BQP and the Polynomial Hierarchy∗

Scott Aaronson† MIT

ABSTRACT 1. INTRODUCTION The relationship between BQP and PH has been an open A central task of quantum computing theory is to un- problem since the earliest days of quantum computing. We derstand how BQP—Bounded-Error Quantum Polynomial- present evidence that quantum computers can solve prob- Time, the class of all problems feasible for a quantum computer— lems outside the entire polynomial hierarchy, by relating this fits in with classical complexity classes. In their original question to topics in circuit complexity, pseudorandomness, 1993 paper defining BQP, Bernstein and Vazirani [9] showed #P 1 and Fourier analysis. that BPP BQP P . Informally, this says that quan- ⊆ ⊆ First, we show that there exists an oracle relation problem tum computers are at least as fast as classical probabilistic (i.e., a problem with many valid outputs) that is solvable in computers and no more than exponentially faster (indeed, BQP, but not in PH. This also yields a non-oracle relation they can be simulated using an oracle for counting). Bern- problem that is solvable in quantum logarithmic time, but stein and Vazirani also gave evidence that BPP = BQP, 6 not in AC0. by exhibiting an oracle problem called Recursive Fourier Ω(log n) Second, we show that an oracle decision problem separat- Sampling that requires n queries on a classical com- ing BQP from PH would follow from the Generalized Linial- puter but only n queries on a quantum computer. The Nisan Conjecture, which we formulate here and which is evidence for the power of quantum computers became dra- likely of independent interest. The original Linial-Nisan matically stronger a year later, when Shor [23] (building on Conjecture (about pseudorandomness against constant-depth work of Simon [24]) showed that Factoring and Discrete circuits) was recently proved by Braverman, after being open Logarithm are in BQP. On the other hand, Bennett et al. for twenty years. [8] gave oracle evidence that NP BQP, and while no one regards such evidence as decisive,6⊂ today it seems extremely Categories and Subject Descriptors unlikely that quantum computers can solve NP-complete problems in polynomial time. A vast body of research, con- F.1.3 [Theory of Computation]: Computation by Ab- tinuing to the present, has sought to map out the detailed stract Devices—Complexity Measures and Classes boundary between those NP problems that are feasible for quantum computers and those that are not. General Terms However, there is a complementary question that—despite being universally recognized as one of the “grand challenges” Theory of the field—has had essentially zero progress over the last sixteen years: Keywords BQP NP BQP constant-depth circuits, Fourier analysis, Linial-Nisan Con- Is in ? More generally, is con- tained anywhere in the polynomial hierarchy PH = jecture, quantum complexity classes NP NP NPNP NPNP ? ∗We regret that, because of space limitations, we are un- ∪ ∪ ∪··· able to prove anything in this extended abstract. Readers The “default” conjecture is presumably BQP PH, since interested in the proofs should stop reading now and go to no one knows what a simulation of BQP in PH6⊂would look www.scottaaronson.com/papers/bqpph.pdf. like. Before this work, however, there was no formal evi- †Based upon work supported by the National Science Foun- dation under Grant No. 0844626. Also supported by a dence for or against that conjecture. Almost all the prob- DARPA YFA grant and the Keck Foundation. lems for which we have quantum algorithms—including Fac- toring and Discrete Logarithm—are easily seen to be in NP coNP.2 One notable exception is Recursive Fourier Sampling∩ , the problem that Bernstein and Vazirani [9] orig- inally used to construct an oracle A relative to which BPPA = 6 Permission to make digital or hard copies of all or part of this work for 1 BQP PP personal or classroom use is granted without fee provided that copies are The upper bound was later improved to by Adleman, DeMarrais, and Huang [2]. ⊆ not made or distributed for profit or commercial advantage and that copies 2 bear this notice and the full citation on the first page. To copy otherwise, to Here we exclude BQP-complete problems such as approxi- republish, to post on servers or to redistribute to lists, requires prior specific mating the Jones polynomial [3], which, by the very fact of permission and/or a fee. being BQP-complete, seem hard to interpret as “evidence” for BQP PH. Copyright 200X ACM X-XXXXX-XX-X/XX/XX ...$5.00. 6⊂ BQPA. One can show, without too much difficulty, that polynomial hierarchy collapses? At first glance, this seems Recursive Fourier Sampling yields oracles A relative to like a wild hope; certainly we have no idea at present how which BQPA NPA and indeed BQPA MAA. How- to prove anything of the kind. However, notice that if ever, while it6⊂ is reasonable to conjecture6⊂ that Recursive BQP AM, then the desired implication would follow imme- Fourier Sampling (as an oracle problem) is not in PH, it diately!⊆ For in that case, coNP BQP, hence coNP AM, P ⊆ ⊆ is open even to show that this problem (or any other BQP hence PH = Σ2 , where the last implication was shown by oracle problem) is not in AM! Recall that AM = NP un- Boppana, H˚astad, and Zachos [10]. der plausible derandomization assumptions. Thus, until we solve the problem of constructing an oracle A such that 1.2 Our Results BQPA AMA, we cannot even claim to have oracle evi- This paper presents the first formal evidence for the possi- 6⊂ dence (which is itself, of course, a weak form of evidence) bility that BQP PH. Perhaps more importantly, it places that BQP NP. the relativized BQP6⊂ versus PH question at the frontier of 6⊂ Before going further, we should clarify that there are two (classical) circuit lower bounds. The heart of the problem, questions here: whether BQP PH and whether PromiseBQP we will find, is to extend Braverman’s spectacular recent ⊆ ⊆ PromisePH. In the unrelativized world, it is entirely pos- proof [11] of the Linial-Nisan Conjecture, in ways that would sible that quantum computers can solve promise problems reveal a great deal of information about small-depth circuits outside the polynomial hierarchy, but that all languages in independent of the implications for quantum computing. BQP are nevertheless in PH. However, for the specific pur- We have two main contributions. First, we achieve an pose of constructing an oracle A such that BQPA PHA, oracle separation between BQP and PH for the case of re- 6⊂ the two questions are equivalent, basically because one can lation problems. A relation problem is simply a problem “offload” a promise into the construction of the oracle A. where the desired output is an n-bit string (rather than a single bit), and any string from some nonempty set S is 1.1 Motivation acceptable. Relation problems arise often in theoretical There are at least four reasons why the BQP versus PH computer science; one well-known example is finding a Nash question is so interesting. At a basic level, it is both theoret- equilibrium (shown to be PPAD-complete by Daskalakis et ically and practically important to understand what classical