arxiv:quant-ph/ v2 26 Apr 2007

Transcription

1 Every NAND formula of size N can be evaluated in time O(N 1 2 +ε ) on a quantum computer arxiv:quant-ph/ v2 26 Apr 2007 Andrew M. Childs amchilds@caltech.edu Robert Špalek spalek@eecs.berkeley.edu Abstract Ben W. Reichardt breic@caltech.edu Shengyu Zhang shengyu@caltech.edu For every NAND formula of size N, there is a bounded-error O(N 1 2 +ε )-time quantum algorithm that evaluates this formula on a black-box input, for ε > 0 an arbitrarily small constant. It follows that the (2 ε)-th power of the quantum query complexity is a lower bound on the formula size, almost solving in the positive an open problem posed by Laplante, Lee and Szegedy. Institute for Quantum Information, California Institute of Technology. Supported by NSF Grant PHY and ARO Grant W911NF University of California, Berkeley. Supported by NSF Grant CCF and ARO Grant DAAD Work conducted in part while visiting Caltech. 1

2 1 Introduction Consider a formula ϕ on N inputs x 1,...,x N, using the gate set S either {AND, OR, NOT} or equivalently {NAND}. That is, ϕ is a tree where each internal node is a gate from S on its children. If the same variable is fed into different inputs of ϕ, we treat each occurrence separately, so that N counts variables with multiplicity. The variables x i are accessed by querying a quantum oracle, which we can take to be the unitary operator U x : b,i ( 1) bx i b,i, for b {0,1} and i {1,..., N} the control qubit and query index, respectively. Theorem 1. For any constant ε > 0, the formula ϕ(x) can be evaluated with error < 1/3 using O(N 1 2 +ε ) time and queries to U x. Our algorithm is heavily inspired by the recent algorithm of Farhi, Goldstone and Gutmann [FGG07] for the case in which S = {NAND}, each NAND gate in ϕ has exactly two inputs and ϕ is balanced i.e., N = 2 n and ϕ has depth n. The main differences are that we weight the matrix elements of the Hamiltonian according to the formula s imbalances, and that we base the algorithm on quantum phase estimation instead of using scattering theory. History of the problem Grover showed in 1996 [Gro96] how to search a general unstructured database of size N, represented by a black-box function, in time O( N) on a quantum computer. His search algorithm can be used to compute the logical OR of N bits in the same time; simply search for a one in the input string. Since Grover search can be used as a subroutine, even within another instance of Grover search, one can speed up the computation of more general logical formulas. For example, a two-level AND-OR tree (with one AND gate of fan-in N and N OR gates of the same fan-in as its children) can be computed in time O( N log N). Here the log factor comes from amplifying the success probability of the inner quantum search to be polynomially close to one, so that the total error is at most constant. By iterating the same argument, regular AND-OR trees of depth d can be evaluated with constant error in time N O(log N) d 1 [BCW98]. Høyer, Mosca and de Wolf [HMW03] showed that Grover search can be applied even if the input variables are noisy, so the log-factor is not necessary. Consequently, a depth-d AND-OR tree can be computed in time O( N c d ), where c is a constant that comes from their algorithm. It follows that constant-depth AND-OR trees can be computed in time O( N). Unfortunately, their algorithm is too slow for the balanced binary AND-OR tree of depth log 2 N (although it does give some speedup for sufficiently large constant fan-ins). Classically, using a technique called alpha-beta pruning, one can compute the value of a balanced binary AND-OR tree with zero error in expected time O(N log 2 [(1+ 33)/4] ) = O(N ) [Sni85, SW86], and this is optimal even for bounded-error algorithms [San95]. For a long time, no quantum algorithm was known that performed better than the classical zero-error one, despite the fact that the best known lower bound, from the adversary method, is only Ω( N) [BS04]. Very recently, Farhi, Goldstone and Gutmann [FGG07] published a groundbreaking quantum algorithm for the balanced case, based on continuous-time quantum walks. Their algorithm runs in time O( N log N) (later improved to O( N)), albeit in an unconventional continuous-time query model. Shortly thereafter, Childs, Cleve, Jordan and Yeung [CCJY07] pointed out that this algorithm can be discretized into the conventional oracle query model with only a small slowdown. Their algorithm runs in time O(N 1 2 +ε ) for an arbitrarily small constant ε. It is natural to ask whether one can achieve a similar speedup for more general formulas. In this paper, we provide such an algorithm. Its running time (in the conventional discrete model) is 2

