Linear Extractors Overview

• Linear extractors are deterministic linear maps that transform weak random sources into nearly uniform outputs by applying fixed matrices over finite fields.
• They employ methods such as sparse random matrices, BCH code-based constructions, and weight-spectrum analysis to ensure minimal bias across diverse source models.
• Practical implementations balance computational speed with accuracy, using sparse constructions for efficiency and code-based approaches for strong algebraic guarantees.

Linear extractors are randomness extractors whose extraction map is linear over a finite field or vector space. In the binary setting, the canonical form is a fixed matrix $M$ applied to a weak source $X\in\{0,1\}^n$, producing $Y=XM$ over $\mathbb{F}_2$ and aiming for $Y$ to be $\epsilon$-close to uniform in statistical distance. Within this broad class fall deterministic linear transformations for independent, bit-fixing, and hidden-Markov sources; code-based binary extractors whose performance is governed by code spectra; affine and directional affine extractors over $\mathbb{F}_2^n$; deterministic extractors for additive sources such as arithmetic progressions and generalized arithmetic progressions; and seeded lossless rank extractors over $\mathbb{F}_q$ (Zhou et al., 2012, Meneghetti et al., 2014, Gryaznov et al., 2022, Bhowmick et al., 2014, Guo et al., 15 Apr 2026).

1. Formal notion and parameters

A deterministic linear extractor is defined by a fixed binary matrix $M$ of size $n\times m$, applied to a weak source $X\in\{0,1\}^n$0 by

$X\in\{0,1\}^n$1

with all arithmetic modulo $X\in\{0,1\}^n$2. The extraction objective is that $X\in\{0,1\}^n$3 be $X\in\{0,1\}^n$4-close to the uniform distribution $X\in\{0,1\}^n$5 in statistical distance:

$X\in\{0,1\}^n$6

The standard parameters are $X\in\{0,1\}^n$7 for input length, $X\in\{0,1\}^n$8 for output length, $X\in\{0,1\}^n$9 for min-entropy, and $Y=XM$0 for allowable error (Zhou et al., 2012).

In the code-based formulation, a $Y=XM$1 binary matrix $Y=XM$2 defines

$Y=XM$3

Each output bit is the modulo-$Y=XM$4 sum of some subset of the input bits. The quality measure is total-variation distance:

$Y=XM$5

where

$Y=XM$6

This formulation emphasizes that linear binary extractors are deterministic post-processors that compress biased input bits into fewer output bits while attempting to reduce residual bias (Meneghetti et al., 2014).

The literature considered here treats several source models. For independent sources, $Y=XM$7 has independent coordinates with arbitrary bias, and

$Y=XM$8

For bit-fixing sources, exactly $Y=XM$9 positions are uniform and independent, while the remaining $\mathbb{F}_2$0 bits are arbitrary. For hidden-Markov sources, an underlying Markov chain $\mathbb{F}_2$1 produces $\mathbb{F}_2$2, subject to the bounded-noise condition

$\mathbb{F}_2$3

which implies that sums of $\mathbb{F}_2$4 bits have bias at most $\mathbb{F}_2$5 (Zhou et al., 2012).

2. Sparse linear transformations and extraction from weak binary sources

A central construction uses a random binary matrix $\mathbb{F}_2$6 whose entries are i.i.d. Bernoulli$\mathbb{F}_2$7 with

$\mathbb{F}_2$8

Here “sparse” means $\mathbb{F}_2$9 but $Y$0. A Fourier-analytic bound gives

$Y$1

reducing extraction analysis to the biases of nonzero linear forms of the output (Zhou et al., 2012).

For independent sources with $Y$2, the main asymptotic statement is that if $Y$3, then for such sparse random $Y$4,

$Y$5

in probability as $Y$6. In this sense, one can extract up to nearly $Y$7 uniform bits. For uniformly random $Y$8 with $Y$9, the expectation bound

$\epsilon$0

is obtained directly, while the sparse case is handled by a small-weight and large-weight partition of the nonzero vectors $\epsilon$1 (Zhou et al., 2012).

For bit-fixing sources, the rate is again $\epsilon$2, but the behavior is stronger: with high probability over $\epsilon$3, one gets $\epsilon$4 as soon as $\epsilon$5. The reason is structural: any nonzero linear form on $\epsilon$6 must involve at least one of the $\epsilon$7 uniform bits, which ensures unbiasedness (Zhou et al., 2012).