al. [13]). Within quantum computing, there is consider- resources are needed to simulate quantum physics. For ex- able precedent for studying relation problems as a warmup ample, when a quantum system evolves to a given state, is to the harder case of decision problems. For example, in there always a short classical proof that it does so? Can 2004 Bar-Yossef, Jayram, and Kerenidis [4] gave a relation one estimate quantum amplitudes using approximate count- problem with quantum one-way communication complexity ing (which would imply BQP BPPNP)? If something like O (log n) and randomized one-way communication complex- this were true, then while the⊆ exponential speedup of Shor’s ity Ω (√n). It took several more years for Gavinsky et al. factoring algorithm might stand, quantum computing would [15] to achieve the same separation for decision problems, nevertheless seem much less different from classical comput- and the proof was much more complicated.3 ing than previously thought. Formally, our result is as follows: Second, if BQP PH, then many possibilities for new quantum algorithms6⊂ might open up to us. One often hears Theorem 1. There exists an oracle A relative to which A PHA the complaint that there are too few quantum algorithms, FBQP FBPP , where FBQP and FBPP are the rela- 6⊂ 4 or that progress on quantum algorithms has slowed since the tion versions of BQP and BPP respectively. mid-1990s. In our opinion, the real issue here has nothing to do with quantum computing, and is simply that there are Interestingly, the oracle A in Theorem 1 can be taken to too few natural NP-intermediate problems for which there be a random oracle. By contrast, Aaronson and Ambainis plausibly could be quantum algorithms! In other words, in- [1] have shown that, under a plausible conjecture about in- stead of focussing on Graph Isomorphism and a small num- fluences in low-degree polynomials, one cannot separate the NP decision classes BQP and BPP by a random oracle without ber of other -intermediate problems, it might be fruitful #P to look for quantum algorithms solving completely different also separating P from P in the unrelativized world. In types of problems—problems that are not necessarily even other words, the use of relation problems (rather than deci- in PH. In this paper, we will see a new example of such a sion problems) seems essential if one wants a random oracle separation. quantum algorithm, which solves a problem called Fourier 0 Checking. Underlying Theorem 1 is a new lower bound against AC P ? BQP circuits (constant-depth circuits composed of AND, OR, and Third, it is natural to ask whether the = question 0 is related to that other fundamental question of complexity NOT gates). The close connection between AC and the ? polynomial hierarchy that we exploit is not new. In the theory, P = NP. More concretely, is it possible that quan- early 1980s, Furst-Saxe-Sipser [14] and Yao [28] noticed that, tum computers could provide exponential speedups even if if we have a PH machine M that computes (say) the Parity P = NP? If BQP PH, then certainly the answer to that question is no (since⊆ P = NP = P = PH). Therefore, 3Recently, Shepherd and Bremner [22] proposed a beauti- if we want evidence that quantum⇒ computing could survive ful sampling problem that is solvable efficiently on a quan- a collapse of P and NP, we must also seek evidence that tum computer but that they conjecture is hard classically. BQP PH. This provides yet another example where it seems easier to 6⊂ find evidence for the power of quantum computers once one Fourth, a major challenge for quantum computing re- moves away from decision problems. search is to get better evidence that quantum computers can- 4Confusingly, the F stands for “function”; we are simply fol- not solve NP-complete problems in polynomial time. As lowing the standard naming convention for classes of relation an example, could we show that if NP BQP, then the problems (FP, FNP, etc). ⊆ of a 2n-bit oracle string, then by simply reinterpreting the formally, in this problem we are given oracle access to two existential quantifiers of M as OR gates and the universal Boolean functions f,g : 0, 1 n 1, 1 , and are promised quantifiers as AND gates, we obtain an AC0 circuit of size that either { } → {− } 2poly(n) solving the same problem. It follows that, if we can prove a 2ω(polylog n) lower bound on the size of AC0 circuits (i) f and g are both uniformly random, or computing Parity, we can construct an oracle A relative to which PA PHA. The idea is the same for constructing (ii) f is uniformly random, while g is extremely well cor- Zn an A relative⊕ 6⊂ to which A PHA, where is any complexity related with f’s Fourier transform over 2 (which we class. C 6⊂ C call “forrelated”). Indeed, the relation between PH and AC0 is so direct that The problem is to decide whether (i) or (ii) is the case. we get the following as a more-or-less immediate counterpart It is not hard to show that Fourier Checking is in BQP: to Theorem 1: basically, one can prepare a uniform superposition over all x 0, 1 n, then query f, apply a quantum Fourier trans- Theorem 2. In the unrelativized world (with no oracle), ∈ { } there exists a relation problem solvable in BQLOGTIME but form, query g, and check whether one has recovered some- not in nonuniform AC0. thing close to the uniform superposition. On the other hand, being forrelated seems like an extremely“global” prop- Here BQLOGTIME is the class of problems solvable by erty of f and g: one that would not be apparent from query- uniform logarithmic-size quantum circuits, with random ac- ing any small number of f (x) and g (y) values. And thus, cess to the input string x1 ...xn. It should not be confused one might conjecture that Fourier Checking (as an oracle with the much larger class BQNC, of problems solvable by problem) is not in PH. logarithmic-depth quantum circuits. In this paper, we adduce strong evidence for that conjec- The relation problem that we use to separate BQP from ture. Specifically, we show that for every k 2n/4, the for- 0 ≤ PH, and BQLOGTIME from AC , is called Fourier Fish- related distribution over f,g pairs is O k2/2n/2 -almost ing. The problem can be informally stated as follows. We h i   k-wise independent. By this we mean that, if one had 1/2 are given oracle access to n Boolean functions f1,...,fn : 0, 1 n 1, 1 , which we think of as chosen uniformly prior probability that f and g were uniformly random, and { } → {− } 1/2 prior probability that f and g were forrelated, then even at random. The task is to output n strings, z1,...,zn 0, 1 n, such that the corresponding squared Fourier coeffi-∈ conditioned on any k values of f and g, the posterior prob- { } 2 2 ability that f and g were forrelated would still be cients f1 (z1) ,..., fn (zn) are “often much larger than av- 2 erage.” Notice that if fi is a random Boolean function, 1 k b b O . then each of its Fourier coefficients fi (z) follows a nor- 2 ± 2n/2  mal distribution—meaning that with overwhelming proba- bility, a constant fraction of the Fourierb coefficients will be We conjecture that this almost k-wise independence prop- erty is enough, by itself, to imply that an oracle