Invitation to a Contemporary Physics (2004)

Some of these 1-bit and 2-bit gates are summarized in the following graph. The incoming bit(s) are on top and the outgoing bit(s) are at the bottom, with the gate in between. Schizophrenic states are indicated by dots between the two basis states.

For better or for worse, the linearity of a quantum gate makes it impossible to copy states faithfully. To see why, let us copy the one-particle states |0 and |1 onto a second particle, thus forming the states |00 and |11 , respectively. This can actually be accomplished using the cn gate if its control bit c is the bit to be copied:

|c 0 → cn → |c, c 0 = |c c .

If the control qubit is now |ψ = α|0 + β|1 , then the input qubits to the cn gate is |ψ |0 = α|00 + β|10 . By linearity, the output qubits of the cn gate are α|00 + β|11 , and not the desired |ψ |ψ = (α|0 + β|1 )(α|0 + β|1 ) = α2|00 + αβ(|01 + |10 ) + β2|11 . In other words, even if we can design a device to copy the basis states, by linearity the same device will not be able to copy their linear combinations faithfully. This is sometimes referred to as the ‘no-cloning theorem.’ The proof can be carried out in a completely general context.

This inability to copy is both good and bad. It is good because data cannot be copied and stolen without our knowing it. It is bad because classical computer algorithms often call for making copies of some data for later use, so such algorithms must be modified.

Let us finally mention a famous 3-bit unitary gate, which can actually be constructed from 1-bit and 2-bit controlled gates. It is the controlled-controlled- not (ccn) gate, otherwise known as the toffoli gate. The incoming state |cc d of this gate contains two control bits c and c , which remain unchanged after passing through the gate. The data bit d is also unchanged unless both c and c are 1, in which case the outgoing data bit is not operating on the incoming data bit d. This

gate can be used as a multiplier of the two control bits, because it converts |cc 0 into |c, c , c × c .

6.4.1Summary

The magic of a quantum computer lies in its ability to manipulate superpositions of qubits. The gates used to manipulate them are linear and unitary, quite di erent from the gates used in a classical computer. One-bit gates are relatively easy to construct, with the not (n) and hadamad (h) gates being some of the most useful ones. Two-bit controlled gates such as the controlled-not (cn) and more generally the controlled-u (cu) gates are also needed, but they are much more di cult to manufacture because of the correlation requirement.

6.5 Deutsch’s Algorithm

Quantum computers can process a mixture of ‘numbers’ in the form of a schizophrenic state. With this special feature e cient quantum algorithms can be designed. If S is the (large) number of steps needed to do a job in a classical algorithm, then we will consider the corresponding quantum algorithm e cient if it takes only O(Sa) steps, with some a < 1 (power saving) or, better still, O(ln S) steps (exponential saving).

The first successful quantum algorithm that provides a substantial (actually exponential) saving is Deutsch’s algorithm. It is a toy program in the sense that it is not that useful in practice. Nevertheless, it is important because it is simple, and it illustrates how quantum savings can be accomplished by the use of schizophrenic states, plus a judicious choice of a final state to yield a definitive rather than a probabilistic answer.

Let us now state the problem to be solved. It concerns a class of functions y = f(x), mapping an n-bit number x onto a 1-bit number y. Every function in this class is either constant, mapping all 2n values of x onto the same number, or balanced, mapping half the values of x onto 0 and the other half of the values of x into 1. A function of this class is given to us in a black box, also known as an oracle. When x is fed into the black box, y = f(x) will appear as the output.

We are told that constant functions and balanced functions occur with equal probability, but we do not know which it is in a specific black box. We are now asked to design an e cient algorithm, incorporating this black box, to decide precisely whether the function given is constant, or balanced.

In a classical computer, the only way to decide is to feed into the black box, one x after another, and compare the outputs. If the function turns out to be constant, then it takes exactly 2n−1 + 1 (half the number of x plus one) steps to recognize it as such. This is so because even if the first 2n−1 values of f turn out to be the same, it can still be balanced if the next 2n−1 output has opposite values. On the other hand, if the function is balanced, then we will be able to tell as soon as a di erent value of f turns up, because then f obviously cannot be constant. Since a balanced function has as many 0 values as 1 values, the chance that an opposite

value of f turns up within the first few steps is very high. For that reason, even if n is very, very large, it can be shown that the average number of steps, a, it takes to tell that it is balanced is finite. Since we are told that balanced functions and constant functions occur with equal probability, the average number of steps for a classical algorithm to decide is S = (a + 2n−1 + 1)/2 2n−2 steps, when n is large.

