Exponential Algorithmic Speedup by a Quantum Walk

Andrew M. Childs∗ Richard Cleve† Enrico Deotto∗ Edward Farhi∗

Sam Gutmann‡ Daniel A. Spielman§

ABSTRACT 1. INTRODUCTION We construct a black box graph traversal problem that A primary goal of the field of quantum computation is can be solved exponentially faster on a quantum computer to determine when quantum computers can solve prob- than on a classical computer. The quantum algorithm is lems faster than classical computers. Exponential quan- based on a continuous time quantum walk, and thus em- tum speedup has been demonstrated for a number of dif- ploys a different technique from previous quantum algo- ferent problems, but in each case, the quantum algorithm rithms based on quantum Fourier transforms. We show for solving the problem relies on the quantum Fourier how to implement the quantum walk efficiently in our transform. The purpose of this paper is to demonstrate black box setting. We then show how this quantum walk that exponential speedup can be achieved by a different solves our problem by rapidly traversing a graph. Finally, algorithmic technique, the quantum walk. We show that we prove that no classical algorithm can solve the problem quantum walks can solve a black box problem exponen- in subexponential time. tially faster than any classical algorithm. Black box problems provided the first examples of algorithmic speedup using quantum instead of classical com- Categories and Subject Descriptors puters. Deutsch gave an example of a problem [10] that F. [Theory of Computation]: Computation by can be solved on a quantum computer using one query, but Abstract Devices that requires two queries on a classical computer. This was followed by a series of black box problems [11, 6, 26] with General Terms increasingly strong quantum versus classical query complexity separations—including exponential ones. These Theory results contributed to Shor’s discovery of polynomial-time algorithms for integer factorization and discrete logarithms Keywords [25]. A number of generalizations and variations of these algorithms have been discovered for solving both black Quantum algorithms, quantum walks box and conventional problems with exponential speedup (e.g., [19, 23, 5, 8, 16, 9, 14, 17, 28, 15]). All of them are ∗Center for Theoretical Physics, Massachusetts Institute of Technology, Cambridge, MA 02139. [email protected], fundamentally based on quantum Fourier transforms. [email protected], [email protected] Since many classical algorithms are based on random †Dept. of Computer Science, Univ. of Calgary, Calgary, walks, it is natural to ask whether a quantum analogue Alberta, Canada T2N 1N4. [email protected] of a random walk process might be useful for quantum ‡Dept. of Mathematics, Northeastern University, Boston, computation. This idea was explored by Farhi and Gut- MA 02115. [email protected] mann [12], who proposed the model of a quantum walk §Dept. of Mathematics, Massachusetts Institute of Tech- used in the present paper. They gave an example of a nology, Cambridge, MA 02139. [email protected] graph in which the time to propagate between two vertices is exponentially faster for the quantum walk than for the corresponding classical random walk. A simpler example was given in [7]. However, as we explain in Sec- Permission to make digital or hard copies of all or part of this work for tion 2, these results do not imply algorithmic speedup. In personal or classroom use is granted without fee provided that copies are the present paper, we modify the example presented in not made or distributed for profit or commercial advantage and that copies [7] and construct a black box problem based on it that bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific can be solved efficiently a quantum algorithm that simu- permission and/or a fee. lates a quantum walk, whereas no classical algorithm can STOC’03, June 9–11, 2003, San Diego, California, USA. solve the problem in subexponential time. Although the Copyright 2003 ACM 1-58113-674-9/03/0006 ...$5.00.

but also than any classical algorithm one can design to traverse the graph. Before we describe the modiﬁed graphs, we provide a black box framework in which graphs can be speciﬁed, and where our notion of an algorithm traversing agraphcanbemadeprecise. Let G =(V(G),E(G)) be a graph with N vertices. To represent G as a black box, let m be such that 2m >Nand

let k be at least as large as the maximum vertex degree eÜiØ eÒØÖaÒce in G. Assign each vertex a V (G) a distinct m-bit string as its name, except do not∈ assign 11 ...1 as the name of any vertex. For each vertex a V (G), assign the outgoing edges of a labels from a set L∈of size k.Fora 0,1 m ∈{ } and c L, define vc(a) as the adjacent vertex reached by following∈ the outgoing edge of a labeled by c,ifsuch an edge exists. If no such edge exists or if a V (G) 6∈ then vc(a)=11...1. The resulting black box for G takes c L and a 0,1 m as input and returns the value of ∈ ∈{ } vc(a). For quantum algorithms, this operation is defined Figure 1: The graph G4. as a unitary transformation U in the usual way. That is, for a, b 0,1 m and c L, ∈{ } ∈ U c, a, b = c, a, b vc(a) , (1) quantum walk is defined as a continuous time process, our | i | ⊕ i quantum algorithm simulates a good approximation of it where denotes bitwise addition modulo 2. in the conventional quantum circuit model. We now⊕ define a notion of traversing a graph G from its We note that the quantum analogue of a classical ran- entrance to its exit. dom walk is not unique, and other models have been proposed. Whereas the states of the continuous time quan- Definition 1. Let G be a graph and entrance and tum walk used in this paper lie in a Hilbert space spanned exit be two vertices of G. The input of the traversal prob- by states corresponding to the vertices in the graph, these lem is a black box for G and the name of the entrance. alternative models operate in discrete time and make use The output is the name of the exit. of an extra state space (e.g., to implement a “quantum

