Quantum walk algorithm for element distinctness

Quantum walk algorithm for element distinctness

arXiv:quant-ph/0311001v2 17 Apr 2004

Andris Ambainis∗

Abstract We use quantum walks to construct a new quantum algorithm for element distinctness and its generalization. For element distinctness (the problem of finding two equal items among N given items), we get an O(N 2/3 ) query quantum algorithm. This improves the previous O(N 3/4 ) query quantum algorithm of Buhrman et.al. (quant-ph/0007016) and matches the lower bound by Shi (quant-ph/0112086). The algorithm also solves the generalization of element distinctness in which we have to find k equal items among N items. For this problem, we get an O(N k/(k+1) ) query quantum algorithm.

1

Introduction

Element distinctness is the following problem. Element Distinctness. Given numbers x1 , . . . , xN ∈ [M ], are they all distinct? It has been extensively studied both in classical and quantum computing. Classically, the best way to solve element distinctness is by sorting which requires Ω(N ) queries. In quantum setting, Buhrman et.al. [14] have constructed a quantum algorithm that uses O(N 3/4 ) queries. Shi [32] has shown that any quantum algorithm requires at least Ω(N 2/3 ) quantum queries. In this paper, we give a new quantum algorithm that solves element distinctness with O(N 2/3 ) queries to x1 , . . . , xN . This matches the lower bound of [32, 7]. Our algorithm uses a combination of several ideas: quantum search on graphs [2] and quantum walks [27]. While each of those ideas has been used before, the present combination is new. We first reduce element distinctness to searching a certain graph with vertices S ⊆ {1, . . . , N } as vertices. The goal of the search is to find a marked vertex. Both examining the current vertex and moving to a neighboring vertex cost one time step. (This contrasts with the usual quantum search [24], where only examining the current vertex costs one time step.) We then search this graph by quantum random walk. We start in a uniform superposition over all vertices of a graph and perform a quantum random walk with one transition rule for unmarked vertices and another transition rule for marked vertices. The result is that the amplitude gathers in the marked vertices and, after O(N 2/3 ) steps, the probability of measuring the marked state is a constant. We also give several extensions of our algorithm. If we have to find whether x1 , . . ., xN contain k numbers that are equal: xi1 = . . . = xik , we get a quantum algorithm with O(N k/(k+1) ) queries for any constant1 k. ∗

Computer Science Division, University of California, Berkeley, CA 94720, USA and Institute of Mathematics and Computer Science, University of Latvia, Rai¸ na bulv. 29, R¯ıga, LV-1459, Latvia. E-mail: [email protected] 1 The big-O constant depends on k. For non-constant k, we can show that the number of queries is O(k2 N k/(k+1) ). The proof of that is mostly technical and is omitted in this version.

1

If the quantum algorithm is restricted to storing r√numbers, r ≤ N 2/3 , then we have an algorithm which solves element distinctness with O(N/ r) queries which is quadratically better 2 than the classical √ O(N /r) query algorithm. Previously, such quantum algorithm was known only for r ≤ N [14]. For the problem of finding k equal numbers, we get an algorithm that N k/2 ) queries and stores r numbers, for r ≤ N (k−1)/k . uses O( r(k−1)/2 For analysis of our algorithm, we develop a generalization of Grover’s algorithm (Lemma 3) which might be of independent interest.

1.1

Related work

Classical element distinctness. Element distinctness has been extensively studied classically. It can be solved with O(N ) queries and O(N log N ) time by querying all the elements and sorting them. Then, any two equal elements must be next one to another in the sorted order and can be found by going through the sorted list. In the usual query model (where one query gives one value of xi ), it is easy to see that Ω(N ) queries are also necessary. Classical lower bounds have also been shown for more general models (e.g. [23]). The algorithm described above requires Ω(N ) space to store all of x1 , . . . , xN . If we are restricted to space S < N , the running time increases. The straightforward algorithm needs 2 O( NS ) queries. Yao [34] has shown that, for the model of comparison-based branching programs, 2−o(1)

this is essentially optimal. Namely, any space-S algorithm needs time T = Ω( N S ). For more general models, lower bounds on algorithms with restricted space S is an object of ongoing research [11, 12]. Related problems in quantum computing. In the related collision problem [16], we are given a 2-1 function f and have to find x and y such that f (x) = f (y). This can be achieved in O(N 1/3 ) steps instead of Θ(N 1/2 ) steps required classically. [1, 32, 28] have shown that Ω(N 1/3 ) is also a quantum lower bound. Collision problem is related to element distinctness in a following way [32]. If element √ distinctness can be solved with M queries, then collision problem can be solved with O( M ) queries. Thus, a quantum algorithm for element distinctness implies a quantum algorithm for collision but not the other way around. Quantum search on graphs. The idea of quantum search on graphs was proposed by Aaronson and Ambainis [2] for finding a marked item on a d-dimensional grid (problem first considered by Benioff [13]) and other graphs with good expansion properties. Our work has a similar flavor but uses completely different methods to search the graph (quantum walk instead of ‘’divide-and-conquer”). Quantum walks. There has been considerable amount of research on quantum walks (e.g., [5, 30, 4, 9]) and their applications (e.g., [20, 18, 26, 31, 21]). We refer to [27] for an excellent survey on this topic. Applications of walks mostly fall into two classes. The first class is exponentially faster hitting times [20, 18, 26]. In these applications, quantum walks are used to find a certain vertex exponentially faster than classically. Our result is quite different from those, both in the problem that we consider and the way how we solve. While polynomial speedup achieved in our paper is smaller than exponential speedup in [18], our result has the advantage that we solve a natural problem which has been widely studied in both classical and quantum computing. The second class is quantum walk search algorithms [31, 21, 10]. In this direction, Shenvi et.al. [31] have constructed a counterpart of Grover’s search [24] based on quantum walk on hypercube. Childs and Goldstone [21] have used quantum walk on to produce a search algorithm on d-dimensional lattices (d ≥ 4) which is faster than the naive application of Grover’s search.

2

This direction is quite closely related to our work. The algorithms by [31, 21] and current paper solve different problems but all have similar structure. Recent developments. After the work described in this paper, the results and ideas from this paper have been used to construct several other quantum algorithms. Magniez et.al. [29] have used our element distinctness algorithm to give an O(n1.3 ) query quantum algorithm for finding triangles in a graph. Ambainis et.al. [10] have used ideas from the current paper to construct a faster algorithm for search on 2-dimensional grid. Childs and Eisenberg [19] have given a different analysis of our algorithm. Szegedy [33] has generalized our results on quantum walk for element distinctness to quantum walks on arbitrary graph.

2

Preliminaries

Let [N ] denote {1, . . . , N }. We consider the following problems. Element Distinctness. Given numbers x1 , . . . , xN ∈ [M ], are there i, j ∈ [N ], i 6= j such that xi = xj ? Element k-distinctness. Given numbers x1 , . . . , xN ∈ [M ], are there k distinct indices i1 , . . . , ik ∈ [N ] such that xi1 = xi2 = . . . = xik ? Element distinctness is a particular case of k-distinctness for k = 2. Our model is the quantum query model (for survey on query model, cf. [8, 17]). In this model, our goal is to compute a function f (x1 , . . . , xN ). For example, k-distinctness is viewed as the function f (x1 , . . . , xN ) which is 1 if there are k distinct i1 , . . . , ik ∈ [N ] such that xi1 = xi2 = . . . = xik and 0 otherwise. The input variables xi can be accessed by queries to an oracle X and the complexity of f is the number of queries needed to compute f . A quantum computation with T queries is just a sequence of unitary transformations U0 → O → U1 → O → . . . → UT −1 → O → UT . Uj ’s can be arbitrary unitary transformations that do not depend on the input bits x1 , . . . , xN . O are query (oracle) transformations. To define O, we represent basis states as |i, a, zi where i consists of ⌈log N ⌉ bits, a consists of ⌈log M ⌉ quantum bits and z consists of all other bits. Then, O maps |i, a, zi to |i, (a + xi ) mod M, zi. In our algorithm, we use queries in two P situations. The first is when a = |0i. Then, the input state to the query is some superposition i,z αi,z P|i, 0, zi and the state after the query is the same superposition with the information about x : i i,z αi,z |i, xi , zi. The second situation is when P the state before the query is i,z αi,z |i, −xi mod M, zi with the information about information about xi from a previous query. Then, applying the query transformation makes the state P α i,z i,z |i, 0, zi, Perasing the information about xi . This can be used to erase the information αi,z |i, xi , zi. We first perform a unitary that maps |xi i → | − xi mod M i, about xi from i,z P obtaining the state i,z αi,z |i, −xi mod M, zi and then apply the query transformation. The computation starts with a state |0i. Then, we apply U0 , O, . . ., O, UT and measure the final state. The result of the computation is the rightmost bit of the state obtained by the measurement. The quantum computation computes f with bounded error if, for every x = (x1 , . . . , xN ), the probability that the rightmost bit of UT Ox UT −1 . . . Ox U0 |0i equals f (x1 , . . . , xN ) is at least 1 − ǫ for some fixed ǫ < 1/2. To simplify exposition, we will occasionally describe a quantum computation by giving a classical algorithm with several quantum subroutines of the form Ut Ox Ut−1 . . . Ox U0 |0i. Any

