1

Quantum Computing:
Whats It Good For?
Scott Aaronson
Computer Science Department, UC Berkeley
January 10, 2002
www.cs.berkeley.edu/~aaronson

John
Bell
Stacy Seitz
Elementary gates
Hadamard gate


Phase shift

> > >

> + > >
=
1 |
2
1
0 |
2
1
1 |
1 |
2
1
0 |
2
1
0 |
H

> >
> >
=
1 | 1 |
0 | 0 |
Z
Elementary gates
Rotation by angle o


Controlled NOT

=
10 11
11 10
01 01
00 00
CNOT

> >
> >
=

1 | 1 |
0 | 0 |
o
o
i
i
e
e
T
Universality
Any quantum computation can be
performed by a circuit consisting of
Hadamard, phase, rotation by t/8 and
controlled NOT gates.
Classical vs. Quantum Circuits
|x>
|0>
|x>
|F(x)>
F
Add extra input initialized to 0.
We can transform a classical circuit
for F to quantum circuit.
Example
y x
^
Classical
Quantum
|x>
|y>
|0>
|x>
|y>
|x.y>
|a> |a(x.y)>
Toffoli gate.
Quantum parallelism




By linearity,

Many evaluations of f in unit time.

|x>
|0>
|x>
|f(x)>
|x> |f(x)>
|x> |0>
x x
Quantum parallelism
Once we measure

we get one particular x and f(x).
Same as if we evaluated f on a random x.
|x> |f(x)>
x
Quantum parallelism
Is it useful?
We cannot obtain all values f(x) from

because quantum states cannot be
measured completely.
We can obtain quantities that depend on
many f(x).
|x> |f(x)>
x
Quantum interference
Hadamard transform:

> > >=

> + > >=
1 |
2
1
0 |
2
1
1 |
1 |
2
1
0 |
2
1
0 |
H
H
> = |
.
|

\
|
> + > 0 | 1 |
2
1
0 |
2
1
H
Illustrate this with
Bloch Sphere
Quantum interference
Negative interference: |1> and -|1> cancel out
one another.
Positive interference: |0> and |0> add up to a
higher probability.
Use quantum parallelism to compute many f(x).
Use positive interference to obtain information
that depends on many values f(x).
Ideal for number-theoretic problems (factoring).
Hadamard matrix:
1 1
2 2
1 1
2 2
H
(
(
=
(

(

H|0) = (|0)+|1))/\2 H|1) = (|0)-|1))/\2
H(|0)+|1))/\2 = |0) H(|0)-|1))/\2 = |1)
Quantum Circuits
Unitary operation is local if it applies to
only a constant number of bits (qubits)
Given a yes/no problem of size n:
1. Apply order n
k
local unitaries for constant k
2. Measure first bit, return yes iff its 1
BQP: class of problems solvable by such a
circuit with error probability at most 1/3
(+ technical requirement: uniformity)
The Power of Quantum Computing
Bernstein-Vazirani 1993:
BPP _ BQP _ PSPACE
BPP: solvable classically with order n
k
time
PSPACE: solvable with order n
k
memory
Apparent power of quantum computing
comes from interference
- Probabilities always nonnegative
- But amplitudes can be negative (or complex), so paths
leading to wrong answers can cancel each other out
Simons Problem
Given a black box
x
f(x)
Promise: There exists a secret string s such that
f(x)=f(y) y=xs for all x,y (: bitwise XOR)
Problem: Find s with as few queries as possible
Simons Problem more
formally
Simons Problem
Determine whether f(x) has is distinct on an XOR mask or distinct
on all inputs using the fewest queries of the oracle. (Find s)
Classical Simon
00
01
10
11
A
C
D
B
C
A
B
D
0 1
S=011
Guess what are
Simons functions?
Example
Input x Output
f(x)
000 4
001 2
010 3
011 1
100 2
101 4
110 1
111 3
Secret string s:
101
f(x)=f(xs)
Quantum Simons problem
Function F:{0, 1}
n
{0, 1}
n
.






