Any AND-OR formula of size N can be evaluated in time N 1/2+o(1) on a quantum computer

Transcription

1 Any AND-OR formula of size N can be evaluated in time N /2+o() on a quantum comuter Andris Ambainis, ambainis@math.uwaterloo.ca Robert Šalek salek@eecs.berkeley.edu Andrew M. Childs, amchilds@uwaterloo.ca Shengyu Zhang shengyu@caltech.edu Ben W. Reichardt breic@caltech.edu Abstract For any AND-OR formula of size N, there is a bounded-error N 2 +o() -time quantum algorithm, based on a discrete-time quantum walk, that evaluates this formula on a black-box inut. Balanced, or aroximately balanced, formulas can be evaluated in O( N) queries, which is otimal. It follows that the (2 o())-th ower of the quantum query comlexity is a lower bound on the formula size, almost solving in the ositive an oen roblem osed by Lalante, Lee and Szegedy. Introduction Consider a formula ϕ on N inuts x,...,x N, using the gate set S either {AND, OR, NOT} or equivalently {NAND}. That is, the formula ϕ corresonds to a tree where each internal node is a gate from S on its children. If the same variable is fed into different inuts of ϕ, we treat each occurrence searately, so that N counts variables with multilicity. The variables x i are accessed by querying a quantum oracle, which we can take to be the unitary oerator O x : b, i ( ) bxi b, i, for b {0, } and i {,...,N} the control qubit and query index, resectively. We will show: Theorem. After efficient rerocessing (i.e., rerocessing taking oly(n) stes) of the formula ϕ indeendent of x, ϕ(x) can be evaluated with error < /3 using N 2 +o() time and queries to O x. Institute for Mathematics and Comuter Science, University of Latvia. Deartment of Combinatorics & Otimization and Institute for Quantum Comuting, University of Waterloo. Institute for Quantum Information, California Institute of Technology. Suorted by NSF Grant PHY and ARO Grant W9NF University of California, Berkeley. Suorted by NSF Grant CCF and ARO Grant DAAD Work conducted in art while visiting Caltech. Our algorithm is insired by the recent N 2 +o() -time algorithm of Farhi, Goldstone and Gutmann [9] for the case in which S = {NAND}, each NAND gate in ϕ has exactly two inuts and ϕ is balanced i.e., N = 2 n and ϕ has deth n. Our algorithm requires no rerocessing in this secial case of a balanced binary NAND tree. For a balanced, or even an aroximately balanced NAND tree, our algorithm requires only O( N) queries (Theorem 8), which is otimal. The correctness of our algorithm will turn on sectral analysis of a Hamiltonian similar to that introduced by Farhi et al., excet in general weighted according to the formula s imbalances. Our algorithm (almost) solves in the ositive the oen roblem osed by Lalante, Lee and Szegedy [4], whether the quantum query comlexity squared is a lower bound on the formula size. Theorem imlies that the formula size of a function f is at least Q 2 (f) 2 o(). Note also that evaluating an AND-OR tree is the decision version of evaluating a MIN-MAX tree, and the latter can be solved using any algorithm for the former with a log factor slow down. History of the roblem Grover showed in 996 [0, ] how to search a general unstructured database of size N, reresented by a black-box oracle function, in O( N) oracle queries and O( N log log N) time on a quantum comuter. His search algorithm can be used to comute the logical OR of N bits in the same time; simly search for a in the inut string. Since Grover search can be used as a subroutine, even within another instance of Grover search, one can seed u the comutation of more general logical formulas. For examle, a two-level AND-OR tree (with one AND gate of fan-in N and N OR gates of the same fan-in as its children) can be comuted in O( N log N) queries. Here the log factor comes from amlifying the success robability of the inner quantum search to be olynomially close to one, so that the total error is at most constant. By iterating

2 the same argument, regular AND-OR trees of deth d can be evaluated with constant error in time N O(log N) d [6]. Høyer, Mosca and de Wolf [2] showed that Grover search can be alied even if the inut variables are noisy, so the log factor is not necessary. Consequently, a dethd AND-OR tree can be comuted in O( N c d ) queries, where c is a constant that comes from their algorithm. It follows that constant-deth AND-OR trees can be comuted in O( N) queries. Unfortunately, their algorithm is too slow for the balanced binary AND-OR tree of deth log 2 N (although it does give some seedu for sufficiently large constant fan-ins). Classically, using a technique called alha-beta runing, one can comute the value of a balanced binary AND-OR tree with zero error in exected time O(N log 2 [(+33)/4] ) = O(N ) [7, 5], and this is otimal even for bounded-error algorithms [6]. For a long time, no quantum algorithm was known that erformed better than the classical zero-error algorithm, desite the fact that the best known lower bound, from the adversary method, is only Ω( N) [2]. Very recently, Farhi, Goldstone and Gutmann [9] resented a groundbreaking quantum algorithm for the balanced case, based on continuous-time quantum walks. Their algorithm runs in time O( N) in an unconventional, continuous-time query model. Childs, Cleve, Jordan and Yeung [7] shortly after ointed out that this algorithm can be discretized into the conventional oracle query model with a small slowdown, to run in time N 2 +o(). This aer is a merged version of technical reorts [?,?]