Solution to the Hidden Subgroup Problem for a Class of Noncommutative Groups

Size: px

Start display at page:

Download "Solution to the Hidden Subgroup Problem for a Class of Noncommutative Groups"

Meredith Lyons
5 years ago
Views:

1 Solution to the Hidden Subgroup Problem for a Class of Noncommutative Groups Demerson N. Gonçalves 1,2, Renato Portugal 2, arxiv: v1 [quant-ph] 7 Apr Universidade Católica de Petrópolis - CEC/UCP, , Petrópolis, RJ 2 Laboratório Nacional de Computação Científica - LNCC, , Petrópolis, RJ demerson.goncalves@ucp.br, portugal@lncc.br Abstract. The hidden subgroup problem (HSP) plays an important role in quantum computation, because many quantum algorithms that are exponentially faster than classical algorithms can be casted in the HSP structure. In this paper, we present a new polynomial-time quantum algorithm that solves the HSP over the group Z p r Z q s, when p r /q = poly(logp r ), where p, q are any odd prime numbers and r,s are any positive integers. To find the hidden subgroup, our algorithm uses the abelian quantum Fourier transform and a reduction procedure that simplifies the problem to find cyclic subgroups. 1 Introduction The area of quantum algorithms is reviewed in two noteworthy papers [1,2]. A wide class of algorithms deals with algebraic problems [1] and most of them can be casted as a Hidden Subgroup Problem (HSP) [3]. The HSP can be described as follows: given a group G and a coset-injective function f : G X on some set X such that f(x) = f(y) iff x H = y H for some subgroup H, the problem consists in determining a generating set for H by querying function f. We say that the function f hides the subgroup H in G or f separates the cosets of H in G. A quantum algorithm for the HSP is said to be efficient when its computational complexity is polylogarithm in the order of the group, i.e. O(poly(log G )). There are many examples of efficient quantum algorithms for the HSP [4,5]. It is known that for finite abelian groups, the HSP can be solved efficiently in a quantum computer [3]. On the other hand, it is not known an efficient solution for a generic nonabelian group. Two important groups in this context are the symmetrical and the dihedral groups. An efficient algorithm for solving the first one implies in an

2 efficient solution for the graph isomorphism problem [6] and for the second one solves instances of the problem of finding the smallest vector in a lattice, with applications in cryptography [7]. An important strategy to solve the nonabelian HSP combines three methods: (1) the abelian Fourier transform, (2) the characterization of all subgroups of the groupg, and (3) the quotient group reduction. This strategy was first employed by Ettinger and Høyer [8], that have reduced the HSP in the dihedral group to the problem of finding cyclic subgroups of order 2. Later on, also employing the same strategy, Inui and Le Gall [9] presented an efficient quantum algorithm for the HSP in groups of the form Z m p r Z p with prime p and positive integers r and m. Bacon et. al. [10] solved in polynomial time the HSP in groups of the form Z N Z q, for positive integers N and prime q, such that N/q = poly(logn), reducing the problem to find cyclic subgroups of order q. Recently, Gonçalves et. al. [11] presented a class of efficient quantum algorithm for the HSP in Z p Z q s, with p/q = poly(logp), where p, q are distinct odd prime numbers and s an arbitrary positive integer. For an extensive description of solutions to the HSP, methods, and references, see Refs. [12,3]. In this work, we present a new quantum algorithm in polynomial time that solves the HSP in Z p r Z q s, with p r /q = poly(logp r ), where p, q are distinct odd prime numbers and r,s arbitrary positive integers. This result extends the results obtained in Ref. [11], that are reproduced when r = 1. This work generalizes one of the results of Ref. [13], which works for prime N. It also generalizes results of Ref. [13] for p-hedral groups and of Ref. [10], which are reproduced when s = 1. The article is organized as follows. In Sec. 2, we define the semidirect product Z p r Z q s and we characterize all subgroups. In Sec. 3, we show that the HSP in Z p r Z q s can be reduced to the problem of finding cyclic subgroups. In Sec. 3.1, we present a polynomial-time quantum algorithm for the HSP in a class of groups of the form Z p r Z q s. Finally, in Sec. 4, we present our conclusions. 2 The Structure of the Group Z p r Z q s Let p, q be prime numbers and r,s positive integers. The semidirect product Z p r φ Z q s, where Z p r and Z q s are cyclic groups and φ :

