On the Algorithm Complexity of Generating Discrete Uniform Distribution from a Biased Coin

Abstract

Lei proposed an algorithm Algorithm ${\mathcal{A}}_3$ in 2023 to generate an exact discrete uniform distribution from an unknown biased Bernoulli source. The present paper does not claim a new extraction algorithm. Its contributions are analytical: first, we provide a Fourier-analytic proof of the uniformity mechanism based on roots of unity and coefficient extraction; second, we derive explicit acceptance-probability and expected-runtime bounds, with a rigorous treatment of composite moduli; third, we show how independent accepted ${\mathcal{A}}_3$ digits yield a continuous $\mathrm{Uniform}(0,1)$ limit through a base-n expansion and quantify the cost of finite-digit simulation.

1. Introduction

1.1. The Quest for Perfect Randomness in Imperfect Worlds

New theory and large experiments show that coin tossing is not perfectly fair in the strict physical sense. The dynamical model from [1] predicts a small precession in flight that makes the coin slightly more likely to land on the same face it started with. A large experiment led by the University of Amsterdam collected 350,757 flips and found the probability of landing on the starting face is about 50.8% with a 95% confidence interval of [0.506, 0.509], and this result closely matches the approximately 51% theoretical prediction while the overall heads versus tails frequencies remain symmetric with heads at roughly 50.0% and a 95% confidence interval of [0.498, 0.502]. No systematic bias exists toward heads or tails but a subtle starting-orientation effect does exist, meaning raw coin tossing is not ideal for those demanding exact fairness.

This mild but detectable bias shows the value of the method from [2] published in Electronic Communications in Probability in 2023. Even when the base bit source, which is the coin, has an unknown bias, one can generate exactly discrete-uniform random numbers without parameters and with proof. The algorithm uses n tosses to form the head count N and a rank-sum R and it outputs R mod n whenever $\gcd (N,n)=1$; it adds an independent random cyclic shift if the flips are independent but not identically distributed, and this process yields an exactly uniform value on $\{0,\dots ,n-1\}$. Even with a starting-orientation bias in physical tossing, this number-theoretic–probabilistic “uniformization” delivers strictly fair n-ary outcomes that are useful for instructional labs, low-cost randomness acquisition and any application that needs verifiable fairness.

1.2. Historical Context and Theoretical Foundations

The present problem is related to broader literature on extracting unbiased randomness from biased sources, beginning with von Neumann’s extractor [3] and including refinements by Elias [4], Knuth-Yao [5], and Peres [6]. These methods optimize different efficiency or source-assumption criteria.

The mathematical problem of making fair random bits from biased coins has a long history. It started with von Neumann’s important 1951 work [3]. For a coin with unknown bias p, von Neumann suggested a simple algorithm. Flip the coin twice. Use the first flip as the result if the outcomes are different. Discard the two flips and try again if they are the same. This simple process gets exactly one fair bit from two biased flips. It has a variable cost and the expected runtime is $1/\left(2p\right(1-p\left)\right)$ flips per output bit.

Dijkstra [7] extended this framework to prime numbers. He created an algorithm that generates a uniform distribution on p elements from p coin flips. This method uses the algebraic structure of cyclic groups and lexicographic ranking within orbits made by cyclic shifts. The primality of p ensures each orbit has exactly p distinct configurations and this allows uniform sampling.

Lei [2] simplified this method by using rank sums modulo p instead of complex orbit analysis, replacing the latter with a straightforward modular computation. His simplification laid the groundwork for generalizing the method to any integer n, using a number-theoretic approach that combines ideas from probability theory and algebra. Lei’s algorithm ${\mathcal{A}}_3$ is distinctive in that it produces exact n-ary uniform variables directly from a Bernoulli source through a number-theoretic acceptance condition. Our contribution is to analyze this mechanism using Fourier coefficients and to quantify the acceptance cost.

1.3. Applications in Modern Data Science

The algorithm’s importance extends beyond theoretical interest to practical applications across modern data science:

Statistical computing: The generation of non-uniform deviates via inversion, acceptance-rejection, or MCMC fundamentally relies on a source of i.i.d. uniform draws. By supplying such draws from an arbitrarily biased Bernoulli stream, ${\mathcal{A}}_3$ immunises these procedures against source-level imperfections. In particular, Metropolis-Hastings samplers require proposal steps with exact uniformity to preserve detailed balance; the proposed method provides a parameter-free guarantee that is otherwise difficult to achieve without knowledge of the physical bias.

Machine Learning and Randomized Algorithms:Modern machine learning uses more and more randomness. It uses randomness for initialization (neural network weights), regularization (dropout), and optimization (stochastic gradient descent). This algorithm has provable fairness. It makes sure that these random parts do not add unintended biases. Ensemble methods like random forests use bootstrap sampling and random feature selection. This algorithm ensures that each data point and feature is selected with equal probability.

Reinforcement Learning: In Reinforcement learning (RL) and bandit algorithms, exploration strategies such as $ϵ$-greedy or Thompson sampling algorithms need uniform sampling to explore state spaces and K-arms; see [8]. A biased generator can cause systematic under-exploration of some action trajectories. MCMC inference uses an acceptance ratio. This ratio needs to compare a computed likelihood with a uniform variable $u\sim \mathcal{U}[0,1]$. The bias in u breaks the detailed balance condition. This means the chain converges to the wrong stationary distribution. We extend ${\mathcal{A}}_3$ to the continuous domain (Section 5) to fix this verification gap.