For hidden-Markov sources, the same sparse-linear framework remains effective but is no longer stated as asymptotically optimal. The extractable rate is

$\epsilon$8

and $\epsilon$9 in probability whenever

$\mathbb{F}_2^n$0

The proofs again use the partition into small-weight and large-weight contributions (Zhou et al., 2012).

Source model	Condition on output length	Asymptotic guarantee
Independent source	$\mathbb{F}_2^n$1	$\mathbb{F}_2^n$2 in probability
Bit-fixing source	$\mathbb{F}_2^n$3	With high probability, $\mathbb{F}_2^n$4
Hidden-Markov source	$\mathbb{F}_2^n$5	$\mathbb{F}_2^n$6 in probability

The same work also analyzes explicit matrices. If $\mathbb{F}_2^n$7 is the generator matrix of a primitive BCH code whose row-weight distribution is asymptotically binomial, and each input bit has bias at most $\mathbb{F}_2^n$8, then for

$\mathbb{F}_2^n$9

the output $\mathbb{F}_q$0 satisfies $\mathbb{F}_q$1. The accompanying trade-off is computational: primitive BCH generator matrices are dense, with approximately $\mathbb{F}_q$2 ones per row, so they require more computation than sparse random matrices (Zhou et al., 2012).

3. Code spectra, minimum distance, and entropy bounds

A linear extractor defined by a binary matrix $\mathbb{F}_q$3 can be studied through the linear code it generates. If $\mathbb{F}_q$4 generates an $\mathbb{F}_q$5 binary linear code, then a classical minimum-distance-only bound gives

$\mathbb{F}_q$6

where $\mathbb{F}_q$7 is the bias of each independent input bit. This estimate depends only on the minimum distance $\mathbb{F}_q$8 (Meneghetti et al., 2014).

The sharper bound introduced later uses the full weight distribution of the code. If $\mathbb{F}_q$9 denotes the number of codewords of Hamming weight $M$0, then

$M$1

This makes the distance spectrum, not merely the minimum distance, the controlling object. A code with the same $M$2 but fewer low-weight codewords has a smaller right-hand side, and when the bulk of the spectrum lies well above $M$3, the improvement over the minimum-distance bound can be substantial (Meneghetti et al., 2014).

The same analysis yields a lower bound on the Shannon-entropy rate of the output. For $M$4 and $M$5 for the uniform distribution on $M$6,

$M$7

with

$M$8

This converts a total-variation estimate into an entropy-rate guarantee (Meneghetti et al., 2014).

The code-spectrum viewpoint also changes code-selection criteria. Classical distance-optimal codes, including BCH codes, Reed–Solomon binary images, and some LDPC ensembles, are singled out because sparse low-weight spectra improve the bound. Numerical illustrations using the Reed–Muller $M$9 and $n\times m$0 codes show that the spectrum-based right-hand side can be orders of magnitude smaller than $n\times m$1 for moderate $n\times m$2 (Meneghetti et al., 2014).

Taken together with the sparse-matrix analysis, these results show two distinct mechanisms for linear extraction. Random sparse transformations rely on probabilistic structure and asymptotic bias decay, whereas fixed code-based maps are governed by algebraic invariants of the underlying code. The latter perspective is especially relevant when deterministic post-processing is required and the matrix cannot be resampled (Zhou et al., 2012, Meneghetti et al., 2014).

4. Affine, additive, and directional forms of linear extraction

Affine sources and additive sources provide a different seedless regime for linear extractors. A line source in $n\times m$3 is the uniform distribution on an affine line

$n\times m$4

and has min-entropy $n\times m$5. For every $n\times m$6 and prime power $n\times m$7, there is an explicit deterministic extractor

$n\times m$8

such that for every line source $n\times m$9,

$X\in\{0,1\}^n$00

By the XOR lemma, this extends to

$X\in\{0,1\}^n$01

with

$X\in\{0,1\}^n$02

The construction is based on a norm-polynomial of degree $X\in\{0,1\}^n$03 that remains nonconstant on every affine line, reducing the field-size requirement from $X\in\{0,1\}^n$04 in earlier work to $X\in\{0,1\}^n$05 (Bhowmick et al., 2014).

