D.1 Deutsch-Jozsa algorithm

Transcription

1 4 CHAPTER III. QUANTUM COMPUTATION Figure III.: Quantum circuit for Deutsch algorithm. [fig. from Nielsen & Chuang ()] D Quantum algorithms D. Deutsch-Jozsa algorithm D..a Deutsch s algorithm In this section you will encounter your first example of a quantum algorithm that can compute faster than a classical algorithm for the same problem. This is a simplified version of Deutsch s original algorithm, which shows how it is possible to extract global information about a function by using quantum parallelism and interference (Fig. III.). 8 Suppose we have a function f :!, asinsec.c.5. Thegoalisto determine whether f() = f() with a single function evaluation. This is not a very interesting problem (since there are only four such functions), but it is a warmup for the Deutsch-Jozsa algorithm. Simple as it is, it could be expensive to decide on a classical computer. For example, suppose f() = the billionth bit of and f() = the billionth bit of e. Thentheproblemis to decide if the billionth bits of and e are the same. It is mathematically simple, but computationally complex. To see how we might solve this problem, suppose we have a quantum gate array U f for f; thatis,u f xi yi = xi y f(x)i. In particular, U f xi i = 8 This is the 998 improvement by Cleve et al. to Deutsch s 985 algorithm (Nielsen & Chuang,, p. 59).

2 D. QUANTUM ALGORITHMS 5 xi f(x)i and U f xi i = xi f(x)i. Usually we set y =togettheresult f(x)i, buthereyouwillseeanapplicationinwhichwewanty =. Now consider the result of applying U f to xi in the data register and to the superposition i = p ( i i) inthetargetregister. U f xi i = p xi f(x)i p xi f(x)i = p xi[ f(x)i f(x)i]. Now the rightmost square bracket is i i if f(x) =or i i if f(x) =. Therefore,wecanwrite U f xi i = p xi( ) f(x) ( i i) =( ) f(x) xi i. (III.) [Here, ( ) x is an abbreviation for ( ) x when we want to emphasize that the sign is all that matters.] Since U f xi i =( ) f(x) xi i, theresultof applying it to an equal superposition of x =andx =is: p U f xi i = p ( ) f(x) xi i. x If f is a constant function, then f() = f(), and the summation is ± p ( i+ i) i = ± +i i because both components have the same sign.. On the other hand, if f() 6= f(), then the summation is ± p ( i i) i = ± i i because the components have opposite signs. That is, a constant function gives the i and i components of the data qubit the same phase, and otherwise gives them the opposite phase. Therefore, we can determine whether the function is constant or not by measuring the first qubit in the sign basis; we get +i if f() = f() and i otherwise. With this background, we can state Deutsch s algorithm. x algorithm Deutsch: Initial state: Begin with the qubits i def = i. Superposition: Transform it to a pair of superpositions i def = p ( i + i) p ( i i) = + i. (III.)

3 6 CHAPTER III. QUANTUM COMPUTATION by a pair of Hadamard gates. Recall that H i = p ( i + i) = +i and H i = p ( i i) = i. Function application: Next apply U f to i = + i. As we ve seen, U f xi i = xi f(x)i = xi f(x)i, and U f xi i = xi f(x)i = xi f(x)i. Therefore,expandEq.III.andapplyU f : i def = U f i = U f apple p ( i + i) p ( i i) = [U f i U f i + U f i U f i] = [,f()i, f()i +,f()i, f()i] There are two cases: f() = f() and f() 6= f(). Equal (constant function): If f() = f(), then i = [,f()i, f()i +,f()i, f()i] = [ i( f()i f()i)+ i( f()i f()i)] = ( i + i)( f()i f()i) = ± ( i + i)( i i) = ± p ( i + i) i = + i. The last line applies because global phase (including ±) doesn tmatter. Unequal (balanced function): If f() 6= f(), then i = [,f()i, f()i +, f()i,f()i]

4 D. QUANTUM ALGORITHMS 7 = [ i( f()i f()i)+ i( f()i f()i)] = [ i( f()i f()i) i( f()i f()i)] = ( i i)( f()i f()i) = ± ( i i)( i i) = ± p ( i i) i = i Clearly we can discriminate between the two cases by measuring the first qubit in the sign basis. In particular, note that in the unequal case, the i component has the opposite phase from the i component. Measurement: Therefore we can determine whether f() = f() or not by measuring the first bit of i in the sign basis, which we can do with the Hadamard gate (recall H +i = i and H i = i): 3 i def = (H I) i ± i i, if f() = f() = ± i i, if f() 6= f() = ± f() f()i i. Notice that the information we need is in the data register, not the target register. This technique is called phase kick-back (i.e., kicked back into the phase of the data register). In conclusion, we can determine whether or not f() = f() with a single evaluation of f, whichisquiteremarkable.ine ect,weareevaluatingf on asuperpositionof i and i and determining how the results interfere with each other. As a result we get a definite (not probabilistic) determination of aglobalpropertywithasingleevaluation. This is a clear example where a quantum computer can do something faster than a classical computer. However, note that U f has to uncompute

5 8 CHAPTER III. QUANTUM COMPUTATION Figure III.3: Quantum circuit for Deutsch-Jozsa algorithm. [fig. from NC] f, whichtakesasmuchtimeascomputingit,butwewillseeothercases (Deutsch-Jozsa) where the speedup is much more than. D..b The Deutsch-Jozsa algorithm The Deutsch-Jozsa algorithm is a generalization of the Deutsch algorithm to n bits, which they published it in 99; here we present the improved version of Nielsen & Chuang (, p. 59). This is the problem: Suppose we are given an unknown function f : n! in the form of a unitary transform U f L(H n+, H) (Fig. III.3). We are told only that f is either constant or balanced, whichmeansthatitison half its domain and on the other half. Our task is to determine into which class the given f falls. Consider first the classical situation. We can try di erent input bit strings x. We might (if we re lucky) discover after the second query of f that it is not constant. But we might require as many as n /+queriestoanswer the question. So we re facing O( n )functionevaluations. algorithm Deutsch-Jozsa: Initial state: As in the Deutsch algorithm, prepare the initial state i def = i n i.