Cryptography and Security: Cryptographic protocols need high-quality randomness for key generation, nonce creation and probabilistic encryption. Cryptographic applications usually need stronger security guarantees than physical coin tossing alone can provide. This algorithm gives a valuable post-processing step. It helps distill entropy from imperfect sources in randomness extractors [9].

A concrete use case is finite experimental randomization from a simple biased physical or hardware Bernoulli source. Suppose a laboratory device produces binary events with unknown but stable bias p, and the experiment requires exact assignment among n treatment arms. Estimating p and then correcting the source introduces calibration error, whereas ${\mathcal{A}}_3$ gives an exact uniform n-ary output under the i.i.d. Bernoulli model. This is the regime in which the algorithm is preferable: exact finite-sample n-ary uniformization is required, the source bias is unknown, and cryptographic security is not the primary objective.

1.4. Contributions and Paper Overview

In summary, the contribution of this paper is as follows: (1) We provide a characteristic-function proof of Lei’s algorithm ${\mathcal{A}}_3$ [2] using roots of unity and coefficient extraction. (2) We prove explicit acceptance-probability and expected-runtime bounds, including the composite-modulus case. (3) We use independent accepted ${\mathcal{A}}_3$ digits to construct a continuous $\mathrm{Uniform}(0,1)$ limit and quantify finite-digit runtime and approximation error.

The specific contributions are as follows:

• A Novel Characteristic Function Proof (Section 3): We use a rigorous analytic proof with Characteristic Functions, which are Fourier analysis on ${\mathbb{Z}}_n$, instead of the combinatorial group-action proof from the original paper. This proof is more robust and directly links the number-theoretic condition $\gcd (N,n)=1$ to the vanishing of Fourier coefficients at non-zero frequencies.
• Complexity Analysis (Section 4): We establish rigorous bounds on the algorithm’s expected runtime. We show the expected number of coin flips is $O\left(n\right)$ when n is prime and $O\left(n\log \log n\right)$ when n is composite. We find explicit constants with Euler’s totient function $\varphi \left(n\right)$ and give detailed asymptotic expansions using analytic number theory tools.
• Extension to Continuous Uniform Distribution (Section 5): We show ${\mathcal{A}}_3$ can be used to generate continuous uniform random variables on $[0,1]$ with base-n expansion. We prove convergence with characteristic function arguments and give error bounds for practical use.

The paper is organized as follows: Section 2 formally presents ${\mathcal{A}}_3$ and establishes notation. Section 3 provides the characteristic function proof of uniformity. Section 4 analyzes computational complexity with detailed asymptotic expansions. Section 5 extends this method to the generation of continuous uniform distributions. Section 6 concludes with discussion and future directions.

2. Preliminaries and Algorithm Formulation

We operate within a standard probability space $(\mathsf{\Omega },\mathcal{F},\mathcal{P})$. Let $\mathbb{N}=\{1,2,\dots \}$ and ${\mathbb{N}}_0=\{0,1,\dots \}$.

2.1. Model and Sufficient Statistics

Assumption 1 (Bernoulli Source).

Let $X_0,X_1,\dots$ be a sequence of independent and identically distributed (i.i.d.) random variables taking values in $\{0,1\}$. We denote the success probability by $p=P(X_i=1)$ and the failure probability by $q=P(X_i=0)=1-p$. We assume $p\in (0,1)$ is unknown.

We denote a sequence of n flips as a random vector ${\mathbf{X}}^n=(X_0,X_1,\dots ,X_{n-1})\in {\{0,1\}}^n$.

The algorithm relies on two statistics of the sample ${\mathbf{X}}^n$: the Hamming weight (head count) and a weighted positional sum (rank sum).

Definition 1 (Head Count).

For a vector ${\mathbf{X}}^n$, the head count is defined as:

$$N\left({\mathbf{X}}^n\right)={\displaystyle \sum _{i=0}^{n-1}}{X}_i.$$

(1)

Definition 2 (Rank Sum).

The rank sum is defined as the sum of indices where heads occur:

$$R\left({\mathbf{X}}^n\right)={\displaystyle \sum _{i=0}^{n-1}}i·X_i.$$

(2)

Definition 3 (Coprimality).

Let $\gcd (x,y)$ denote the greatest common divisor of integers x and y. We say N and n are coprime if $\gcd (N,n)=1$. The set of integers in $\{0,\dots ,n-1\}$ coprime to n forms the multiplicative group of integers modulo n, denoted by ${\mathbb{Z}}_n^{\times }$. The size of this group is given by Euler’s totient function $\varphi \left(n\right)$.

2.2. Algorithm ${\mathcal{A}}_3$

The core algorithm proposed in [2] is a rejection sampling procedure. It generates batches of size n and accepts a batch only if the head count N is coprime to the batch size n (see Algorithm 1).

Algorithm 1. Discrete Uniform Generation

Require: Sequence of biased coin flips $X_i\sim \mathrm{Ber}\left(p\right)$. Target size $n\in \mathbb{N},n\ge 2$.

Ensure: Random variable Y uniformly distributed on $\{0,1,\dots ,n-1\}$.

