D Quantum Algorithms

124 CHAPTER III. QUANTUMQuantum algorithms COMPUTATION33

Figure 1.19. Quantum circuit implementing Deutsch’s algorithm. Figure III.22: Quantum circuit for Deutsch algorithm. [fig. from Nielsen & Chuang (2010)] is sent through two Hadamard gates to give 0 + 1 0 1 1 = | i | i | i| i . (1.42) | i p p D Quantum algorithms 2  2 A little thought shows that if we apply Uf to the state x ( 0 1 )/p2thenweobtain f(x) p | i | i| i D.1the state Deutsch-Jozsa ( 1) x ( 0 1 )/ algorithm2. Applying Uf to 1 therefore leaves us with one of two possibilities: | i | i| i | i D.1.a Deutsch’s algorithm0 + 1 0 1 | i | i | i| i if f(0) = f(1) p p 8 ± 2 2 In this section you = will encounter  your first example of a quantum algorithm(1.43) 2 that can compute| i faster than0 a1 classical0 1 algorithm for the same problem. < | i| i | i| i if f(0) = f(1). This is a simplified version± ofp Deutsch’s2 p original2 algorithm,6 which shows how   itThe is possible final Hadamard to extract gate: global on the first information qubit thus about gives us a function by using quantum 8 parallelism and interference (Fig.0 III.22).1 0 | i| i if f(0) = f(1) Suppose we have a function f p: 2 2,asinSec.C.5.Thegoalisto 8 ±| i 2 ! determine whetherf(0)= = f(1) with asingle function evaluation. This(1.44) is 3 | i 0 1 not a very interesting problem< 1 (since| i| therei areif f only(0) = fourf(1). such functions), but ±| i p 6 it is a warmup for the Deutsch-Jozsa 2 algorithm. Simple as it is, it could be expensiveRealizing that to decidef(0) f on(1) ais 0classical if f(0) = computer.f(1) and 1 otherwise, For example, we can rewrite suppose thisf result(0) = : theconcisely billionth as bit of ⇡ and f(1) = the billionth bit of e.Thentheproblemis to decide if the billionth bits of ⇡ and e are0 the1 same. It is mathematically 3 = f(0) f(1) | i| i , (1.45) simple, but computationally| i ±| complex. i p  2 soTo by see measuring how we the might first qubit solve we this may problem, determine supposef(0) f(1). we This have is a very quantum interesting gate arrayindeed:Uf thefor quantumf;thatis, circuitUf hasx giveny = usx they abilityf(x to) determine.Inparticular, a global propertyUf x 0of= f(x), namely f(0) f(1), using| onlyi| ione evaluation| i| of f(xi)! This is faster than is possible| i| i with8This a classical is the 1998 apparatus, improvement which would by Cleve require et al. at to least Deutsch’s two evaluations. 1985 algorithm (Nielsen & Chuang,This 2010, example p. 59). highlights the difference between quantum parallelism and classical randomized algorithms. Naively, one might think that the state 0 f(0) + 1 f(1) | i| i | i| i corresponds rather closely to a probabilistic classical computer that evaluates f(0) with probability one-half, or f(1) with probability one-half. The difference is that in a classical computer these two alternatives forever exclude one another; in a quantum computer it is D. QUANTUM ALGORITHMS 125

x f(x) and Uf x 1 = x f(x) . Usually we set y =0togettheresult |fi(|x) ,buthereyouwillseeanapplicationinwhichwewanti | i| i | i|¬ i y =1. | i Now consider the result of applying Uf to x in the data register and to the superposition = 1 ( 0 1 )inthetargetregister.| i |i p2 | i| i 1 1 1 Uf x = x f(x) x f(x) = x [ f(x) f(x) ]. | i|i p2| i| ip2| i|¬ i p2| i | i|¬ i Now the rightmost square bracket is 0 1 if f(x)=0or 1 0 if f(x)=1.Therefore,wecanwrite | i| i | i| i

1 f(x) f(x) Uf x = x ( ) ( 0 1 )=( ) x . (III.21) | i|i p2| i | i| i | i|i [Here, ( )x is an abbreviation for ( 1)x when we want to emphasize that f(x) the sign is all that matters.] Since Uf x =( ) x ,theresultof applying it to an equal superposition of| xi|=0andi x =1is:| i|i 1 1 U x = ( )f(x) x . p f | i|i p | i|i 2 x 2 2 x 2 X2 X2 If f is a constant function, then f(0) = f(1), and the summation is 1 ( 0 + ± p2 | i 1 ) = + because both components have the same sign.. On the other| i |i hand,±| if if|i(0) = f(1), then the summation is 1 ( 0 1 ) = 6 ± p2 | i| i |i because the components have opposite signs. That is, a constant function±|i|i gives the 0 and 1 components of the data qubit the same phase, and otherwise gives| i them| thei opposite phase. Therefore, we can determine whether the function is constant or not by measuring the ﬁrst qubit in the sign basis; we get + if f(0) = f(1) and otherwise. With this background, we can state Deutsch’s| i algorithm. |i

algorithm Deutsch:

Initial state: Begin with the qubits def= 01 . | 0i | i

Superposition: Transform it to a pair of superpositions

def 1 1 1 = ( 0 + 1 ) ( 0 1 )= + . (III.22) | i p2 | i | i ⌦ p2 | i| i | i 126 CHAPTER III. QUANTUM COMPUTATION by a pair of Hadamard gates. Recall that H 0 = 1 ( 0 + 1 )= + and | i p2 | i | i | i H 1 = 1 ( 0 1 )= . | i p2 | i| i |i

Function application: Next apply U to = + . As we’ve seen, f | 1i | i Uf x 0 = x 0 f(x) = x f(x) ,andUf x 1 = x 1 f(x) = x | if| (ix) .Therefore,expandEq.III.22andapply| i| i | i| i | i|Ui: | i| i | i|¬ i f def= U | 2i f | 1i 1 1 = Uf ( 0 + 1 ) ( 0 1 ) p2 | i | i ⌦ p2 | i| i  1 = [U 00 U 01 + U 10 U 11 ] 2 f | i f | i f | i f | i 1 = [ 0,f(0) 0, f(0) + 1,f(1) 1, f(1) ] 2 | i| ¬ i | i| ¬ i There are two cases: f(0) = f(1) and f(0) = f(1). 6

Equal (constant function): If f(0) = f(1), then

1 = [ 0,f(0) 0, f(0) + 1,f(0) 1, f(0) ] | 2i 2 | i| ¬ i | i| ¬ i 1 = [ 0 ( f(0) f(0) )+ 1 ( f(0) f(0) )] 2 | i | i|¬ i | i | i|¬ i 1 = ( 0 + 1 )( f(0) f(0) ) 2 | i | i | i|¬ i 1 = ( 0 + 1 )( 0 1 ) ±2 | i | i | i| i 1 = ( 0 + 1 ) ±p2 | i | i |i = + . | i The last line applies because global phase (including )doesn’tmatter. ±

Unequal (balanced function): If f(0) = f(1), then 6 1 = [ 0,f(0) 0, f(0) + 1, f(0) 1,f(0) ] | 2i 2 | i| ¬ i | ¬ i| i D. QUANTUM ALGORITHMS 127

1 = [ 0 ( f(0) f(0) )+ 1 ( f(0) f(0) )] 2 | i | i|¬ i | i |¬ i| i 1 = [ 0 ( f(0) f(0) ) 1 ( f(0) f(0) )] 2 | i | i|¬ i | i | i|¬ i 1 = ( 0 1 )( f(0) f(0) ) 2 | i| i | i|¬ i 1 = ( 0 1 )( 0 1 ) ±2 | i| i | i| i 1 = ( 0 1 ) ±p2 | i| i |i = |i Clearly we can discriminate between the two cases by measuring the ﬁrst qubit in the sign basis. In particular, note that in the unequal case, the 1 component has the opposite phase from the 0 component. | i | i

Measurement: Therefore we can determine whether f(0) = f(1) or not by measuring the ﬁrst bit of 2 in the sign basis, which we can do with the Hadamard gate (recall H +| =i 0 and H = 1 ): | i | i |i | i def=(H I) | 3i ⌦ | 2i 0 , if f(0) = f(1) = ±|1i|i, if f(0) = f(1) ⇢ ±| i|i 6 = f(0) f(1) . ±| i|i

⇤

Notice that the information we need is in the data register, not the target register. This technique is called phase kick-back (i.e., kicked back into the phase of the data register). In conclusion, we can determine whether or not f(0) = f(1) with a single evaluation of f,whichisquiteremarkable.Ine↵ect,weareevaluatingf on asuperpositionof 0 and 1 and determining how the results interfere with each other. As a result| i we| geti a deﬁnite (not probabilistic) determination of aglobalpropertywithasingleevaluation. This is a clear example where a quantum computer can do something faster than a classical computer. However, note that Uf has to uncompute Quantum algorithms 35 128 CHAPTER III. QUANTUM COMPUTATION