problem a constant factor larger than the mean. Furthermore, it is not in PH. We call this the Generalized Linial-Nisan is straightforward to create a quantum algorithm that sam- 2 Conjecture. ples each z with probability proportional to fi (z) , so that 2 n/2 larger Fourier coefficients are more likely to be sampled than Without the O k /2 error term, our conjecture b ±   smaller ones. would be equivalent5 to a famous conjecture in circuit com- On the other hand, computing any specific fi (z) is easily plexity made by Linial and Nisan [18] in 1990. Their con- seen to be equivalent to summing 2n bits. By well-known jecture stated that polylogarithmic independence fools AC0: 0 b lower bounds on the size of AC circuits computing the Ma- in other words, every probability distribution over N-bit jority function (see H˚astad [26] for example), it follows strings that is uniform on every small subset of bits, is in- 0 that, for any fixed z, computing fi (z) cannot be in PH as distinguishable from the truly uniform distribution by AC an oracle problem. Unfortunately, this does not directly im- circuits. When we began investigating this topic a year ply any separation between BQP andb PH, since the quantum ago, even the original Linial-Nisan Conjecture was still open. algorithm does not compute fi (z) either: it just samples a Since then, Braverman [11] (building on earlier work by z with probability proportional to f (z)2. However, we will Bazzi [5] and Razborov [20]) has given a beautiful proof b i show that, if there exists a BPPPH machine M that even of that conjecture. In other words, to construct an ora- b cle relative to which BQP PH, it now suffices to general- approximately simulates the behavior of the quantum algo- 6⊂ rithm, then one can solve Majority by means of a nonde- ize Braverman’s Theorem from k-wise independent distribu- terministic reduction—which uses approximate counting to tions to almost k-wise independent ones. We believe that estimate Pr [M outputs z], and adds a constant number of this is by far the most promising approach to the BQP versus layers to the AC0 circuit. The central difficulty is that, if M PH problem. knew the specific z for which we were interested in estimat- Alas, generalizing Braverman’s proof is much harder than one might have hoped. To prove the original Linial-Nisan ing f (z), then it could choose adversarially never to output i Conjecture, Braverman showed that every AC0 function f : that z. To solve this, we will show that we can “smug- n gle”b a Majority instance into the estimation of a random 0, 1 0, 1 can be well-approximated, in the L1-norm, {by low-degree} → { } sandwiching polynomials: real polynomials Fourier coefficient fi (z), in such a way that it is information- n pℓ,pu : R R, of degree O (polylog n), such that pℓ (x) theoretically impossible for M to determine which z we care n f (x) p →(x) for all x 0, 1 . Since p and p triv-≤ about. b u ℓ u ially have≤ the same expectation∈ { } on any k-wise independent Our second contribution is to define and study a new black-box decision problem, called Fourier Checking. In- 5Up to unimportant variations in the parameters distribution that they have on the uniform distribution, one number of accesses to a very long input string. When some- can show that f must have almost the same expectation as one gives an oracle A relative to which A A, what they well. To generalize Braverman’s result from k-wise inde- really mean is simply that they have foundC 6⊂ a D problem that pendence to almost k-wise independence, we will show that machines can solve using superpolynomially fewer queries it suffices to construct low-degree sandwiching polynomials thanC machines. In other words, has “cleared the first that satisfy a certain additional condition. This new condi- possibleD obstacle”—the query complexityC obstacle—to hav- tion (which we call “low-fat”) basically says that pℓ and pu ing capabilities beyond those of . Of course, it could be must be representable as linear combinations of terms (that (and sometimes is) that Dfor other reasons, but if C ⊆ D is, products of xi’s and (1 xi)’s), in such a way that the we do not even have a query complexity lower bound, then sum of the absolute values− of the coefficients is bounded— proving one is in some sense the obvious place to start. thereby preventing “massive cancellations” between positive Oracle separations have played a role in many of the cen- and negative terms. Unfortunately, while we know two tral developments of both classical and quantum complexity techniques for approximating AC0 functions by low-degree theory. As mentioned earlier, proving query complexity polynomials—that of Linial-Mansour-Nisan [17] and that of lower bounds for PH machines is essentially equivalent to Razborov [19] and Smolensky [25]—neither technique pro- proving size lower bounds for AC0 circuits—and indeed, the vides anything like the control over coefficients that we need. pioneering AC0 lower bounds of the early 1980s were ex- To construct low-fat sandwiching polynomials, it seems nec- plicitly motivated by the goal of proving oracle separations essary to reprove the LMN and Razborov-Smolensky theo- for PH.7 Within quantum computing, oracle results have rems in a more “conservative,” less “profligate” way. And played an even more decisive role: the first evidence for the such an advance seems likely to lead to breakthroughs in cir- power of quantum computers came from the oracle sepa- cuit complexity and computational learning theory having rations of Bernstein-Vazirani [9] and Simon [24], and Shor’s nothing to do with quantum computing. algorithm [23] contains an oracle algorithm (for the Period- Let us mention three further applications of Fourier Check- Finding problem) at its core. ing: Having said all that, if for some reason one still feels averse First, if the Generalized Linial-Nisan Conjecture holds, to the language of oracles, then (as mentioned before) one then just like with Fourier Fishing, we can “scale down is free to scale everything down by an exponential, and to by an exponential,” to obtain a promise problem that is in reinterpret a relativized separation between BQP and PH as BQLOGTIME but not in AC0. an unrelativized separation between BQLOGTIME and AC0. Second, without any assumptions, we can prove the new results that there exist oracles relative to which BQP 6⊂ 2. PRELIMINARIES BPPpath and BQP SZK. We can also reprove all previ- ous oracle separations6⊂ between BQP and classical complexity It will be convenient to consider Boolean functions of the n classes in a unified fashion. form f : 0, 1 1, 1 . Throughout this paper, we n{ } → {− } Third, independent of its applications to complexity classes, let N = 2 ; we will often view the truth table of a Boolean Fourier Checking yields the largest gap between classical function as an “input” of size N. Given a Boolean function n and quantum query complexity yet known. Its bounded- f : 0, 1 1, 1 , the Fourier transform of f is defined { } → {− } error randomized query complexity is Ω(N 1/4) (and we con- as jecture Θ(√N)), while its quantum query complexity is only 1 x z f (z) := ( 1) · f (x) . O (1). Prior to this work, the best known gaps were of √ − N x X0,1 n the form N Ω(1) versus O (log N) (for Simon’s and Shor’s b ∈{ } algorithms), or Θ (log N) versus O (1) (for the Bernstein- Recall Parseval’s identity: Vazirani problem).6 Buhrman et al. [12] explicitly raised 2 2 the open problem of finding a larger gap. We also get f (x) = f (z) = N. a property (namely, the property of being forrelated) that x X0,1 n z X0,1 n ∈{ } ∈{ } b takes N Ω(1) queries to test classically but only O (1) queries to test quantumly. 