3

such classical algorithm with quantum subroutines can be transformed into an equivalent sequence UT Ox UT −1 . . . Ox U0 |0i with the number of queries being equal to the number of queries in the classical algorithm plus the sum of numbers of queries in all quantum subroutines. Comparison oracle. In a different version of query model, we are only allowed comparison queries. In a comparison query, we give two indices i, j to the oracle. The oracle answers whether xi < xP j or xi ≥ xj . In the quantum model, we can query the comparison oracle with a superposition i,j ai,j |ii|ji. In section 6, we show that our algorithms can be adapted to this model with a logarithmic increase in the number of queries.

3

Algorithm

Our main results are Theorem 1 Element k-distinctness can be solved by a quantum algorithm with O(N k/(k+1) ) queries. In particular, element distinctness can be solved by a quantum algorithm with O(N 2/3 ) queries. Theorem 2 If memory of a quantum algorithm is restricted to O(r log M ) qubits, then element distinctness can be solved with O( √Nr + r) queries and element k-distinctness can be solved with k/2

N + r) queries. O( r(k−1)/2

Theorem 1 follows from Theorem 2 by setting r = ⌊N 2/3 ⌋ for element distinctness and r = ⌊N k/(k+1) ⌋ for k-distinctness. In the rest of this section, we present two algorithms. Algorithm 2 solves element distinctness if we have a promise that x1 , . . . , xN are either all distinct or there is exactly one pair i, j, i 6= j, xi = xj (and k-distinctness if we have a promise that there is at most one set of k indices i1 , . . . , ik such that xi1 = xi2 = . . . = xik ). Algorithm 3 solves general case by calling Algorithm 2 as subroutine several times. The proofs of correctness of algorithms 2 and 3 are given in sections 4 and 5, respectively.

3.1

Main ideas

We start with an informal description of our algorithm. For simplicity, we restrict to element distinctness and postpone the more general k-distinctness

till the end of this subsection. N Let r = N 2/3 . We define a graph G with Nr + r+1 vertices. The vertices vS correspond to sets S ⊆ [N ] of size r and r + 1. Two vertices vS and vT are connected by an edge if T = S ∪ {i} for some i ∈ [N ]. A vertex is marked if S contains i, j, xi = xj . Element distinctness reduces to finding a marked vertex in this graph. If we find a marked vertex vS , then we know that xi = xj for some i, j ∈ S, i.e. x1 , . . . , xN are not all distinct. The naive way to find a vertex in this graph would be to use Grover’s quantum search algorithm [24, 15]. If ǫ fraction of vertices are marked, then quantum search finds a marked vertex by examining O( √1ǫ ) vertices. Assume that there exist i, j ∈ [N ] such that i 6= j, xi = xj .

For a random S, |S| = N 2/3 , the probability of vS being marked is P r[i ∈ S; j ∈ S] = P r[i ∈ S]P r[j ∈ S|i ∈ S] =

N 2/3 N 2/3 − 1 1 · = (1 − o(1)) 2/3 . N N −1 N

Thus, a quantum algorithm can find a marked vertex by examining O( √1ǫ ) = O(N 1/3 ) vertices. However, to find out if a vertex is marked, the algorithm needs to query N 2/3 items xi , i ∈ S.

4

1. Apply the transformation 



X 2 2 |Si|yi → |Si  −1 + |yi + |y ′ i . N −r N − r y′ ∈S,y ′ 6=y / 



on the y register of the state in H. (This transformation is a variant of “diffusion transformation” in [24].) 2. Map the state from H to H′ by adding y to S and changing x to a vector of length k + 1 by introducing 0 in the location corresponding to y: 3. Query for f (y) and insert it into location of x corresponding to y. 4. Apply the transformation 

on the y register.

  |Si|yi → |Si −1 +



X 2 2 |y ′ i . |yi + r+1 r + 1 y′ ∈S,y′ 6=y 

5. Erase the element of x corresponding to new y by using it as the input to query for f (y). 6. Map the state back to H by removing the 0 component corresponding to y from x and then removing y from S. Algorithm 1: One step of quantum walk This makes the total query complexity O(N 1/3 N 2/3 ) = O(N ), giving no speedup compared to the classical algorithm which queries all items. We improve on this naive algorithm is by re-using the information from previous queries. Assume that we just checked if vS is marked by querying all xi , i ∈ S. If the next vertex vT is such that T contains only m elements i ∈ / S, then we only need to query m elements xi , i ∈ T − S instead of r = N 2/3 elements xi , i ∈ T . To formalize this, we can think of the following model. At each moment, we are at one vertex of G (superposition of vertices in quantum case). In one time step, we can examine if the current vertex vS is marked and move to an adjacent vertex vT . If, in this model, we can find a marked vertex in M steps, then we can solve element distinctness in M + r steps. To do that, we first use r queries to query all xi , i ∈ S for the starting vertex vS . Each next step involves moving to an adjacent vertex vT . This may involve querying one xi for i ∈ T − S. M moves involve M queries. Checking if the current vertex vS is marked requires no queries because we already know all xi , i ∈ S. Thus, the total number of queries is M + r. In the next sections, we will show how to search this graph by quantum walk in O(N 2/3 ) steps for element distinctness and O(N k/(k+1) ) steps for k-distinctness.

3.2

The algorithm

Let x1 , . . . , xN ∈ [M ]. Let r be the number of items that we are allowed
to store in our memory. We consider two Hilbert spaces H and H′ . H has dimension Nr M r (N − r) and the basis

5

1. Generate the uniform superposition q 1 (Nr )(N −r)

P

|S|=r,y ∈S /

|Si|yi.

2. Query all xi for i ∈ S. This transforms the state to 1 q

3. t1 = O((N/r)k/2 ) times repeat:

X

N
r

(N − r) |S|=r,y∈S /

|Si|yi

O i∈S

|xi i.

(a) Apply phase flip (the transformation |Si|yi|xi → −|Si|yi|xi) for S such that xi1 = xi2 = . . . = xik for k distinct i1 , . . . , ik ∈ S. √ (b) Perform t2 = O( r) steps of the quantum walk (algorithm 1). 4. Measure the final state. Algorithm 2: Single-solution algorithm 1. Let T = [N ]. 2. While |T | > r repeat:

| 2 (a) Run Algorithm 2 on xi , i ∈ T , with memory size equal to r ′ = ⌊ |T N r⌋ items . Measure the final state, obtaining a set S. If there are k equal elements xi , i ∈ S, stop, answer “not k-distinct”. 1 . (b) For each i ∈ T , remove i from T with probability 2k+1

3. Query all xi , i ∈ T classically. If k equal elements are found, answer “k-distinct”, otherwise, answer “not k-distinct”. Algorithm 3: Multiple-solution algorithm states H are |S, x, yi with S ⊆ [N ], |S| = r, x ∈ [M ]r , y ∈ [N ] − S. H′ has dimension
ofr+1 N M (r + 1). The basis states of H′ are |S, x, yi with S ⊆ [N ], |S| = r + 1, x ∈ [M ]r+1 , r+1 y ∈ S. In the states used by our algorithm, x will always be equal to (xi1 , . . . , xik ) where i1 , . . . , ik are elements of S in increasing order. We start by defining a quantum walk on H and H′ (algorithm 1). Each step of the quantum walk starts in a superposition of states in H. The first three steps map the state from H to H′ and the last three steps map it back to H. Our algorithm for k-distinctness is as follows. If there at most one set of√k values i1 , . . . , ik such that xi1 = xi2 = . . . = xik , we apply Algorithm 2 (t1 and t2 are c1 ∗ r and c2 ∗ ( Nr )k/2 for constants c1 and c2 which can be calculated from the analysis in section 4). This algorithm alternates quantum walk with a transformation that changes the phase if the current state contains k equal elements. 2

If we used the same memory size r throughout the algorithm, this would result in the number of queries being N k/2 O( r(k−1)/2 + r log N ), because r queries would be used in the first step of Algorithm 2 every time it is invoked and

6

If there can be more than one set of k equal elements, element k-distinctness is solved by algorithm 3 which samples subsets of xi and runs algorithm 2 on each subset. In section 5, we will show that, with a constant probability, at least one of sampled subsets contains unique i1 , . . . , ik satisfying xi1 = . . . = xik . This will reduce the correctness of Algorithm 3 to the correctness of Algorithm 2.