. 2 Summary of results and methods We design an algorithm whose running time deends on the structure of the NAND tree. For arbitrary balanced trees, the algorithm uses O( N) queries. More generally, if the fanin of each NAND gate in our formula is bounded by a constant, our algorithm uses O( Nd) queries, where d is the deth of the formula. If the deth is large, we use a rebalancing rocedure of [5, 4] to construct an equivalent formula with deth 2 O( log N). This imlies that any NAND formula of size N can be evaluated using N /2+O(/ log N) queries. Idea of the algorithm Our algorithm can be described in terms of discrete-time quantum walks. With any NAND formula ϕ, we associate a tree T = T(ϕ). Figure gives an examle for the case of the balanced binary tree of deth 3. Consider the classical uniform random walk on this tree; at vertex v with degree d(v), fli an unbiased d(v)-sided coin to decide which neighbor to ste to next. (The coin r Figure : The balanced binary NAND formula of deth 3, ϕ = `(x x 2) (x 3 x 4) `(x 5 x 6) (x 7 x 8) where a b = (a b) is reresented by the balanced subtree rooted at r. The inut is fed in at the leaves (to row), and internal vertices are evaluated as NAND gates on their children. Here a vertex v is filled or not according to whether its evaluation (v) is or 0, resectively; in this examle, the inut is x = 0000 and overall, ϕ(x) = (r) =. Below r, we have additionally attached two vertices, r and r. Modify the classical uniform random walk on this tree by marking leaf vertices evaluating to as robability sinks, and adding a certain bias to the transition robabilities at r. Then the corresonding quantum walk can be used to evaluate the formula in O( N) time. at r will have a certain bias, as will all coins in the case of an unbalanced tree.) Incororate the inut into the walk by making all vertices evaluating to into robability sinks. The corresonding discrete-time quantum walk U works on a vertex register and a coin register. Instead of randomizing the coin register between stes, a Grover diffusion oerator is alied to the coin. This quantum walk U, started at r, can be used with hase estimation to evaluate a general NAND formula in only N 2 +o() time, or O( N) queries in the balanced or aroximately balanced case. The general algorithm is described in Section 7, while Figure 2 resents the full algorithm for the balanced case. The correctness roof uses Szegedy s corresondence between classical random walks and discrete-time quantum walks (Theorem 6). Note that Szegedy s formulation can also be viewed as establishing a corresondence between discrete- and continuous-time quantum walks (Remark 2). In articular, the sectrum and eigenvectors of the unitary oerator describing the discrete-time quantum walk can be related to those of the Hamiltonian for a continuous-time quantum walk on a closely related tree. We use this by first designing a continuous time quantum walk algorithm and then converting it into a discrete-time algorithm.

3 Organization. Initialization. Let T = 320 N. Preare three quantum registers in the state ( T ) ( i) t t r left. T t=0 The first register is a counter for quantum hase estimation, the second register holds a vertex index, and the third register is a qutrit coin holding down, left or right in this order. 2. Quantum walk. If the first register is t, erform t stes of the following discrete-time quantum walk U. Denote the last two registers by v c. Diffusion ste. (a) If v is a leaf, aly a hase fli ( ) xv using one controlled call to the inut oracle. (b) If v is an internal degree-three vertex, aly the following diffusion oerator on coin c : Reflection u = 2 u u I, where u = 3 ( down + left + right ). (c) If v = r, aly the following diffusion oerator on c : Reflection u = 2 u u I, where u = 4 N down + N left. (d) If v = r, do nothing. Walk ste. (a) If c = down, then walk down to the arent of v and set c to either left or right deending on which child v is. (b) If c { left, right }, then walk u to the corresonding child of v and set c to down. Note that the walk ste oerator is a ermutation that simly flis the direction of each oriented edge. 3. Quantum hase estimation. Aly the inverse quantum Fourier transform (modulo T ) on the first register and measure it in the comutational basis. Return 0 if and only if the outcome is 0 or T 2. Figure 2: An otimal quantum algorithm to evaluate the balanced binary NAND formula using O( N) queries. The algorithm runs quantum hase estimation on to of the quantum walk of Figure. The resentation of the algorithm and the roof of its correctness are organized as follows. Section 3 defines and uts weights on the tree T(ϕ), where the weights of edges to the leaves deend on the inut x. Section 4 shows that when ϕ(x) = 0, there exists a zero-energy eigenstate (i.e., eigenvector with eigenvalue zero) of the weighted adjacency matrix of T(ϕ) and a short tail, having substantial overla with a known initial