Given: is function F such that F(x+s)=F(x) for
all x, where operation + is a bitwise addition.
Find: number s.

|x>
|0>
|x>
|F(x)>
F
This is a cyclic function such as cosine
Quantum Algorithm [Simon, 1994]
|0>
|0>
|y>
|f(x)>
H
H
H
H
H
H
F
Repeat n times and combine results y
1
,..., y
n
.
Observe that y
i
are AFTER Hadamard.
|x>
The trick here is to use Hadamard transform at the inputs
and outputs of F
Hadamard transform

> > >

> + > >
=
1 |
2
1
0 |
2
1
1 |
1 |
2
1
0 |
2
1
0 |
H
review
Hadamard on n qubits
H
H
|0>
|0>
> + > 1 |
2
1
0 |
2
1
> + > 1 |
2
1
0 |
2
1
{ }

e
> = |
.
|

\
|
> + > >
n
x
n
n
n
x
1 , 0
|
2
1
1 |
2
1
0 |
2
1
0 |
As you remember we do
Kronecker product for
gates that are in parallel
Kronecker product of
unitary matrix of H gate
Simons algorithm step-by-step
|0>
|0>
|y>
|F(x)>
H
H
H
H
H
H
F
{ }
> >

e
0 | |
2
1
1 , 0
n
x
n
x
{ }
> >

e
) ( | |
2
1
1 , 0
x F x
n
x
n
From last slide
Kronecker Product
of Unitary Matrices
Here n = 3
If F(X)is distinct If F(X)is distinct
Simons algorithm step-by-step
|0>
|0>
|y>
|F(x)>
H
H
H
H
H
H
F
{ }
> >

e
0 | |
2
1
1 , 0
n
x
n
x
{ }
> >

e
) ( | |
2
1
1 , 0
x F x
n
x
n
From last slide
Kronecker Product
of Unitary Matrices
Here n = 3
We add Hadamards at the
outputs and observe
Measuring F(x)
Partial measurement of last n bits.
We get some value y=F(x).
The state

collapses to part consistent with y=F(x).

{ }
> >

e
) ( | |
2
1
1 , 0
x F x
n
x
n
> >

=
y x
y x F
| |
) (
1. measure the last n qubits
2. perform Hadamard on first n qubits.
|0>
|0>
|y>
|F(x)>
H
H
H
H
H
H
F
{ }
> >

e
0 | |
2
1
1 , 0
n
x
n
x
{ }
> >

e
) ( | |
2
1
1 , 0
x F x
n
x
n
Here n = 3
Last step
We now have the state

How do we get z?
Measuring the first register would give
only one of x and x+z.
> > + + > y z x x | ) | (|
Simons algorithm
|0>
|0>
|y>
|f(x)>
H
H
H
H
H
H
F
) | (| > + + > z x x
Measuring the first register would give only one of x and x+z.
This is why we measure through the output Hadamard Transform

Hadamard transform

> > >

> + > >
=
1 |
2
1
0 |
2
1
1 |
1 |
2
1
0 |
2
1
0 |
H
> + > >= 1 | ) 1 (
2
1
0 |
2
1
|
x
x H
1 1
1 -1
Please observe when we
have positive and when
negative values
Hadamard transform
H
H
H
|x
1
>
|x
2
>
|x
n
>
...
> + > 1 | ) 1 (
2
1
0 |
2
1
1
x
> + > 1 | ) 1 (
2
1
0 |
2
1
2
x
> + > 1 | ) 1 (
2
1
0 |
2
1
n
x
...
...
>

>
n
y y y
n
y y y
i
y
i
x
x x x
n
... | ) 1 ( ... |
2 1
...
2 1
2 1
Hadamard transform
>

+
> +
n
y y y
y y y
i
y
i
z
i
x
z x
n
... |
) (
) 1 ( |
2 1
...
2 1
>

>
n
y y y
y y y
i
y
i
x
x
n
... | ) 1 ( |
2 1
...
2 1
Signs are the same iff z
i
y
i
= 0 mod 2.

Let us analyze signs in |x> and |x+z>
Simons Algorithm - 1993
Simons algorithm examines an oracle problem which takes polynomial
time on a quantum computer but exponential time on a classical
computer.

His algorithm takes oracle access to a function
f: {0, 1}
n
{0, 1}
n
, runs in poly(n) time and behaves as follows:

1. If f is a permutation on {0, 1}
n
, the algorithm outputs an n-bit
string y which is uniformly distributed over {0, 1}
n
.