4 4.1

Analysis of single-collision algorithm Overview

√ The number of queries for algorithm 2 is r for creating the initial state and O((N/r)k/2 r) = k/2 N k/2 N ) for the rest of the algorithm. Thus, the overall number of queries is O(r + r(k−1)/2 ). O( r(k−1)/2 The correctness of algorithm 2 follows from Theorem 3 Let the input x1 , . . ., xN be such that xi1 = . . . = xik for exactly one set of k distinct values i1 , . . . , ik . With a constant probability, measuring the final state of algorithm 2 gives S such that i1 , . . . , ik ∈ S. Proof: Let |S, yi be a shortcut for the basis state |S, x, yi. (Since the |xi register always contains the state ⊗i∈S |xi i, the state of |xi is uniquely determined by S and y.) We classify the basis states |S, yi (|S| = r, y ∈ / S) into 2k + 1 types. A state |S, yi is of type (j, 0) if |S ∩ {i1 , . . . , ik }| = j and y ∈ / {i1 , . . . , ik } and of type (j, 1) if |S ∩ {i1 , . . . , ik }| = j and y ∈ {i1 , . . . , ik }. For j ∈ {0, . . . , k−1}, there are both type (j, 0) and type (j, 1) states. For j = k, there are only (k, 0) type states. ((k, 1) type is impossible because, if, |S ∩ {i1 , . . . , ik }| = k, then y ∈ / S implies y ∈ / {i1 , . . . , ik }.) ˜ be the Let |ψj,l i be the uniform superposition of basis states |S, yi of type (j, l). Let H (2k + 1)-dimensional space spanned by states |ψj,l i. For the space H′ , its basis states |S, yi (|S| = r + 1, y ∈ S) can be similarly classified into 2k + 1 types. We denote those types (j, l) with j = |S ∩ {i1 , . . . , ik }|, l = 1 if y ∈ {i1 , . . . , ik } and l = 0 otherwise. (Notice that, since y ∈ S for the space H′ , we have type (k, 1) but no type (0, 1).) Let |ϕj,l i be the uniform superposition of basis states |S, yi of type (j, l) for space H′ . Let H˜ ′ be the (2k + 1)-dimensional space spanned by |ϕj,l i. Notice that the transformation |S, yi → |S ∪ {y}, yi maps |ψi,0 i → |ϕi,0 i, |ψi,1 i → |ϕi+1,1 i. We claim ˜ to H ˜′ and steps 4-6 map H ˜ ′ to H. ˜ Lemma 1 In algorithm 1, steps 1-3 map H Proof: In section 4.2. ˜ to itself. Also, in algorithm 2, step 3b maps |ψk,0 i → −|ψk,0 i Thus, algorithm 1 maps H and leaves |ψj,l i for j < k unchanged (because |ψj,l i, j < k are superpositions of states |S, yi for which {i1 , . . . , ik } 6⊆ S and |ψk,0 i is a superposition of states |S, yi for which {i1 , . . . , ik } ⊆ S). ˜ to itself. Therefore, it suffice to analyze algorithms This means every step of algorithm 2 maps H ˜ 1 and 2 on subspace H. In this subspace, we will be interested in two particular states. Let |ψstart i be the uniform superposition of all |S, yi, |S| = r, y ∈ / S. Let |ψgood i = |ψk,0 i be the uniform superposition of all |S, yi with i ∈ S and j ∈ S. |ψstart i is the algorithm’s starting state. |ψgood i is the state we would like to obtain (because measuring |ψgood i gives a random set S such that {i1 , . . . , ik } ⊆ S). We start by analyzing a single step of quantum walk. Algorithm 2 might be invoked O(log N ) times.

7

˜ by one step of the quantum walk Lemma 2 Let S be the unitary transformation induced on H ˜ (algorithm 1). S has 2k + 1 different eigenvalues in H. One of them is√1, with |ψstart i being the eigenvector. The other eigenvalues are e±θ1 i , . . ., e±θk i with θj = (2 j + o(1)) √1r . Proof: In section 4.2.√ π ˜ t2 steps fix H ˜ as well. We set t2 = ⌈ 3√ r⌉. Since one step of quantum walk fixes H, k Moreover, |ψstart i will still be an eigenvector with eigenvalue 1. The other 2k eigenvalues √ ±i(

2π j √

+o(1))

3 k become e . Thus, every of those eigenvalues is a constant independent of N and r. This resembles one of analyses of Grover’s algorithm [3]. In this analysis, we have subspace H containing two vectors |ψstart i and |ψgood i with hψstart |ψgood i = α. Grover’s algorithm starts in state |ψstart i and applies a sequence of transformations (U2 U1 )t . U1 is defined by U1 |ψgood i = −|ψgood i and U1 |ψi = |ψi for any |ψi perpendicular to |ψgood i. U2 is defined by U2 |ψstart i = |ψstart i and U2 |ψi = −|ψi for any |ψi perpendicular to |ψstart i. The result of [3] is that, if we take t = c ∗ α1 for appropriate constant c, then (U2 U1 )t |ψstart i is almost equal to the state |ψgood i. In our case, the transformations U1 and U2 are steps 3a and 3b of algorithm 2. The transformation U1 acts similarly as above. However, the transformation U2 is different. We still have U2 |ψstart i = |ψstart√i but, for eigenstates |ψi perpendicular to |ψstart i, the amplitude changes

±i(

2π j √

+o(1))

3 k by factors of e (which are different for different eigenstates) instead of -1. The following lemma generalizes the analysis of [3] to our situation.

Lemma 3 Let H be a finite dimensional Hilbert space and |ψ1 i, . . ., |ψm i be an orthonormal basis for H. Let |ψgood i, |ψstart i be two states in H which are superpositions of |ψ1 i, . . ., |ψm i with real amplitudes and hψgood |ψstart i = α. Let U1 , U2 be unitary transformations on H with the following properties: 1. U1 is the transformation that flips the phase on |ψgood i (U1 |ψgood i = −|ψgood i) and leaves any state orthogonal to |ψgood i unchanged.

2. U2 is a transformation which is described by a real-valued m ∗ m matrix in the basis |ψ1 i, . . ., |ψm i. Moreover, U2 |ψstart i = |ψstart i and, if |ψi is an eigenvector of U2 perpendicular to |ψstart i, then U2 |ψi = eiθ |ψi for θ ∈ [ǫ, 2π − ǫ].

