mathcal{O}
\left( \mathsf{M} (n) \log (n) \right)$ is proven only in the power series and
$p$-adic integers cases. The issue with general $p$-adic rings is the
management of carries. Although we do not prove it here, we believe that this
complexity result carries forward to any $p$-adic ring.

Recent progress has been made on relaxed multiplication: the multiplication
of two $p$-adics at precision $n$ can be done in time $\mathsf{R} (n) =
\mathsf{M} (n) \log (n)^{o (1)}$ {\citep{Hoeven2007,Hoeven2012}}. Once again,
this complexity statement has been proven only for power series and $p$-adic
integers rings. We also believe that this result should carry forward to any
$p$-adic ring.

\subsection{Our contribution}\label{subsec:contributions}

We will make the following assumption on the representation of the input
system: we assume that $\tmmathbf{f}$ is given by a straight-line program with
inputs $T, X_1, \ldots, X_s$ and $s$ outputs corresponding to $f_1, \ldots,
f_s$, using operations in $\{ +, -, \ast \}$. We let $L$ be the size of this
straight-line program.

With this notation being introduced, we can state our first result, which
deals with lifting of triangular representations.

\begin{thm}
  \label{theorem:master}Let $\tmmathbf{f}= (f_1, \ldots, f_s)$ be a polynomial
  system in $R [X_1, \ldots, X_s]$ given by a straight-line program $\Gamma$
  of size $L$. Suppose that $\tmmathbf{f}$ satisfies assumption $\left(
  \mathsf{H} \right)$ and admits a triangular representation $\tmmathbf{t}$
  with coefficients in $Q$ and multi-degree $\tmmathbf{d}$.
  
  Suppose that assumption $\left( \mathsf{H}' \right)_{\tmmathbf{t}, p}$
  holds. Given $\tmmathbf{t}_0 =\tmmathbf{t} \, \tmop{mod} p$, one can compute
  $\tmmathbf{t} \, \tmop{mod} p \nocomma^n$ in time
\[
    \mathcal{O} \left( \left( \mathsf{IT} (\tmmathbf{d}) + s^{\Omega} 
    \mathsf{MT} (\tmmathbf{d}) \right) + (sL + s^2)  \mathsf{R} (n) 
    \mathsf{MT} (\tmmathbf{d}) \right) .
\]
\end{thm}

In the running time, the first term corresponds to the inversion of the
Jacobian matrix of $\tmmathbf{f}$ modulo $\mathcal{U}_0$, with coefficients in
$R / (p)$; this allows us to initialize the lifting. Then, to reach precision
$n$, most of the work consists in relaxed multiplications for $p$-adics in
$R_p$ at precision $n$, coupled with polynomial multiplication modulo a
triangular set of multi-degree $\tmmathbf{d}$. The overall cost is
quasi-linear in $n$.

For comparison, an adaptation of Newton's iteration for triangular sets
{\citep{Schost02}} computes the same output in time
\[
  \mathcal{O} \left( \left( \mathsf{IT} (\tmmathbf{d}) + s^{\Omega} 
  \mathsf{MT} (\tmmathbf{d}) \right) + \nobracket (sL \nobracket + s^{\omega})
  \mathsf{M} (n)  \mathsf{{\tmsamp{}}MT} (\tmmathbf{d}) \right) .
\]
As the term $s^{\omega}  \mathsf{M} (n)  \mathsf{{\tmsamp{}}MT}
(\tmmathbf{d})$ suggests, this algorithm requires one to do matrix
multiplications, with entries that are multivariate polynomials of
multi-degree $\tmmathbf{d}$, having themselves power series coefficients of
precision $n$. Our solution requires no such full-precision matrix
multiplication.

\

Let us next turn to the case of univariate representations. Our main result
for this problem is the following.

\begin{thm}
  \label{theorem:mastercorol3}Let $\tmmathbf{f}= (f_1, \ldots, f_s)$ be a
  polynomial system in $R [X_1, \ldots, X_s]$ given by a straight-line program
  $\Gamma$ of size $L$. Suppose that $\tmmathbf{f}$ satisfies assumption
  $\left( \mathsf{H} \right)$ and admits a univariate representation
  $\mathcal{U}$ with coefficients in $Q$ and degree $d$.
  
  Suppose that assumption $\left( \mathsf{H}' \right)_{\mathcal{U}, p}$ holds.
  Given $\mathcal{U}_0 =\mathcal{U} \, \tmop{mod} p$, one can compute
  $\mathcal{U} \, \tmop{mod} p^n$ in time
  \[
    \mathcal{O} \left( \left( \mathsf{M} (d) \log (d) + s^{\Omega}  \mathsf{M}
    (d) \right) + \left( (L + s^2)  \mathsf{R} (n) + sLn \right)  \mathsf{M}
    (d) \right) .
  \]
\end{thm}

A univariate representation can be seen as a particular case of a triangular
one, through the introduction of an extra unknown $Z$, and the equation
expressing $Z$ as a linear form in $X_1, \ldots, X_s$. However,
Theorem~\ref{theorem:mastercorol3} is not obtained by specializing the
triangular case to the univariate one; further considerations are actually
needed. We develop in Section~\ref{section:secondshalgo} a technique suited
for small number of {\tmem{essential variables}}, that is of variables $\{ X_j
| d_j > 1 \}$ that actually appears in normal forms modulo a triangular set.
Univariate representations are a typical application since they involve only
one essential variable $T$.

The other known algorithm to perform this kind of task is a suitable version
of Newton iteration, introduced in {\citep{GLS01,HMW01}}. To compute the same
output, it runs in time
\[
  \mathcal{O} \left( \left( \mathsf{M} (d) \log (d) + s^{\Omega}  \mathsf{M}
  (d) \right) + (sL + s^{\omega})  \mathsf{M} (n)  \mathsf{M} (d) \right) .
\]
As in the triangular case, the relaxed approach avoids matrix multiplication
with $p$-adic multivariate entries.

As a general remark, relaxed lifting algorithms carry out (asymptotically in
the precision) less relaxed multiplications than off-line (not relaxed)
algorithms do off-line multiplications. In counterpart, the plain $p$-adic
multiplication of Newton's iteration are slightly faster than the relaxed
product used in our algorithm. Thus, there exists a trade-off between the
dependencies in $s$ and $n$ for both algorithms.

\subsection{Outline of the paper}\label{subsec:outline}

One major advantage of online algorithms is their suitability to compute
recursive $p$-adics. We present in Section~\ref{section:relaxedframework} the
framework of this application of online algorithms. In
Section~\ref{sec:mulremquo}, we focus on arithmetics modulo a triangular set.
Anticipating future needs, we develop an algorithm $\mathtt{Rem\_quo}$
computing efficiently both the quotient and remainder modulo a triangular set.
Section~\ref{section:relaxlifttriangset} provides shifted algorithms for a
triangular set, which is the requirement to lift this triangular set using the
framework of Section~\ref{section:relaxedframework}. Finally, we report on
implementations in Section~\ref{section:implementation}.

\section{Online framework for recursive
$p$-adics}\label{section:relaxedframework}

This section presents online (or relaxed) algorithms and their use for
computing recursive $p$-adics. We start by recalling the definition of online
algorithms in Section~\ref{section:defonlinealgorithm}. For this matter, we
introduce a notion of {\tmem{shift}} of an algorithm that takes words as input
and output. The rest of the section is devoted to the online solver of fixed
point equations $\tmmathbf{y}=\tmmathbf{\Phi} (\tmmathbf{y})$. Recursive
$p$-adics $\tmmathbf{y}$ are defined as solutions of special fixed point
equations $\tmmathbf{y}=\tmmathbf{\Phi} (\tmmathbf{y})$ in
Section~\ref{section:recursivepadics}. When $\tmmathbf{\Phi}$ is equipped with
an evaluation algorithm of shift $1$, we can use the relation
$\tmmathbf{y}=\tmmathbf{\Phi} (\tmmathbf{y})$ to compute $\tmmathbf{y}$ from
its first coefficient $\tmmathbf{y}_0$. The online algorithm that is behind
this process is presented in
Section~\ref{subsection:onlinerecursiveframework}. We present in
Section~\ref{section:shiftindex} the framework used to build evaluation
algorithms of shift $1$ for $\tmmathbf{\Phi}$. Finally we recall in
Section~\ref{subsec:onlinelinalgsolver} the online linear algebra system
solver, which is an application of the previous online solver.

The whole Section~\ref{section:relaxedframework} is a natural extension of
{\cite[Section~2]{BeLe12}}. We contribute by extending the framework to many
recursive $p$-adics, by giving a more educational description of the online
solver and by completing its proof.

\subsection{Online algorithms}\label{section:defonlinealgorithm}

The idea behind online and shifted algorithms is to control the access to the
$p$-adic coefficients of the input during the computation. The following
definition of the shift of an algorithm is a generalization of the original
definition of online algorithms given by {\citep{Hennie66,FiSt1974}}.

\begin{defn}
  \label{d:shiftMT}Let us consider a Turing machine $\Tau$ with $n$ inputs in
  $\Sigma^{\ast}$ and one output in $\Delta^{\ast}$, where $\Sigma$ and
  $\Delta$ are sets. We denote by $\tmmathbf{a}= (a^{(1)}, \ldots,
  a^{(\ell)})$ an input sequence of $\Tau$ and, for all $1 \leqslant i
  \leqslant \ell$, we write $a^{(i)} = a^{(i)}_0 a^{(i)}_1 \ldots a^{(i)}_n$
  with $a_j^{(i)} \in \Sigma$. We denote by $c_0 c_1 \ldots c_n$ the
  corresponding output, where $c_k \in \Delta$.
  
  For an input index $i$, we say that $\Tau$ has {\tmem{shift $s$ with respect
  to its $i$th input}} if $\Tau$ produces $c_k$ before reading $a_j^{(i)}$ for
  all $0 \leqslant k < j + s$ and all input $\tmmathbf{a}$.
  
  Also, we say that $\Tau$ has {\tmem{shift $s$}} if this is the case with
  respect to all its inputs.
\end{defn}

Considering $p$-adics as the sequence of their coefficients, we obtain a
notion of {\tmem{shift}} for algorithms with $p$-adic input and output.

Algorithms do not have a unique shift: if $\Tau$ has shift $s$ with respect
to its $i$th input, then any integer lesser than $s$ is such a shift. In the
last definition, we use Turing machines as a formal computation model that
includes reads and writes on the input and output tapes.

The notion of {\tmem{online}} (or equivalently {\tmem{relaxed}}) algorithms
is a specialization of the notion of shift.

\begin{defn}
  A Turing machine $\Tau$ is online if and only if it has shift $0$. Its $i$th
  input is an online argument if and only if $\Tau$ has shift $0$ for this
  input.
\end{defn}

Algorithms that are not online are called {\tmem{off-line}}, or equivalently
{\tmem{zealous}} following the terminology of {\citep{Hoeven2002}}.

Let us give a few examples of online algorithms. For the sake of clarity, we
will write our online algorithms iteratively, by regrouping the computations
that lead to the production of a new coefficient of the output. This is
particularly convenient to see the shift of an algorithm. It will also help us
understand the order of the computations and therefore the correctness of the
online recursive $p$-adics framework.

However, this presentation does not reflect how the algorithms are
implemented in {\tmname{Mathemagix}}. We refer to {\citep{Hoeven2002}} and
{\cite[Section 5.1]{BeHoLe11}} for a description of the actual
\tmverbatim{C++} implementation of recursive $p$-adics in
{\tmname{Mathemagix}}.

\begin{exmp}
  \label{Ex5}The first example of an online algorithm is the addition of
  $p$-adics. For computing the addition of $p$-adics $a$ and $b$, we use a
  subroutine that takes as input another $c \in R_p$ and an integer $i$. The
  extra $p$-adic $c$ stores the current state of the computation, while the
  integer $i$ indicates the step of the computation we are at. Computations at
  step $i$ are responsible for producing $c_{i - 1}$; they complete those of
  previous steps to get a result at precision $i$, {\tmem{i.e.}} modulo $p^i$.
  Step $1$ is additionally responsible for the initialization.
  
  \begin{algorithm}[!ht]
    \caption[]{\tmtextbf{$\mathtt{NaiveAddStep}$}} {
      \Input{$a, b, c \in R_p$ and $i \in \mathbbm{Z}$}
      \Output{$c \in R_p$}
      \Indp
      \BlankLine

      \lIf{$i = 1$} {$c = 0$ \hfill {\textbackslash}{\textbackslash} Initialization}
      \lIf{$i \geqslant 1$} {$c = c + (a_{i - 1} + b_{i - 1}) p^{i - 1}$}
      \Return{$c$}\;                          
    }
  \end{algorithm}
  
  The addition algorithm itself follows:
  
  \begin{algorithm}[!ht]
    \caption[]{\tmtextbf{$\mathtt{NaiveAdd}$}} {
      \Input{$a, b \in R_p$ and $n \in \mathbbm{N}$}
      \Output{$c \in R_p$ such that $c = (a + b)  \, \tmop{mod} p^n$}
      \Indp
      \BlankLine

      \For{$i$ {\tmstrongb{from}} $1$ {\tmstrongb{to}} $n$} {
        $c = \mathtt{NaiveAddStep} (a, b, c, i)$\;
      }
      \Return{$c$}\;                          
    }
  \end{algorithm}
  
  This addition algorithm is online: it outputs the coefficient $c_i$ of the
  addition $c = a + b$ without using any $a_j$ or $b_j$ of index $j > i$.
  After each step $i$, $c$ represents the sum of $a \, \tmop{mod} p^i$ and $b
  \, \tmop{mod} p^i$; thus, the result is correct modulo $p^i$.
\end{exmp}

\begin{exmp}
  \label{example:shiftoperator}Let us introduce two new operators: for all $s$
  in $\mathbb{N}^{\ast}$, define
  \begin{eqnarray*}
    \begin{array}{lllllllll}
      p^s \times \_: & R_p & \rightarrow & R_p &  & \_/ p^s : & p^s R_p &
      \rightarrow & R_p\\
      & a & \mapsto & p^s a, &  &  & a & \mapsto & a / p^s .
    \end{array}
  \end{eqnarray*}
  The implementation of these operators just moves (or shifts) the
  coefficients of the input. It does not call any multiplication algorithm.
  
  \begin{algorithm}[!ht]
    \caption[]{\tmtextbf{$\mathtt{OnlineShiftStep}$}} {
      \Input{$a, c \in R_p$, $s \in \mathbbm{Z}$ and $i \in \mathbbm{Z}$}
      \Output{$c \in R_p$}
      \Indp
      \BlankLine

      \lIf{$i = 1$} {$c = 0$ \hfill {\textbackslash}{\textbackslash} Initialization}
      \lIf{$i \geqslant \max (1, 1 + s)$} {$c = c + a_{(i - 1) - s} p^{i - 1}$}
      \Return{$c$}\;                          
    }
  \end{algorithm}

  
  Let $s \in \mathbbm{Z}$ and denote by $\mathtt{OnlineShift} (a, c, s, n_{})$
  the algorithm that puts \linebreak $\mathtt{OnlineShiftStep} (a, c, s, i_{})$ in a loop
  with $i$ varying from $1$ to $n \in \mathbbm{N}$. Then Algorithm
  $\mathtt{OnlineShift} (a, c, s, n_{})$ has shift $s$ with respect to its
  input $a$, and is online with respect to $a$ if and only if $s \geqslant 0$.
\end{exmp}

\subsection{Recursive $p$-adics}\label{section:recursivepadics}

The study of online algorithms is motivated by their efficient implementation
of recursive $p$-adics, which we introduce in this section. To the best of our
knowledge, the paper {\citep{Wa89}} was the first to mention the lazy
computation of power series which are solutions of a fixed point equation $y =
\Phi (y)$. The paper {\citep{Hoeven2002}}, in addition to rediscovering the
fast online multiplication algorithm of {\citep{FiSt1974}}, connected for the
first time this fast online multiplication algorithm to the online computation
of recursive power series. The article~{\citep{BeHoLe11}} generalizes this
setting to general $p$-adic rings. An issue about the correctness of the
online recursive $p$-adics framework was raised and solved in~{\citep{BeLe12}},
leading to the notion of {\tmem{shifted algorithm}}.

We start by giving a definition of a vector of recursive $p$-adics.

\begin{defn}
  \label{def:recursivepadic}Let $\ell \in \mathbbm{N}$, $\tmmathbf{\Phi}$ a
  function from $(R_p)^{\ell}$ to $(R_p)^{\ell}$, $\tmmathbf{y} \in
  (R_p)^{\ell}$ be a fixed point of $\tmmathbf{\Phi}$, {\tmem{i.e.}}
  $\tmmathbf{y}=\tmmathbf{\Phi} (\tmmathbf{y})$. We write $\tmmathbf{y}=
  \sum_{i \in \mathbbm{N}} \tmmathbf{y}_i p^i$ the $p$-adic decomposition of
  $\tmmathbf{y}$.
  
  Then, we say that the coordinates $(y_1, \ldots, y_{\ell})$ of
  $\tmmathbf{y}$ are {\tmem{recursive}} $p$-adics if for all $n \leqslant m
  \in \mathbb{N}^{\ast}$, the $p$-adic coefficient
  $(\tmmathbf{\Phi}(\tmmathbf{y}))_n$ does not depend on the coefficient
  $\tmmathbf{y}_m$, {\tmem{i.e.}} $(\tmmathbf{\Phi}(\tmmathbf{y}))_n =
  (\tmmathbf{\Phi}(\tmmathbf{y}+ p^n \tmmathbf{a}))_n$ for any $\tmmathbf{a}
  \in (R_p)^{\ell}$.
\end{defn}

The vector of $p$-adics $\tmmathbf{y}$ is called recursive since it can be
computed recursively from its first coefficient $\tmmathbf{y}_0$ and
$\tmmathbf{\Phi}$. Our definition of recursive $p$-adics extends the
definition of {\citep{BeLe12}} to many recursive $p$-adics.

\begin{exmp}
  \label{ex:recursivephi}Take $R =\mathbbm{Q} [T]$ and $p = T$ so that $R_p
  =\mathbbm{Q} [[T]]$. Consider the power series polynomial $\Phi (Y) = Y^2 +
  T \in (\mathbbm{Q} [[T]]) [Y]$.
  
