A fast quantum mechanical algorithm for database search Lov K. Grover 3C-404A, Bell Labs 600 Mountain Avenue Murray Hill NJ 07974 [email protected]
Summary This paper applies quantum computing to a mundane problem in information processing and pre- Imagine a phone directory containing N names sents an algorithm that is significantly faster than any arranged in completely random order. In order to find classical algorithm can be. The problem is this: there is 1 someone's phone number with a probability of--- , any an unsorted database containing N items out of which 2 just one item satisfies a given condition - that one item classical algorithm (whether deterministic or probabilis- has to be retrieved. Once an item is examined, it is pos- N tic) will need to look at a minimum of---- names. Quan- sible to tell whether or not it satisfies the condition in 2 one step. However, there does not exist any sorting on tum mechanical systems can be in a superposition of the database that would aid its selection. The most effi- states and simultaneously examine multiple names. By cient classical algorithm for this is to examine the items properly adjusting the phases of various operations, suc- in the database one by one. If an item satisfies the cessful computations reinforce each other while others required condition stop; if it does not, keep track of this interfere randomly. As a result, the desired phone num- item so that it is not examined again. It is easily seen () N ber can be obtained in onlyON steps. The algo- that this algorithm will need to look at an average of ---- rithm is within a small constant factor of the fastest 2 possible quantum mechanical algorithm. items before finding the desired item.
1. Introduction 1.1 Search Problems in Computer Science Even in theoretical computer science, the typical prob- 1.0 Background Quantum mechanical computers lem can be looked at as that of examining a number of were proposed in the early 1980’s [Benioff80] and in different possibilities to see which, if any, of them sat- many respects, shown to be at least as powerful as clas- isfy a given condition. This is analogous to the search sical computers - an important but not surprising result, problem stated in the summary above, except that usu- since classical computers, at the deepest level, ulti- ally there exists some structure to the problem, i.e some mately follow the laws of quantum mechanics. The sorting does exist on the database. Most interesting description of quantum mechanical computers was for- problems are concerned with the effect of this structure malized in the late 80’s and early 90’s [Deutsch85] on the speed of the algorithm. For example the SAT [BB94] [BV93] [Yao93] and they were shown to be problem asks whether it is possible to find any combina- more powerful than classical computers on various spe- tion of n binary variables that satisfies a certain set of cialized problems. In early 1994, [Shor94] demonstrated clauses C, the crucial issue in NP-completeness is whether it is possible to solve it in time polynomial in n. that a quantum mechanical computer could efficiently n solve a well-known problem for which there was no In this case there are N=2 possible combinations which have to be searched for any that satisfy the specified known efficient algorithm using classical computers. property and the question is whether we can do that in a This is the problem of integer factorization, i.e. finding () ()k the factors of a given integer N, in a time which is poly- time which is polynomial inONlog , i.e.O n . Thus if it were possible to reduce the number of steps to nomial inlogN . ------a finite power ofON()log (instead ofON() as in this paper), it would yield a polynomial time algorithm for NP-complete problems. This is an updated version of a paper that originally In view of the fundamental nature of the search appeared in Proceedings, STOC 1996, Philadelphia PA problem in both theoretical and applied computer sci- USA, pages 212-219.