coin”) [21, 29, 2, 4]. As far as we know, our results are For the graphs Gn,setentrance and exit to the left the first example of algorithmic speedup based on either root and the right root of the trees, respectively. This discrete or continuous time quantum walks. instance of the traversal problem can be solved in time The structure of this paper is as follows. In Section 2, polynomial in n using a classical algorithm that is not a we define our problem. In Section 3, we present a quantum random walk. The key is that we can always tell whether algorithm for solving this problem in polynomial time with a particular vertex is in the central column by checking its high probability, and in Section 4, we show that the prob- degree. We begin at the entrance.Ateachvertex,we lem cannot be solved classically in subexponential time query the oracle and move to one of the two unvisited ad- with non-negligible probability. We conclude with a dis- jacent vertices. After n steps, we reach the central column cussion of the results in Section 5. and then proceed moving to unvisited adjacent vertices in the right tree, checking the degree at each step. If we dis- 2. THE GRAPH TRAVERSAL PROBLEM cover that after s steps we are again at a central vertex, we know that the wrong move happened after 2steps( In this section we describe in detail the problem we ad- s/ s can only be even due to the structure of )andwecan dress in this paper. The problem involves determining Gn backtrack to that point and take the other edge. After a property of a certain type of graph whose structure is only ( 2) steps this procedure will reach the .1 given in the form of black box. O n exit We now describe how the graphs are modified so that Our problem is based on a generalization of the graphs Gn they cannot be traversed efficiently by any classical algo- Gn presented in [7], which consist of two balanced binary rithm. We choose a graph G0 at random from a particular trees of height n with the 2n leaves of the left tree identified n with the 2n leaves of the right tree in the simple way shown 1Also, there is a polynomial-time classical traversal algo- in Figure 1 (for n = 4). A classical random walk starting rithm for the n-dimensional hypercube (where entrance at the left root of this graph requires exponentially many and exit are two vertices whose distance apart is n). For a steps (in n) to reach the right root. However, a continuous description of the algorithm, see Appendix A. This means time quantum walk traverses in a time linear in . that there can be no exponential algorithmic speedup us- Gn n ing quantum walks to traverse the hypercube, even though In this paper, we modify the graphs in the previous ex- both continuous and discrete time quantum walks have ample so that the quantum walk is exponentially better been shown to reach the exit in a polynomial number of not only than the corresponding classical random walk, steps in a non-black box setting [22, 18].

Our model of a quantum walk is defined in close analogy to a continuous time classical random walk, which is a Markov process. In a continuous time classical random walk, the probability of jumping to any adjacent vertex in atimeis γ (in the limit as 0). If the graph has N vertices, this classical random walk→ can be described by the N N infinitesimal generator matrix K defined by

× 8

eÒØÖaÒce eÜiØ

< γ if (a, b) E(G) ∈ Kab = d(a)γ if a = b (2) : −0 otherwise.

If pa(t) is the probability of being at vertex a at time t then

d X p (t)= K p (t) . (3) dt a ab b b

Since the columns of K sum to 0, an initially normalized È Figure 2: A typical graph G40 . distribution remains normalized: a pa(t) = 1 for all t. Now consider quantum evolution in the N-dimensional

Hilbert space spanned by V (G). Let the state at time t be È distribution on graphs. A typical graph Gn0 is shown in given by a αa(t) a . If the Hamiltonian is H then the Figure 2 (for n = 4). The distribution is deﬁned as follows. dynamics are determined| i by the Schr¨odinger equation,

The graph again consists of two balanced binary trees of d X height n, but instead of identifying the leaves, they are i αa(t)= Hab αb(t) . (4) dt connected by a random cycle that alternates between the b leaves of the two trees. In other words, we choose a leaf Note the similarity between (3) and (4). A natural quan- on the left at random and connect it to a leaf on the right tum analogue to the continuous time classical random chosen at random. Then we connect the latter to a leaf walk described above is given by setting H to K [12]. In on the left chosen randomly among the remaining ones, the quantum case, there is no need for the columns of H to and so on, until every leaf on the left is connected to two sum to zero; we only require H to be Hermitian. For sim- leaves on the right (and vice versa). plicity, we set the diagonal to zero, and deﬁne a quantum In Section 3, we describe a quantum algorithm that walk in terms of a Hamiltonian with matrix elements

solves the graph traversal problem for Gn0 in polynomial- time, and, in Section 4, we show that any classical algo- γ if (a, b) E(G) Hab = ∈ (5) rithm that solves this traversal problem with nonnegligi- 0 otherwise. ble probability for a randomly generated black box for Gn0 In other words, H is the adjacency matrix of the graph takes exponential time. times γ.SinceHis Hermitian, an initially normalized È 2 state remains normalized: αa(t) =1forallt. a | | 3. QUANTUM ALGORITHM 3.2 Implementing the quantum walk In this section, we give a polynomial-time quantum al- In this section, we describe how to implement a quan- gorithm based on quantum walks for solving our problem. tum walk on a graph G. Our goal is to simulate the unitary We begin by describing the model of a continuous time iHt evolution e− with H given by (5). We are not given quantum walk on a graph in Section 3.1. Then, in Sec- H explicitly. Rather, we have access to a black box for G tion 3.2, we explain how to use a quantum computer to ef- as defined by (1). A simulation of H is a quantum cir- ficiently approximate the quantum walk on a graph given iHt cuit that approximates the unitary transformation e− by such a black box. Finally, in Section 3.3, we prove within some precision . We are interested in simulations that, after executing the quantum walk for a polynomial of quantum walks that are efficient in the sense that they amount of time, if the state is measured, the probability consist of a number of queries and additional one- and of finding the name of the exit is Ω(1/n). The occurrence two-qubit gates that are polynomial with respect to m, k, of this event can be checked, since exit is the only vertex t,and1/. We have two simulation results, that are stated of degree 2 other than . Therefore, with ( ) entrance O n in Theorem 1 and Theorem 2 (which appear below). executions of the algorithm, the success probability can Some standard tools for simulating Hamiltonians are: be made arbitrarily close to 1.