Figure 1.20. Quantum circuit implementing the general Deutsch–Jozsa algorithm. The wire with a ‘/’ through it Figurerepresents III.23: a set of n Quantumqubits, similar circuitto the common for engineering Deutsch-Jozsa notation. algorithm. [ﬁg. from NC]

evenly weighted superposition of 0 and 1. Next, the function f is evaluated (by Bob) f,whichtakesasmuchtimeascomputingit,butwewillseeothercasesusing Uf : x, y x, y f(x) ,giving | i!| i (Deutsch-Jozsa) where the speedup is much more than 2 . ( 1)f(x) x 0 1 ⇥ 2 = | i | i| i . (1.48) n | i x p2 p2 X  D.1.bAlice nowThe has Deutsch-Jozsaa set of qubits in which algorithm the result of Bob’s function evaluation is stored Thein the Deutsch-Jozsa amplitude of the algorithm qubit superposition is a generalization state. She now of interferes the Deutsch terms algorithmin the super- to position using a Hadamard transform on the query register. To determine the result of n bits,the Hadamard which they transform published it helps it to in ﬁrst 1992; calculate here the we effect present of the the Hadamard improved transform version ofon Nielsen a state &x .Bycheckingthecases Chuang (2010, p. 59).x =0andx =1separatelyweseethatforasingle | i xz f n qubitThisH isx the= problem:z( 1) z Suppose/p2. Thus we are given an unknown function : 2 2 in the form| i of a unitary| i transform U ( n+1, ) (Fig. III.23). We are! f x1z1+ +x z P ( 1) ·· n n z ,...,z n z1,...,zn 2LH H1 n told only thatHf isx1 either,...,xn constant= or balanced,whichmeansthatitis0on| i . (1.49) n half its domain and| 1 on thei otherP half. Ourp task2 is to determine into which classThis the can given be summarizedf falls. more succinctly in the very useful equation Consider ﬁrst the classical situation. Wex canz try di↵erent input bit strings n z( 1) · z H x = | i , (1.50) x. We might (if we’re lucky) discover| i afterp2n the second query of f that it is not constant. But we might requireP as many as 2n/2+1queriestoanswer where x z is the bitwise inner productn 1 of x and z,modulo2.Usingthisequation the question.· So we’re facing (2 )functionevaluations. and (1.48) we can now evaluate 3 , | Oi x z+f(x) ( 1) · z 0 1 = | i | i| i . (1.51) 3 2n | i z x p2 algorithm Deutsch-Jozsa:X X  n Alice now observes the query register. Note that the amplitude for the state 0 is | i ( 1)f(x)/2n.Let’slookatthetwopossiblecases–f constant and f balanced – to x def n Initialdiscern state: what happens.As in theIn the Deutsch case where algorithm,f is constant prepare the amplitude the initial for 0 state is +1 0 or= Pn | i | i 0 ⌦1,1 depending. on the constant value f(x)takes.Because 3 is of unit length it follows | ithat | alli the other amplitudes must be zero, and an observation| i will yield 0s for all qubits in the query register. If f is balanced then the positive and negative contributions to the n amplitude for 0 cancel, leaving an amplitude of zero, and a measurement must yield aresultotherthan0onatleastonequbitinthequeryregister.Summarizing,ifAlice| i D. QUANTUM ALGORITHMS 129

Superposition: Use the Walsh-Hadamard transformation to create a superposition of all possible inputs:

def n 1 1 =(H⌦ H) 0 = x, . | i ⌦ | i p n | i x 2n 2 X2 Claim: Similarly to the single qubit case (Eq. III.21), we can see that f(x) n n Uf x, =( ) x ,where( ) is an abbreviation for ( 1) .From the| deﬁnitioni of | i|andi U , U x, = x 1 ( f(x) f(x) ). Since |i f f | i | i p2 | i|¬ i f(x) 2, 1 ( f(x) f(x) )= if f(x)=0,andit= if f(x)=1. p2 This2 establishes| thei claim.|¬ i |i |i

Function application: Therefore, you can see that:

def 1 f(x) 2 = Uf 1 = ( ) x . (III.23) | i | i p n | i|i x 2n 2 X2 In the case of a constant function, all the components of the data state have the same phase, otherwise they do not. To see how we can make use of this information, let’s consider the state in more detail. For a single bit you can show (Exer. III.46): 1 1 1 H x = ( 0 +( )x 1 )= ( )xz z = ( )xz z . | i p | i | i p | i p | i 2 2 z 2 z 2 2 X2 X2 (This is just another way of writing H 0 = 1 ( 0 + 1 )andH 1 = 1 ( 0 | i p2 | i | i | i p2 | i 1 ).) Therefore, the general formula for the Walsh transform of n bits is: | i

n 1 x1z1+ +xnzn H⌦ x1,x2,...,xn = ( ) ··· z1,z2,...,zn | i p2n | i z1,...,zn 2 X2 1 x z = ( ) · z , (III.24) p n | i 2 z 2n X2 where x z is the bitwise inner product. (It doesn’t matter if you do addition or since· only the parity of the result is signiﬁcant.) Remember this formula! Combining this and the result in Eq. III.23,

def n 1 x z+f(x) =(H⌦ I) = ( ) · z . | 3i ⌦ | 2i 2n | i|i z 2n x 2n X2 X2 130 CHAPTER III. QUANTUM COMPUTATION

Measurement: Consider the ﬁrst n qubits and the amplitude of one par- n ticular basis state, z = 0 = 0 ⌦ ,whichweseparatefromtherestofthe summation: | i | i

1 f(x) 1 x z+f(x) = ( ) 0 + ( ) · z | 3i 2n | i|i 2n | i|i x 2n z 2n 0 x 2n X2 2 X{ } X2 n 1 f(x) Hence, the amplitude of 0 ⌦ ,theall-0 qubit string, is x 2n 2n ( ) . Recall how in the basic Deutsch| i algorithm| i we got a sum of signs2 (either all the same or not) for all the function evaluations. The resultP is similar here, but we have 2n values rather than just two. We now have two cases:

Constant function: If the function is constant, then all the exponents of 1willbethesame(eitherall0orall1),andsotheamplitudewillbe 1. Therefore all the other amplitudes are 0 and any measurement must yield± 0 n for all the qubits (since only 0 ⌦ has nonzero amplitude). | i

Balanced function: If the function is not constant then (ex hypothesi)it is balanced, but more speciﬁcally, if it is balanced, then there must be an n equal number of +1 and 1contributionstotheamplitudeof 0 ⌦ ,soits amplitude is 0. Therefore, when we measure the state, at least| i one qubit must be nonzero (since the all-0s state has amplitude 0). ⇤

The good news about the Deutsch-Jozsa algorithm is that with one quantum function evaluation we have got a result that would require between 2 n 1 and (2 )classicalfunctionevaluations(exponentialspeedup!).Thebad newsOis that the algorithm has no known applications! Even if it were useful, however, the problem could be solved probabilistically on a classical computer with only a few evaluations of f:foranerrorprobabilityof✏,ittakes 1 (log ✏ ) function evaluations. However, it illustrates principles of quantum computingO that can be used in more useful algorithms. D. QUANTUM ALGORITHMS 131

D.2 Simon’s algorithm Simon’s algorithm was first presented in 1994 and can be found in Simon, D. (1997), “On the power of quantum computation,” SIAM Journ. Computing, 26 (5), pp. 1474–83.9 For breaking RSA we will see that its useful to know the period of a function: that r such that f(x + r)=f(x). Simon’s problem is a warmup for this. Simon’s Problem: Suppose we are given an unknown function f : 2n 2n and we are told that it is two-to-one.Thismeansf(x)=f(y)i↵ x !y = r for some fixed r 2n.Thevectorr can be considered the period off,sincef(x r)=f(x).2 The problem is to determine the period r of a given unknown f. Consider first the classical solution. Since we don’t know anything about f, the best we can do is evaluate it on random inputs. If we are ever lucky enough to find x and x0 such that f(x)=f(x0), then we have our answer, r = x x0. After testing m values, you will have eliminated about m(m 1)/2 possible r vectors (namely, x x0 for every pair of these m vectors). You will be done when m2 2n.Therefore,ontheaverageyouneedtodo 2n/2 function evaluations,⇡ which is exponential in the size of the input. For n =100,itwouldrequireabout250 1015 evaluations. “At 10 million calls per second it would take about three⇡ years” (Mermin, 2007, p. 55). We will see that a quantum computer can determine r with high probability 6 (> 1 10 ) in about 120 evaluations. At 10 million calls per second, this would take about 12 microseconds!

algorithm Simon:

Input superposition: As before, start by using the Walsh-Hadamard transform to create a superposition of all possible inputs:

def n n 1 = H⌦ 0 ⌦ = x . | 1i | i 2n/2 | i x 2n X2

9The following presentation follows Mermin’s Quantum Computer Science (Mermin, 2007, 2.5, pp. 55–8). § 132 CHAPTER III. QUANTUM COMPUTATION

Function evaluation: Suppose that Uf is the quantum gate array implementing f and recall U x y = x y f(x) .Therefore: f | i| i | i| i def n 1 = U 0 ⌦ = x f(x) . | 2i f | 1i| i 2n/2 | i| i x 2n X2 Therefore we have an equal superposition of corresponding input-output values.

Output measurement: Measure the output register (in the computational basis) to obtain some z .Sincethefunctionistwo-to-one,theprojection will have a superposition| i of two inputs: 1 ( x0 + x0 r ) z , p2 | i | i | i where f(x0)=z = f(x0 r). The information we need is contained in the input register, def 1 3 = ( x0 + x0 r ), | i p2 | i | i but it cannot be extracted directly. If we measure it, we will get either x0 or x0 r, but not both, and we need both to get r.(Wecannotmaketwo copies, due to the no-cloning theorem.) Suppose we apply the Walsh-Hadamard transform to this superposition:

n n 1 H⌦ 3 = H⌦ ( x0 + x0 r ) | i p2 | i | i 1 n n = (H⌦ x0 + H⌦ x0 r ). p2 | i | i Now, recall (D.1.b, p. 129) that

n 1 x y H⌦ x = ( 1) · y . | i 2n/2 | i y 2n X2 (This is the general expression for the Walsh transform of a bit string. The phase depends on the number of common 1-bits.) Therefore,

n 1 1 x0 y 1 (x0+r) y H⌦ = ( 1) · y + ( 1) · y | 3i p 2n/2 | i 2n/2 | i 2 " y 2n y 2n # X2 X2 1 x0 y (x0+r) y = ( 1) · +( 1) · y . 2(n+1)/2 | i y 2n X2 ⇥ ⇤ D. QUANTUM ALGORITHMS 133

Note that (x0+r) y x0 y r y ( 1) · =( 1) · ( 1) · . Therefore, if r y =1,thenthebracketedexpressionis0(sincetheterms have opposite sign· and cancel). However, if r y =0,thenthebracketed x0 y · expression is 2( 1) · (since they don’t cancel). Hence the result of the Walsh-Hadamard transform is

n 1 x0 y = H⌦ = ( 1) · y . | 4i | 3i 2(n 1)/2 | i y s.t. r y=0 X·

Measurement: Measuring the input register (in the computational basis) will collapse it with equal probability into a state y(1) such that r y(1) =0. | i ·

