Quantum Algorithm for Identifying Hidden Polynomial Function Graphs

Transcription

1 Quantum Algorithm for Identifying Hidden Polynomial Function Graphs Thomas Decker Jan Draisma Pawel Wocjan arxiv: v1 [quant-ph] 8 Jun 2007 Abstract In a recent paper we studied the Hidden Polynomial Function Graph Problem. The task is to identify an unknown polynomial that is hidden by a black box. We obtained efficient quantum algorithms for univariate quadratic and cubic polynomials over finite fields, i.e., the number of elementary operations is polylogarithmic in the field size. We extend these results by designing efficient algorithms for m-variate polynomials of arbitrary fixed total degree n provided that the characteristic is sufficiently large, where m and n are considered to be fixed parameters. We show that it suffices to query the black box n m + n m n times. These results are based on a classical reduction of the multivariate problem to the univariate one for which we provide a quantum algorithm. 1 Introduction Recently, new ways of generalizing the abelian Hidden Subgroup Problem have been proposed in [1, 2] and [7]. The idea is to consider hidden structures that correspond to polynomial equations over finite fields. We defined and studied the Hidden Polynomial Function Graph Problem [7] which is a special case of the Hidden Polynomial Problem formulated in [1, 2]. We obtained efficient algorithms for univariate quadratic and cubic function graphs, whereas no efficient algorithms are currently known for the general Hidden Polynomial Problem. Our algorithm is an extension of the standard approach to Hidden Subgroup Problems where the black-box problem is reduced to a quantum state identification problem. For the Hidden Polynomial Function Graph Problem we constructed an orthogonal measurement for distinguishing the states. We formulated this measurement in such a way that its success probability and implementation are closely tied to properties of a certain classical algebro-geometric problem involving polynomial equations. Department of Computer Science & Engineering, University of Washington, Seattle, WA 98195, USA. Electronic address: decker@ira.uka.de Department of Mathematics and Computer Science, Technische Universiteit Eindhoven, PO Box 513, 5600 MB Eindhoven, The Netherlands. Electronic address: j.draisma@tue.nl School of Electrical Engineering and Computer Science, University of Central Florida, Orlando, FL 32816, USA. Electronic address: wocjan@cs.ucf.edu 1

2 For the quadratic and cubic cases we showed that the algebro-geometric problems can be solved efficiently and lead to an efficient implementation of the measurements. This was done by computing Gröbner basis and studying their properties for different cases. However, this direct approach is not practicable for multivariate or higher degree polynomials making it necessary to use other techniques in the present paper. To this end, we reformulate the algebro-geometric problem in terms of generic morphisms between affine spaces and we show that an approximate version of the orthogonal measurement can be implemented efficiently and identifies the states with constant success probability. Furthermore, we show that for m-variate polynomials of degree n or less the quantum query complexity is at most n m + n m n, which is independent of the field size d in contrast to the classical situation. We also show that the time complexity is polylogarithmic in d, whereas the classical time and query complexities are polynomial in d. This paper is organized as follows. In Section 2 we recapitulate the definition of the Hidden Polynomial Function Graph Problem and show that it suffices to solve the univariate case on a quantum computer. In Section 3 we explain how the problem can be reduced to a state distinguishing problem. We also present an idealized measurement relying on the solution of an algebro-geometric problem to illustrate the basic ideas of our algorithm. In Section 4 we analyze this problem thoroughly. In Section 5 we complete our proof by showing that the hidden polynomial function graphs can be identified efficiently with an approximate version of the measurement. In Section 6 we conclude and discuss possible objectives for further research. 2 Hidden Polynomial Function Graph Problem The hidden polynomial function graph problem is defined as follows [7]. Definition (Hidden Polynomial Function Graph Problem). Let F be a finite field of size d and let Q(X 1,...,X m ) F[X 1,...,X m ] be an arbitrary polynomial with total degree deg(q) n and vanishing constant term. Furthermore, let B : F m+1 F be a black-box function with B(r 1,...,r m,s) := π(s Q(r 1,...,r m )) where π is an arbitrary and unknown permutation of the elements of F. The Hidden Polynomial Function Graph Problem is to identify the polynomial Q if only the blackbox function B is given. An algorithm for this problem is efficient if its running time is polylogarithmic in the field size d for a fixed number m of variables and a fixed maximum total degree n. The multivariate problem can be reduced to the univariate problem with a simple recursive interpolation scheme. First, rewrite Q as Q(X 1,...,X m ) = α Q α (X m ) X α X α m 1 m 1 where α = (α 1,...,α m 1 ) is a vector with the exponents of the variables X 1,...,X m 1. For the recursion we assume that we have an efficient algorithm for polynomials with 2