1: Initialize valid ← false.   2: while not valid do   3:       Sample n independent flips ${\mathbf{X}}^n=(X_0,\dots ,X_{n-1})$.   4:       Calculate $N={\sum }_{i=0}^{n-1}{X}_i$.   5:       if $\gcd (N,n)==1$ then   6:          Calculate $R={\sum }_{i=0}^{n-1}i·X_i$.   7:          Set $Y=R\left(\mathrm{mod}n\right)$.   8:          valid ← true.   9:       else  10:         Discard ${\mathbf{X}}^n$ and restart.  11:      end if  12: end while  13: return Y.

2.3. Illustrative Examples

Example 1 ($n=2$: Connection to von Neumann’s Algorithm).

For $n=2$, ${\mathcal{A}}_3$ reduces to a variant of von Neumann’s original procedure. Consider all possible outcomes:

• $(0,0)$: $N=0$, $\gcd (0,2)=2>1$, reject
• $(1,1)$: $N=2$, $\gcd (2,2)=2>1$, reject
• $(0,1)$: $N=1$, $\gcd (1,2)=1$, $R=0·0+1·1=1$, output $1\mathrm{mod}2=1$
• $(1,0)$: $N=1$, $\gcd (1,2)=1$, $R=0·1+1·0=0$, output $0\mathrm{mod}2=0$

The algorithm accepts exactly when the two flips differ, producing outputs 0 for $(H,T)$ and 1 for $(T,H)$, matching von Neumann’s procedure.

Example 2 ($n=6$: Composite Case).

Consider $n=6$ and the outcome $X^6=(1,0,1,0,1,0)$:

• Head count: $N=1+0+1+0+1+0=3$
• $\gcd (3,6)=3>1$, so reject

Now consider $X^6=(1,1,0,0,0,1)$:

• Head count: $N=1+1+0+0+0+1=3$
• $\gcd (3,6)=3>1$, reject again

Finally, consider $X^6=(1,0,0,1,0,0)$:

• Head count: $N=1+0+0+1+0+0=2$
• $\gcd (2,6)=2>1$, reject

These examples illustrate that many outcomes are rejected when n has multiple prime factors.

3. Characteristic Function Proof of Uniformity

The algorithm admits a natural algebraic interpretation. Consider the random variable $Y_i\in \{\overline{0},\overline{1}\}$ where $\overline{0}$ represents tails and $\overline{1}$ represents heads. Then, the n flips correspond to a random vector $(Y_0,\dots ,Y_{n-1})$ in ${\mathbb{Z}}_n^n$. The head count condition $\gcd (N,n)=1$ ensures that the sum ${\sum }_{i=0}^{n-1}{Y}_i$ generates the entire group ${\mathbb{Z}}_n$, while the rank sum condition $R\mathrm{mod}n$ provides a linear combination that, under this coprimality condition, yields uniform distribution.

Theorem 1.

Let $X_0,\dots ,X_{n-1}$ be identically distributed Bernoulli variables with the probability of success $p\in (0,1)$ and the probability of failure $q=1-p$. Let $N={\sum }_{i=0}^{n-1}{X}_i$ and $R={\sum }_{i=0}^{n-1}i{X}_i$. For any integer c such that $\gcd (c,n)=1$, the conditional distribution of $R\left(\mathrm{mod}n\right)$ given $N=c$ is uniform on $\{0,\dots ,n-1\}$.

3.1. Refined Proof: Group Action Method

Proof. 

Let $\mathsf{\Omega }={\{0,1\}}^n$ be the sample space of outcomes $\mathbf{x}=(x_0,\dots ,x_{n-1})$. Consider the cyclic shift operator $T:\mathsf{\Omega }\to \mathsf{\Omega }$ defined by

$$T(x_0,\dots ,x_{n-1})=(x_1,\dots ,x_{n-1},x_0).$$

Since the random variables $X_0,\dots ,X_{n-1}$ are i.i.d., the probability measure P on $\mathsf{\Omega }$ is invariant under T; that is, $P(\mathbf{X}=\mathbf{x})=P(\mathbf{X}=T\mathbf{x})$ for all $\mathbf{x}\in \mathsf{\Omega }$.

We examine the behavior of the statistics N and R under this transformation. The total count is invariant:

$$N\left(T\mathbf{x}\right)={\displaystyle \sum _{i=0}^{n-1}}{x}_i=N\left(\mathbf{x}\right).$$

For the rank sum R, observing that indices shift by $-1\left(\mathrm{mod}n\right)$, we compute:

$$\begin{array}{cc}\hfill R\left(T\mathbf{x}\right)& ={\displaystyle \sum _{i=0}^{n-2}}i{x}_{i+1}+(n-1)x_0\hfill \\ & ={\displaystyle \sum _{j=1}^{n-1}}(j-1)x_j+(n-1)x_0={\displaystyle \sum _{j=1}^{n-1}}j{x}_j-{\displaystyle \sum _{j=1}^{n-1}}{x}_j+(n-1)x_0\hfill \\ & ={\displaystyle \sum _{j=0}^{n-1}}j{x}_j-(N\left(\mathbf{x}\right)-x_0)+n{x}_0-x_0\hfill \\ & =R\left(\mathbf{x}\right)-N\left(\mathbf{x}\right)+n{x}_0\hfill \\ & \equiv R\left(\mathbf{x}\right)-N\left(\mathbf{x}\right)\left(\mathrm{mod}n\right).\hfill \end{array}$$

By induction, for any $k\in {\mathbb{Z}}_{\ge 0}$, the k-th iteration of the shift satisfies

$$R\left(T^k\mathbf{x}\right)\equiv R\left(\mathbf{x}\right)-kN\left(\mathbf{x}\right)\left(\mathrm{mod}n\right).$$

Consider the set of outcomes $S_c=\{\mathbf{x}\in \mathsf{\Omega }:N\left(\mathbf{x}\right)=c\}$ for a fixed count c satisfying $\gcd (c,n)=1$. The operator T partitions $S_c$ into disjoint orbits. For any $\mathbf{x}\in S_c$, the orbit is ${\mathcal{O}}_{\mathbf{x}}=\{\mathbf{x},T\mathbf{x},\dots ,T^{n-1}\mathbf{x}\}$.