6 D. QUANTUM ALGORITHMS 9 Superposition: Use the Walsh-Hadamard transformation to create a superposition of all possible inputs: i def =(H n H) i = p x, i. x n n Claim: Similarly to the single qubit case (Eq. III.), we can see that U f x, i =( ) f(x) xi i, where( ) n is an abbreviation for ( ) n. From the definition of i and U f, U f x, i = xi p ( f(x)i f(x)i). Since f(x), p ( f(x)i f(x)i) = i if f(x) =,andit= i if f(x) =. This establishes the claim. Function application: Therefore, you can see that: i def = U f i = x n p n ( )f(x) xi i. (III.3) In the case of a constant function, all the components of the data state have the same phase, otherwise they do not. To see how we can make use of this information, let s consider the state in more detail. For a single bit you can show (Exer. III.46): H xi = p ( i +( ) x i) = p z( ) xz zi = z p ( ) xz zi. (This is just another way of writing H i = p ( i+ i) andh i = p ( i i).) Therefore, the general formula for the Walsh transform of n bits is: H n x,x,...,x n i = = p n p n z,...,z n ( ) x z + +x nz n z,z,...,z n i z n ( ) x z zi, (III.4) where x z is the bitwise inner product. (It doesn t matter if you do addition or since only the parity of the result is significant.) Remember this formula! Combining this and the result in Eq. III.3, 3 i def =(H n I) i = ( n z n x n )x z+f(x) zi i.

7 3 CHAPTER III. QUANTUM COMPUTATION Measurement: Consider the first n qubits and the amplitude of one particular basis state, z = i = i n,whichweseparatefromtherestofthe summation: 3 i = x n n ( )f(x) i i + z n {} x n n ( )x z+f(x) zi i Hence, the amplitude of i n,theall- i qubit string, is P x n n ( ) f(x). Recall how in the basic Deutsch algorithm we got a sum of signs (either all the same or not) for all the function evaluations. The result is similar here, but we have n values rather than just two. We now have two cases: Constant function: If the function is constant, then all the exponents of willbethesame(eitherallorall),andsotheamplitudewillbe±. Therefore all the other amplitudes are and any measurement must yield for all the qubits (since only i n has nonzero amplitude). Balanced function: If the function is not constant then (ex hypothesi) it is balanced, but more specifically, if it is balanced, then there must be an equal number of + and contributionstotheamplitudeof i n,soits amplitude is. Therefore, when we measure the state, at least one qubit must be nonzero (since the all-s state has amplitude ). The good news about the Deutsch-Jozsa algorithm is that with one quantum function evaluation we have got a result that would require between and O( n )classicalfunctionevaluations(exponentialspeedup!). Thebad news is that the algorithm has no known applications! Even if it were useful, however, the problem could be solved probabilistically on a classical computer with only a few evaluations of f: foranerrorprobabilityof, ittakes O(log ) function evaluations. However, it illustrates principles of quantum computing that can be used in more useful algorithms.

8 D. QUANTUM ALGORITHMS 3 D. Simon s algorithm Simon s algorithm was first presented in 994 and can be found in Simon, D. (997), On the power of quantum computation, SIAM Journ. Computing, 6 (5), pp For breaking RSA we will see that its useful to know the period of a function: that r such that f(x + r) =f(x). Simon s problem is a warmup for this. Simon s Problem: Suppose we are given an unknown function f : n! n and we are told that it is two-to-one. This means f(x) =f(y) i x y = r for some fixed r n.thevectorrcan be considered the period of f, sincef(x r) =f(x). The problem is to determine the period r of a given unknown f. Consider first the classical solution. Since we don t know anything about f, the best we can do is evaluate it on random inputs. If we are ever lucky enough to find x and x such that f(x) =f(x ), then we have our answer, r = x x. After testing m values, you will have eliminated about m(m )/ possible r vectors (namely, x x for every pair of these m vectors). You will be done when m n. Therefore, on the average you need to do n/ function evaluations, which is exponential in the size of the input. For n =, it would require about 5 5 evaluations. At million calls per second it would take about three years (Mermin, 7, p. 55). We will see that a quantum computer can determine r with high probability (> 6 ) in about evaluations. At million calls per second, this would take about microseconds! algorithm Simon: Input superposition: As before, start by using the Walsh-Hadamard transform to create a superposition of all possible inputs: i def = H n i n = n/ x n xi. 9 The following presentation follows Mermin s Quantum Computer Science (Mermin, 7,.5, pp. 55 8).

9 3 CHAPTER III. QUANTUM COMPUTATION Function evaluation: Suppose that U f is the quantum gate array implementing f and recall U f xi yi = xi y f(x)i. Therefore: i def = U f i i n = xi f(x)i. n/ x n Therefore we have an equal superposition of corresponding input-output values. Output measurement: Measure the output register (in the computational basis) to obtain some zi. Since the function is two-to-one, the projection will have a superposition of two inputs: p ( x i + x ri) zi, where f(x )=z = f(x input register, r). The information we need is contained in the 3 i def = p ( x i + x but it cannot be extracted directly. If we measure it, we will get either x or x r, but not both, and we need both to get r. (We cannot make two copies, due to the no-cloning theorem.) Suppose we apply the Walsh-Hadamard transform to this superposition: H n 3 i = H n p ( x i + x ri) ri), = p (H n x i + H n x ri). Now, recall (D..b, p. 9) that H n xi = n/ y n ( ) x y yi. (This is the general expression for the Walsh transform of a bit string. The phase depends on the number of common -bits.) Therefore, " # H n 3 i = p ( ) x y yi + ( ) (x+r) y yi n/ n/ y n y n = (n+)/ y n ( ) x y +( ) (x+r) y yi.

10 D. QUANTUM ALGORITHMS 33 Note that ( ) (x +r) y =( ) x y ( ) r y. Therefore, if r y =,thenthebracketedexpressionis(sincetheterms have opposite sign and cancel). However, if r y =,thenthebracketed expression is ( ) x y (since they don t cancel). Hence the result of the Walsh-Hadamard transform is 4 i = H n 3 i = (n )/ y s.t. r y= ( ) x y yi. Measurement: Measuring the input register (in the computational basis) will collapse it with equal probability into a state y () i such that r y () =. First equation: Since we know y (),thisgivesussomeinformationabout r, expressedintheequation: y () r + y () r + + y () r n =(mod). n Iteration: The quantum computation can be repeated, producing a series of bit strings y (), y (),... such that y (k) r =. Fromthemwecanbuild up a system of n linearly-independent equations and solve for r. (If you get a linearly-dependent equation, you have to try again.) Note that each quantum step (involving one evaluation of f) produces an equation (except in the unlikely case y (k) =orthatit slinearlydependent),andtherefore determines one of the bits in terms of the other bits. That is, each iteration reduced the candidates for r by approximately one-half. A mathematical analysis (Mermin, 7, App. G) shows that with n + m iterations the probability of having enough information to determine r is >. Thus the odds are more than a million to one that with m+ n +invocationsofu f we will learn [r], no matter how large n may be.