1 ence, it is natural to ask - how fast can the basic identifi- that are needed in the algorithm of this paper. The first is cation problem be solved without assuming anything the creation of a configuration in which the amplitude of about the structure of the problem? It is generally the system being in any of the 2n basic states of the sys- assumed that this limit isON() since there are N items tem is equal; the second is the Walsh-Hadamard trans- to be examined and a classical algorithm will clearly formation operation and the third the selective rotation takeON() steps. However, quantum mechanical sys- of different states. tems can simultaneously be in multiple Schrodinger cat A basic operation in quantum computing is that states and carry out multiple tasks at the same time. This of a “fair coin flip” performed on a single bit whose states are 0 and 1 [Simon94]. This operation is repre- paper presents anON() step algorithm for the search 1 problem. sented by the following matrix:M = ------1 1 . A bit There is a matching lower bound on how fast 2 1– 1 the desired item can be identified. [BBBV96] show in in the state 0 is transformed into a superposition in the their paper that in order to identify the desired element, 1 , 1 without any information about the structure of the data- two states:------ . Similarly a bit in the state 1 is base, a quantum mechanical system will need at least 2 2 Ω() 1 , 1 N steps. Since the number of steps required by transformed into------–------ , i.e. the magnitude of the 2 2 the algorithm of this paper isON() , it is within a con- 1 stant factor of the fastest possible quantum mechanical amplitude in each state is------but the phase of the algorithm. 2 amplitude in the state 1 is inverted. The phase does not 1.2 Quantum Mechanical Algorithms A good have an analog in classical probabilistic algorithms. It comes about in quantum mechanics since the ampli- starting point to think of quantum mechanical algo- tudes are in general complex. In a system in which the rithms is probabilistic algorithms [BV93] (e.g. simu- n lated annealing). In these algorithms, instead of having states are described by n bits (it has 2 possible states) the system in a specified state, it is in a distribution over we can perform the transformation M on each bit inde- various states with a certain probability of being in each pendently in sequence thus changing the state of the sys- state. At each step, there is a certain probability of mak- tem. The state transition matrix representing this ing a transition from one state to another. The evolution operation will be of dimension 2n X 2n. In case the ini- of the system is obtained by premultiplying this proba- tial configuration was the configuration with all n bits in bility vector (that describes the distribution of probabili- the first state, the resultant configuration will have an ties over various states) by a state transition matrix. n –--- 2 Knowing the initial distribution and the state transition identical amplitude of2 in each of the 2n states. This matrix, it is possible in principle to calculate the distri- is a way of creating a distribution with the same ampli- bution at any instant in time. n Just like classical probabilistic algorithms, tude in all 2 states. quantum mechanical algorithms work with a probability Next consider the case when the starting state distribution over various states. However, unlike classi- is another one of the 2n states, i.e. a state described by cal systems, the probability vector does not completely an n bit binary string with some 0s and some 1s. The describe the system. In order to completely describe the result of performing the transformation M on each bit system we need the amplitude in each state which is a will be a superposition of states described by all possi- complex number. The evolution of the system is ble n bit binary strings with amplitude of each state hav- n obtained by premultiplying this amplitude vector (that –--- 2 describes the distribution of amplitudes over various ing a magnitude equal to2 and sign either + or -. To states) by a transition matrix, the entries of which are deduce the sign, observe that from the definition of the complex in general. The probabilities in any state are 1 given by the square of the absolute values of the ampli- matrix M, i.e.M = ------1 1 , the phase of the result- tude in that state. It can be shown that in order to con- 2 1– 1 serve probabilities, the state transition matrix has to be ing configuration is changed when a bit that was previ- unitary [BV93]. ously a 1 remains a 1 after the transformation is The machinery of quantum mechanical algo- rithms is illustrated by discussing the three operations performed. Hence ifx be the n-bit binary string describ- ing the starting state andy the n-bit binary string
2 describing the resulting string, the sign of the amplitude 3. Algorithm ofy is determined by the parity of the bitwise dot prod- (i) Initialize the system to the distribution: ⋅ ()x y 1 ,,1 1 … 1 uct ofx andy , i.e.–1 . This transformation is ------ , i.e. there is the same amplitude referred to as the Walsh-Hadamard transformation N N N N [DJ92]. This operation (or a closely related operation to be in each of the N states. This distribution can be called the Fourier Transformation) is one of the things obtained inON()log steps, as discussed in section 1.2. that makes quantum mechanical algorithms more pow- (ii) Repeat the following unitary operations ON() erful than classical algorithms and forms the basis for times (the precise number of repetitions is important as most significant quantum mechanical algorithms. discussed in [BBHT96]): The third transformation that we will need is (a) Let the system be in any state S: the selective rotation of the phase of the amplitude in () certain states. The transformation describing this for a 4 In caseCS = 1 , rotate the phase byπ radians; jφ e 1 0 0 0 In caseCS() = 0 , leave the φ j 2 system unaltered. state system is of the form:0 e 0 0 , where (b) Apply the diffusion transform D which jφ 0 0 e 3 0 is defined by the matrix D as follows: φ 2 2 j 4 D = ---- ifi≠ j &D = – 1 + ---- . 0 0 0 e ij N ii N φ ,,,φ φ φ This diffusion transform, D, can be j = –1 and1 2 3 4 are arbitrary real numbers. implemented asDWRW= , where R the Note that, unlike the Walsh-Hadamard transformation and other state transition matrices, the probability in rotation matrix & W the Walsh-Hadamard each state stays the same since the square of the absolute Transform Matrix are defined as follows: ≠ value of the amplitude in each state stays the same. Rij = 0 ifi j ; ≠ Rii = 1 ifi = 0 ;Rii = –1 ifi 0 . 2. The Abstracted Problem Let a system As discussed in section 1.2: n –n 2/ ()i⋅ j have N = 2 states which are labelled S1,S2,...SN. These W ij = 2 –1 , wherei is the n 2 states are represented as n bit strings. Let there be a binary representation ofi , and unique state, say S , that satisfies the condition C(S ) = ν ν i⋅ j denotes the bitwise dot product 1, whereas for all other states S, C(S) = 0 (assume that for any state S, the condition C(S) can be evaluated in of the two n bit stringsi andj . () unit time). The problem is to identify the state Sν. (iii) Sample the resulting state. In case CSν = 1 there is a unique state Sν such that the final state is Sν 1 with a probability of at least--- . 2
Note that step (ii) (a) is a phase rotation transformation of the type discussed in the last paragraph of section 1.2. In a practical implementation this would involve one portion of the quantum system sensing the state and then deciding whether or not to rotate the phase. It would do it in a way so that no trace of the state of the system be left after this operation (so as to ensure that paths lead- ing to the same final state were indistinguishable and could interfere). The implementation does not involve a classical measurement.