First equation: Since we know y(1),thisgivesussomeinformationabout r,expressedintheequation:

y(1)r + y(1)r + + y(1)r =0(mod2). 1 1 2 2 ··· n n

Iteration: The quantum computation can be repeated, producing a series of bit strings y(1), y(2),... such that y(k) r =0.Fromthemwecanbuild up a system of n linearly-independent equations· and solve for r.(Ifyou get a linearly-dependent equation, you have to try again.) Note that each quantum step (involving one evaluation of f) produces an equation (except in the unlikely case y(k) =0orthatit’slinearlydependent),andtherefore determines one of the bits in terms of the other bits. That is, each iteration reduced the candidates for r by approximately one-half. ⇤

A mathematical analysis (Mermin, 2007, App. G) shows that with n + m iterations the probability of having enough information to determine r is > 1 1 .“Thustheoddsaremorethanamilliontoonethatwith 2m+1 n +20invocationsofUf we will learn [r], no matter how large n may be.” 134 CHAPTER III. QUANTUM COMPUTATION

(Mermin, 2007, p. 57) Note that the “extra” evaluations are independent of n.ThereforeSimon’sproblemcanbesolvedinlinear time on a quantum computer, but requires exponential time on a classical computer. D. QUANTUM ALGORITHMS 135

D.3 Shor’s algorithm

If computers that you build are quantum, Then spies everywhere will all want ’em. Our codes will all fail, And they’ll read our email, Till we get crypto that’s quantum, and daunt ’em. — Jennifer and Peter Shor (Nielsen & Chuang, 2010, p. 216)

The widely used RSA public-key cryptography system is based on the di- culty of factoring large numbers.10 The best classical algorithms are nearly exponential in the size of the input, m =lnM. Specifically, the best current (2006) algorithm (the number field sieve algorithm)runsintime (m1/3 ln2/3 m) eO .Thisissubexponentialbutveryinecient.Shor’squantum algorithm is bounded error-probability quantum polynomial time (BQP), specifically, (m3). Shor’s algorithm was invented in 1994, inspired by Si- mon’s algorithm.O Shor’s algorithm reduces factoring to finding the period of a function. The connection between factoring and period finding can be understood as follows. Assume you are trying to factor M.Supposeyoucanfindx such that x2 =1(modM). Then x2 1=0(modM). Therefore (x+1)(x 1) = 0(modM). Therefore both x +1and x 1havecommonfactorswith M (except in the trivial case x =1,andsolongasneitherisamultipleof M). Now pick an a that is coprime (relatively prime) to M.Ifar =1(modM) and r happens to be even, we’re done (since we can find a factor of M as explained above). (The smallest such r is called the order of a.) This r is the period of ax (mod M), since ax+r = axar = ax (mod M). In summary, if we can find the order of an appropriate a and it is even, then we can probably factor the number. To accomplish this, we need to find the period of ax (mod M), which can be determined through a Fourier transform. Like the classical Fourier transform, the quantum Fourier transform puts all the amplitude of the function into multiples of the frequency (reciprocal period). Therefore, measuring the state yields the period with high probability.

10These section is based primarily on Rie↵el & Polak (2000). 136 CHAPTER III. QUANTUM COMPUTATION

D.3.a Quantum Fourier transform Before explaining Shor’s algorithm, it’s necessary to explain the quantum Fourier transform, and to do so it’s helpful to begin with a review of the classical Fourier transform. Let f be a function deﬁned on [0, 2⇡). We know it can be represented as aFourierseries,

a 1 A 1 f(x)= 0 + (a cos kx + b sin kx)= 0 + A cos(kx + ), 2 k k 2 k k Xk=1 Xk=1 where k =0, 1, 2,...represents the overtone series (natural number multiples of the fundamental frequency). You know also that the Fourier transform can be represented in the ciscoid (cosine + i sine) basis, where we deﬁne def ikx u (x) =cis( kx)=e .(The“ ”signisirrelevant,butwillbeconvenient k later.) The uk are orthogonal but not normalized, so we divide them by 2⇡ 2 2 2⇡,since 0 cos x +sin x dx =2⇡. The Fourier series in this basis is 1 1 ˆ ˆ f(x)= k= fk cis( kx). The Fourier coecients are given by fk = 2⇡ uk R 1 h | f = 1 2⇡ eikxf(x)dx.Theygivetheamplitudeandphaseofthecomponent 2⇡ P0 signalsi u . Rk For the discrete Fourier transform (DFT) we suppose that f is repre- def j def sented by N samples, fj = f(xj), where xj =2⇡ N ,withj N = T 2 0, 1,...,N 1 .Letf =(f0,...,fN 1) . Note that the xj are the 1/N segments{ of a circle.} (Realistically, N is big.) Likewise each of the basis functions is represented by a vector of N sam- def T ples: uk =(uk,0,...,uk,N 1) .Thuswehaveamatrixofallthebasissam- ples: def 2⇡ikj/N u =cis( kx )=e ,j N. kj j 2 2⇡ikj/N In e ,notethat2⇡i represents a full cycle, k is the overtone, and j/N represents the fraction of a full cycle. Recall that every complex number has N principal N th-roots, and in particular the number 1 (unity) has N principal N th-roots. Notice that N samples of the fundamental period correspond to the N principal N th-roots j 2⇡i/N kj of unity, that is, ! where (for a particular N) ! = e . Hence, ukj = ! . k 0 k 1 k (N 1) T That is, uk =(! · ,! · ...,! · ) .Itiseasytoshowthatthevectors uk are orthogonal, and in fact that uk/pN are ON (exercise). Therefore, f D. QUANTUM ALGORITHMS 137 can be represented by a Fourier series, 1 1 f = fˆ u = (u† f)u . p k k N k k N k N k N X2 X2 Deﬁne the discrete Fourier transform of the vector f, ˆf =Ff,tobethe ˆ vector of Fourier coecients, fk = uk† f/pN.DetermineFasfollows: ˆ f0 u0†f u0† ˆ f1 1 u1†f 1 u1† ˆf = 0 . 1 = 0 . 1 = 0 . 1 f. . pN . pN . B ˆ C B C B C B fN 1 C B uN† 1f C B uN† 1 C B C B C B C @ A @ A @ A Therefore let

0 0 0 1 0 (N 1) ! · ! · ! · u0† 1 0 1 1 ··· 1 (N 1) ! · ! · ! · def 1 u1† 1 0 2 0 2 1 ··· 2 (N 1) 1 F = 0 . 1 = ! · ! · ! · . pN . pN B . . ···. . C B C B . . .. . C B uN† 1 C B (N 1) 0 (N 1) 1 (N 1) (N 1) C B C B ! · ! · ! · C @ A B ··· C @ (III.25)A kj That is, Fkj = ukj/pN = ! /pN for k, j N. Note that the “ ”signsin the complex exponentials were eliminated by2 the conjugate transpose. F is unitary transformation (exercise). The fast Fourier transform (FFT) reduces the number of operations required from (N 2)to (N log N).11 It does this with a recursive algorithm that avoids recomputingO O values. However, it is restricted to powers of two, N =2n. The quantum Fourier transform (QFT) is even faster, (log2 N), that is, (n2). However, because the spectrum is encoded in theO amplitudes of the quantumO state, we cannot get them all. Like the FFT, the QFT is restricted to powers of two, N =2n. The QFT transforms the amplitudes of a quantum state: U f j = fˆ k , QFT j| i k| i j N k N X2 X2 11The FFT is (N log N), but N>M2 = e2m. Therefore the FFT is (M 2 log M 2)= (M 2 log M)=O(me2m) O O O 138 CHAPTER III. QUANTUM COMPUTATION where ˆf def=Ff. Suppose f has period r,andsupposethattheperiodevenlydividesthe number of samples, r N.Thenalltheamplitudeoffˆ should be at multiples of its fundamental frequency,| N/r.Ifr N,thentheamplitudewillbe concentrated near multiples of N/r.Theapproximationisimprovedbyusing6| larger n. The FFT (and QFT) are implemented in terms of additions and multi- plications by various roots of unity (powers of !). In QFT, these are phase shifts. In fact, the QFT can be implemented with n(n +1)/2gatesoftwo types: (1) One is Hj, the Hadamard transformation of the jth qubit. (2) The other is a controlled phase-shift Sj,k,whichusesqubitxj to control whether it does a particular phase shift on the 1 component of qubit x .Thatis, | i k S x x x x0 is deﬁned by j,k| j ki 7! | j ki

def i✓k j S = 00 00 + 01 01 + 10 10 + e 11 11 , j,k | ih | | ih | | ih | | ih | k j where ✓k j = ⇡/2 .Thatis,thephaseshiftdependsontheindicesj and k. It can be shown that the QFT can be deﬁned:12

n 1 n 1 UQFT = Hj Sj,k. j=0 Y k=Yj+1 This is (n2)gates. O

D.3.b Shor’s algorithm step by step Shor’s algorithm depends on many results from number theory, which are outside of the scope of this course. Since this is not a course in cryptography or number theory, I will just illustrate the ideas.

algorithm Shor:

12See Rie↵el & Polak (2000) for this, with a detailed explanation in Nielsen & Chuang (2010, 5.1, pp. 517–21). § D. QUANTUM ALGORITHMS 139

Input: Suppose we are factoring M (and M =21willbeusedforcon- crete examples, but of course the goal is to factor very large numbers). Let m def= lg M =5inthecaseM =21. d e

Step 1: Pick a random number a

Modular exponentiation: Let g(x) def= ax (mod M), for x M def= 0, 1,...,M 1 .Thistakes (m3)gatesandisthemostcomplexpart2 of{ the algorithm! } (Reversible circuitsO typically use m3 gates for m qubits.) In our example case, g(x)=11x (mod 21), so g(x)=1, 11, 16, 8, 4, 2, 1, 11, 16, 8, 4,... period In order to get a good QFT| approximation,{z } pick n such that M 2 2n < 2M 2.  Let N def=2n.Equivalently,pickn such that 2 lg M n<2lgM +1,that is, roughly twice as many qubits as in M. Note that although the number of samples is N =2n,weneedonlyn qubits (thanks to the tensor product). This is where quantum computation gets its speedup over classical computation; M is very large, so N>M2 is extremely large. The QFT computes all these in parallel. For our example M =21,andsowepickn =9for N =512since441 512 < 882. Therefore m =5. 