11 34 CHAPTER III. QUANTUM COMPUTATION (Mermin, 7, p. 57) Note that the extra evaluations are independent of n. Therefore Simon s problem can be solved in linear time on a quantum computer, but requires exponential time on a classical computer.

12 D. QUANTUM ALGORITHMS 35 D.3 Shor s algorithm If computers that you build are quantum, Then spies everywhere will all want em. Our codes will all fail, And they ll read our , Till we get crypto that s quantum, and daunt em. Jennifer and Peter Shor (Nielsen & Chuang,, p. 6) The widely used RSA public-key cryptography system is based on the di - culty of factoring large numbers. The best classical algorithms are nearly exponential in the size of the input, m = lnm. Specifically, the best current (6) algorithm (the number field sieve algorithm) runsintime e O(m/3 ln /3 m). This is subexponential but very ine cient. Shor s quantum algorithm is bounded error-probability quantum polynomial time (BQP), specifically, O(m 3 ). Shor s algorithm was invented in 994, inspired by Simon s algorithm. Shor s algorithm reduces factoring to finding the period of a function. The connection between factoring and period finding can be understood as follows. Assume you are trying to factor M. Suppose you can find x such that x =(modm). Then x =(modm). Therefore (x+)(x ) = (modm). Therefore both x +andx havecommonfactorswithm (except in the trivial case x =,andsolongasneitherisamultipleofm). Now pick an a that is coprime (relatively prime) to M. Ifa r =(modm) and r happens to be even, we re done (since we can find a factor of M as explained above). (The smallest such r is called the order of a.) This r is the period of a x (mod M), since a x+r = a x a r = a x (mod M). In summary, if we can find the order of an appropriate a and it is even, then we can probably factor the number. To accomplish this, we need to find the period of a x (mod M), which can be determined through a Fourier transform. Like the classical Fourier transform, the quantum Fourier transform puts all the amplitude of the function into multiples of the frequency (reciprocal period). Therefore, measuring the state yields the period with high probability. These section is based primarily on Rie el & Polak ().

13 36 CHAPTER III. QUANTUM COMPUTATION D.3.a Quantum Fourier transform Before explaining Shor s algorithm, it s necessary to explain the quantum Fourier transform, and to do so it s helpful to begin with a review of the classical Fourier transform. Let f be a function defined on [, ). We know it can be represented as afourierseries, f(x) = a + (a k cos kx + b k sin kx) = A + A k cos(kx + k ), k= where k =,,,...represents the overtone series (natural number multiples of the fundamental frequency). You know also that the Fourier transform can be represented in the ciscoid (cosine + i sine) basis, where we define u k (x) def =cis( kx) =e ikx.(the signisirrelevant,butwillbeconvenient later.) The u k are orthogonal but not normalized, so we divide them by, since R cos x +sin x dx =. The Fourier series in this basis is f(x) = P ˆf k= k cis( kx). The Fourier coe cients are given by ˆf k = hu k R fi = e ikx f(x)dx. Theygivetheamplitudeandphaseofthecomponent signals u k. For the discrete Fourier transform (DFT) we suppose that f is represented by N samples, f j = f(x j ), where x j = j def def, with j N = N {,,...,N }. Let f =(f,...,f N ) T. Note that the x j are the /N segments of a circle. (Realistically, N is big.) Likewise each of the basis functions is represented by a vector of N samples: u k =(u k,,...,u k,n ) T.Thuswehaveamatrixofallthebasissam- def ples: def u kj =cis( kx j )=e ikj/n,jn. In e ikj/n,notethat i represents a full cycle, k is the overtone, and j/n represents the fraction of a full cycle. Recall that every complex number has N principal N th -roots, and in particular the number (unity) has N principal N th -roots. Notice that N samples of the fundamental period correspond to the N principal N th -roots of unity, that is,! j where (for a particular N)! = e i/n. Hence, u kj =! kj. That is, u k =(! k,! k...,! k (N ) ) T.Itiseasytoshowthatthevectors u k are orthogonal, and in fact that u k / p N are ON (exercise). Therefore, f k=

14 D. QUANTUM ALGORITHMS 37 can be represented by a Fourier series, f = p N kn ˆf k u k = N (u k f)u k. kn Define the discrete Fourier transform of the vector f, ˆf =Ff, tobethe vector of Fourier coe cients, ˆfk = u k f/p N.DetermineFasfollows: ˆf = Therefore let F def = p N ˆf ˆf. ˆf N u u. u N C A = p B C A = p N u f u f u N. f C A = p B u u. u N C A f.!! (N! )!! (N! )!! (N )!......! (N )! (N )! (N ) (N ) (III.5) That is, F kj = u kj / p N =! kj / p N for k, j N. Note that the signsin the complex exponentials were eliminated by the conjugate transpose. F is unitary transformation (exercise). The fast Fourier transform (FFT) reduces the number of operations required from O(N )too(nlog N). It does this with a recursive algorithm that avoids recomputing values. However, it is restricted to powers of two, N = n. The quantum Fourier transform (QFT) is even faster, O(log N), that is, O(n ). However, because the spectrum is encoded in the amplitudes of the quantum state, we cannot get them all. Like the FFT, the QFT is restricted to powers of two, N = n. The QFT transforms the amplitudes of a quantum state: U QFT jn f j ji = kn ˆf k ki,. C A The FFT is O(N log N), but N>M = e m. Therefore the FFT is O(M log M )= O(M log M) =O(me m )

15 38 CHAPTER III. QUANTUM COMPUTATION def where ˆf =Ff. Suppose f has period r, andsupposethattheperiodevenlydividesthe number of samples, r N. Thenalltheamplitudeofˆf should be at multiples of its fundamental frequency, N/r. If r 6 N, thentheamplitudewillbe concentrated near multiples of N/r. Theapproximationisimprovedbyusing larger n. The FFT (and QFT) are implemented in terms of additions and multiplications by various roots of unity (powers of!). In QFT, these are phase shifts. In fact, the QFT can be implemented with n(n + )/ gatesoftwo types: () One is H j, the Hadamard transformation of the jth qubit. () The other is a controlled phase-shift S j,k,whichusesqubitx j to control whether it does a particular phase shift on the i component of qubit x k. That is, S j,k x j x k i 7! x j x ki is defined by S j,k def = ih + ih + ih + e i k j ih, where k j = / k j.thatis,thephaseshiftdependsontheindicesjand k. It can be shown that the QFT can be defined: This is O(n )gates. ny ny U QFT = H j j= k=j+ S j,k. D.3.b Shor s algorithm step by step Shor s algorithm depends on many results from number theory, which are outside of the scope of this course. Since this is not a course in cryptography or number theory, I will just illustrate the ideas. algorithm Shor: See Rie el & Polak () for this, with a detailed explanation in Nielsen & Chuang (, 5., pp. 57 ).