3 2 4. Outline of rest of paper are easily verified: first, thatP = P & second, that P The loop in step (ii) above, is the heart of the algorithm. acting on any vectorv gives a vector each of whose Each iteration of this loop increases the amplitude in the components is equal to the average of all components. 1 () desired state byO------ , as a result inON repeti- 2 N Using the fact thatP = P , it follows immediately 2 tions of the loop, the amplitude and hence the probabil- from the representationDI= –+ 2P that D = I ity in the desired state reachO()1 . In order to see that and hence D is unitary. 1 In order to see thatD is the inversion about aver- the amplitude increases byO------ in each repetition, N age, consider what happens whenD acts on an arbitrary we first show that the diffusion transform, D, can be vectorv . Expressing D as–I + 2P , it follows that: interpreted as an inversion about average operation. A Dv=()– I + 2P v = – v + 2Pv . By the discussion simple inversion is a phase rotation operation and by the discussion in the last paragraph of section 1.2, is unitary. above, each component of the vectorPv is A where A is In the following discussion we show that the inversion the average of all components of the vectorv . Therefore about average operation (defined more precisely below) the ith component of the vectorDv is given by is also a unitary operation and is equivalent to the diffu- ()–v + 2A which can be written as ()A+ () A– v sion transform D as used in step (ii)(a) of the algorithm.. i i Let α denote the average amplitude over all states, which is precisely the inversion about average. α th Next consider what happens when the inversion i.e. if i be the amplitude in the i state, then the aver- about average operation is applied to a vector where N 1 each of the components, except one, are equal to a age is---- α . As a result of the operation D, the ∑ i 1 N value, say C, which is approximately------; the one com- i = 1 N amplitude in each state increases (decreases) so that after this operation it is as much below (above) α as it ponent that is different is negative. The average A is () was above (below) α before the operation. approximately equal to C. Since each of the N – 1 components is approximately equal to the average, it does not change significantly as a result of the inversion about average. The one component that was negative to Average (α) start out, now becomes positive and its magnitude ABCD increases by approximately2C , which is approximately 2 (before) ------. N Average Average (α) ABCD (before) (after) Figure 1. Inversion about average operation.