Because $\gcd (c,n)=1$, the map $k\mapsto -kc\left(\mathrm{mod}n\right)$ is a bijection on ${\mathbb{Z}}_n$. Consequently, the set of values $\{R\left(\mathbf{y}\right)\left(\mathrm{mod}n\right):\mathbf{y}\in {\mathcal{O}}_{\mathbf{x}}\}$ is exactly ${\{R\left(\mathbf{x}\right)-kc\left(\mathrm{mod}n\right)\}}_{k=0}^{n-1}$, which is a permutation of $\{0,\dots ,n-1\}$.

Since the measure is invariant under T, every element in a given orbit ${\mathcal{O}}_{\mathbf{x}}$ has equal probability. Thus, conditional on falling into a specific orbit, $R\left(\mathrm{mod}n\right)$ is uniform. Since $S_c$ is a disjoint union of such orbits, $R\left(\mathrm{mod}n\right)$ is uniform on $S_c$. □

This algebraic perspective connects the algorithm to deeper number-theoretic structures and motivates the characteristic function approach developed. We now use roots of unity to characterize the discrete uniform distribution on the set $\{0,1,\dots ,n-1\}$.

Lemma 1.

Let Z be a random variable supported on $\{0,1,\dots ,n-1\}$ and write

$${\varphi }_Z\left(t\right)=\mathbb{E}\left[e^{itZ}\right],t\in \mathbb{R}.$$

Let $\omega :=e^{2\pi i/n}$ and define the discrete Fourier coefficients

$$\widehat{p}\left(m\right):=\mathbb{E}\left[{\omega }^{mZ}\right]={\varphi }_Z\left(\frac{2\pi m}{n}\right),m=0,1,\dots ,n-1.$$

Then the following are equivalent:

1.

Z is uniformly distributed on $\{0,1,\dots ,n-1\}$.

2.

$\widehat{p}\left(0\right)=1$ and $\widehat{p}\left(m\right)=0$ for all $m=1,\dots ,n-1$; equivalently

${\varphi }_Z\left(\frac{2\pi m}{n}\right)=\left\{\begin{array}{cc}1,\hfill & m=0,\hfill \\ 0,\hfill & m=1,\dots ,n-1.\hfill \end{array}\right.$

Proof. 

(1 ⇒ 2). If Z is uniform on $\{0,1,\dots ,n-1\}$, then $P(Z=k)=1/n$ for all k and

$$\widehat{p}\left(m\right)={\displaystyle \frac{1}{n}}{\displaystyle \sum _{k=0}^{n-1}}{\omega }^{mk}.$$

For $m=0$ this is 1. For $m=1,\dots ,n-1$ we use the geometric series:

$${\displaystyle \sum _{k=0}^{n-1}}{\omega }^{mk}={\displaystyle \frac{1-{\left({\omega }^m\right)}^n}{1-{\omega }^m}}={\displaystyle \frac{1-1}{1-{\omega }^m}}=0,$$

so $\widehat{p}\left(m\right)=0$. Because $\widehat{p}\left(m\right)={\varphi }_Z(2\pi m/n)$, the stated values of ${\varphi }_Z$ follow.

(2 ⇒ 1). Let $p_k=P(Z=k)$, $k=0,\dots ,n-1$, and consider the discrete Fourier transform (DFT)

$$\widehat{p}\left(m\right)={\displaystyle \sum _{k=0}^{n-1}}{p}_k{\omega }^{mk},m=0,\dots ,n-1.$$

On the finite abelian group ${\mathbb{Z}}_n$, the DFT is invertible with the inversion formula

$$p_k={\displaystyle \frac{1}{n}}{\displaystyle \sum _{m=0}^{n-1}}\widehat{p}\left(m\right){\omega }^{-mk},k=0,\dots ,n-1,$$

(3)

which follows from the orthogonality of nth roots of unity:

$${\displaystyle \frac{1}{n}}{\displaystyle \sum _{m=0}^{n-1}}{\omega }^{m(k-\mathcal{\ell })}=\left\{\begin{array}{cc}1,\hfill & k=\mathcal{\ell },\hfill \\ 0,\hfill & k\ne \mathcal{\ell }.\hfill \end{array}\right.$$

Now apply (3) with the assumption $\widehat{p}\left(0\right)=1$ and $\widehat{p}\left(m\right)=0$ for $m\ge 1$:

$$p_k={\displaystyle \frac{1}{n}}\left(\widehat{p}\left(0\right){\omega }^0+{\displaystyle \sum _{m=1}^{n-1}}\widehat{p}\left(m\right){\omega }^{-mk}\right)={\displaystyle \frac{1}{n}}.$$

Hence $p_k=1/n$ for all k, i.e., Z is uniform on $\{0,1,\dots ,n-1\}$. □

While the group-action proof is combinatorially elegant, the characteristic-function approach reveals directly how $\gcd (N,n)=1$ forces the Fourier coefficients to vanish. The argument proceeds as follows.