3 O(N 1 2 +ε ), where again ε is an arbitrarily small constant. This running time almost matches the Ω( N) lower bound. Our algorithm (almost) solves in the positive the open problem posed by Laplante, Lee and Szegedy [LLS06], whether the quantum query complexity squared is a lower bound on the formula size. By turning our argument upside down, we see that the formula size of a function f is at least Q 2 (f) 2 ε for an arbitrarily small constant ε. Idea of the algorithm Associated to ϕ and each assignment of its variables x = x 1...x N is a tree T = T(ϕ,x). Figure 1 gives an example; the formal construction is in Section 2. We work on the Hilbert space with orthonormal basis v for vertices v of T. The main idea of our algorithm is to prepare a state at the root, r, and then measure the energy, where the Hamiltonian H is a weighted adjacency matrix of T. If an energy of zero is observed, we guess that ϕ(x) is 0; otherwise we output 1. Measuring H involves a continuous-time quantum walk along the tree T, starting at r. However, the deepest level of T can only be found by querying a quantum oracle for the input x, so we in fact simulate the quantum walk by alternating certain oracle queries with a walk along the rest of T. Actually, the above-sketched algorithm does not quite work, as we will see below, because in the case where ϕ(x) = 0, the overlap of a zero-energy eigenstate with r is not sufficiently large. However, by appending a tail to the tree, the overlap can be amplified. Organization In Section 2, we present our NAND tree evaluation algorithm, up to specifying the tree s edge weights, which are fixed in Section 3. In Section 4, we show that when ϕ(x) = 0, there exists a zero-energy eigenstate (i.e., eigenvector with eigenvalue zero) of H with substantial overlap with a known initial state. Conversely, if ϕ(x) = 1, then any zero-energy eigenstates can be neglected, as they have no overlap on the initial state. In Section 5, we show that in the case ϕ(x) = 1, eigenvectors with small nonzero eigenvalues can also be neglected. This is argued by connecting the NAND formula s evaluation to the ratio of amplitudes from a child to its parent. A special analysis is required for vertices within the long tail. Finally, in Section 6, we explain how to discretize the oracle queries used in phase estimation for measuring H. 2 The algorithm Consider an N-variable, depth-d NAND formula ϕ. (The NAND gate on inputs y 1,...,y k {0,1} evaluates to 1 k i=1 y i.) By expanding out any gates of larger fan-in, assume that each NAND gate has constant fan-in. Assume that the depth of ϕ is d = O(log N). This is without loss of generality, because any formula on N variables can be transformed into an equivalent one with depth O(log N) and size N 1+ε for an arbitrarily small constant ε > 0 [BB94, BCE91]. Represent ϕ by a rooted tree, in which the leaves correspond to variables, and other vertices correspond to NAND gates on their children. (Because ϕ is a formula and not a circuit, each gate has fan-out 1, so there are no loops in the associated graph.) For a setting of the variables x = x 1 x N, adjust the tree as follows: for each i {1,...,N}, if x i = 1 then add a child vertex 3