  The rational $y_0 = 0$ is a modular fixed point of $\Phi$, {\tmem{i.e.}}
  $y_0 = \Phi (y_0) \, \tmop{mod} T.$ Hensel's Lemma states that there exists
  a unique power series fixed point of $\Phi$ satisfying $y_0 = 0$, that is
  \[
    y = \frac{1 - \sqrt{1 - 4 T}}{2} = T + T^2 + 2 T^3 + 5 T^4 +\mathcal{O}
    (T^5) .
  \]
  Let us prove that the power series $y$ is recursive. For any $b \in
  \mathbbm{Q} [[T]]$, there exists, by Taylor expansion at $y$, a power series
  $\Theta (y, b)$ such that $\Phi (y + b) - \Phi (y) = \Phi' (y) b + \Theta
  (y, b) b^2$. Taking $b = T^n a$ and noticing that $(\Phi' (y))_0 = (\Phi'
  (y_0))_0 = 0$, we get
  \[
    \Phi (y + T^n a) - \Phi (y) = \Phi' (y) T^n a + T^{2 n} \Theta (y, T^n a)
    \in T^{n + 1} \mathbbm{Q} [[T]] .
  \]
  More generally, if $\Phi \in R_p [X_1, \ldots, X_{\ell}]^{\ell}$, $\Phi
  (y_0) = y_0 \, \tmop{mod} p$ and $\Phi' (y_0) = 0 \, \tmop{mod} p$, then the
  unique lifted fixed point $y$ from $y_0$ is a recursive $p$-adic.
\end{exmp}

\subsection{Online framework for computing recursive
$p$-adics}\label{subsection:onlinerecursiveframework}

In this section, we introduce the notion of {\tmem{shifted algorithm}} and
present how it is used to compute a vector of recursive $p$-adics
$\tmmathbf{y}$ from the relation $\tmmathbf{y}=\tmmathbf{\Phi} (\tmmathbf{y})$
when $\tmmathbf{\Phi}$ is a shifted algorithm.

\begin{defn}
  Let $\tmmathbf{y} \in (R_p)^{\ell}$ be a vector of $p$-adics and
  $\tmmathbf{\Psi}$ be a Turing machine with $\ell$ inputs and $\ell$~outputs.
  
  Then, $\tmmathbf{\Psi}$ is said to be a {\tmem{shifted algorithm}} that
  computes $\tmmathbf{y}$ if
  \begin{enumerate}
    \item $\tmmathbf{y}=\tmmathbf{\Psi} (\tmmathbf{y})$,
    
    \item $\tmmathbf{\Psi}$ has shift $1$.
  \end{enumerate}
\end{defn}

The existence of a shifted algorithm $\tmmathbf{\Psi}$ for a vector of
$p$-adics $\tmmathbf{y}$ implies the recursivity of $\tmmathbf{y}$. Indeed,
the condition that $\tmmathbf{\Psi}$ has shift $1$ implies that
$(\tmmathbf{\Psi}(\tmmathbf{y}))_n = (\tmmathbf{\Psi}(\tmmathbf{y}+ p^n
\tmmathbf{a}))_n$ for any $\tmmathbf{a} \in (R_p)^{\ell}$ and $n \in
\mathbbm{N}$.

We now get down to the computation of $\tmmathbf{y}$ using the relation
$\tmmathbf{y}=\tmmathbf{\Psi} (\tmmathbf{y})$. The sketch of the computation
is the following: suppose that we are at the point where we know the $p$-adic
coefficients $\tmmathbf{y}_0, \ldots, \tmmathbf{y}_{n - 1}$ of $\tmmathbf{y}$
and $\tmmathbf{\Psi} (\tmmathbf{y})$ has been computed up to its $(n - 1)$th
coefficient. Since in the online framework, the computation is done step by
step, one can naturally ask for one more step of the evaluation of
$\tmmathbf{\Psi}$ at $\tmmathbf{y}$. Because $\tmmathbf{\Psi}$ has shift~$1$,
the $n$th step of the computation of $\tmmathbf{\Psi} (\tmmathbf{y})$, which
completes the computation of $(\tmmathbf{\Psi}(\tmmathbf{y})) \, \tmop{mod}
p^{n + 1}$, reads at most $\tmmathbf{y}_0, \ldots, \tmmathbf{y}_{n - 1}$ and
thus computes correctly. Now that we know $(\tmmathbf{\Psi}(\tmmathbf{y}))_n$,
we can deduce $\tmmathbf{y}_n = (\tmmathbf{\Psi}(\tmmathbf{y}))_n$.

We sum this up in the next algorithm. We slice the computations of
$\tmmathbf{\Psi}$ with respect to the coefficients of the output. For $i
\geqslant 1$, the $i$th step of the computations of $\tmmathbf{\Psi}$ regroups
all computations made strictly after the writing of the $(i - 2)$th
coefficient of the output until the writing of the $(i - 1)$th coefficient of
the output. Therefore, the $i$th step of $\tmmathbf{\Psi}$ is responsible for
completing the computations of previous step in order to get the result modulo
$p^i$.

\begin{algorithm}[!ht]
  \caption[]{\tmtextbf{$\mathtt{OnlineRecursivePadic}$}} {
    \Input{a shifted algorithm $\tmmathbf{\Psi}$ and $n \in \mathbbm{N}$}
    \Output{$\tmmathbf{y} \in (R_p)^{\ell}$ at precision $n$}
    \Indp
    \BlankLine

    $\tmmathbf{a}= [0, \ldots, 0]$\;
    
    \For{$i$ {\tmstrongb{from}} $1$ {\tmstrongb{to}} $n$} {
      Perform the $i$th step of the evaluation of $\tmmathbf{\Psi}$ at $\tmmathbf{a}$ \label{step:ORP3a} \;
      Copy the $p$-adic coefficient $(\tmmathbf{\Psi} (\tmmathbf{a}))_{i - 1}$ to $\tmmathbf{a}_{i - 1}$ \label{step:ORP3b} \;
    }
    \Return{$\tmmathbf{a}$}\;                          
  }
\end{algorithm}


It may seem that our algorithm allows to lift $\tmmathbf{y}$ from
$\tmmathbf{\Psi}$ without requiring $\tmmathbf{y}_0$. In fact,
$\tmmathbf{y}_0$ is encoded in $\tmmathbf{\Psi}$ since for any $a \in R_p$,
$\tmmathbf{y}_0 = (\tmmathbf{\Psi}(\tmmathbf{y}))_0 =
(\tmmathbf{\Psi}(\tmmathbf{y}+\tmmathbf{a}))_0$ which implies $\tmmathbf{y}_0
= (\tmmathbf{\Psi}(0))_0$ for instance.

Next proposition is the cornerstone of complexity estimates of recursive
$p$-adics. It is a slight generalization of {\cite[Proposition~10]{BeLe12}}.

\begin{prop}
  \label{p:complexityRelaxedRecursive}Let $\tmmathbf{\Psi}$ be a shifted
  algorithm for recursive $p$-adics $\tmmathbf{y}$. Then, Algorithm
  \tmverbatim{OnlineRecursivePadic} is correct and computes the vector of
  recursive $p$-adics $\tmmathbf{y}$ at precision $n$ in the time necessary to
  evaluate $\tmmathbf{\Psi}$ at $\tmmathbf{y}$ at precision $n$.
\end{prop}

\begin{pf}
  We start with the proof of correctness of Algorithm
  \tmverbatim{OnlineRecursivePadic}: let us show by induction for $i$ from $1$
  to $n + 1$ that $\tmmathbf{a}$ and $\tmmathbf{y}$ coincide modulo $p^{i -
  1}$ before step $i$. We consider that the beginning of the loop for $i = n +
  1$ coincides with the end of the loop for $i = n$. For $i = 1$, it is
  trivial since the equality is modulo $1$. Let us now assume the inductive
  hypothesis proved until step $i - 1$. Therefore $\tmmathbf{a}$ and
  $\tmmathbf{y}$ coincide modulo $p^{i - 1}$ at the beginning of step $i$.
  Since the $i$th step of $\tmmathbf{\Psi}$ is known to read at most
  $\tmmathbf{a}_0, \ldots, \tmmathbf{a}_{i - 2}$, which coincide with
  $\tmmathbf{y}_0, \ldots, \tmmathbf{y}_{i - 2}$, we deduce that the
  evaluation of Step~\ref{step:ORP3a} produces the same output
  $\tmmathbf{\Psi} (\tmmathbf{y}) \, \tmop{mod} p^i$ than if it were executed
  on the solution $\tmmathbf{y}$. Therefore $(\tmmathbf{\Psi}
  (\tmmathbf{a}))_{i - 1} = (\tmmathbf{\Psi} (\tmmathbf{y}))_{i - 1}
  =\tmmathbf{y}_{i - 1}$ and our inductive hypothesis follows.
  
  As a consequence, the cost of the computation of $\tmmathbf{y}$ {\tmem{is
  exactly the cost of the evaluation}} of $\tmmathbf{\Psi} (\tmmathbf{y})$ in
  $R_p$. Indeed reads and writes of Step~\ref{step:ORP3b} are
  not accounted for in our complexity model.
\end{pf}

\subsection{Creating shifted algorithms}\label{section:shiftindex}

This section is devoted to the process of creating shifted algorithms. We
start by recalling the basics of straight line programs (s.l.p.s). Using these
s.l.p.s, we build evaluation algorithms over $p$-adics based on online
arithmetics, which are good candidates to be shifted algorithms. Finally, we
introduce the notion of shift index of an s.l.p., which is the key to checking
that our candidates are shifted algorithms.

\paragraph*{Straight-line programs}Straight-line programs are a model of
computation that consists in ordered lists of instructions without branching.
We give a short presentation of this notion and refer to~{\citep{BCS97}} for
more details. We will use this model of computation to describe and analyze
the forthcoming recursive operators and shifted algorithms.

Let $R$ be a ring and $A$ an $R$-algebra. A {\tmem{straight-line program}} is
an ordered sequence of operations between elements of $A$. An
{\tmem{operation}} of {\tmem{arity}} $r$ is a map from a subset $\mathcal{D}$
of $A^r$ to $A$. We usually work with the binary arithmetic operators $+, -,
\ast : \hspace{1em} \mathcal{D} = A^2 \rightarrow A$. We also define for $r
\in R$ the $0$-ary operations $r^c$ whose output is the constant $r$ and
denote the set of all these operations by $R^c$. For $s \in
\mathbbm{N}^{\ast}$, we consider the unary operators $p^s \times \_: A
\rightarrow A$ and $\_/ p^s : p^s A \rightarrow A$ defined in
Example~\ref{example:shiftoperator}. Let us fix a set of operations $\Omega$,
{\tmem{e.g.}} $\Omega = \{ +, -, \ast, p^s \times \_, \_/ p^s \} \cup R^c$.

An s.l.p. starts with a number $\ell$ of {\tmem{input}} parameters indexed
from $- (\ell - 1)$ to 0. It has $L$ {\tmem{instructions}} $\Gamma_1, \ldots,
\Gamma_L$ with $\Gamma_i = (\omega_i ; u_{i, 1}, \ldots, u_{i, r_i})$ where $-
\ell < u_{i, 1}, \ldots, u_{i, r_i} < i$ and $r_i$ is the arity of the
operation $\omega_i \in \Omega$. The s.l.p. $\Gamma$ is {\tmem{executable}} on
$\tmmathbf{a}= (a_0, \ldots, a_{\ell - 1})$ with {\tmem{result sequence}}
$\tmmathbf{c}= (c_{- \ell + 1}, \ldots, c_L) \in A^{\ell + L}$, if $c_i =
a_{\ell - 1 + i}$ whenever $- (\ell - 1) \leqslant i \leqslant 0$ and $c_i =
\omega_i (c_{u, 1}, \ldots, c_{u, r_i})$ with $(c_{u, 1}, \ldots, c_{u, r_i})
\in \mathcal{D}_{\omega_i}$ whenever $1 \leqslant i \leqslant L$. Finally, the
s.l.p. has a number $r$ of outputs indexed by $1 \leqslant j_1, \ldots, j_r
\leqslant L$. We then say that $\Gamma$ computes $c_{j_1}, \ldots, c_{j_r}$ on
the input $\tmmathbf{a}$.

\paragraph*{Shift index of an s.l.p.}Let $\Gamma = (\Gamma_1, \ldots,
\Gamma_L)$ be an s.l.p. over the $R$-algebra $R_p$ with $\ell$ input
parameters and operations in $\Omega$. We define the weighted directed acyclic
graph $\mathcal{G}_{\Gamma}$ of $\Gamma$ as the graph with $\ell + L$ nodes
indexed by $- (\ell - 1), \ldots, L$ and directed edges $(u, j)$ for each
input index $u$ of the $j$th operation $\Gamma_j$. The edge $(u, j)$ has
weight $0$ if $\omega_j \in \{ +, -, \ast \}$. For any $s \in \mathbbm{N}$,
the edge $(u, j)$ has weight $s$ if $\omega_j = p^s \times \_$ and weight $-
s$ if $\omega_j =\_/ p^s$. Finally, we define the weight of any path $((v_0,
v_1), \ldots, (v_{r - 1}, v_r)) \nocomma$ as the sum of the weights of its
edges $(v_i, v_{i + 1})$.

The next definition of shift index is an extension of
{\cite[Definition~2]{BeLe12}} to s.l.p.s with many inputs and from a more
global point of view.

\begin{defn}
  \label{d:shift}For any pair $(h, j)$ such that $- \ell < h \leqslant j
  \leqslant L$, we define the {\tmem{shift index}} $\sh (\Gamma, h
  \rightsquigarrow j) \in \mathbbm{Z} \cup \{ + \infty \}$ of $(h, j)$ as the
  minimal weight of any path from $h$ to $j$ in the weighted directed graph
  associated to $\Gamma$. If there exists no such path, we set $\sh (\Gamma, h
  \rightsquigarrow j) = 0$ if $h = j$ and $\sh (\Gamma, h \rightsquigarrow j)
  = + \infty$ otherwise.
  
  Moreover, we define
  \[
  \begin{array}{rcl}
    \sh (\Gamma, h \rightsquigarrow .) & \assign & \min \left\{ \sh (\Gamma, h
    \rightsquigarrow j)  \middle| j \text{ an output index} \right\}\\
    \sh (\Gamma) & \assign & \min \left\{ \sh (\Gamma, h \rightsquigarrow .) 
    \middle| h \text{ an input index} \right\} .
  \end{array}
  \]
\end{defn}

\begin{exmp}
  \label{ex:slpdagphi}This example is the continuation of
  Example~\ref{ex:recursivephi}. We still consider the power series polynomial
  $\Phi (Y) = Y^2 + T \in (\mathbbm{Q} [[T]]) [Y]$. We can naturally associate
  to $\Phi$ the s.l.p. with one input, one output, and instructions
  \[
    \Gamma_1 = (\ast ; 0, 0), \hspace{1em} \Gamma_2 = (T^c), \hspace{1em}
    \Gamma_3 = (+ ; 1, 2) .
  \]
  Let $\Gamma'$ be the s.l.p. associated to $\Psi (Y) = T^2 \times ((Y / T)^2)
  + T$, that is the s.l.p. with one input, one output, and instructions
  \[
    \Gamma'_1 = (\_/ T ; 0), \hspace{1em} \Gamma'_2 = (\ast ; 1, 1),
    \hspace{1em} \Gamma'_3 = (T^2 \times \_; 2), \hspace{1em} \Gamma'_4 =
    (T^c), \hspace{1em} \Gamma'_5 = (+ ; 3, 4) .
  \]
  Then $\Gamma'$ describes another way to compute the polynomial $Y^2 + T$.
  
  We draw the directed acyclic graphs $\mathcal{G}_{\Gamma}$ and
  $\mathcal{G}_{\Gamma'}$ associated to $\Phi$ and $\Psi$ in
  Figure~\ref{fig:dagex}. The weight of the unique path from the input (drawn
  by a double circle) to the output (drawn with an external arrow) is $0$ for
  $\Phi$ and $1$ for $\Psi$. So we have $\sh (\Phi) = 0$ and $\sh (\Psi) = 1$.
  
  \begin{figure}[!ht]
    \resizebox{0.9\columnwidth}{!}{\includegraphics{./wgraph.eps}}
    \caption{\label{fig:dagex}Weighted directed acyclic graphs of $\Phi$ and
      $\Psi$ in Example~\ref{ex:slpdagphi}.}
  \end{figure}
\end{exmp}

A convenient way to compute shift indices is the following. Let $- \ell < h
\leqslant j \leqslant L$ and consider $\sh (\Gamma, h \rightsquigarrow j)$.
The last edge of any path from $h$ to $j$ must originate from an input $u$ of
the $j$th operation as its last step. So
\[
  \sh (\Gamma, h \rightsquigarrow j) = \min \left\{ \sh (h \rightsquigarrow u)
  + \tmop{weight} (u, j) \text{ } | \text{ } u \text{ input index of the $j$th
  operation} \right\} .
\]
Note that this is consistent with {\cite[Definition~2]{BeLe12}}.