16 D. QUANTUM ALGORITHMS 39 Input: Suppose we are factoring M (and M =willbeusedforconcrete examples, but of course the goal is to factor very large numbers). Let m def = dlg Me =5inthecaseM =. Step : Pick a random number a<m.ifa and M are not coprime (relatively prime), we are done. (Euclid s algorithm is O(m )=O(log M).) For our example, suppose we pick a =, which is relatively prime with. Modular exponentiation: Let g(x) def = a x (mod M), for x M def = {,,...,M }. This takes O(m 3 )gatesandisthemostcomplexpart of the algorithm! (Reversible circuits typically use m 3 gates for m qubits.) In our example case, g(x) = x (mod ), so g(x) =,, 6, 8, 4,,,, 6, 8, 4,... {z } period In order to get a good QFT approximation, pick n such that M apple n < M. Let N def = n. Equivalently, pick n such that lg M apple n<lgm +, that is, roughly twice as many qubits as in M. Note that although the number of samples is N = n,weneedonlyn qubits (thanks to the tensor product). This is where quantum computation gets its speedup over classical computation; M is very large, so N>M is extremely large. The QFT computes all these in parallel. For our example M =,andsowepickn =9for N =5since44apple5 < 88. Therefore m =5. Step (quantum parallelism): Apply U g to the superposition i def = H n i n = p xi N to get xn i def = U g i i m = p N xn x, g(x)i. For our example problem, 4 qubits are required [n =9forx and m =5for g(x)]. The quantum state looks like this (note the periodicity): i = p 5 (, i +, i +, 6i + 3, 8i + 4, 4i + 5, i +

17 4 CHAPTER III. QUANTUM COMPUTATION 6, i + 7, i + 8, 6i + 9, 8i +, 4i +, i + ) Step 3 (measurement): The function g has a period r, whichwewant to transfer to the amplitudes of the state so that we can apply the QFT. This is accomplished by measuring (and discarding) the result register (as in Simon s algorithm). 3 Suppose the result register collapses into state g (e.g., g = 8). The input register will collapse into a superposition of all x such that g(x) =g. We can write it: where i def = Z xn s.t. g(x)=g x, g i = Z f x def = " f x x, g i = xn, if g(x) =g, otherwise, Z # f x xi g i, xn and Z def = p {x g(x) =g } is a normalization factor. For example, i = ( 3, 8i + 9, 8i + 5, 8i + ) Z = ( 3i + 9i + 5i + ) 8i Z Note that the values x for which f x 6=di erfromeachotherbytheperiod; This produces a function f of very strong periodicity. As in Simon s algorithm, if we could measure two such x, wewouldhaveusefulinformation, but we can t. Suppose we measure the result register and get g = 8. Fig. III.4 shows the corresponding f =(,,,,,,,,,,,,...). Step 4 (QFT): Apply the QFT to obtain,! def 3 i = U QFT f x xi Z xn = ˆfˆx ˆxi. Z ˆxN 3 As it turns out, this measurement of the result register can be avoided. This is in general true for internal measurement processes in quantum algorithms (Bernstein & Vazirani 997).

18 D. QUANTUM ALGORITHMS 6 4 E. Rieffel and W. Polak. 6.8 E. Rieffel and W. Polak P. Fig.. Probabilities for measuring x when probability measuring the state distribution C x, 8 obtained, where x Figure III.4: Example fx in Stepfor state x mod = 8}} P = {x. Z In8this example is r =448 6 (e.g., at the period xnfx x, 8i. x = 3, 9, 5,...). [fig. source: Rie el & Polak ()] P.7 Fig.. Probabilities for measuring x when measuring the state C x.53 x mod = 8}} = {x x, 8 obtained in Step, where Fig. 3. Probability distribution of the quantum state after Fourier Transformation where the amplitude is except at multiples of m /r. When the period r does not divide m, the transform approximates the of exact case so most of the amplitude is attached to Fig. 3. Probabilityprobability distribution thedistribution quantum state after Fourier Transformation. m Figure III.5: fˆx of the quantum Fourier integers close toexample multiples of r. transform f. The spectrum is applying concentrated nearfourier multiples of ton/6 Example.ofFigure 3 shows the result of the quantum Transform the = m where the amplitude is except at multiples of /r. When the period r does not divide 5/6 = 85 /3, is that 85 Figure /3, 7 /3, 56, etc.fast [fig. source: state obtained in Stepthat. Note 3 is the graph of the Fourier transformrie el of the & m function, the transform approximates exact case so most the amplitude is attached shown in Figure. Inmthisthe particular example the of period of f does not divide mto. Polak ()] integers close to multiples of r. Step 4. Extracting the period. Measure the state in the standard basis for quantum comexample. 3 shows theinresult of applying theperiod quantum Fourier putation, andfigure call the result v. the case where the happens to Transform be a powertoofthe, m state obtained in StepFourier. Notetransform that Figure 3 isexactly the graph of the fast transform the so that the quantum gives multiples of Fourier /r, the period isofeasy m function shown in Figure particular example the period of f does not divide m. to extract. In this case, v.=inj this r for some j. Most of the time j and r will be relatively Step 4. Extracting the period. Measure the state in the standard basis for quantum computation, and call the result v. In the case where the period happens to be a power of, so that the quantum Fourier transform gives exactly multiples of m /r, the period is easy m to extract. In this case, v = j r for some j. Most of the time j and r will be relatively

19 4 CHAPTER III. QUANTUM COMPUTATION (The collapsed result register g i has been omitted.) If the period r divides N = n,thenˆf will be nonzero only at multiples of the fundamental frequency N/r. Thatis,thenonzerocomponentswillbe kn/ri. If it doesn t divide evenly, then the amplitude will be concentrated around these kn/ri. See Fig. III.4 and Fig. III.5 for examples of the probability distributions f x and ˆfˆx. Step 5 (period extraction): Measure the state in the computational basis. Period a power of : If r N, thentheresultingstatewillbev def = kn/ri for some k N. Thereforek/r = v/n. Ifk and r are relatively prime, as is likely, then reducing the fraction v/n to lowest terms will produce r in the denominator. In this case the period is discovered. Period not a power of : In the case r does not divide N, it softenpossible to guess the period from a continued fraction expansion of v/n. 4 If v/n is su ciently close to p/q, thenacontinuedfractionexpansionofv/n will contain the continued fraction expansion of p/q. Forexample, suppose the measurement returns v = 47, which is not a power of two. This is the result of the continued fraction expansion of v/n (in this case, 47/5) (see IQC): i a i p i q i i which terminates with 6 = q <Mapple q 3. Thus, q =6islikelytobethe period of f. [IQC] Step 6 (finding a factor): The following computation applies however we 4 See Rie el & Polak (, App. B) for an explanation of this procedure and citations for why it works.