2.1 Problems We first define the Fourier Fishing problem, in both 1.3 In Defense of Oracles “distributional” and “promise” versions. In the distribu- This paper is concerned with finding oracles relative to tional version, we are given oracle access to n Boolean func- n which BQP outperforms classical complexity classes. As tions f1,...,fn : 0, 1 1, 1 , which are chosen uni- such, it is open to the usual objections: “But don’t oracle formly and independently{ } → at{− random.} The task is to output n results mislead us about the ‘real’ world? What about non- n strings, z1,...,zn 0, 1 , at least 75% of which satisfy relativizing results like IP = PSPACE [21]?” ∈ { } fi (zi) 1 and at least 25% of which satisfy fi (zi) 2. In our view, it is most helpful to think of oracle separa- ≥ ≥ (Note that these thresholds are not arbitrary, but were care- tions, not as strange metamathematical claims, but as lower b b bounds in a concrete computational model that is natural and fully chosen to produce a separation between the quantum well-motivated in its own right. The model in question is and classical models!) query complexity, where the resource to be minimized is the We now want a version of Fourier Fishing that removes the need to assume the fi’s are uniformly random, replacing 6De Beaudrap, Cleve, and Watrous [7] gave an N Ω(1) versus O (1) separation, but for a non-standard model of quantum 7Yao’s paper [28] was entitled “Separating the polynomial- query complexity where one gets to map x to σ (x) for time hierarchy by oracles”; the Furst-Saxe-Sipser paper [14] a permutation σ (rather than x y to x | yi σ|(x) asi in was entitled “Parity, circuits, and the polynomial time hier- the standard model). | i | i | i | ⊕ i archy.” it with a worst-case promise on the fi’s. Call an n-tuple string y. There could be many valid y’s for a given instance, f1,...,fn of Boolean functions good if and the algorithm’s task is to output any one of them. h i FP FNP P n The definitions of and (the relation versions of 2 and NP) are standard. We now define FBPP and FBQP, fi (zi) 0.8Nn, ≥ the relation versions of BPP and BQP. i=1 X zi: fXi(zi) 1 | |≥ b n b Definition 3. FBPP is the class of relations R 0, 1 ∗ 2 ⊆ { } × fi (zi) 0.26Nn. 0, 1 ∗ for which there exists a probabilistic polynomial-time ≥ { } n i=1 X zi: fXi(zi) 2 algorithm A that, given any input x 0, 1 , produces an | |≥ b output y such that Pr[(x,y) R] = 1 ∈o {(1),} where the prob- b ∈ − (We will show in Lemma 6 that the vast majority of f1,...,fn ability is over A’s internal randomness. (In particular, this are good.) In Promise Fourier Fishing, we areh given i implies that for every x, there exists at least one y such that n oracle access to Boolean functions f1,...,fn : 0, 1 (x,y) R.) FBQP is defined the same way, except that A 1, 1 , which are promised to be good. The task,{ again,} → is a quantum∈ algorithm rather than a classical one. {− } n is to output strings z1,...,zn 0, 1 , at least 75% of ∈ { } An important point about FBPP and FBQP is that, as far which satisfy fi (zi) 1 and at least 25% of which satisfy ≥ as we know, these classes do not admit amplification. In other words, the value of an algorithm’s success probability fi (zi) 2. b ≥ might actually matter, not just the fact that the probability Next we define a decision problem called Fourier Check- b is bounded above 1/2. This is why we adopt the conven- ing . Here we are given oracle access to two Boolean func- n tion that an algorithm “succeeds” if it outputs (x,y) R tions f,g : 0, 1 1, 1 . We are promised that either with probability 1 o (1). In practice, we will give oracle∈ (i) f,g was{ drawn} → {− from the} uniform distribution , which problems for which− the FBQP algorithm succeeds with prob- sets everyh if (x) and g (y) by a fair, independent coinU toss. ability 1 1/ exp(n), while any FBPPPH algorithm succeeds (ii) f,g was drawn from the “forrelated” distribution , with probability− at most (say) 0.99. How far the constant whichh is definedi as follows. First choose a random realF N in this separation can be improved is an open problem. vector v = (v ) n R , by drawing each entry in- x x 0,1 Another important point is that, while BPPPH = PPH dependently from∈{ a Gaussian} ∈ distribution with mean 0 and (which follows from BPP ΣP), the class FBPPPH is strictly variance 1. Then set f (x) := sgn (v ) and g (x) := sgn (v ) 2 x x larger than FPPH. To see⊆ this, consider the relation prob- for all x. Here sgn (α) := α/ α , and v is the Fourier trans- Zn | | lem where we are given n, and asked to output any string form of v over 2 : b b of Kolmogorov complexity at least n. Clearly this problem 1 x y is in FBPP: just output a random 2n-bit string. On the vy := ( 1) · vx. PH √ − other hand, just as obviously the problem is not in FP . N x X0,1 n ∈{ } This is why we need to construct an oracle A such that b A In other words, f and g individually are still uniformly ran- FBQPA FBPPPH : because constructing an oracle A such 6⊂ A dom, but they are no longer independent: now g is extremely that FBQPA FPPH is trivial and not even related to well correlated with the Fourier transform of f (hence “for- quantum computing.6⊂ related”). We now discuss some “low-level” complexity classes. AC0 The problem is to accept if f,g was drawn from , and is the class of problems solvable by a nonuniform family to reject if f,g was drawn fromh i . Note that, sinceF h i U F of AND/OR/NOT circuits, with depth O (1), size poly (n), and overlap slightly, we can only hope to succeed with AC0 U and unbounded fanin. When we say “ circuit,” we mean overwhelming probability over the choice of f,g , not for a constant-depth circuit of AND/OR/NOT gates, not nec- every f,g pair. h i h i essarily of polynomial size. Any such circuit can be made We can also define a promise-problem version of Fourier into a formula (i.e., a circuit of fanout 1) with only a poly- Checking. In Promise Fourier Checking, we are promised nomial increase in size. The circuit has depth d if it consists that the quantity of d alternating layers of AND and OR gates (without loss 2 of generality, the NOT gates can all be pushed to the bot- 1 x y tom, and we do not count them towards the depth). For p (f,g) :=  f (x)( 1) · g (y) N 3 − example, a DNF (Disjunctive Normal Form) formula is just x,y X0,1 n 0  ∈{ }  an AC circuit of depth 2. is either at least 0.05 or at most 0.01. The problem is to We will also be interested in quantum logarithmic time, accept in the former case and reject in the latter case. which can be defined naturally as follows: Definition 4. BQLOGTIME is the class of languages L 2.2 Complexity Classes ⊆ 0, 1 ∗ that are decidable, with bounded error, by a LOGTIME- See the Complexity Zoo8 for the definitions of standard { } uniform family of quantum circuits Cn n such that each Cn complexity classes, such as BQP, AM, and PH. When we has O (log n) gates, and can include{ gates} that make random- PH write (i.e., a complexity class with an oracle for the access queries to the input string x = x1 ...xn (i.e., that C C ΣP polynomial hierarchy), we mean k 1 k . map i z to i z xi for every i [n]). We will consider not only decision∪ ≥ problems,C but also rela- | i | i | i | ⊕ i ∈ tion problems (also called function problems). In a relation One other complexity class that arises in this paper, which problem, the output is not a single bit but a poly (n)-bit is less well known than it should be, is BPPpath. Loosely speaking, BPPpath can be defined as the class of problems 8www.complexityzoo.com that are solvable in probabilistic polynomial time, given the Hadamard gates to all n qubits, query g in superposition, and apply Hadamard gates to all n qubits again, to create the state