state. Conversely, if ϕ(x) =, then any zero-energy eigenstates can be neglected, as they have no overla on the initial state. In the case ϕ(x) =, Section 5 shows that eigenvectors with small nonzero eigenvalues can also be neglected. This is argued by connecting the NAND formula s evaluation to the ratio of amlitudes from a child to its arent. We then construct an algorithm using the observations of Sections 4 and 5. Section 6 reviews Szegedy s theorem relating the sectrum and eigenvectors of a discrete-time quantum walk to those of the Hamiltonian for a continuous-time quantum walk. We aly this relationshi in Section 7 to show that hase estimation on a certain discrete-time quantum walk can be used to evaluate ϕ. We conclude the aer by describing some alications to evaluating iterated functions in Section 8, and by resenting some oen roblems in Section 9. 3 Weighted NAND formula tree Consider a NAND formula of size N i.e., on N variables, counting multilicity. (The NAND gate on inuts y,...,y k {0, } evaluates to k i= y i. In articular, the NAND gate on a single inut is simly the NOT gate.) Reresent the formula ϕ by a rooted tree T = T(ϕ), in which the leaves corresond to variables, and other vertices corresond to NAND gates on their children. (Because ϕ is a formula, not a circuit, each gate has fan-out one, so there are no loos in the associated grah.) Attach below the root r a tail of two vertices r and r as in Figure. Definition. For a vertex v, let s v be the number of inuts of the subformula under v, counting multilicity (in articular, s r = s r = s r = N). Let (v) denote the value of the subformula at v ( (r) = (r ) = ϕ(x)). Definition 2. Let H be a symmetric, weighted adjacency matrix of the grah consisting of T and the attached tail: H v = h v + c h vc c, () where is the arent of v and the sum is over v s children. (If v has no arent or no children, the resective terms are

4 zero.) The edge weights deend on the structure of the tree, and are given by with two excetions: h v = ( sv s ) /4, (2). If a leaf v evaluates to (v) =, set h v = 0, i.e., effectively remove the edge (, v) by setting its weight to zero. 2. Set h r r = /( σ (r)n /4 ) (see Definition 3). Definition 3. To track error terms through the analysis, it will be helful to define σ (v) = max ξ σ + (v) = max ξ w ξ: (w)=0 w ξ: (w)= sw s w (3) with the maximum in each case taken over all aths ξ from v u to a leaf. Letting d r be the deth of r, clearly σ (v) σ (r) d r and σ + (v) σ + (r) Nd r. We call formula ϕ aroximately balanced if σ (r) = O(), σ + (r) = O(N) and H = O(), where denotes the sectral norm. The simlest examle of an aroximately balanced tree is the balanced binary tree. More generally, a tree is aroximately balanced if s v decreases sufficiently raidly from the root toward the leaves (see Section 7). Our algorithm will deend on the following roerties of H, which we will rove in the next two sections: Theorem 2. If ϕ(x) = 0, then there exists a zero-energy eigenvector a of H with a = and overla r a / 2. If ϕ(x) =, then every eigenvector with suort on r or r has corresonding eigenvalue at least 9σ (r) σ +(r) in absolute value. Remark. For a leaf v evaluating to 0, it is sufficient that the h v satisfy h v /s /4. One can also verify Theorem 2 for weights h v defined by, for an arbitrary fixed β, h v = s β v /s 2 β, h r r = /( σ (r)n 2 β ) and σ (v) = max ξ w ξ: s 2β w. We fix β = /4 to simlify notation. (w)=0 Figure 3: An examle NAND tree to illustrate Lemmas 3 and 4. As in Figure, a vertex is filled or not according to whether it evaluates to or 0, resectively. The amlitudes v a of a zeroenergy eigenstate a for the adjacency matrix H are also labeled, with α, β, γ free variables, assuming h v = for every edge (,v). The amlitudes of the neighbors of any vertex sum to zero. The existence of such an a is romised by Lemma 4. As required by Lemma 3, v a = 0 if (v) =, so vertices evaluating to are not labeled. 4 Zero-energy eigenstates of H Recall that in a NAND tree T, internal vertices are interreted as NAND gates on their children. As Definition 2 uts zero weight on the arental edge of a leaf evaluating to one, such leaves can be regarded as disconnected. Then all leaves connected to the root comonent can be interreted as zeros. Definition 4. By T v, we mean the subtree of T consisting of v and all its descendants. The restriction to T v of a vector a on T will be denoted a Tv. That is, for a subset S of the vertices, define the rojector Π S = s S s s ; then a Tv = Π Tv a. We will also write a v for v a. Finally, let H S = Π S H. Lemma 3. For an internal vertex in NAND tree T, if () = and H T a = 0, then a = 0. Proof. Since () =, there exists a child v of having (v) = 0. If v is a leaf, then 0 = v H a = h v a, as asserted. Otherwise, all children c of v must have (c) =, imlying by induction that a c = 0. Then as asserted. 0 = v H a = h v a + c h vc a c = h v a, In fact, σ (r) = O( d r), because s w must increase by at least one every two levels down (two NOT gates in a row would be redundant). Slightly stronger bounds can be given for trees rerocessed according to the rebalancing rocedure of Lemma 9, but oly(d r) and oly(log N) factors here won t significantly change the running time.