\paragraph*{Shifted evaluation algorithms}Let $\Gamma$ be given as an s.l.p.
with operations in $\Omega = \{ +, -, \ast, \linebreak p^s \times \_, \_/ p^s \} \cup
R^c$. The upcoming Algorithm~$\mathtt{ShiftedEvaluationStep}$ evaluates
$\Gamma$ at $\tmmathbf{a}$ in a way that controls the shift of the algorithm.
Arithmetic operations are performed using online algorithms. Let
$\mathtt{OnlineAddStep}$ (resp. $\mathtt{OnlineSubStep}$,
$\mathtt{OnlineMulStep}$) be the step routine of any online addition (resp.
subtraction, multiplication) algorithm (see Examples~\ref{Ex5}
and~\ref{example:shiftoperator}). Only online multiplication actually offers
multiple implementation choices (see for instance
{\cite[Section~2.3]{LeSc13}}).

Notice that for any operation $j$ and any input index $u$ of the $j$th
operation, our choice of implementation is such that the algorithm has shift
$\tmop{weight} (u, j)$ with respect to its input $u$.

\begin{algorithm}[!ht]
  \caption[]{\tmtextbf{$\mathtt{OperationStep}$}} {
    \Input{an s.l.p. $\Gamma$, $[c_{- \ell + 1}, \ldots, c_L] \in (R_p)^{\ell + L}$ and $i \in \mathbbm{Z}$}
    \Output{$[c_1, \ldots, c_L] \in (R_p)^L$}
    \Indp
    \BlankLine

    \For{$j$ {\tmstrongb{from}} $1$ {\tmstrongb{to}} $L$} {
      $i' \assign i - \sh (\Gamma, j \rightsquigarrow .)$ \;
      \lIf{$ ( \Gamma_j = (' +' ; u, v) )$}
          {$c_j = \mathtt{OnlineAddStep} (c_u, c_v, c_j, i')$}
      \lIf{$(\Gamma_j = (' -' ; u, v))$}
          {$c_j = \mathtt{OnlineSubStep} (c_u, c_v, c_j, i')$}
      \lIf{$(\Gamma_j = (' \ast' ; u, v))$}
          {$c_j = \mathtt{OnlineMulStep} (c_u, c_v, c_j, i')$}
      \lIf{$(\Gamma_j = (p^s \times \_; u))$}
          {$c_j = \mathtt{OnlineShiftStep} (c_u, c_j, s, i'_{})$}
      \lIf{$(\Gamma_j = (\_/ p^s ; u))$}
          {$c_j = \mathtt{OnlineShiftStep} (c_u, c_j, - s, i'_{})$}
      \lIf{$(\Gamma_j = (r^c ;))$}
          {$c_j = c_j + r_{i'} p^{i'}$}
    }
    \Return{$[c_1, \ldots, c_L]$}\;
  }
\end{algorithm}

\begin{algorithm}[!ht]
  \caption[]{\tmtextbf{$\mathtt{ShiftedEvaluationStep}$}} {
    \Input{an s.l.p. $\Gamma$, $\tmmathbf{a}=
      (a_0, \ldots, a_{\ell - 1}) \in (R_p)^{\ell}$, $[c_1, \ldots, c_L] \in
      (R_p)^L$ and $i \in \mathbbm{Z}$}
    \Output{$[c_1, \ldots, c_L] \in (R_p)^L$}
    \Indp
    \BlankLine

    \If(\hfill{\textbackslash}{\textbackslash} Initialization){$i = 1$} 
       {
         $[c_{- \ell + 1}, \ldots, c_0] = [a_0, \ldots, a_{\ell - 1}]$; 
         $[c_1, \ldots, c_L] = [0, \ldots, 0]$\;
         
         \For{$k$ {\tmstrongb{from}} $1 + \min_{- \ell < j \leqslant L} \left( \sh (\Gamma, j \rightsquigarrow .) \right)$ {\tmstrongb{to}} $0$} {
           $[c_1, \ldots, c_L] = \mathtt{OperationStep} (\Gamma, [c_{- \ell + 1}, \ldots, c_L], k)$
         }
       }
    \If{$i \geqslant 1$} {$[c_1, \ldots, c_L] = 
      \mathtt{OperationStep} (\Gamma, [c_{- \ell + 1}, \ldots, c_L], i)$}
    \Return{$[c_1, \ldots, c_L]$}\;                          
  }
\end{algorithm}

Once again, Algorithm $\mathtt{ShiftedEvaluationStep}$ is a subroutine that
corresponds to one step of following Algorithm $\mathtt{ShiftedEvaluation}$,
that computes the result sequence $[c_1, \ldots, c_L] \in (R_p)^L$ of the
s.l.p. $\Gamma$ on the input $\tmmathbf{a} \in (R_p)^{\ell}$. Note that we may
need to perform a few more steps of $\mathtt{OperationStep}$ at initialization
in order to guarantee that every step subroutine ({\tmem{e.g.}}
$\mathtt{OnlineAddStep}$) starts from $i' = 1$ even if $\sh (\Gamma, j
\rightsquigarrow .) < 0$. We recall that our step routines do nothing when $i'
\leqslant 0$ by design.

\begin{algorithm}[!t]
  \caption[]{\tmtextbf{$\mathtt{ShiftedEvaluation}$}} {
    \Input{an s.l.p. $\Gamma$, $\tmmathbf{a}= (a_0, \ldots, a_{\ell - 1}) \in (R_p)^{\ell}$ and 
      $n \in \mathbbm{N}$}
    \Output{$[c_1, \ldots, c_L] \in (R_p)^L$}
    \Indp
    \BlankLine
    
    \For{$i$ {\tmstrongb{from}} $1$ {\tmstrongb{to}} $n$} {
      $[c_1, \ldots, c_L] = \mathtt{ShiftedEvaluationStep} (\Gamma,
      \tmmathbf{a}, [c_1, \ldots, c_L], i)$
    }
    \Return{$[c_1, \ldots, c_L]$}\;
  }
\end{algorithm}

We can now prove that shift index and shift are compatible; the shift index of
an s.l.p. $\Gamma$ is a shift of Algorithm $\mathtt{ShiftedEvaluation}
(\Gamma, \tmmathbf{a}, n)$ with respect to its input $\tmmathbf{a}$.

\begin{prop}
  \label{p:shiftedeval}Let $b_{- \ell + 1}, \ldots, b_L$ be the result
  sequence of the s.l.p. $\Gamma$ on input $\tmmathbf{a}$ and $j_1, \ldots,
  j_r$ be the indices of its output. Then Algorithm
  $\mathtt{ShiftedEvaluation}$ has shift $\sh (\Gamma)$ with respect to its
  input $\tmmathbf{a}$. Moreover, Algorithm $\mathtt{ShiftedEvaluation}$
  outputs the result sequence at precision $n$, {\tmem{i.e.}} $c_{j_k} =
  b_{j_k} \, \tmop{mod} p^n$ for all $1 \leqslant k \leqslant r$.
\end{prop}

\begin{pf}
  For the purposes of the proof, we introduce Algorithm
  $\mathtt{ShiftedEvaluationBis}$. It is a variant of Algorithm
  $\mathtt{ShiftedEvaluation}$ that differs only in terms of presentation of
  the initialization step $1$, which is now split in many steps $i$ from $1 +
  \min_{- \ell < j \leqslant L} \left( \sh (\Gamma, j \rightsquigarrow .)
  \right)$ to $1$.
  
  \begin{algorithm}[!ht]
    \caption[]{\tmtextbf{$\mathtt{ShiftedEvaluationBis}$}} {
      \Input{an s.l.p. $\Gamma$, $\tmmathbf{a}= (a_0, \ldots, a_{\ell - 1}) \in (R_p)^{\ell}$ and 
        $n \in \mathbbm{N}$}
      \Output{$[c_1, \ldots, c_L] \in (R_p)^L$}
      \Indp
      \BlankLine
      
      $[c_{- \ell + 1}, \ldots, c_0] = [a_0, \ldots, a_{\ell - 1}]$;  
      $[c_1, \ldots, c_L] = [0, \ldots, 0]$\;
      
      \For{$i$ {\tmstrongb{from}} $1 + \min_{- \ell < j \leqslant L} \left( \sh (\Gamma, j \rightsquigarrow .) \right)$ {\tmstrongb{to}} $n$} {
        $[c_1, \ldots, c_L] = \mathtt{OperationStep} (\Gamma, [c_{- \ell + 1}, \ldots, c_L], k)$
      }
      \Return{$[c_1, \ldots, c_L]$}\;
    }
  \end{algorithm}

  
  Let $(c_j)_{- \ell < j \leqslant L}$ be the variables of
  $\mathtt{ShiftedEvaluationBis}$ and denote by $s$ the integer $- \min_{- \ell
  < j \leqslant L} \left( \sh (\Gamma, j \rightsquigarrow .) \right) \geqslant
  0$. For any pair $(i, j) \in \llbracket 1 - s ; n \rrbracket \times
  \rrbracket - \ell ; L \rrbracket$, we let $c_{(i, j)}$ be the truncated
  $p$-adic $c_j \, \tmop{mod} p^{i'}$ where $i' \assign i - \sh (\Gamma, j
  \rightsquigarrow .)$. If $i' \leqslant 0$, we set $c_{(i, j)} = 0$ by
  convention. Algorithm $\mathtt{ShiftedEvaluationBis}$ computes progressively
  the $p$-adics $c_{(i, j)}$ for $(i, j) \in \llbracket 1 - s ; n \rrbracket
  \times \llbracket 1 ; L \rrbracket$ following the lexicographic order
  $<_{\tmop{lex}}$ with $(0, 1) <_{\tmop{lex}} (1, 0)$. Let us prove by
  induction on $(i, j) \in \llbracket 1 - s ; n \rrbracket \times \rrbracket -
  \ell ; L \rrbracket$ that $c_{(i, j)} = b_{(i, j)}$ and, if $j \geqslant 0$,
  that the $(i, j)$th step of the computation reads at most $c_{(k, u)}$ for
  $(k, u) <_{\tmop{lex}} (i, j)$.
  
  We initiate the recursion: $c_{(1 - s, \um \ell + 1)}$ is an input of
  $\Gamma$, so we have the equalities $c_{- \ell + 1} = a_{- \ell + 1} = b_{-
  \ell + 1}$, which also hold modulo any power of $p$. Let us now assume that
  the inductive hypothesis is verified for all $(k, m) <_{\tmop{lex}} (i, j)$.
  If $j \leqslant 0$ then $c_{(i, j)}$ corresponds to an input and $c_{(i, j)}
  = b_{(i, j)}$ as before. Otherwise $j > 0$ and $c_{(i, j)}$ is obtained from
  the $i'$th step of the $j$th operation. Let $u < j$ be the index of an input
  of the $j$th operation. Then, the current computation reads at most $c_{(u,
  k)}$ for $k' \leqslant i' - \tmop{weight} (u, j)$. Since
  \[
    \sh (\Gamma, u \rightsquigarrow .) \leqslant \tmop{weight} (u, j) + \sh
    (\Gamma, j \rightsquigarrow .),
  \]
  we obtain $k \leqslant i$ and therefore $(k, u) \leqslant_{\tmop{lex}} (i,
  u) <_{\tmop{lex}} (i, j)$ which proves the second part of our induction.
  
  By the inductive hypothesis, all the coefficients $c_{(k, u)}$ that are read
  by the $j$th operation up to step $i$ coincide with $b_{(k, u)}$. Therefore
  the $j$th operation produces the same output than if it were executed on the
  inputs $b_{- \ell + 1}, \ldots, b_L$. Since the loop on $i$ starts from $1 -
  s$, we have performed all the steps from $1$ to $i'$ of the $j$th operation,
  whose output $c_j$ consequently equals to $b_j$ modulo $p^{i'}$,
  {\tmem{i.e.}} $c_{(i, j)} = b_{(i, j)}$. This concludes our induction.
  
  Using our induction, the $i$th step of $\mathtt{ShiftedEvaluationBis}$ reads
  at most \linebreak $a_j \, \tmop{mod} p^{i - \sh (\Gamma, j \rightsquigarrow .)}$ for
  any input index $- \ell < j \leqslant 0$. The first part of the proposition
  follows from $\sh (\Gamma) \leqslant \sh (\Gamma, j \rightsquigarrow .)$ for
  any input index $- \ell < j \leqslant 0$. The second part of the proposition
  is a direct consequence of our induction on couples $(n, j_k)$ for all $1
  \leqslant k \leqslant r$.
\end{pf}

\begin{cor}
  \label{c:shitedevalcomputerecpadic}Let $\tmmathbf{y} \in (R_p)^{\ell}$ be a
  vector of $p$-adics and $\tmmathbf{\Psi}$ be an s.l.p.~of positive shift
  index $\sh (\tmmathbf{\Psi}) \geqslant 1$ such that
  $\tmmathbf{y}=\tmmathbf{\Psi} (\tmmathbf{y})$. Then Algorithm
  $\mathtt{ShiftedEvaluation} (\tmmathbf{\Psi}, \_, n)$ is a shifted algorithm
  that computes $\tmmathbf{y}$.
\end{cor}

\begin{exmp}
  \label{ex:slpdagphiend}This example is the continuation of
  Examples~\ref{ex:recursivephi} and \ref{ex:slpdagphi}. In particular, we
  keep the notations $\Phi$ and $\Psi$ for the two s.l.p.s respectively
  associated to $Y^2 + T$ and $T^2 \times ((Y / T)^2) + T$. The two s.l.p.s
  are related: if $a = 0 \, \tmop{mod} T$, then $\Phi (a) = \Psi (a)$. In
  particular, $\Phi$ and $\Psi$ give fixed point equations for the recursive
  $p$-adic $y$, {\tmem{i.e.}} $\Psi (y) = \Phi (y) = y$.
  
  Since $\sh (\Psi) = 1$, the s.l.p. $\Psi$ satisfies the conditions of
  Corollary~\ref{c:shitedevalcomputerecpadic} and can be used to compute $y$
  accordingly to Proposition~\ref{p:complexityRelaxedRecursive}. On the
  contrary, $\sh (\Phi) = 0$ and its associated evaluation algorithm
  $\mathtt{ShiftedEvaluation} (\Phi, \_, n)$ does not introduce the shift in
  the coefficients of $y$ necessary to be able to compute $y$.
\end{exmp}

\begin{rem}
  One drawback of the online method for computing recursive $p$-adics is the
  space complexity. We have seen that we store the current state of each
  computation of $\Gamma$ in Algorithm $\mathtt{ShiftedEvaluation}$. This
  leads to a space complexity $\mathcal{O} (nL)$ to compute the recursive
  $p$-adic at precision $n$ where $L$ is the size of $\Gamma$.
  
  In Newton's iteration approach, the required evaluation of $\Gamma$ could
  use significantly less memory by freeing the result of a computation as soon
  as it is used for the last time. For this reason, Newton's iteration may
  consume less memory.
\end{rem}

\subsection{Online linear algebra system
solver}\label{subsec:onlinelinalgsolver}

One of the building blocks that will be required to lift triangular sets is an
online $p$-adic linear system solver. In this section, we recall the main
result concerning the online linear system solver of {\cite[Section
4]{BeLe12}}. This solver is built upon the online recursive $p$-adic
framework. We refer to the original paper for more details.

We consider a linear system of the form $\tmmathbf{A}=\tmmathbf{B} \cdot
\tmmathbf{C}$, where $\tmmathbf{A}$ and $\tmmathbf{B}$ are known, and
$\tmmathbf{C}$ is the unknown. The matrix $\tmmathbf{A}$ belongs to
$\mathcal{M}_{m, 1} (R_p)$ and $\tmmathbf{B} \in \mathcal{M}_m (R_p)$ is
invertible; we solve the linear system $\tmmathbf{A}=\tmmathbf{B} \cdot
\tmmathbf{C}$ for $\tmmathbf{C} \in \mathcal{M}_{m, 1} (R_p)$.

\begin{prop}[{\citealp{BeLe12}}, Proposition~21]
  \label{prop:linearalgebrasolver}With the previous notations and given
  $\tmmathbf{C}_0$ and $\Gamma \assign (\tmmathbf{B}_0)^{- 1} \, \tmop{mod}
  p$, there exists an algorithm $\mathtt{LinearSolver}$ online with respect to
  inputs $\tmmathbf{A}$ and $\tmmathbf{B}$ that outputs the linear system
  solution $\tmmathbf{C}$ at precision $n$ in time $\mathcal{O} \left( m^2 
  \mathsf{R} (n) \right)$.
\end{prop}

We extend the set of operations $\Omega$ of our s.l.p.s with this new
operation $\mathtt{LinearSolver}$ and, if $\Gamma_j = \left(
\mathtt{LinearSolver} ; u, v \right)$, we set the weight of the edges $(u, j)$
and $(v, j)$ as 0. Since this Algorithm $\mathtt{LinearSolver}$ is online,
this choice of shift index is consistent with Proposition~\ref{p:shiftedeval}
and Corollary~\ref{c:shitedevalcomputerecpadic}.

\section{Quotient and remainder modulo a triangular set}\label{sec:mulremquo}

This section deals with Euclidean division modulo a triangular set. In this
section, we denote by $\tmmathbf{t}= (t_1, \ldots, t_s)$ a triangular set in
$R [X_1, \ldots, X_s]$, with $R$ being any ring. Computing remainders is a
basic operation necessary to be able to compute with the quotient algebra $A
\assign R [X_1, \ldots, X_s] / (\tmmathbf{t})$. We are also interested in the
quotients of the division since we will need them later.