Then, there exists t = O( α1 ) such that hψgood |(U2 U1 )t |ψstart i = Ω(1). (The constant under Ω(1) is independent of α but can depend on ǫ.) Proof: In section 4.3. This lemma might also be interesting by itself. It says that, in Grover-like sequence of transformations (U2 U1 )t , we can significantly relax the constraints on U2 and the algorithm will still give similar result. It is quite likely that such situations might appear in analysis of other algorithms. For the walk resulting from element distinctness, Childs and Eisenberg [19] have shown that hψgood |(U2 U1 )t |ψstart i (and algorithm’s success probability) is 1 − o(1) instead of Ω(1), given by lemma 3. Their result, however, is not true for arbitrary transformations U1 and U2 satisfying conditions of lemma 3, just for ones resulting from element distinctness. Next, we show how to use lemma 3 to complete the proof of Theorem 3. By Lemma 3, there exists t1 = O( α1 ) such that the inner product of (U2 U1 )t1 |ψstart i and |ψgood i is a constant. Since |ψgood i is a superposition of |S, yi over S satisfying {i1 , . . . , ik } ⊆ S, measuring (U2 U1 )t1 |ψstart i gives a set S satisfying {i1 , . . . , ik } ⊆ S with a constant probability. It remains to calculate α. Let α′ be the fraction of S satisfying {i1 , . . . , ik } ⊆ S. Since |ψstart i is the uniform superposition of all |S, yi and |ψgood i is the uniform superposition of

8

|S, yi with {i1 , . . . , ik } ⊆ S we have α =

√ α′ . Also,

α′ = P r[{i1 , . . . , ik } ⊆ S] = P r[i1 ∈ S]

k Y

j=2

P r[ij ∈ S|{i1 , . . . , ij−1 } ⊆ S] =

k−1 r Y r−j rk = (1 − o(1)) k . N j=1 N − j N k/2

Therefore, α = Ω( Nr k/2 ) and t1 = O((N/r)k/2 ).

4.2

Proofs of Lemmas 1 and 2

˜ is mapped to H ˜′ , it suffices to show that each of basis Proof: [of Lemma 1] To show that H ˜′ . Consider vectors |ψj,0 i and |ψj,1 i for j ∈ {0, 1, . . . , k − vectors |ψj,l i is mapped to a vector in H 1}. Fix S, |S ∩ {i1 , . . . , ik }| = j. We divide y ∈ [N ] − S into two sets S0 and S1 . Let S0 = {y : y ∈ [N ] − S, y ∈ / {i1 , . . . , ik }}, S1 = {y : y ∈ [N ] − S, y ∈ {i1 , . . . , ik }}. Since |S ∩ {i1 , . . . , ik }| = j, S1 contains k − j elements. Since S0 ∪ S1 = [N P] − S contains N − r elements, S0 contains N − r − k + j elements. Define |ψS,0 i = √ 1 y∈S0 |S, yi and k−j P 1 |ψS,1 i = √ y∈S1 |S, yi. Then, we have N −r−k+j

|ψj,0 i = q

1


N r

X

S:|S|=r

|ψS,0 i

(1)

and, similarly for |ψj,1 i and |ψS,1 i. ′ Consider the step 1 of algorithm 1, applied to the state |ψS,0 i. Let |ψS,0 i be the resulting ′ state. Since the |Si register is unchanged, |ψS,0 i is some superposition of states |S, yi. Moreover, both the state |ψS,0 i and the transformation applied to this state in step 1 are invariant under permutation of states |S, yi, y ∈ S0 or states |S, yi, y ∈ S1 . Therefore, the resulting state must be invariant under such permutations as well. This means that every |S, yi, y ∈ S0 and every ′ ′ |S, yi, y ∈ S1 has the same amplitude in |ψS,0 i. This is equivalent to |ψS,0 i = a|ψS,0 i + b|ψS,1 i for some a, b. Because of equation (1), this means that step 1 maps |ψj,0 i to a|ψj,0 i + b|ψj,1 i. Steps 2 and 3 then map |ψj,0 i to |ϕj,0 i and |ψj,1 i to |ϕj+1,1 i. Thus, |ψj,0 i is mapped to a ˜ ′ : |ϕj,0 i and |ϕj+1,1 i. Similarly, |ψj,1 i is mapped to a superposition of two basis states of H (different) superposition of those two states. For j = k, we only have one state |ψk,0 i. A similar argument shows that this state is ˜′ . unchanged by step 1 and then mapped to |ϕk,0 i which belongs to H ˜ Proof: [of Lemma 2] We fix a basis for H consisting of |ψj,0 i, |ψj,1 i, j ∈ {0, . . . , j − 1} and ˜ ′ consisting of |ϕ0,0 i and |ϕj,1 i, |ϕj,0 i, j ∈ {1, . . . , m}. Let Dǫ be the |ψk,0 i and a basis for H matrix √   1 − 2ǫ 2 ǫ − ǫ2 √ . Dǫ = 2 ǫ − ǫ2 −1 + 2ǫ

9

˜ to H ˜′ induced by steps 1-3 of quantum Claim 1 Let U1 be the unitary transformation mapping H walk. Then, U1 is described by a block diagonal matrix   D k ... 0 0 N −r  0 0  0 D k−1 . . .   N −r   U1 =  . . . ... ... ... ... .    0 0 . . . D N1−r 0  0 0 ... 0 1

˜ spanned by |ψj,0 i and |ψj,1 i. Let H′ be the Proof: Let Hj be the 2-dimensional subspace of H j ˜ ′ spanned by |ϕj,0 i and |ϕj+1,1 i. 2-dimensional subspace of H From the proof of Lemma 1, we know that the subspace Hj is mapped to the subspace Hj′ . Thus, we have a block diagonal matrices with 2*2 blocks mapping Hj to Hj′ and 1*1 identity matrix mapping |ψk,0 i to |ϕk,0 i. It remains to show that the transformation from Hj to Hj′ is D k−j . N −r

Fix S for which |{i1 , . . . , ik } ∩ S| = j. Let |ψS,0 i and |ψS,1 i be as in the proof of Lemma 1. Then, step 1 of algorithm 1 maps |ψS,0 i to     X X 2 1  −1 + 2 √ |yi + |y ′ i = N −r N − r N −r−k+j ′ ′ y ∈S /

1 √ N −r−k+j

 −1 +

y 6=y,y ∈S /

2 2 + (N − r − k + j − 1) N −r N −r

X

y∈S0

|yi

X 2 1 |yi = N − r − k + j N − r y∈S 1 √   2(k − j) 2 N −r−k+j = 1− |ψS,0 i + |ψS,1 i N −r N −r

+(N − r − k + j) √

and |ψS,1 i to

   X X 2 2(k − j − 1) 2(k − j) 1  −1 + √ + |yi − |yi N −r N −r N −r k−j y∈S y∈S 1

0

√   2(k − j) 2 N −r−k+j = −1 + |ψS,1 i + |ψS,0 i. N −r N −r

Thus, step 1 produces the transformation D k−j on |ψS,0 i and |ψS,1 i. Since |ψj,0 i and |ψj,1 i are N −r

uniform superpositions of |ψS,0 i and |ψS,1 i over all S, step 1 also produces the same transformation D k−j on |ψj,0 i and |ψj,1 i. Steps 2 and 3 just map |ψj,0 i to |ϕj,0 i and |ψj,1 i to |ϕj+1,1 i. N −r

Similarly, steps 4-6 give the transformation U2 described by block-diagonal matrix   1 0 0 ... 0  0 D′ 1 0 ... 0    r+1 ′  0 . . . 0  0 D 2 U2 =  . r+1    ... ... ... ... ...  ′ 0 0 0 ... D k r+1

10

˜ ′ to H. ˜ Here, Dǫ′ denotes the matrix from H  −1 √ + 2ǫ Dǫ′ = 2 ǫ − ǫ2

√  2 ǫ − ǫ2 . 1 − 2ǫ

A step of quantum walk is S = U2 U1 . Let V be the diagonal matrix with odd entries on the diagonal being 1 and even entries being -1. Since V 2 = I, we have S = U2 V 2 U1 = U2′ U1′ for U2′ = U2 V and U1′ = V U1 . Let √ √     1√− 2ǫ 2 ǫ − ǫ2 1 − 2ǫ −2 ǫ − ǫ2 ′ √ = , E , Eǫ = ǫ 1 − 2ǫ 1 − 2ǫ 2 ǫ − ǫ2 −2 ǫ − ǫ2 Then, U1′ and U2′ are equal to U1 and U2 , with every Dǫ or Dǫ′ replaced by corresponding Eǫ or Eǫ′ . We will first diagonalize U1′ and U2′ separately and then argue that eigenvalues of U2′ U1′ are almost the same as eigenvalues of U2′ . Since U2′ is block diagonal, it suffices to diagonalize each block. 1*1 identity block has 2 eigenvalue 1. √ For a matrix Eǫ , its characteristic polynomial is λ √ − (2 − 4ǫ)λ + 1 = 0 and its ±(2+o(1))i ǫ 2 roots are 2ǫ ± √ . Thus, the eigenvalues of U′ 1 − 4ǫ i. For ǫ = o(1), this is equal to e √ 2 ±2 √

j

±2 √

i

j

i

r+1 N −r are 1, and e for j ∈ {1, 2, . . . , k}. Similarly, the eigenvalues of U1′ are 1, and e for j ∈ {1, 2, . . . , k}. To complete the proof, we use the following bound on the eigenvalues of the product of two matrices. (Appendix A shows how to derive this theorem from Hoffman-Wielandt theorem in matrix analysis [25].)