1. Tensor product. If H1,...,Hj each act on O(1) qubits 3.1 Quantum walk and the product of their eigenvalues is eﬃciently We now deﬁne our model of a quantum walk on any computable, then we can simulate H1 Hj. undirected graph G =(V(G),E(G)) that has no self- This can be done with a generalization⊗···⊗ of a tech- loops. Let d(a) denote the degree of vertex a. nique discussed in Section 4.7.3 of [24]. We will not

ar r present the general construction, but we show its |1i W W † application to a specific Hamiltonian below. Note br r |1i that H1 Hj may be highly nonlocal, so it ⊗ ··· ⊗ ar r may look very different from the Hamiltonian of a |2i W W † physical system. br r |2i pp pp 2. Unitary conjugation. If we can simulate H and we p p pp can efficiently perform the unitary operation U,then p ppp we can simulate † . This follows from the simple am r r U HU |i iHt iU †HUt W W † fact that † − = − . bm r r U e U e |i r b 3. Linear combination. If we can simulate H1,...,Hq |i iZt 0d d d e− d d d then we can simulate H1 + +Hq as a result of the |i Lie product formula ···

iT t

r 2 Figure 3: A circuit computing e− .

i(H1+ +Hq)t iH1t/r iHqt/r qlt e− ··· e− e− =O , − ··· r

where l =maxp,q [Hp,Hq] ,thelargestnormofa where the superscript indicates which two qubits S acts commutator of twok of the Hamiltonians.k This is a on, and the projector onto 0 acts on the third register. | i powerful tool for the simulation of physical quan- Here S is a Hermitian operator on two qubits satisfying tum systems, whose Hamiltonians can typically be S z1z2 = z2z1 . The eigenvalues of S are 1, and the | i | i 1 ± expressed as sums of local terms [20]. unique eigenvector with eigenvalue 1is (01 10 ), − √2 | i−| i making the eigenvalues of T easy to compute. The circuit 4. Commutation. If we can simulate H1 and H2,then iT t shown in Figure 3 computes e− and thus simulates T . we can simulate i[H1,H2]. This is a consequence of In this ﬁgure, W denotes the unitary operator such that

the identity 1 z1 r W † z1z2 = ( 0z2 +( 1) 1z2 ) . (7) [H1,H2]t iH1t/√r iH2t/√r iH1t/√r iH2t/√r √2 e = lim e− e− e e . | i | i − | i r →∞ m Applying W ⊗ diagonalizes T , and the Toffoli gates com- Using linear combination and commutation, it is pos- pute the argument of the eigenvalue in an ancilla register sible to simulate any Hamiltonian in the Lie algebra initially prepared in the state 0 . After computing the generated by a set of Hamiltonians. We will not eigenvalue, we apply the appropriate| i phase shift if r =0 need to use commutation in the present paper, but by evolving for a time t according to the Pauli Z operator we include it for completeness. satisfying Z z =( 1)z z . This controlled phase shift | i − | i We will first show how to efficiently simulate the quan- can be performed since it is a two-qubit gate. Finally, we tum walk on any graph given as a black box provided that uncompute the eigenvalue and return to the original basis. the edge labeling is symmetric. A symmetric edge labeling We now give our method for implementing the quantum walk on a general graph for which the labeling is is one where vc(a)=bimplies vc(b)=afor any vertices a G and b and any label c. In this case, the labels associated symmetric. First, note that by checking whether vc(a)= with each edge can be viewed as a coloring of the edges of 11 ...1, it is straightforward use a single query to (1) to perform (for each c L), the transformation G. If the maximum degree of G is ∆, then its edges can ∈ always be colored with at most ∆ + 1 colors [27]. Vc a, b, r = a, b vc(a),r fc(a) , (8) | i | ⊕ ⊕ i Theorem 1. Given a symmetrically labeled black box 0 v (a)=11...1 for G, a quantum walk on G can be simulated for time t where f (a)= c c 1 v (a)=116 ...1. with precision by using O(k2t2/) black box queries and c O(k2t2m/) auxiliary operations. Also, Vc† = Vc, so by unitary conjugation, we can simulate Vc†TVc using two queries and O(m) other gates. Note that, Proof. Our quantum walk simulation occurs in the for a V (G), Hilbert space spanned by states of the form a, b, r ,where ∈ | i aand b are m-bit strings and r is a bit. States correspond- Vc†TVc a, 0, 0 = Vc†T a, vc(a),fc(a) ing to vertices are those of the form a, 0, 0 ,fora V(G). | i | i (9) | i ∈ = δ V † vc(a),a,0 = δ vc(a), 0, 0 , We begin by showing how to simulate the evolution gen- 0,fc(a) c | i 0,fc(a)| i erated by the Hermitian operator T satisfying T a, b, 0 = where δ is the Kronecker delta and we have used the fact b, a, 0 and T a, b, 1 = 0. We will use T as a| buildingi | i | i that fc(a) = 0 implies vc(vc(a)) = a and fc(vc(a)) = 0. block in our simulation of H. Our simulation of T is ex- Finally, by linear combination, with r O(kt2/), we act and uses only O(m) one- and two-qubit gates. The can simulate ∈

operator T may be written as X Vc†TVc (10) T = S(1,m+1) S(2,m+2) S(m,2m) 0 0 , (6) ⊗ ⊗···⊗ ⊗| ih | c