3.2. New Proof: Characteristic Function Method

Proof. 

Let $\omega =e^{2\pi i/n}$. To establish uniformity on ${\mathbb{Z}}_n$, it suffices to show that the conditional characteristic function of R vanishes at all non-zero frequencies. Specifically, we must show that for all $k\in \{1,\dots ,n-1\}$:

$$\mathbb{E}[{\omega }^{kR}\mid N=c]=0.$$

Since $\gcd (c,n)=1$ implies $1\le c\le n-1$ and $p\in (0,1)$, we have $P(N=c)=\left(\begin{array}{c}n\hfill \\ c\hfill \end{array}\right)p^c{(1-p)}^c>0$. Hence the conditional expectation is well-defined by

$${\displaystyle \frac{\mathbb{E}\left[{\omega }^{kR}{\mathbf{1}}_{\{N=c\}}\right]}{P(N=c)}}.$$

We analyze the numerator. Consider the joint characteristic function (CF) of $(R,N)$, defined for $z\in \mathbb{C}$ as:

$${\mathsf{\Psi }}_k\left(z\right)=\mathbb{E}\left[{\omega }^{kR}{z}^N\right]=\mathbb{E}\left[{\displaystyle \prod _{j=0}^{n-1}}{\omega }^{kj{X}_j}{z}^{X_j}\right].$$

Since $\left|{\omega }^{kR}{z}^N\right|\le {\left|z\right|}^N$ and $\mathbb{E}\left[{\left|z\right|}^N\right]={(1-p+p\left|z\right|)}^n<\infty$ for $\left|z\right|\le 1$, the series converges absolutely and coefficient extraction is valid.

By independence, the expectation factors:

$${\mathsf{\Psi }}_k\left(z\right)={\displaystyle \prod _{j=0}^{n-1}}\mathbb{E}\left[{\left({\omega }^{kj}z\right)}^{X_j}\right]={\displaystyle \prod _{j=0}^{n-1}}(q+pz{\omega }^{kj}).$$

where $p=P\left(X_j=1\right)$ and $q=1-p$.

Let $d_k=\gcd (k,n)$ and $m_k=n/d_k$. The sequence of exponents ${\left\{kj\left(\mathrm{mod}n\right)\right\}}_{j=0}^{n-1}$ traverses the values $\{0,d_k,2d_k,\dots ,(m_k-1)d_k\}$, each repeated $d_k$ times. With $\eta ={\omega }^{d_k}$, a primitive $m_k$-th root of unity,

$${\mathsf{\Psi }}_k\left(z\right)={\left\{{\displaystyle \prod _{r=0}^{m_k-1}}(q+pz{\eta }^r)\right\}}^{d_k}={\{q^{m_k}-{(-pz)}^{m_k}\}}^{d_k}.$$

Therefore ${\mathsf{\Psi }}_k\left(z\right)$ is a polynomial in $z^{m_k}$. Consequently $\left[z^c\right]{\mathsf{\Psi }}_k\left(z\right)=0$ unless $m_k\mid c$. If $1\le k\le n-1$, then $m_k>1$ and $m_k\mid n$; since $\gcd (c,n)=1$, $m_k\nmid c$. Hence $\left[z^c\right]{\mathsf{\Psi }}_k\left(z\right)=0$, and the nonzero Fourier coefficients vanish. We have:

$$\mathbb{E}\left[{\omega }^{kR}{\mathbf{1}}_{\{N=c\}}\right]=\left[z^c\right]{\mathsf{\Psi }}_k\left(z\right).$$

where the notation $\left[z^c\right]{\mathsf{\Psi }}_k\left(z\right)$ is the coefficient of the term $z^c$ in the series expansion of ${\mathsf{\Psi }}_k\left(z\right)$. Since

$$\begin{array}{c}\hfill \mathbb{E}\left[{\omega }^{kR}{\mathbf{1}}_{\{N=c\}}\right]=\sum _r\sum _{m}P(R=r,N=m)·{\omega }^{kr}·{\mathbf{1}}_{\{m=c\}}=\sum _{r}P(R=r,N=c)·{\omega }^{kr}·1\end{array}$$

Given the hypothesis $\gcd (c,n)=1$, c cannot be a multiple of $m_k=n/\gcd (k,n)$ unless $m_k=1$. If $k\in \{1,\dots ,n-1\}$, then $\gcd (k,n)<n$, implying $m_k>1$. Since $m_k$ is a divisor of n greater than 1, and $\gcd (c,n)=1$, it follows that $m_k\nmid c$. Therefore, $\left[z^c\right]{\mathsf{\Psi }}_k\left(z\right)=0$ for all $k\not\equiv 0\left(\mathrm{mod}n\right)$.