Step 2 (quantum parallelism): Apply Ug to the superposition

def n n 1 = H⌦ 0 ⌦ = x | 0i | i p | i N x N X2 to get def m 1 = U 0 ⌦ = x, g(x) . | 1i g| 0i| i p | i N x N X2 For our example problem, 14 qubits are required [n =9forx and m =5for g(x)]. The quantum state looks like this (note the periodicity): 1 1 = ( 0, 1 + 1, 11 + 2, 16 + 3, 8 + 4, 4 + 5, 2 + | i p512 | i | i | i | i | i | i 140 CHAPTER III. QUANTUM COMPUTATION

6, 1 + 7, 11 + 8, 16 + 9, 8 + 10, 4 + 11, 2 + ) | i | i | i | i | i | i ···

Step 3 (measurement): The function g has a period r,whichwewant to transfer to the amplitudes of the state so that we can apply the QFT. This is accomplished by measuring (and discarding) the result register (as 13 in Simon’s algorithm). Suppose the result register collapses into state g⇤ (e.g., g⇤ = 8). The input register will collapse into a superposition of all x such that g(x)=g⇤. We can write it:

def 1 1 1 = x, g⇤ = f x, g⇤ = f x g⇤ , | 2i | i x| i x| i | i x N s.t.g(x)=g x N " x N # Z 2 X ⇤ Z X2 Z X2 where def 1, if g(x)=g f = ⇤ , x 0, otherwise ⇢ and def= x g(x)=g is a normalization factor. For example, Z |{ | ⇤}| 1 p = ( 3, 8 + 9, 8 + 15, 8 + ) | 2i | i | i | i ··· Z1 = ( 3 + 9 + 15 + ) 8 | i | i | i ··· | i Z Note that the values x for which fx =0di↵erfromeachotherbytheperiod; This produces a function f of very6 strong periodicity. As in Simon’s algorithm, if we could measure two such x,wewouldhaveusefulinformation, but we can’t. Suppose we measure the result register and get g⇤ = 8. Fig. III.24 shows the corresponding f =(0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0,...).

Step 4 (QFT): Apply the QFT to obtain, 1 def= U f x | 3i QFT x| i x N ! Z X2 1 = fˆ xˆ . xˆ| i xˆ N Z X2 13As it turns out, this measurement of the result register can be avoided. This is in general true for “internal” measurement processes in quantum algorithms (Bernstein & Vazirani 1997). D. QUANTUM ALGORITHMS 141 26 E. Rieffel and W. Polak · 0.012 0.0108 26 E. Rieffel and W. Polak 0.0096· 0.00840.012 0.01080.0072 0.00960.006 0.00840.0048 0.00720.0036 0.00240.006 0.00480.0012 0.00360.0 0 64 128 192 256 320 384 448 512 0.0024

0.0012 2 Fig. 2. Probabilities for measuring x when measuring the state C x X x, 8 obtained in Step 2, where Figure III.24: Example probability distribution | fx for state X = x0.0211x mod 21 = 8 1 { | }} | | Z x N0fx x, 864.Inthisexampletheperiodis128 192 256 P320 384 r =6(e.g.,at448 512 x =3, 9,215,...| ).i [ﬁg. source: Rie↵el & Polak (2000)] P 0.17 Fig. 2. Probabilities for measuring x when measuring the state C x, 8 obtained in Step 2, where x X | X = 0.153x 211x mod 21 = 8 { | }} 0.136 P

0.1190.17 0.1530.102 0.1360.085 0.1190.068 0.1020.051 0.0850.034 0.0680.017 0.0510.0 0 64 128 192 256 320 384 448 512 0.034

0.017 Fig. 3. Probability distribution of the quantum state after Fourier Transformation. 0.0 0 64 128 192 256 320 384 448 512 where the amplitude is 0 except at multiples of 2m/r.Whentheperiodr does not divide 2m,thetransformapproximatestheexactcasesomostoftheamplitude is attached to Fig. 3. Probability distributionm of the quantum state after Fourierˆ 2 Transformation. Figureintegers III.25: close to Example multiples of probability2 . distribution fxˆ of the quantum Fourier r | | transformExample. ofFiguref.Thespectrumisconcentratednearmultiplesof 3 shows the result of applying the quantum Fourier Transform toN/ the6= m 512wherestate/6=851 obtained the amplitude in/3, Step that is 2.0 Noteexcept is that 85 at Figure1 multiples/3, 170 3 is of the 2/23 graph,/r256,.Whentheperiod of the etc.fast [ﬁg. Fourier source:r transformdoes not Rie divide of↵ theel & 2m,thetransformapproximatestheexactcasesomostoftheamplitude is attachedm to Polakfunction (2000)] shown in Figure 2. Inm this particular example the period of f does not divide 2 . integers close to multiples of 2 . Step 4. Extracting the period.r Measure the state in the standard basis for quantum computation,Example. andFigure call the 3 showsresult v the.Inthecasewheretheperiodhappenstobeapowerof result of applying the quantum Fourier Transform to the2, stateso that obtained the quantum in Step Fourier 2. Note transform that Figure gives 3 is exactly the graph multipl of theesfast of 2 Fourierm/r,theperiodiseasy transform of the function shown in Figure 2. In2 thism particular example the period of f does not divide 2m. to extract. In this case, v = j r for some j.Mostofthetimej and r will be relatively Step 4. Extracting the period. Measure the state in the standard basis for quantum computation, and call the result v.Inthecasewheretheperiodhappenstobeapowerof2, so that the quantum Fourier transform gives exactly multiples of 2m/r,theperiodiseasy 2m to extract. In this case, v = j r for some j.Mostofthetimej and r will be relatively 142 CHAPTER III. QUANTUM COMPUTATION

(The collapsed result register g⇤ has been omitted.) | i If the period r divides N =2n,thenˆf will be nonzero only at multiples of the fundamental frequency N/r.Thatis,thenonzerocomponentswillbe kN/r . If it doesn’t divide evenly, then the amplitude will be concentrated around| i these kN/r . See Fig. III.24 and Fig. III.25 for examples of the probability distributions| i f 2 and fˆ 2. | x| | xˆ|

Step 5 (period extraction): Measure the state in the computational basis.

Period a power of 2: If r N,thentheresultingstatewillbev def= kN/r for some k N.Thereforek/r| = v/N.Ifk and r are relatively prime,| as isi likely, then2 reducing the fraction v/N to lowest terms will produce r in the denominator. In this case the period is discovered.

Period not a power of 2: In the case r does not divide N,it’softenpos- sible to guess the period from a continued fraction expansion of v/N.14 If v/N is suciently close to p/q,thenacontinuedfractionexpansionofv/N will contain the continued fraction expansion of p/q.Forexample,suppose the measurement returns v = 427, which is not a power of two. This is the result of the continued fraction expansion of v/N (in this case, 427/512) (see IQC):

i ai pi qi ✏i 0 0 0 1 0.8339844 1 1 1 1 0.1990632 2 5 5 6 0.02352941 3 42 211 253 0.5

“which terminates with 6 = q2

Step 6 (ﬁnding a factor): The following computation applies however we

14See Rie↵el & Polak (2000, App. B) for an explanation of this procedure and citations for why it works. D. QUANTUM ALGORITHMS 143 got the period q in Step 5. If the guess q is even, then aq/2 +1andaq/2 1 are likely to have common factors with M. Use the Euclidean algorithm to check this. The reason is as follows. If q is the period of g(x)=ax (mod M), then aq =1(modM). This is because, if q is the period, then for all x, g(x + q)=g(x), that is, aq+x = aqax = ax (mod M)forallx.Therefore aq 1=0(modM). Hence, (aq/2 +1)(aq/2 1) = 0 (mod M). Therefore, unless one of the factors is a multiple of M (and hence = 0 mod M), one of them has a nontrivial common factor with M. In the case of our example, the continued fraction gave us a guess q =6,so with a =11weshouldconsider113 +1 = 1332and113 1=1330.ForM = 21 the Euclidean algorithm yields gcd(21, 1332) = 3 and gcd(21, 1330) = 7. We’ve factored 21!

Iteration: There are several reasons that the preceding steps might not have succeeded: (1) The value v projected from the spectrum might not be close enough to a multiple of N/r (D.3.b). (2) In D.3.b, k and r might not be relatively prime, so that the denominator is only a factor of the period, but not the period itself. (3) In D.3.b, one of the two factors turns out to be a multiple of M.(4)InD.3.b,q was odd. In these cases, a few repetitions of the preceding steps yields a factor of M. ⇤

D.3.c Recent progress To read our E-mail, how mean of the spies and their quantum machine; be comforted though, they do not yet know how to factorize twelve or ﬁfteen. — Volker Strassen (Nielsen & Chuang, 2010, p. 216)

In this section we review recent progress in hardware implementation of 144 CHAPTER III. QUANTUM COMPUTATION

Figure III.26: Hardware implementation of Shor’s algorithm developed at UCSB (2012). The Mj are quantum memory elements, B is a quantum “bus,” and the Qj are phase qubits that can be used to implement qubit operations between the bus and memory elements. [source: CPF]

Figure III.27: Circuit of hardware implementation of Shor’s algorithm developed at UCSB. [source: CPF] D. QUANTUM ALGORITHMS 145

Shor’s algorithm.15 In Aug. 2012 a group at UC Santa Barbara described aquantumimplementationofShor’salgorithmthatcorrectlyfactored15 about 48% of the time (50% being the theoretical success rate). (There have been NMR hardware factorizations of 15 since 2001, but there is some doubt if entanglement was involved.) This is a 3-qubit compiled version of Shor’s algorithm, where “compiled” means that the implementation of modular exponentiation is for fixed M and a. This compiled version used a =4asthe coprime to M =15.Inthiscasethecorrectperiodr = 2. The device (Fig. III.26) has nine quantum devices, including four phase qubits and five su- perconducing co-planar waveguide (CPW) microwave resonators. The four CPWs (Mj)canbeusedasmemoryelementsandfifth(B)canbeusedasa “bus” to mediate entangling operations. In e↵ect the qubits Qj can be read and written. Radio frequency pulses in the bias coil can be used to adjust the qubit’s frequency, and gigahertz pulses can be used to manipulate and measure the qubit’s state. SQUIDs are used for one-shot readout of the qubits. The qubits Qj can be tuned into resonance with the bus B or memory elements Mj. The quantum processor can be used to implement the single-qubit gates X, Y, Z, H, and the two-qubit swap (iSWAP) and controlled-phase (C) gates. The entanglement protocol can be scaled to an arbitrary number of qubits. The relaxation and dephasing times are about 200ns. Another group has reported the quantum factoring of 21.16 Their procedure operates by using one qubit instead of the n qubits in the (upper) control qubits. It does this by doing all the unitaries associated with the lowest-order control qubit, then for the next control qubit, updating the work register after each step, for n interations.