20 D. QUANTUM ALGORITHMS 43 got the period q in Step 5. If the guess q is even, then a q/ +anda q/ are likely to have common factors with M. Use the Euclidean algorithm to check this. The reason is as follows. If q is the period of g(x) =a x (mod M), then a q =(modm). This is because, if q is the period, then for all x, g(x + q) =g(x), that is, a q+x = a q a x = a x (mod M) forallx. Therefore a q =(modm). Hence, (a q/ +)(a q/ ) = (mod M). Therefore, unless one of the factors is a multiple of M (and hence = mod M), one of them has a nontrivial common factor with M. In the case of our example, the continued fraction gave us a guess q =6,so with a =weshouldconsider 3 + = 33 and 3 =33. ForM = the Euclidean algorithm yields gcd(, 33) = 3 and gcd(, 33) = 7. We ve factored! Iteration: There are several reasons that the preceding steps might not have succeeded: () The value v projected from the spectrum might not be close enough to a multiple of N/r (D.3.b). () In D.3.b, k and r might not be relatively prime, so that the denominator is only a factor of the period, but not the period itself. (3) In D.3.b, one of the two factors turns out to be a multiple of M. (4)InD.3.b,q was odd. In these cases, a few repetitions of the preceding steps yields a factor of M. D.3.c Recent progress To read our , how mean of the spies and their quantum machine; be comforted though, they do not yet know how to factorize twelve or fifteen. Volker Strassen (Nielsen & Chuang,, p. 6) In this section we review recent progress in hardware implementation of

21 44 CHAPTER III. QUANTUM COMPUTATION Figure III.6: Hardware implementation of Shor s algorithm developed at UCSB (). The Mj are quantum memory elements, B is a quantum bus, and the Qj are phase qubits that can be used to implement qubit operations between the bus and memory elements. [source: CPF] Figure III.7: Circuit of hardware implementation of Shor s algorithm developed at UCSB. [source: CPF]

22 D. QUANTUM ALGORITHMS 45 Shor s algorithm. 5 In Aug. a group at UC Santa Barbara described aquantumimplementationofshor salgorithmthatcorrectlyfactored5 about 48% of the time (5% being the theoretical success rate). (There have been NMR hardware factorizations of 5 since, but there is some doubt if entanglement was involved.) This is a 3-qubit compiled version of Shor s algorithm, where compiled means that the implementation of modular exponentiation is for fixed M and a. This compiled version used a =4asthe coprime to M =5. Inthiscasethecorrectperiodr =. The device (Fig. III.6) has nine quantum devices, including four phase qubits and five superconducing co-planar waveguide (CPW) microwave resonators. The four CPWs (M j )canbeusedasmemoryelementsandfifth(b)canbeusedasa bus to mediate entangling operations. In e ect the qubits Q j can be read and written. Radio frequency pulses in the bias coil can be used to adjust the qubit s frequency, and gigahertz pulses can be used to manipulate and measure the qubit s state. SQUIDs are used for one-shot readout of the qubits. The qubits Q j can be tuned into resonance with the bus B or memory elements M j. The quantum processor can be used to implement the single-qubit gates, Y, Z, H, and the two-qubit swap (iswap) and controlled-phase (C ) gates. The entanglement protocol can be scaled to an arbitrary number of qubits. The relaxation and dephasing times are about ns. Another group has reported the quantum factoring of. 6 Their procedure operates by using one qubit instead of the n qubits in the (upper) control qubits. It does this by doing all the unitaries associated with the lowest-order control qubit, then for the next control qubit, updating the work register after each step, for n interations. 5 This section is based primarily on Erik Lucero, R. Barends, Y. Chen, J. Kelly, M. Mariantoni, A. Megrant, P. O Malley, D. Sank, A. Vainsencher, J. Wenner, T. White, Y. Yin, A. N. Cleland & John M. Martinis, Computing prime factors with a Josephson phase qubit quantum processor. Nature Physics 8, () doi:.38/nphys385 [CPF]. 6 See Martin-Lópex et al., Experimental realization of Shor s quantum factoring algorithm using qubit recycling, Nature Photonics 6, ().

23 46 CHAPTER III. QUANTUM COMPUTATION D.4 Search problems D.4.a Overview Many problems can be formulated as search problems over a solution space S. 7 That is, find the x Ssuch that some predicate P (x) istrue. For example, hard problems such as the Hamiltonian path problem and Boolean satisfiability can be formulated this way. An unstructured search problem is a problem that makes no assumptions about the structure of the search space, or for which there is no known way to make use of it (also called a needle in a haystack problem). That is, information about a particular value P (x )doesnotgiveususableinformationaboutanothervaluep(x ). In contrast, a structured search problem is a problem in which the structure of the solution space can be used to guide the search, for example, searching an alphabetized array. In general, unstructured search takes O(M) evaluations, where M = S is the size of the solution space (which is often exponential in the size of the problem). On the average it will be M/ (thinkofsearching an unordered array) to find a solution with 5% probability. We will see that Grover s algorithm can do unstructured search on a quantum computer with bounded probability in O( p M)time,thatis,quadratic speedup. This is provably more e cient than any algorithm on a classical computer, which is good (but not great). Unfortunately, it has been proved that Grover s algorithm is optimal for unstructured search. Therefore, to do better requires exploiting the structure of the solution space. Quantum computers do not exempt us from understanding the problems we are trying to solve! Shor s algorithm is an excellent example of exploiting the structure of a problem domain. Later we will take a look at heuristic quantum search algorithms that do make use of problem structure. D.4.b Grover s Algorithm algorithm Grover: Input: Let M be the size of the solution space and pick n such that n M. 7 This section is based primarily on Rie el & Polak ().