with precision . ThisisequivalenttoH, since, for all qqpppqqqqpppqq11√211

X entrance exit C0 C1 Cn 1 Cn Cn+1 C n+2 C 2 n C 2 n+1 a V (G), it maps a, 0, 0 to vc(a), 0, 0 . − ∈ | i | i c:v (a) V (G) c ∈ Figure 4: Quantum walk in column subspace of Gn0 . The next theorem addresses the case of non-symmetric labelings (where v (v (a)) need not equal a)forare- c c In particular, a quantum walk starting in the state corre- stricted class of graphs and for quantum walks that start sponding to the entrance always remains in the column at a particular vertex. This subsumes the case of simulat- subspace. Thus, to understand the quantum walk starting a quantum walk on G0 starting at vertex entrance. n ing from the entrance, we only need to understand how Theorem 2. If G is bipartite and a V (G) then, given the Hamiltonian acts on the column subspace. In this

any black box for G, a quantum walk on∈G starting in state subspace, the non-zero matrix elements of H are a can be simulated for time t with precision by using √2γ 0 j 2n and j = n | i 4 2 4 2 Cj H Cj+1 = ≤ ≤ 6 (12) O(k t /) queries and O(k t m/) auxiliary operations. h | | i 2γj=n Proof. The idea is to simulate a symmetric labeling (and those deduced by Hermiticity of H). For simplicity, scheme and apply Theorem 1. For each edge (a, b), the we set γ =1/√2. The quantum walk in the column sub- labels from its two ends—call them ca and cb—are taken space is shown pictorially in Figure 4. For the purpose 2 together and viewed as a label from a larger set of up to k of this proof, it will be more convenient to consider the labels. The bipartite structure of G is used to determine graph Gn0 1, which reduces to a line with 2n vertices. We − whether this aggregate label is (ca,cb)or(cb,ca). labeltheverticesfrom1to2n, and the defect is on the The construction makes use of a parity bit at each ver- edge between vertices n and n + 1. With this labeling, the tex, indicating which side of the bipartite graph it is in. Hamiltonian (12) has non-zero matrix elements

This can be constructed by defining the initial state a to have parity bit equal to 0 and then flipping the value of| i the 11j2n1andj=n Cj H Cj+1 = ≤≤− 6 (13) parity bit each time the black box is queried. Therefore, h | | i √2 j=n, each vertex can be assumed to contain a parity bit. (and those deduced by Hermiticity of H). If vertex a has parity bit 0 then the label of edge (a, b) Define a reflection operator R Cj = C2n+1 j .Note − is (ca,cb); otherwise the label is (cb,ca). The label of an that R2 =1,soRhas eigenvalues| i1. R| commutesi with incident edge can be easily computed using the black box H on the column subspace, so we± can find simultaneous and the parity bit, and it is also easy to compute whether eigenstates of R and H. These are of the form

there is an edge with a particular label incident on a given vertex. What results is a symmetric labeling scheme. sin pj 1 j n Cj E = ≤ ≤ (14) h | i sin(p(2n+1 j)) n +1 j 2n, See [3] for more general Hamiltonian simulations. ± − ≤ ≤ which explicitly vanish at j =0andj=2n+1. The eigen- 3.3 Upper bound on the traversal time value corresponding to eigenstate E is E =2cosp,and the quantization condition (to be| discussedi later) comes We now consider the quantum walk on the specific fam- from matching at vertices n and n +1. The entrance ily of graphs Gn0 of Figure 2, and prove that the walk vertex corresponds to C1 and the exit vertex to C2n . reaches the exit in polynomial time. It can be shown [13] | i | i that, at a time of order n, there is a probability of order Lemma 3. Consider the quantum walk in Gn0 1 start- 1/3 − n− of finding the exit if a measurement is made. We ing at the entrance. Letthewalkrunforatimetchosen shall give a simpler proof of a bound that is not tight—but uniformly in [0,τ] and then measure in the computational is nevertheless polynomial. basis. If τ 4n for any constant >0,where∆Eis the ≥ ∆E The analysis of the walk on Gn0 reduces to a walk on a magnitude of the smallest gap between any pair of eigen- line with 2n + 2 vertices, one for each column of the orig- values of the Hamiltonian, then the probability of finding inal graph. Consider the (2n + 2)-dimensional subspace the exit is greater than 1 (1 ). 2n − spanned by the states Proof. The probability of finding the exit after the

1 X randomly chosen time t [0,τ]is

Cj = Ô a , (11) ∈ | i | i Z τ Nj a column j 1 iHt 2 ∈ dt C2n e− C1 τ 0 |h | | i| where Nj is the number of vertices in column j. We refer Z

X τ 1 i(E E0)t to this subspace as the column subspace. Because every = dte− − C2n E E C1 C1 E0 E0 C2n vertex in column j is connected to the same number of τ 0 h | ih | ih | ih | i E,E0 vertices in column j + 1 and every vertex in column j +1 X 2 2 = E C1 E C2n is connected to the same number of vertices in column j, |h | i| |h | i| applying H to any state in the column subspace results in E

X i(E E )τ 1 e− − 0 another state in this subspace. Despite the random con- + − C2n E E C1 C1 E0 E0 C2n . i(E E0)τ h | ih | ih | ih | i nections in Gn0 , the column subspace is invariant under H. E=E 6 0 −

By (14), E C1 = E C2n , so the ﬁrst term is

h | i ±h | i

Ô X

4 1 ¾ E C1 (15) |h | i| ≥ 2n E as is easily established using the Cauchy-Schwarz inequal-

ity. The second term can be bounded as follows:

¬ ¬

¬ ¬ ¼

X i(E E )τ ¬

¬ 1 e− − 0 ¬

¬ − C2n E E C1 C1 E0 E0 C2n ¬

¬ i(E E )τ ¬ ¬ 0 h | ih | ih | ih | i E=E 6 0 − 2 X 2 2 2 E C1 E0 C2n = . (16)