Theorem 4 Let A and B be unitary matrices. Assume that A has eigenvalues 1 + δ1 , . . ., 1 + δm , B has eigenvalues µ1 , . . ., µm and AB has eigenvalues µ′1 , . . ., µ′m . Then, |µi − µ′i | ≤

m X i=1

|δi |.

Let A = U1′ and B = U2′ . Since |eǫi − 1| ≤ |ǫ|, each of |δi | is of order O( √N1−r ). Therefore, their sum is of order O( √N1−r ) as well. Thus, for each eigenvalue of U2′ , there is a corresponding eigenvalue of U1′ U2′ that differs by at most by O( √N1−r ). The lemma now follows from √N1−r = 1 ). o( √r+1

4.3

Proof of Lemma 3

We assume that α is less than some small constant (for example, α < 0.1). Otherwise, we can just take t = 0 and get hψgood |(U2 U1 )t |ψstart i = hψgood |ψstart i ≥ 0.1. Consider the eigenvalues of U2 . Since U2 is described by a real m ∗ m matrix (in the basis |ψ1 i, . . ., |ψm i), its characteristic polynomial has real coefficients. Therefore, the eigenvalues are 1, -1, e±iθ1 , . . ., e±iθl . For simplicity, assume that there is no -1 eigenvalue. Let |wj,+ i, |wj,− i be the eigenvectors of U2 with eigenvalues eiθj , e−iθj . Let |wj,+ i = Pl Pl ∗ j ′ =1 cj,j ′ |ψj ′ i. (Since U2 is a real matrix, j ′ =1 cj,j ′ |ψj ′ i. Then, we can assume that |wj,− i = taking U2 |wj,+ i = eiθj |wj,+ i and replacing every number with its complex conjugate gives Pl U2 |wi = e−iθj |wi for |wi = j=1 c∗j,j ′ |ψj ′ i.) We write |ψgood i in a basis consisting of eigenvectors of U2 : |ψgood i = α|ψstart i +

l X j=1

(aj,+ |wj,+ i + aj,− |wj,− i).

11

(2)

W. l. o. g., assume that α and all aj,+ , aj,− are positive reals. (Otherwise, multiply |wj,+ i and |wj,− i by appropriate complex factors to make aj,+ or aj,− real.) P We also have aj,+ = aj,− . (To see that, let |ψgood i = lj ′ =1 bj ′ |ψj ′ i. Then, bj ′ are real (bePl cause vector |ψgood i and matrix U are both real). We have hψgood |wj,+ i = aj,+ = j ′ =1 bj ′ c∗j,j ′ Pl Pl and hψgood |wj,− i = aj,− = j ′ =1 bj ′ (c∗j,j ′ )∗ = ( j ′ =1 bj ′ c∗j,j ′ )∗ = a∗j,+ . Since aj,+ is real, this means aj,+ = aj,− .) Therefore, we denote aj,+ = aj,− as simply aj . Consider the vector   β |ψstart i+ |vβ i = α 1 + i cot 2     l l X X −θj + β θj + β aj 1 + i cot aj 1 + i cot |wj,+ i + |wj,− i. (3) 2 2 j=1 j=1

We have |vβ i = |ψgood i + i|vβ′ i where |vβ′ i = α cot

l l X X β −θj + β θj + β aj cot aj cot |ψstart i + |wj,+ i + |wj,− i. 2 2 2 j=1 j=1

Claim 2 If |vβ′ i is orthogonal to |ψgood i, then |vβ i is an eigenvector of U2 U1 with an eigenvalue of eiβ and |v−β i is an eigenvector of U2 U1 with an eigenvalue of e−iβ . Proof: Since |vβ′ i is orthogonal to |ψgood i, we have U1 |vβ′ i = |vβ′ i and U1 |vβ i = −|ψgood i+i|vβ′ i. Therefore,     l X −θj + β β aj eiθj −1 + i cot |ψstart i + |wj,+ i U2 U1 |vβ i = α −1 + i cot 2 2 j=1 +

l X j=1

Furthermore,

aj e

−iθj

  θj + β −1 + i cot |wj,− i. 2 π

1 + i cot x =

sin x + i cos x ei( 2 −x) = , sin x sin x π

ei( 2 +x) − sin x + i cos x = , −1 + i cot x = sin x sin x Therefore,     β β iβ 1 + i cot =e , −1 + i cot 2 2 θj     β π −θj + β ei( 2 + 2 + 2 ) −θj + β iβ eiθj −1 + i cot = 1 + i cot =e −θ +β 2 2 sin j2 and similarly for the coefficient of |wj,− i. This means that U2 U1 |vβ i = eiβ |vβ i. ′ For |v−β i, we write out the inner products hψgood |vβ′ i and hψgood |v−β i. Then, we see that ′ ′ ′ hψgood |v−β i = −hψgood |vβ i. Therefore, if |ψgood i and |vβ i are orthogonal, so are |ψgood i and ′ |v−β i. By the argument above, this implies that |v−β i is an eigenvector of U2 U1 with an eigenvalue e−iβ . Claim 3 There exists β = Ω(α) such that |vβ′ i is orthogonal to |ψgood i.

12

Proof: Let f (β) = hψgood |vβ′ i. We have f (β) = f1 (β) + f2 (β) where f1 (β) = α2 cot β2 and f2 (β) =

l X

  θj + β −θj + β . + cot a2j cot 2 2 j=1

We estimate each of f1 and f2 separately. First, we have cot Second, cot cos

θj +β 2

β 1 = = 2 tan β2

β 2

2 1 = + O(1). 2 β + O(β )

θj + β θj + β θj − β −θj + β + cot = cot − cot = 2 2 2 2

θj −β θ −β − cos j 2 2 θ −β θ +β sin j 2 sin j 2

sin

sin

θj +β 2

=−

sin β sin

θj +β 2

sin

θj −β 2

=−

β sin2

θj 2

+ O(β 2 ).

Pl a2 Therefore, f2 (β) = −Aβ + O(β 2 ) where A = j=1 2j θj . We have A = O(1). (Since θj ∈ sin 2 P P P 1 [ǫ, π−ǫ], A ≤ sin12 ǫ lj=1 a2j . Since ksk2 = α2 +2 lj=1 a2j , we have lj=1 a2j ≤ 21 and A ≤ 2 sin 2 ǫ .) Putting all together, we have that f (β) is equal to

f (β) = 0 for β = (1 + |vβ i kvβ k

√ o(1)) √2α A

= Θ(α).

2α2 β −Aβ

plus lower order terms. Therefore,

|v−β i kv−β k .

Let |u1 i = and |u2 i = We will show that |ψstart i is almost a linear combination of |u1 i and |u2 i. First, we express |u1 i and |u2 i in terms of |ψstart i and another vector |ψend i |vend i where defined by |ψend i = kv end k     l X θj −θj aj 1 + i cot aj 1 + i cot |wj,+ i + |wj,− i. |vend i = 2 2 j=1 j=1 l X

(4)

Claim 4 |u1 i = cstart i|ψstart i + cend |ψend i + |u′1 i, |u2 i = −cstart i|ψstart i + cend |ψend i + |u′2 i

for some cstart , cend , ku′1 k = O(β) and ku′2 k = O(β).