15This section is based primarily on Erik Lucero, R. Barends, Y. Chen, J. Kelly, M. Mariantoni, A. Megrant, P. O’Malley, D. Sank, A. Vainsencher, J. Wenner, T. White, Y. Yin, A. N. Cleland & John M. Martinis, “Computing prime factors with a Josephson phase qubit quantum processor.” Nature Physics 8, 719–723 (2012) doi:10.1038/nphys2385 [CPF]. 16See Martin-L´opex et al., “Experimental realization of Shor’s quantum factoring algorithm using qubit recycling,” Nature Photonics 6, 773–6 (2012). 146 CHAPTER III. QUANTUM COMPUTATION

D.4 Search problems D.4.a Overview Many problems can be formulated as search problems over a solution space .17 That is, find the x such that some predicate P (x)istrue.For example,S hard problems such2S as the Hamiltonian path problem and Boolean satisfiability can be formulated this way. An unstructured search problem is a problem that makes no assumptions about the structure of the search space, or for which there is no known way to make use of it (also called a needle in a haystack problem). That is, information about a particular value P (x0)doesnotgiveususableinformationaboutanothervalueP (x1). In contrast, a structured search problem is a problem in which the structure of the solution space can be used to guide the search, for example, searching an alphabetized array. In general, unstructured search takes (M)evaluations, where M = is the size of the solution space (which is oftenO exponential in the size of the|S| problem). On the average it will be M/2(thinkofsearching an unordered array) to find a solution with 50% probability. We will see that Grover’s algorithm can do unstructured search on a quantum computer with bounded probability in (pM)time,thatis,quadratic speedup. This is provably more ecient thanO any algorithm on a classical computer, which is good (but not great). Unfortunately, it has been proved that Grover’s algorithm is optimal for unstructured search. Therefore, to do better requires exploiting the structure of the solution space. Quantum computers do not exempt us from understanding the problems we are trying to solve! Shor’s algorithm is an excellent example of exploiting the structure of a problem domain. Later we will take a look at heuristic quantum search algorithms that do make use of problem structure.

D.4.b Grover’s Algorithm

algorithm Grover:

Input: Let M be the size of the solution space and pick n such that 2n M. 17This section is based primarily on Rie↵el & Polak (2000). 30 E. Rieffel and W. Polak 30 · E. Rieffel and W. Polak · The difficult step is to obtain a useful result from this superposition. The difficult step is to obtain a useful result from this superposition. For any x0 such that P (x0) is true, x0, 1 will be part of the superposition of Eq. 2. SinceFor theany amplitudex0 such that of suchP (x0 a) stateis true, is |x10, 1,theprobabilitythatarandommeasurementi will be part of the superposition of Eq. 2. Since the amplitude of such a state is |12n ,theprobabilitythatarandommeasurementi of the superposition produces x is only22n n.Thetrickistochangethequantumstate 0 n of the superposition produces x0 is only 2 .Thetrickistochangethequantumstate in Eq. 2 so as to greatly increase the amplitude of vectors x0, 1 for which P is true and indecrease Eq. 2 so the as amplitude to greatly of increase vectors thex, 0 amplitudefor which ofP vectorsis false.|x0, 1i for which P is true and decrease the amplitude of vectors |x, 0i for which P is false.| i Once such a transformation of| the quantumi state has been performed, one can simply measureOnce such the last a transformation qubit of the quantum of the quantum state which state represents has been perfP (xormed,).Becauseoftheam- one can simply measureplitude change, the last there qubit is of a thehigh quantum probability state that which the result represents will beP (1x.Ifthisisthecase,the).Becauseoftheam- plitude change, there is a high probability that the result will be 1.Ifthisisthecase,the1 k measurement has projected the state of Eq. 2 onto the subspace xi, 1 where 12k ki=1 measurement has projected the state of Eq. 2 onto the subspace |xi, 1i where k is the number of solutions. Further measurement of the remaining2k bitsi will=1 | providei one k is the number of solutions. Further measurement of the remaining bitsP will provide one of these solutions. If the measurement of qubit P (x) yields 0,thenthewholeprocessisP ofstarted these over solutions. and the If superposition the measurement of Eq. of 2qubit must beP ( computedx) yields 0 a,thenthewholeprocessisgain. startedGrover’s over algorithm and the superposition then consists of of Eq. the 2 following must be computed steps: again. Grover’s algorithm then consists of the following steps: (1) Prepare a register containing a superposition of all possible values x [0 ...2n 1]. i n (1) Prepare a register containing a superposition of all possible values xi 2 [0 ...2 1]. (2) Compute P (xi) on this register. 2 (2) Compute P (xi) on this register. (3) Change amplitude aj to aj for xj such that P (xj )=1.Anefficientalgorithmfor (3) Change amplitude a to a for x such that P (x )=1.Anefficientalgorithmfor D. QUANTUMchanging selected ALGORITHMS signsj is describedj j in section 7.1.2.j A plotoftheamplitudesafter 147 changingthis step is selected shown here. signs is described in section 7.1.2. A plotoftheamplitudesafter this step is shownaverage here. average 0 0

(4) Apply inversion about the average to increase amplitude of xj with P (xj )=1.The Figure(4) Applyquantum III.28: inversion algorithm Depiction about to efﬁciently the of average the performresult to increase inversion of amplitudephase about rotationof theaverageisgiveninsec-xj with (changingP (xj )=1.The the sign) quantum algorithm to efﬁciently perform inversion about theaverageisgiveninsec- of solutionstion 7.1.1. in The Grover’s resulting amplitudesalgorithm. look [source: as shown, Rie where↵el th &eamplitudeofallthe Polak (2000)] xi’s tion 7.1.1. The resulting amplitudes look as shown, where theamplitudeofallthexi’s with P (xi)=0have been diminished imperceptibly. with P (xi)=0have been diminished imperceptibly.

average average

0 0 (5) Repeat steps 2 through 4 p2n times. (5) Repeat steps 2 through 4 4 p2n times. (6) Read the result. 4 Figure(6) Read III.29: the result. Depiction of result of inversion about the mean in Grover’s algorithm.Boyer et.al. [source: [Boyer et Rieal. 1996]providea↵el & Polak detailed (2000)] analysis of the performance of Grover’s algorithm.Boyer et.al. They [Boyer prove et that al. 1996]providea Grover’s algorithm detailed is optimal analysis upofto the a constant performance factor; of no Grover’s quan- algorithm.tum algorithm They can prove perform that Grover’s an unstructured algorithm search is optimal faster. up Thtoey a alsoconstant show factor; that if no there quan- is tum algorithm can perform an unstructured search faster.n They also show that if there is only a single x0 such that P (x0) is true, then after p2 iterations of steps 2 through 4 the def def 8 n only a singlenx0 such that P (x0) isn true,n then after p2 iterations of stepsn 2 through 4 the LetfailureN rate=2 is 0and.5.Afteriterating let N = 2 =p2 0times, 1,...,N the8 failure1 rate,thesetof drops to 2n.Interestingly,-bit strings. We failure rate is 0.5.Afteriterating4 p2{n times the failure rate} drops to 2 n.Interestingly, areadditional given iterations a computable will increase predicate4 the failureP rate.: N For e2xample,.Supposewehaveaquantum after p2n iterations the 2 p n additional iterations will increase the failure rate. For! example, after 2 2 iterations the gatefailure array rate isU closeP (an to 1oracle. ) that computes the predicate: failureThere rate are is many close classical to 1. algorithms in which a procedure is repeated over and over again There are many classical algorithms in which a procedure is repeated over and over again for ever better results. RepeatingU quantumx, y = proceduresx, y mayP (x improve) . results for a while, but for ever better results. Repeating quantumP | i procedures| may improvei results for a while, but

Application: Consider what happens if, as usual, we apply the function to asuperpositionofallpossibleinputs : | 0i 1 1 U 0 = U x, 0 = x, P (x) . P | 0i| i P p | i p | i " N x N # N x N X2 X2 Notice that the components we want, x, 1 ,andthecomponentswedon’t want, x, 0 , all have the same amplitude,| i1 .Soifwemeasurethestate, pN | i n the chances of getting a hit are very small, (2 ). The trick, therefore, is to amplify the components that we want at theO expense of the ones we don’t want; this is what Grover’s algorithm accomplishes. 148 CHAPTER III. QUANTUM COMPUTATION

Sign-change: To do this, ﬁrst we change the sign of every solution (a phase rotation of ⇡). That is, if the state is a x ,P(x ) ,thenwewantto j j| j j i change aj to aj whenever P (xj) = 1. See Fig. III.28. I’ll get to the technique in a moment. P

Inversion about mean: Next, we invert all the components around their mean amplitude (which is a little less than the amplitudes of the non- solutions); the result is shown in Fig. III.29. As a result of this operation, amplitudes of non-solutions go from a little above the mean to a little below it, but amplitudes of solutions go from far below the mean to far above it. This ampliﬁes the solutions.