24 measurement has projected the state of Eq. onto the subspace Pki= xi, i where xi, i where measurement has projected the state of Eq. onto the subspace kk i= k is the number of solutions. Further measurement of the remaining bits will provide one kofisthese the number of solutions. Further measurement of the remaining bits will provide one solutions. If the measurement of qubit P (x) yields, then the whole process is of theseover solutions. the measurement P (x) yields, then the whole process is started and theifsuperposition of Eq.of qubit must be computed again. started over algorithm and the superposition must be computed Grover s then consistsofofeq. thefollowing steps: again. Grover s algorithm then consists of the following steps: () Prepare a register containing a superposition of all possible values xi [... n ]. () Prepare a register containing a superposition of all possible values xi [... n ]. () Compute P (xi ) on this register. () Compute P (xi ) on this register. (3) Change amplitude aj to aj for xj such that P (xj ) =. An efficient algorithm for (3) QUANTUM Change aj to is adescribed that P 7... (xj ) =A.plot Anof efficient algorithmafter for j for xj such D. ALGORITHMS changingamplitude selected signs in section the amplitudes changing selected signs is described in section 7... A plot of the amplitudes after this step is shown here. this step is shown here. average 47 average (4) Apply inversion about the average to increase amplitude of xj with P (xj ) =. The (4) Apply inversion about the of average to increase of with P is (xgiven The Figure III.8: Depiction theperform result of amplitude phase rotation (changing j ) =. quantum algorithm to efficiently inversion about thexjaverage inthe sec-sign) quantum algorithm to efficiently perform inversion about the average is given in secof solutions Grover s algorithm. [source: & amplitude Polak ()] tion 7...inThe resulting amplitudes look as shown,rie el where the of all the xi s tion amplitudes look as shown, where the amplitude of all the xi s with7... P (xi )The = resulting have been diminished imperceptibly. with P (xi ) = have been diminished imperceptibly. average average p (5) Repeat steps through 4 4 p n times. (5) Repeat steps through 4 4 n times. (6) Read the result. Figure III.9: Depiction of result of inversion about the mean in Grover s (6) Read the result. Boyer et.al.[source: [Boyer et Rie el al. 996] & provide a detailed analysis of the performance of Grover s algorithm. Polak ()] Boyer et.al. [Boyer al. 996] provide a detailed analysis performance of no Grover s algorithm. They proveetthat Grover s algorithm is optimal upoftothe a constant factor; quanalgorithm. They prove that Grover s algorithm is optimal up to a constant factor; no quantum algorithm can perform an unstructured search p faster. They also show that if there is tum perform an )unstructured search faster. n They also show that if there is onlyalgorithm a single xcan such that P (x is true, then after 8 p iterations of steps through 4 the n iterations of steps through 4 the p then after def nx such that P (x def ) is onlyna single n times Let = is.5. andafter let N = n4true, ={,,..the.,8failure N }, setto of strings. We p ratethe drops nn-bit. Interestingly, failure rate iterating n times the failure rate drops to p n. Interestingly, failure rate is.5. After iterating n 4 are given iterations a computable predicate P rate. : N For! example,. Suppose a quantum p have additional will increase the failure after we iterations the additional will increase the failure rate. For example, after n iterations the failure rateiterations isuclose to. gate array (an oracle) that computes the predicate: P failure rate close to. algorithms in which a procedure is repeated over and over again There areismany classical There are many classical algorithms in which a procedure is repeated overfor anda over again for ever better results. Repeating quantum procedures may improve results while, but = x, y may P (x)i. P x, yi procedures for ever better results. RepeatingUquantum improve results for a while, but Application: Consider what happens if, as usual, we apply the function to a superposition of all possible inputs i: " # UP i i = UP p x, i = p x, P (x)i. N xn N xn Notice that the components we want, x, i, and the components we don t want, x, i, all have the same amplitude, pn. So if we measure the state, the chances of getting a hit are very small, O( n ). The trick, therefore, is to amplify the components that we want at the expense of the ones we don t want; this is what Grover s algorithm accomplishes.

25 48 CHAPTER III. QUANTUM COMPUTATION Sign-change: To do this, first we change the sign of every solution (a phase rotation of ). That is, if the state is P j a j x j,p(x j )i, thenwewantto change a j to a j whenever P (x j ) =. See Fig. III.8. I ll get to the technique in a moment. Inversion about mean: Next, we invert all the components around their mean amplitude (which is a little less than the amplitudes of the nonsolutions); the result is shown in Fig. III.9. As a result of this operation, amplitudes of non-solutions go from a little above the mean to a little below it, but amplitudes of solutions go from far below the mean to far above it. This amplifies the solutions. Iteration: This Grover iteration (the sign change and inversion about the mean) is repeated p N 4 times. Thus the algorithm is O( p N). Measurement: Measurement yields an x for which P (x )=withhigh probability. Specifically, if there is exactly one solution x S,then p N 8 iterations will yield it with probability /. With p N iterations, the probability of failure drops to /N = n. Unlike with most classical algorithms, 4 additional iterations will give a worse result! This is because Grover iterations are unitary rotations, and so excessive rotations can rotate past the solution. Therefore it is critical to know when to stop. Fortunately there is a quantum technique (Brassard et al. 998) for determining the optimal stopping point. Grover s iteration can be used for a wide variety of problems as a part of other quantum algorithms. In the following geometric analysis, I will suppose that there is just one answer such that P ( ) =;then i is the desired answer vector. Let!i be a uniform superposition of all the other (non-answer) states, and observe that i and!i are orthonormal. Therefore, initially the state is i = p N i + q N N!i. In general, after k iterations the state is ki =

26 D. QUANTUM ALGORITHMS 49 â â Figure III.3: Process of inversion about the mean in Grover s algorithm. The black lines represent the original amplitudes a j.theredlinesrepresent ā a j,withthearrowheadsindicatingthenewamplitudesa j. a i + w!i, forsomea, w with a + w =. The sign change operation transforms the state as follows: k i = a i + w!i 7! a i + w!i = ki, where I ve called the result k i. This is a reflection across the!i vector, which means that it will be useful to look at reflections more generally. Suppose that i and? i are orthonormal vectors and that i = a? i+ b i is an arbitrary vector in the space they span. The reflection of i across i is i = a? i + b i. Since a = h? i and b = h i, weknow i = ih i +? ih? i, and you can see that i = ih i? ih? i. Hence the operator to reflect across i is R def = ih? ih?. Alternate forms of this operator are ih I and I? ih?, that is, subtract twice the perpendicular component. The sign change can be expressed as a reflection: R! =!ih! ih = I ih, which expresses the sign-change of the answer vector clearly. Of course we don t know i, which is why we will have to use a di erent process to accomplish this reflection (see p. 5). We also will see that the inversion about the mean is equivalent to reflecting that state vector across i. But first, taking this for granted, let s see the e ect of the Grover iteration (Fig. III.3). Let be the angle between i and!i. It sgivenbytheinner