We start by defining quotients and remainder of the Euclidean division by
$\tmmathbf{t}$ in a unique manner in Section~\ref{section:canonicalquotient}.
Then we focus on computing these objects. We circumvent the fact that the size
of the quotients is exponential in the size $d_1 \cdots d_s$ of the quotient
algebra $A$ by computing only reductions of the quotients modulo a triangular
set. This leads us to Algorithms \tmverbatim{Rem} and \tmverbatim{Rem\_quo} of
Section~\ref{section:fastmulquo}. In this section, we will consider only
arithmetic complexity over $R$.

\subsection{Canonical quotients and
remainder}\label{section:canonicalquotient}

For any $g \in R [X_1, \ldots, X_s]$, the existence of $r, q_1, \ldots, q_s
\in R [X_1, \ldots, X_s]$ satisfying $g = r + q_1 t_1 + \cdots + q_s t_s$ and
$\deg_{X_i} (r) < d_i$ is guaranteed because triangular sets are Gr{\"o}bner
bases. However, the quotients $q_1, \ldots, q_s$ are not necessarily unique.
For $1 \leqslant i < j \leqslant s$, let $z_{i, j}$ be the vector of $R [X_1,
\ldots, X_s]^s$ with only $t_j$ in the $i$th position and $- t_i$ in the $j$th
position. We can add to any choice of quotients $(q_1, \ldots, q_s)$ an
element of the syzygy $R [X_1, \ldots, X_s]$-module spanned by the $(z_{i,
j})_{1 \leqslant i < j \leqslant s}$ in $R [X_1, \ldots, X_s]^s$.
Nevertheless, a canonical choice of quotient can be made.

\begin{lem}
  \label{lemma:eucldiv}For all $g \in R [X_1, \ldots, X_s]$, there exists a
  unique vector of polynomials $(r, q_1, \ldots, q_s)$ in $R [X_1, \ldots,
  X_s]^{s + 1}$ such that
  \[
    g = r + q_1 t_1 + \cdots + q_s t_s
  \]
  and for all $1 \leqslant i \leqslant s$, $\deg_{X_i} (r) < d_i$ and for all
  $1 \leqslant i < j \leqslant s$, $\deg_{X_j} (q_i) < d_j$.
\end{lem}

\begin{pf}
  Take any Euclidean decomposition $g = r + q_1 t_1 + \cdots + q_s t_s$ with
  $\deg_{X_i} (r) < d_i$. Then use the syzygies $(z_{1, i})_{1 < i \leqslant
  s}$ to reduce the degree of $q_1$ in $X_2, \ldots, X_s$. Again use the
  syzygies $(z_{2, i})_{2 < i \leqslant s}$ to reduce the degree of $q_2$ in
  $X_3, \ldots, X_s$. This last action does not change $q_1$. Continuing the
  process until we reduce the degree of $q_{s - 1}$ in $X_s$ by $z_{s - 1,
  s}$, we have exhibited a Euclidean decomposition satisfying the hypothesis
  of the lemma.
  
  Now let us prove the uniqueness of $(r, q_1, \ldots, q_s)$. Because $r$ is
  unique, we have to prove that if $q_1 t_1 + \cdots + q_s t_s = 0$ with
  $\deg_{X_j} (q_i) < d_j$ for all $1 \leqslant i < j \leqslant s$, then $q_1
  = \cdots = q_s = 0$. By contradiction, we suppose there is such a
  decomposition with a non-zero $q_i$. Let $j$ be the maximal index of a
  non-zero $q_j$. Then $\deg_{X_j} (q_j t_j) \geqslant d_j$ and at the same
  time
  \begin{eqnarray*}
    \deg_{X_j} (q_j t_j) & = & \deg_{X_j} (q_1 t_1 + \cdots + q_{j - 1} t_{j -
    1})\\
    & \leqslant & \max_{i < j} (\deg_{X_j} (q_i t_i))\\
    & \leqslant & \max_{i < j} (\deg_{X_j} (q_i))\\
    & < & d_j .
  \end{eqnarray*}
  Contradiction.
\end{pf}

We call canonical quotients and remainder, those which satisfy the conditions
of Lemma \ref{lemma:eucldiv}. We denote by $g \tmop{rem} \tmmathbf{t}$ the
canonical remainder of $g$ modulo $\tmmathbf{t}$. We will not compute the
whole quotients $q_i$ because they suffer from the phenomenon of
{\tmem{intermediate expression swell}}; in the computations of the remainder
of a polynomial modulo a triangular set, the size of intermediate expressions,
e.g. the size of the quotients, increases too much. A quick estimate gives
that the number of monomials of the quotients is exponential in the size $d_1
\cdots d_s$ of the quotient algebra $A$ {\citep{Lang91}}.

Instead, we will show how to compute modular reductions of the quotients.

\subsection{Fast multivariate Euclidean division by a triangular
set}\label{section:fastmulquo}

Recall that $d_i$ denotes the degree in $X_i$ of $t_i$. For any triangular set
$\tmmathbf{t}$ in $R [X_1, \ldots, X_s]$, we say that the variables $\{ X_j  |
d_j > 1 \}$ are the {\tmem{essential variables}} and denote by $e \assign \#
\{ i | d_i > 1 \}$ their number. Only those variables play a true role in the
quotient algebra $A \assign R [X_1, \ldots, X_s] / (\tmmathbf{t})$. If $r$ is
a reduced normal form modulo $\tmmathbf{t}$ (seen as a Gr{\"o}bner basis for
the lexicographic order $X_1 \ll \cdots \ll X_s$), then $r$ is written on the
$e$ essential variables. For the sake of simplicity in our forthcoming
algorithms, we will assume that the set of indices $\{ i | d_i > 1 \}$ of
essential variables is $\{ 1, \ldots, e \}$, so that any reduced normal form
$r$ belongs to $R [X_1, \ldots, X_e]$.

\

We start with Algorithm \tmverbatim{Rem}, which is a variant of the algorithm
of {\citep{LiMaSc09}}. It is designed to reduce the product of two reduced
elements, therefore we suppose that the input polynomial $g \in R [X_1,
\ldots, X_e]$ satisfies $\deg_{X_i} (g) \leqslant 2 (d_i - 1)$. We denote by
$\tmop{rev}_{X_i} (g)$ the reverse polynomial of $g \in R [X_1, \ldots, X_s]$
with respect to $X_i$, {\tmem{i.e.}} $\tmop{rev}_{X_i} (g) \assign
X_i^{\deg_{X_i} (g)} g (1 / X_i)^{}$.

\begin{algorithm}[!ht]
  \caption[]{\tmtextbf{$\mathtt{Rem}$}} {
   \Input{$g \in R [X_1, \ldots, X_e]$ and 
     $\tmmathbf{t}$ such that $\deg_{X_i} (g) \leqslant 2 (d_i - 1)$}
   \Output{$r = g \tmop{rem} \tmmathbf{t} \in R [X_1, \ldots, X_e]$}
   \Indp
   \BlankLine
   
   Let $\tmmathbf{t}' \assign (t_1, \ldots, t_{e - 1})$ 
   and $R' \assign R [X_1, \ldots, X_{e - 1}] / (\tmmathbf{t}')$\;
   Compute the quotient $q_e$ of $g$ by $t_e$ in $R' [X_e]$: \label{step:quotient} \;
   
   \Indp
   $q_e \assign \sum_{i = d_e}^{2 d_e - 1}
   \mathtt{Rem} (g [X_e^i], \tmmathbf{t}') X_e^i$ \label{step:quotienta} \;
        
   Precompute $I \assign 1 / \tmop{rev}_{X_e}
   (t_e) \tmop{rem} X_e^{d_e - 1}$ \hfill in $R' [X_e]$ \label{step:quotientb} \\
        
   $q_e \assign \tmop{rev}_{X_e} (q_e) I
   \tmop{rem} X_e^{d_e}  \hfill \tmop{in} R' [X_e]$ \label{step:quotientc} \\
        
   $q_e \assign \tmop{rev}_{X_e} (q_e)$\;
   
   \Indm
   $r \assign (g - q_e t_e) \tmop{rem} X_e^{d_e}$
   \hfill in $R [X_1, \ldots, X_{e - 1}] [X_e]$ \label{step:reducen} \\
   $r \assign \sum_{i = 0}^{d_e - 1} \mathtt{Rem} (r [X_e^i], \tmmathbf{t}') X_e^i$\;
   \Return{$r$}\;
  }
\end{algorithm}

The precomputation of step~\ref{step:quotientb} means
that, as the object $I$ depends only on $\tmmathbf{t}$, we compute it once and
for all at the first call of Algorithm \tmverbatim{Rem}.

Let $\mathsf{M} (d_1, \ldots, d_s) = \mathsf{M} (\tmmathbf{d})$ denote the
cost of multiplication of dense multivariate polynomials $g \in R [X_1,
\ldots, X_s]$ satisfying $\deg_{X_i} (g) < d_i$ for all $1 \leqslant i
\leqslant s$. By Kronecker substitution, we get that $\mathsf{M}
(\tmmathbf{d}) =\mathcal{O} \left( \mathsf{M} (2^s d_1 \cdots d_s) \right)$
{\citep{GaGe03}}.

We define $\mathsf{Rem} (d_1, \ldots, d_s)$ to be the arithmetic cost of
reducing polynomials $g \in R [X_1, \ldots, X_s]$ satisfying $\deg_{X_i} (g)
\leqslant 2 (d_i - 1)$ modulo $\tmmathbf{t}$. The number $e$ of
{\tmem{essential variables}} plays an important role because $\mathsf{Rem}
(\tmmathbf{d})$ is exponential in $e$.

\begin{prop}
  \label{prop:complexrem}The algorithm \tmverbatim{Rem} is correct and has
  cost
  \[
    \mathsf{Rem} (d_1, \ldots, d_e) =\mathcal{O} (3^e d \log (d) \log (\log
    (d))) .
  \]
\end{prop}

\begin{pf}
  The algorithm is a multivariate generalization of the fast univariate
  division with remainder {\cite[Section 9.1]{GaGe03}}. We refer to
  {\citep{LiMaSc09}} for the proof of correction of our algorithm.
  
  Let us focus on the complexity. Step~\ref{step:quotientc} involves a multiplication in $R
  [X_1, \ldots, X_e]$ and a reduction by $\tmmathbf{t}'$ of the coefficients
  in $X_e^i$ for $i < d_e$. So multivariate multiplications are used in 
  steps~\ref{step:quotientc} and \ref{step:reducen} and $d_e$
  reductions by $\tmmathbf{t}'$ are done in steps~\ref{step:quotienta},
  \ref{step:quotientc} and \ref{step:reducen}. Thus the
  complexity analysis becomes
  \begin{eqnarray*}
    \mathsf{Rem} (d_1, \ldots, d_e) & = & 3 d_e  \mathsf{Rem} (d_1, \ldots,
    d_{e - 1}) + 2 \mathsf{M} (d_1, \ldots, d_e)\\
    & = & 3 d_e  \mathsf{Rem} (d_1, \ldots, d_{e - 1}) + 2 \mathsf{M} (2^e
    d_1 \cdots d_e)\\
    & = & 3 d_e  \mathsf{Rem} (d_1, \ldots, d_{e - 1}) +\mathcal{O} (2^e d
    \log (2^e d) \log (\log (2^e d)))
  \end{eqnarray*}
  Unrolling the recurrence, we get
  \begin{eqnarray*}
    \mathsf{Rem} (d_1, \ldots, d_e) & = & \mathcal{O} \big( 2^e
    d \log (2^e d) \log (\log (2^e d)) + \\
    &  & + 3 \cdot 2^{e - 1} d \log (2^{e - 1} d / d_e) \log (\log (2^{e - 1}
    d / d_e)) + \cdots\\
    &  & + 3^{e - 1} d \log (d_1) \log (\log (d_1)) \big)\\
    & = & \mathcal{O} (3^e d \log (d) \log (\log (d))) .
  \end{eqnarray*}
  The precomputation of step~\ref{step:quotientb} is an
  inversion of power series done by Newton iteration. The initialization is
  trivial; indeed $1 / \tmop{rev}_{X_e} (t_e) = 1 \, \tmop{mod} X_e$ since
  $t_e$ is monic. The cost of the Newton iteration is big-O of the cost of the
  last step, which is $\mathsf{M} (d_1, \ldots, d_e) + d_e  \mathsf{Rem} (d_1,
  \ldots, d_{e - 1})$. So the precomputation can be done in time $\mathcal{O}
  \left( \mathsf{Rem} (d_1, \ldots, d_e) \right)$.
\end{pf}

Our algorithm is a slight improvement of the algorithm of {\citep{LiMaSc09}};
the exponential factor in the complexity is $3^e$ instead of $4^e$.

We obtain the complexity estimate of modular multiplication given in
Proposition~\ref{prop:costMT} of the introduction as corollary of
Proposition~\ref{prop:complexrem}:
\[
  \mathsf{MT} (\tmmathbf{d}) = \mathsf{M} (\tmmathbf{d}) + \mathsf{Rem}
  (\tmmathbf{d}) =\mathcal{O} \left( 3^e d \log (d) \log (\log (d)) \right) .
\]
Remark that non-essential variables do not impact the complexity of our
algorithm, {\tmem{i.e.}} $\mathsf{Rem} (\tmmathbf{d}) = \mathsf{Rem} (d_1,
\ldots, d_e)$, and the same for the modular multiplication.

\

Now we adapt Algorithm \tmverbatim{Rem} to keep the quotients modulo another
triangular set $\tmmathbf{t}^{(2)} = (t^{(2)}_1, \ldots, t^{(2)}_s)$. In order
to simplify the algorithm and because it suits our future needs, we assume
that for all $i$, $\deg_{X_i} (t_i^{(1)}) = \deg_{X_i} (t_i^{(2)})$ and still
denote by $d_i$ this degree. Once again, our algorithm is designed to take the
product of two reduced elements as input, so we suppose that $\deg_{X_i} (g)
\leqslant 2 (d_i - 1)$.

\begin{algorithm}[!ht]
  \caption[]{\tmtextbf{$\mathtt{Rem\_quo}$}} {
   \Input{$g \in R [X_1, \ldots, X_e]$ s.t.
     $\deg_{X_i} (g) \leqslant 2 (d_i - 1)$ and triangular sets
     $\tmmathbf{t}^{(1)}$, $\tmmathbf{t}^{(2)}$.}
   \Output{$r, q_1, \ldots, q_e \in R [X_1, \ldots, X_e]$
     reduced modulo $\tmmathbf{t}^{(1)}$ such that
     \[
     g = r + \sum_{i = 1}^e q_i t_i^{(1)} \hspace{1em} \tmop{modulo}
     (\tmmathbf{t}^{(1)})  (\tmmathbf{t}^{(2)}) .
     \] }
   \Indp
   \BlankLine
   
   Let $\tmmathbf{t}^{(2)\prime} \assign (t_1^{(2)}, \ldots, t_{e -
     1}^{(2)})$ and $R' \assign R [X_1, \ldots, X_{e - 1}] /
   (\tmmathbf{t}^{(2)\prime})$.\;
   
   Compute the quotient $q_e$ of $g$ by $t_e^{(1)}$ in $R' [X_e]$: \;
   
   \Indp
   $q_e \assign \sum_{i = d_e}^{2 d_e - 1} \mathtt{Rem} (g [X_e^i], \tmmathbf{t}^{(2)\prime}) X_e^i$\;
   
   Precompute $I \assign 1 / \tmop{rev}_{X_e} (t_e^{(1)})
   \tmop{rem} X_e^{d_e - 1}$ \hfill in $R' [X_e]$ \\
        
   $q_e \assign (\tmop{rev}_{X_e} (q_e) I) \tmop{rem} X_e^{d_e}$ \hfill in $R' [X_e]$\\
        
   $q_e \assign \tmop{rev}_{X_e} (q_e)$\;
   
   \Indm
   $r \assign (g - q_e t_e^{(1)})$ \hfill in $R [X_1, \ldots, X_e]$\\
   
   $r_1 \assign r \tmop{rem} X_e^{d_e}$, \ $r_2 = r - r_1$\;
   
   $0, q_1, \ldots, q_{e - 1} \assign \sum_{i =
     d_e}^{2 d_e - 1} \mathtt{Rem\_quo} (r_2 [X_e^i], \tmmathbf{t}^{(2)\prime},
   (t_1^{(1)}, \ldots, t_{e - 1}^{(1)})) X_e^i$ \label{step:rc1} \;
   
   \For{$i$ {\tmstrongb{from}} $1$ {\tmstrongb{to}} $e - 1$ }
         { $q_i' \assign \mathtt{Rem} (q_i, \tmmathbf{t}^{(1)})$ \label{step:reduce1} }
         
   $r \assign r_1 + q_1' t^{(2)}_1 + \cdots + q_{e - 1}' t^{(2)}_{e -
           1}$ {\hspace*{\fill}}in $R [X_1, \ldots, X_e]$\\
      
   $r, q_1, \ldots, q_{e - 1} \assign \sum_{i =
     0}^{d_e - 1} \mathtt{Rem\_quo} (r [X_e^i], \tmmathbf{t}^{(1)\prime},
   \tmmathbf{t}^{(2)\prime}) X_e^i$ \label{step:rc2} \;
      
   \Return{$r, q_1, \ldots, q_{e - 1}, q_e$}\;
  }
\end{algorithm}

\begin{lem}
  \label{lemma:relremquo}If $r$ is reduced modulo $\tmmathbf{t}^{(1)}$ and $g
  = r + \sum_{i = 1}^e q_i t^{(1)}_i$ modulo the product ideal
  $(\tmmathbf{t}^{(1)})  (\tmmathbf{t}^{(2)})$, then $r$ is the reduced normal
  form of $g$ modulo $\tmmathbf{t}^{(1)}$ and
  \[
    g = r + \sum_{i = 1}^e q_i t^{(1)}_i \hspace{1em} \tmop{modulo}
    \tmmathbf{t}^{(2)} .
  \]
\end{lem}

\begin{pf}
  Since the product ideal $(\tmmathbf{t}^{(1)})  (\tmmathbf{t}^{(2)})$ is
  included in both the ideals $(\tmmathbf{t}^{(1)})$ and
  $(\tmmathbf{t}^{(2)})$, the relation $g = r + \sum_{i = 1}^e q_i t^{(1)}_i$
  stands modulo both these ideals. In particular $g = r$ modulo
  $\tmmathbf{t}^{(1)}$ and, since $r$ is reduced modulo $\tmmathbf{t}^{(1)}$,
  it is the reduced normal form of $g$ modulo $\tmmathbf{t}^{(1)}$.
\end{pf}

We denote by $\mathsf{RemQuo} (d_1, \ldots, d_e)$ the complexity of
\tmverbatim{Rem\_quo} for triangular sets $\tmmathbf{t}^{(1)}$ and
$\tmmathbf{t}^{(2)}$ of same degrees $d_1, \ldots, d_e$.

\begin{prop}
  \label{prop:complexremquo}Algorithm $\mathtt{Rem\_quo}$ is correct and its
  cost is
  \[
    \mathsf{RemQuo} (d_1, \ldots, d_e) =\mathcal{O} \left( e \mathsf{Rem}
    (d_1, \ldots, d_e) \right) =\mathcal{O} \left( e \mathsf{MT} (d_1, \ldots,
    d_e) \right) .
  \]
\end{prop}

\begin{pf}
  We proceed recursively on the number $e$ on variables involved in $g$. In
  one variable, our algorithm coincides with the fast univariate division with
  remainder (see {\cite[Section 9.1]{GaGe03}}). So it is correct and
  $\mathsf{RemQuo} (d_1) = \mathsf{Rem} (d_1)$.
  