1 x y y z f (x)( 1) · g (y)( 1) · z . N 3/2 − − | i x,y,zX0,1 n ∈{ } Finally, measure in the computational basis, and “accept” n if and only if the outcome 0 ⊗ is observed. If needed, repeat the whole algorithm O| (1)i times to boost the success probability. n It is clear that the probability of observing 0 ⊗ (in a Figure 1: The Fourier coefficients of a random single run of FC-ALG) equals | i

Boolean function follow a Gaussian distribution, 2 with mean 0 and variance 1. However, larger 1 x y p (f,g) :=  f (x)( 1) · g (y) . Fourier coefficients are more likely to be observed N 3 − x,y X0,1 n by the quantum algorithm.  ∈{ }  Recall that Promise Fourier Checking was the prob- lem of deciding whether p (f,g) 0.05 or p (f,g) 0.01, ≥ ≤ ability to “postselect” (that is, discard all runs of the com- promised that one of these is the case. Thus, we immedi- putation that do not produce a desired result, even if such ately get a quantum algorithm to solve Promise Fourier runs are the overwhelming majority). Checking, with constant error probability, using O (1) queries to f and g. For distributional Fourier Checking, we also need the 3. QUANTUM ALGORITHMS following theorem, which is proved in the full version. In this section, we show that Fourier Fishing and Fourier Checking both admit simple quantum algorithms. Theorem 7. If f,g is drawn from the uniform distri- bution , then E [ph (f,gi )] = 1 . If f,g is drawn from the U N 3.1 Algorithm for Fourier Fishing forrelatedU distribution , then E [ph(f,gi)] > 0.07. F F Here is a quantum algorithm, FF-ALG, that solves Fourier Fishing with overwhelming probability in O n2 time and 4. FOURIER FISHING LOWER BOUND n quantum queries (one to each fi). For i := 1
to n, first In Section 3.1, we gave a quantum algorithm for Fourier prepare the state Fishing that made only one query to each fi. By con- 1 trast, it is not hard to show that any classical algorithm fi (x) x , √ | i for Fourier Fishing requires exponentially many queries N x X0,1 n ∈{ } to the fi’s—or in complexity terms, that Fourier Fishing then apply Hadamard gates to all n qubits, then measure in is not in FBPP. In this section, we give a much stronger PH the computational basis and output the result as zi. result: that Fourier Fishing is not even in FBPP . This Intuitively, FF-ALG samples the Fourier coefficients of each result does not rely on any unproved conjectures. fi under a distribution that is skewed towards larger coef- ficients; the algorithm’s behavior is illustrated pictorially in 4.1 Constant-Depth Circuit Lower Bounds 0 Figure 1. Recall the definition of a “good” tuple f1,...,fn Our starting point will be the following AC lower bound, h i from Section 2.1. Assuming f1,...,fn is good, it is not which can be found in the book of H˚astad [26] for example. hard to analyze FF-ALG’s successh probability.i Theorem 8 ([26]). Any depth-d circuit that accepts all

Lemma 5. Assuming f1,...,fn is good, FF-ALG succeeds n-bit strings of Hamming weight n/2 + 1, and rejects all h i 1/(d 1) with probability 1 1/ exp(n). strings of Hamming weight n/2, has size exp Ω n − . −    We also have the following: We now give a corollary of Theorem 8, which (though sim- ple) seems to be new, and might be of independent interest. Lemma 6. f1,...,fn is good with probability 1 1/ exp(n), h i − Consider the following problem, which we call ε-Bias De- if the fi’s are chosen uniformly at random. m tection. We are given a string y = y1 ...ym 0, 1 , ∈ { } Combining Lemmas 5 and 6, we find that FF-ALG succeeds and are promised that each bit yi is 1 with independent with probability 1 1/ exp(n), where the probability is over probability p. The task is to decide whether p = 1/2 or − p = 1/2+ ε. both f1,...,fn and FF-ALG’s internal randomness. h i m 3.2 Algorithm for Fourier Checking Corollary 9. Let [ε] be the distribution over 0, 1 where each bit is 1 withU independent probability 1/{2 +}ε. We now turn to Fourier Checking, the problem of de- Then any depth-d circuit C such that ciding whether two Boolean functions f,g are independent FC-ALG or forrelated. Here is a quantum algorithm, , that Pr [C (x)] Pr [C (x)] = Ω(1) solves Fourier Checking with constant error probability x [ε] − x [0] ∼U ∼U using O (1) queries. First prepare a uniform superposition 1/(d+2) over all x 0, 1 n. Then query f in superposition, apply has size exp Ω 1/ε . ∈ { }    Corollary 9 is proved in the full version. The proof pro- Alice can force even an adversarial Bob to give her useful ceeds exactly as one would expect: we start with an AC0 information about the magnitude of f (s). circuit C for ε-Bias Detection, and then use many copies Now let = Es [ [s]] (that is, an equal mixture of all of C, on different random subsets of the input bits, to get the [s]’s).D ThenD we prove in theb full version that is an AC0 circuit that with high probability distinguishes all extremelyD close in variation distance to , the uniformD dis- strings of Hamming weight n/2 + 1 from all strings of Ham- tribution over all Boolean functions f : U0, 1 n 1, 1 . ming weight n/2. { } → {− } Lemma 11. = O(1/√N). 4.2 Secretly Biased Fourier Coefficients kD − Uk An immediate corollary of Lemma 11 is that, if a Fourier In this section, we state two lemmas indicating that one Fishing algorithm succeeds with probability p on f1,...,fn can slightly bias one of the Fourier coefficients of a random n h i n drawn from , then it also succeeds with probability at Boolean function f : 0, 1 1, 1 , and yet still have f nU n { } → {− } least p p O(n/√N) on f1,...,fn drawn be indistinguishable from a random Boolean function (so from −n. kD −U k≥ − h i that, in particular, an adversary has no way of knowing D which Fourier coefficient was biased). These lemmas will 4.3 Putting It All Together play a key role in our reduction from ε-Bias Detection to Using the results of Sections 4.1 and 4.2, we can give a Fourier Fishing. n lower bound on the constant-depth circuit complexity of Fix a string s 0, 1 . Let [s] be the probability Fourier Fishing. distribution over functions∈ { } f : 0, 1 An 1, 1 where each { } → {−1 } s x 1 f (x) is 1 with independent probability + ( 1) · , Theorem 12. Any depth-d circuit that solves the Fourier 2 − 2√N and let [s] be the distribution where each f (x) is 1 with Fishing problem, with probability at least 0.99 over f1,...,fn B 1 s x 1 1/(2d+8) independent probability ( 1) · . Then let [s]= chosen uniformly at random, has size exp Ω N . 