27 5 CHAPTER III. QUANTUM COMPUTATION α ψ θ θ θ ψ ω ψ' Figure III.3: Geometry of first Grover iteration. q product cos = h!i = N. Therefore the sign change reflects N i from above!i into i, whichis below it. Inversion about the mean reflects i from below i into a state we call i,whichis above it. Therefore, in going from i to i the state vector has rotated closer to i. You can see that after k iterations, the state vector k i will be (k +) above!i. We can solve (k +) = / to get the required number of iterations to bring k i to i. Note that for small, sin = p N (which is certainly small). Hence, we want (k +)/ p N /, or k + p N/. That is, k p N/4 is the required number of iterations. Note that after p N/8iterations,weareabouthalfwaythere(i.e., /4), so the probability of success is 5%. In general, the probability of success is about sin k+ p N. Now for the techniques for changing the sign and inversion about the mean. Let k i be the state after k iterations (k ). To change the sign, simply apply U P to k i i. Toseetheresult,let = {x P (x) =} and = {x P (x) =}, thesolutionset.then: U P k i i = U P " xn a x x, i #

28 D. QUANTUM ALGORITHMS 5 " = U P p a x x, i xn a x x, i = p U P " x a x x, i + x a x x, i = p " x a x U P x, i + x a x U P x, i x a x U P x, i # x a x U P x, i = p " x a x x, i + x a x x, i x a x x, i x a x x, = p " x a x xi i + x a x xi i! = p a x xi a x xi ( i x x! = a x xi a x xi i. x x x a x x, i # i # x a x xi i i) x a x x, i x a x xi i # # Therefore the signs of the solutions have been reversed (they have been rotated by ). Notice how i in the target register can be used to separate the and results by rotation. This is a useful idea! It remains to show the connection between inversion about the mean and reflection across i. This reflection is given by R = ih I. Note that: ih = p N xi!! p hy = N N xih y. xn yn xn yn

29 5 CHAPTER III. QUANTUM COMPUTATION This is the di usion matrix: N N. N N N N N..... N N C A, which, as we will see, does the averaging. To perform inversion about the mean, let ā be the average of the a j (see Fig. III.3). Inversion about the mean is accomplished by the transformation: jn a j x j i 7! jn (ā a j ) x j i. To see this, write a j =ā ± j,thatis,asadi erencefromthemean. Then ā a j =ā (ā ± j )=ā j. Therefore an amplitude j below the mean will be transformed to j above, and vice verse. But an amplitude that is negative, and thus very far below the mean, will be transformed to an amplitude much above the mean. This is exactly what we want in order to amplify the negative components, which correspond to solutions. Inversion about the mean is accomplished by a Grover di usion transformation D. ToderivethematrixD, considerthenewamplitudea j as a function of all the others:! N a def j =ā a j = a k a j = N N a k + N a j. k= k6=j This matrix has onthemaindiagonaland in the o -diagonal N N elements: N N N N N N D = C.. A. N N N Note that D = ih I = R.ItiseasytoconfirmthatDD = I (Exer. III.49), so the matrix is unitary and therefore a possible quantum operation, but it remains to be seen if it can be implemented e ciently.

30 D. QUANTUM ALGORITHMS 53 Figure III.3: Circuit for Grover s algorithm. The Grover iteration in the dashed box is repeated p N 4 times. We claim D = WRW,whereW = H n is the n-qubit Walsh-Hadamard transform and R is the phase rotation matrix: R def = C.. A. To see this, let R def = R + I = C.. A. Then WRW = W (R I)W = WR W WW = WR W I. Itiseasyto show (Exer. III.5) that: N N N WR W = N. N N N..... N N C A. It therefore follows that D = WR W diagram of Grover s algorithm. I = WRW. See Fig. III.3 for a

31 54 CHAPTER III. QUANTUM COMPUTATION It remains to consider the possibility that there may be several solutions to the problem. If there are s solutions, then run the Grover iteration p N/s 4 times, which is optimal (Exer. III.5). It can be done in p N/s iterations even if s is unknown. D.4.c Hogg s heuristic search algorithms Many important problems can be formulated as constraint satisfaction problems, inwhichwetrytofindasetofassignmentstovariablesthatsatisfy specified constraints. MorespecificallyletV def = {v,...,v n } be a set of variables, and let def = {x,...,x n } be a set of values that can be assigned to the variables, and let C,...,C l be the constraints. The set of all possible assignments of values to variables is V. Subsets of this set correspond to full or partial assignments, including inconsistent assignments. The set of all such assignments is P(V ). The sets of assignments form a lattice under the partial order (Fig. III.33). By assigning bits to the elements of V, elementsofp(v ) can be represented by mn-element bit strings (i.e., integers in the set MN = {,..., mn }); see Fig. III.34. Hogg s algorithms are based on the observation that if an assignment violates the constraints, then so do all those assignments above it in the lattice. algorithm Hogg: Initialization: The algorithm begins with all the amplitude concentrated in the bottom of the lattice, i (i.e., the empty set of assignments). Movement: The algorithm proceeds by moving amplitude up the lattice, while avoiding assignments that violate the constraints; that is, we want to move amplitude from a set to its supersets. For example, we want to redistribute the amplitude from i to i and i. Hogg has developed several methods. One method is based on the assumption that the transformation has the form WDW,whereW = H mn,themn-dimensional Walsh-Hadamard transformation, and D is diagonal. The elements of D

32 D. QUANTUM ALGORITHMS 55 Introduction to Quantum Computing 8 < v = v = v : = v = v = v = v = v = v = v = v = v = v = v = v = v = v = v = v = v = v = v = v = v = v = v = v = v = {v =} {v =} {v =} {v =} Figure III.33: Lattice of variable assignments. [source: Rie el & Polak ()]

33 56 CHAPTER III. QUANTUM COMPUTATION Figure III.34: Lattice of binary strings corresponding to all subsets of a 4- element set. [source: Rie el & Polak ()] depend on the size of the sets. W xi = p mn Recall (D..b, p. 9) that zmn ( ) x z zi. As shown in Sec. A..c (p. 7), we can derive a matrix representation for W : W jk = hj W ki = hj p ( ) k z zi mn = = p mn zmn zmn p mn ( )k j. ( ) k z hj zi Note that k j = k \ j, whereontheright-handsideweinterpretthebit strings as sets.