≤ τ∆E |h | i| |h | i| τ∆E Ô

E,E0 ¾

Thus we have

¿ 4

5 5 5 1 iHt 2 1 2 1 5 dt C2n e− C1 (1 ) (17) τ 0 |h | | i| ≥ 2n − τ∆E ≥ 2n − Ô where the last inequality follows since τ 4n . ≥ ∆E Figure 5: Left hand side of (22) for n =5. Now we need to prove that the minimum gap ∆E is only polynomially small. Let p0 and p00 be the two roots of (22) closest to the root Lemma 4. The smallest gap between any pair of eigen- p just found, with p0

that p0 and p00 both are roots of (22) with +√2. (Note

2π2 1 that the smallest p, corresponding to l =1,doesnothave ∆E> + O . (18) (1 + √2)n3 n4 ap0.) We see that p00 lies to the right of the zero of sin np at p = lπ/n. We also see that p0 lies to the left of the zero Proof. To evaluate the spacings between eigenvalues, of sin(( +1) )at ( + 1). Therefore we have

we need to use the quantization condition. We have n p lπ/ n

lπ lπ 1 lπ Cn H E =2cosp Cn E (19) p0 < + O and p00 > , (25) h | | i h | i n − n2 n3 n so that from which we conclude that

√2 Cn+1 E + Cn 1 E =2cosp Cn E (20) h | i h − | i h | i lπ√2 1 and using (14), we have p p0 > + O and (26)

− (1 + √2)n2 n3 √ 2 sin np + sin((n 1)p)=2cospsin np (21) lπ 1 ± − p00 p> + O , (27) which simpliﬁes to − (1 + √2)n2 n3 sin((n +1)p) = √2 . (22) for l =1,2,...,n 1. Thus the smallest spacing is at least sin np ± π/[(1 + √2)n2]+−O(1/n3 ). In Figure 5 we plot the left hand side of (22) for n =5. Now, for a given p, the corresponding eigenvalue is 2 cos p.

The intersections with √2 occur to the left of the zeros of For small ∆p, the spacing ∆E is related to ∆p by ¡ − sin np, which occur at πl/n for l =1,2,...,n 1. For the ∆E =2∆psin p + O (∆p)2 . (28) values of p that intersect √2, we can write p =(− πl/n) δ. | | − − Equation (22) with √2 on the right hand side is now The factor sin p = sin(lπ/n + O(1/n2)) is smallest when

−

l =1,sowehave lπ √2 sin nδ = sin nδ + δ . (23) 2π2 1 8 − − n ∆E> + O > for n suﬃciently large. (1+√2)n3 n4 n3 Write δ =(c/n)+(d/n2)+O(1/n3 ). Taking n in The alert reader will note from the ﬁgure with n =5 (23) gives √2 sin c = sin c, which implies c = 0,→∞ yielding that there are only 8 roots, whereas the dimension of the

−

reduced space is 10, so there are actually 10 eigenvalues. d 1 d lπ 1 √2 sin + = sin + (24) In general, there are 2n 2 roots of (22) with p real. If we O 2 O 2 − n n n − n n let p = ik with k real, we− can have eigenstates of the form lπ (14) with sin pj replaced by sinh kj and sin(p(2n +1 which gives, as , = .Thuswehavethat n d j)) replaced by sinh(k(2n +1 j)). The± corresponding− →∞ 1+√2 ± −

the roots of (22) with √2 on the right hand side are of eigenvalue is 2 cosh k and the condition (22) becomes

lπ −lπ 1 the form p = + O . sinh((n +1)k) 3 = √2. (29) n − (1 + √2)n2 n sinh nk ±

As n , the root of this equation is at ek = √2, which In Game 1, the algorithm could traverse a disconnected →∞ 1 corresponds to an eigenvalue √2+ . To obtain the subgraph of G0 . But because there are exponentially √2 n last eigenvalue, let p = π + ik. The eigenvalue is then many more strings of 2n bits than vertices in the graph, 2coshk. The quantization condition is now the same it is highly unlikely that any algorithm will ever guess the − √ 1 nameofavertexthatitwasnotsentbytheoracle.Thus, as (29), and as n , the eigenvalue is ( 2+ √ ). →∞ − 2 Game 1 is essentially equivalent to the following game: So we have found two eigenvalues at (√2+ 1 )with ± √2 corrections that vanish exponentially as n .Since Game 2. The oracle contains a graph and a set of ver- →∞ the other n 2 eigenvalues are all in the range [ 2, 2], our tex names as described in Game 1. At each step, the algo- − − conclusion about the minimum spacing is unchanged. rithm sends the oracle the name of the entrance vertex or the name of a vertex it has previously been sent by the From Lemma 3 and Lemma 4, we conclude oracle. The oracle then returns the names of the neighbors Theorem 5. For n sufficiently large, running the quan- of that vertex. The algorithm wins it ever sends the oracle n4 thenameoftheexit vertex. tum walk for a time chosen uniformly in [0, 2 ] and then measuring in the computational basis yields a probability The next lemma shows that, if the algorithms run for a of finding the exit that is greater than 1 (1 ). 2n − sufficiently short time, then the success probabilities for Combining this with the efficient implementation of the Game 1 and Game 2 can only differ by a small amount. quantum walk from Section 3.2, we obtain a quantum al- Lemma 7. For every algorithm A for Game 1 that makes gorithm that solves the traversal problem for Gn0 using a polynomial number of calls to the black box and a poly- at most t oracle queries, there exists an algorithm A0 for nomial number of one- and two-qubit gates. Game 2 that also makes at most t oracle queries such that for all graphs G,