3 Z q s Aut(Z p r), is a group homomorphism that defines the group product. The elements are (a,b), where a Z p r, b Z q s and the product of two element is (a,b)(c,d) = (a + φ(b)(c),b + d). Note that x = (1,0) and y = (0,1) generate the group Z p r Z q s. Since Aut(Z p r) is isomorphic to Z pr, the homomorphism φ is completely determined by α := φ(1)(1) Z pr. The notation (a,b) is equivalent to x a y b and the commutation relation is y b x a = x aαb y b. Observe that φ(0) = φ(q s ) : Z p r Z p r is the identity element of the group Aut( Z p r). Then α qs = φ(q s )(1) = 1. The element α Z p r defines the semidirect product of groups Z p r α Z q s, if it satisfies the congruence equation X qs 1 modp r. In this case, we must have ord(α) = q t for some t = 0,...,s. The case t = 0 reduces to the direct product of groups Z p r Z q s, which is an abelian group. An efficient solution for the HSP is known for this case. From now on we consider 1 t s. For all prime p and positive integer r, the group Z pr is cyclic. Let u Z pr be an arbitrary generator of this group. Then ord(u) = p r 1 (p 1) and α = u k, for some integer 1 k < p r 1 (p 1). Thus α qt = u kqt 1 modp r p 1 kq t. Because p and q are distinct prime numbers, we must have q t p 1 and k = lpr 1 (p 1), for some q t l Z q. Thus, for each 1 t s and l Z t q, the number t α := u lp r 1 (p 1) q t (1) defines a semidirect product of groups, that will be denoted by G t,l = Z p r α Z q s. (2) The parameter l in Eq. (1) is disposable, because the group G t,l is isomorphic to G t,1, for all l. Next theorem states this fact. Theorem 1. G t,l G t,1 for all l Z q t. Proof: Consider the mapping Φ t,l : G t,1 G t,l defined by Φ t,l (x a y b ) = x a y l 1b. Notice that there is an unique inverse l 1 of l Z q t. Thus, given x a y b G t,l there is an unique x a y lb G t,1 such that Φ t,l (x a y lb ) = x a y b. Then Φ t,l is one-to-one. It is easy to verify that Φ t,l (x a y b x c y d ) = Φ t,l (x a y b )Φ t,l (x c y d ), therefore Φ t,l is a group isomorphism.

4 Let us denote G t,l by G t, where the homomorphism α is given by Eq. (1) with l = 1. Using the relation y b x a = x aαb y b and making an induction on k, we verify that (x a y b ) k = { x ak y bk, if q t b; x a(α bk 1) α b 1 y bk, otherwise, (3) where q t = ord(α). Now we are able to list all subgroups of G t = Z p r Z q s by stating the following Theorem 2. The subgroups of G t are i) x pi y qj for 0 i r and t j s; ii) x pi,x a y qj for 0 i r, 0 a < p r and 0 j < t. Proof: In the appendix. 3 The Quantum Algorithm In this section, we show that the HSP in G t can be reduced to the problem of finding cyclic subgroups of the form x a y qj, where a is an arbitrary element in the cyclic group Z p r and 0 j < t. Afterward we present an efficient quantum algorithm for the HSP in G t for t = 1. Let f be the oracle function that hides the subgroup H in G t. It follows from Theorem 2 that there are two cases for H, either x pi y qj or x pi,x a y qj. The parameters to be determined are i,j anda. Parameterais the most difficult one to address. The algorithm that determines the value of a will be presented in Sec The general idea of the algorithm is the following. Let H x = H x and H y = H y. Consider function f x defined by f x (a) = f(a,0), which hides H x in Z p r. Analogously, consider function f y defined by f y (b) = f(0,b), which hides H y in Z q s. The solution of the HSP in the abelian groups Z p r and Z q s with oracle functions f x and f y determines generators for the subgroups H x and H y, respectively.