The diffusion transform,D , is defined as follows: 2 2 (4.0)D = ---- , ifi≠ j &D = – 1 + ---- . Average ij N ii N Next it is proved thatD is indeed the inversion about average as shown in figure 1 above. Observe that D can (after) be represented in the formDI≡ –+ 2P whereI is the Figure 2. The inversion about average operation is identity matrix andP is a projection matrix with applied to a distribution in which all but one of the com- 1 P = ---- for alli, j . The following two properties of P ij N
4 1 theorems 2 & 3 that it converges to the desired state. ponents is initiallyO------ ; one of the components is N As mentioned before (4.0), the diffusion trans- form D is defined by the matrix D as follows: initially negative. 2 ≠ 2 (5.0)Dij = ---- , ifi j &Dii = – 1 + ---- . In the loop of step (ii) of section 3, first the amplitude in N N a selected state is inverted (this is a phase rotation and hence a valid quantum mechanical operation as dis- The way D is presented above, it is not a local transition cussed in the last paragraph of section 1.2). Then the matrix since there are transitions from each state to all N inversion about average operation is carried out. This states. Using the Walsh-Hadamard transformation increases the amplitude in the selected state in each iter- matrix as defined in section 3, it can be implemented as 1 a product of three unitary transformations as ation byO------ (this is formally proved in the next N DWRW= , each of W & R is a local transition matrix. R section as theorem 3). as defined in theorem 2 is a phase rotation matrix and is clearly local. W when implemented as in section 1.2 is a Theorem 3 - Let the state vector before step (ii)(a) of local transition matrix on each bit. the algorithm be as follows - for the one state that satis- fiesCS() = 1 , the amplitude is k, for each of the Theorem 1 - D can be expressed asDWRW= , remaining()N – 1 states the amplitude is l such that where W, the Walsh-Hadamard Transform Matrix and R, the rotation matrix, are defined as follows < < 1 > ()∆ ≠ 0 k ------ andl 0 . The change in k k after Rij = 0 ifi j , 2 ≠ steps (a) and (b) of the algorithm is lower bounded by Rii = 1 ifi = 0 ,Rii = –1 ifi 0 . 1 –n 2/ ()i⋅ j ∆k > ------. Also after steps (a) and (b),l > 0 . W ij = 2 –1 . 2 N Proof - We evaluate WRW and show that it is equal to –n 2/ ()i⋅ j Using theorem 3, it immediately follows that there D. As discussed in section 3,W ij = 2 –1 , exists a number M less than2N , such that in M repeti- wherei is the binary representation ofi , and i⋅ j 1 tions of the loop in step (ii), k will exceed------. Since the denotes the bitwise dot product of the two n bit strings i 2 probability of the system being found in any particular andj . R can be written asRR= 1 + R2 where state is proportional to the square of the amplitude, it R = –I ,I is the identity matrix andR , = 2 , follows that the probability of the system being in the 1 2 00 ≠ , ≠ 1 1 R2, ij = 0 ifi 0 j 0 . By observing that MMI= desired state when k is------, isk2 = --- . Therefore if the 2 2 where M is the matrix defined in section 1.2, it is easily system is now sampled, it will be in the desired state proved that WW=I and hence D1 =WR1WI = – . We 1 with a probability greater than--- . next evaluate D2 = WR2W. By standard matrix multipli- 2 Section 6 quotes the argument from [BBBV96] cation: D2, ad = ∑W abR2, bcW cd . Using the defini- that it is not possible to identify the desired record in bc n less thanΩ()N steps. tion of R2 and the factN = 2 , it follows that 2 a ⋅ 0+ 0 ⋅ d 2 D , =2W W =-----()–1 = ---- . Thus 5. Proofs 2 ad a0 0d 2n N The following section proves that the system discussed 2 all elements of the matrix D equal---- , the sum of the in section 3 is indeed a valid quantum mechanical sys- 2 N tem and that it converges to the desired state with a two matrices D1 and D2 gives D. probabilityΩ()1 . It was proved in the previous section that D is unitary, theorem 1 proves that it can be imple- mented as a sequence of three local quantum mechani- cal state transition matrices. Next it is proved in