Deutsch’s quantum algorithm can accomplish this task in O(n) = O(ln S) steps, thus gaining an exponential advantage compared to the classical algorithm. Here is how it works.

First of all, we must realize that the black box itself is not a unitary gate, because it has an n-bit input but only a 1-bit output. However, the gate Uf in Eq. (6.2), which maps |x |y to |x |y f(x) , is unitary. Note that Uf maps |x (|0 −|1 ) onto itself if f(x) = 0, and it reverses the sign of this state if f(x) = 1. In other words, it produces a prefactor (−1)f(x) when operated on this state, no matter how many bits x carries. What Deutsch did was to make use of this feature to determine what kind of function f is.

In the notations explained at the end of Sec. 6.2, Deutsch’s algorithm can be

It starts from the (n + 1)-bit ground state |0 , with its first n bits stored in Register

I and the remaining bit stored in Register II. A not gate followed by a hadamad

√

gate on II converts the last qubit into the state (|0 − |1 )/ 2 , while the n-bit hadamad gate converts the content of the first register into the uniform state. Now the (n + 1)-bit state is passed through the gate Uf constructed from the black box. The result is an extra sign factor (−1)f(x) applied to each state |x in the first register. The resulting state in the first register is finally passed through an n-bit hadamad gate to convert it into a state |a . If f is constant, then since H · H|0 = |0 , |a is ±|0 . The sign is plus when all f(x) = 0, and minus when all f(x) = 1. On the other hand, if f is balanced, then the state x(−1)f(x)|x is orthogonal to the uniform state. Since the unitary gate hI preserves inner products, the resulting state |a is orthogonal to the n-bit ground state |0 , meaning that at least one of the n-bits in |a is 1. If we count as one step the query of a bit to determine whether it is 0 or 1, then it takes n steps to decide whether a 1 is present in at least one bit, and therefore whether the function is balanced. In counting the

number of steps perhaps we should include the number of operations needed to get |a , and that is of order n as well. Hence, the final number of steps is O(n), which provides an exponential saving compared to the classical algorithm.

If we were to ask what precisely f is, rather than just whether it is constant or balanced, then quantum algorithm or not, it requires O(2n) steps.

6.5.1Summary

Deutsch’s algorithm is designed to find out whether a given function y = f(x) is constant or balanced. It makes use of the property that the unitary gate Uf associated with these functions maps |x (|0 − |1 ) onto itself when f(x) = 0, and minus the state when f(x) = 1. A uniform state is passed through this gate to allow the Deutsch algorithm to gain an exponential saving over the corresponding classical algorithm.

6.6 Finding the Period of a Function

6.6.1 Introduction

What allows the Deutsch algorithm to succeed is the special nature of the function f(x), being either constant or balanced, as well as the limited nature of our enquiry, whether f is constant or balanced, and not precisely what the function f is. In this section we will discuss another algorithm with similar characteristics. This time the function f is periodic, and we only want to know what its period r is. The quantum algorithm for this task again o ers an exponential saving over the classical algorithm. Moreover, it will be needed in Shor’s factorization routine to be discussed in the next section.

Consider an m-bit periodic function y = f(x) of an n-bit variable x, with a period r, so that f(x + r) = f(x) for every x. We shall assume that f(x) takes on di erent values at di erent x within a period, and that r divides S = 2n. Again f is handed to us in a black box, or an oracle. Our aim is find out the period r of this function.

The most straightforward method is again to pass each x value through the black box and record its outcome y, from which we determine the period r. This takes r + 1 steps. The period r could be as small as 1 and as large as 2n, so on average it would take roughly 2n−1 steps to find the period this way.

Since f is periodic, we may also use the Fourier transform to find the period. However, this turns out not to be a good way with a classical computer, because it takes O(S2) = 22n steps just to compute all the values of the Fourier transform,8 many more than what is required in the naive method discussed in the preceeding

8There are S values in the Fourier space and each can be computed by summing the S terms in the Fourier transform.

paragraph. The number of steps can be reduced to O(S ln S) by using a fast Fourier transform, but that still does not beat the naive approach.