5 Lemma 3 constrains the existence of zero-energy eigenstates suorted on the root r when the NAND formula evaluates to. However, there may be zero-energy eigenstates that are not suorted on the root (for examle, consider the right subtree in Figure 3). Lemma 4. Consider a vertex in NAND tree T. If () = 0, then there exists an a = a T with H T a = 0, a =, and a /( σ ()s /4 ). Proof. Since () = 0, for all children v of, (v) =. So each v has a child c v satisfying (c v ) = 0. Construct a as follows. Set a v = 0 for all children v. Set a Tc = 0 for all grandchildren c / {c v }. By induction, for each v construct ã Tc v satisfying ã Tc v =, H Tc v ã Tc v = 0 and ã c v /( σ (c v )s /4 c ). v For each v, in order to satisfy v H a = 0, we need h v a = h vc va c v. To satisfy all these equations, we rescale the vectors ã Tv. Let a =, and let a Tc v = hv h vc v ã ã c v T c v. It only remains to verify that a 2 s σ (), so that renormalizing, a / a = / a is still large. Indeed, a 2 = a 2 + v + v h 2 v h 2 vc v(ã c v)2 a T c v 2 h 2 v h 2 sc vσ (c v ) vc v s v σ (c v ) s + v ( s + max s s σ (). v ) σ (c v ) (The key ste in the above roof, which motivates the choice of weights h v, is v s v = s.) Lemma 4 is a strong converse of Lemma 3, as it does not merely assert that a can be set nonzero; it also uts a quantitative lower bound on the achievable magnitude. Lemma 4 lets us say that there exists an energy-zero eigenstate with large overla with the root r when (r) = 0. Now in the case ϕ(x) = (r) = 0, let us extend a Tr from Lemma 4 into a zero-energy eigenvector a over the whole grah, to see that the overla r a / a is large. In order to satisfy H a = 0, we must have a r = 0 and a r = h r r h a r r r = σ (r)n /4 a r. Therefore, we lower bound r a a + atr 2 = 2. This comletes the roof of the first half of Theorem 2. 5 Sectral ga of H in the case ϕ(x) = To rove the second half of Theorem 2, we must consider the case ϕ(x) =, and investigate the eigenvectors of H corresonding to energies E close to zero. As T is a biartite grah, the sectrum of H is symmetric around zero. Let E = α v v v be an eigenvector of H with eigenvalue E > 0. From Eq. () we obtain v H E = Eα v = h v α + c h vc α c. (4) The analysis deends on the fact that α v /α is either large or small in magnitude deending on whether (v) = 0 or. Lemma 5. Let 0 < E. For vertices v 5σ (r) σ +(r) r in T, define y 0v and y v by y 0v = ( + k v )σ (v) 4 s v s y v = ( + k v )σ (v) s3/4 v s /4 where is the arent of v, and k v is defined by k v = 4E 2 σ 2 (v)σ +(v). Then for every vertex v r in T, either α v = α = 0, or (v) = 0 0 < α /α v y 0v E (v) = 0 > α v /α y v E. Note that, because of our assumtion on E, we always have k v 4 25 = 0.6. Proof. By induction. Base case: for every leaf v, (v) = 0 and by Eq. (4), Eα v = h v α. Thus either α v = α = 0, or α = E s = α v h 4 E = v s 4 s s v E y 0v E. v Induction ste:, (5) (6) If (v) = 0, then all children c evaluate to (c) =. First assume α v 0. Dividing both sides of Eq. (4) by α v, using the induction hyothesis, and rearranging terms gives α = ( E α v h v c ( + h v c h vc α c α v ) h vc y c )E.