5 Theorem 2 - Let the state vector be as follows - for Corollary 2.2 - Let the state vector be as follows - any one state the amplitude is k1, for each of the remain- for the state that satisfiesCS() = 1 , the amplitude is k, ing (N-1) states the amplitude is l1. Then after applying for each of the remaining()N – 1 states the amplitude the diffusion transform D, the amplitude in the one state is l. Then if after applying the diffusion transformation 2 ()N – 1 isk = ----– 1 k + 2------l and the amplitude in D, the new amplitudes are respectivelyk1 andl1 as 2 N 1 N 1 derived in theorem 2, then each of the remaining (N-1) states is 2 () 2 2 () 2 2 ()N – 2 k1 + N – 1 l1 = k + N – 1 l . l2 = ----k1 + ------l1 . N N Proof - Using theorem 2 it follows that Proof -Using the definition of the diffusion transform (5.0) (at the beginning of this section), it follows that 2 ()N – 2 2 ()N – 1 2 k = ------k2 + 4------l2 2 ()N – 1 1 2 2 k = ----– 1 k + 2------l N N 2 N 1 N 1 4()N – 2 ()N – 1 2 2 2()N – 2 –------kl l = ----– 1 l +----k + ------l N 2 2 N 1 N 1 N 1 Similarly Therefore: 4()N – 1 2 2 ()N – 2 ()N – 1 l2 = ------k2 l = ----k + ------l 1 2 2 N 1 N 1 N ()N – 2 2 4()N – 2 ()N – 1 + ------()N – 1 l2 + ------kl . As is well known, in a unitary transformation the total N 2 N 2 probability is conserved - this is proved for the particu- Adding the previous two equations the corollary fol- lar case of the diffusion transformation by using theo- lows. rem 2. Theorem 3 - Let the state vector before step (a) of the Corollary 2.1 - Let the state vector be as follows - algorithm be as follows - for the one state that satisfies for any one state the amplitude is k, for each of the CS() = 1 , the amplitude is k, for each of the remain- remaining()N – 1 states the amplitude is l. Let k and l ing()N – 1 states the amplitude is l such that be real numbers (in general the amplitudes can be com- 1 k 0
6 1 Fourier transform”. assuming non-trivialN , it follows that∆k > ------. 2 N (iii) The conditional phase shift would be much eas- ier to implement if the algorithm was used in the mode > In order to provel2 0 , observe that after the phase where the function at each point was computed rather < > than retrieved form memory. This would eliminate the inversion (step (a)),k1 0 &l1 0 . Furthermore it fol- storage requirements in quantum memory. < < 1 > 1 lows from the facts0 k ------ &l ------(dis- (iv) In case the elements had to be retrieved from a 2 2N table (instead of being computed as discussed in (iii)), in principle it should be possible to store the data in classi- k1 < cussed in the previous paragraph) that----- N . cal memory and only the sampling system need be l 1 quantum mechanical. This is because only the system Therefore by corollary 2.1, l2 is positive. under consideration needs to undergo quantum mechan- ical interference, not the bits in the memory. What is 6. How fast is it possible to find the needed, is a mechanism for the system to be able to feel the values at the various datapoints something like what desired element? There is a matching lower happens in interaction-free measurements as discussed bound from the paper [BBBV96] that suggests that it is in more detail in the first paragraph of the following sec- not possible to identify the desired element in fewer than tion. Note that, in any variation, the algorithm must be Ω()N steps. This result states that any quantum arranged so as not to leave any trace of the path fol- lowed in the classical system or else the system would mechanical algorithm running for T steps is only sensi- not undergo quantum mechanical interference. tive toOT()2 queries (i.e. if there are more possible queries, then the answer to at least one can be flipped 8. Other observations without affecting the behavior of the algorithm). So in 1. It is possible for quantum mechanical systems to order to correctly decide the answer which is sensitive to make interaction-free measurements by using the dual- N queries will take a running time ofT = Ω()N . To ity properties of photons [EV93] [KWZ96]. In these the presence (or absence) of an object can be deduced by () see this assume thatCS = 0 for all states and the allowing for a very small probability of a photon inter- algorithm returns the right result, i.e. that no state satis- acting with the object. Therefore most probably the pho- fies the desired condition. Then, by [BBBV96] if ton will not interact, however, just allowing a small T < Ω()N , the answer to at least one of the queries probability of interaction is enough to make the mea- surement. This suggests that in the search problem also, () aboutCS for some S can be flipped without affecting it might be possible to find the object without examining the result, thus giving an incorrect result for the case in all the objects but just by allowing a certain probability which the answer to the query was flipped. of examining the desired object which is something like [BBHT96] gives a direct proof of this result along what happens in the algorithm in this paper. with tight bounds showing the algorithm of this paper is within a few percent of the fastest possible quantum 2. As mentioned in the introduction, the search algo- mechanical algorithm. rithm of this paper does not use any knowledge about the problem. There exist fast quantum mechanical algo- rithms that make use of the structure of the problem at 7. Implementation considerations This hand, e.g. Shor’s factorization algorithm [Shor94]. It algorithm