3 m 1 variables or less. Then we solve the m-variate problem with the following two steps. Step 1: Set the variables X 1,...,X m 1 to 0. We obtain Q(0,...,0,X m ) = Q (0,...,0) (X m ) which is a univariate polynomial. It has no constant term because Q also has no constant term. This is a univariate problem and can be solved by assumption. Step 2: For n different fixed t j F we consider 1 the polynomials Q(X 1,...,X m 1,t j ) = α Q α (t j ) X α X α m 1 m 1 where Q α (t j ) is a constant coefficient. By assumption we can determine all Q α (t j ) for α (0,...,0). Denote by α = j α j the degree of the monomial defined by α. Since for α 1 the polynomial Q α (X m ) has degree n α and since we know n function values, we can determine Q α efficiently with Lagrange interpolation [8]. The basis case of this recursive procedure is the univariate problem for which we show in the following sections that we need n black-box queries. With this result the query complexity for m-variate polynomials follows directly. For this, let κ m be the number of black-box queries of the procedure for m-variate polynomials with degree n or less. Hence, we have κ 1 = n and κ m = κ 1 + n κ m 1. This leads to queries of the black-box function. κ m = n m + n m n 3 Distinguishing Polynomial Function States The standard approach for hidden subgroup problems, i.e., the reduction of the blackbox problem to a state distinguishing problem, can be successfully applied to the hidden polynomial function graph problem. In [7] we obtained the Polynomial Function States ρ Q for the polynomials Q. We now discuss the properties of these states and present the main idea of an efficient measurement scheme to distinguish the polynomial function states. In the following we consider only the univariate case. 3.1 Structure of Polynomial Function States For a polynomial Q F[X] with zero constant term the corresponding polynomial function state ρ Q can be written as ρ Q := 1 φ Q,z φ Q,z with φ Q,z := 1 r Q(r) + z. d d z F 1 Note that the degree of the polynomials is w.l.o.g. smaller than the size of F after reducing exponents modulo d 1. 3 r F

4 To obtain a compact expression for ρ Q we introduce the shift operator S := x F + x x for F which directly leads to ρ Q = 1 d 2 b c S Q(b) Q(c). b,c F Now we use the fact that the shift operators S for all F can be diagonalized simultaneously with the Fourier transform DFT F := 1 d x,y F ωp Tr(xy) x y over F, where Tr : F F p is the trace map of the field extension F/F p and ω p := e 2πi/p is a primitive complex pth root of unity. The Fourier transform DFT F can be approximated to within error ǫ in time polynomial in log( F ) and log(1/ǫ) [6]. For simplicity, we assume that it can be implemented perfectly (as the error can be made exponentially small with polynomial resources only). We have DFT F S DFT F = ωp Tr( x) x x. x F Consequently, the density matrices have the block diagonal form ρ Q := (I d DFT F ) ρ Q (I d DFT F ) = 1 ( ) d 2 χ [Q(b) Q(c)]x b c x x b,c,x F in the Fourier basis where we set χ(z) := ωp Tr(z) for all z F and where I d denotes the identity matrix of size d. By repeating the standard approach k times for the same black-box function B, we obtain the density matrix ρ k Q. After rearranging the registers we can write ρ k Q = 1 k d 2k χ [Q(b j ) Q(c j )] x j b c x x b,c,x F k j=1 [ = 1 k n d 2k χ q i (b i j ci j ]x ) j b c x x b,c,x F k j=1 i=1 = 1 n k d 2k q i (b i j c i j)x j b c x x = 1 d 2k b,c,x F k χ b,c,x F k χ i=1 j=1 ( ) q Φ n (b) Φ n (c) x b c x x, where q, Φ n (b), Φ n (c), and x are defined as follows: 4