Iteration: This Grover iteration (the sign change and inversion about the mean) is repeated ⇡pN times. Thus the algorithm is (pN). 4 O

Measurement: Measurement yields an x0 for which P (x0)=1withhigh ⇡pN probability. Speciﬁcally, if there is exactly one solution x0 ,then 8 ⇡pN 2S iterations will yield it with probability 1/2. With 4 iterations, the prob- n ability of failure drops to 1/N =2 . Unlike with most classical algorithms, additional iterations will give a worse result! This is because Grover iterations are unitary rotations, and so excessive rotations can rotate past the solution. Therefore it is critical to know when to stop. Fortunately there is a quantum technique (Brassard et al. 1998) for determining the optimal stopping point. Grover’s iteration can be used for a wide variety of problems as a part of other quantum algorithms. ⇤

In the following geometric analysis, I will suppose that there is just one answer ↵ such that P (↵)=1;then ↵ is the desired answer vector. Let ! be a uniform superposition of all| thei other (non-answer) states, and observe| i that ↵ and ! are orthonormal. Therefore, initially the state is | i | i 1 N 1 = ↵ + ! .Ingeneral,afterk iterations the state is = | 0i pN | i N | i | ki q D. QUANTUM ALGORITHMS 149

2â

Figure III.30: Process of inversion about the mean in Grover’s algorithm. The black lines represent the original amplitudes aj.Theredlinesrepresent 2¯a a ,withthearrowheadsindicatingthenewamplitudesa0 . j j a ↵ + w ! ,forsomea, w with a 2 + w 2 =1. | iThe sign| i change operation transforms| | | | the state as follows:

= a ↵ + w ! a ↵ + w ! = 0 , | ki | i | i 7! | i | i | ki where I’ve called the result k0 .Thisisareflectionacrossthe! vector, which means that it will be useful| i to look at reflections more generally.| i Suppose that and ? are orthonormal vectors and that = a ? + b is an arbitrary| i vector| ini the space they span. The reflection| ofi |acrossi | i | i is 0 = a ? + b . Since a = ? and b = ,weknow | i | i | i | i h | i h | i = + ? ? ,andyoucanseethat 0 = | i | ih | i | ih | i | i def | ih | ? ? . Hence the operator to reflect across is R = i| ih | i | i | ih | ? ? . Alternate forms of this operator are 2 I and I 2 ? ? , that| ih is,| subtract twice the perpendicular component.| ih | | ih | The sign change can be expressed as a reflection: R = ! ! ↵ ↵ = I 2 ↵ ↵ , ! | ih || ih | | ih | which expresses the sign-change of the answer vector clearly. Of course we don’t know ↵ ,whichiswhywewillhavetouseadi↵erentprocessto accomplish this| i reflection (see p. 150). We also will see that the inversion about the mean is equivalent to reflecting that state vector across 0 . But first, taking this for granted, let’s see the e↵ect of the Grover| iterationi (Fig. III.31). Let ✓ be the angle between and ! .It’sgivenbytheinner | 0i | i 150 CHAPTER III. QUANTUM COMPUTATION

|α〉

|ψ1〉

|ψ 〉 2θ 0 θ θ |ω〉

|ψ'0〉

Figure III.31: Geometry of ﬁrst Grover iteration.

N 1 product cos ✓ = ! = .Thereforethesignchangereﬂects h 0 | i N | 0i from ✓ above ! into 0 ,whichisq ✓ below it. Inversion about the mean | i | 0i reﬂects 0 from 2✓ below into a state we call ,whichis2✓ above it. | 0i | 0i | 1i Therefore, in going from 0 to 1 the state vector has rotated 2✓ closer to ↵ . | i | i | i You can see that after k iterations, the state vector k will be (2k +1)✓ above ! .Wecansolve(2k +1)✓ = ⇡/2 to get the| requiredi number of iterations| i to bring to ↵ . Note that for small ✓, ✓ sin ✓ = 1 (which | ki | i ⇡ pN is certainly small). Hence, we want (2k +1)/pN ⇡/2, or 2k +1 ⇡pN/2. That is, k ⇡pN/4 is the required number of⇡ iterations. Note⇡ that after ⇡pN/8iterations,weareabouthalfwaythere(i.e.,⇡ ⇡/4), so the probability of success is 50%. In general, the probability of success is about sin2 2k+1 . pN Now for the techniques for changing the sign and inversion about the mean. Let be the state after k iterations (k 0). To change the sign, | ki simply apply UP to k .Toseetheresult,letX0 = x P (x)=0 and X = x P (x)=1|,thesolutionset.Then:i|i { | } 1 { | } U P | ki|i = U a x, P x| i "x N # X2 D. QUANTUM ALGORITHMS 151

1 = U a x, 0 a x, 1 P p x| i x| i " 2 x N # X2 1 = UP ax x, 0 + ax x, 0 ax x, 1 ax x, 1 p2 | i | i | i | i "x X0 x X1 x X0 x X1 # X2 X2 X2 X2 1 = axUP x, 0 + axUP x, 0 p2 | i | i "x X0 x X1 X2 X2 a U x, 1 a U x, 1 x P | i x P | i x X0 x X1 # X2 X2 1 = ax x, 0 + ax x, 1 p2 | i | i "x X0 x X1 X2 X2 a x, 1 0 a x, 1 1 x| i x| i x X0 x X1 # X2 X2 1 = ax x 0 + ax x 1 ax x 1 ax x 0 p2 | i| i | i| i | i| i | i| i "x X0 x X1 x X0 x X1 # X2 X2 X2 X2 1 = ax x ax x ( 0 1 ) p2 | i | i | i| i x X0 x X1 ! X2 X2 = a x a x . x| i x| i |i x X0 x X1 ! X2 X2

Therefore the signs of the solutions have been reversed (they have been rotated by ⇡). Notice how in the target register can be used to separate the 0 and 1 results by rotation.|i This is a useful idea! It remains to show the connection between inversion about the mean and reﬂection across 0 .ThisreﬂectionisgivenbyR 0 =2 0 0 I. Note that: | i | ih |

1 1 1 = x y = x y . | 0ih 0| p | i p h | N | ih | N x N ! N y N ! x N y N X2 X2 X2 X2 152 CHAPTER III. QUANTUM COMPUTATION

This is the di↵usion matrix:

1 1 1 N N N 1 1 ··· 1 N N N 0 . . ···. . 1 , . . .. . B 1 1 1 C B C B N N ··· N C @ A which, as we will see, does the averaging.

To perform inversion about the mean, leta ¯ be the average of the aj (see Fig. III.30). Inversion about the mean is accomplished by the transformation:

a x (2¯a a ) x . j| ji 7! j | ji j N j N X2 X2

To see this, write aj =¯a j,thatis,asadi↵erencefromthemean.Then 2¯a a =2¯a (¯a )=¯± a .Thereforeanamplitude below the j ± j ⌥ j j mean will be transformed to j above, and vice verse. But an amplitude that is negative, and thus very far below the mean, will be transformed to an amplitude much above the mean. This is exactly what we want in order to amplify the negative components, which correspond to solutions. Inversion about the mean is accomplished by a “Grover di↵usion transformation” D.ToderivethematrixD,considerthenewamplitudeaj0 as a function of all the others:

N 1 def 1 2 2 a0 =2¯a a =2 a a = a + 1 a . j j N k j N k N j k=0 ! k=j ✓ ◆ X X6 2 2 This matrix has N 1onthemaindiagonaland N in the o↵-diagonal elements: 2 2 2 N 1 N N 2 2 ··· 2 N N 1 N D = 0 . . ···. . 1 ...... B 2 2 2 C B 1 C B N N ··· N C @ A Note that D =2 0 0 I = R 0 .ItiseasytoconﬁrmthatDD† = I (Exer. III.49), so the matrix| ih is| unitary and therefore a possible quantum operation, but it remains to be seen if it can be implemented eciently. D. QUANTUM ALGORITHMS 153

Figure III.32: Circuit for Grover’s algorithm. The Grover iteration in the ⇡pN dashed box is repeated 4 times.

n We claim D = WRW,whereW = H⌦ is the n-qubit Walsh-Hadamard transform and R is the phase rotation matrix:

10 0 ··· def 0 1 0 R = 0 . . ···. . 1 ...... B C B 00 1 C B ··· C @ A To see this, let 20 0 ··· def 00 0 R0 = R + I = 0 . . ···. . 1 ...... B C B 00 0 C B ··· C @ A Then WRW = W (R0 I)W = WR0W WW = WR0W I.Itiseasyto show (Exer. III.50) that:

2 2 2 N N N 2 2 ··· 2 N N N WR0W = 0 . . ···. . 1 ...... B 2 2 2 C B C B N N ··· N C @ A It therefore follows that D = WR0W I = WRW. See Fig. III.32 for a diagram of Grover’s algorithm. 154 CHAPTER III. QUANTUM COMPUTATION

It remains to consider the possibility that there may be several solutions ⇡pN/s to the problem. If there are s solutions, then run the Grover iteration 4 times, which is optimal (Exer. III.51). It can be done in N/s iterations even if s is unknown. p

D.4.c Hogg’s heuristic search algorithms

Many important problems can be formulated as constraint satisfaction problems,inwhichwetrytofindasetofassignmentstovariablesthatsatisfy specified constraints.MorespecificallyletV def= v ,...,v be a set of vari- { 1 n} ables, and let X def= x ,...,x be a set of values that can be assigned to { 1 n} the variables, and let C1,...,Cl be the constraints. The set of all possible assignments of values to variables is V X.Subsetsofthissetcorrespond ⇥ to full or partial assignments, including inconsistent assignments. The set of all such assignments is (V X). P ⇥ The sets of assignments form a lattice under the partial order (Fig. III.33). By assigning bits to the elements of V X,elementsof✓ (V X) ⇥ ⇥ can be represented by mn-element bit strings (i.e., integers in theP set MN = 0,...,2mn 1 ); see Fig. III.34. Hogg’s algorithms are based on the observation{ that if} an assignment violates the constraints, then so do all those assignments above it in the lattice. algorithm Hogg:

Initialization: The algorithm begins with all the amplitude concentrated in the bottom of the lattice, 0 0 (i.e., the empty set of assignments). | ··· i

Movement: The algorithm proceeds by moving amplitude up the lattice, while avoiding assignments that violate the constraints; that is, we want to move amplitude from a set to its supersets. For example, we want to redistribute the amplitude from 1010 to 1110 and 1011 . Hogg has developed several methods. One method| i is based| i on the| assumptioni that the mn transformation has the form WDW,whereW = H⌦ ,themn-dimensional Walsh-Hadamard transformation, and D is diagonal. The elements of D D. QUANTUM ALGORITHMS 155