6 Using the inductive assumtion about y c and substituting the exressions for h v, h vc in terms of α, α v, α c, we can uer bound the coefficient of E by h v + c ( + k c )σ (c) s cs /4 s 3/4 v Since c s c = s v and k c k v for any c, this is at most ( s 4 ( + k v ) + maxσ (c) s 4 ) s v s v c = ( + k v ) 4 s v s (max σ (c) + ) c sv = ( + k v )σ (v) 4 s v s. The induction hyothesis also gives that α /α v E/h v > 0. If α v = 0, then the induction hyothesis gives that all α c are zero, so also α = 0 by Eq. (4). If (v) =, then there is at least one child c with (c) = 0. We may assume α v 0 since otherwise α v /α = 0 and the inequality holds trivially. Then, again dividing Eq. (4) by α v h v, using the induction hyothesis, and multilying by E, α = E α v h v c E + h v c: (c)= c: (c)=0 h vc α c h v α v h vc y c E h v h vc h v y 0c E.. (7) Because of the revious case, we can uer bound the first sum by c h vc y c h v E max( + k c )σ (c) 4 s v s E c ( + k v )σ (v) 4 s v s E. (8) We lower bound the second sum by one of its terms (since there is at least one c with (c) = 0): h vc h v y 0c E s /4 ( + k c )σ (v)s 3/4 v E. Finally, the first term on the right hand side of Eq. (7) is E h v = 4 s s v E, which is less than the right hand side of Eq. (8). Therefore, Eq. (7) is at most 2e( + k v )σ (v) 4 s v s E s /4 ( + k c )σ (v)s 3/4 v E = s /4 e kc σ (v)s 3/4 v E ( 2(+k v)(+k c )σ 2 (v)s v E 2 ). Let δ = σ 2 (v)s ve 2. Since k c k v 0.6, we can lower bound the exression in brackets by This means that δ 2.7δ. α s /4 ( 2.7δ), α v ( + k c )σ (v)s 3/4 v E To comlete the roof that α α v y ve (and, hence, by taking inverses, αv α y v E), it suffices to show that + k c 2.7δ + k v. We have ( ) + k c 2.7δ = + k c + ( + k c ) 2.7δ ( ) + k c δ. (9) We now observe that δ σ 2 (v)σ +(v)e If 0 δ 0.04, the last term of (0) is always uerbounded by 4δ. Therefore, the entire right hand side of (0) is uer-bounded by + k c + 4δ = + 4σ 2 (v)(σ +(c) + s v )E 2 + k v. Now we are ready to comlete the roof of the second half of Theorem 2. Assume E is an eigenvector of H with energy E (0, ]. We want to show α r 5σ (r) σ = +(r) = 0. We have α r Eα r = h r r α r + h rr α r h2 r r E α r h rr y reα r, with the inequality following from Eα r = h r r α r and Lemma 5. If α r 0, we can divide both sides by Eα r. Then, moving the second term from the right hand side to the left gives us + h rr y r h2 r r E 2. Substituting the values of h rr and h r r and alying the assumed uer bound on E gives us + y r 25σ (r)σ + (r) N 25σ (r) N. (0)

7 By Lemma 5, we have y r = ( + k r )σ (r) s3/4 r s /4 r.6σ (r) N. Substituting this into () gives a contradiction. Therefore, α r = 0 and, because of Eα r = h r r α r, we also have α r = 0. This comletes the roof of Theorem 2. 6 Discrete-time quantum walk To construct an algorithm from Theorem 2, we first briefly review Szegedy s rocedure for quantizing classical random walks. Theorem 6, adated from [8], relates the eigensystem of the discrete-time quantum walk to that of the original classical walk. Theorem 6 ([8]). Let { v : v V } be an orthonormal basis for H V. For each v V, let ṽ = v w V vw w H V H V, where vw 0 and ṽ ṽ = w vw =. Let T = v ṽ v and Π = TT = v ṽ ṽ be the rojection onto the san of the ṽ s. Let S = v,w v, w w, v, a swa. Let M = T ST = v,w v ṽ S w w = v,w vw wv v w a real symmetric matrix, and take { λ a } a comlete set of orthonormal eigenvectors of M with resective eigenvalues λ a. Let U = (2Π )S, a swa followed by reflection about the san of the ṽ s. Then the sectral decomosition of U is determined by that of M as follows: Let R a = san{t λ a, ST λ a }. Then R a R a for a a ; let R = a R a. U fixes the saces R a and is S on R. The eigenvalues and eigenvectors of U within R a are given by β a,± = λ a ± i λ 2 a and ( + β a,±s)t λ a, resectively. Proof. First assume a a, and let us show R a R a. Indeed, λ a T T λ a = λ a λ a = 0, as T T =. Since S 2 =, similarly, ST λ a is orthogonal to ST λ a. Finally, λ a T ST λ a = λ a M λ a = 0. Therefore, the decomosition H V H V = ( a R a ) R is well-defined. R is the san of the images of ST and T. 2Π is + on the image of T and on its comlement; therefore U is S on R. Finally, ΠT = TT T = T and ΠST = TT ST = TM, so U(ST λ a ) = (2Π )T λ a = T λ a U(T λ a ) = (2Π )ST λ a = (2λ a S)T λ a ; U fixes the subsaces R a. To determine its eigenvalues on R a, let β = ( + βs)t λ a. Then U β = (2λ a + β)t λ a ST λ a is roortional to β if β(2λ a + β) = ; i.e., β { λ a ± i λ 2 a}. (If λ a = ±, note that T λ a = ±ST λ a, so R a is one-dimensional, corresonding to a single eigenvector of U.) To connect this theorem to classical and quantum walks, start with an undirected