  Let's suppose that we have proved our claims in less that $e$ variables.
  Since $q_e$ is the quotient of $g$ by $t_e^{(1)}$ in $(R [X_1, \ldots, X_{e
  - 1}] / (\tmmathbf{t}^{(2)\prime})) [X_e]$, we have $r_2 = 0$ in\linebreak $(R [X_1,
  \ldots, X_{e - 1}] / (\tmmathbf{t}^{(2)\prime})) [X_e]$. By assumption, the
  recursive call of step \ref{step:rc1} gives the decomposition
  \[
    r_2 = \sum_{i = 1}^{e - 1} q_i t^{(2)}_i \hspace{1em} \tmop{modulo}
    (\tmmathbf{t}^{(1)\prime})  (\tmmathbf{t}^{(2)\prime})
  \]
  and also modulo $(\tmmathbf{t}^{(1)})  (\tmmathbf{t}^{(2)})$. The reduction
  of the quotient of step \ref{step:reduce1} gives
  \[
    r_2 = \sum_{i = 1}^{e - 1} q_i' t^{(2)}_i \hspace{1em} \tmop{modulo}
    (\tmmathbf{t}^{(1)})  (\tmmathbf{t}^{(2)})
  \]
  where the polynomials $q_i'$ are reduced modulo $\tmmathbf{t}^{(1)}$.
  Therefore the polynomial $r_2' \assign \sum_{i = 1}^{e - 1} q_i' t^{(2)}_i$
  has degree $\deg_{X_e} (r_2') < d_e$ and $\deg_{X_i} (r_2') < 2 d_i$ for $i
  < e$. Because $r_1$ satisfies the same degree conditions, they are still
  satisfied by $r = r_1 + r_2'$. By the induction hypothesis, at step
  \ref{step:rc2}, we have for all $0 \leqslant i < d_e$ and $1 \leqslant j
  \leqslant e - 1$, that $q_j [X_e^i]$ is reduced modulo
  $\tmmathbf{t}^{(1)\prime}$. Since $q_j$ has degree less than $d_e$ in $X_e$, it
  is reduced modulo $\tmmathbf{t}^{(1)}$. The last quotient $q_e$ is also
  reduced because it was computed in $(R [X_1, \ldots, X_{e - 1}] /
  (\tmmathbf{t}^{(2)\prime})) [X_e]$ and $\deg_{X_e} (q_e) = \deg_{X_e} (g) -
  \deg_{X_e} (t_e^{(1)}) < d_e$. Finally
  \begin{eqnarray*}
    g = r_1 + r_2 + q_e t_e^{(1)} & = & (r_1 + r_2') + q_e t_e^{(1)}
    \hspace*{\fill} \tmop{modulo} (\tmmathbf{t}^{(1)})  (\tmmathbf{t}^{(2)})\\
    & = & \left( r + \sum_{i = 1}^{e - 1} q_i t_i^{(1)} \right) + q_e
    t_e^{(1)} \hspace*{\fill} \tmop{modulo} (\tmmathbf{t}^{(1)}) 
    (\tmmathbf{t}^{(2)}) .
  \end{eqnarray*}
  Concerning the complexity analysis, we have
  \begin{eqnarray*}
    \mathsf{RemQuo} (d_1, \ldots, d_e) & = & 2 d_e  \mathsf{RemQuo} (d_1,
    \ldots, d_{e - 1}) + 2 d_e  \mathsf{Rem} (d_1, \ldots, d_{e - 1}) +\\
    &  & (e - 1)  \mathsf{Rem} (d_1, \ldots, d_e) + (e + 1)  \mathsf{M} (d_1,
    \ldots, d_e)
  \end{eqnarray*}
  which gives
  \[
    \mathsf{RemQuo} (d_1, \ldots, d_e) =\mathcal{O} \left( e \mathsf{Rem}
    (d_1, \ldots, d_e) \right) . \hfill \qed
  \]
  \let\qed\relax
\end{pf}

As for the remainder algorithm, we have $\mathsf{RemQuo} (\tmmathbf{d}) =
\mathsf{RemQuo} (d_1, \ldots, d_e)$, so that $\mathsf{RemQuo} (\tmmathbf{d})
=\mathcal{O} \left( e \mathsf{Rem} (\tmmathbf{d}) \right)$.

Finally, we mention that there exists a different approach for computing
remainders modulo a triangular set {\citep{BCHS11}}: it relies roughly on an
evaluation / interpolation on the points of the variety defined by the
triangular set. Because this approach can not be adapted to obtain the
quotients, we did not consider it here.

\subsection{Shift index of remainder and quotient}

We now specify the base ring to be the ring of $p$-adics $R_p$.

\begin{lem}
  \label{lemma:shiftmoddiv}If arithmetic operations are performed in $R_p$ by
  online algorithms, then both Algorithms $\mathtt{Rem}$ and
  $\mathtt{Rem\_quo}$ are online.
\end{lem}

\begin{pf}
  We prove it for $\mathtt{Rem\_quo}$, the other case being similar. We
  proceed by induction on the number $s$ of variables involved in the input of
  $\tmmathbf{t}^{(1)}$. If no variables are involved, then the result is
  trivial. From now on, let us assume that the result is valid for input of
  less than $s$ variables.
  
  First, we prove that the computations that leads to $I \assign 1 /
  \tmop{rev}_{X_s} (t_s) \tmop{rem} X_s^{d_s - 1}$ in $R' [X_s]$ are online.
  Define $I_0 \assign 1$ and $I_{\ell} \assign I_{\ell - 1} - I_{\ell - 1} 
  (\tmop{rev}_{X_{\ell}} (t_{\ell}) I_{\ell - 1} - 1)$ in $R' [X_s] /
  (X_s^{\ell})$. Thereby $I = I_{\lceil \log_2 (d_s - 1) \rceil}$ modulo
  $X_s^{d_s - 1}$. We conclude by noticing that $I_{\ell}$ is obtained from
  $I_{\ell - 1}$ by an online multiplication and reductions modulo
  $\tmmathbf{t}'$ which are also online.
  
  Our algorithm uses only recursive calls in less variables, online additions
  and multiplications. Since the composition of online algorithms is online,
  the lemma is proved.
\end{pf}

We extend one last time our set of operations $\Omega$ with the new operations
$\mathtt{Rem}$ and $\mathtt{Rem\_quo}$. Let $\Gamma$ be an s.l.p.~whose $j$th
operation is either $\mathtt{Rem}$ and $\mathtt{Rem\_quo}$ and let $u$ be one
of the input indices, then we define $\tmop{weight} (u, j) \assign 0$. Since
these algorithms are online by Lemma~\ref{lemma:shiftmoddiv}, this choice of
shift index is consistent with Proposition~\ref{p:shiftedeval} and
Corollary~\ref{c:shitedevalcomputerecpadic}.

\section{Relaxed lifting of triangular sets}\label{section:relaxlifttriangset}

In this section we detail two relaxed algorithms that lift triangular sets.
The first algorithm of Section \ref{section:firstshalgo} should be used for
triangular set of generic multi-degree. We refine this algorithm in Section
\ref{section:secondshalgo} for triangular sets with few essential variables,
which is the case of univariate representations.

Suppose that $\tmmathbf{f}$ satisfies assumption $\left( \mathsf{H} \right)$
and admits a triangular representation $\tmmathbf{t}$ with coefficients in $Q$
and multi-degree $\tmmathbf{d}$. Suppose that assumption $\left( \mathsf{H}'
\right)_{\tmmathbf{t}, p}$ holds and that we know $\tmmathbf{t}_0
=\tmmathbf{t} \, \tmop{mod} p$. Hypothesis $\left( \mathsf{H}'
\right)_{\tmmathbf{t}, p}$ implies that the Jacobian matrix $\tmop{Jac}
(\tmmathbf{f}_0)$ is invertible over $(R / (p)) [X_1, \ldots, X_s] /
(\tmmathbf{t}_0)$. Our objective is to compute $\tmmathbf{t}$ from
$\tmmathbf{f}$ and $\tmmathbf{t}_0$.

Define the $R$-algebra $B \assign R [X_1, \ldots, X_s] / (\tmmathbf{t}_0)$,
$B_0 \assign (R / (p)) [X_1, \ldots, X_s] / (\tmmathbf{t}_0)$ its reduction
modulo $p$ and $B_p \assign R_p [X_1, \ldots, X_s] / (\tmmathbf{t}_0)$ its
$p$-adic completion.

Throughout this section, we let $\tmmathbf{f}$ be given as an s.l.p. $\Gamma$
with inputs $X_1, \ldots, X_s$ and $s$ outputs corresponding to $f_1, \ldots,
f_s$. The s.l.p. $\Gamma$ has operations in $\{ +, -, \ast \}$ and can use
constants in $B$. Denote by $c_{- s}, \ldots, c_L$ the result sequence of the
s.l.p. $\Gamma$ on the input $X_1, \ldots, X_s$. Let $r_i$ and
$\tmmathbf{b}_i$ be the canonical remainder and quotients of $c_i$ for $- s
\leqslant i \leqslant L$. So we have $c_i = r_i + \text{}^t \tmmathbf{b}_i
\cdot \tmmathbf{t} \in R [X_1, \ldots, X_s]$. Let $i_1, \ldots, i_s$ be the
indices of the $s$ outputs of $\Gamma$, so that we have $f_j = c_{i_j}$ for $1
\leqslant j \leqslant s$. We denote by $\tmmathbf{B} \in \mathcal{M}_s (R
[X_1, \ldots, X_s])$ the matrix whose $j$th row is $\tmmathbf{b}_{i_j}$.
Therefore one has $\tmmathbf{f}=\tmmathbf{B} \cdot \tmmathbf{t} \in
\mathcal{M}_{s, 1} (R [X_1, \ldots, X_s])$.

Let us consider vectors as $s \times 1$ matrices. We fix the notation
$\tmmathbf{A} \cdot \tmmathbf{v}$ for the matrix vector product and similarly
$\text{}^t \tmmathbf{v}_1 \cdot \tmmathbf{v}_2$ for the inner product of two
vectors, $\text{}^t \tmmathbf{v}$ being the transposed vector of
$\tmmathbf{v}$. We also let $c \times \tmmathbf{v}$ be the coefficientwise
product of a scalar $c$ by a vector $\tmmathbf{v}$.

\subsection{Using the quotient matrix}\label{section:firstshalgo}

We define two maps $\sigma$ and $\delta$ from $R_p$ to $R_p$ by $\sigma (a) =
a_0$ and $\delta (a) \assign \frac{a - a_0}{p}$ for any $a = \sum_{i \in
\mathbbm{N}} a_i p^i \in R_p$. For any $a \in R_p$, we have $a = \sigma (a) +
p \delta (a)$. We extend the definition of $\sigma$ and $\delta$ to
polynomials by acting coefficientwise and to matrices by acting componentwise.
Thus $\sigma (\tmmathbf{t})$, also denoted by $\tmmathbf{t}_0$, verifies
$\sigma (\tmmathbf{t}) = (\sigma (t_1), \ldots, \sigma (t_s))$.

\paragraph*{Recursive formula for $\tmmathbf{t}$.}The triangular set
$\tmmathbf{t}$ is a recursive $p$-adic vector of polynomials.

\begin{lem}
  \label{lemma:1strecursiveoperator}The matrix $\sigma (\tmmathbf{B})$ is
  invertible modulo $\tmmathbf{t}_0$. Let $\tmmathbf{\Gamma}$ be a
  representative in $\mathcal{M}_s (R_p [X_1, \ldots, X_s])$ of $\sigma
  (\tmmathbf{B})^{- 1} \, \tmop{mod} \tmmathbf{t}_0$.
  
  Then the triangular set $\tmmathbf{t}$ satisfies the recursive equation in
  $\mathcal{M}_{s, 1} (R_p [X_1, \ldots, X_s])$
  \begin{eqnarray}
    \label{eq:recursiveshiftedeq} \tmmathbf{t}-\tmmathbf{t}_0 =
    [\tmmathbf{\Gamma} \cdot (\tmmathbf{f}- p^2  (\delta (\tmmathbf{B}) \cdot
    \delta (\tmmathbf{t})))] \tmop{rem} \tmmathbf{t}_0 .
  \end{eqnarray}
\end{lem}

\begin{pf}
  By differentiating the equality $\tmmathbf{f}_0 = \sigma (\tmmathbf{B})
  \cdot \tmmathbf{t}_0 \in \mathcal{M}_{s, 1} (R / (p) [X_1, \ldots, X_s])$
  and then reducing modulo $\tmmathbf{t}_0$, we get $\tmop{Jac}
  (\tmmathbf{f}_0) = \sigma (\tmmathbf{B}) \cdot \tmop{Jac} (\tmmathbf{t}_0)$
  in $\mathcal{M}_s (B_0)$. Since $\tmop{Jac} (\tmmathbf{f}_0)$ is invertible
  in $\mathcal{M}_s (B_0)$ by hypothesis, $\tmmathbf{B}_0$ and $\tmop{Jac}
  (\tmmathbf{t}_0)$ are also invertible
  \begin{eqnarray}
    \sigma (\tmmathbf{B}) = \tmop{Jac} (\tmmathbf{f}_0) \cdot \tmop{Jac}
    (\tmmathbf{t}_0)^{- 1} \in \mathcal{M}_s (B_0) \label{eq:sigmaBJacfJact}
  \end{eqnarray}
  Then $\sigma (\tmmathbf{B})$ is invertible in $\mathcal{M}_s (B_p)$ since it
  is invertible modulo $p$.
  
  For any $g \in R [X_1, \ldots, X_s]$, let $r$ and $\tmmathbf{a}$ be the
  canonical remainder and quotients of $g$ by $\tmmathbf{t}$ so that
  \[
    g - r = \text{}^t \tmmathbf{a} \cdot \tmmathbf{t}= \text{}^t \sigma
    (\tmmathbf{a}) \cdot \tmmathbf{t}+ p (\text{}^t \delta (\tmmathbf{a})
    \cdot \tmmathbf{t}) = \text{}^t \sigma (\tmmathbf{a}) \cdot \tmmathbf{t}+
    p (\text{}^t \delta (\tmmathbf{a}) \cdot \tmmathbf{t}_0) + p^2  (\text{}^t
    \delta (\tmmathbf{a}) \cdot \delta (\tmmathbf{t})) .
  \]
  Thus we have $\text{}^t \sigma (\tmmathbf{a}) \cdot \tmmathbf{t}= g - (r +
  p^2  (\text{}^t \delta (\tmmathbf{a}) \cdot \delta (\tmmathbf{t}))) \in
  B_p$. Now if $g \in (\tmmathbf{t})$, then $r = 0$. We apply this to the
  equations $\tmmathbf{f}$ and get
  \begin{eqnarray}
    \sigma (\tmmathbf{B}) \cdot \tmmathbf{t}=\tmmathbf{f}- p^2  (\delta
    (\tmmathbf{B}) \cdot \delta (\tmmathbf{t})) \in \mathcal{M}_{s, 1} (B_p) .
    \label{formula:simplerecursiveeq}
  \end{eqnarray}
  It remains to invert $\sigma (\tmmathbf{B})$ to get
  \[
    \tmmathbf{t}-\tmmathbf{t}_0 =\tmmathbf{t} \tmop{rem} \tmmathbf{t}_0 =
    [\tmmathbf{\Gamma} \cdot (\tmmathbf{f}- p^2  (\delta (\tmmathbf{B}) \cdot
    \delta (\tmmathbf{t})))] \tmop{rem} \tmmathbf{t}_0 \in \mathcal{M}_{s, 1}
    (R_p [X_1, \ldots, X_s]) . \hfill \qed
  \]
  \let\qed\relax
\end{pf}

Recursive Equation~(\ref{eq:recursiveshiftedeq}) will be our shifted algorithm
that will compute $\tmmathbf{t}$ thanks to
Proposition~\ref{p:complexityRelaxedRecursive}. Indeed, taking the coefficient
in $p^m$ of Equation~(\ref{eq:recursiveshiftedeq}), we get that the $p$-adic
coefficient $\tmmathbf{t}_m \assign (t_{1, m}, \ldots, t_{s, m})$ depends only
on the $p$-adic coefficients $\tmmathbf{B}_i$ and $\tmmathbf{t}_i$ with $i <
m$. We will now see how to compute $\tmmathbf{B}$ from $\tmmathbf{f}$ and
$\tmmathbf{t}$ by a relaxed algorithm, so that $\tmmathbf{B}_i$ depends only
on $\tmmathbf{t}_j$ with $j \leqslant i$.