2 2√N 1 − − D    2 ( [s]+ [s]) (that is, an equal mixture of [s] and [s]). NowA considerB the following game involvingA Alice andB Bob, Combining Theorem 12 with standard diagonalization tricks, which closely models our problem. First, Alice chooses a we can also give an oracle separation (in fact, a random or- string s 0, 1 n uniformly at random. She then draws f acle separation) between the complexity classes FBQP and FBPPPH according∈ to{ }[s]. She keeps s secret, but sends the truth . D A table of f to Bob. After examining the entire truth table, Theorem 13. FBQPA FBPPPH with probability 1 for Bob can output any string z 0, 1 n such that f (z) β. a random oracle A. 6⊂ ∈ { } ≥ Bob’s goal is to avoid outputting s. The following lemma b If we “scale down by an exponential,” then we can elimi- says that, regardless of Bob’s strategy, if β is sufficiently nate the need for the oracle A, and get a relation problem greater than 1, then Bob must output s with probability that is solvable in quantum logarithmic time but not in AC0. significantly greater than 1/N. Theorem 14. There is a relation in BQLOGTIME AC0. Lemma 10. In the above game, we have \ Theorems 12, 13, and 14 are proved in the full version. β β e + e− Pr [s = z] . ≥ 2√eN 5. FOURIER CHECKING LOWER BOUND where the probability is over s, f, and Bob’s random choices. Section 4 settled the relativized BQP versus PH question, if we are willing to talk about relation problems. Ulti- Lemma 10 is proved in the full version. The intuition mately, though, we also care about decision problems. So behind it is simple: f looks to Bob almost exactly like a in this section we consider the Fourier Checking problem, of deciding whether two Boolean functions f,g are indepen- random Boolean function. Let Vβ be the set of all s ∈ dent or forrelated. In Section 3.2, we saw that Fourier 0, 1 n such that f (s) β. Then when Alice biases f, of { } ≥ Checking has quantum query complexity O (1). What is 9 course she significantly increases the probability that s Vβ . its classical query complexity? b ∈ But the biased Fourier coefficient f (s) still gets “lost in the It is not hard to give a classical algorithm that solves noise”—that is, it is information-theoretically impossible for Fourier Checking using O(√N) = O(2n/2) queries. In Bob to tell s apart from the exponentiallyb many other strings the next section, we will show that Fourier Checking has z that are in Vβ just by chance. Therefore, the best Bob a property called almost k-wise independence, which imme- 4 n/4 can do is basically just to output a random element of Vβ . diately implies a lower bound of Ω(√N) = Ω(2 ) on its 10 But since Vβ N, this strategy will cause Bob to output randomized query complexity (as well as exponential lower | |≪ s with probability 1/N. bounds on its MA, BPPpath, and SZK query complexities). Formalizing the≫ above intuition involves a surprisingly Indeed, we conjecture that almost k-wise independence is simple Bayesian calculation. Basically, all we need to do enough to imply that Fourier Checking is not in PH. We is fix f together with Bob’s output z (which we know be- discuss the status of that conjecture in Section 6. longs to Vβ), and then calculate how likely f was to be drawn 9So long as we consider the distributional version of from [z] rather than [z′] for some z′ = z. D D 6 Fourier Checking, the deterministic and randomized To see the connection to our problem, think of Bob as query complexities are the same (by Yao’s principle). a putative AC0 circuit for Fourier Fishing, and Alice as 10With some more work, we believe that the randomized 0 an AC reduction that uses Bob to solve ε-Bias Detection. query complexity lower bound can be improved to Ω(√N), Bob might try not to cooperate, but by choosing s randomly, though we have not pursued that here. 5.1 Almost k-Wise Independence 6. THE GENERALIZED LN CONJECTURE N Let X = x1 ...xN 0, 1 be a string. Then a literal In 1990, Linial and Nisan [18] conjectured that “polyloga- ∈ { } 0 is an expression of the form xi or 1 xi, and a k-term is rithmic independence fools AC ”—or loosely speaking, that − a product of k literals (each involving a different xi), which every probability distribution over n-bit strings that is is 1 if the literals all take on prescribed values and 0 other- uniform on all small subsets of bits,D is indistinguishable from wise. We can give an analogous definition for strings over the uniform distribution by polynomial-size, constant-depth the alphabet 1, 1 ; we simply let the literals have the form circuits. We now state a variant of the Linial-Nisan Conjec- 1 x {− } ± i 2 . ture, not with the best parameters but with weaker, easier- Let be the uniform distribution over N-bit strings. The to-understand parameters that suffice for our application. followingU definition will play a major role in this work. Conjecture 19 (Linial-Nisan or LN Conjecture). Ω(1) n Definition 15. A distribution over N-bit strings is ε- Let be an n -wise independent distribution over 0, 1 , D n 0{ } almost k-wise independent if for everyD k-term C, and let f : 0, 1 0, 1 be computed by an AC circuit o(1){ } → { } of size 2n and depth O (1). Then PrX [C (X)] 1 ε ∼D 1+ ε. − ≤ PrX [C (X)] ≤ Pr [f (x)] Pr [f (x)] = o (1) . ∼U x x ∼D − ∼U k (Note that PrX [C (X)] is just 2− .) ∼U After seventeen years of almost no progress, in 2007 Bazzi [5] finally proved the LN Conjecture for the special case of In other words, there should be no assignment to any k depth-2 circuits (also called DNF formulas). Bazzi’s proof input bits, such that conditioning on that assignment gives was about 50 pages, but it was dramatically simplified a year us much information about whether X was drawn from later, when Razborov [20] discovered a 3-page proof. Then or . D U in 2009, Braverman [11] gave a breakthrough proof of the Now let be the forrelated distribution over pairs of full LN Conjecture. Boolean functionsF f,g : 0, 1 n 1, 1 , where we first { } → {− RN} choose a vector v = (vx)x 0,1 n of independent Theorem 20 (Braverman’s Theorem [11]). Let f : ∈{ } ∈ n 0 (0, 1) Gaussians, then set f (x) := sgn (vx) and g (x) := 0, 1 0, 1 be computed by an AC circuit of size S N n { } → { } 7d2 sgn (vx) for all x 0, 1 . S and depth d, and let be a log ε -wise independent ∈ { } Dn distribution over 0, 1 . Then for all