5 These subgroups have the form H x = x pi and H y = y qj, for some 0 i r and 0 j s. From now on we assume that i and j are known. If j t then H = x pi y qj (Theorem 2), otherwise we learn that H = x pi,x a y qj. In the last step we run the algorithm of Section 3.1 to find the value of a in polynomial time and with high probability. We end this section by analyzing the time complexity of classical algorithms for solving the HSP in G t. It follows from Theorem 2 that G t has Ω(p r ) subgroups. Therefore, the HSP cannot be solved efficiently by a classical computer by performing an exhaustive search for the subgroups of G t. The methods known in the literature, such as the ones presented in Refs. [14,15] for groups with commutators of polynomial size and for nilpotent groups with constant nilpotency class, cannot be employed in this context. A remaining method is the following. The HSP in G t can be efficiently solved by finding two distinct elements g 1 and g 2 in G t, such that f(g 1 ) = f(g 2 ). Let us show that such collision solves the HSP. For each 0 j s, function f is promised to hide subgroup H = x a y qj. Then, if we know two elements g 1 and g 2 such that f(g 1 ) = f(g 2 ), we will obtain g2 1 g 1 H. Using that g2 1 g 1 = x u y v for some u Z p r and v Z q s, we have that g2 1 g 1 H if and only if { u a αkqj 1 mod α qj pr 1 v kq j mod q s, for some k = 0,...,q s j 1. From Eq. (4), it follows that a u αqj 1 α v 1 modpr q t v. Now the question is: What is the probability that q t v is true? Suppose that v is an integer multiple of q t, this is, q t v. Since v Z q s, there exist q s t integer multiple of v in Z q s. The probability of v being in Z q s and being an integer multiple of q t is qs t = 1. Then the probability of v being in Z q s q t q s and q t v is 1 1. With probability 1 1 1, the HSP in G q t q t t reduces itself to the problem of finding elements g 1 g 2 such that f(g 1 ) = f(g 2 ). The problem of finding distinct elements g 1 and g 2 such f(g 1 ) = f(g 2 ) is known as the collision problem. In that case, the function f is said to (4)

6 be q s j -to-one 3, and the time complexity of the classical algorithm for this problem is Θ( p r q j ), see Ref. [16]. Therefore, the lower limit of the classical algorithm for the HSP in G t is Ω( p r ). 3.1 Case H = x a y qj In this section, we present an efficient quantum algorithm that solves the HSP in G t = Z p r Z q s when p r /q = poly(logp r ). The HSP in Z p r Z q s can be reduced to the problem of finding cyclic subgroups generated by x a y qj, which has order q s j. We describe a procedure that, given a function f that hides the subgroup H = x a y qj in Z p r Z q s, efficiently determines the value of a with high probability, when t = 1. For t > 1, we argue that there is no efficient solution. The procedure is the following one: 1. Initialize the quantum computer in the state Ψ 1 = 1 pr 1 q t j p r m=0 q t j 1 n=0 m n f(x m y n ). (5) The arithmetical operations in the first ket (second ket) are performed modulo p r (q t j ). Note that the left cosets of H are { } x m 0 y n 0 H = x m 0+aα n0s(n) y n 0+nq j,n = 0,...,q s j 1, (6) for each m 0 Z p r, n 0 Z q j and S(n) = αnqj 1 α qj 1 mod p r. (7) 2. Measure the third register of state Ψ 1 in the computational basis. The state after the measurement is Ψ 2 = 1 q t j 1 m 0 +aα n 0 S(n) n0 +nq j, (8) q t j n=0 for some 0 m 0 < p r and 0 n 0 < q t j unknown and uniformly distributed. We discard the third register from now on, because it is not relevant in what follows. 3 A function f : X Y is said to be m-to-one, when there are m elements in X that are mapped to the same element in Y.