\paragraph*{Computation of $\tmmathbf{B}$ modulo $\tmmathbf{t}_0$.}In this
paragraph, we explain how to compute the remainder $r_i$ and quotients
$\tmmathbf{b}_i$ by $\tmmathbf{t}$ of any element $c_i$ of the result
sequence. Since Equation (\ref{eq:recursiveshiftedeq}) is modulo
$\tmmathbf{t}_0$, this quantities are only required modulo $\tmmathbf{t}_0$.
We proceed recursively on the index $i$ for $- s \leqslant i \leqslant L$.

First, we start with the inputs $X_1, \ldots, X_s$ on our s.l.p. $\Gamma$. For
$- s < i \leqslant 0$, we have $c_i = X_{\bar{\imath}}$ where $\bar{\imath}
\assign i + s$ and we distinguish two cases:
\begin{itemize}
  \item if $d_{\bar{\imath}} > 1$, then $X_{\bar{\imath}}$ is already reduced
  modulo $\tmmathbf{t}$, we put $r_i \assign X_{\bar{\imath}}$ and
  $\tmmathbf{b}_i \assign (0, \ldots, 0)$.
  
  \item if $d_{\bar{\imath}} = 1$, then $\tmmathbf{b}_i \assign (0, \ldots, 0,
  1, 0, \ldots, 0)$ with only a one in position $\bar{\imath}$ and $r_i =
  X_{\bar{\imath}} - t_{\bar{\imath}}$.
\end{itemize}
Let us now turn to operations of the s.l.p. indexed by $0 < i \leqslant L$. If
the $i$th result $c_i$ is a constant in $B$, then it is reduced modulo
$\tmmathbf{t}$ because $\tmmathbf{t}$ and $\tmmathbf{t}_0$ have the same
multi-degree. Consequently, we take $r_i \assign c_i$ and $\tmmathbf{b}_i
\assign (0, \ldots, 0)$.

Otherwise $c_i = c_j \tmop{op} c_k$ with $\tmop{op} \in \{ +, -, \ast \}$ and
$j, k < i$. If $\tmop{op}$ is an addition then we set
\begin{eqnarray*}
  r_i & \assign & r_j + r_k\\
  \tmmathbf{b}_i & \assign & \tmmathbf{b}_j +\tmmathbf{b}_k .
\end{eqnarray*}
Subtractions are dealt similarly. Let us consider the case of the
multiplication. Define $r, \tmmathbf{q} \assign \mathtt{Rem\_quo} (r_j r_k,
\tmmathbf{t}, \tmmathbf{t}_0)$ be the reductions modulo $\tmmathbf{t}_0$ of
the canonical remainder and quotients of $r_j r_k$ by $\tmmathbf{t}$. By
Lemma~\ref{lemma:relremquo}, $r = r_j r_k \tmop{rem} \tmmathbf{t}$ and $r_j
r_k = r + \text{}^t \tmmathbf{q} \cdot \tmmathbf{t} \in B_p$. So one has
\begin{eqnarray*}
  c_j c_k & = & r_j r_k + \text{}^t [(r_j + \text{}^t \tmmathbf{b}_j \cdot
  \tmmathbf{t}) \times \tmmathbf{b}_k + r_k \times \tmmathbf{b}_j] \cdot
  \tmmathbf{t}\\
  & = & r + \text{}^t [\tmmathbf{q}+ (r_j + \text{}^t \tmmathbf{b}_j \cdot
  \tmmathbf{t}) \times \tmmathbf{b}_k + r_k \times \tmmathbf{b}_j] \cdot
  \tmmathbf{t}
\end{eqnarray*}
in $B_p$ and we set
\begin{eqnarray}
  r_i & \assign & r \nonumber\\
  \tmmathbf{b}_i & \assign & \tmmathbf{q}+ (r_j + \text{}^t \tmmathbf{b}_j
  \cdot \tmmathbf{t}) \times \tmmathbf{b}_k + r_k \times \tmmathbf{b}_j . 
  \label{formula:simplerecmul}
\end{eqnarray}
\paragraph*{Shifted algorithm.}We put all these formulas together to form an
algorithm that computes all the remainders $r_i$ and quotients
$\tmmathbf{b}_i$ modulo $\tmmathbf{t}_0$. We describe this algorithm as a
straight-line program, in order to prove that it is a part of a shifted
algorithm.

Let $L$ be the length of the s.l.p. $\Gamma$ of $\tmmathbf{f}$. We define
recursively in $i$ such that $- s < i \leqslant L$ some s.l.p.'s
$\varepsilon^i$ with $s$ inputs. These s.l.p.'s $\varepsilon^i$ compute, on
the entries $\tmmathbf{t}$ given as the list of their polynomial coefficients,
the remainders $r_j$ and quotients $\tmmathbf{b}_j$ of $c_j$ for $j < i$. We
call $\rho^i$ and $\tmmathbf{\alpha}^i = (\alpha^i_1, \ldots, \alpha^i_s)$ the
outputs of $\varepsilon^i$ corresponding to $r_i$ and $\tmmathbf{b}_i$.

\begin{defn}
  Let us initiate the induction for $- s < i \leqslant 0$ and $\bar{\imath}
  \assign i + s$:
  \begin{itemize} %% **
    \item if $d_{\bar{\imath}} = 1$, then we define $\varepsilon^i \assign
    (r_{\bar{\imath}}, 0, 1)$ where $r_{\bar{\imath}} \assign X_{\bar{\imath}}
    - t_{\bar{\imath}}$. The output $\rho^i$ points to $r_{\bar{\imath}}$ and
    $\alpha^i_m$ points to $0$ if $m \neq \bar{\imath}$ or $1$ otherwise;
    
    \item if $d_{\bar{\imath}} > 1$, then we define $\varepsilon^i \assign
    (X_{\bar{\imath}}, 0)$. The output $\rho^i$ points to $X_{\bar{\imath}}$
    and $\alpha^i_m$ points to $0$ for any $1 \leqslant m \leqslant s$.
  \end{itemize} %% **
  Now recursively for $0 < i \leqslant L$, depending on the operation type of
  $\Gamma_i$:
  \begin{itemize} %% **
    \item if $\Gamma_i = (g^c)$ with $g$ reduced modulo $\tmmathbf{t}_0$, then
    we define $\varepsilon^i \assign (g, 0)$. The output $\rho^i$ points to P
    and $\alpha^i_m$ points to $0$ for any $1 \leqslant m \leqslant s$;
    
    \item if $\Gamma_i = (+ ; u, v)$, then we build $\varepsilon^i$ on top of
    $\varepsilon^u$ and $\varepsilon^v$ in such a manner that one has $\rho^i
    \assign \rho^u + \rho^v$ and $\tmmathbf{\alpha}^i \assign
    \tmmathbf{\alpha}^u +\tmmathbf{\alpha}^v$;
    
    \item if $\Gamma_i = (- ; u, v)$, then we build $\varepsilon^i$ on top of
    $\varepsilon^u$ and $\varepsilon^v$ in such a manner that one has $\rho^i
    \assign \rho^u - \rho^v$ and $\tmmathbf{\alpha}^i \assign
    \tmmathbf{\alpha}^u -\tmmathbf{\alpha}^v$;
    
    \item if $\Gamma_i = (\ast ; u, v)$, we define $\varepsilon^i$ accordingly
    to formula (\ref{formula:simplerecmul}). First, we compute $r,
    \tmmathbf{q} \assign \mathtt{Rem\_quo} (\rho^u (\tmmathbf{t}) \rho^v
    (\tmmathbf{t}), \tmmathbf{t}, \tmmathbf{t}_0)$. Then $\rho^i \assign r$
    and $\tmmathbf{\alpha}^i$ is defined by
    \[
      \tmmathbf{q}+ (\rho^u (\tmmathbf{t}) + \text{}^t \tmmathbf{\alpha}^u
      (\tmmathbf{t}) \cdot \tmmathbf{t}) \times \tmmathbf{\alpha}^v
      (\tmmathbf{t}) + \rho^v (\tmmathbf{t}) \times \tmmathbf{\alpha}^u
      (\tmmathbf{t}), \tmmathbf{t}_0 .
    \]
  \end{itemize} %% **
  Finally, we set $\varepsilon = \varepsilon^L$.
\end{defn}

The s.l.p. $\varepsilon$ computes the matrix $\tmmathbf{B}$ on the entries
$\tmmathbf{t}$. We build an s.l.p. $\tmmathbf{\Lambda}$ on top of
$\varepsilon$ such that
\[
  \tmmathbf{\Lambda}: \tmmathbf{t} \mapsto \tmmathbf{t}_0 +
  \mathtt{LinearSolver} (\tmmathbf{f}- p^2 \times (\delta (\tmmathbf{B}) \cdot
  \delta (\tmmathbf{t})), \sigma (\tmmathbf{B})) .
\]
Since we need the right-hand side of Formula~(\ref{eq:recursiveshiftedeq})
modulo $\tmmathbf{t}_0$, all computations in the s.l.p.s $\varepsilon$ and
$\tmmathbf{\Lambda}$ take place in $B_p$. There are two notable exceptions:
the product $r_j r_k$ in $r, \tmmathbf{q} \assign \mathtt{Rem\_quo} (r_j r_k,
\tmmathbf{t}, \tmmathbf{t}_0)$ should be in $R_p [X_1, \ldots, X_s]$.
Otherwise, $r$ is not the canonical remainder of $c_i$ modulo $\tmmathbf{t}$
and Equation~(\ref{formula:simplerecursiveeq}) does not hold. The second
exception is the addition by $\tmmathbf{t}_0$ in $\tmmathbf{\Lambda}$ which
should be done in $R_p [X_1, \ldots, X_s]$ since
Formula~(\ref{eq:recursiveshiftedeq}) holds there.

\begin{lem}
  \label{lemma:simpleshifted}Algorithm $\mathtt{ShiftedEvaluation}
  (\tmmathbf{\Lambda}, \_, n)$ is a shifted algorithm for the recursive
  $p$-adics $\tmmathbf{t}$.
\end{lem}

\begin{pf}
  To prove our lemma, we will rely on
  Corollary~\ref{c:shitedevalcomputerecpadic}. Note that the triangular set
  $\tmmathbf{t}$ is a fixed point of the s.l.p. $\tmmathbf{\Lambda}$ because
  of Equation~(\ref{eq:recursiveshiftedeq}). It remains to prove that $\sh
  (\tmmathbf{\Lambda}) \geqslant 1$.
  
  Let us consider the partial s.l.p.~$\tmmathbf{t} \mapsto \tmmathbf{B}$ of
  $\tmmathbf{\Lambda}$ whose output is $\tmmathbf{B}$. Since the s.l.p.
  $\varepsilon$ uses only additions, subtractions, multiplications,
  $\mathtt{Rem}$ and $\mathtt{Rem\_quo}$, and since all these operations
  preserve a zero shift index (see Definition~\ref{d:shift}), we know that
  $\sh (\tmmathbf{t} \mapsto \tmmathbf{B}) = 0$. Besides
  \begin{eqnarray*}
    \sh (\tmmathbf{t} \mapsto p^2 \times (\delta (\tmmathbf{B}) \cdot \delta
    (\tmmathbf{t}))) & = & 2 + \sh (\tmmathbf{t} \mapsto \delta (\tmmathbf{B})
    \cdot \delta (\tmmathbf{t}))\\
    & = & 2 + \min \left( \sh (\tmmathbf{t} \mapsto \delta (\tmmathbf{B})),
    \sh (\tmmathbf{t} \mapsto \delta (\tmmathbf{t})) \right)\\
    & = & 1 + \min \left( \sh (\tmmathbf{t} \mapsto \tmmathbf{B}), \sh
    (\tmmathbf{t} \mapsto \tmmathbf{t}) \right)\\
    & = & 1.
  \end{eqnarray*}
  Furthermore, notice that $\tmmathbf{f} \tmop{rem} \tmmathbf{t}_0$ and
  $\sigma (\tmmathbf{B})$ depend only on $\tmmathbf{t}_0$. Finally the
  resolution of the linear system preserves the shift index
  (Proposition~\ref{prop:linearalgebrasolver}), hence we have $\sh
  (\tmmathbf{\Lambda}) = 1$.
\end{pf}

Using the online recursive $p$-adic framework, we have our relaxed $p$-adic
triangular set Hensel lifting algorithm. We can now prove our first main
result and state the complexity of our algorithm.

\begin{pf}[of Theorem \ref{theorem:master}]
  Lemma \ref{lemma:simpleshifted} and
  Proposition~\ref{p:complexityRelaxedRecursive} show that we can compute
  $\tmmathbf{t}$ at precision $n$ in the time necessary to apply
  Algorithm~$\mathtt{ShiftedEvaluation} (\tmmathbf{\Lambda}, \_, n)$.
  
  {\noindent}{\tmem{Cost of $\varepsilon$.}} The dominant cost when evaluating
  $\varepsilon$ corresponds to multiplications $\ast$ in $\tmmathbf{f}$. These
  steps make one call to Algorithm \tmverbatim{Rem\_quo}, one inner product of
  vectors modulo $\tmmathbf{t}_0$, and a few additions and multiplications
  modulo $\tmmathbf{t}_0$. Thereby the total cost of evaluating~$\varepsilon$
  is $\mathcal{O} \left( L \mathsf{R} (n)  \left( \mathsf{RemQuo}
  (\tmmathbf{d}) + s \mathsf{MT} (\tmmathbf{d}) \right) \right) =\mathcal{O}
  \left( sL \mathsf{R} (n)  \mathsf{MT} (\tmmathbf{d}) \right)$ (see
  Proposition~\ref{prop:complexremquo}).
  
  {\tmem{{\noindent}Cost of $\tmmathbf{f} \tmop{rem} \tmmathbf{t}_0$.}}
  Evaluating the s.l.p. $\tmmathbf{f}$ over $B_p$ costs $\mathcal{O} \left( L
  \mathsf{R} (n)  \mathsf{MT} (\tmmathbf{d}) \right)$.
  
  {\noindent}{\tmem{Cost of $p^2 \times (\delta (\tmmathbf{B}) \cdot \delta
  (\tmmathbf{t}))$.}} The matrix vector product costs $\mathcal{O} \left( s^2 
  \mathsf{R} (n)  \mathsf{MT} (\tmmathbf{d}) \right)$. Since $s \leqslant L$,
  this cost is dominated by the cost due to $\varepsilon$.
  
  {\noindent}{\tmem{Resolution of the linear system in $\sigma
  (\tmmathbf{B})$.}} Proposition~\ref{prop:linearalgebrasolver} solves the
  linear system in time $\mathcal{O} \left( s^2  \mathsf{R} (n) \right)$. We
  need to provide the algorithm with $\sigma (\tmmathbf{B})^{- 1} \in
  \mathcal{M}_s (B_0)$, which costs $\mathcal{O} \left( \mathsf{IT}
  (\tmmathbf{d}) + s^{\Omega}  \mathsf{MT} (\tmmathbf{d}) \right)$.
\end{pf}

\subsection{By-passing the whole quotient matrix}\label{section:secondshalgo}

The algorithm of Section \ref{section:firstshalgo} computes the whole quotient
$\tmmathbf{B}$, leading to a component $\mathcal{O} \left( sL \mathsf{R} (n) 
\mathsf{MT} (\tmmathbf{d}) \right)$ in the complexity. However, when $e \ll
s$, we can benefit from not computing $\tmmathbf{B}$. We present in this
section a new method to compute $\delta (\tmmathbf{B}) \cdot \delta
(\tmmathbf{t})$ avoiding $\tmmathbf{B}$, thus leading to an asymptotic
complexity of $\mathcal{O} \left( eL \mathsf{R} (n)  \mathsf{Rem}
(\tmmathbf{d}) \right)$. In return, we increase the asymptotic subdominant
part in the precision $n$ of the complexity.

Indeed, this new method makes it harder to deal with the carries involved in
the computation of $\tmmathbf{B}$. We introduce the notion of shifted
decomposition to solve this issue.