grah G = (V, E). Choose the v,w to be the transition robabilities v w of a classical random walk on this grah (i.e., with the constraint v,w = 0 if (v, w) / E). Then U = (2Π )S can be considered a quantization of the classical walk, taking lace on the directed edges of G. First the swa S switches the direction of an edge. Then, for the first register fixed to be v, 2Π acts as a reflection about ṽ = v w v v,w w ; it is a coin fli that mixes the directed edges leaving v. Therefore, although U acts on H V H V, it reserves the subsace sanned by v, w and w, v for (v, w) E. An alternative basis for this subsace is to give a vertex v together with an edge index to describe an edge leaving v. If the grah has maximum degree D, then U can be imlemented on H V C D instead of H V H V. Discretization of continuous-time quantum walks Szegedy s Theorem 6 relates the eigenvalues and eigenvectors of the quantum walk U to that of the matrix M = v,w v,w w,v v w. If P = v,w v,w v w is the elementwise square root of the transition matrix of a classical random walk, then M is the elementwise roduct P P T. But M can also be regarded as the Hamiltonian for a continuous-time quantum walk on the vertices of the underlying grah. In our case, we are given H, and desire a factorization H = P P T such that P has all row norms exactly one. Then Theorem 6 with M = H alies to relate the eigensystem of H to that of a certain discrete-time quantum walk. Such a factorization is ossible for a large class of Hamiltonians: Claim 7. Let H = v,w H v,w v w be the ositiveweighted symmetric adjacency matrix of a connected grah G. Let δ be the rincial eigenvector of H, with v δ = δ v > 0 for every v. Assume H =. Then H = P P T, where P = δ v,w H w v,w δv v w has all row norms equal to. Proof. Since H is nonnegative, its rincial eigenvector δ is also nonnegative, by the Perron-Frobenius Theorem. Since H is connected, δ v > 0 for every v; hence P is well-defined. By construction, P v,w P w,v = H v,w, i.e., P P T = H. Furthermore, the squared norm of the vth row of P is w P v,w 2 = δ v w H v,wδ w = (Hδ)v δ v = H =, so P corresonds to a classical random walk. Remark 2. Szegedy s Theorem 6, with Claim 7, serves as a general method for relating an arbitrary continuous-time quantum walk on the vertices of G to a discrete-time quantum walk on directed edges of G. In articular, the eigenval-

8 ues of the discrete walk iu are given by ± λ 2 a +iλ a (i.e., e iarcsin λa and e iarcsin λa ), whereas the continuous walk e im has eigenvalues e iλa. The sectral gas from zero of the continuous walk and the discrete walk are equal u to third order. 7 The algorithm Recall from Definition 3 that a NAND formula is aroximately balanced if σ (r) = O(), σ + (r) = O(N) and H = O(). These conditions are satisfied, for examle, by a balanced binary NAND tree, as σ (r) < 2 and σ + (r) < 2N will then both be geometric series. The definition is also satisfied if for a fixed ǫ (0, 2 ], for every vertex and every grandchild c of, s c ( ǫ)s. Under this condition, σ (r) = O( ǫ ) and σ +(r) = O( N ǫ ). Theorem 8. After efficient (i.e., oly(n) time) classical rerocessing, indeendent of the inut x, of an arbitrary formula ϕ of size N, ϕ(x) can be evaluated with error < /3 using N 2 +O(/ log N) queries to U x. The running time is also N 2 +O(/ log N) assuming unit-cost coherent access to the rerocessed string. For a formula that is aroximately balanced according to Definition 3, the query comlexity is only O( N) and the running time is only N(log N) O(). Proof. Prerocessing: If σ (r) σ + (r) H = N 2 +Ω(), then rerocess the formula in two ways. First, exand out gates so each NAND gate has O() fan-in. Since the edge weights are all, this ensures that H = O(). Also, aly the formula rebalancing rocedure of [5, 4] with arameter k to be determined: Lemma 9 ([4, Theorem 4]). For all k 2, one can efficiently construct an equivalent NAND formula ϕ with gate fan-ins at most two and satisfying 2 deth(ϕ) (9 ln 2)k log 2 N size(ϕ) N +/ log 2 k. Let H be the Hamiltonian corresonding to a weighted adjacency matrix of the grah according to Definition 2. Comute a discrete-time quantum walk oerator U that corresonds to M = H/n(H) via Theorem 6 (where n(h) is some uer bound on H, to ensure that all eigenvalues of M have λ a ). Obtaining U takes a little care, 2 The constant in the deth bound is 9ln 2 instead of the 3ln2 in [4, Theorem 4] because we lose a constant converting an {AND, OR, NOT} formula to a NAND formula. since H deends on the oracle. Consider H 0 N the Hamiltonian from Definition 2 assuming that all leaves evaluate to 0. By alying Claim 7 as art of the rerocessing, we obtain