A Signature-based Algorithm for Computing
Gröbner Bases over Principal Ideal Domains

The theory of Gröbner bases was introduced by Buchberger in 1965 [5] and has since become a fundamental algorithmic tool in computer algebra. Over the past decades, many algorithms have been developed to compute Gröbner bases more and more efficiently. The latest iteration of such algorithms is the class of signature-based algorithms, which introduce the notion of signatures and use it to detect and prevent unnecessary or redundant reductions. Following early work in [20], the technique of signatures was first formally introduced for Algorithm F5 [11], allowing to compute a Gröbner basis for a regular sequence without any reduction to zero. Since then, there have been many research works in this direction [13, 2, 7, 8].

All these algorithms are for ideals in polynomial rings over fields. Gröbner bases can be defined and computed over commutative rings [1, Ch. 4]. This can be used in many applications, e.g. for polynomials over $\mathbb{Z}$ in lattice-based cryptography [12] or for polynomials over a polynomial ring as an elimination tool [21]. Many other examples are described in [18].

If the coefficient ring is not a field, there are two ways to define Gröbner bases, namely weak and strong bases. Strong Gröbner bases ensure that normal forms can be computed as in the case of fields. But a strong Gröbner basis is in general larger than a weak one, and if the base ring is not a Principal Ideal Domain (PID), then some ideals exist which do not admit a strong Gröbner basis. On the other hand, weak Gröbner bases, or simply Gröbner bases, always exist for polynomial ideals over a Noetherian commutative ring. They do not necessarily define a unique normal form, but they can be used to decide ideal membership. If necessary, over a PID, a post-processing phase performing coefficient reductions can be used to obtain a strong Gröbner basis.

Recent works have focused on generalizing signature-based techniques to Gröbner basis algorithms over rings. First steps in this direction, adding signatures to a modified version of Buchberger’s algorithm for strong Gröbner bases over Euclidean rings [17], were presented in [9]. That paper proves that a signature-based Buchberger’s algorithm for strong Gröbner bases cannot ensure correctness of the result after encountering a “signature-drop”, but can nonetheless be used as a prereduction step in order to significantly speed up the computations.

In this paper, we prove that it is possible to compute a weak signature-Gröbner bases of polynomial ideals over PIDs (including Euclidean rings) using signature-based techniques. The proof-of-concept algorithm that we present is adapted from the weak Gröbner basis algorithm due to Möller [19] [1, Sec. 4.2], which is designed to compute a basis for a polynomial ideal over any ring, and does so by considering combinations and reductions by multiple polynomials at once. The main difference with the results of [9] is that we use a stricter definition of regular reductions, effectively preventing more reductions from happening, and at the same time adding more polynomials to the basis.

This ensures that no reductions leading to signature-drops can happen in the algorithm, and as a consequence, we prove that the algorithm terminates and computes a signature Gröbner basis with elements ordered with non-decreasing signatures. This property allows us to examine classic signature-based criteria, such as the syzygy criterion, the F5 criterion and the singular criterion, and show how they can be adapted to the case of PIDs. In particular, when the input forms a regular sequence, the algorithm performs no reductions to zero. To the best of our knowledge, this is the first algorithm that, given a regular sequence of polynomials with coefficients in a PID, can compute a Gröbner basis of the corresponding ideal without any reduction to zero.

Möller also presented an efficient algorithm that computes (strong) Gröbner basis for polynomial ideals where the coefficients are from Principal Ideal Rings [19, Section 4]. That algorithm skips the combinatorial bottleneck of computing saturated sets. Instead, it uses two polynomials to build S-polynomials and makes use of Gebauer-Möller criteria [15], previously introduced for fields, to discard redundant S-polynomials.

Whenever necessary, for clarity, we shall refer to that algorithm as Möller’s strong algorithm. The algorithm at the center of our focus, computing weak Gröbner bases, will be referred to as Möller’s weak algorithm, or simply Möller’s algorithm.