Proof: By regrouping terms in equation (3), we have |vβ i = αi cot

β |ψstart i + |vend i + |vβ′′ i 2

(5)

where |vβ′′ i = α|ψstart i+

    l X θj + β −θj + β −θj θj aj i cot aj i cot |wj,+ i+ |wj,− i. − cot − cot 2 2 2 2 j=1 j=1

l X

We claim that kvβ′′ k = O(β)kvβ k. We prove this by showing that the absolute value of each of coefficients in |vβ′′ i is O(β) times the absolute value of corresponding coefficient in |vβ i. The

13

coefficient of |ψstart i is α in |vβ′′ i and α(1 + i cot β2 ) in |vβ i. For small β, cot β2 is of order Ω( β1 ). Therefore, α = O(β)|α(1 + i cot β2 )|. For the coefficient of |wj,+ i, we have cot

cos −θj + β −θj − cot = 2 2

For small β, this is approximately and

β 2 sin2

−θj 2

≤

β 2 sin2

ǫ 2

−θj +β 2

sin sin

sin sin

−θj +β 2 −θj 2

−θj 2

cos

=

sin β2 sin

−θj +β 2

sin

−θj 2

.

θ

β 2 sin2

−θj 2 − −θj +β 2

−θj 2

. Since θj ∈ [ǫ, π − ǫ], we have | sin − 2j | ≥ sin 2ǫ

= O(β). Therefore, the absolute value of coefficient of |wj,+ i in |vβ′′ i is −θ +β

O(β) ∗ aj . On the other hand, the coefficient of |wj,+ i in |vβ i is aj (1 + i cot j2 ) which is of absolute value at least aj . Similarly, we can bound the absolute value of coefficient of |wj,− i. By dividing equation (5) by kvβ k, we get α cot

β

|u1 i = cstart i|ψstart i + cend |ψend i + |u′1 i

k and |u′1 i = kv1β k |vβ′′ i. Since kvβ′′ k = O(β)kvβ k, we have for cstart = kvβ k2 , cend = kvkvend βk ku′1 k = O(β). The proof for u2 is similar. Since |u1 i and |u2 i are eigenvectors of U2 U1 with different eigenvalues, they must be orthogonal. Therefore, we have

hu1 |u2 i = −c2start + c2end + O(β) = 0. Also, ku1 k2 = c2start + c2end + O(β 2 ) = 1.

These two equalities together imply that cstart = √12 + O(β) and cend = we have 1 1 |u1 i = √ i|ψstart i + √ |ψend i + |u′′1 i, 2 2 1 1 |u2 i = − √ i|ψstart i + √ |ψend i + |u′′2 i, 2 2 with ku′′1 k = O(β) and ku′′2 k = O(β). This means that

√1 2

+ O(β). Therefore,

i i |ψstart i = − √ |u1 i + √ |u2 i + |w′ i, 2 2

π kw′ k = O(β). Let t = ⌊ 2β ⌋. Then, (U2 U1 )t |u1 i is almost i|u1 i (plus a term of order O(β)) and (U2 U1 )t |u2 i is almost −i|u2 i. Therefore,

(U2 U1 )t |ψstart i = |ψend i + |v ′ i

where kv ′ k = O(β). This means that the inner product hψgood |(U2 U1 )t |ψstart i is hψgood |ψend i plus a term which is O(β). To complete the proof, it suffices to show Claim 5 hψgood |ψend i = Ω(1). hψ

|vend i kvend k ,

|v

i

end we have hψgood |ψend i = good . By definition of |vend i kvend k Pl Pl 2 2 (equation (4)), hψgood |vend i = 2 j=1 aj . By equation (2), kψgood k = α2 + 2 j=1 a2j . Since kψgood k2 = 1, we havehψgood |vend i = 1 − α2 . Since α < 0.1 (see beginning of the proof), we have hψgood |ψend i ≥ kv0.99 . end k Pl θ We have kvend k2 = a20 + 2 j=1 a2j (1 + cot2 2j ). Since θk ∈ [ǫ, π − ǫ], kvend k2 ≤ a20 + Pl 0.99 which is a constant if ǫ is fixed. 2 j=1 a2j (1 + cot2 ǫ) ≤ (1 + cot2 ǫ) and hψgood |ψend i ≥ √1+cot 2ǫ

Proof: Since |ψend i =

14

5

Analysis of multiple-collision algorithm

We claim Theorem 5

(a) Algorithm 2 uses O(r +

N k/2 ) r (k−1)/2

queries.

(b) Let p be the success probability of algorithm 2, if there is exactly one k-collision. For any x1 , . . . , xN containing at least one k-collision, algorithm 3 finds a k-collision with probability at least p/2. Proof: Part (a). The last step of algorithm 3 uses at most r queries and is performed at most N k/2 once. Therefore, it suffices to show that algorithm 3 uses O(r + r(k−1)/2 ) queries in its second step (the while loop). Let Ti be the set T during ith repetition of the loop in algorithm 3. Then |T1 | = N , 1 1 )N and E|Ti+1 | = (1 − 2k+1 )i N . If Algorithm 3 invokes Algorithm 2 on M E|T2 | = (1 − 2k+1 r∗M ′ elements, it uses memory size r = N . Therefore, the number of queries used by Algorithm 2 is at most    (k−1)/2  √ N r M k/2 ′ M = c + r M + c N (r′ )(k−1)/2 r(k−1)/2 for some big-O constant c. The overall number of queries in the loop is at most  (k−1)/2  ∞ X p N r E c |T | . ∗ |T | + i i N r(k−1)/2 i=1 Since x and c

(6)

√ x functions are concave, equation (6) is at most

∞ ∞ ∞ X r r X N (k−1)/2 p N (k−1)/2 X p E|Ti | + c ( (k−1)/2 ∗ E|Ti | + E|Ti |) = c (k−1)/2 E|Ti |. N N i=1 r r i=1 i=1

Since E|Ti+1 | = (1 − c

1 i 2k+1 ) N ,

this is equal to

i/2 i ∞  ∞  1 1 r X N (k−1)/2 √ X 1 − 1 − + c . N N 2k + 1 N i=1 2k + 1 r(k−1)/2 i=0

Each of two sums is over a decreasing geometric progression. If k is constant, these sums are constant and the number of queries is of order N (k−1)/2 √ r N k/2 N + N = + r. N r(k−1)/2 r(k−1)/2 Part (b). If x1 , . . . , xN contain exactly one k-collision, then running algorithm 2 on all of x1 , . . . , xN finds the k-collision with probability at least p. If x1 , . . . , xN contain more than one k-collision, we can have three cases: 1. For some i, Ti contains more than one k-collision but Ti+1 contains exactly one k-collision. 2. For some i, Ti contains more than one k-collision but Ti+1 contains no k-collisions. 3. All Ti contain more than one k-collision (till |Ti | becomes smaller than N 2/3 and the loop is stopped). In the first case, performing algorithm 2 on xj , j ∈ Ti+1 finds the k-collision with probability at least p. In the second case, we have no guarantees about the probability at all. In the third case, the last step of algorithm 3 finds one of k-collisions with probability 1.

15

We will show that the probability of the second case is always less than the probability of the first case. This implies that, with probability at least 1/2, either first or third case occurs. Therefore, the probability of algorithm 3 finding a k-collision is at least p/2. To complete the proof, we show Lemma 4 Let T be a set containing a k-collision. Let N onei be the event that xj , j ∈ Ti contains no k equal elements and U niquei be the event that xj , j ∈ Ti contains a unique set of k equal elements. Then, P r[U niquei+1 |Ti = T ] > P r[N onei+1 |Ti = T ]. The probability of the first case is just the sum of probabilities P r[U niquei+1 ∧ Ti = T ] = P r[T ]P r[U niquei+1 |Ti = T ] over all i and T such that |T | > N k/(k+1) and T contains more than one k-collision. The probability of the second case is a similar sum of probabilities P r[N onei+1 ∧ Ti = T ] = P r[T ]P r[N onei+1 |Ti = T ]. Therefore, P r[U niquei+1 |Ti = T ] > P r[N onei+1 |Ti = T ] implies that the probability of the second case is less than the probability of the first case. It remains to prove the lemma. Proof: [of Lemma 4] Let x be such that xj = x for at least k numbers xj , j ∈ Ti . Let J be the set of all j ∈ Ti such that xj = x. Let m = |J|. Notice that m ≥ k (by definition of x and J). Let Pl be the event that l of numbers in J belong to Ti+1 . Then, l  m−l   1 1 m , 1− 2k + 1 2k + 1 l
m P r[Pl ] l+1 1 1 1 l
= = m · · · . 1 P r[Pl+1 ] 2k + 1 m − l 2k 1 − 2k+1 l+1 P r[Pl ] =

For l ≤ k − 1, we have l + 1 ≤ k and m − l ≥ k − l ≥ 1. Therefore, 1 P r[Pk ] and l ≤ k − 1. This implies P r[Pl ] ≤ 2k−l k−1 X l=0

P r[Pl ] ≤

k−1 X l=0

1 2k−l

!

l+1 1 m−l 2k

1 ≤ k 2k =

1 2

for

P r[Pk ] ≤ P r[Pk ].