a U 0 N corresonding to H 0 N/ H 0 N. Let U = O x U 0 N, where O x is the inut hase-fli oracle; conditioned on the current vertex being a leaf i, O x adds a hase of ( ) xi. Then we claim that alying Theorem 6 to U gives M = H/ H 0 N. Indeed, the only difference between U and U 0 N is on the ĩ s for leaf vertices i with x i = ; in U 0 N, ĩ = i, ( being i s arent), whereas in U, ĩ = i, i (i.e., i,i = ). Therefore the M from U only differs from H 0 N in the coefficients involving leaves i with x i =, and i M = ĩ S = 0, so M = H/ H 0 N as claimed. Algorithm:. Preare r = r, r. 2. Measure the energy according to H. In other words, aly quantum hase estimation to iu = io x U 0 N. Use recision δ = /(0σ (r) σ + (r)) and error robability δ e any constant less than /4. 3. Outut zero if and only if the measured hase is 0 or π. Figure 2 lays out the stes of the algorithm in comlete detail for the case of a balanced binary NAND tree. We did not use Claim 7 to derive U in Figure 2, because in this secial case it is clear that alying Theorem 6 to U gives H, excet with larger weights to leaves evaluating to 0 (see Remark ). Correctness: The correctness follows from Theorems 2 and 6. If ϕ(x) = 0, then there exist two eigenvectors of U given by ( ± is)t a, with eigenvalues ±i, resectively. Their overlas with the initial state r are r ( ± is)t a = a r ± ia h r r r H / 2 O(/N /4 ). Since the norm of ( ± is)t a is at most 2 a = 2, we find that the robability of oututting 0 is at least 2 ( 2 ( 2 o()) ) 2 = /4 o(). Conversely, if ϕ(x) =, then every eigenstate of H with suort on r or r has energy at least /(5σ (r) σ + (r)) in magnitude. Every eigenstate of U with suort on r, r = r = T r must be of the form ( + β a,± S)T λ a = ( + ( λ a ± i λ 2 a)s)t λ a. The terms which can overla T r are either r λ a (via T ) or r λ a (via ST ). But for λ a < /(0σ (r) σ + (r)), both coefficients must be zero. Therefore, our algorithm oututs 0 with robability less than δ e < /4. This constant ga can be amlified as usual.

9 Query and time comlexity: Phase estimation requires alying O( H 0 N /(δ δ e )) = O(σ (r) σ + (r) H 0 N ) controlled-u evolutions [8]. For an aroximately balanced grah, this is O( N). For a general grah, the number of controlled-u alications is O( s r d 3/2 r H 0 N ) due to the bounds on σ ± (r) from Definition 3. For a rebalanced formula from Lemma 9 with arameter k, this is O(N H = O(). Set k = q log 2 N 2log 2 k (k log 2 N) 3/2 ) since 3 to otimize this bound to be N 2 + (3+o())/log N queries to O x. During the rerocessing hase, for each vertex v we comute a sequence of O((log N) 2 log log N) elementary gates that aroximate to within /N the coin diffusion oerator at v, by alying the Solovay-Kitaev Theorem [3]. (Using these aroximations, the algorithm s total error robability will only increase by o().) Store the descritions of these gate sequences in a classical string, which we assume the algorithm can access coherently at unit cost. The algorithm at vertex v looks u the corresonding gate sequence and alies it to the coin register c. The total running time is thus only olylogarithmically larger than the number of queries. 8 Evaluating iterated functions Our algorithm can be used to evaluate an arbitrary Boolean function by first writing a NAND formula for the function and then evaluating that formula. Of course, this aroach will only be advantageous when the formula size is sufficiently small. This strategy is articularly natural in the case of a recursively defined function. In articular, it gives imroved uer bounds for the iterated functions studied in []. Let f(x, x 2, x 3 ) = if x = x 2 = x 3 and f(x, x 2, x 3 ) = 0 otherwise. We define a sequence of iterated functions f, f 2,..., with f n being a function of 3 n variables. Let f = f, and f n (x,..., x 3 n) = f ( f n (x,...,x 3 n ), f n (x 3 n +,...,x 2 3 n ), f n (x 2 3 n +,...,x 3 n) ). The functions f n have attracted interest in the context of relating olynomial degree and quantum query comlexity of Boolean functions. The olynomial degree of a Boolean function f is always a lower bound on its quantum query comlexity [3]. The function f n is one of the known functions for which this lower bound is not otimal. The olynomial degree of f n is 2 n, while the quantum query comlexity of f n is lower bounded by Ω(( 3 2 ) n ) = Ω(2.2 n ) []. So far, there has been no quantum algorithm for f n using o(3 n ) queries. Our aroach gives the first non-trivial quantum algorithm for this function. To see this, note that both f and its negation can be reresented by NAND formulas of size 6 as follows: f(x, x 2, x 3 ) = ( (x, x 2, x 3 ), ( x, x 2, x 2 )) f(x, x 2, x 3 ) = ( (x, x 2 ), (x 2, x 3 ), (x 3, x )). Using these formulas, we can inductively construct NAND formulas for f n and f n of size 6 n. Namely, given NAND formulas for f n and f n of size 6 n, we can substitute those instead of variables into the NAND formulas for f and f to obtain NAND formulas for f n and f n of size 6 n. Thus, using our algorithm for NAND tree evaluation, we can evaluate f n using O( 6 n ) = O(2.45 n ) quantum queries. 