We have written a toy implementation of the algorithms presented, with the F5 and the singular criteria, in the Magma Computational Algebra System [4], and compared its efficiency, in terms of number of excluded pairs, with Möller’s strong algorithm. Experimentally, on all considered examples, Möller’s (weak) algorithm with signatures does compute and reduce fewer S-polynomials than Möller’s strong algorithm.

Möller’s (weak) algorithm, without signatures, works for polynomial systems over any Noetherian commutative ring. The signature-based algorithm is only proved to be correct and to terminate for PIDs, but with very few changes, it can be made to accommodate inputs with coefficients in a more general ring. Interestingly, early experimental data with coefficients in a multivariate polynomial ring (a Unique Factorization Domain but not a PID) suggest that the signature-based algorithm might work over more general rings than just PIDs. For that reason, and because it does not over-complicate the exposition, we choose to present Möller’s algorithms, with and without signatures, in their most general form, accepting input over any Noetherian commutative ring.

Let $R$ be a Noetherian integral domain, which is assumed to have a unit and be commutative. Let $A=R[x_{1},\dots,x_{n}]$ be the polynomial ring in $n$ indeterminates $x_{1},\ldots,x_{n}$ over $R$. A monomial in $A$ is $x^{a}=x_{1}^{a_{1}}\dots x_{n}^{a_{n}}$ where $a=(a_{1},\dots,a_{n})\in\mathbb{N}^{n}$. A term is $kx^{a}$, where $k\in R$ and $k\neq 0$. We will denote all the terms in $A$ by $\mathrm{Ter}(A)$ and all the monomials in $A$ by $\mathrm{Mon}(A)$. We use the notation $\mathfrak{a}$ for polynomial ideals in $A=R[x_{1},\ldots,x_{n}]$ and $I$ for ideals in the coefficient ring $R$.

The notion of monomial order can be directly extended from $\mathbb{K}[x_{1},\ldots,x_{n}]$ to $A$. In the rest of the paper, we assume that $A$ is endowed with an implicit monomial order $\prec$, and we define as usual the leading monomial $\mathrm{LM}$, the leading term $\mathrm{LT}$ and the leading coefficient $\mathrm{LC}$ of a given polynomial.

Given a tuple of polynomials $(g_{1},\dots,g_{s})$ and $i\in\{1,\dots,s\}$, we will frequently denote, for brevity, $M(i)=\mathrm{LM}(g_{i})$, $C(i)=\mathrm{LC}(g_{i})$ and $T(i)=\mathrm{LT}(g_{i})=C(i)M(i)$.

For more details about the contents of this section, one can refer to [1, Chapter 4].

We consider the free $A$-module $A^{m}$ with basis $\mathbf{e}_{1},\ldots,\mathbf{e}_{m}$. A term (resp. monomial) in $A^{m}$ is $kx^{a}\mathbf{e}_{i}$ (resp. $x^{a}\mathbf{e}_{i}$) for some $k\in R\setminus\{0\}$, $x^{a}\in\mathrm{Mon}(A)$, $i\in\{1,\dots,m\}$. In this paper, terms in $A^{m}$ are ordered using the Position Over Term (POT) order, defined by

Given two terms $kx^{a}\mathbf{e}_{i}$ and $lx^{b}\mathbf{e}_{j}$ in $A^{m}$, we write $kx^{a}\mathbf{e}_{i}\simeq lx^{b}\mathbf{e}_{j}$ if they are incomparable, i.e. if $a=b$ and $i=j$.

Given a set of polynomials $f_{1},\dots,f_{m}\in A$, elements of $A^{m}$ encode elements of the ideal $\langle f_{1},\dots,f_{m}\rangle$ through the $A$-module homomorphism $\bar{\cdot}:A^{m}\to A$, defined by setting $\overline{\mathbf{e}}_{i}=f_{i}$ and extending linearly to $A^{m}$. In particular, $\overline{\sum_{i=1}^{m}p_{i}\mathbf{e}_{i}}=\sum_{i=1}^{m}p_{i}f_{i}$.