Let p be the probability of no k equal elements from xj , Ti − J being in Ti+1 . Event N onei+1 occurs if two conditions are satisfied: • at most k − 1 elements from J are in set Ti+1 and

• no k equal elements from xj , j ∈ Ti − J are in Ti+1 .

The two conditions are independent and the probability of the second condition. Therefore, Pk−1 P r[N onei+1 |Ti = T ] = p l=0 P r[Pl ] < pP r[Pk ]. Consider the case when exactly k elements from J are in set Ti+1 and no k equal elements from xj , j ∈ Ti − J are in Ti+1 . This happens with probability pP r[Pk ]. Therefore, P r[U niquei+1 |Ti = T ] ≥ pP r[Pk ] and P r[U niquei+1 |Ti = T ] ≥ P r[N onei+1 |Ti = T ].

16

6

Running time and other issues

Running time. What is the running time of our algorithm if non-query transformations are taken into account? All that we do between queries is Grover’s diffusion operator which can be implemented in O(log N ) quantum time and some data structure operations on set S (for example, insertions and deletions). In the next paragraphs, we will show how to store S in a classical data structure which supports the necessary operations in O(log N ) time. If the quantum model is sufficiently powerful, it should be possible to transform O(log N ) step classical computation into O(logc N ) step quantum computation. Then, our algorithm would run in O(N 2/3 logc N ) steps. We take a hash table in which {1, . . . , N } is hashed to r buckets by a hash function h : [N ] → [r]. The k th bucket stores pairs (y, xy ) for y ∈ S such that h(y) = k. Each bucket has c ∗ log N memory locations allocated to it. Pairs (y, xy ) are stored in these locations, in the order of increasing y. To add y to S, we compute h(y) and insert (y, xy ) into the array for the h(y)th bucket. Deletion is similar. Performing diffusion transform (steps 1 and 4 of algorithm 1) is slightly more complicated. Diffusion transform can be implemented with O(log N ) quantum gates [24] but, in our case, we have the extra requirement that it must be performed only on |yi, y ∈ S (or y ∈ / S), not all |yi, y ∈ [N ] as in [24]. To do that, we need to implement a 1-1 mapping f between between S and {1, . . . , |S|} (or between [N ] − S and {1, . . . , N − |S|}). Once we have such mapping, we can carry out the transformation |yi → |f (y)i by |yi|0i → |yi|f (y)i → |0i|f (y)i where the first step is a calculation of f (y) from y and the second step is the reverse of a calculation of y from f (y). The transformation |yi → |f (y)i maps the set |yi, y ∈ S to the set |yi, y ∈ {1, . . . , |S|}. Then, we can implement diffusion over this set efficiently as in [24] and apply the transformation |f (y)i → |yi, mapping {1, . . . , |S|} back to S. The mapping f can be defined as follows. f (y) = f1 (y) + f2 (y) where f1 (y) is the number of items i ∈ S that are mapped to buckets k, k < h(y) and f2 (y) is the number of items y ′ ≤ y that are mapped to bucket h(y). It is easy to see that f is 1-1 mapping from S to {1, . . . , |S|}. f2 (y) can be computed by counting the number of items in bucket h(y) in time O(log N ). To implement f1 (y), we use a full binary tree of depth ⌈log2 r⌉. The leaves of the tree (in the order from left to right) correspond to r buckets of the hash table (in the order from 1 to r). At the k th leaf, we store the number of y ∈ S such that h(y) = k. At each internal node v, we store the number of y ∈ S such that h(y) is equal to some leaf in the subtree rooted at v. Then, f1 (y) can be computed by following the path from the root to h(y) and counting the number of y ′ such that h(y ′ ) is to the left of this path (and, thus, to the left of h(y)). This can be done in time O(log r). We also need to ensure that the tree get updated when the hash table changes. Whenever we add or delete an item to a bucket k, we add or delete 1 to all vertices on the path from the root to k. This can be carried out in time O(log r) because the depth of the tree is O(log r). Making a data structure part of quantum algorithm creates two subtle issues. First, there is the uniqueness problem. In many classical data structures, the same set S can be stored in many equivalent ways, depending on the order in which elements were added/deleted. In the quantum case, this would mean that the basis state |Si is replaced by many states |S 1 i, |S 2 i, . . . which in addition to S store some information about the previous sets. This can have very bad result. In the original quantum algorithm, we might have α|Si interfering with −α|Si, resulting in 0 amplitude for |Si. If α|Si − α|Si becomes α|S 1 i − α|S 2 i, there is no interference between |S 1 i and |S 2 i and the result of the algorithm can be different. To avoid this problem, we need a data structure where the same set S ⊆ [N ] is always stored in the same way, independent of how S was created. Hash table has this property (as long as

17

elements in each bucket are sorted by i and not by order in which they are added). Second, if we use a classical subroutine, it must terminate in a fixed time t. Only then, we can replace it by an O(poly(t)) time quantum algorithm. The subroutines that take time t on average (but might take longer time sometimes) are not acceptable. Does hash table satisfy this requirement? As long as no bucket overflows (gets more than c log N items hashed to it), all the operations are carried out in time O(log N ). Furthermore, the probability of more than c log N items being hashed to one bucket is exponentially small. Therefore, we can modify hash table algorithms so that they stop if the bucket overflows, even if that means incorrect result. Then, the classical subroutines always terminate in O(log N ) time and give correct results with probability at least 1 − 2Ω(N ) . Such subroutines can be then transformed into quantum subroutines with O(logc N ) steps. Since the total number of steps in our algorithm is polynomial in N , the final state is not significantly affected by the cases when the result of subroutine is incorrect. Comparison model. Our algorithm can be adapted to the model of comparison queries similarly to the algorithm of [14]. Instead of having the register ⊗j∈S |xj i, we have a register |j1 , j2 , . . . , jr i where |jl i is the index of the lth smallest element in the set S. √Given such register and y ∈ [N ], we can add y to |j1 , . . . , jr i by binary search which takes O(log N 2/3 ) = O(log N ) queries. We can also remove a given x ∈ [N ] in O(log N ) queries by reversing this process. This gives an algorithm with O(N 2/3 log N ) queries. However, it is open whether we can have O(N 2/3 logc N ) running time in comparison model. (Hash table solution does not work because it is not clear how to maintain a hash table in comparison model.)

7

Open problems 1. Time-space tradeoffs. Our optimal O(N 2/3 )-query algorithm requires space to store O(N 2/3 ) items. By Shi’s lower bound [32, 7], we know there is no algorithm with less queries. But can we have an O(N 2/3 ) query algorithm that uses less space? A related open problem is: how many queries do we need if algorithm’s memory is restricted to r items? Our algorithm needs O( √Nr ) queries and this is the best known. Curiously, the 2

lower bound for deterministic algorithms in comparison query model is Ω( Nr ) queries [34] which is quadratically more. This suggests that our algorithm might be optimal in this setting as well. However, the only lower bound is the Ω(N 2/3 ) lower bound for algorithms with unrestricted memory [32]. 2. Optimality of k-distinctness algorithm. While element distinctness is known to require Ω(N 2/3 ) queries, it is open whether our O(N k/(k+1) ) query algorithm for kdistinctness is optimal. The best lower bound for k-distinctness is Ω(N 2/3 ), by a following argument. We take an instance of element distinctness x1 , . . . , xN and transform it into k-distinctness by repeating every element k − 1 times. If x1 , . . . , xN are all distinct, there is no k equal elements. If there are i, j such that xi = xj among original N elements, then repeating each of them k − 1 times creates 2k − 2 equal elements. Therefore, solving k-distinctness on (k − 1) ∗ N elements requires at least the same number of queries as solving distinctness on N elements (which requires Ω(N 2/3 ) queries). 3. Generalizing our algorithm. It is plausible that the methods developed in this paper could be useful for other quantum algorithms as well. To make them more applicable, it would be very useful to state our result in a general and easy-to-use form (like amplitude

18

amplification of [15] or quantum lower bound theorems of [6] which can be easily used without understanding every detail of their proofs). A big step in this direction has been made by Szegedy [33]. 4. Quantum walks on other graphs. A quantum walk search algorithm based on similar ideas can be used for Grover search on grids [10, 21]. What other graphs can quantumwalks based algorithms search? Is there a graph-theoretic property that determines if quantum walk algorithms work well on this graph? By Szegedy’s recent work [33], we know that eigenvalue gap is important. If a graph has a large gap between the first and the second eigenvalue, quantum walks work well on this graph. However, there are some graphs with a small eigenvalue gap (for example, grids studied in [10]) on which quantum walks also do well. Thus, big eigenvalue gap is sufficient but not necessary. Acknowledgments. Thanks to Scott Aaronson for showing that k-distinctness is at least as hard as distinctness (remark 2 in section 7), to Robert Beals, Greg Kuperberg and Samuel Kutin for pointing out the “uniqueness” problem in section 6 and proposing hash table as a solution to it and to Andrew Childs, Daniel Gottesman, Julia Kempe, Samuel Kutin, Frederic Magniez and Mario Szegedy for comments and discussions.