7 3. Apply the Fourier transform F Zp r I to the state Ψ 2. The result is Ψ 3 = 1 pr 1 q t j p r k=0 q t j 1 n=0 ω k(m 0+aα n 0S(n)) p r k n0 +nq j, (9) where ω p r is to p r -th primitive root of the unity. 4. Measure the first register in the computational basis. Assume that the result of the measurement is some element k 0 Z p r. Then, the state after the measurement is Ψ 4 = 1 q t j 1 ω k 0(m 0 +aα n 0S(n)) q t j p k 0 r n0 +nq j. (10) n=0 The probability of obtaining the state Ψ 4 is 1 1. p 5. Apply the operator U, defined by ( ) U m n = ms(n) ms(n) n S 1, (11) to state Ψ 4. Operator U is not unitary in general, because S(n) is not injective in general. However, for n in Z q t j, Lemma A2 ensures that S(n) is injective, and therefore U is unitary. We must impose t j > t 1, which implies j = 0. It follows from Theorem 2 that j = 0 when t = 1. Taking t = 1 and applying U to Ψ 4 one obtains Ψ 5 = 1 q 1 q n=0 k 0 ω k 0(m 0 +as(n)) p r k 0S(n) 0. (12) Our goal now is to obtain parameter a present in state Ψ 5. We will use the following argument discussed in Ref. [10]. Consider the state ã = 1 p r 1 p r j=0 ω ja pr j. (13) Notice that an application of the inverse Fourier transform F Z p r to the state ã returns the value ofawith high probability. State ã has

8 information about parameter a. What do we learn about a measuring state Ψ 5? Is there a relation between ã and Ψ 5? Those questions can be answered using the notion of quantum fidelity. The fidelity between the quantum states ã and Ψ 5 (discarding ket 0 of Ψ 5 ) is given by ã Ψ 5 = q. Then, applying the p r inverse Fourier transform F Z to state Ψ p r 5 and afterward measuring the result in the computational basis, we obtain the value of a with probability ã Ψ 5 2 = q. The total success probability of obtaining p r the value of a is 1 1 p q = (p 1)q. Now, we run the algorithm l p r p r+1 times, where l = pr+1 2(p 1)q = O(poly(logpr )), to obtain the value of a with probability 1/2. Theorem 3. There is a quantum algorithm that solves, in polynomial time with success probability greater than 1/2, the HSP in the group Z p r Z q s when p r /q = poly(logp r ), where p, q are distinct prime numbers and r,s are positive integers. 4 Conclusions We have presented a quantum algorithm in polynomial time for solving the HSP in a class of noncommutative groups Z p r Z q s, where p, q are distinct prime numbers and r,s are positive integers. Using the classification of the subgroups of Z p r Z q s, we have showed that the HSP can be reduced to the problem of finding cyclic subgroups. The algorithm has success probability greater than 1/2 and requires that p r /q = poly(logp r ) and t = 1. For t > 1, it seems that there is no unitary operator that reveals the parameters that describe the hidden subgroup. This work generalizes previous results. It generalizes the results of Ref. [13] forp-hedral groups and Ref. [10], which are obtained from our results by setting s = 1. It generalizes the results of Ref. [11], which are obtained from our results by setting r = 1. In Ref. [13], the authors employed the nonabelian Fourier transform. It would be interesting to analyze the possibility of obtaining similar results for the HSP in Z p r Z q s using nonabelian Fourier transforms.