G G n È 4. CLASSICAL LOWER BOUND È1 (A) 2 (A0)+O(t/2 ) . (31) ≤ In this section, we show that any classical algorithm Proof. Algorithm A0 simulates A, but whenever A solving the problem of traversing Gn0 (as described in Sec- queries a name it has not previously been sent by the tion 2) requires exponential time. The precise result is oracle, A0 assumes the result of the query is 11 ...1. The chance of A discovering the name of a new vertex is at Theorem 6. Any classical algorithm that makes at most most t(2n+2 2)/(22n 1), and unless this happens, the 2n/6 queries to the oracle ﬁnds the exit with probability − − n/6 two algorithms will have similar behavior. at most 4 2− . · To obtain a bound on the success probability of Game 2, We shall prove Theorem 6 by considering a series of we will compare it with a simpler game, which is the same games and proving relations between them. The ﬁrst game except that it provides an additional way to win: is essentially equivalent to our problem and each new game is essentially as easy to win. Finally, we will show that the Game 3. The oracle contains a graph and a set of ver- easiest game cannot be won in subexponential time. tex names as described in Game 1. At each step, the algo- Our problem is equivalent to the following game: rithm and the oracle interact as in Game 2. The algorithm wins it ever sends the oracle the name of the exit vertex, Game 1. The oracle contains a random set of names or if the subgraph it has seen contains a cycle. for the vertices of the randomly chosen graph Gn0 such that each vertex has a distinct 2n-bit string as its name and the Game 3 is clearly easier to win than Game 2, so we have entrance vertex has the name 0. At each step, the algorithm sends a 2n-bit string to the oracle, and if there exists Lemma 8. For al l algorithms A for Game 2,

a vertex with that name, the oracle returns the names of G G È È (A) (A) . (32) the neighbors of that vertex. The algorithm wins if it ever 2 ≤ 3 sends the oracle the name of the exit vertex. Now we further restrict the form of the subgraph that Note that there are two sources of randomness in this ora- can be seen by the algorithm unless it wins Game 3. We will show that the subgraph an algorithm sees must be a cle: in the choice of a graph Gn0 and in the random naming of its vertices. We first consider a fixed graph G and only random embedding of a rooted binary tree. For a rooted draw implications from the random names. Throughout binary tree T , we define an embedding of T into G to be a function π from the vertices of T to the vertices of G this section, G always refers to one of the graphs Gn0 .For a game X with a graph G, the success probability of the such that π(root)=entrance and for all vertices u and algorithm A is defined as v that are neighbors in T , π(u)andπ(v) are neighbors in G. We say that an embedding of T is proper if π(u) = π(v) G

È 6 X(A)= Pr [A wins game X on graph G] , (30) for = . We say that a tree exits under an embedding names u v T π if π6(v)=exit for some v T . where Pr [ ] means the probability is taken over the ran- ∈ names · We must specify what we mean by a random embed- dom naming of vertices. ding of a tree. Intuitively, a random embedding of a tree

is obtained by setting π(root)=entrance and then generates two unused names b0 and c0 at random and uses mapping the rest of T into G at random. We deﬁne this them as the neighbors of a0.Nowb0 and c0 correspond to formally for trees T in which each internal vertex has two b and c, the neighbors of a in G. Using the tree generated children (it will not be necessary to consider others). A by A0 in Game 4 has the same behavior as using A in random embedding is obtained as follows: Game 3.

1. Label the root of T as 0, and label the other vertices Finally, we bound the probability that an algorithm of T with consecutive integers so that if vertex i lies wins Game 4: on the path from the root to vertex j then i

2. Set π(0) = entrance.

h i G n/6

max E È (T ) 3 2− . (35) 3. Let i and j be the neighbors of 0 in T. T G ≤ · 4. Let u and v be the neighbors of entrance in G. Proof. Let T be a tree with t vertices, t 2n/6,with ≤ image π(T )inGn0 under the random embedding π.The 5. With probability 1/2setπ(i)=uand π(j)=v,and n vertices of columns n +1,n +2,...n + in Gn0 divide with probability 1/2setπ(i)=vand π(j)=u. 2 naturally into 2n/2 complete binary subtrees of height n/2. 6. For i =1,2,3,...,ifvertexiis not a leaf, and π(i) is not exit or entrance, (i) It is very unlikely that π(T ) contains the root of any of these subtrees, i.e., that π(T ) includes any vertex n (a) Let j and k denote the children of vertex i,and in column n + 2 . Consider a path in T from the let l denote the parent of vertex i. root to a leaf. The path has length at most t,and there are at most t such paths. To reach column (b) Let u and v be the neighbors of π(i)inGother n n + 2 from column n +1, π must choose to move than π(l). n right 2 1 times in a row, which has probability (c) With probability 1/2setπ(i)=uand π(j)= 1 n/2 − 2 − . Since there are at most t triesoneachpath v, and with probability 1/2setπ(i)=vand of T (from the root to a leaf) and there are at most t π(j)=u. 2 1 n/2 such paths, the probability is bounded by t 2 − . · We now define the game of finding a tree T for which a randomly chosen π is an improper embedding or T exits: (ii) If π(T ) contains a cycle, then there are two vertices a, b in T such that π(a)=π(b). Let P be the path Game 4. The algorithm outputs a rooted binary tree T in T from a to b.Thenπ(P) is a cycle in Gn0 .Let with t vertices in which each internal vertex has two chil- cbe the vertex in T closest to the root on the path dren. A random π is chosen. The algorithm wins if π is π(P ), and let π(P ) consist of the path π(P1) from c to and ( ) from to . an improper embedding of T in Gn0 or T exits Gn0 under π. a π P2 c b n/2 Let S ,S ,...,S n/2 denote the 2 subtrees de- As the algorithm A merely serves to produce a distribution 1 2 2 scribed above. Let 0 0 0 denote the cor- S1,S2,...,S2n/2 on trees T , we define n responding subtrees made out of columns 2 +1 to n. G