References [1] S. Aaronson. Quantum lower bound for the collision problem. Proceedings of STOC’02, pp. 635-642. Also quant-ph/0111102. [2] S. Aaronson, A. Ambainis. Quantum search of spatial structures. Proceedings of FOCS’03, pp. 200-209. Also quant-ph/0303041. [3] D. Aharonov. Quantum computation - a review. Annual Review of Computational Physics(ed. Dietrich Stauffer), vol. VI, World Scientific, 1998. Also quant-ph/9812037. [4] D. Aharonov, A. Ambainis. J. Kempe, and U. Vazirani. Quantum walks on graphs, Proceedings of STOC’01, pp. 50–59. quant-ph/0012090. [5] Y. Aharonov, L. Davidovich, and N. Zagury. Quantum Random Walks. Physical Review A, 48:1687, 1993. [6] A. Ambainis. Quantum lower bounds by quantum arguments. Journal of Computer and System Sciences, 64: 750-767, 2002. Also STOC’00 and quant-ph/0002066. [7] A. Ambainis. Quantum lower bounds for collision and element distinctness with small range, quant-ph/0305179. [8] A. Ambainis. Quantum query algorithms and lower bounds. Proceedings of FOTFS’III, to appear. Journal version under preparation. [9] A. Ambainis, E. Bach, A. Nayak, A. Vishwanath, and J. Watrous. One-dimensional quantum walks. Proceedings of STOC’01, pp. 37-49. [10] A. Ambainis, J. Kempe, A. Rivosh. Coins make quntum walks faster, quant-ph/0402107. [11] P. Beame, T. Jayram, M. Saks. Time-Space Tradeoffs for Branching Programs. Journal of Computer and System Sciences, 63: 542-572, 2001. Also FOCS’98. [12] P. Beame, M. Saks, X. Sun, E. Vee. Time-space trade-off lower bounds for randomized computation of decision problems. Journal of the ACM, 50: 154-195, 2003. Also FOCS’00.

19

[13] P. Benioff. Space searches with a quantum robot.Quantum Computation and Quantum Information: A Millennium Volume, AMS Contemporary Mathematics Series, 2002. Also quant-ph/0003006. [14] H. Buhrman, C. Durr, M. Heiligman, P. Hoyer, F. Magniez, M. Santha, and R. de Wolf. Quantum algorithms for element distinctness. 16th IEEE Annual Conference on Computational Complexity (CCC’01), pp.131-137, quant-ph/0007016. [15] G. Brassard, P. Høyer, M. Mosca, and A. Tapp. Quantum amplitude amplification and estimation, Quantum Computation and Quantum Information: A Millennium Volume, AMS Contemporary Mathematics Series, 2002. quant-ph/0005055. [16] G. Brassard, P. Høyer, and A. Tapp. Quantum cryptanalysis of hash and claw-free functions. Proceedings of LATIN’98, Lecture Notes in Computer Science, 1380:163-169, 1998. Also quant-ph/9705002. [17] H. Buhrman, R. de Wolf. Complexity measures and decision tree complexity: a survey. Theoretical Computer Science, 288:21-43, 2002. [18] A. Childs, R. Cleve, E. Deotto, E. Farhi, S. Gutmann, D. Spielman Exponential algorithmic speedup by quantum walk. Proceedings of STOC’03, pp. 59-68. quant-ph/0209131. [19] A. Childs, J. Eisenberg. Quantum algorithms for subset finding. quant-ph/0311038. [20] A. Childs, E. Farhi, S. Gutmann. An example of the difference between quantum and classical random walks. Journal of Quantum Information Processing, 1:35, 2002. Also quant-ph/0103020. [21] A. Childs, J. Goldstone. Spatial search by quantum walk, quant-ph/0306054. [22] E. Farhi, S. Gutmann. Quantum computation and decision trees. Physical Review A, 58:915928, 1998. Also quant-ph/9706062 [23] D. Grigoriev, M. Karpinski, F. Meyer auf der Heide, and R. Smolensky. A lower bound for randomized algebraic decision trees. Proceedings of STOC’96, pp. 612–619. [24] L. Grover. A fast quantum mechanical algorithm for database search. Proceedings of STOC’96, pp. 212-219, quant-ph/9605043. [25] R. Horn, C. Johnson Matrix Analysis, Cambridge University Press, 1985. [26] J. Kempe. Quantum random walks hit exponentially faster Proceedings of RANDOM’03, Lecture Notes in Computer Science, 2764:354-369, 2003. Also quant-ph/0205083 [27] J. Kempe. Quantum random walks - an introductory overview, Contemporary Physics, 44:307-327, 2003. Also quant-ph/0303081. [28] S. Kutin. A quantum lower bound for the collision problem. quant-ph/0304162. [29] F. Magniez, M. Santha, M. Szegedy. An O(n˜1.3 ) quantum algorithm for the triangle problem. quant-ph/0310134. [30] D. Meyer. From quantum cellular automata to quantum lattice gases, Journal of Statistical Physics, 85:551-574, 1996. Also quant-ph/9604003. [31] N. Shenvi, J. Kempe, K. Whaley. Quantum random-walk search algorithm, Physical Review A, 67:052307, 2003. Also quant-ph/0210064. [32] Y. Shi. Quantum lower bounds for the collision and the element distinctness problems. Proceedings of FOCS’02, pp. 513-519. quant-ph/0112086. √ [33] M. Szegedy. Spectra of quantized walks and a δǫ rule, quant-ph/0401053. [34] A. Yao. Near-optimal time-space tradeoff for element distinctness. Proceedings of FOCS’88, pp. 91-97.

20

A

Derivation of Theorem 4

Theorem 4 follows from Hoffman-Wielandt inequality. Definition 1 For a matrix C = (cij ), we define its l2 -norm as kCk =

qP

2 i,j cij .

Theorem 6 [25, pp. 292] If U is unitary, then kU Ck = kCk for any C.

Theorem 7 [25, Theorem 6.3.5] Let C and D be m∗m matrices. Let µ1 , . . ., µm and µ′1 , . . . , µ′m be eigenvalues of C and D, respectively. Then, m X i=1

(µi − µ′i )2 ≤ kA − Bk2 .

To derive theorem 4 from theorem 7, let C = B and D = AB. Then, C − D = (I − A)B. Since B is unitary, kC −Dk = kI −Ak (Theorem 6). Let U be a unitary matrix that diagonalizes A. Then, U (I − A)U −1 = I − U AU −1 and kI − Ak = kI − U AU −1 k. Since U AU −1 is a diagonal matrix with 1 + δi P on the diagonal, I − U AU −1 is a diagonal matrix with δi on the diagonal and 2 −1 −1 2 kI − U AU k = m , we get i=1 |δi | By applying Theorem 7 to I and U AU m X i=1

(µi − µ′i )2 ≤

m X i=1

|δi |2 .

Pm In particular, for every i, we have (µi − µ′i )2 ≤ ( i=1 |δi |)2 and v um m X uX ′ |µi − µi | ≤ t |δi |. |δi |2 ≤ i=1

21

i=1