We recall the concept of signatures in $A^{m}$. Let $\mathbf{p}=\sum_{i=1}^{m}p_{i}\mathbf{e}_{i}$ be a module element. Under the POT ordering, the signature of $\mathbf{p}$ is $\mathfrak{s}(\mathbf{p})=\mathrm{LT}(p_{i})\mathbf{e}_{i}$ where $i$ is such that $p_{i+1}{=}\dots=p_{m}=0$ and $p_{i}\neq 0$. Signatures are of the form $kx^{a}\mathbf{e}_{i}$, where $k\in R,x^{a}\in\mathrm{Mon}(A)$ and $\mathbf{e}_{i}$ is a standard basis vector.

Note that we have two ways of comparing two similar signatures $\mathfrak{s}(\boldsymbol{\alpha})=kx^{a}\mathbf{e}_{i}$ and $\mathfrak{s}(\boldsymbol{\beta})=lx^{b}\mathbf{e}_{j}$. We write $\mathfrak{s}(\boldsymbol{\alpha})=\mathfrak{s}(\boldsymbol{\beta})$ if $k=l$, $a=b$ and $i=j$, and we write $\mathfrak{s}(\boldsymbol{\alpha})\simeq\mathfrak{s}(\boldsymbol{\beta})$ if $a=b$ and $i=j$, $k$ and $l$ being possibly different. If $R$ is a field, one can assume that the coefficient is $1$, and so this distinction is not important.

Note also that when we order signatures, we only compare the corresponding module monomials, and disregard the coefficients. This is a different approach from the one used in [9], where both signatures and coefficients are ordered.

Given a tuple $(\boldsymbol{\alpha}_{1},\dots,\boldsymbol{\alpha}_{s})$ of module elements in $A^{m}$ and $i,j\in\{1,\dots,s\}$, we shall frequently denote $S(i)=\mathfrak{s}(\boldsymbol{\alpha}_{i})$ for brevity.

In order to keep track of signatures we modify Def. 3.2 to introduce the notion of $\mathfrak{s}$-reduction.

Just like $\mathfrak{s}$-reduction over fields, one can interpret $\mathfrak{s}$-reduction as polynomial reduction with an extra condition on the signature of the reducers. The difference with fields is that in $R[x_{1},\dots,x_{n}]$ polynomial reduction is defined differently from the classic polynomial reduction. Additionally, in the case of fields, all singular $\mathfrak{s}$-reductions are $1$-singular.

The outcome $\mathbf{q}$ of $\mathfrak{s}$-reducing $\mathbf{p}$ is such that $\mathrm{LT}(\overline{\mathbf{q}})\prec\mathrm{LT}(\overline{\mathbf{p}})$ and $\mathfrak{s}(\mathbf{q})\preceq\mathfrak{s}(\mathbf{p})$. If $\mathbf{q}$ is the result of a regular $\mathfrak{s}$-reduction, then $\mathfrak{s}(\mathbf{q})=\mathfrak{s}(\mathbf{p})$. In signature-based algorithms, in order to keep track of the signatures of the basis elements, we only allow regular $\mathfrak{s}$-reductions. Later, we will also prove that elements which are $1$-singular $\mathfrak{s}$-reducible can be discarded.

Using this definition, we can give the following characterization of 1-singular reducibility, which allows for an easy algorithmic test.

We now define (weak) semi-strong signature Gröbner bases, which form a subclass of weak $\mathfrak{s}$-Gröbner bases. In the case of rings, it is easier to compute them than to directly compute weak $\mathfrak{s}$-Gröbner bases.

In order to compute signature Gröbner bases, similar to the case of fields, we will restrict the computations to regular S-polynomials. For this purpose, we first introduce the signature of a set of indices, and regular sets.

Note that given a regular set $J$, one can always compute a regular saturated set $J^{\prime}$ containing $J$, by adding those indices $j$ such that $M(j)\mid M(J)$ and $\frac{M(J)}{M(j)}S(j)\prec S_{J}$.

Recall that all $\mathfrak{s}$-reductions are weak top $\mathfrak{s}$-reductions. In this section, all S-polynomials are weak S-polynomials.