4 e 2 e 2 r r Figure 1: Left: As an example of the correspondence (ϕ, x) T, the above tree corresponds to the NAND ( ) formula ϕ = (x 1 x 2 ) (x 3 x 4 ) x 5 (x 6 (x 7 x 8 ) x 9 ) (x 10 x 11 x 12 ) evaluated on the input x 1...x 12 = The input is reflected by the presence or absence of the bold or dotted edges; for example e 1 is not present because x 7 = 0, while the presence of e 2 indicates x 8 = 1. Leaf vertices evaluate to 0, while each internal vertex evaluates the NAND of its children (or a NOT gate on a single child). A vertex is filled or not according to whether it evaluates to 1 or 0, respectively; overall, ϕ(x) = (r) = 0. Right: Flipping x 5 by removing an edge, the tree now evaluates to 1. above the ith leaf. Call the adjusted tree T = T(ϕ, x). Most of T s structure is determined by ϕ, with only the level of vertices farthest from the root depending on x. For an example, see Fig. 1. In T, each leaf evaluates to 0, and other vertices are NAND gates on their children. (A NAND gate on a single vertex is just a NOT gate.) Our goal is to evaluate the root r of T(ϕ,x), corresponding to the value of ϕ(x). Append a tail of even length L { Nd, Nd + 1} to the root of T; an even number of NOT gates does not change its evaluation. Figures 2 and 3 compare our construction with that of Farhi et al. r Figure 2: Farhi et al. attach a line of length Θ(N) to the root of the tree associated to a balanced binary NAND formula on N variables. The variable settings (accessed via an oracle) determine the presence or absence of the last line of edges; here, the input string is and (r) = 1. Compare to our construction in Fig. 3. 4

5 c h vc v h pv p r Figure 3: In our construction, we start with an arbitrary NAND tree of depth d. As before, leaves evaluate to zero and portions of the tree are only accessible via calls to the oracle. An edge from a vertex v to a child c is weighted according Eq. (2). We attach to the root r a single tail of even length Nd in order to boost the overlap of a zero-energy eigenstate with an equal superposition over every other vertex of the tail. Depending on whether the tree evaluates to 0 or 1, we can either guarantee the existence of a zero-energy eigenstate with large overlap on the tail, or prohibit the existence of any low-energy eigenstate with nonzero overlap. The algorithm is now as follows: 1. Prepare the uniform superposition over every other vertex along the tail, starting at its end, with alternating phases: ψ = 1 L/2 ( 1) j 2j, L/2 where 2j is the vertex on the tail at distance 2j from the original root r. 2. Let H be a Hamiltonian corresponding to a weighted adjacency matrix of the graph. Suitable weights will be specified later. Measure the energy H of ψ with precision δ p = 1 3 Nd and a constant error probability, say 1/10. This can be implemented by applying quantum phase estimation to the unitary operator U = e iπh/n(h), where n(h) is an upper bound on H. (Since all gates have constant fan-in and, it turns out, all edge weights will be O( d), it follows that H = O( d).) j=1 Phase estimation requires applying O(log 1/δ p ) controlled-h evolutions, for a total amount of time O(1/δ p ) [CEMM98]. The leaves of T are not known and hence H is also partly unknown. However, each controlled-h evolution can be discretized into controlled-oracle queries and input-independent unitaries. The unitaries between queries can be implemented efficiently because the vertex degrees and the edge weights are small; see Section 6 for details. 3. Output zero if and only if the measured energy is zero. Section 6 will analyze the running time of this algorithm. The correctness follows by: Theorem 2. If ϕ(x) = 0, then there exists a a zero-energy eigenvector of H, with overlap on the initial state ψ a 1/3 o(1). If ϕ(x) = 1, then every eigenvector with support on any vertex of 1 the tail has corresponding eigenvalue at least 2 in absolute value. Nd 5