5 q := (q 1,q 2,...,q n ) F 1 n is the row vector whose entries are the coefficients of the hidden polynomial Q(X) = n i=1 q ix i, Φ n (b) is the n k matrix Φ n (b) := n i=1 j=1 k b i j i j = b 1 b 2 b k b 2 1 b 2 2 b 2 k... b n 1 b n 2 b n k, and x := (x 1,...,x k ) T F k is the column vector whose entries are those of x. 3.2 Algebro-Geometric Problem We now show how to construct an orthogonal measurement for distinguishing the states ρ k Q by applying and suitably modifying the pretty good measurement techniques developed in [3, 4, 5]. Both the success probability and the efficient implementation of our measurement are closely related to the following algebro-geometric problem. Consider the problem to determine all b F k for given x F k and w F n such that Φ n (b) x = w, i.e., b 1 b 2 b k x 1 w 1 b 2 1 b 2 2 b 2 k... x 2. = w 2 (1). b n 1 b n 2 b n k x k w n We denote the set of solutions to these polynomial equations and its cardinality by S x w := {b Fk : Φ n (b) x = w } and η x w := Sx w, respectively. We also define the quantum states Sw x to be the equally weighted superposition of all solutions Sw x := 1 b η x w if ηw x > 0 and Sw x to be the zero vector otherwise. Using this notation we can write the state ρ k Q as ρ k Q = 1 ( η d 2k q w q v ) x w ηv x Sx w Sx v x x. (2) χ x F k w,v F n The block structure of the states ρ k Q in Eq. (2) implies that we can measure the second register in the computational basis without any loss of information. The probability of obtaining a particular x is ( ) Tr ρ k Q (I d k x x ) = 1 d 2k ηw x = 1 d k, w F n i.e., we have the uniform distribution, and the resulting reduced state is ρ x Q := 1 ( η d k q w q v ) x w ηv x Sw S x v x. (3) w,v F n χ b S x w 5

6 3.3 Idealized Measurement for Identifying the States We now consider an idealized situation in order to explain the intuition behind the measurement. More precisely, the idealization is the assumption that there is an efficient implementation of a unitary transformation U x satisfying U x Sw x = w (4) for all (x,w) with ηw x > 0. In Section 5 we show that it suffices to realize an approximate version V x of U x. We apply U x to the state ρ x Q of Eq. (3) and obtain U x ρ x QU x = 1 d k w,v F n χ ( η q w q v ) x w ηv x w v. We now measure in the Fourier basis, i.e., we carry out an orthogonal measurement with respect to the states ψ Q := 1 d n w F n χ ( ) q w w. (5) Simple computations show that the probability for the correct identification of the state ρ x Q is ( ) 2 ψ Q ρ x Q ψ Q = 1 η d k+n x w. (6) w F n The probability to identify Q correctly is obtained by averaging, i.e., summing the probabilities in Eq. (6) over all x and multiplying the sum by 1/d k. It is given by 1 d 2k+n x F k ( w F n η x w ) 2. (7) The problem with this idealization is that there are pairs (x,w) where η x w is in the order of d. It is not clear how to implement the unitary (4) efficiently in this case. Therefore, we restrict the pairs (x,w) to cases where we know an upper bound for η x w for the approximation. Then, an efficient implementation of V x exists. Of course, we have to show that these cases include almost all (x,w). 4 Analysis of the Algebro-Geometric Problem We want to implement a unitary V x that maps S x w to w for a sufficiently large fraction of all (x,w). Hence, for these cases we need a uniform upper bound on η w x which depends on n but not on d, and an efficient procedure for enumerating S x w on a classical computer. 6

