Reconstructing noisy polynomial evaluation in residue rings

Let q > 1 be an integer and let a and b be elements of the residue ring ZZq of integers modulo q. We show how, when given a polynomial f ∈ ZZq[X] and approximations to v0, v1 ∈ ZZq such that v1 ≡ f(v0) mod q one can recover v0 and v1 efficiently. This result has direct applications to predicting the polynomial congruential generator: a sequence (vn) of pseudorandom numbers defined by the relation vn+1 ≡ f(vn) mod q for some polynomial f ∈ ZZq[X]. The applications lead to analogues of results known for the linear congruential generator xn+1 ≡ axn + b mod q, although the results are much more restrictive due to nonlinearity of the problem.