is likely to be simpler to implement as com- might be possible to combine the search scheme of this pared to other quantum mechanical algorithms for the paper with [Shor94] and other quantum mechanical following reasons: algorithms to design faster algorithms. Alternatively, it (i) The only operations required are, first, the might be possible to combine it with efficient database Walsh-Hadamard transform, and second, the conditional search algorithms that make use of specific properties of phase shift operation both of which are relatively easy as the database. [DH96] is an example of such a recent compared to operations required for other quantum application. [Median96] applies phase shifting tech- mechanical algorithms [BCDP96]. niques, similar to this paper, to develop a fast algorithm (ii) Quantum mechanical algorithms based on the for the median estimation problem. Walsh-Hadamard transform are likely to be much sim- pler to implement than those based on the “large scale
7 3. The algorithm as discussed here assumes a unique [BV93] E. Bernstein and U. Vazirani, Quantum state that satisfies the desired condition. It can be easily Complexity Theory, Proceedings 25th modified to take care of the case when there are multiple ACM Symposium on Theory of Com- states satisfying the conditionCS() = 1 and it is puting, 1993, pp. 11-20. required to find one of these. Two ways of achieving this [Deutsch85] D. Deutsch, Quantum Theory, the are: Church-Turing principle and the univer- (i) The first possibility would be to repeat the experi- sal quantum computer, Proc. Royal ment so that it checks for a range of degeneracy, i.e. Society London Ser. A, 400, 1985, redesign the experiment so that it checks for the degen- pp. 96-117. eracy of the solution being in the range [DH96] C. Durr & P. Hoyer, A quantum algo- ()k, k + 1, …2k for various k. Then within log N repe- rithm for finding the minimum, lanl preprint, quant-ph/9602016. titions of this procedure, one can ascertain whether or [DJ92] D. Deutsch and R. Jozsa, Rapid solution not there exists at least one out of the N states that satis- of problems by quantum computation, fies the condition. [BBHT96] discusses this in detail. Proceedings Royal Society of London, (ii) The other possibility is to slightly perturb the prob- A400, 1992, pp. 73-90. lem in a random fashion as discussed in [MVV87] so [EV93] A. Elitzur & L. Vaidman, Quantum that with a high probability the degeneracy is removed. mechanical interaction free measure- There is also a scheme discussed in [VV86] by which it ments, Foundations of Physics 23, 1993, is possible to modify any algorithm that solves an NP- pp. 987-997. search problem with a unique solution and use it to [KWZ96] P. Kwiat, H. Weinfurter & A. Zeilinger, solve an NP-search problem in general. Quantum seeing in the dark, Scientific American, Nov. 1996, pp. 72-78. 9. Acknowledgments Peter Shor introduced [Median96] L.K. Grover, A fast quantum mechanical me to the field of quantum computing, Ethan Bernstein algorithm for estimating the median, provided the lower bound argument stated in section 6, lanl e-print quant-ph/9607024. Gilles Brassard made several constructive comments [MVV87] K. Mulmuley, U. Vazirani & V. Vazirani, that helped to update the STOC paper. Matching is as easy as matrix inversion, Combinatorica, 7, 1987, pp. 105-131. 10. References [Shor94] P. W. Shor, Algorithms for quantum [BB94] A. Berthiaume and G. Brassard, Oracle computation: discrete logarithms and quantum computing, Journal of Modern factoring, Proceedings, 35th Annual Optics, Vol.41, no. 12, December 1994, Symposium on Fundamentals of Comp. pp. 2521-2535. Science (FOCS), 1994, pp. 124-134. [BBBV96] C.H. Bennett, E. Bernstein, G. Brassard [Simon94] D. Simon, On the power of quantum & U.Vazirani, Strengths and weaknesses computation, Proceedings, 35th Annual of quantum computing, to be published Symposium on Fundamentals of Comp. in the SIAM Journal on Computing. Science (FOCS), 1994, pp.116-123. [BBHT96] M. Boyer, G. Brassard, P. Hoyer & A. [VV86] L. G. Valiant & V. Vazirani, NP is as Tapp, Tight bounds on quantum search- easy as detecting unique solutions, ing, Proceedings, PhysComp 1996 Theor. Comp. Sc. 47, 1986, pp. 85-93. (lanl e-print quant-ph/9605034). [Yao93] A. Yao, Quantum circuit complexity, [BCDP96] D. Beckman, A.N. Chari, S. Devabhak- Proceedings 34th Annual Symposium tuni & John Preskill, Efficient networks on Foundations of Computer Science for quantum factoring, Phys. Rev. A (FOCS), 1993, pp. 352-361. 54(1996), 1034-1063 (lanl preprint, quant-ph/9602016). [Benioff80] P. Benioff, The computer as a physical system: A microscopic quantum mechanical Hamiltonian model of com- puters as represented by Turing machines, Journal of Statistical Physics, 22, 1980, pp. 563-591.
8