7 Both requirements can be satisfied if we choose the number of copies to be equal to the maximally possible degree of the hidden polynomial, i.e., we set k = n. To prove this statement we reformulate this problem as follows. We define the n polynomials f j F[X 1,...,X n,b 1,...,B n ] as f 1 f 2. f n := B 1 B 2 B n B1 2 B2 2 Bk 2... B1 n B2 n Bn n where the product of the matrix and the vector corresponds to the left-hand side of Eq. (1). Furthermore, let f be the n-tuple f = (f 1,...,f n ) which defines a map from F n F n to F n with f(x,b) = (f 1 (x,b),...,f n (x,b)). Using this notation S x w can be expressed as S x w = {b F n : f(x,b) = w} with w F n. For a fixed x the tuple f defines a map from F n to F n and the sets S x w are the preimages of w F n under this map. The following general proposition allows us to make statements about the size of the preimages independently of the underlying field F. It deals with a general morphism f : A m A n A n, which should be thought of as a family of morphisms from the n-dimensional affine space A n to itself, parameterized by A m. Proposition 4.1. Consider a morphism f : A m A n A n defined over Z, that is, f is given by an n-tuple f = (f 1,...,f n ) of polynomials in Z[X,B], where X = (X 1,...,X m ) and B = (B 1,...,B n ) are the coordinates on A m and on the first copy of A n, respectively. Suppose that the Jacobian determinant det( f i / B j ) ij is a non-zero element 2 of Z[X,B]. Then there exists a real number γ with 0 < γ 1 and a non-zero polynomial g Z[X] such that for all finite fields F and x F m with g(x) 0 we have f({x} F n ) γ F n. Proof. By the condition on the Jacobian determinant f 1,...,f n Q(X,B) are algebraically independent over Q(X). 3 As Q(X,B) has transcendence degree n over Q(X), every B i is algebraic over Q(X,f 1,...,f n ), i.e., there exist non-zero polynomials P 1,...,P n Z[X,W,T] such that P i (X,f,B i ) = 0 Z[X,B]. View P i as a polynomial of degree d i N in T with coefficients from Z[X,W], and let Q i Z[X,W] be the (non-zero) coefficient of T d i in P i. Then h := n i=1 Q i(x,w) is a non-zero polynomial in Z[X,W]. By the algebraic independence of the f i, h(x,f(x,b)) is a non-zero polynomial in Z[X,B]; viewing this as a polynomial of degree e in B with coefficients from Z[X], let g Z[X] be any non-zero coefficient of a monomial B α of degree e. 2 This condition on f says that generic morphisms in this family are dominant. When we work over algebraically closed fields F this means that the image is dense in F n. The proposition states that over finite fields the generic morphism still hits a large subset of F n. 3 If P Q(X)[W 1,..., W n ] is of minimal degree with P(f) = P(f 1,..., f n ) = 0, then differentiation with respect to B j and the chain rules gives P i W i (f) fi B j Jacobian matrix, and non-zero by minimality of deg(p) whence det( fi B j ) = 0. 7 X 1 X 2. X n = 0, so that ( P W i (f)) i is in the row kernel of the