34 D. QUANTUM ALGORITHMS 57 The general approach is to try to steer amplitude away from sets that violate the constraints, but the best technique depends on the particular problem. One technique is to invert the phase on bad subsets so that they tend to cancel the contribution of good subsets to supersets. This could be done by a process like Grover s algorithm using a predicate that tests for violation of constraints. Another approach is to assign random phases to bad sets. It is di cult to analyze the probability that an iteration of a heuristic algorithm will produce a solution, and so its e ciency is usually evaluated empirically, but empirical tests will be di cult to apply to quantum heuristic search until larger quantum computers are available, since classical computers require exponential time to simulate quantum systems. Small simulations, however, indicate that Hogg s algorithms may provide polynomial speedup over Grover s algorithm.

35 58 CHAPTER III. QUANTUM COMPUTATION Figure III.35: E ects of decoherence on a qubit. On the left is a qubit yi that is mostly isoloated from its environment i. Ontheright,aweakinteraction between the qubit and the environment has led to a possibly altered qubit xi and a correspondingly (slightly) altered environment xy i. D.5 Quantum error correction D.5.a Motivation Quantum coherence is very di cult to maintain for long. 8 Even weak interactions with the environment can a ect the quantum state, and we ve seen that the amplitudes of the quantum state are critical to quantum algorithms. On classical computers, bits are represented by very large numbers of particles (but that is changing). On quantum computers, qubits are represented by atomic-scale states or objects (photons, nuclear spins, electrons, trapped ions, etc.). They are very likely to become entangled with computationally irrelevant states of the computer and its environment, which are out of our control. Quantum error correction is similar to classical error correction in that additional bits are introduced, creating redundancy that can be used to correct errors. It is di erent from classical error correction in that: (a) We want to restore the entire quantum state (i.e., the continuous amplitudes), not just s and s. Further, errors are continuous and can accumulate. (b) It must obey the no-cloning theorem. (c) Measurement destroys quantum information. 8 This section follows Rie el & Polak ().

36 D. QUANTUM ALGORITHMS 59 D.5.b Effect of decoherence Ideally the environment i, consideredasaquantumsystem,doesnotinteract with the computational state. But if it does, the e ect can be categorized as a unitary transformation on the environment-qubit system. Consider decoherence operator D describing a bit flip error in a single qubit (Fig. III.35): i i =) i i + D : i i i i =) i i + i i. In this notation the state vectors xy i are not normalized, but incorporate the amplitudes of the various outcomes. In the case of no error, i = i = i and i = i =. Iftheentanglementwiththeenvironment is small, then k k, k k (smallexchangeofamplitude). Define decoherence operators D xy i def = xy i,forx, y, whichdescribe the e ect of the decoherence on the environment. (These are not unitary, but are the products of scalar amplitudes and unitary operators for the various outcomes.) Then the evolution of the joint system is defined by the equations: Alternately, we can define it: D i i = (D I + D ) i i, D i i = (D + D I) i i. D = D ih + D ih + D ih + D ih. Now, it s easy to show (Exer. III.9): ih = (I + Z), ih = ( Y ), ih = ( + Y ), ih = (I Z), where Y =.Therefore D = [D (I + Z)+D ( Y )+ D ( + Y )+D (I Z)] = [(D + D ) I +(D + D ) + (D D ) Y +(D D ) Z].

37 6 CHAPTER III. QUANTUM COMPUTATION Therefore the bit flip error can be described as a linear combination of the Pauli matrices. It is generally the case that the e ect of decoherence on a single qubit can be described by a linear combination of the Pauli matrices, which is important, since qubits are subject to various errors beside bit flips. This is a distinctive feature about quantum errors: they have a finite basis, and because they are unitary, they are therefore invertible. In other words, single-qubit errors can be characterized in terms of a linear combination of the Pauli matrices (which span the space of self-adjointunitary matrices: C..a, p. 5): I (no error), (bit flip error), Y (phase error), and Z = Y (bit flip phase error). Therefore a single qubit error is represented by e +e +e +e 3 3 = P 3 j= e j j, wherethe j are the Pauli matrices (Sec. C..a, p. 5). D.5.c Correcting the quantum state We consider a basis set of unitary error operators E j,sothattheerror transformation is a superposition E def = P j e je j. In the more general case of quantum registers, the E j a ect the entire register, not just a single qubit. algorithm quantum error correction: Encoding: An n-bit register is encoded in n + m bits, where the extra bits are used for error correction. Let y def = C(x) m+n be the n + m bit code for x n. As in classical error correcting codes, we embed the message in aspaceofhigherdimension. Error process: Suppose ỹ m+n is the result of error type k, ỹ = E k (y). Syndrome: Let k = S(ỹ) beafunctionthatdeterminestheerrorsyndrome, which identifies the error E k from the corrupted code. That is, S(E k (y)) = k. Correction: Since the errors are unitary, and the syndrome is known, we can invert the error and thereby correct it: y = E S(ỹ) (ỹ).

38 D. QUANTUM ALGORITHMS 6 Figure III.36: Circuit for quantum error correction. i is the n-qubit quantum state to be encoded by C, whichaddsm error-correction qubits to yield the encoded state i. E is a unitary superposition of error operators E j, which alter the quantum state to i. S is the syndrome extraction operator, which computes a superposition of codes for the errors E. The syndrome register is measured, to yield a particular syndrome code j,whichisusedto select a corresponding inverse error transformation E j to correct the error. Quantum case: Now consider the quantum case, in which the state i is a superposition of basis vectors, and the error is a superposition of error types, E = P j e je j. This is an orthogonal decomposition of E (see Fig. III.36). Encoding: The encoded state is i def = C i i. Thereareseveralrequirements for a useful quantum error correcting code. Obviously, the codes for orthogonal inputs must be orthogonal; that is, if h i =,thenc, i and C, i are orthogonal: h, C C, i =. Next, if i and i are the codes of distinct inputs, we do not want them to be confused by the error processes, so h E j E k i =foralli, j. Finally, we require that for each pair of error indices j, k, thereisanumberm jk such that h E j E k i = m jk for every code i. This means that the error syndromes are independent of the codes, and therefore the syndromes can be measured without collapsing superpositions in the codes, which would make them useless for quantum computation. def Error process: Let i = E i be the code corrupted by error.