9 References 1. A. M. Childs and W. van Dam. Quantum algorithms for algebraic problems. Rev. Mod. Phys., 82(1):1 52, M. Mosca. Quantum algorithms. Encyclopedia of Complexity and Systems Science, pages , C. Lomont. The Hidden Subgroup Problem - Review and Open Problems. Quantum Physics, Abstract quant-ph/ , November D. R. Simon. On the Power of Quantum Computation. In Proceedings of the 35th Annual Symposium on Foundations of Computer Science, pages , Los Alamitos, CA, Institute of Electrical and Electronic Engineers Computer Society Press. 5. P. W. Shor. Algorithms for quantum computation: discrete logs and factoring. In Proc. of the 35th Ann. IEEE Symp. on the Foundation of Computer Science, pages , R. Beals. Quantum computation of Fourier transforms over symmetric groups. In Proc. 29th ACM Symp. on Theory of Computing, pages 48 53, New York, ACM. 7. O. Regev. Quantum Computation and Lattice Problems. SIAM Journal on Computing, 33(3): , M. Ettinger and P. Høyer. On quantum algorithms for noncommutative hidden subgroups. Adv. in Appl. Math., (25): , Y. Inui and F. Le Gall. An efficient quantum algorithm for the hidden subgroup problem over a class of semi-direct product groups. Quantum Information and Computation, (5): , D. Bacon, A. M. Childs, and W. van Dam. From optimal measurement to efficient quantum algorithms for the hidden subgroup problem over semi-direct product groups. In Proc. of 46th Ann. IEEE Symp. on Foundations of Computer Science - FOCS 2005, pages , D. N. Gonçalves, R. Portugal, and C. M. M. Cosme. Solutions to the hidden subgroup problem on some metacylic groups. In Proc. 4th Worshop on Theory of Quantum Computation, Communication and Cryptography. LNCS, Springer- Verlag (to apper), F. Wang, The Hidden Subgroup Problem, arxiv: , C. Moore, D. Rockmore, A. Russell, and L. J. Schulman. The power of basis selection in fourier sampling: hidden subgroup problems in affine groups. In SODA 04: Proceedings of the fifteenth annual ACM-SIAM symposium on Discrete algorithms, pages , G. Ivanyos, F. Magniez, and M. Santha. Efficient Quantum Algorithms for some Instances of the Non-Abelian Hidden Subgroup Problem. Internation Journal of Foudations of Computer Science, 14(5): , G. Ivanyos, L. Sanselme, and M. Santha. An efficient quantum algorithm for the hidden subgroup problem in nil-2 groups. Proc. of 8th Latin American Theoretical Informatics, LATIN 08, S. Kutin. Quantum lower bound for the collision problem with small range. Theory of Computing, 1(1):29 36, 2005, toc:v001/a002.

10 A Proof of Theorem 2 The proof of Theorem 2 uses two lemmas. The first one characterizes the cyclic subgroups of G t. Lemma A1 The cyclic subgroups of G t are i) x a y qj, for 0 a < p r and 0 j < t. ii) x pi y qj, 0 i r and j t s. Proof: Let H be a cyclic subgroup of G t. Then H = x a y b for some a Z p r and b Z q s. Let p i = gcd(a,p r ) for some i = 0,...,r and q j = gcd(b,q s ) for some j = 0,...,s. Then, there are integers u Z p r and v Z q s such that a = upi and b = vq j, respectively. There are two cases to consider with respect to parameter j: 0 j < t and j t. In the first case we have (x a y b ) v 1 = (x a y vqj ) v 1 = x a(α q j 1) α b 1 y qj x a y b. Notice that there is v 1 such that vv 1 = 1. Then v Z q s. Taking a = a(αqj 1) we have that x a y qj x a y b. α b 1 Since ord(x a y b ) = ord(x a y qj ) = q s j, we have x a y qj = x a y b, whenever q j b, for every 0 j < t. Then H is in class i) of Theorem 2. If j t, then (x a y b ) k = (x upi y vqj ) k = x upik y vqjk = e k = p r i q s j. Besides x pi,y qj x pi y qj, then x upi y vqj x pi y qj. Since x pi y qj = x upi y vqj = p r i q s j we have that x a y b = x upi y vqj = x pi y qj. Then, we conclude that H is in class ii). Lemma A2 Let α be the homomorphism that defines G t. For all b Z q s such that q t b we have α b 1 Z p r. Proof: Suppose by contradiction that α b 1 Z p r. Then, there is an integer number k Z p r such that α b = kp + 1. Using the binomial expansion, we obtain α bpr 1 = (kp + 1) bpr 1 = 1 mod p r. Since ord(α) = q t, we have q t bp r 1. This is a contradiction, since q t b and p,q are distinct primes. Then α b 1 Z p r.