The situation is di erent with a quantum computer. The Fourier transform F of a state |x is a state given by

If |x = |0 , the output is the uniform state |Υ of Eq. (6.3), which can be generated from |0 using the n-bit hadamad gate H in n steps. If |x =|0 , additional phase factors are present, which requires 2-bit controlled gates to obtain. The number of steps required is then O(n2), which still gains an exponential saving of steps compared to the naive method. This is the reason why it pays to find the period r using quantum Fourier transform if a quantum computer is present.

In the next subsection we shall discuss in more detail how to implement a quantum Fourier transform and why it can be done in O(n2) steps. In the subsection after we shall discuss how the quantum Fourier transform can be used to find the periodicity of the function f(x). These two subsections are more technical, so readers who are not interested in such details may skip now to the next section.

6.6.2Implementing a Quantum Fourier Transform

Both the left-hand side and the right-hand side of Eq. (6.5) can be factorized. Their th qubits are related by

which can be shown by expressing |k in (6.5) in binary notation. If we expand x in the exponent into binary form like Eq. (6.1), then every bit of x will enter into the exponent on the right-hand side. In other words, F|x depends not just on the th bit of x, but it also depends on every other bit of it. Such a correlation clearly requires control gates to implement. The resulting gate to transform |x turns out to be h Φ , where Φ is made up of a product of ( − 1) 2-bit control gates cu for some appropriate u’s. Counting each control gate and each h gate as one step, a qubit can therefore be transformed with steps. The total number of steps for the quantum Fourier transform is therefore

= n(n + 1)/2. This is O(n2) as promised.

6.6.3 Period of the Function from the Fourier Transform

To find the period of the function f(x), construct the (n + m)-qubit state

S−1

1

|F = √ |x |f(x) .

S x=0

This can be obtained by applying the n-bit gate H to the ground state |0 of the first (n-bit) register, and then the Uf gate of Eq. (6.2) to both registers. These two operations are summarized as

It can be accomplished in n+1 steps: n steps for H and one step for Uf . This is negligible compared to the O(n2) steps needed later to carry out the quantum Fourier transform.

Organize the components of |F according to the value |y0 = |f(x0) of the second register. Since the period of f(x) is r, every f(x) with x = x0 + j r (j is an integer) gives the same value y0. In this way we can re-write the state as

x0 between 0 and S − 1, provided we interpret the sum x0 + j r as the sum mod S. With this extension, |g(x0) is periodic in x0, with a period r. In this way, the periodicity of f is transferred to the periodicity of g, which is easier to handle because it is independent

of other details of f. Since g has a period r, its Fourier transform, Eq. (6.5), has a

spectrum which vanishes except when k is an integral multiple of K = S/r. By performing

measurements in the first register of the state FI|F , we can find out K and hence r =

S/K.

6.6.4Summary

An e cient algorithm with exponential saving can be designed to measure the period r of a periodic function f(x), by using a quantum Fourier transform. The number of steps needed is O(n2), if x ranges from 1 to S = 2n. In contrast, this requires O(n2n) number of steps to accomplish by using a classical Fourier transform, and O(2n) steps to do it naively.

6.7 Shor’s Factorization Algorithm

Suppose we know that an n-bit number N is made up of the product of two prime

factors p and q. Given N, how di cult is it to find p and q? Naively, it takes an

√

average of O( N ) steps by trial and error to get them. Starting from 2, we test whether it divides N. If it does, we have found one of the prime numbers, and the

other can be obtained by dividing N by it. If it does not, we proceed to the next

√

prime number 3, and try again. Since one of p and q must be smaller than N , we

√

can certainly obtain the answer after at most N tries.

If N is large, say with 128 bits so that it is of the order of 2n 3 × 1038, then it will take a long time to succeed with this naive method. Fortunately, there are classical algorithms which can do this much faster. The fastest known takes O(exp[(64/9)1/3n1/3(ln n)2/3]) steps. For n = 128, this is of the order the of e27.6 9.6 × 1011, still a very large number of steps. This di culty in factorization has been exploited to design a coding system, the RSA public key encryption scheme, which can be broken only when one succeeds in finding p and q from a given N. Since it takes such a long time to do so, by the time one succeeds, N and hence the coding scheme will have been changed, so one’s e ort is wasted and this encryption method is safe. We will discuss exactly how the public key encryption works in a later section.

As soon as the first quantum computer is turned on, this encryption system will become obsolete. A quantum algorithm invented by Peter Shor in 1994 allows the factorization to be done in less than O(n3) steps. What took months to do will now be accomplished in seconds.