The same polynomial-plus-Weil-bound method extends to short arithmetic progressions and to constant-dimensional generalized arithmetic progressions. The additive-source model includes arithmetic progressions, generalized arithmetic progressions, and Bohr sets, each of which generalizes affine sources. Over both $X\in\{0,1\}^n$06 and $X\in\{0,1\}^n$07, explicit extractors are obtained for additive sources with linear min-entropy, although the results over $X\in\{0,1\}^n$08 require a list-decodability condition (Bhowmick et al., 2014).

Directional affine extractors strengthen standard affine extractors by requiring pseudorandomness of every nonzero directional derivative. For a function $X\in\{0,1\}^n$09 and nonzero direction $X\in\{0,1\}^n$10, the derivative is

$X\in\{0,1\}^n$11

The function is an $X\in\{0,1\}^n$12 directional affine extractor if for every nonzero $X\in\{0,1\}^n$13 and every affine subspace $X\in\{0,1\}^n$14 of dimension at least $X\in\{0,1\}^n$15, the distribution $X\in\{0,1\}^n$16 has error at most $X\in\{0,1\}^n$17 from uniform. In the one-bit case, Gryaznov, Pudlák, and Talebanfard give an explicit triple-trace construction on $X\in\{0,1\}^n$18 bits:

$X\in\{0,1\}^n$19

which is a directional affine extractor with extractor dimension $X\in\{0,1\}^n$20, output length $X\in\{0,1\}^n$21, and bias $X\in\{0,1\}^n$22 (Gryaznov et al., 2022).

A later explicit construction is stated as

$X\in\{0,1\}^n$23

such that for every $X\in\{0,1\}^n$24-dimensional affine source $X\in\{0,1\}^n$25 and every nonzero $X\in\{0,1\}^n$26,

$X\in\{0,1\}^n$27

Its parameters are

$X\in\{0,1\}^n$28

A key ingredient is a new linear somewhere condenser for affine sources based on dimension expanders (Li et al., 2023).

These directional constructions have average-case complexity consequences. If $X\in\{0,1\}^n$29 is an $X\in\{0,1\}^n$30 directional affine extractor with $X\in\{0,1\}^n$31, then any strongly read-once linear branching program $X\in\{0,1\}^n$32 of size

$X\in\{0,1\}^n$33

computes $X\in\{0,1\}^n$34 with advantage at most $X\in\{0,1\}^n$35 over random guessing:

$X\in\{0,1\}^n$36

In the later framework, if $X\in\{0,1\}^n$37 is a $X\in\{0,1\}^n$38-directional affine extractor, then any strongly read-once linear branching program that agrees with $X\in\{0,1\}^n$39 on more than $X\in\{0,1\}^n$40 fraction of inputs must have size at least $X\in\{0,1\}^n$41 (Gryaznov et al., 2022, Li et al., 2023).

5. Rank extractors and linear-algebraic pseudorandomness over finite fields

A seeded lossless rank extractor is a family of linear maps

$X\in\{0,1\}^n$42

such that, for each seed $X\in\{0,1\}^n$43, the map $X\in\{0,1\}^n$44 is an $X\in\{0,1\}^n$45 matrix over $X\in\{0,1\}^n$46, and for every full-rank matrix $X\in\{0,1\}^n$47 the number of bad seeds satisfying

$X\in\{0,1\}^n$48

is at most $X\in\{0,1\}^n$49. Equivalently, for every $X\in\{0,1\}^n$50-dimensional subspace $X\in\{0,1\}^n$51,

$X\in\{0,1\}^n$52

When only existence of one good seed is required for every $X\in\{0,1\}^n$53, the object is called a lossless rank disperser (Guo et al., 15 Apr 2026).

Recent work gives explicit constructions in the small-field regime, where the field size depends only on the rank parameter and is independent of the ambient dimension. Over every non-prime field $X\in\{0,1\}^n$54 of size $X\in\{0,1\}^n$55, there exist infinitely many $X\in\{0,1\}^n$56 for which one gets an explicit $X\in\{0,1\}^n$57 lossless extractor with

$X\in\{0,1\}^n$58

Over prime fields $X\in\{0,1\}^n$59 with $X\in\{0,1\}^n$60, a similar extractor exists with

$X\in\{0,1\}^n$61

Over arbitrary small $X\in\{0,1\}^n$62, including $X\in\{0,1\}^n$63, one can build $X\in\{0,1\}^n$64 lossless rank dispersers of size

$X\in\{0,1\}^n$65

These are the first explicit constructions of lossless rank extractors and weak subspace designs for $X\in\{0,1\}^n$66 over fields $X\in\{0,1\}^n$67 with $X\in\{0,1\}^n$68 and $X\in\{0,1\}^n$69 non-prime (Guo et al., 15 Apr 2026).