11 Proof of Theorem 2 Let H be a subgroup of G t. If H is cyclic, Lemma A1 states that H is either in class i) or in class ii) with i = r. Suppose that H has a generating set with n elements, where n is a positive integer: H = x a 1 y b 1,...,x an y bn. If q t b k for all k = 1,...,n, let p i k = gcd(ak,p r ) and q j k = gcd(bk,q s ), with u k Z p r, v k Z q s, for all integer numbers 0 i k r and t j k s. Then H = x pi 1 y qj 1,...,x pin y qjn. Define i = min{i 1,...,i n } and j = min{j 1,...,j n }. Then, for all k = 1,...,n we have i k = i+i k, j k = j + j k, for some i k Z p r, j k Z q s. Then k = x xpi pi+i k = (x pi ) pi k x pi and y qj k = y qj+j k = (y qj ) qj k y qj. This result implies that x pi k y qj k x pi,y qj. Since x pi,y qj = x pi y qj, we have x pi k y qj k x pi y qj. Then H x pi y qj. Note that x pi k,y qj k H for all k = 1,...,n. Then x pi y qj H and H = x pi y qj. We conclude that H is in class i). On the other hand, if q t b k for all k = 1,...,n, then the generators of H can be written as x a k y v kq j k, where v k Z q with 0 j s k < t. Then, for each k,l = 1...,n with k l, the commutator of the generators x a k y b k and x a ly b l is [ ] x a k y b k,x a l y b l = x a k+a l α b k a k α bl a l = x γ klp i kl, (14) for some γ kl Z p and 0 i r kl r. Let i = min{i kl, k,l = 1,...,n e k l} and suppose with no loss of generality that ord(x an y bn ) = q s jn ord(x a k b b k) = q s j k j k j n, for all k = 1,...,n 1. Then, we state that H = x pi,x an y bn. In fact, it is easy to conclude that x pi,x an y bn H. We simply need to verify that x a k y b k x pi,x an y. bn In fact, if x a k y b k is in subgroup x pi,x an y bn, then there are positive integers M and N such that x a k y b k = x Mpi α Nbn +a 1 n α bn 1 y Nbn. (15) This above equation implies that { ak =Mp i +a n α Nbn 1 α bn 1 mod pr ; b k = Nb n mod q s. (16)

12 This system of modular equations has solutions, since b k = Nb n mod q s v k q j k = Nv n q jn mod q s N = v k vn 1 q j k j n. To find M, we note that Mp i = a k a n (α b k 1) α bn 1. (17) From Eq. (14), it follows that Mp i = γ kn p i kn (1 α b n ) 1. Using i i kn, we obtain M = γ kn p ikn i (1 α bn ) 1. Then H = x pi,x an y bn. (18) From Lemma A2, we conclude that there is the inverse (1 α bn ) 1. From Lemma A1, the cyclic subgroup x an y bn has the form x a y qj for some a Z p r and some integer number 0 j < t. Then H = x pi,x a y qj is in class ii). Finally, let us suppose that subgroup H can be written as H = x a 1 y b 1,...,x an y bn for some n N with indices 1 j 1 < j 2 <... < j k n such that q t b j1,...,q t b jk. Suppose that j 1 = 1,...,j k = k, then H can be written as H = x a 1 y b 1,...,x a k y b k,x a k+1 y v k+1q j k+1,...,x an y vnqjn (19) = x pi,x a y qj,x pl y qm, (20) for some integer numbers 0 i,l r, 0 a < p r, 0 j < t and t m s. Define λ = min{i,l}, then H = x pi,x a y qj,x pl y qm = x λ y qm,x a y qj. Since y qt = (x a y qj ) qt j x a y qj, we have y qm x a y qj for m = t,...,s. This result implies that H = x pλ,x a y qj. Again we show that H is in class ii). This ends the proof.

Quantum Computing Lecture Notes, Extra Chapter. Hidden Subgroup Problem

Quantum Computing Lecture Notes, Extra Chapter Hidden Subgroup Problem Ronald de Wolf 1 Hidden Subgroup Problem 1.1 Group theory reminder A group G consists of a set of elements (which is usually denoted