Introduction to Quantum Computing 33

v1 =0 · v1 =1 8 v2 =0 < v2 =1 :

v1 =1 v1 =0 v1 =0 v1 =0 v2 =0 v2 =0 v1 =1 v1 =1 v2 =1v2 =1v2 =1v2 =0

v2 =0 v1 =1 v1 =0 v1 =1 v1 =0 v1 =0 v2 =1 v2 =1 v2 =1 v2 =0 v2 =0 v1 =1 ⇢ ⇢ ⇢ ⇢ ⇢ ⇢

v1 =0 v1 =1 v2 =0 v2 =1 { }{}{}{ }

Fig. 4. Lattice of variable assignments in a CSP Figure III.33: Lattice of variable assignments. [source: Rie↵el & Polak (2000)] 1 rn 1 r0 = ( 0 +( 1) 1 ) ... ( 0 +( 1) 1 ) p2n | i | i ⌦ ⌦ | i | i 2n 1 1 sn 1rn 1 s0r0 = ( 1) sn 1 ... ( 1) s0 p n | i⌦ ⌦ | i 2 s=0 X 2n 1 1 s r = ( 1) · s . p n | i 2 s=0 X 7.2.2 Overview of Hogg’s algorithms. Aconstraintsatisfactionproblem(CSP)hasn variables V = v ,...,v which can take m different values X = x ,...,x subject { 1 n} { 1 m} to certain constraints C1,...,Cl.Solutionstoaconstraintsatisfactionproblemlieinthe space of assignments of xi’s to vj ’s, V X.Thereisanaturallatticestructureonthisspace given by set containment. Figure 4 shows⇥ the assignment spaceanditslatticestructurefor n =2, m =2, x1 =0,andx2 =1.Notethatthelatticeincludesbothincompleteand inconsistent assignments. Using the standard correspondence between sets of enumerated elements and binary sequences, in which a 1 in the nth place corresponds to inclusion of the nth element and a 0 corresponds to exclusion, standard basis vectors for a quantum state space can be put in one to one correspondence with the sets. For example, Figure 5showsthelatticeofFigure 4rewritteninketnotationwheretheelementsv1 =0, v1 =1, v2 =0and v2 =1have been enumerated in that order. If a state violates a constraint, then so do all states above itinthelattice.Theapproach 34 E. Rieffel and W. Polak 156 · CHAPTER III. QUANTUM COMPUTATION

1111 | 1110 1101 1011 0111 | | | | 1100 1010 1001 0110 0101 0011 | | | | | | 1000 0100 0010 0001 | | | | 0000 |

Fig. 5. Lattice of variable assignments in ket form Figure III.34: Lattice of binary strings corresponding to all subsets of a 4- elementHogg set. takes[source: in designing Rie↵el quantum & Polak algorithms (2000)] for constraint satisfaction problems is to begin with all the amplitude concentrated in the 0 ...0 state and to iteratively move amplitude up the lattice from sets to supersets and| away fromi sets that violate the constraints. dependNote on the that size this algorithm of the sets. begins Recall differently (D.1.b, than Shor’s p. 129) algorithm that and Grover’s algorithm, which both begin by computing a function on a superposition ofalltheinputvaluesat once. 1 x z Hogg gives twoW waysx [Hogg= 1996; Hogg( 1998]) · ofz constructing. a unitary matrix for | i p mn | i moving amplitude up the lattice. We2 willz describeMN both methods, and then describe how he moves amplitude away from bad sets. 2X As shownMoving in Sec. amplitude A.2.c (p. up: 70), Method we can 1. deriveThere a is matrix an obvious representation transformation thatfor W moves: amplitude from sets to supersets. Any amplitude associated to the empty set is evenly distributed amongW alljk sets= withj a singleW element.k Any amplitude associated to a set with a single element is evenly distributedh | among| i all two element sets which contain that element 1 k z and so on. For the lattice= of a threej element set ( ) · z h |p mn | i 2 z MN 2111 |Xi 1 k z = ( ) · j z p mn h | i 2 z MN 011 2 101 110 | i X| i | i 1 k j = (1) · . p2mn 001 010 100 | i | i | i Note that k j = k j ,whereontheright-handsideweinterpretthebit strings as sets.· | \ | 000 ⇤ | i We want to transform

000 1/p3( 001 + 010 + 100 | i! | i | i | i D. QUANTUM ALGORITHMS 157

The general approach is to try to steer amplitude away from sets that violate the constraints, but the best technique depends on the particular problem. One technique is to invert the phase on bad subsets so that they tend to cancel the contribution of good subsets to supersets. This could be done by a process like Grover’s algorithm using a predicate that tests for violation of constraints. Another approach is to assign random phases to bad sets. It is dicult to analyze the probability that an iteration of a heuristic algorithm will produce a solution, and so its eciency is usually evaluated empirically, but empirical tests will be dicult to apply to quantum heuristic search until larger quantum computers are available, since classical computers require exponential time to simulate quantum systems. Small simulations, however, indicate that Hogg’s algorithms may provide polynomial speedup over Grover’s algorithm. 158 CHAPTER III. QUANTUM COMPUTATION

Figure III.35: E↵ects of decoherence on a qubit. On the left is a qubit y that is mostly isoloated from its environment ⌦ .Ontheright,aweakinteraction| i between the qubit and the environment| hasi led to a possibly altered qubit x and a correspondingly (slightly) altered environment ⌦ . | i | xyi

D.5 Quantum error correction

D.5.a Motivation

Quantum coherence is very dicult to maintain for long.18 Even weak inter- actions with the environment can a↵ect the quantum state, and we’ve seen that the amplitudes of the quantum state are critical to quantum algorithms. On classical computers, bits are represented by very large numbers of parti- cles (but that is changing). On quantum computers, qubits are represented by atomic-scale states or objects (photons, nuclear spins, electrons, trapped ions, etc.). They are very likely to become entangled with computationally irrelevant states of the computer and its environment, which are out of our control. Quantum error correction is similar to classical error correction in that additional bits are introduced, creating redundancy that can be used to correct errors. It is di↵erent from classical error correction in that: (a) We want to restore the entire quantum state (i.e., the continuous amplitudes), not just 0s and 1s. Further, errors are continuous and can accumulate. (b) It must obey the no-cloning theorem. (c) Measurement destroys quantum information.

18This section follows Rie↵el & Polak (2000). D. QUANTUM ALGORITHMS 159

D.5.b Effect of decoherence Ideally the environment ⌦ ,consideredasaquantumsystem,doesnotinter- act with the computational| i state. But if it does, the e↵ect can be categorized as a unitary transformation on the environment-qubit system. Consider decoherence operator D describing a bit ﬂip error in a single qubit (Fig. III.35):

⌦ 0 = ⌦ 0 + ⌦ 1 D : 00 10 . |⌦i|1i =)|⌦ i|0i + |⌦ i|1i ⇢ | i| i )|01i| i | 11i| i In this notation the state vectors ⌦ are not normalized, but incorporate | xyi the amplitudes of the various outcomes. In the case of no error, ⌦00 = ⌦ = ⌦ and ⌦ = ⌦ = 0.Iftheentanglementwiththeenvironment| i | 11i | i | 01i | 10i is small, then ⌦01 , ⌦10 1(smallexchangeofamplitude). k k k k⌧ def Deﬁne decoherence operators Dxy ⌦ = ⌦xy ,forx, y 2,whichdescribe the e↵ect of the decoherence on the environment.| i | i (These are2 not unitary, but are the products of scalar amplitudes and unitary operators for the various outcomes.) Then the evolution of the joint system is deﬁned by the equations:

D ⌦ 0 =(D I + D X) ⌦ 0 , | i| i 00 ⌦ 10 ⌦ | i| i D ⌦ 1 =(D X + D I) ⌦ 1 . | i| i 01 ⌦ 11 ⌦ | i| i Alternately, we can deﬁne it:

D = D 0 0 + D 1 0 + D 0 1 + D 1 1 . 00 ⌦| ih | 10 ⌦| ih | 01 ⌦| ih | 11 ⌦| ih | Now, it’s easy to show (Exer. III.19): 1 1 1 1 0 0 = (I + Z), 0 1 = (X Y ), 1 0 = (X + Y ), 1 1 = (I Z), | ih | 2 | ih | 2 | ih | 2 | ih | 2 0 1 where Y = .Therefore 10 ✓ ◆ 1 D = [D (I + Z)+D (X Y )+ 2 00 ⌦ 01 ⌦ D (X + Y )+D (I Z)] 10 ⌦ 11 ⌦ 1 = [(D + D ) I +(D + D ) X + 2 00 11 ⌦ 10 01 ⌦ (D D ) Y +(D D ) Z]. 10 01 ⌦ 00 11 ⌦ 160 CHAPTER III. QUANTUM COMPUTATION

Therefore the bit flip error can be described as a linear combination of the Pauli matrices. It is generally the case that the e↵ect of decoherence on a single qubit can be described by a linear combination of the Pauli matrices, which is important, since qubits are subject to various errors beside bit flips. This is a distinctive feature about quantum errors: they have a finite basis, and because they are unitary, they are therefore invertible. In other words, single-qubit errors can be characterized in terms of a linear combination of the Pauli matrices (which span the space of 2 2self-adjointunitary matrices: C.2.a, p. 105): I (no error), X (bit flip error),⇥ Y (phase error), and Z = YX (bit flip phase error). Therefore a single qubit error is represented 3 by e00 +e11 +e22 +e33 = j=0 ejj,wherethej are the Pauli matrices (Sec. C.2.a, p. 105). P

D.5.c Correcting the quantum state

We consider a basis set of unitary “error operators” Ej,sothattheerror def transformation is a superposition E = j ejEj.Inthemoregeneralcase of quantum registers, the Ej a↵ect the entire register, not just a single qubit. P algorithm quantum error correction:

Encoding: An n-bit register is encoded in n + m bits, where the extra bits are used for error correction. Let y def= C(x) 2m+n be the n + m bit code for x 2n. As in classical error correcting codes,2 we embed the message in aspaceofhigherdimension.2

Error process: Supposey ˜ 2m+n is the result of error type k,˜y = E (y). 2 k

Syndrome: Let k = S(˜y)beafunctionthatdeterminestheerrorsyndrome, which identiﬁes the error Ek from the corrupted code. That is, S(Ek(y)) = k.