2. If f is two-to-one with XOR mask s, the algorithm outputs an n-bit
string y which is uniformly distributed over the 2
n-1
strings such that
y * s = 0.

3. If f is invariant under XOR mask with s, the algorithm outputs
some n-bit string y which satisfies y * s =0.



Simons Algorithm
Simon showed that when he runs this procedure O(n) times, a
quantum algorithm can distinguish between Case 1 and Case 3
with high probability.
He also showed that in Case 2 the algorithm can be used to
efficiently identify s with high probability.
After analyzing the success probability of classical oracle
algorithms for his problem he came up with the following
theorem:
Let O
n
= s {0, 1}
n
be chosen uniformly and let
f :{0, 1}
n
{0, 1}
n
be an oracle chosen uniformly from the set
of all functions which are two-to-one with XOR mask s. Then
(i) there is a polynomial-time quantum oracle algorithm which
identifies s with high probability; (ii) any p.p.t classical oracle
algorithm identifies s with probability 1/2
O(n)
.
Simons Algorithm
Classically, order 2
n/2
queries needed to find s
- Even with randomness

Simon (1993) gave quantum algorithm using
only order n queries
Assumption: given |x), can compute |x)|f(x))
efficiently
Schematic Diagram
O
b
s
e
r
v
e
f(x)
O
b
s
e
r
v
e
n
H

n
H

|0)
|0)
|0)
|0)
|0)
|0)
1. Prepare uniform superposition
2. Compute f:
( )
{ }
/ 2
0,1
1
2 n n
x
x f x
e

3. Measure |f(x)), yielding

for some x
( ) ( ) 1
2 x x s f x +
Simons Algorithm (cont)
1. Prepare uniform superposition
2. Compute f:
( )
{ }
/ 2
0,1
1
2 n
n
x
x f x
e

3. Measure |f(x)), yielding

for some x
( ) ( )
1
2
x x s f x +
Schematic Diagram
O
b
s
e
r
v
e
f(x)
O
b
s
e
r
v
e
n
H

n
H

|0)
|0)
|0)
|0)
|0)
|0)
Schematic Diagram
O
b
s
e
r
v
e
f(x)
O
b
s
e
r
v
e
n
H

n
H

|0)
|0)
|0)
|0)
|0)
|0)
Schematic Diagram
O
b
s
e
r
v
e
f(x)
O
b
s
e
r
v
e
n
H

n
H

|0)
|0)
|0)
|0)
|0)
|0)
Simons Algorithm (cont)
( )
1
2
x x s +
1 1
2 2
1 1
2 2
H
(
(
=
(

(

4. Apply to each bit of
Result:
( ) ( )
( )
{ }
/ 2
0,1
1
1 1
22
n
x y x s y
n
y
y

e
(
+

1
mod2
n
i i
i
x y x y
=
| |
=
|
\ .

where
Simons Algorithm (cont)
5. Measure. Obtain a random y such that
( )
0. x y x s y s y = =
7. Solve for s. Can show solution is unique with
high probability.
6. Repeat steps 1-5 order n times. Obtain a
linear system over GF
2
:
1
2
0
0
s y
s y
=
=
Summary of Simon
Measuring the final state gives a vector y such
that

n-1 such constraints uniquely determine z, with
high probability.
Quantum parallelism: computing F for many
values simultaneously.
Quantum interference: Hadamard transform.

) 2 (mod 0 =
i i
z y
Quantum Simon: more details
An Open Question
(you could be famous!)
Concluding: Period finding
Function F:NN




such that F(x)=F(x+r) for all x.
Find r.
|x>
|0>
|x>
|F(x)>
F
Now we want to apply it to Shor
Period Finding
Given: Function f from {12
n
} to {12
n
}
Promise: There exists a secret integer r such
that f(x)=f(y) r | x-y for all x
Problem: Find r with as few queries as possible
Classically, order 2
n/3
queries to f needed
Inspired by Simon, Shor (1994) gave quantum
algorithm using order poly(n) queries
Example: r=5
0
1
2
3
4
5
6
7
8
9
10
0 1 2 3 4 5 6 7 8 9 10 11
Factoring and Discrete Log
Using period-finding, can factor integers in
polynomial time (Miller 1976)
Also discrete log: given a,b,N, find r such that
a
r
b(mod N)
Breaks widely-used public-key cryptosystems:
RSA, Diffie-Hellman, ElGamal, elliptic
curve systems
Order finding
The order of aeZ
N
*
modulo N is the smallest integer r>0
such that
a
r
1 (mod N)
For example, order of 4 mod 7 is 3:

4
1

4,
4
2
=162(mod 7),
4
3
=641 (mod 7),
4
4
=64*44 (mod 7),..

Factoring reduces to order-finding.
In the moment we will show how it reduces to order-
finding.


Four
again
Period finding
Function F:NN



such that F(x)=F(x+r) for all x.
Find smallest r.
|x>
|0>
|x>
|F(x)>
F
So now we have to create a function and find its order
oracle
Before we explain how order is used in factorization, we have to
review about some other problems, Simon, etc.
The algorithms
depend on what
we mean by
addition here
Algorithm [Shor, 1994]
|0>
|0>
F
Find factor by continued fraction expansion.
QFT QFT
Shors algorithm step-by-step
|0>
|0>
F
QFT QFT
> >

=
) ( | |
1
1
x F x
M
M
x
> >

=
0 | |
1
1
M
x
x
M
What is M?
The
second
register
Shors algorithm step by step
Measuring the second register leaves the
first register in a state consisting of all x
with the same F(x):
|d>+|d+r>++|d+ir>
|0>
|0>
F
QFT QFT
> >

=
) ( | |
1
1
x F x
M
M
x
> >

=
0 | |
1
1
M
x
x
M
The
second
register
Quantum Fourier transform (QFT)
> = >

=
k
i
e
M
j T
M
i
M
k j
|
2
1
|
1
0
t
If M=2, this is Hadamard transform.
We can check it by substituting M=2
QFT detects periods
Assume r divides M.


Then,

If j relatively prime with r,
|
|
.
|

\
|
|
.
|

\
|
+ + + + + >= r
r
M
d r d d
r M
1 ...
/
1
|

=
=
1
0
r
j
j
r
M
j a T
. gcd
r
M
r
M j
M, =
|
.
|

\
|

QFT detects periods
Assume r does not divide M.


Then, most of T|) consists of |k> with



r
r
d M
d r d d
(

+ + + + + =
1
...
r
M j
k

~
QFT detects periods
r
M
r
M 3
r
M 2
0
r
M
r
M 3
r
M 2
0
r divides M
r does not
divide M
Can we find r?
Continued fraction expansion
Number theory algorithm.
Given k, M, finds j, r such that


is smallest among all j and r s r
0
.
If M=O(r
2
), correct w.h.p.
r
M j
k

Summary of
Shors factoring algorithm
1. Reduce factoring to period-finding.
2. Generate a quantum state with period r.
In the easy case, QFT transforms a state
with period r into multiples of M/r.
General case: same but approximately.
Continued fraction algorithm finds the
closest multiple of M/r.
Conclusion
Known quantum algorithms can be split into 3
groups depending on the methods they use:
The first group contains algorithms which are based
on determining a common property of all the output
values. For example, Shors Algorithm.
The second group contains those which transform the
state to increase the likelihood that the ouput of
interest will be read, Grovers Algorithm.
The third group contains algorithms which are based
on a combination of methods from the previous two
groups.
Conclusion (cont.)
Currently very few quantum algorithms
are known and the search for new ones
has had very limited success due to the
absence of an understanding of why
quantum algorithms work.
Quantum algorithms can provide at most a
square-root speedup for carrying out an
unstructured search.
Resources
http://hplbwww2.hpl.hp.com/brims/websems/quantum/ekert/sli6.ht
ml
http://people.deas.harvard.edu/~rocco/Public/icalp01.pdf
http://www.dcs.ex.ac.uk/~jwallace/history.htm
http://planck.thphys.may.ie/jtwamley/thesis/Hovland/thesis/node43.
shtml
http://www.imsa.edu/~matth/cs299/
http://www.bell-labs.com/user/feature/archives/lkgrover/