We will outline in this section how Shor’s algorithm works. Essentially, it turns the factorization problem into a problem of finding the periodicity of a function, so the technique discussed in the last section can be used to gain an exponential saving.

To start with, pick a number a < N at random. If a divides N, we are done, for we have found either p or q. If a does not, then according to Euler’s theorem in

The number r is not unique, but we will take the smallest of them.

For example, if N = 15, and we picked a = 4, then r = 2 because 42 = 1 + 15. Note that we also have a4 ≡ 1 mod 15 because 44 = 256 = 1 + 17 × 15, but we will take r to be the smallest, so it is 2 and not 4.

We will discuss in a moment how r can be found using the algorithm from the last section. If r turns out to be odd, then we must start over again, pick another a, and find another r. If r is even, then the condition (6.6) can be written in the form:

(ar/2 − 1)(ar/2 + 1) = kN = kpq ,

For simplicity we will assume only one record in the database has exactly these properties. This is not a necessary condition for the algorithm, but we will not discuss the additional details needed to remove this restriction. There are also other variations of the algorithm but here we will stick only to the basic version.

For example, suppose there is a database containing all the essential data of every person living in a country. Suppose we know that one and only one person in the country is 120 years of age, but we do not know anything else about the person — not the name nor the address. We would like to pull that record from the database to find out possible clues to her/his longevity. What is a good and fast way to find the record?

Naively we simply have to pull and examine every record until we find the right one. That takes on the average N/2 trials, so the number of steps required is O(N).

Note that if the database were structured, then there are much faster ways to find the desired record. For example, if all the records are already arranged by age, then no algorithm is needed because we simply pull the last few records. The sorting problem is the hardest when the database is unstructured.

In this section we shall describe a quantum algorithm invented by Lov Grover,

√

which accomplishes the task in O( N ) steps. If the country has 400 million people, this can be accomplished in of the order of 20,000 steps, rather than 200,000,000 steps.

By inserting empty records if necessary, we may assume the length of the database to be N = 2n for some n. In that case we can label the records by an n-bit integer x. Suppose the desired record is located at x0, then the purpose of the algorithm is to find this number x0.

To determine whether a record is the one we want, we must examine it for the desired properties. Such an examination can be carried out by a subroutine designed specifically to look for the properties we want, and we shall assume that such a subroutine is already available, and is given to us in the form of a black box, or an oracle. When we feed the xth record into the black box, it will examine it and spit out either a 1, when it is the desired record, or a 0, when it is not. In other words, the black box can be replaced by a ‘yes-no function’ f(x), with f(x0) = 1 and f(x) = 0 for all other x.

The idea of the algorithm is as follows. Start with a uniform state,

N−1

1

|Υ = √ |x ,

N x=0

and use the oracle repeatedly to filter out the desired state |x0 . As indicated

√

before, this can be done in O( N ) steps. We will now proceed to describe how this is accomplished. Readers not interested in such details can skip to the next section.

We start from the uniform state |Υ obtained by applying the n-bit hadamad gate H to the ground state |0 . A grover gate (g) is then used repeatedly to filter out from |Υ the desired state |x0 .

The grover gate is defined by

G = −HI0HIx0 ,

where H is the n-bit hadamad gate mentioned above, and Ix0 is a 1-bit gate that reverses the sign of the state |x0 but leaves all other states |x unchanged. In other words,

Ix0 |x = (−1)f(x)|x .

Similarly, I0 is a gate that reverses the sign of the state |0 , but leaves all other states unchanged.

Ix0 can be constructed from the Uf gate of Eq. (6.2). In addition to the n-bit register which holds |x , we need an auxiliary 1-bit register which holds |0 at the beginning. Then

so that the output of Ix0 |x appears at the end in the first register. In arriving at this result, the fact that the property function f(x) is either 1 or 0 has been used.

Carrying out the algebraic computation, which we skip, it can be shown that passing the uniform state |Υ through the grover gate k times will result in the state:

√

where θ is determined by sin θ = 1/ N . For large N, the angle θ is small. We see from this formula that the weight of the uniform state is decreased through each pass, and the weight of |x0 is correspondingly enhanced. After k passes through the grover gate, where (2k + 1)θ is chosen to be as close to π/2 as possible, namely,

then |Υk |x0 . Even if the right-hand side of this equation is not an integer, there is still a very high probability of finding |Υk in the state |x0 when N is large. In that case we simply have to run the search algorithm several times to determine the exact value of x0.