In other words, if W is based on the 3-round Feistel cipher, the derived function f will have the above property, and Simon’s algorithm will randomly sample vectors orthogonal to (1||z).