6 By Theorem 2, which we will prove in subsequent sections, if ϕ(x) = 0, then our algorithm outputs zero with probability at least ψ a 2 1/9 o(1). If ϕ(x) = 1, then our algorithm outputs zero with probability less than the phase estimation error 1/10. This constant gap can be amplified as usual. 3 Definition of the weighted adjacency matrix Hamiltonian H Definition 1. Let r be the root of the tree T = T(ϕ,x). For a vertex v, let (v) denote the value of the subformula at v (in particular, (r) = ϕ(x)). Let s v denote the number of leaves of the subformula under v, and let d v denote its depth assuming the all-ones input (d v = 1 for a leaf of T(ϕ,1 N )). Let d = d r O(log N). Let H be a symmetric, weighted adjacency matrix of the graph consisting of T and the attached tail: H v = h pv p + h vc c, (1) c where p is the parent of v and the sum is over v s children. (If v has no parent or no children, the respective terms are zero.) The edge weights depend on the structure of the tree, and are given by ( sv ) 1/4 d v h pv = s p γ dv 1 (2) within T, where γ = 1 1 2d. The tail edges are weighted by h pv = d + (d v d)/ N γ d 1 δ dv d, (3) where δ = Nd2. Note that edge weights are independent of the input x. Remark 1. This choice of weights is primarily motivated in order to satisfy h pv y 0v / s p, where y 0v satisfies a recurrence Eq. (5) below and s p is a normalizing factor independent of v used to keep the weights bounded. 4 Zero-energy eigenstates of H Recall that in a NAND tree T, leaves are interpreted as zeros, and internal vertices are interpreted as NAND gates on their children. By T v, we mean the subtree of T consisting of v and all its descendants. The restriction to T v of a vector a on T will be denoted a Tv. That is, for a subset S of the vertices, define the projector Π S = s S s s ; then a T v = Π Tv a. We will also write a v for v a. Finally, let H S = Π S H. (Note that by the adjacency structure of H, H Tv = H Tv Π {p} Tv, where p is the parent of v.) Lemma 3. For a vertex p in NAND tree T, if (p) = 1 and H Tp a = 0, then a p = 0. Proof. Since (p) = 1, there exists a child v of p having (v) = 0. If v is a leaf, then 0 = v H a = h pv a p, as asserted. Otherwise, all children c of v must have (c) = 1, implying by induction that a c = 0. Then 0 = v H a = h pv a p + h vc a c = h pv a p, c as asserted. 6

7 0 γ γ γ γ α β α + β γ γ α β α + β Figure 4: An example NAND tree to illustrate Lemmas 3 and 4. As in Fig. 1, a vertex is filled or not according to whether it evaluates to 1 or 0, respectively. The amplitudes v a of a zero-energy eigenstate a for the adjacency matrix H are also labeled, with α, β, γ free variables, assuming h pv = 1 for every edge (p, v). The amplitudes of the neighbors of any vertex sum to zero. The existence of such an a is promised by Lemma 4. As required by Lemma 3, v a = 0 if (v) = 1, so vertices evaluating to 1 are not labeled. Lemma 3 constrains the existence of zero-energy eigenstates supported on the root r when the NAND formula evaluates to 1. However, there may be zero-energy eigenstates that are not supported on the root (for example, consider the right subtree in Fig. 4). Lemma 4. Consider a vertex p in NAND tree T. If (p) = 0, then there exists an a = a Tp with H Tp a = 0, a = 1, and a p 1/(s 1/4 p dp /γ dp 1 ). If p has parent q, then this inequality is a p 1/(s 1/4 q h qp ). Proof. Since (p) = 0, for all children v of p, (v) = 1. So each v has a child c v satisfying (c v ) = 0. Construct a as follows. Set a v = 0 for all children v. Set a Tc = 0 for all grandchildren c / {c v }. By induction, for each v construct ã Tc v satisfying ã Tc v = 1, H Tc v ã Tc v = 0 and ã c v 1/(s 1/4 v h vc v). For each v, in order to satisfy v H a = 0, we need h pv a p = h vc va c v. To satisfy all these equations, we rescale the vectors ã Tv. Let a p = 1, and let a Tc v = hpv h vc v 1 ã c v ã T c v. It only remains to verify that a 2 s q h 2 qp, so that renormalizing, a p/ a = 1/ a is still large. Indeed, a 2 = a 2 p + v 1 + v h 2 pv h 2 vc v(ã c v)2 a T c v 2 ã c v 1/(s 1/4 v h vc v) 1 h 2 pv sv h pv = (s v /s p ) 1/4 d v /γ dv 1 = 1 + v s v d v sp γ dv s p (d p 1) γ dp 2 < s p d p γ dp 1 = s q h 2 qp. s v = s p v 1 We use a note beside a line to help indicate the derivation of the next line. 7