È (T )=Pr[πis improper for T or T exits G under π] , Without loss of generality, let π(c)beinthelefttree π of Gn0 , i.e., in a column n, as shown in Figure 6. and observe that for every distribution on graphs G and ≤ π(P1) visits a sequence of subtrees S0 ,Sj ,S0 ,... all algorithms taking at most t steps, i1 1 i2

and, similarly, π(P2) visits a sequence of subtrees

h i h i G G 0 0 .Since ()= ( ), the last subtree

Sk1 ,Sl1,Sk2,... πa π b È max E È4 (A) max E (T ) . (33) A G ≤ trees T with t vertices G on these two lists must be the same. (The other possibility is that π(a)=π(b) does not lie in any (Here EG [ ] means the expectation over graphs.) Game 3 n · subtree, hence lies in columns 1 through 2 or n + and Game 4 are also equivalent: n n 2 +1 through 2n. But the event that column n+ 2 is Lemma 9. For any algorithm A for Game 3 that uses ever reached has already been shown to be unlikely in at most t queries of the oracle, there exists an algorithm part (i). The same argument bounds the probability n A0 for Game 4 that outputs a tree of at most t vertices ofareturntocolumn 2 after a visit to column n+1.) such that for all graphs G, At least one of the lists has more than one term (or all vertices visited are in the left tree, which can’t

G G È È3 (A)= 4(A0). (34) make a cycle). The probability that the last terms n/2 n Algorithm halts if it ever ﬁnds a cycle, exits, on the two lists agree is bounded by 2 /(2 t), by Proof. A − or uses t steps. Algorithm A0 will generate a (random) the construction of the random cycle that connected n 1

the two trees of Gn0 .Aslongast 2−,wehave ¡ tree by simulating A. Suppose that vertex a in graph G n/2 n n/2 ≤ t corresponds to vertex a0 in the tree that A0 is generating. 2 /(2 t) 2 2− . Since there are 2 paths − ≤ · 2 n/2 If A asks the oracle for the names of the neighbors of a, A0 P , the probability of a cycle is less than t 2− . ·

n n 0 2 n n+1 n+ 2 2n+1 Although it is convenient to express our results in terms Q of a graph traversal problem, the results can also be cast in Q Q terms of a graph reachability problem, where one is given Q Q agraphGand two vertices s and t and the goal is to de- Q Q termine whether or not there is a path connecting s and Q t. The idea is to set G to two disjoint copies of G0 , s to Q n Q the entrance of one of the copies and t to the exit of either the same copy or the other copy of Gn0 .Thequan- π(P1) Q tum algorithm in Section 3 can be adapted to solve this Q Q problem in polynomial time and the lower bound of Sec- Q Q tion 4 can be adapted to show that no classical algorithm Q can solve this problem in subexponential time. (See [30] Q r π(c) r Q for a survey of classical results about graph reachability Q Q problems in various contexts.) π(a)=π(b) Our traversal problem can be viewed as a decision prob- p p lem either by recasting it as a reachability problem or by p p asking for the first bit of the name of the .Thus,our p p exit result can be also interpreted as showing the existence of Q a new kind of oracle relative to which BQP = BPP [6, 26]. π(P2) Q 6 Q Many computational problems can be recast as deter- Q Q mining some property of a graph. A natural question is Q whether there are useful computational problems (espe- Q Q cially non-black box ones) that are classically hard (or are Q Q believed to be classically hard) but that can be solved efficiently on a quantum computer employing quantum walks. Q Q Q Q Acknowledgments Q Q We thank Jeffrey Goldstone for helpful discussions and Q Q encouragement throughout this project. We also thank Q Q Dorit Aharonov for stimulating correspondence about the implementation of quantum walks and John Watrous for Figure 6: Graphical representation of part (ii) of several helpful remarks about quantum walks. the proof of Lemma 10. The triangles represent AMC received support from the Fannie and John Hertz Foundation, RC received support from Canada’s NSERC, the subtrees of G0 of height n/2, the dashed and n ED received support from the Istituto Nazionale di Fisica dotted lines represent the paths π(P1) and π(P2), respectively, which form a cycle in the graph. Nucleare (Italy), and DAS received support by an Alfred P. Sloan Foundation Fellowship and NSF Award CCR- 0112487. This work was also supported by the Cambridge–

Overall we have shown that MIT Foundation, the Department of Energy under coop-

h i G 2 n/2 2 1 n/2 n/6 erative research agreement DE-FC02-94ER40818, and the

E È (T ) t 2− + t 2 − 3 2− , (36) G ≤ · · ≤ · National Security Agency and Advanced Research and De- velopment Activity under Army Research Office contract if t 2n/6. ≤ DAAD19-01-1-0656. This completes the proof of Theorem 6. 6. REFERENCES 5. DISCUSSION In this paper, we have applied a fairly general imple- [1] M. Abramowitz and I. A. Stegun, Handbook of mentation of (continuous time) quantum walks to a black Mathematical Functions (Dover, New York, 1972). box problem, and proved that this problem can be solved [2] D. Aharonov, A. Ambainis, J. Kempe, and U. efficiently by a quantum computer, whereas no classical Vazirani. Quantum walks on graphs. In Proc. of the algorithm can do the same. We considered the problem of 33rd ACM Symp. on Theory of Computing, pages finding the name of the exit of a particular graph start- 50–59, 2001. ing from the entrance, given a black box that outputs [3] D. Aharonov and A. Ta-Shma. Adiabatic quantum the names of the neighbors of an input vertex. Note that state generation and statistical zero knowledge. In although our quantum algorithm finds the name of the Proc. 35th ACM Symp. on Theory of Computing, 2003. exit, it does not find a particular path from entrance [4] A. Ambainis, E. Bach, A. Nayak, A. Vishwanath, and to exit. J. Watrous. One-dimensional quantum walks. In Proc.