Correction: Since the errors are unitary, and the syndrome is known, we 1 can invert the error and thereby correct it: y = ES(˜y)(˜y). D. QUANTUM ALGORITHMS 161

Figure III.36: Circuit for quantum error correction. is the n-qubit quantum state to be encoded by C,whichaddsm error-correction| i qubits to yield the encoded state . E is a unitary superposition of error operators Ej, which alter the quantum| i state to ˜ . S is the syndrome extraction operator, which computes a superposition| ofi codes for the errors E.Thesyndrome register is measured, to yield a particular syndrome code j⇤,whichisusedto 1 select a corresponding inverse error transformation E to correct the error. j⇤

Quantum case: Now consider the quantum case, in which the state is a superposition of basis vectors, and the error is a superposition of error| types,i

E = j ejEj. This is an orthogonal decomposition of E (see Fig. III.36). P Encoding: The encoded state is def= C 0 .Thereareseveralrequire- ments for a useful quantum error| correctingi | i code.| i Obviously, the codes for orthogonal inputs must be orthogonal; that is, if 0 =0,thenC , 0 h | i | i and C 0, 0 are orthogonal: , 0 C†C 0, 0 = 0. Next, if and 0 are the codes| ofi distinct inputs, weh do not| want| themi to be confused| i by the| errori processes, so E†E 0 =0foralli, j. Finally, we require that for each h | j k| i pair of error indices j, k,thereisanumbermjk such that Ej†Ek = mjk for every code . This means that the error syndromes areh | independent| i of the codes, and| thereforei the syndromes can be measured without collapsing superpositions in the codes, which would make them useless for quantum computation.

Error process: Let ˜ def= E be the code corrupted by error. | i | i 428 Quantum error-correction

the logical 0 and logical 1 states, not the physical zero and one states. A circuit 162performing this| ⟩ encoding is illustrated| ⟩ CHAPTER in Figure III. 10.2. QUANTUM COMPUTATION

ψ | ⟩ • • 0 | ⟩ ⊕ 0 | ⟩ ⊕ Figure 10.2. Encoding circuit for the three qubit bit ﬂip code. The data to be encoded enters the circuit on the top Figureline. III.37: Quantum encoding circuit for triple repetition code. [source: NC] Exercise 10.1: Verify that the encoding circuit in Figure 10.2 works as claimed.

Suppose the initial state a 0 + b 1 has been perfectly encoded as a 000 + b 111 . Syndrome extraction:| ⟩Apply| ⟩ the syndrome extraction| operator⟩ | to⟩ the encodedEach of the state, three augmented qubits is passed with through enough an independent extra qubits copy to of therepresent bit flip channel. the set of syndromes.Suppose a bit This flip occurred yields aon superposition one or fewer ofthe of syndromes: qubits. There is a simple two stage error-correction procedure which can be used to recover the correct quantum state in this case: S ˜, 0 = S e E 0 = e (SE 0 )= e (E j ). | i j j| i ⌦| i j j| i| i j j| i| i (1) Error-detection j or syndrome! diagnosis:Weperformameasurementwhichtellsusj j what error, ifX any, occurred on the quantumX state. The measurementX result is called the error syndrome.Forthebitflipchanneltherearefourerrorsyndromes, corresponding to the four projection operators: Measurement: Measure the syndrome register to obtain some j⇤ and the P0 000 19000 + 111 111 no error (10.5) collapsed state Ej⇤ ≡ |j⇤ .⟩⟨ | | ⟩⟨ | P1| i| 100i 100 + 011 011 bit flip on qubit one (10.6) ≡ | ⟩⟨ | | ⟩⟨ | P2 010 010 + 101 101 bit flip on qubit two (10.7) ≡ | 1 ⟩⟨ | | ⟩⟨ | Correction: Apply Ej to correct the error. P3 001⇤ 001 + 110 110 bit flip on qubit three. (10.8) ⇤ ≡ | ⟩⟨ | | ⟩⟨ | Suppose for example that a bit flip occurs on qubit one, so the corrupted state is a 100 + b 011 .Noticethat ψ P1 ψ =1inthiscase,sotheoutcomeofthe | ⟩ | ⟩ ⟨ | | ⟩ Notemeasurement the remarkable result (the errorfact thatsyndrome) although is certainly there 1. was Furthermore, a superposition the syndrome of er- measurement does not cause any change to the state: it is a 100 + b 011 both rors, we only have to correct one of them to get the original state back. This before and after syndrome measurement. Note that the syndrome| ⟩ contains| ⟩ only is becauseinformation measurement about what error of the has error occurred, syndrome and does collapses not allow into us to a infer state anything a↵ected by justabout that the onevalue error. of a or b,thatis,itcontainsnoinformationaboutthestatebeing protected. This is a generic feature of syndrome measurements, since to obtain D.5.dinformationExample about the identity of a quantum state it is in general necessary to perturb that state. We’ll(2) Recovery work through:Weusethevalueoftheerrorsyndrometotelluswhatproceduretouse an example to illustrate the error correction process. For an example,to recover thesuppose initial state. we use For a example, simple if triple the error redundancy syndrome was code 1, indicating that assigns a bit flip on the first qubit, then we flip that qubit again, recovering the original state 19As we mentioned the discussion of in Shor’s algorithm (p. 140), it is not necessary to actuallya 000 perform+ b 111 thewith measurement; perfect accuracy. the same The e↵ect four can possible be obtained error syndromes by unitary and operations. the recovery| ⟩ procedure| ⟩ in each case are: 0 (no error) – do nothing; 1 (bit flip on first qubit) – flip the first qubit again; 2 (bit flip on second qubit) – flip the second qubit D. QUANTUM ALGORITHMS 163

0 000 and 1 111 .Thisisaccomplishedbyasimplequantumgate array:| i 7! | i | i 7! | i C 0 00 = 000 ,C1 00 = 111 . | i| i | i | i| i | i This is not a sophisticated code! It’s called a repetition code.Thethree-qubit codes are called logical zero and logical one (See Fig. III.37). This code can correct single bit ﬂips (by majority voting); the errors are represented by the operators:

E = I I I 0 ⌦ ⌦ E = I I X 1 ⌦ ⌦ E = I X I 2 ⌦ ⌦ E = X I I. 3 ⌦ ⌦ The following works as a syndrome extraction operator:

S x ,x ,x , 0, 0, 0 def= x ,x ,x ,x x ,x x ,x x . | 3 2 1 i | 3 2 1 1 2 1 3 2 3i The scompareeachpairofbits,andsothe will be zero if the two bits are the same (the majority). The following table shows the bit ﬂipped (if any), the corresponding syndrome, and the operator to correct it (which is the same as the operator that caused the error):

bit ﬂipped syndrome error correction none 000 I I I 1 |110i I ⌦ I ⌦ X 2 |101i I ⌦ X⌦ I 3 |011i X⌦ I ⌦ I | i ⌦ ⌦ (Note that the correction operators need not be the same as the error operators, although they are in this case.) For an example, suppose we want to encode the state = 1 ( 0 1 ). | i p2 | i| i Its code is = 1 ( 000 111 ). Suppose the following error occurs: p2 4 | i 3 | i| i E = 5 X I I + 5 I X I (that is, the bit 3 ﬂips with probability 16/25, and bit 2⌦ with⌦ probability⌦ ⌦ 9/25). The resulting error state is

˜ = E | i | i 4 3 1 = X I I + I X I ( 000 111 ) 5 ⌦ ⌦ 5 ⌦ ⌦ p2 | i| i ✓ ◆ 164 CHAPTER III. QUANTUM COMPUTATION

4 3 = X I I( 000 111 )+ I X I( 000 111 ) 5p2 ⌦ ⌦ | i| i 5p2 ⌦ ⌦ | i| i 4 3 = ( 100 011 )+ ( 010 101 ). 5p2 | i| i 5p2 | i| i Applying the syndrome extraction operator yields: 4 3 S ˜, 000 = S ( 100000 011000 )+ ( 010000 101000 ) | i 5p2 | i| i 5p2 | i| i  4 3 = ( 100011 011011 )+ ( 010101 101101 ) 5p2 | i| i 5p2 | i| i 4 3 = ( 100 011 ) 011 + ( 010 101 ) 101 5p2 | i| i ⌦| i 5p2 | i| i ⌦| i Measuring the syndrome register yields either 011 (representing an error in bit 3) or 101 (representing an error in bit 2).| Supposei we get 011 .The state collapses| i into: | i 1 ( 100 011 ) 011 . p2 | i| i ⌦| i Note that we have projected into a subspace for just one of the two bit-flip errors that occurred (the flip in bit 3). The measured syndrome 011 tells us to apply X I I to the first three bits, which restores : | i ⌦ ⌦ | i 1 1 (X I I) ( 100 011 )= ( 000 111 )= . ⌦ ⌦ p2 | i| i p2 | i| i | i We can do something similar to correct single phase flip (Z)errorsbyusing the encoding 0 +++ , 1 (Exer. III.54). To see this, recall that Z in the| signi 7! basis | isi the| i analog 7! | of iX is the computational basis.

D.5.e Discussion There is a nine-qubit code, called the Shor code, that can correct arbitrary errors on a single qubit, even replacing the entire qubit by garbage (Nielsen & Chuang, 2010, 10.2). The essence of this code is that triple redundancy is used to correct §X errors, and triple redundancy again to correct Z errors, thus requiring nine code qubits for each logical qubut. Since Y = ZX and the Pauli matrices are a basis, this code is able to correct all errors. Quantum error correction is remarkable in that an entire continuum of errors can be corrected by correcting only a discrete set of errors. This D. QUANTUM ALGORITHMS 165 works in quantum computation, but not classical analog computing. The general goal in syndrome extraction is to separate the syndrome information from the computational information in such a way that the syndrome can be measured without collapsing any of the computational information. Since the syndrome is unitary, it can be inverted to correct the error. What do we do about noise in the gates that do the encoding and decod- ing? It is possible to do fault-tolerant quantum computation.“Evenmore impressively, fault-tolerance allow us to perform logical operations on encoded quantum states, in a manner which tolerates faults in the underlying gate operations.” (Nielsen & Chuang, 2010, p. 425) Indeed, “provided the noise in individual quantum gates is below a certain constant threshold it is possible to eciently perform an arbitrarily large quantum computation.” (Nielsen & Chuang, 2010, p. 425)20

20See Nielsen & Chuang (2010, 10.6.4). §