8 Lemma 4 is a strong converse of Lemma 3, as it does not merely assert that a p can be set nonzero; it also puts a quantitative lower bound on the achievable magnitude. Lemma 4 lets us say that there exists an energy-zero eigenstate with large overlap with the root r when (r) = 0. Now in the case ϕ(x) = (r) = 0, let us extend a T from Lemma 4 into a zero-energy eigenvector a over the whole graph (the tree T and the attached tail), to see that the overlap ψ a / a is large. Again denote by i the ith tail vertex away from T s root r = 0. In order to satisfy H a = 0, we must have a 2j 1 = 0 and a 2j = h 2j 1,2j 2 h 2j,2j 1 a 2j 2 for j = 1,2,...,L/2. Then it is easy to lower-bound a 2j h 0,1 h 2j 1,2j a 0 f a 0, where f = δ L /2 = 1 2 o(1). Therefore, the total overlap ψ a / a is at least (L/2)f a 0 L/2 1 + (L/2)f 2 a 0 2 t 1 + t o(1), where t = f L/2 a 0, and so using a 0 1/(N 1/4 2d) = 1/ 2L, t f/2 = o(1). 5 Spectral gap in the case ϕ(x) = 1 To complete the analysis in the ϕ(x) = 1 case, we investigate H s eigenvectors corresponding to energies E close to zero. In this section, we will show 1 Lemma 5. If ϕ(x) = 1, then H has no eigenvector with energy E (0, root or any vertex of the tail. 2 Nd As T is a bipartite graph, H s eigenvalues are symmetric around zero. Let ] and support on the E = v α v v be an eigenvector of H with eigenvalue E > 0. From Eq. (1) we obtain v H E = Eα v = h pv α p + c h vc α c. (4) The analysis depends on the fact that α v /α p is either large or small in magnitude depending on whether (v) = 0 or Bounding amplitude ratios depending on (v): Analysis in T It will be helpful to define quantities y 0v and y 1v for vertices v in T, as follows: y 0v = 1 + c h vcy 1c h pv y 1v = h pv sv, γ (5) where p is the parent of v, and the sum is over children c of v. If v is a leaf without any children, then the sum over c is zero. Recall that γ = 1 1 2d. Assuming temporarily Lemma 6 below, we can connect Eq. (5) to the NAND subformula evaluated at v. Depending on (v), y 0v and y 1v give upper bounds on αp α v or αv α p. 8

9 Lemma 6. For every v in T, h pv y 0v / s p and s v h pv y 0v 2Nd. Theorem 7. Let 0 < E 1 2 Nd. Then for every vertex v in T, either α v = α p = 0, or (v) = 0 0 α p /α v y 0v E (v) = 1 0 α v /α p y 1v E. Proof. By induction. Base case: for every leaf v, (v) = 0 and by Eq. (4), Eα v = h pv α p. Thus either α v = α p = 0, or α p /α v = E h pv = y 0v E. Induction step: If (v) = 0, then all children c evaluate to (c) = 1. First assume α v 0. Dividing both sides of Eq. (4) by α v and rearranging terms gives α p α v = 1 h pv ( E c 1 h pv ( 1 + c h vc α c α v ) h vc y 1c )E = y 0v E. induction hypothesis The induction hypothesis also gives that α p /α v E/h pv > 0. If α v = 0, then the induction hypothesis gives that all α c are zero, so also α p = 0 by Eq. (4). If (v) = 1, then there is at least one child c with (c) = 0. We may assume α v 0 since otherwise α v /α p = 0 and the inequality holds trivially. Then, again dividing Eq. (4) by α v, and multiplying by E, α p Eh pv = E α v c c: (c)=0 h vc α c α v E 2 induction hypothesis (7) h vc y 0c E 2( 1 + c: (c)=1 h vc y 1c ) h vc y 0c / s v by Lemma 6, subst. h pv y 0v from Eq. (5) 1 ( #{c : (c) = 0} E 2 ) #{c : (c) = 0} 1, s v h pv y 0v sv sv h pv y 0v 2Nd by Lemma 6 1 ( 1 1 ) = γ = h pv. (8) sv 2d sv y 1v As h pv, y 1v and E are all positive, we have 0 > α v /α p Ey 1v, as desired. Proof of Lemma 6. Compute h pv y 0v = 1 + c h vc y 1c y 1c = h vc sc /γ by Eq. (5) h 2 vc sc γ = 1 + c = sv c s c d c γ dc sv d v 1 h 2 vc = γ dv 1 s c c c sv d v γ dv 1 = s p h 2 pv. Eq. (2) sc s v d c max c γ = d v 1 dc γ dv 1 s c = s v,γ < 1 d c by Eq. (2) γdc 1 It follows that y 0v sp h pv, as claimed. Also, by Eq. (2), s v h pv y 0v svdv γ dv 1 2Nd, because s v N, d v d, and γ d e 1/2 > 1 2. (6) 9