sufficiently large S, Theoremb 16. is O(k2/√N)-almost k-wise independent { } 4 F for all k √N. Pr [f (x)] Pr [f (x)] ε. ≤ x − x ≤ ∼D ∼U We prove Theorem 16 in the full version. To do so, we We conjecture a modest-seeming extension of Braverman’s first compute the measure of the Gaussian distribution on Theorem, which says (informally) that almost k-wise inde- 0 an affine subspace of R2N defined by K + L equations of the pendent distributions fool AC as well. form v = a and v = b . This computation is somewhat xi i yj j Conjecture 21 (GLN Conjecture). Let be a 1/nΩ(1)- involved, but is enormously aided by rotational invariance Ω(1) D n and other nice propertiesb of the Gaussian distribution. We almost n -wise independent distribution over 0, 1 , and n AC0 { } then perform a discretization step, to deal with the fact that let f : 0, 1 0, 1 be computed by an circuit of size no(1) { } → { } the functions f and g are Boolean. 2 and depth O (1). Then 5.2 Oracle Separation Results Pr [f (x)] Pr [f (x)] = o (1) . x − x The following lemma says that any almost k-wise inde- ∼D ∼U 0 pendent distribution is indistinguishable from the uniform By the usual correspondence between AC and PH, the distribution by BPPpath or SZK machines. GLN Conjecture immediately implies the following counter- part of Lemma 17: Lemma 17. Suppose a probability distribution over or- D Suppose a probability distribution over oracle acle strings is 1/t (n)-almost poly (n)-wise independent, for strings is 1/t (n)-almost poly (n)-wiseD indepen- BPP some superpolynomial function t. Then no path ma- dent, for some superpolynomial function t. Then chine or SZK protocol can distinguish from the uniform D no PH machine can distinguish from the uni- distribution with non-negligible bias. form distribution with non-negligibleD bias. U U We can combine Theorem 16 and Lemma 17 with standard And thus we get the following implication: diagonalization tricks, to obtain an oracle relative to which Theorem 22. Assuming the GLN Conjecture, there ex- BQP BPPpath and BQP SZK. 6⊂ 6⊂ ists an oracle A relative to which BQPA PHA. 6⊂ Theorem 18. There exists an oracle A relative to which The proof is the same as that of Theorem 18; the only BQPA BPPA and BQPA SZKA. 6⊂ path 6⊂ difference is that the GLN Conjecture now plays the role of Lemma 17. Likewise: Since BPP MA BPPpath, Theorem 18 supersedes the previous results⊆ that⊆ there exist oracles A relative to which Theorem 23. Assuming the GLN Conjecture for the spe- BPPA = BQPA [9] and BQPA MAA [27]. cial case of depth-2 circuits (i.e., DNF formulas), there ex- Lemma6 17 and Theorem 18 are6⊂ proved in the full version. ists an oracle A relative to which BQPA AMA. 6⊂ As a side note, it is conceivable that one could prove PH question, the GLN Conjecture, and what makes them so Prx [ϕ (x)] Prx [ϕ (x)] = o (1) for every almost k-wise difficult. ∼D ∼U independent distribution− and small CNF formula ϕ, with- The first question is an obvious one. Complexity theorists out getting the same resultD for DNF formulas (or vice versa). have known for decades how to prove constant-depth circuit However, since BQP is closed under complement, even such lower bounds, and how to use those lower bounds to give an asymmetric result would imply an oracle A relative to oracles A relative to which (for example) PPA PHA and which BQPA AMA. PA PHA. So why should it be so much harder6⊂ to give If the GLN6⊂ Conjecture holds, then we can also “scale down an⊕ A 6⊂relative to which BQPA PHA? What makes this by an exponential,” to obtain an unrelativized decision prob- AC0 lower bound different from6⊂ all other AC0 lower bounds? lem that is solvable in BQLOGTIME but not in AC0. The answer seems to be that, while we have powerful techniques for proving that a function f is not in AC0, all Theorem 24. Assuming the GLN Conjecture, there ex- of those techniques, in one way or another, involve argu- ists a promise problem in BQLOGTIME AC0. ing that f is not approximated by a low-degree polynomial. \ The Razborov-Smolensky technique [19, 25] argues this ex- 6.1 Low-Fat Polynomials plicitly, while even the random restriction technique [14, 28, Given that the GLN Conjecture would have such remark- 26] argues it “implicitly,” as shown by Linial, Mansour, and able implications for quantum complexity theory, the ques- Nisan [17]. And this is a problem, if f is also computed by tion arises of how we can go about proving it. As we are an efficient quantum algorithm. For Beals et al. [6] proved indebted to Louay Bazzi for pointing out to us, the GLN the following in 1998: Conjecture is equivalent to the following conjecture, about approximating AC0 functions by low-degree polynomials. Lemma 26 ([6]). Suppose a quantum algorithm Q makes T queries to a Boolean input X 0, 1 N . Then Q’s ac- ∈ { } Conjecture 25 (Low-Fat Sandwich Conjecture). ceptance probability is a real multilinear polynomial p (X), For every function f : 0, 1 n 0, 1 computable by an of degree at most 2T . 0 { } → { } n AC circuit, there exist polynomials pℓ,pu : R R of de- gree k = no(1) that satisfy the following three conditions.→ In other words, if a function f is in BQP, then for that very reason, f has a low-degree approximating polynomial!

(i) Sandwiching: pℓ (x) f (x) pu (x) for all x. As an example, we already saw that the following polyno- ≤ ≤ mial p, of degree 4, successfully distinguishes the forrelated (ii) L1-Approximation: Ex [pu (x) pℓ (x)] = o (1). distribution from the uniform distribution : ∼U − F U 2 (iii) Low-Fat: pℓ (x) and pu (x) can be written as linear 1 x y p (f,g) := f (x)( 1) · g (y) . (1) combinations of terms, pℓ (x)= C αC C (x) and pu (x)= 3   C N n − β C (x) respectively, such that α 2−| | = x,y X0,1 C C P C C  ∈{ }  o(1) C o(1) | | Pn and βC 2−| | = n . (HereP a term is a C | | Therefore, we cannot hope to prove a lower bound for Fourier product ofP literals of the form xi and 1 xi.) − Checking, by any argument that would also imply that such a p cannot exist. If we take out condition (iii), then Conjecture 25 becomes This brings us to a second question. If equivalent to the original LN Conjecture (see Bazzi [5] for a proof). And indeed, all progress so far on “Linial-Nisan (i) every known technique for proving f / AC0 involves problems” has crucially relied on this connection with poly- showing that f is not approximated by∈ a low-degree nomials. Bazzi [5] and Razborov [20] proved the depth-2 polynomial, but case of the LN Conjecture by constructing low-degree, ap- proximating, sandwiching polynomials for every DNF, while (ii) every function f with low quantum query complexity Braverman [11] proved the full LN Conjecture by construct- is approximated by a low-degree polynomial, ing such polynomials for every AC0 circuit.11 Given this history, proving Conjecture 25 would seem like the “obvi- does that mean there is no hope of solving the relativized ous” approach to proving the GLN Conjecture. BQP versus PH problem using polynomial-based techniques? We believe the answer is no. The essential point here It is easy to prove one direction of the equivalence: that 0 to prove the GLN Conjecture, it suffices to construct low-fat is that an AC function can be approximated by different sandwiching polynomials for every AC0 circuit. The other kinds of low-degree polynomials. Furthermore, to show that f / AC0, it suffices to show that f is not approximated direction—that the GLN Conjecture implies Conjecture 25, ∈ and hence, there is no loss of generality in working with poly- by a low-degree polynomial in any one of these senses. For nomials instead of probability distributions—follows from a example, even though the Parity function has degree 1 over F linear programming duality calculation. the finite field 2, Razborov and Smolensky showed that