The conditional characteristic function is thus:

$$\mathbb{E}[{\omega }^{kR}\mid N=c]=\left\{\begin{array}{cc}1\hfill & \mathrm{if}k\equiv 0\left(\mathrm{mod}n\right),\hfill \\ 0\hfill & \mathrm{if}k\not\equiv 0\left(\mathrm{mod}n\right).\hfill \end{array}\right.$$

By the uniqueness of the CF, R is uniformly distributed on $\{0,\dots ,n-1\}$ conditional on $N=c$. □

4. Complexity Analysis of Algorithm ${\mathcal{A}}_3$

We analyze the sample complexity of Algorithm ${\mathcal{A}}_3$, defined as the expected number of coin flips required to generate a single output sample.

Theorem 2 (Expected Complexity).

Let $p\in (0,1)$ be the success probability of the biased coin. Let $T_n$ be the random variable representing the total number of coin flips performed by Algorithm ${\mathcal{A}}_3$ to generate one output in $\{0,\dots ,n-1\}$.

The expected number of flips satisfies the following asymptotic bound as $n\to \infty$:

$$\mathbb{E}\left[T_n\right]=O\left(n\log \log n\right).$$

Furthermore, if n is prime, the complexity is strictly linear:

$$\mathbb{E}\left[T_n\right]=n+o\left(1\right).$$

Proof. 

Algorithm ${\mathcal{A}}_3$ operates in independent trials. In each trial, a batch of n coin flips is generated. Let ${\mathbf{X}}^{\left(n\right)}=(X_0,\dots ,X_{n-1})$ be the sequence of outcomes in a single batch, and let $N={\sum }_{i=0}^{n-1}{X}_i$ be the number of heads. The batch is accepted if and only if $\gcd (N,n)=1$.

Let ${\alpha }_n$ denote the probability of acceptance in a single trial:

$${\alpha }_n=P(\gcd (N,n)=1)=\sum _{\begin{array}{c}0\le k\le n\\ \gcd (k,n)=1\end{array}}\left({\displaystyle \genfrac{}{}{0pt}{}{n}{k}}\right)p^k{(1-p)}^{n-k}.$$

Since trials are independent, the number of trials M required to obtain a valid output follows a Geometric distribution with parameter ${\alpha }_n$. The total number of flips is $T_n=n·M$. By the properties of the Geometric distribution ($\mathbb{E}\left[M\right]=1/{\alpha }_n$), the expected number of flips is:

$$\mathbb{E}\left[T_n\right]={\displaystyle \frac{n}{{\alpha }_n}}.$$

Case 1: n is Prime

If n is prime, $\gcd (k,n)=1$ for all $k\in \{1,\dots ,n-1\}$. The condition fails only if $N=0$ or $N=n$.

$${\alpha }_n=1-P(N=0)-P(N=n)=1-{(1-p)}^n-p^n.$$

For any fixed $p\in (0,1)$, the terms ${(1-p)}^n$ and $p^n$ decay exponentially to 0. Thus, ${\lim }_{n\to \infty }{\alpha }_n=1$.

$$\mathbb{E}\left[T_n\right]\approx {\displaystyle \frac{n}{1}}=O\left(n\right).$$

Case 2: n is Composite (General Case)

We estimate ${\alpha }_n$ for composite n. As $n\to \infty$, the distribution of the sum N modulo d approaches a uniform distribution on $\{0,\dots ,d-1\}$ when d is any fixed divisor of n.

The probability that N is coprime to n behaves asymptotically like the density of integers coprime to n in the range $[0,n-1]$ and this density is given by Euler’s totient function ratio ${\displaystyle \frac{\varphi \left(n\right)}{n}}$:

$${\alpha }_n={\displaystyle \frac{\varphi \left(n\right)}{n}}+r_n,\left|r_n\right|\le C_p{\displaystyle \frac{\tau \left(n\right)}{\sqrt{n}}}.$$

Thus, for fixed $p\in (0,1)$ and sufficiently large n, ${\alpha }_n\ge {\displaystyle \frac{1}{2}}\varphi \left(n\right)/n$. This is the only estimate needed for the complexity upper bound.

The relevant lemmas and proofs can be found in Appendix A. Substituting this into the expectation:

$$\mathbb{E}\left[T_n\right]={\displaystyle \frac{n}{{\alpha }_n}}\le {\displaystyle \frac{2n}{\varphi \left(n\right)/n}}={\displaystyle \frac{2n^2}{\varphi \left(n\right)}}.$$

By Landau’s theorem (see Theorem 328 of [10]), $n/\varphi \left(n\right)=O\left(\log \log n\right)$, hence

$$\mathbb{E}\left[T_n\right]=O\left(n\log \log n\right).$$

The prime case remains sharper. If n is prime, the only rejected head counts are 0 and n, so

$${\alpha }_n=1-q^n-p^n,\mathbb{E}\left[T_n\right]={\displaystyle \frac{n}{1-q^n-p^n}}=n+O\left(n(p^n+q^n)\right)=n+o\left(1\right).$$

   □

According to Theorem 2, when n is prime, the expected complexity of Algorithm ${\mathcal{A}}_3$ achieves a strict linear bound $\mathbb{E}\left[T_n\right]=n+o\left(1\right)$. This implies that the algorithm’s acceptance probability ${\alpha }_n$ is approximately $1/n$ (as derived from $T_n=n/{\alpha }_n$), thereby achieving an optimal linear time cost for generating a single output.