10 5.2 Analysis specialized to vertices within the tail Provided the root of T has degree one, Theorem 7 and Lemma 6 are already sufficient to establish a spectral gap around zero in the case the formula evaluates to ϕ(x) = 1. However, we have appended a tail of L = Nd vertices to ensure that in the case ϕ(x) = 0, the zero-energy eigenvector has large overlap with a known state. The bound of Lemma 6 does not suffice for moving along this tail because the 1/γ dv term will grow out of control to γ Nd e N/2. Fortunately, since every tail vertex has exactly one child, it is possible to prove a stronger bound within the tail. For tail vertices v, adjust the definition Eq. (5) of y 1v to y 1v = h pv N δ ; (9) recall that δ = 1 1 as in Theorem 7. 4 Nd 2. We prove that the y s still give a bound on child/parent amplitude ratios Lemma 8. Label the tail vertices by their distance 1,2,...,L away from the root r of the original tree T. Then for every tail vertex v, h pv y 0v. (10) N Furthermore, if 0 < E 1 2 Nd, then for every v, either α v = α p = 0, or (v) = 0 0 α p /α v y 0v E (v) = 1 0 α v /α p y 1v E. (11) Proof. We have h pv y 0v = 1 + h vc y 1c = 1 + h2 vc N δ = 1 + N d + (v 1)/ N γ d 1 δ v N d + v/ N γ d 1 δ v = Nh 2 pv. The second statement follows exactly as in Theorem 7, except Eq. (7) is replaced by α p Eh pv 1 (1 E 2 s v ) 1 1 ) (1 α v sv sv 4 = δ = h pv. Nd 2 sv y 1v Here, the first inequality holds because the one child c has (c) = 0; there are no children evaluating to one. 5.3 Proof of Lemma 5 Proof of Lemma 5. By contradiction. Assume E is an eigenvector of H with energy E (0, 1 2 Nd ]. If α c 0 for c either a tail vertex or the root r, then Eq. (4) at c s parent v implies that either α p 0 or α v 0, where p is c s grandparent. Repeating this argument, either α p 0 or α v 0 10