over other fields (such as F3), any degree-o (√n) polynomial disagrees with Parity on a large fraction of inputs—and 7. DISCUSSION that is enough to imply that Parity / AC0. In other words, We now take a step back, and use our results to address we simply need to find a type of polynomial∈ approximation some conceptual questions about the relativized BQP versus that works for AC0 circuits, but does not work for Fourier 11Strictly speaking, Braverman constructed approximating Checking. If true, Conjecture 25 (the Low-Fat Sandwich polynomials with slightly different (though still sufficient) Conjecture) provides exactly such a type of approximation. properties. We know from Bazzi [5] that it must be possible But this raises another question: what is the significance to get sandwiching polynomials as well. of the “low-fat” requirement in Conjecture 25? Why, of all things, do we want our approximating polynomial p to [3] D. Aharonov, V. Jones, and Z. Landau. A polynomial be expressible as a linear combination of terms, p (x) = quantum algorithm for approximating the Jones C o(1) polynomial. In Proc. ACM STOC, p. 427–436, 2006. C αC C (x), such that C αC 2−| | = n ? The answer takes us to the| heart| of what an oracle sep- [4] Z. Bar-Yossef, T. S. Jayram, and I. Kerenidis. Exponential P P separation of quantum and classical one-way aration between BQP and PH would have to accomplish. communication complexity. SIAM J. Comput., Notice that, although the polynomial p from equation (1) 38(1):366–384, 2008. solved the Fourier Checking problem, it did so only by [5] L. Bazzi. Polylogarithmic independence can fool DNF cancelling massive numbers of positive and negative terms, formulas. In Proc. IEEE FOCS, p. 63–73, 2007. then representing the answer by the tiny residue left over. [6] R. Beals, H. Buhrman, R. Cleve, M. Mosca, and R. de Not coincidentally, this sort of cancellation is a central fea- Wolf. Quantum lower bounds by polynomials. J. ACM, ture of quantum algorithms. By contrast, we show that, 48(4):778–797, 2001. if a polynomial p does not involve such massive cancella- [7] J. N. de Beaudrap, R. Cleve, and J. Watrous. Sharp quantum versus classical query complexity separations. tions, but is instead more “conservative” and “reasonable” Algorithmica, 34(4):449–461, 2002. (like the polynomials that arise from classical decision trees), [8] C. Bennett, E. Bernstein, G. Brassard, and U. Vazirani. then p cannot distinguish almost k-wise independent distri- Strengths and weaknesses of quantum computing. SIAM J. butions from the uniform distribution, and therefore cannot Comput., 26(5):1510–1523, 1997. solve Fourier Checking. If Conjecture 25 holds, then [9] E. Bernstein and U. Vazirani. Quantum complexity theory. every small-depth circuit can be approximated, not just by SIAM J. Comput., 26(5):1411–1473, 1997. any low-degree polynomial, but by a “reasonable” low-degree [10] R. B. Boppana, J. H˚astad, and S. Zachos. Does co-NP have Inf. Proc. Lett. polynomial—one with a bound on the coefficients that pre- short interactive proofs? , 25:127–132, 1987. [11] M. Braverman. Poly-logarithmic independence fools AC0 vents massive cancellations. This would prove that Fourier circuits. In Proc. IEEE Complexity, p. 3–8, 2009. Checking has no small constant-depth circuits, and hence [12] H. Buhrman, L. Fortnow, I. Newman, and H. R¨ohrig. that there exists an oracle separating BQP from PH. Quantum property testing. SIAM J. Comput., 37(5):1387–1400, 2008. [13] C. Daskalakis, P. W. Goldberg, and C. H. Papadimitriou. 8. OPEN PROBLEMS The complexity of computing a Nash equilibrium. First, of course, prove the GLN Conjecture, or prove the Commun. ACM, 52(2):89–97, 2009. existence of an oracle A relative to which BQPA PHA by [14] M. Furst, J. B. Saxe, and M. Sipser. Parity, circuits, and some other means. A natural first step would be6⊂ to prove the polynomial time hierarchy. Math. Systems Theory, the GLN Conjecture for the special case of DNFs: as shown 17:13–27, 1984. in Theorem 23, this would imply an oracle A relative to [15] D. Gavinsky, J. Kempe, I. Kerenidis, R. Raz, and R. de A A Wolf. Exponential separation for one-way quantum which BQP AM . We have offered a $200 prize for the communication complexity, with applications to 6⊂ 12 PH case and a $100 prize for the AM case. cryptography. SIAM J. Comput., 38(5):1695–1708, 2008. Second, it would be of interest to prove the GLN Conjec- [16] A. Klivans and D. van Melkebeek. Graph nonisomorphism ture for classes of functions weaker than (or incomparable has subexponential size proofs unless the polynomial-time with) DNFs: for example, monotone DNFs, read-once for- hierarchy collapses. SIAM J. Comput., 31:1501–1526, 2002. mulas, and read-k-times formulas. [17] N. Linial, Y. Mansour, and N. Nisan. Constant depth Third, can we give an example of a Boolean function f : circuits, Fourier transform, and learnability. J. ACM, 40(3):607–620, 1993. 0, 1 n 1, 1 that is well-approximated by a low-degree { } → {− } [18] N. Linial and N. Nisan. Approximate inclusion-exclusion. polynomial, but not by a low-degree low-fat polynomial? Combinatorica, 10(4):349–365, 1990. Fourth, can we give an oracle relative to which BQP IP? 6⊂ [19] A. A. Razborov. Lower bounds for the size of circuits of Fifth, what else does the GLN Conjecture imply? bounded depth with basis {&, ⊕}. Mathematicheskie Sixth, how much can we say about the BQP versus PH Zametki, 41(4):598–607, 1987. question in the unrelativized world? As one concrete chal- [20] A. A. Razborov. A simple proof of Bazzi’s theorem. ACM lenge, can we find a nontrivial way to “realize” the Fourier Trans. Comput. Theory, 1(1), 2009. Checking oracle (in other words, an explicit computational [21] A. Shamir. IP=PSPACE. J. ACM, 39(4):869–877, 1992. problem that is solvable using Fourier Checking)? [22] D. Shepherd and M. J. Bremner. Temporally unstructured quantum computation. Proc. Roy. Soc. London, Seventh, how far can the gap between the success proba- A465(2105):1413–1439, 2009. FBQP FBPPPH bilities of and algorithms be improved? [23] P. W. Shor. Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum 9. ACKNOWLEDGMENTS computer. SIAM J. Comput., 26(5):1484–1509, 1997. [24] D. Simon. On the power of quantum computation. In Proc. I thank Louay Bazzi for reformulating the GLN Conjec- IEEE FOCS, p. 116–123, 1994. ture as the Low-Fat Sandwich Conjecture, Andy Drucker, [25] R. Smolensky. Algebraic methods in the theory of lower Lance Fortnow, and Sasha Razborov for helpful discussions, bounds for Boolean circuit complexity. In Proc. ACM and an anonymous reviewer for comments. STOC, p. 77–82, 1987. [26] J. H˚astad. Computational Limitations for Small Depth Circuits. MIT Press, 1987. 10. REFERENCES [27] J. Watrous. Succinct quantum proofs for properties of finite [1] S. Aaronson and A. Ambainis. The need for structure in groups. In Proc. IEEE FOCS, p. 537–546, 2000. quantum speedups. arXiv:0911.0996, 2009. [28] A. C-C. Yao. Separating the polynomial-time hierarchy by [2] L. Adleman, J. DeMarrais, and M.-D. Huang. Quantum oracles. In Proc. IEEE FOCS, p. 1–10, 1985. computability. SIAM J. Comput., 26(5):1524–1540, 1997.

12See http://scottaaronson.com/blog/?p=381