8 Now let F be any finite field, and let x F m be such that g(x) 0. Then q := h(x,f(x,b)) is a non-zero polynomial in F[B] of degree e. For any b F n outside the zero set of q we have Q i (x,f(x,b)) 0 so that P i (x,f(x,b),t) F[T] has degree d i, for all i = 1,...,n. Again by construction, any b F n satisfying f(x,b ) = f(x,b) satisfies the system of polynomial equations P i (x,f(x,b),b i ) = 0 for i = 1,...,n, which has at most D := i d i solutions. We conclude that the fiber of f(x, ) over f(x,b) has cardinality at most D, and therefore f({x} F n ) {b Fn q(b) 0} D The Schwartz-Zippel theorem applied to q shows that the right-hand side of this inequality is at least ( F n e F n 1 )/D. From this the existence of γ follows. Note that the polynomials P i,g, and h can all be computed effectively, e.g., using Gröbner basis methods [8]. In general, the running time will depend very strongly on the particular form of the morphism f, but is independent of the field size d, which is sufficient for our purposes. It is possible that a more refined analysis taking into account the structure of f could lead to an improved performance for certain types of morphisms. We emphasize that we cannot rule out that the polynomial g Z[X] is zero when considered as a polynomial over F. This can only happen if all coefficients of g are multiples of the characteristic p of F. For this reason, we have to assume that p is sufficiently large so that this case can be excluded. In what follows we will use the additional notation: X good := {x F m g(x) 0}, W x good := {w F n h(x,w) 0} for x X good, and B x good := {b F n f(x,b) W x good } for x X good. If the image of g in F[X] is non-zero then by the Schwartz-Zippel theorem at least F m deg(g) F m 1 of the elements x F m lie in X good. Similarly, for all x X good most w F n lie in Wgood x, and for such w the fiber Sx w of f(x, ) has at most d elements and also most b F n are in Bgood x. For x X good and w Wgood x the fiber Sx w can be computed efficiently: By computing the zeros of the univariate polynomials P i (x,w,t) in F we find the possible values for each of the b i, and then we need only to determine 4 those combinations that are mapped to w. In our application we have m = n and the Jacobian determinant det( f i / B j ) is non-zero as after specializing all X i to 1 it is a non-zero scalar times the Vandermonde determinant det(bj i 1 ) ij, which is a non-zero polynomial. So the above results apply. 5 Approximate Measurement Let us assume that we have obtained x X good in the first measurement step described at the end of Section 3.2. We now discuss the approximate transformation V x and the 4 This can be done more efficiently by the replacement of the P i with a triangular system that can be used to find the elements of S x w consecutively. 8

9 resulting success probability. Let P good be the projector onto the subspace spanned by b for all b Bgood x. Clearly, the measurement with respect to this decomposition can be carried out efficiently as membership in Wgood x can be tested efficiently. The probability to be in the good subspace is ) Tr (P good ρ x QP good = Bx good d k and the resulting reduced density operator is ρ x Q,good := 1 B x good w,v W x good ( η χ q w q v ) x w ηv x Sw S x v x. (8) In the following we use the fact that for x X good and all w Wgood x the cardinality ηw x is bounded from above by a constant independent of the field size d and that the elements of the sets Sw x can be computed efficiently. In this case we have an efficiently computable bijection between Sw x and the set {(w,j) : j = 0,...,ηw x 1}. This bijection is obtained by sorting the elements of Sw x according to the lexicographic order on F k and associating to each b Sw x the unique j {0,...,ηw x 1} corresponding to its position in Sw. x We now show how to implement the transformation V x efficiently which satisfies Implement a transformation with V x S x w = w. b 0 0 w j η x w (9) for all b Bgood x. To make it unitary we can simply map all b Bx good onto some vectors which are orthogonal (e.g., by simply flipping some additional qubit saying that they are bad). Note that b and x determine j and w uniquely and vice versa. Furthermore, we can compute w and j efficiently since ηw x is bounded from above by a constant. Consequently, this unitary acts on the states Sw x as follows Apply the unitary 1 η x w η x w 1 b S x w b η x w w (F l+1 I d k l 1) l l + l=0 d k 1 l=η x w ηw x j ηw x (10) j=1 I d k l l on the second and third register. This implements the embedded Fourier transform F l of size l controlled by the second register in order to map the superposition of all j with j {0,...,l 1} to 0. The resulting state is w 0 η x w. Uncompute η x w in the third register with the help of w and x. This leads to the state w 0 0 9