For the composite case, our analysis using Fourier methods and number theory demonstrates that the acceptance probability satisfies ${\alpha }_n={\displaystyle \frac{\varphi \left(n\right)}{n}}+O_p\left({\displaystyle \frac{\tau \left(n\right)}{\sqrt{n}}}\right)$, where $\varphi \left(n\right)$ is Euler’s totient function and $\tau \left(n\right)$ is the divisor function. By leveraging the properties $\tau \left(n\right)=n^{o\left(1\right)}$ and $n/\varphi \left(n\right)=O\left(\log \log n\right)$, we establish the lower bound ${\alpha }_n\ge {\displaystyle \frac{1}{2}}·{\displaystyle \frac{\varphi \left(n\right)}{n}}$. This directly leads to the expected complexity bound of $O\left(n\log \log n\right)$.

This refined analysis not only explains the root cause of the complexity difference between prime and composite cases but also rigorously demonstrates, through a proven lower bound on the acceptance probability, that the $O\left(n\log \log n\right)$ complexity for composite n is indeed tight.

Remark 1.

The appearance of $\varphi \left(n\right)/n$ has a simple interpretation. A batch is accepted precisely when its head count lies in a residue class coprime to n. Among the n residues modulo n, exactly $\varphi \left(n\right)$ are coprime to n. Thus $\varphi \left(n\right)/n$ is the ideal acceptance density. The Moebius–Fourier calculation quantifies the deviation of the binomial head-count distribution from this ideal residue density.

5. Continuous Complexity Analysis of Algorithm ${\mathcal{A}}_3$

Having established the strict uniformity of the algorithm through a purely analytic characteristic function proof and derived tight asymptotic bounds on its expected runtime, we proceed to extend the method to the continuous uniform distribution in this section. We utilize the discrete extraction method from Theorem 3 to construct a random variable U on the continuous interval $[0,1]$.

Definition 4 (Base-n Digit Generator).

Let $\mathcal{S}$ be a stream of i.i.d. Bernoulli trials. We parse $\mathcal{S}$ into disjoint blocks of length n. For each block j, we compute the total sum $N_j$ and rank sum $R_j$.

• If $\gcd (N_j,n)=1$, we accept the block and output the digit $D_k=R_j\left(\mathrm{mod}n\right)$.
• If $\gcd (N_j,n)\ne 1$, we discard the block.

Let $D_1,D_2,\dots$ be the sequence of successfully generated digits. By Theorem 3 and the independence of the blocks, ${\left\{D_k\right\}}_{k\ge 1}$ is a sequence of i.i.d. variables uniformly distributed on $\{0,1,\dots ,n-1\}$.

Base-n expansions are not unique on the countable set of n-adic rationals, where a terminating expansion can also be written with an eventually all-$(n-1)$ tail. We adopt the canonical convention that excludes the eventually all-$(n-1)$ representation. The digit sequence generated by independent accepted A3 blocks is almost surely not eventually constant equal to $n-1$, so the ambiguity has probability zero and does not affect the distributional conclusion.

Theorem 3 (Continuous Uniformity).

Let U be the random variable defined by the base-n expansion using the digits generated above:

$$U={\displaystyle \sum _{k=1}^{\infty }}{\displaystyle \frac{D_k}{n^k}}.$$

Then U follows a continuous uniform distribution on $[0,1]$, i.e., $U\sim \mathit{Uniform}[0,1]$.

Proof. 

We use the method of Characteristic Functions. The characteristic function of the target distribution $\mathrm{Uniform}[0,1]$ is:

$${\varphi }_{\mathrm{target}}\left(t\right)={\int }_0^1{e}^{itx}dx={\displaystyle \frac{e^{it}-1}{it}}.$$

We must show that ${\varphi }_U\left(t\right)=\mathbb{E}\left[e^{itU}\right]$ is equal to ${\varphi }_{\mathrm{target}}\left(t\right)$.

• Case 1: Characteristic Function of a Single Digit

Since $D_k$ is uniform on $\{0,\dots ,n-1\}$, its characteristic function is:

$$\mathbb{E}\left[e^{i\xi D_k}\right]={\displaystyle \frac{1}{n}}{\displaystyle \sum _{j=0}^{n-1}}{e}^{i\xi j}={\displaystyle \frac{1}{n}}{\displaystyle \frac{e^{in\xi }-1}{e^{i\xi }-1}}.$$

• Case 2: Characteristic Function of the Partial Sum

Let $U_M={\sum }_{k=1}^M{D}_k{n}^{-k}$ be the partial sum of the first M digits. Since the digits are independent, the characteristic function of the sum is the product of the characteristic functions of the individual terms. The k-th term is $X_k=D_k{n}^{-k}$.

$${\varphi }_{U_M}\left(t\right)=\mathbb{E}\left[\exp \left(it{\displaystyle \sum _{k=1}^M}{\displaystyle \frac{D_k}{n^k}}\right)\right]={\displaystyle \prod _{k=1}^M}\mathbb{E}\left[e^{i(t/n^k)D_k}\right].$$

Substituting $\xi =t/n^k$ into the single digit formula:

$$\mathbb{E}\left[e^{i(t/n^k)D_k}\right]={\displaystyle \frac{1}{n}}{\displaystyle \frac{e^{in(t/n^k)}-1}{e^{i(t/n^k)}-1}}={\displaystyle \frac{1}{n}}{\displaystyle \frac{e^{it/n^{k-1}}-1}{e^{it/n^k}-1}}.$$

The preceding calculation assumes $t\ne 0$ because the displayed telescoping quotient contains $e^{it/n^M}-1$ in the denominator. The point $t=0$ is immediate: for every M, ${\varphi }_{U_M}\left(0\right)=1$, and the characteristic function of $\mathrm{Uniform}[0,1]$ also equals 1 at zero. We therefore define $(e^{it}-1)/\left(it\right)$ at $t=0$ by continuity. Hence the characteristic functions converge for all $t\in \mathbb{R}$.

