Given (for example) different primes $p,q$ with $2 p+1$, and $4 p+3$ prime as well (same for $q$).
Let
$$N = (4 p+3)\cdot (4 q+3)$$
With this the sequence
$$s_{i+1} = s_i^4 \mod N$$
will have $p\cdot q$ elements (in most cases) for $s_0 = r^4 \mod N$ for almost all random values $r$.
Depending on chosen $r$ the related $s_0 = r^4 \mod N$ will (almost always) be a member of 1 out of 4 disjoint sequences of length $p \cdot q$.
Question:
$\text{ }\mathrm{ I }.$ Is there an easy way to check if a random $r$ leads to a member of sequence $S_1,S_2,S_3,S_4$?
$\mathrm{II}.$ Or can we produce random $r'$ which are all member of the same sequence?
(Both without leaking secret information. The related $s_0$ or other $f(r)$ can also be compared)
(Reducing it to less than 4 sequences with same size would also be helpful.)
More details: If we do $\mathrm{II}.$ we also need to guarantee the related $s_0$ do not follow a known order. E.g. if we produce $r'$ with a fixed chosen sequence member $s_m$ and $r' = s_m^{4^r} \mod N$ we always know the exact position related to $s_m$ for every $r$ $\mapsto s_{m+r+1}$.
special cases: For some $r$ the sequence will only have $p,q$ or $1$ element. We ignore them here. To avoid that we need to pick $r$ with
$$r\in[2,N-1] $$
$$r\mod (4 p+3)\not=0 $$
$$ r\mod (4 q+3)\not=0 $$
$$ r \not\in\{r_*^{2p+1} \mod N \}\land r \not\in\{r_*^{2q+1} \mod N \}$$
The adversary will also be able to generate those random members at his machine. Given 2 random $r$ he should not know the index distance in between their related $s_0$ among the target sequence. If he somehow does know it for 2 random $r$ he should not be able to easily compute it for a 3rd random $r$ (in most cases). The exponent $\alpha = 4$ can be replaced with an hard-to-compute equivalent.
Example: $N= 7849=47 \cdot 167$ will produce $4$ sequences with length $451 = 11 \cdot 41$
(plus special cases of length $11,41,1$)