10 We apply V x to the state of Eq. (8) and obtain V x ρ x Q,good V x = 1 B x good w,v W x good ( η χ q w q v ) x w ηv x w v. We now measure in the Fourier basis, i.e., we carry out the orthogonal measurement with respect to the states ψ Q defined in Eq. (5). Analogously to the ideal situation we obtain that the probability for the correct detection of the state ρ x Q is ψ Q V x ρ x Q,good V x ψ Q = 1 1 d n Bgood x w Wgood x The overall success probability is 1 d n x X good B x good d n ψ Q V x ρ x Q,good V x ψ Q = 1 d 3n x F n 2 η x w. (11) w W x good The first factor 1/d n is the probability that we obtain a specific x. 2 η x w. (12) Corollary 5.1. Assume that the image of g in F[X] is non-zero. Then the success probability is bounded from below by the expression 1 d 3n x X good w W x good 2 η x w which is a positive and non-zero constant independent of d. Proof. By Proposition 4.1, for all x X good the image f({x} F n ) has at least γd n elements. This means that the inner sum in expression (13) is also at least γd n. Therefore, the expression is at least whence the corollary follows. 1 d 3n X good γ 2 d 2n 1 d 3n (dn deg(g) d n 1 ) γ 2 d 2n, 6 Conclusion and Outlook We have shown that the hidden polynomial function graph problem can be solved efficiently on a quantum computer for fixed total degree n and fixed number m of indeterminates provided that the characteristic of the underlying finite field is sufficiently large. We have established that it suffices to query the black box n m + n m n times. This result relies on a classical reduction of the multivariate problem to the univariate one for which we have provided a quantum algorithm. This algorithm for the univariate case queries the black box only n times. 10 (13)

11 The extension of our results to more general algebraic structures, e.g., rings with Fourier transforms, and the extension to a broader class of functions such as rational functions are possible directions of future research. Additionally, it would be important to find other polynomial black-boxes with efficient quantum algorithms and to explore if interesting real-life problems can be reduced efficiently to such black box problems. TD was supported under the ARO/DTO/NSA quantum algorithms grant number W911NSF JD was supported by DIAMANT, a mathematics cluster funded by NWO, the Netherlands Organisation for Scientific Research. References [1] A. Childs, L. Schulman, U. Vazirani, Quantum algorithms for hidden nonlinear structures, arxiv: v1, [2] A. Childs, L. Schulman, and U. Vazirani, Quantum algorithms for hidden nonlinear structures, Personal communication and talk given at the QIP Workshop 2007, Brisbane, Australia, January 30 February 3, [3] D. Bacon, A. Childs, and W. van Dam, Optimal measurements for the dihedral hidden subgroup problem, Chicago Journal of Theoretical Computer Science, Article 2, [4] D. Bacon, A. Childs, and W. van Dam, From optimal measurements to efficient quantum algorithms for the hidden subgroup problem over semidirect product groups, Proc. of the 46th Symposium on Foundations of Computer Science, 2005, pp [5] A. Childs and W. van Dam, Quantum algorithm for a generalized hidden shift problem, Proc. 18th ACM-SIAM Symposium on Discrete Algorithms, 2007, pp [6] W. van Dam, S. Hallgren, L. Ip, Quantum Algorithms for some Hidden Shift Problems, Proc. 14th ACM-SIAM Symposium on Discrete Algorithms, 2003, pp [7] T. Decker, P. Wocjan, Efficient Quantum Algorithm for Hidden Quadratic and Cubic Polynomial Function Graphs, arxiv: quant-ph/ v3, [8] J. von zur Gathen, J. Gerhard: Modern Computer Algebra, Cambridge University Press,