The product over $k=1$ to M telescopes:

$$\begin{array}{cc}\hfill {\varphi }_{U_M}\left(t\right)& =\left({\displaystyle \frac{1}{n}}{\displaystyle \frac{e^{it}-1}{e^{it/n}-1}}\right)·\left({\displaystyle \frac{1}{n}}{\displaystyle \frac{e^{it/n}-1}{e^{it/n^2}-1}}\right)\cdots \left({\displaystyle \frac{1}{n}}{\displaystyle \frac{e^{it/n^{M-1}}-1}{e^{it/n^M}-1}}\right)\hfill \\ & ={\displaystyle \frac{1}{n^M}}{\displaystyle \frac{e^{it}-1}{e^{it/n^M}-1}}.\hfill \end{array}$$

• Case 3: Convergence to the Continuum

We take the limit as $M\to \infty$. Consider the denominator term $e^{it/n^M}-1$. Using the Taylor expansion $e^x\approx 1+x$ for small x:

$$e^{it/n^M}-1\sim {\displaystyle \frac{it}{n^M}}\mathrm{as}M\to \infty .$$

Substituting this back into the expression for ${\varphi }_{U_M}\left(t\right)$:

$$\underset{M\to \infty }{\lim }{\varphi }_{U_M}\left(t\right)=\underset{M\to \infty }{\lim }{\displaystyle \frac{1}{n^M}}{\displaystyle \frac{e^{it}-1}{(it/n^M)}}={\displaystyle \frac{e^{it}-1}{it}}.$$

The limit matches ${\varphi }_{\mathrm{target}}\left(t\right)$. By the Lévy Continuity Theorem, $U_M$ converges in distribution to U, and U is uniformly distributed on $[0,1]$. □

For finite-precision simulation, the generator outputs $U_M={\sum }_{k=1}^M{D}_k{n}^{-k}$. Since each digit requires one accepted A3 block and each block has acceptance probability ${\alpha }_n$, the expected number of biased flips is $Mn/{\alpha }_n$. Hence the finite-precision runtime is $Mn(1+o(1\left)\right)$ for prime n and $O\left(Mn\log \log n\right)$ for general n. Under the canonical coupling with the infinite expansion, $|U-U_M| \le n^{-M}$.

In fact, let ${\left(D_k\right)}_{k\ge 1}$ be the i.i.d. digits generated by accepted A3 blocks. Define

$$U={\displaystyle \sum _{k=1}^{\infty }}{D}_k{n}^{-k},U_M={\displaystyle \sum _{k=1}^M}{D}_k{n}^{-k}.$$

Then $U\sim \mathrm{Uniform}[0,1]$ and

$$0\le U-U_M\le {\displaystyle \sum _{k=M+1}^{\infty }}(n-1)n^{-k}=n^{-M}.$$

The expected number of biased coin flips required to generate $U_M$ is

$$\mathbb{E}\left[T_{n,M}\right]=M{\displaystyle \frac{n}{{\alpha }_n}},$$

which is $Mn(1+o(1\left)\right)$ for prime n and $O\left(Mn\log \log n\right)$ for general n.

The algorithm does not require storing the entire block. During the scan of a block, N and $R\mathrm{mod}n$ can be updated incrementally. Computing $\gcd (N,n)$ by the Euclidean algorithm adds only logarithmic arithmetic overhead. Therefore the dominant cost remains the generation of Bernoulli trials, while the modular arithmetic and gcd check are standard low-order implementation costs.

6. Conclusions

This paper has provided a comprehensive theoretical treatment of Lei’s algorithm ${\mathcal{A}}_3$ for extracting exact discrete uniform distributions from biased Bernoulli trials, and has extended its reach to continuous uniform generation. Three primary contributions were presented. First, in terms of algorithm validity verification, we abandon the traditional group-theoretic proof framework and propose a novel analytic proof based on characteristic functions and roots of unity. Second, regarding sample complexity analysis, we derive the first explicit asymptotic bounds for Algorithm ${\mathcal{A}}_3$ by combining properties of the binomial distribution, Euler’s totient function $\varphi \left(n\right)$, and classical results from analytic number theory. Third, in the extension to continuous uniform distributions, we construct a Base-n Digit Generator using the discrete uniform digits output by ${\mathcal{A}}_3$.

From a methodological standpoint, the characteristic-function perspective not only simplifies the proof but also suggests possible generalizations to other group structures. The complexity analysis, albeit asymptotic, confirms that the rejection penalty for composite moduli is mild—only a logarithmic factor—and is unlikely to hinder practical deployment.

Future research directions can focus on three aspects: first, optimizing the rejection sampling strategy to reduce the discard rate of composite n, especially for large n with multiple prime factors; second, extending the algorithm to non-i.i.d. Bernoulli sources (e.g., sources with weak dependence) while maintaining uniformity guarantees; third, exploring the application of ${\mathcal{A}}_3$ in privacy-preserving machine learning, such as ensuring fairness in federated learning systems where local hardware biases may compromise global model equity.