The constructions are algebraic. One replaces classical polynomial-method constructions by analogues over a function field $X\in\{0,1\}^n$70 of genus $X\in\{0,1\}^n$71 with many rational places, chooses functions from suitable Riemann–Roch spaces, and evaluates them at rational places to form the extractor matrices. The losslessness argument expands $X\in\{0,1\}^n$72 via Cauchy–Binet, uses valuations at a distinguished place $X\in\{0,1\}^n$73, and bounds the number of bad seeds by the pole order of a nonzero determinant function. For prime fields, the construction passes through a quadratic extension and then uses explicit hitting sets for symbolic determinants of the form

$X\in\{0,1\}^n$74

with each $X\in\{0,1\}^n$75 of rank at most $X\in\{0,1\}^n$76 (Guo et al., 15 Apr 2026).

A complementary Fourier-analytic framework uses $X\in\{0,1\}^n$77-biased sets in $X\in\{0,1\}^n$78. If $X\in\{0,1\}^n$79, then such a set meets every codimension-$X\in\{0,1\}^n$80 affine subspace. If $X\in\{0,1\}^n$81, then its projectivization is a strong $X\in\{0,1\}^n$82-blocking set in $X\in\{0,1\}^n$83. Through these connections, explicit rank extractors yield weak subspace designs and strong blocking sets, including constructions of size $X\in\{0,1\}^n$84 for sufficiently large non-prime fields $X\in\{0,1\}^n$85 and $X\in\{0,1\}^n$86 for arbitrary $X\in\{0,1\}^n$87 via the $X\in\{0,1\}^n$88-biased method (Guo et al., 15 Apr 2026).

6. Computational trade-offs and relation to seeded extraction

One motivation for linear extractors is implementation speed. Sparse random matrices are computationally fast, easy to implement using hardware like FPGAs, and attractive in high-speed random number generation. In block-processing mode, one partitions the input stream into blocks of length $X\in\{0,1\}^n$89 and computes $X\in\{0,1\}^n$90 by a matrix-vector XOR. In streaming mode, one keeps a rolling vector $X\in\{0,1\}^n$91 and updates

$X\in\{0,1\}^n$92

for each new bit $X\in\{0,1\}^n$93. The total cost for an $X\in\{0,1\}^n$94 extraction is $X\in\{0,1\}^n$95 XORs, and with $X\in\{0,1\}^n$96 this becomes $X\in\{0,1\}^n$97 (Zhou et al., 2012).

The density of the matrix determines the speed trade-off. Sparse-random $X\in\{0,1\}^n$98 has density approximately $X\in\{0,1\}^n$99, with per-bit processing cost $Y=XM$00 and a simple XOR network. A primitive BCH generator matrix has density $Y=XM$01 and per-bit cost $Y=XM$02. In FPGA terms, sparse-random $Y=XM$03 can be implemented with $Y=XM$04 XOR gates, whereas BCH-based matrices require $Y=XM$05 gates and therefore higher area and power (Zhou et al., 2012).

These deterministic and fixed-matrix approaches sit alongside seeded extractors. A strong seeded extractor is a function

$Y=XM$06

such that for every distribution $Y=XM$07 on $Y=XM$08 with $Y=XM$09 and independent uniform seed $Y=XM$10,

$Y=XM$11

Recent constructions achieve, for all $Y=XM$12 and $Y=XM$13,

$Y=XM$14

with running time $Y=XM$15 after a one-time preprocessing step in the low-$Y=XM$16 regime. The same work gives an instantiation of Trevisan’s extractor with evaluation time

$Y=XM$17

and therefore truly linear time $Y=XM$18 when

$Y=XM$19

These seeded constructions directly yield privacy amplification protocols with communication equal to the seed length (Doron et al., 2024).

The contrast is structural. Sparse linear transformations require no external seed, no look-ahead, and no multiprecision arithmetic, while seeded extractors are defined for every source of min-entropy at least $Y=XM$20 and achieve strong guarantees conditioned on the seed. Within the linear-extractor landscape, the principal axes are therefore the source model, whether a seed is available, the algebraic structure of the map, and the trade-off between explicitness, extraction rate, and evaluation complexity (Zhou et al., 2012, Doron et al., 2024).