11 for p = L and v = L 1 being the end of the tail and its single child, respectively. Since Eα p = p H E = h pv α v, in fact neither α p nor α v is zero. We have (p) = ϕ(x) = 1, so (v) = 0, and by Lemma 8, α v /α p 1/(y 0v E). Putting this together with Eα p = h pv α v, we obtain E h pv /y 0v 1/N 1/4 by Eq. (10), a contradiction. 1 (We only obtain a gap of 2, rather than Nd 1/N1/4, because Eq. (7) of Theorem 7 does not hold for energies E 1 2.) Recall that Lemma 3 showed that also E 0 for eigenstates with support Nd on r or tail vertices. 6 Discretizing the algorithm As described in Section 2, the algorithm applies phase estimation with precision δ p = 1/(3 Nd) to the unitary operator U = e iπh/n(h). This requires implementing controlled-u 2k operations for k = 0,1,...,log O( Nd). In particular, it is sufficient to show how to simulate the evolution exp(iht) for any t O( Nd). The Hamiltonian H is the weighted adjacency matrix of a graph with maximum degree upperbounded by a constant, and with edge weights upper-bounded by h = O( d). In general, for any ε > 0, such evolutions can be simulated using O(τ(ht) 1+ε ) steps, where τ is the number of steps required to compute a list of the neighbors of a given vertex, together with their edge weights [BACS07, Chi04]. (The running time also depends on how accurately we wish to simulate the Hamiltonian dynamics, but the simulation error can be made O(1/ log N) with only polylogarithmic overhead.) The main ideas of the simulation are to use an edge coloring of the graph to break it into simple pieces, and to apply a higher-order Lie product decomposition to put those pieces back together with only small overhead. So far, we have not concerned ourselves with how the formula ϕ is specified. If ϕ is given explicitly, then we must perform preprocessing independent of x taking O(N) time to produce a table of adjacency lists and the corresponding edge weights given by Eq. (2), which we subsequently allow to be looked up in constant time. Alternatively, we can assume that the formula is uniformly generated in a way that allows computing adjacency lists and edge weights in time O(N ε ) for ε > 0 arbitrarily small (possibly with preprocessing taking time O(N 1 2 +ε )). Of course, the Hamiltonian H depends not only on the structure of ϕ, but also on the input string through the presence of additional children for leaves of the original tree with x i = 1. Using two queries of U x, we can compute whether leaf i has an additional child. Thus under either of the above assumptions, the computation of adjacency lists and edge weights in the full tree can be done in time τ = O(N ε ), where we count oracle queries as additional computational steps. Overall, this shows that the simulation of e iht for t Nd can be implemented in time O(N 1 2 +ε ), and in particular using only O(N 1 2 +ε ) queries. It remains open to find a discrete-time algorithm that runs slightly faster, perhaps in time O( N). Acknowledgments Robert would like to thank the Institute for Quantum Information at Caltech for hospitality. We thank Ronald de Wolf for comments on an early draft of the paper. 11

12 References [BACS07] D. W. Berry, G. Ahokas, R. Cleve, and B. C. Sanders. Efficient quantum algorithms for simulating sparse Hamiltonians. Communications in Mathematical Physics, 270(2): , [BB94] [BCE91] [BCW98] [BS04] [CCJY07] M. L. Bonet and S. R. Buss. Size-depth tradeoffs for Boolean formulae. Information Processing Letters, 49(3): , N. H. Bshouty, R. Cleve, and W. Eberly. Size-depth tradeoffs for algebraic formulae. In Proc. of 32nd IEEE FOCS, pages , H. Buhrman, R. Cleve, and A. Wigderson. Quantum vs. classical communication and computation. In Proc. of 30th ACM STOC, pages 63 68, H. Barnum and M. Saks. A lower bound on the quantum query complexity of read-once functions. Journal of Computer and System Sciences, 69(2): , A. M. Childs, R. Cleve, S. P. Jordan, and D. Yeung. Discrete-query quantum algorithm for NAND trees. quant-ph/ , [CEMM98] R. Cleve, A. Ekert, C. Macchiavello, and M. Mosca. Quantum algorithms revisited. Proc. R. Soc. London A, 454(1969): , [Chi04] [FGG07] [Gro96] [HMW03] [LLS06] [San95] [Sni85] [SW86] A. M. Childs. Quantum Information Processing in Continuous Time. PhD thesis, MIT, E. Farhi, J. Goldstone, and S. Gutmann. A quantum algorithm for the Hamiltonian NAND tree. quant-ph/ , L. K. Grover. A fast quantum mechanical algorithm for database search. In Proc. of 28th ACM STOC, pages , P. Høyer, M. Mosca, and R. de Wolf. Quantum search on bounded-error inputs. In Proc. of 30th ICALP, pages , LNCS S. Laplante, T. Lee, and M. Szegedy. The quantum adversary method and classical formula size lower bounds. Computational Complexity, 15: , Earlier version in Complexity 05. M. Santha. On the Monte Carlo decision tree complexity of read-once formulae. Random Structures and Algorithms, 6(1):75 87, M. Snir. Lower bounds on probabilistic decision trees. Theoretical Computer Science, 38:69 82, M. Saks and A. Wigderson. Probabilistic Boolean decision trees and the complexity of evaluating game trees. In Proc. of 27th IEEE FOCS, pages 29 38,