\paragraph*{Shifted decomposition.}Recall that $\sigma$ and $\delta$ were
defined by $\sigma (a) = a_0$ and $\delta (a) \assign \frac{a - a_0}{p}$ and
that, for any $a \in R_p$, we have $a = a_0 + p \delta (a)$. To our great
regret, $\sigma$ and $\delta$ are not ring homomorphisms. To remedy this fact,
we call a {\tmem{shifted decomposition}} of $a \in R_p$ a pair $(\sigma_a,
\delta_a) \in R_p^2$ such that $a = \sigma_a + p \delta_a$. Shifted
decompositions are not unique. For any $a \in R_p$, the pair $(\sigma (a),
\delta (a))$ is called the {\tmem{canonical}} shifted decomposition of $a$.
Because $\sigma$ and $\delta$ are not ring homomorphisms, we will use another
shifted decomposition that behaves better with respect to arithmetic
operations.

\begin{lem}
  \label{lemma:arithmshifteddecomp}Let $(\sigma_a, \delta_a), (\sigma_b,
  \delta_b) \in R_p^2$ be shifted decompositions of $a, b \in R_p$. Then
  \begin{enumerate}
    \item $(\sigma_a + \sigma_b, \delta_a + \delta_b)$ is a shifted
    decomposition of $a + b$;
    
    \item $(\sigma_a - \sigma_b, \delta_a - \delta_b)$ is a shifted
    decomposition of $a - b$;
    
    \item $(\sigma_a \sigma_b, \delta_a \sigma_b + a \delta_b)$ and $(\sigma_a
    \sigma_b, \delta_a b + \sigma_a \delta_b)$ are shifted decompositions of
    $ab$.
  \end{enumerate}
\end{lem}

The notion of shifted decomposition extends naturally to polynomials and
matrices.

\paragraph*{Recursive formula for $\tmmathbf{t}$.}The recursive Formula
(\ref{eq:recursiveshiftedeq}) for $\tmmathbf{t}$ adapts well to shifted
decomposition.

\begin{lem}
  \label{lemma:2ndrecursiveoperator}Let $(\sigma_{\tmmathbf{B}},
  \delta_{\tmmathbf{B}})$ be a shifted decomposition of the $\tmmathbf{B}$.
  Then the matrix $\sigma_{\tmmathbf{B}}$ is invertible modulo
  $\tmmathbf{t}_0$.
  
  Let $\tmmathbf{\Gamma}$ be a representative in $\mathcal{M}_s (R_p [X_1,
  \ldots, X_s])$ of $\sigma (\tmmathbf{B})^{- 1} \, \tmop{mod}
  \tmmathbf{t}_0$. Then $\tmmathbf{t}$ satisfies the recursive equation
  \begin{eqnarray}
    \tmmathbf{t}-\tmmathbf{t}_0 = [\tmmathbf{\Gamma} \cdot (\tmmathbf{f}- p^2 
    (\delta_{\tmmathbf{B}} \cdot \delta (\tmmathbf{t})))] \hspace{1em}
    \tmop{rem} \hspace{1em} \tmmathbf{t}_0 . \label{eq:2ndrecursiveshiftedeq}
  \end{eqnarray}
\end{lem}

\begin{pf}
  The proof of Formula~(\ref{eq:2ndrecursiveshiftedeq}) is similar to the
  proof of Lemma \ref{lemma:1strecursiveoperator}. Concerning
  $\sigma_{\tmmathbf{B}}$, its zeroth $p$-adic coefficient is the one of
  $\tmmathbf{B}$, which in invertible in $\mathcal{M}_s (B_0)$ (see the proof
  of Lemma \ref{lemma:1strecursiveoperator}). Therefore
  $\sigma_{\tmmathbf{B}}$ is invertible in $\mathcal{M}_s (B_p)$.
\end{pf}

\paragraph*{Computation of $r$, $\sigma_{\tmmathbf{B}}$ and
$\delta_{\tmmathbf{B}} \cdot \delta (t)$.}For every multiplication of the
s.l.p. $\Gamma$ of $\tmmathbf{f}$, the computation of the quotients
$\tmmathbf{b}_i$ were calling in Subsection \ref{section:firstshalgo} $s$
times $\mathtt{Rem}$ and one time $\mathtt{Rem\_quo}$. Here, we present a
method that does only $\mathcal{O} (1)$ calls to $\mathtt{Rem}$ and one call
to $\mathtt{Rem\_quo}$ in the same situation.

We denote by $(\sigma_{\tmmathbf{b}_i}, \delta_{\tmmathbf{b}_i})$ a shifted
decomposition of the quotients $\tmmathbf{b}_i$. The main idea of our new
method is to deal with $\text{}^t \delta_{\tmmathbf{b}_i} \cdot \delta
(\tmmathbf{t}) \in R_p$ instead of $\delta_{\tmmathbf{b}_i} \in (R_p)^s$. Let
us explain how to compute $r_i$, $\sigma_{\tmmathbf{b}_i}$ and $\text{}^t
\delta_{\tmmathbf{b}_i} \cdot \delta (\tmmathbf{t})$ recursively on the index
$i$ for $- s < i \leqslant L$.

First, for an index $i$ corresponding to an input, {\tmem{i.e.}} $- s < i
\leqslant 0$, we set $\bar{\imath} \assign i + s$. Therefore $c_i =
X_{\bar{\imath}}$ and we distinguish two cases:
\begin{itemize} %% **
  \item if $d_{\bar{\imath}} > 1$, then $X_{\bar{\imath}}$ is reduced modulo
  $\tmmathbf{t}$ and we take
  \begin{eqnarray}
    \label{formula:initgtr1} r_i \assign X_{\bar{\imath}}, \hspace{1em}
    \sigma_{\tmmathbf{b}_i} \assign (0, \ldots, 0), \hspace{1em} \text{}^t
    \delta_{\tmmathbf{b}_i} \cdot \delta (\tmmathbf{t}) = 0.
  \end{eqnarray}
  \item if $d_{\bar{\imath}} = 1$, then we set $r_i \assign X_{\bar{\imath}} -
  t_{\bar{\imath}}$, $\sigma_{\tmmathbf{b}_i} \assign (0, \ldots, 0, 1, 0,
  \ldots, 0)$ with only a one at position $\bar{\imath}$ and $\text{}^t
  \delta_{\tmmathbf{b}_i} \cdot \delta (\tmmathbf{t}) = 0$.
\end{itemize} %% **
Now let $0 < i \leqslant L$ that corresponds to operations in $\Gamma$. If the
$i$th result $c_i$ is a constant reduced modulo $\tmmathbf{t}_0$, then, as
before, we take
\begin{eqnarray}
  \label{formula:constant} r_i \assign c_i, \hspace{1em}
  \sigma_{\tmmathbf{b}_i} \assign (0, \ldots, 0), \hspace{1em} \text{}^t
  \delta_{\tmmathbf{b}_i} \cdot \delta (\tmmathbf{t}) = 0.
\end{eqnarray}
Consider the final case when $c_i = c_j \tmop{op} c_k$ with $\tmop{op} \in \{
+, -, \ast \}$ and $j, k < i$. The case where $\tmop{op}$ is the addition is
straightforward; using Lemma \ref{lemma:arithmshifteddecomp}, one takes
\begin{eqnarray}
  r_i & \assign & r_j + r_k \nonumber\\
  \sigma_{\tmmathbf{b}_i} & \assign & \sigma_{\tmmathbf{b}_j} +
  \sigma_{\tmmathbf{b}_k}  \label{formula:recplus}\\
  \text{}^t \delta_{\tmmathbf{b}_i} \cdot \delta (\tmmathbf{t}) & \assign &
  \text{}^t \delta_{\tmmathbf{b}_j} \cdot \delta (\tmmathbf{t}) + \text{}^t
  \delta_{\tmmathbf{b}_k} \cdot \delta (\tmmathbf{t}) . \nonumber
\end{eqnarray}
The case of subtraction is similar. Let us deal with the more complicated case
of multiplication. We start by computing the remainder and quotients $r,
\tmmathbf{q} \assign \mathtt{Rem\_quo} (r_j r_k, \tmmathbf{t},
\tmmathbf{t}_0)$ of $r_j r_k$ by $\tmmathbf{t}$ modulo $\tmmathbf{t}_0$. By
Lemma~\ref{lemma:relremquo}, they satisfy $r_j r_k = r \tmop{rem}
\tmmathbf{t}$ and $r_j r_k = r + \text{}^t \tmmathbf{q} \cdot \tmmathbf{t} \in
B_p$.

Thus we still take
\begin{eqnarray}
  r_i & \assign & r  \label{formula:recmul1}
\end{eqnarray}
and we have the same relation
\[
  \tmmathbf{b}_i =\tmmathbf{q}+ (r_j + \text{}^t \tmmathbf{b}_j \cdot
  \tmmathbf{t}) \times \tmmathbf{b}_k + r_k \times \tmmathbf{b}_j .
\]
Now we use Lemma \ref{lemma:arithmshifteddecomp} to compute the shifted
decomposition of $\tmmathbf{b}_i$ from shifted decompositions of its operands.
We choose to take the canonical shifted decomposition for $r_j, r_k,
\tmmathbf{q}$ and $\tmmathbf{t}$. Since the scalar multiplication operator
$\times$ and the inner product $\cdot$ are made of additions and
multiplications, the following is a shifted decomposition of $\tmmathbf{b}_i$
\begin{eqnarray*}
  \sigma_{\tmmathbf{b}_i} & = & \tmmathbf{q}_0 + ((r_j)_0 + \text{}^t
  \sigma_{\tmmathbf{b}_j} \cdot \tmmathbf{t}_0) \times \sigma_{\tmmathbf{b}_k}
  + (r_k)_0 \times \sigma_{\tmmathbf{b}_j}\\
  \delta_{\tmmathbf{b}_i} & = & \delta (\tmmathbf{q}) + (\delta (r_j) +
  \text{}^t \delta_{\tmmathbf{b}_j} \cdot \tmmathbf{t}_0 + \text{}^t
  \tmmathbf{b}_j \cdot \delta (\tmmathbf{t})) \times \tmmathbf{b}_k + ((r_j)_0
  + \text{}^t \sigma_{\tmmathbf{b}_j} \cdot \tmmathbf{t}_0) \times
  \delta_{\tmmathbf{b}_k} + \\
  &  & \delta (r_k) \times \tmmathbf{b}_j + (r_k)_0
  \times \delta_{\tmmathbf{b}_j} .
\end{eqnarray*}
Because we work modulo $\tmmathbf{t}_0$, this decomposition simplifies
\begin{eqnarray}
  \sigma_{\tmmathbf{b}_i} & \assign & \tmmathbf{q}_0 + (r_j)_0 \times
  \sigma_{\tmmathbf{b}_k} + (r_k)_0 \times \sigma_{\tmmathbf{b}_j} 
  \label{formula:sigma}\\
  \delta_{\tmmathbf{b}_i} & \assign & \delta (\tmmathbf{q}) + \delta (r_k)
  \times \tmmathbf{b}_j + (r_k)_0 \times \delta_{\tmmathbf{b}_j} + (\delta
  (r_j) + \text{}^t \tmmathbf{b}_j \cdot \delta (\tmmathbf{t})) \times
  \tmmathbf{b}_k + (r_j)_0 \times \delta_{\tmmathbf{b}_k} . \nonumber
\end{eqnarray}
Now that we have computed $r_i$ and $\sigma_{\tmmathbf{b}_i}$, it remains to
compute $\delta_{\tmmathbf{b}_i} \cdot \delta (\tmmathbf{t})$. Using
$\sigma_{\tmmathbf{b}_j}, \sigma_{\tmmathbf{b}_k}, \delta_{\tmmathbf{b}_j}
\cdot \delta (\tmmathbf{t}), \delta_{\tmmathbf{b}_k} \cdot \delta
(\tmmathbf{t})$ and other known polynomials, we compute
\begin{eqnarray}
  \text{}^t \delta_{\tmmathbf{b}_i} \cdot \delta (\tmmathbf{t}) & \assign &
  \text{}^t \delta (\tmmathbf{q}) \cdot \delta (\tmmathbf{t}) + \delta (r_k) 
  (\text{}^t \tmmathbf{b}_j \cdot \delta (\tmmathbf{t})) + (r_k)_0  (\text{}^t
  \delta_{\tmmathbf{b}_j} \cdot \delta (\tmmathbf{t})) + \nonumber\\
  &  & (\delta (r_j) + \text{}^t \tmmathbf{b}_j \cdot \delta (\tmmathbf{t})) 
  (\text{}^t \tmmathbf{b}_k \cdot \delta (\tmmathbf{t})) + (r_j)_0  (\text{}^t
  \delta_{\tmmathbf{b}_k} \cdot \delta (\tmmathbf{t})) 
  \label{formula:recmul3}
\end{eqnarray}
where $\text{}^t \tmmathbf{b}_j \cdot \delta (\tmmathbf{t}) \assign \text{}^t
\sigma_{\tmmathbf{b}_j} \cdot \delta (\tmmathbf{t}) + p (\text{}^t
\delta_{\tmmathbf{b}_j} \cdot \delta (\tmmathbf{t}))$ and the same for
$\text{}^t \tmmathbf{b}_k \cdot \delta (\tmmathbf{t})$. This latest formula
admits no equivalents for canonical shifted decompositions when the $p$-adics
have carries.

\paragraph*{Shifted algorithm.}We sum up all these computations in an
algorithm. We define recursively for $- s < i \leqslant L$ some s.l.p.'s
$\xi^i$ with $s$ inputs. These s.l.p.'s $\xi^i$ compute, on the entries
$\tmmathbf{t}$ given as the list of their polynomial coefficients, the
remainder $r_j$ and the quantities $\sigma_{\tmmathbf{b}_j}$ and $\text{}^t
\delta_{\tmmathbf{b}_{_j}} \cdot \delta (\tmmathbf{t})$ for $j < i$. We name
$\rho^i$, $\tmmathbf{\alpha}^i = (\alpha^i_1, \ldots, \alpha^i_s)$ and
$\theta^i$ the outputs of $\xi^i$ corresponding to $r_i$,
$\sigma_{\tmmathbf{b}_i}$ and $\text{}^t \delta_{\tmmathbf{b}_i} \cdot \delta
(\tmmathbf{t})$.

\begin{defn}
  \label{def:epsreceq}Let us initiate the induction for $- s < i \leqslant 0$
  and $\bar{\imath} \assign i + s$:
  \begin{itemize} %% **
    \item if $d_{\bar{\imath}} = 1$, then we define $\xi^i \assign
    (r_{\bar{\imath}}, 0, 1)$ where $r_{\bar{\imath}} \assign X_{\bar{\imath}}
    - t_{\bar{\imath}}$. The output $\rho^i$ points to $r_{\bar{\imath}}$,
    $\alpha^i_m$ points to $0$ if $m \neq \bar{\imath}$ or $1$ otherwise and
    $\theta^i$ points to $0$;
    
    \item if $d_{\bar{\imath}} > 1$, then we define $\xi^i \assign
    (X_{\bar{\imath}}, 0)$. The output $\rho^i$ points to $X_{\bar{\imath}}$,
    $\theta^i$ and $\alpha^i_m$ points to $0$ for any $1 \leqslant m \leqslant
    s$.
  \end{itemize} %% **
  Now recursively for $0 < i \leqslant L$, depending on the operation type of
  $\Gamma_i$:
  \begin{itemize} %% **
    \item if $\Gamma_i = (g^c)$ with $g$ reduced modulo $\tmmathbf{t}_0$, then
    we define $\xi^i \assign (g, 0)$. The output $\rho^i$ points to P and
    $\alpha^i_m$ points to $0$ for any $1 \leqslant m \leqslant s$;
    
    \item if $\Gamma_i = (+ ; u, v)$, then we build $\xi^i$ on top of $\xi^u$
    and $\xi^v$ in such a manner that one has $\rho^i \assign \rho^u +
    \rho^v$, $\tmmathbf{\alpha}^i \assign \tmmathbf{\alpha}^u
    +\tmmathbf{\alpha}^v$ and $\theta^i \assign \theta^u + \theta^v$;
    
    \item if $\Gamma_i = (- ; u, v)$, then we build $\xi^i$ on top of $\xi^u$
    and $\xi^v$ in such a manner that one has $\rho^i \assign \rho^u -
    \rho^v$, $\tmmathbf{\alpha}^i \assign \tmmathbf{\alpha}^u
    -\tmmathbf{\alpha}^v$ and $\theta^i \assign \theta^u - \theta^v$;
    
    \item if $\Gamma_i = (\ast ; u, v)$, we define $\xi^i$ accordingly to
    Formulas (\ref{formula:recmul1}, \ref{formula:sigma},
    \ref{formula:recmul3}). First, we compute $r, \tmmathbf{q} \assign
    \mathtt{Rem\_quo} (\rho^u (\tmmathbf{t}) \rho^v (\tmmathbf{t}),
    \tmmathbf{t}, \tmmathbf{t}_0)$. Then $\rho^i \assign r$,
    $\tmmathbf{\alpha}^i$ is defined by
    \[
      \sigma (\tmmathbf{q}) + (\rho^u (\tmmathbf{t}) + \text{}^t
      \tmmathbf{\alpha}^u (\tmmathbf{t}) \cdot \tmmathbf{t}) \times
      \tmmathbf{\alpha}^v (\tmmathbf{t}) + \rho^v (\tmmathbf{t}) \times
      \tmmathbf{\alpha}^u (\tmmathbf{t})
    \]
    and $\theta^i$ is defined by
    \[
      \text{}^t \delta (\tmmathbf{q}) \cdot \delta (\tmmathbf{t}) + \delta
      (\rho^v)  (\Theta^u) + (\rho^v)_0  (\theta^u) + (\delta (\rho^u) +
      \Theta^u)  (\Theta^v) + (\rho^u)_0  (\theta^v)
    \]
    where $\Theta^u \assign \text{}^t \tmmathbf{\alpha}^u \cdot \delta
    (\tmmathbf{t}) + p \times \theta^u$ and the same for $\Theta^v$.
  \end{itemize} %% **
  Finally, we set $\xi = \xi^L$.
\end{defn}

Since $\xi$ computes $\sigma_{\tmmathbf{B}}$ and $\delta_{\tmmathbf{B}} \cdot
\delta (\tmmathbf{t})$, we can build an s.l.p. $\tmmathbf{\Delta}$ on top of
$\xi$ such that
\[
  \tmmathbf{\Delta}: \tmmathbf{t} \mapsto \tmmathbf{t}_0 +
  \mathtt{LinearSolver} (\tmmathbf{f}- p^2 \times (\delta_{\tmmathbf{B}} \cdot
  \delta (\tmmathbf{t})), \sigma_{\tmmathbf{B}}) .
\]
Once again, computations take place in $B_p$ except for the input of
$\mathtt{Rem\_quo}$ and the final addition by $\tmmathbf{t}_0$. We will now
compute the shift index of $\tmmathbf{\Delta}$.

\begin{lem}
  \label{lemma:shifteps}The s.l.p. $\xi$ has shift index $0$ with respect to
  its outputs $\rho^L$ and $\tmmathbf{\alpha}^L$ and shift index $- 1$ with
  respect to its output $\theta^L$.
\end{lem}

\begin{pf}
  We prove recursively on $i$ for $- s < i \leqslant L$ that $\xi^i$ has shift
  index $0$ with respect to its outputs $\rho^i$ and $\tmmathbf{\alpha}^i$ and
  shift index $- 1$ with respect to its output $\theta^i$.
  