9 Oen roblems We conclude by mentioning some oen roblems. Our algorithm needs to know the full structure of the formula beforehand to determine the quantum walk transition amlitudes (i.e., the biases of the quantum coin ) at each internal vertex. (The transition amlitudes are determined by the rincial eigenvector of the grah s weighted adjacency matrix; they can also be solved for recursively from the leaves to r.) However, these coefficients need not be comuted exactly, because there is some freedom in the recurrence on y 0v and y v. It would be interesting to know if a different choice of coefficients, or a relaxed calculation thereof, would allow for faster rerocessing. Furthermore, it would be interesting to know on what kinds of structured inuts the rerocessing can be done in time N 2 +o(). Numerical simulations indicate that the formula can be evaluated by running the quantum walk from the initial state, and measuring whether the quantum state has large overla with 2 ( r, r + r, r ) or 2 ( r, r r, r ). If this is true, then we can avoid the hase estimation on to of the quantum walk, simlifying the algorithm. What kinds of noisy oracles can this algorithm, or an extended version, tolerate? For examle, [2] extends Grover search to the case where inut values are comuted by a bounded-error quantum subroutine. Are there hard instances of formulas for which the rebalancing rovided by Lemma 9 is tight? Are these also hard instances for our algorithm? For examle, the most unbalanced formula, ϕ(x... x N ) =

10 x (x 2 (x 3 (... x N ))), is not a hard instance. It can be rebalanced by a different rocedure, giving an equivalent formula with deth O(log N) and size O(N log N), and can be evaluated with O( N) queries. Acknowledgments Robert would like to thank the Institute for Quantum Information at Caltech for hositality. We thank Ronald de Wolf for comments on an early draft of the aer, and thank Jérémie Roland for thoughtful remarks. [5] M. Saks and A. Wigderson. Probabilistic Boolean decision trees and the comlexity of evaluating game trees. In Proc. of 27th IEEE FOCS, ages 29 38, 986. [6] M. Santha. On the Monte Carlo decision tree comlexity of read-once formulae. Random Structures and Algorithms, 6():75 87, 995. [7] M. Snir. Lower bounds on robabilistic linear decision trees. Theoretical Comuter Science, 38:69 82, 985. [8] M. Szegedy. Quantum seed-u of Markov chain based algorithms. In Proc. of 45th IEEE FOCS, ages 32 4, References [] A. Ambainis. Polynomial degree vs. quantum query comlexity. J. Comut. Syst. Sci., 72(2): , [2] H. Barnum and M. Saks. A lower bound on the quantum query comlexity of read-once functions. J. Comut. Syst. Sci., 69(2): , [3] R. Beals, H. Buhrman, R. Cleve, M. Mosca, and R. de Wolf. Quantum lower bounds by olynomials. J. ACM, 48(4): , 200. [4] M. L. Bonet and S. R. Buss. Size-deth tradeoffs for Boolean formulae. Information Processing Letters, 49(3):5 55, 994. [5] N. H. Bshouty, R. Cleve, and W. Eberly. Size-deth tradeoffs for algebraic formulae. In Proc. of 32nd IEEE FOCS, ages , 99. [6] H. Buhrman, R. Cleve, and A. Wigderson. Quantum vs. classical communication and comutation. In Proc. of 30th ACM STOC, ages 63 68, 998. [7] A. M. Childs, R. Cleve, S. P. Jordan, and D. Yeung. Discrete-query quantum algorithm for NAND trees. quanth/070260, [8] R. Cleve, A. Ekert, C. Macchiavello, and M. Mosca. Quantum algorithms revisited. Proc. R. Soc. London A, 454(969): , 998. [9] E. Farhi, J. Goldstone, and S. Gutmann. A quantum algorithm for the Hamiltonian NAND tree. quant-h/070244, [0] L. K. Grover. A fast quantum mechanical algorithm for database search. In Proc. of 28th ACM STOC, ages 22 29, 996. [] L. K. Grover. Tradeoffs in the quantum search algorithm. quant-h/02052, [2] P. Høyer, M. Mosca, and R. d. Wolf. Quantum search on bounded-error inuts. In Proc. of 30th ICALP, ages , LNCS 279. [3] A. Y. Kitaev, A. H. Shen, and M. N. Vyalyi. Classical and Quantum Comutation, volume 47 of Graduate Studies in Mathematics. American Mathematical Society, Providence, Rhode Island, [4] S. Lalante, T. Lee, and M. Szegedy. The quantum adversary method and classical formula size lower bounds. Comutational Comlexity, 5:63 96, Earlier version in Comlexity 05.