33rd ACM Symp. on Theory of Computing, pages Quantum Computing and Quantum Communication, 37–49, 2001. Vol. 1509 of LNCS, pages 174–188, 1999. [5] J. N. de Beaudrap, R. Cleve, and J. Watrous. Sharp [24] M. A. Nielsen and I. L. Chuang, Quantum quantum vs. classical query complexity separations. Computation and Quantum Information (Cambridge Algorithmica, 34:449–461, 2002. University Press, Cambridge, 2000). [6] E. Bernstein and U. Vazirani. Quantum complexity [25] P. W. Shor. Algorithms for quantum computation: theory. SIAM J. on Computing, 26:1411–1473, 1997. discrete logarithms and factoring. SIAM J. on [7] A. M. Childs, E. Farhi, and S. Gutmann. An example Computing, 26:1484–1509, 1997. of the difference between quantum and classical [26] D. Simon. On the power of quantum computation. random walks. Quantum Information Processing, SIAM J. on Computing, 26:1474–1483, 1997. 1:35–43, 2002. [27] V. G. Vizing. On an estimate of the chromatic class [8] W. van Dam and S. Hallgren. Efficient quantum of a p-graph. Metody Diskret. Analiz., 3:25–30, 1964. algorithms for shifted quadratic character problems. [28] J. Watrous. Quantum algorithms for solvable quant-ph/0011067. groups. In Proc. 33rd ACM Symposium on Theory of [9] W. van Dam and G. Seroussi. Efficient quantum Computing, pages 60–67, 2001. algorithms for estimating Gauss sums. Unpublished. [29] J. Watrous. Quantum simulations of classical [10] D. Deutsch. Quantum theory, the Church-Turing random walks and undirected graph connectivity. principle, and the universal quantum computer. Proc. J. Computer and System Sciences, 62:376–391, 2001. Roy. Soc. London A, 400:96–117, 1985. [30] A. Wigderson. The complexity of graph connectivity. [11] D. Deutsch and R. Jozsa. Rapid solution of In Proc. 17th Mathematical Foundations of Computer problems by quantum computation. Proc. Roy. Soc. Science Conf., Vol. 629 of LNCS, pages 112–132, 1992. London A, 439:553–558, 1992. [12] E. Farhi and S. Gutmann. Quantum computation APPENDIX and decision trees. Phys. Rev. A, 58:915–928, 1998. [13] J. Goldstone. Personal communication, Sept. 2002. A. EFFICIENT CLASSICAL ALGORITHM [14] M. Grigni, L. Schulman, M. Vazirani, and U. TRAVERSING THE HYPERCUBE Vazirani. Quantum mechanical algorithms for the We describe a classical algorithm that traverses the hy- nonabelian hidden subgroup problem. In Proc. 33rd percube graph, where entrance isanyvertexandexit ACM Symp. on Theory of Computing, pages 68–74, is the unique vertex whose distance from entrance is n. 2001. The idea of the algorithm is to start at entrance and [15] S. Hallgren. Polynomial-time quantum algorithms repeatedly move one level closer to exit, where level k is for Pell’s equation and the principal ideal problem. In the set of vertices whose distance from entrance is k. Proc. 34th ACM Symp. on Theory of Computing, In other words, the algorithm will construct a sequence of pages 653–658, 2002. vertices a0 = entrance,a1,...,an 1,an = exit,where − [16] S. Hallgren, A. Russell, and A. Ta-Shma. Normal ak is in level k. To choose the vertex ak+1, the algorithm subgroup reconstruction and quantum computation will also require a set of vertices Sk 1,whichisthesetof − using group representations. In Proc. 32nd ACM all neighbors of ak that are at level k 1. − Symp. on Theory of Computing, pages 627–635, 2000. The algorithm proceeds as follows. First, let a1 be any [17] G. Ivanos, F. Magniez, and M. Santha. Efficient neighbor of a0 and let S0 = a0 . Now suppose that (for { } quantum algorithms for some instances of the some k) ak and Sk 1 are known. Then let ak+1 be any − non-abelian hidden subgroup problem. neighbor of ak that is not in Sk 1,andletSk contain every − quant-ph/0102014. neighbor of ak+1 that is also a neighbor of some element [18] J. Kempe. Quantum random walks hit exponentially of Sk 1. The key point is that the set Sk constructed in − faster. quant-ph/0205083. this way is in fact the set of all neighbors of ak+1 whose [19] A. Kitaev. Quantum measurements and the abelian distance from a0 is k.Afternsuch steps, the algorithm 2 stabilizer problem. quant-ph/9511026. reaches an = exit.EachsteptakesO(n) queries, so the 3 [20] S. Lloyd. Universal quantum simulators, Science total number of queries is O(n ). 273:1073–1078, 1996. [21] D. A. Meyer. From quantum cellular automata to quantum lattice gasses. J. Stat. Phys., 85:551–574, 1996. [22] C. Moore and A. Russell. Quantum walks on the hypercube. In Proc. of RANDOM 02, Vol. 2483 of LNCS, pages 164–178, 2002. [23] M. Mosca and A. Ekert. The hidden subgroup problem and eigenvalue estimation on a quantum computer. In Proc. 1st NASA International Conf. on