  We initialize the induction for any $- s < i \leqslant 0$. One has
  \[
    \sh (\tmmathbf{t} \mapsto \tmmathbf{\alpha}^i (\tmmathbf{t})) = \sh
    (\tmmathbf{t} \mapsto \theta^i (\tmmathbf{t})) = + \infty, \hspace{1em}
    \sh (\tmmathbf{t} \mapsto \rho^i (\tmmathbf{t})) = \left\{
    \begin{array}{ll}
      + \infty & \text{if } d_{\bar{\imath}} > 1\\
      0 & \text{if } d_{\bar{\imath}} = 1
    \end{array} \right. .
  \]
  Now recursively for $0 < i \leqslant L$, depending on the type of the $i$th
  operation of $\Gamma$:
  \begin{itemize} %% **
    \item if $\Gamma_i = (g^c)$ with $g$ reduced modulo $\tmmathbf{t}_0$, one
    has
    \[
      \sh (\tmmathbf{t} \mapsto \rho^i (\tmmathbf{t})) = \sh (\tmmathbf{t}
      \mapsto \tmmathbf{\alpha}^i (\tmmathbf{t})) = \sh (\tmmathbf{t} \mapsto
      \theta^i (\tmmathbf{t})) = + \infty .
    \]
    \item if $\Gamma_i = (\omega ; u, v)$ with $\omega \in \{ +, -, \ast \}$
    then we proceed as follows. The s.l.p. $\xi^i$ uses only additions,
    subtractions, multiplications, shifts $p \times \_$ by $p$, and calls to
    $\mathtt{Rem}$ and $\mathtt{Rem\_quo}$. These operations are online
    algorithms and
    \[
      \sh (\tmmathbf{t} \mapsto \rho^i (\tmmathbf{t})) = 0, \hspace{1em} \sh
      (\tmmathbf{t} \mapsto \tmmathbf{\alpha}^i (\tmmathbf{t})) = 0.
    \]
    Now $\theta^i$ is an arithmetic expression in $\delta (\tmmathbf{q})$,
    $\delta (\tmmathbf{t})$, $(\rho^u)_0$, $\delta (\rho^u)$,
    $\tmmathbf{\alpha}^u$, $\theta^u$, $p \times \theta^u$ and the same for
    $v$. The operator $\delta : a \mapsto (a - a_0) / p$ decreases the shift
    index by $1$. Therefore all elements of the result sequence have a shift
    index greater or equal to $- 1$ and so it is for $\theta^i$. \hfill \qed
  \end{itemize} %% **
  \let\qed\relax
\end{pf}

\begin{lem}
  \label{lemma:shiftalgo}Algorithm $\mathtt{ShiftedEvaluation}
  (\tmmathbf{\Delta}, \_, n)$ is a shifted algorithm of which $\tmmathbf{t}$
  is a fixed point.
\end{lem}

\begin{pf}
  The s.l.p. $\tmmathbf{\Delta}$ satisfies $\tmmathbf{\Delta} (\tmmathbf{t})
  =\tmmathbf{t}$ thanks to Lemma \ref{lemma:2ndrecursiveoperator} and because
  the formulas that define $\xi$ in Definition \ref{def:epsreceq} match
  formulas (\ref{formula:initgtr1}) to (\ref{formula:recmul3}).
  
  A direct consequence of Lemma \ref{lemma:shifteps} is that
  \[
    \sh (\tmmathbf{t} \mapsto p^2 \times (\delta_{\tmmathbf{B}} \cdot \delta
    (\tmmathbf{t}))) = \left( 2 + \sh (\tmmathbf{t} \mapsto
    \delta_{\tmmathbf{B}} \cdot \delta (\tmmathbf{t})) \right) = 1.
  \]
  Since $\tmmathbf{f} \tmop{rem} \tmmathbf{t}_0$ and $\sigma_{\tmmathbf{B}}$
  depend only on $\tmmathbf{t}_0$, and since the resolution of the linear
  system does not impact the shift, we have proved $\sh (\tmmathbf{\Delta}) =
  1$. We conclude using Corollary~\ref{c:shitedevalcomputerecpadic}.
\end{pf}

We can now state our second main theorem on the relaxed lifting of triangular
sets.

\begin{thm}
  \label{theorem:master2}Let $\tmmathbf{f}= (f_1, \ldots, f_s)$ be a
  polynomial system in $R [X_1, \ldots, X_s]$ given by a straight-line program
  $\Gamma$ of size $L$. Suppose that $\tmmathbf{f}$ satisfies assumption
  $\left( \mathsf{H} \right)$ and admits a triangular representation
  $\tmmathbf{t}$ with coefficients in $Q$ and multi-degree $\tmmathbf{d}$.
  
  Suppose that assumption $\left( \mathsf{H}' \right)_{\tmmathbf{t}, p}$
  holds. Given $\tmmathbf{t}_0 =\tmmathbf{t} \, \tmop{mod} p$, one can compute
  $\tmmathbf{t} \, \tmop{mod} p \nocomma^n$ in time
  \[
    \mathcal{O} \left( \mathsf{IT} (\tmmathbf{d}) +
    s^{\Omega}  \mathsf{MT} (\tmmathbf{d}) \right) + \left( (eL + s^2) 
    \mathsf{R} (n) + sLn \right)  \mathsf{MT} (\tmmathbf{d}).
  \]
\end{thm}

\begin{pf}
  (of Theorem~\ref{theorem:master2}) By Lemma \ref{lemma:shiftalgo} and
  Proposition~\ref{p:complexityRelaxedRecursive}, we can compute
  $\tmmathbf{t}$ in time necessary to compute $\mathtt{ShiftedEvaluation}
  (\tmmathbf{\Delta}, \_, n)$, whose cost we now detail.
  
  {\tmem{{\noindent}Cost of computing $\sigma_{\tmmathbf{B}}$.}} Recall that
  we compute recursively $\sigma_{\tmmathbf{b}_i}$ using
  Formula~(\ref{formula:sigma})
  \[
    \sigma_{\tmmathbf{b}_i} =\tmmathbf{q}_0 + (r_j)_0 \times
    \sigma_{\tmmathbf{b}_k} + (r_k)_0 \times \sigma_{\tmmathbf{b}_j} .
  \]
  The multiplication of two $p$-adics with one input of length $1$ has a
  linear cost in the precision $n$. Consequently, we compute
  $\sigma_{\tmmathbf{B}}$ for a total cost of $\mathcal{O} \left( sLn
  \mathsf{MT} (\tmmathbf{d}) \right)$.
  
  {\tmem{{\noindent}Computation of $\tmmathbf{f} \tmop{rem} \tmmathbf{t}_0$.}}
  It costs $\mathcal{O} \left( L \mathsf{R} (n)  \mathsf{MT} (\tmmathbf{d})
  \right)$.
  
  {\noindent}{\tmem{Computation of $\delta_{\tmmathbf{B}} \cdot \delta
  (\tmmathbf{t})$.}} We focus on multiplications in the s.l.p. of
  $\tmmathbf{f}$ because they induce the more operations in
  $\tmmathbf{\Delta}$. The remainder $r$ and quotients $\tmmathbf{q}$ of $r_j
  r_k$ require a call to Algorithm \tmverbatim{Rem\_quo}. Then
  $\delta_{\tmmathbf{B}} \cdot \delta (\tmmathbf{t})$ use an inner product
  $\delta (\tmmathbf{q}) \cdot \delta (\tmmathbf{t})$ and $\mathcal{O} (1)$
  multiplications in $B_p$. The inner product costs less than
  \tmverbatim{Rem\_quo}, since this latter algorithm performs such an inner
  product. Summing up, the total cost is $\mathcal{O} \left( L \mathsf{R} (n) 
  \left( \mathsf{RemQuo} (\tmmathbf{d}) + \mathsf{MT} (\tmmathbf{d}) \right)
  \right)$, that is $\mathcal{O} \left( eL \mathsf{R} (n)  \mathsf{MT}
  (\tmmathbf{d}) \right) .$
  
  {\noindent}{\tmem{Resolution of the linear system in $\sigma
  (\tmmathbf{B})$.}} Proposition~\ref{prop:linearalgebrasolver} solves the
  linear system in time $\mathcal{O} \left( s^2  \mathsf{R} (n) \right)$. We
  need to provide the algorithm with $\sigma (\tmmathbf{B})^{- 1} \in
  \mathcal{M}_s (B_0)$, which costs $\mathcal{O} \left( \mathsf{IT}
  (\tmmathbf{d}) + s^{\Omega}  \mathsf{MT} (\tmmathbf{d}) \right)$.
\end{pf}

Finally, Theorem~\ref{theorem:mastercorol3} is a direct corollary of previous
Theorem~\ref{theorem:master2}.

\section{Implementation in
{\tmname{Mathemagix}}}\label{section:implementation}

The computer algebra software {\tmname{Mathemagix}} {\citep{mmx}} provides a
\tmverbatim{C++} library named {\tmname{Algebramix}} implementing relaxed
power series or $p$-adic numbers and the relaxed framework for recursive
$p$-adics {\citep{Hoeven2002,Hoeven2007,BeHoLe11,BeLe12}}. Our implementation
is built upon this base. It is available inside the file
\tmverbatim{lifting\_fiber\_relaxed} in the \tmverbatim{C++} library
{\tmname{Geomsolvex}} of {\tmname{Mathemagix}}. The relaxed algorithm has been
plugged into an implementation of the geometric resolution algorithm inside
the library {\tmname{Geomsolvex}} of {\tmname{Mathemagix}} by G. Lecerf.

\subsection{Benchmarks}

We have implemented the lifting of univariate representations over the power
series ring $\mathbbm{F}_p [[T]]$ for both the off-line and the relaxed
approach. The implementations over the $p$-adic integers $\mathbbm{Z}_p$ are
still in progress. Although they work, they still require some efforts to be
competitive.

For benchmark purposes, we decide to consider the computation of geometric
resolutions, which is a good example of ``real world'' use of liftings of
univariate representations. One of the most expensive computation in the
geometric resolution algorithm is its last lifting: given a polynomial system
$\tmmathbf{f}= (f_1, \ldots, f_s)$ in $\mathbbm{F}_p [X_1, \ldots, X_s]$, we
need to lift a univariate representation of $(f_1, \ldots, f_{s - 1})$ over
$\mathbbm{F}_p [[X_1]] [X_2, \ldots, X_s]$ (after a generic change of
coordinates).

We report on the timings of our implementation of this lifting inside the
geometric resolution algorithm. Timings are given in milliseconds. They are
measured using one core of an {\tmname{Intel Xeon}} X5650 at 2.67 GHz running
{\tmname{Linux}} 64 bits, {\tmname{Gmp}} 5.0.2 {\citep{GMP}} and setting $p =
1048583$ a 21-bit prime number. We indicate the number of variables $s$, the
required precision $n$ of the $p$-adics and the degree $d$ of the univariate
representation. Our relaxed lifting algorithm is compared to the classical
off-line variant based on Newton's iteration as detailed in
{\citep{GLS01,HMW01}}.

We have tried our algorithm on two family of polynomial systems that have a
small complexity of evaluation. The {\tmname{Katsura}} polynomials systems
comes from a problem of magnetism in physics {\citep{Katsura90}}. The system
{\tmname{Katsura}}-$s$ has $s + 1$ unknowns $X_0, \ldots, X_s$ and $s + 1$
equations:
\[
  \tmop{for} 0 \leqslant m < s, \hspace{1em} \sum_{\ell = - s}^s X_{| \ell |}
  X_{| m - \ell |} = X_m
\]
and $X_0 + 2 \sum_{\ell = 1}^s X_{\ell} = 1$. The best algorithm for each
problem is written using a bold font.

\begin{table}[!ht]
  \begin{tabular}{|c|c|c|c|c|c|c|}
    \hline
    \multicolumn{7}{|c|}{{\tmname{Katsura}}-$(s - 1)$} \\
    $s \ (n, d)$ & $4 \  (8, 16)$ & $5 \  (16,
    32)$ & $6 \  (32, 64)$ & $7 \  (64, 128)$ & $8
    \  (128, 256)$ & $9 \  (256, 512)$\\
    \hline
    \hline
    off-line & $50$ & $220$ & $520$ & $2\,600$ & $14\,000$ & {\tmstrong{$77\,000$}}\\
    \hline
    relaxed & {\tmstrong{$21$}} & {\tmstrong{$87$}} & {\tmstrong{$220$}} &
    {\tmstrong{$1\,400$}} & {\tmstrong{$10\,000$}} & $85\,000$\\
    \hline
  \end{tabular}
  
  \ 
  \caption{Timings of off-line/relaxed lifting of univariate representations
    for {\tmname{Katsura}}-$s$.}
\end{table}

The other family of polynomial system {\tmname{MulLinForm}}-$s$ has $s$
unknowns and $s$ equations of the form
\[
  (\lambda_1 X_1 + \cdots + \lambda_s X_s)  ({\textmu}_1 X_1 + \cdots
  +{\textmu}_s X_s) = \alpha
\]
where the $\lambda_i, {\textmu}_i$ and $\alpha$ are random coefficients in
$\mathbbm{F}_p$.

\begin{table}[!ht]
  \begin{tabular}{|c|c|c|c|c|c|c|}
    \hline
    \multicolumn{7}{|c|}{{\tmname{MulLinForm}}-$(s - 1)$} \\
    $s \  (n, d)$ & $4 \  (8, 16)$ & $5 \  (16,
    32)$ & $6 \  (32, 64)$ & $7 \  (64, 128)$ & $8
    \  (128, 256)$ & $9 \  (256, 512)$\\
    \hline
    \hline
    off-line & $125$ & $360$ & $1\;600$ & $9\;000$ & {\tmstrong{$52\;000$}} &
    {\tmstrong{$290\;000$}}\\
    \hline
    relaxed & {\tmstrong{$52$}} & {\tmstrong{$230$}} & {\tmstrong{$910$}} &
    {\tmstrong{$7\;000$}} & $60\;000$ & $560\;000$\\
    \hline
  \end{tabular}
  
  \
  \caption{Timings of off-line/relaxed lifting of univariate representations
  for the polynomial systems {\tmname{MulLinForm}}-$s$.}
\end{table}

The timings of the relaxed algorithm depends strongly on the performance of
the relaxed multiplication. For our computations, we need a relaxed
multiplication of implementation of power series of polynomial in
$(\mathbbm{F}_p [X]) [[T]]$. The relaxed multiplication algorithm reduces to
multiplications in $(\mathbbm{F}_p [X]) [T]$. We classically used a Kronecker
substitution to reduce these products to multiplications of univariate
polynomials in $\mathbbm{F}_p [Z]$.

We compared relaxed and not relaxed product in $(\mathbbm{F}_p [[T]]) [Y]$;
relaxed algorithms are always slower by a ratio up to $15$ in practice.
Besides, this ratio grows logarithmically in the precision of the power series
as expected. As a future work, we will apply the new relaxed multiplications
of {\citep{Hoeven2007,Hoeven2012}} or of {\citep{LeSc13}} to keep the ratio
$\mathsf{R} (n) / \mathsf{I} (n)$ smaller.

\subsection{Conclusion}

As a conclusion, we remark that a relaxed approach has generated new
algorithms for the lifting of triangular sets. Our hope was to save the cost
of linear algebra in the dominant part of the complexity when the precision
$n$ tends to infinity. Besides, previous experiences, with e.g. the relaxed
lifting of regular roots, showed that we could expect to do less
multiplications in the relaxed model than in the zealous one. Therefore,
whenever the precision $n$ gives a measured ratio of complexity between
relaxed and zealous multiplication, we can expect better timings from the
relaxed approach.

In view of our hopes, we are not completely satisfied with the lifting of
general triangular sets, for it does more multiplications when $sL \geqslant
s^{\omega}$. On the contrary, the lifting of univariate representations always
improve the asymptotic number of $p$-adic multiplications and saves the cost
of linear algebra. Thus, there exists a trade-off between the dependencies in
$s$ and $n$ for both relaxed and classical algorithms.

\section*{Acknowledgments}

I thank {\'E}ric Schost for his help in the preparation of this paper and the
numerous conversations on polynomial systems. I am very grateful to
J{\'e}r{\'e}my Berthomieu, Joris van der Hoeven and Gr{\'e}goire Lecerf for
showing me the potential of relaxed algorithms. Finally, this paper has
benefited from comments of Kazuhiro Yokoyama on shifted algorithms and
proofreadings of the anonymous reviewers.

\bibliographystyle{elsart-harv}
\bibliography{global2}

\end{document}
