Quantum Computing: Foundations to Frontier Fall 2018

Lecture 4
Lecturer: Henry Yuen Scribes: Deeksha Adil, Xing Hu, Jinhui Li, Fengwei Sun

1 Overview

In the last lecture we were looking at Simon’s algorithm. In this lecture we complete the analysis
of Simon’s algorithm and move on to Quantum Fourier Transform and its applications.

2 Simon’s Algorithm (continued)

Recall that Simon’s algorithm solves the following problem. The input is a function f : {0, 1}n →
{0, 1}n with the property, ∃s 6= 0 such that ∀x, y,
(
x = y, or
f (x) = f (y) ⇐⇒
x = y ⊕ s.

The problem is to find s. Simon’s algorithm outputs s in polynomial time. To solve the problem
classically, any algorithm has to at least find a collision if it has to recover s and for that we need
at least Ω(2n/2 ) queries. Therefore, any classical algorithm requires exponentially many queries to
f to find s. In the last lecture we were analyzing the main subroutine of the algorithm.

2.1 Basic Subroutine

Let us briefly recall the subroutine.

1. Apply the Hadamard operator to each of the first n qubits.

2. Next apply Uf to all 2n qubits.
3. Again apply the Hadamard operator to each of the first n qubits.
4. Finally measure the first n qubits.

In the previous lecture we had seen that after step 3 the state looks like,
!
1 X X
|ψi = n |yi (−1)x·y |f (x)i .
2 y x

Now, it remains to analyse the outcome of measurement. When we measure we get a string
y ∈ {0, 1}n with probability,
2
1 X x·y
P (y) = n (−1) |f (x)i .
2 x

1
Let A denote the image space of the function f i.e., A = {z : ∃x, f (x) = z}. For every x ∈ {0, 1}n ,
there exists x0 = x ⊕ s ∈ {0, 1}n such that f (x) = f (x0 ). Therefore, we have 2n−1 values in the
range of A, i.e., 1/2 × |{0, 1}n |. For every value a ∈ A, let x1 (a), x2 (a) denote the two strings for
which f (x) = a. As a result of the property of the function f , we must have x2 (a) = x1 (a) ⊕ s.
2
1 X 
P (y) = n (−1)x1 (a)·y + (−1)x2 (a)·y |ai
2
a∈A
2
1 X 
= n (−1)x1 (a)·y + (−1)(x1 (a)⊕s)·y |ai
2
a∈A
2
1 X 
= n (−1)x1 (a)·y + (−1)x1 (a) (−1)s·y |ai
2
a∈A
2
1 X
= n (−1)x1 (a)·y (1 + (−1)s·y ) |ai
2
a∈A

Note that, 1 + (−1)s·y = 0 when s · y = 1 mod 2 and 1 + (−1)s·y = 2 otherwise. Using this, we
get,
(
0 if s · y = 1 mod 2
P (y) = 4 P x (a)·y 2
2n a∈A (−1)
1 |ai otherwise
(2
0 if s · y = 1 mod 2
= 4
2n |A| otherwise
(2
0 if s · y = 1 mod 2
= 1
2n−1
otherwise.

There are 2n−1 strings y such that its inner product with s is non zero. When we measure at step
4 of the subroutine we get one such string y uniformly at random.

2.2 The Algorithm

We now look at the main algorithm.

1. Run the basic subroutine m = 100n2 times. This gives us y1 , y2 , ..., ym that satisfy yi · s = 0
mod 2

2. Solve the system of linear equations for s using any standard technique such as Gaussian
Elimination (with arithmetic done modulo 2).

Running the subroutine O(n2 ) times, with high probability we get n − 1 linearly independent
equations and we can easily solve for s.

2
3 Quantum Fourier Transform (QFT)

Simply speaking, Fourier transform is a way to break up functions into simpler pieces (called
frequencies). In quantum computing, the quantum Fourier transform is an algorithm to apply linear
transformation on quantum bits, and is the quantum analogue of the discrete Fourier transform.

3.1 Discrete Fourier Transform

Given n numbers: ψ0 , ψ1 , . . . , ψN −1 ∈ CN . We can interpret ψx as a discrete signal, then

N −1
1 X c −2πikx
ψx = √ ψk e N
N k=0

x = 0, . . . , N − 1
The coefficients {ψ
ck } are called the Fourier coefficients of {ψx } and represents the contributions of
−2πikx −2πikx
each frequency function e N . Let φk (x) = √1N e N (the frequency functions), then φk (x) can
be interpreted as vectors in CN and {φk (x)} form an orthonormal basis.

PN −1 c
Now ψx can be written as ψx = k=0 ψk φk (x).

3.2 Quantum Fourier Transform

In quantum set up, if we are working in n-qubit space, then the Hilbert space is (C2 )⊗n ∼
n
= C2 .
PN −1 P −1 c PN −1 −2πikx
Let N = 2n , |ψi = x=0 ψx |xi. Then |ψi = N √1
k=0 ψk |φk i, where |φk i = N x=0 e
N |xi.
The Fourier transform is simply the change of basis: F : |φk i −→ |ki, which is an unitary operator
s.t.
N
X −1 N
X −1
F |ψi = ck F |φk i =
ψ ck |ki = |ψi
ψ b
k=0 k=0
The quantum Fourier transform (QFT) is an algorithm that implements this unitary F .

Question: Why is this useful?

If we measure |ψi,
b we get outcome |ki with probability |ψ ck |2 . However, we cannot really figure
out ψk because quantum states are fragile: when you measure |ψi, b the quantum state collapses and
the information about ψk ’s disappears. So why is it useful? QFT is useful because it can perform
c
Fourier transform on exponentially long vectors (N = 2n - dimensional vector) by implementing
F with only poly(n)(= polylog(N )) number of gates and ancillas. In other words, it trades off
between the ability to directly access the Fourier coefficients of ψ and the ability to compute (in a
sense) the Fourier transform of an exponentially large vector.

Let FN denote the N × N Fourier transform unitary that does the transformation:
N −1  
1 X 2πikx
FN |xi = √ exp |ki
N k=0 N

3
where x, k are n-bit numbers.
 
1 1 1
F2 = √2 = Hadamard gate
1 −1
   
1 1 1 1 1 1 1 1  
1 i −1 −i  1 −1 i −i  F2 A2 F2
F4 = √14  √1  √1

1 −1 1 −1 → (reordering columns) → 4 
 =
1 1 −1 −1  4 F2 −A2 F2
1 −i −1 i 1 −1 −i i
where we define  
1 0
A2 = .
0 i

For F4 , in the first matrix we wrote, the columns are associated with the basis states |00i, |01i, |10i, |11i
(in that order). If we reorder the columns so that the ones corresponding to basis states |00i and
|10i are on the left, and the columns corresponding to basis states |01i and |11i are on the right,
then we get the matrices on the right. We’re not changing the linear operator, but just reordering
the columns just so it’s evident that F4 has a nice recursive structure.
This recursive structure holds for FN when N = 2n :
" #
1 F N2 AN FN
FN = √ 2 2
N F N −A N F N
2 2 2

where for all M , we define

 
1
 ω2M 
 
2
ω2M
AM =
 

 .. 
 . 
M −1
ω2M
2πi πi
with ω2M = e 2M = e M .
Again, this recursive structure appears if we order the columns so that the “even” columns (columns
corresponding to basis states that end in 0) are on the left, and the “odd” columns are on the right.

3.3 QFT Circuit

Assuming that there’s a circuit for unitaries, F N and A N , the circuit below implements a circuit
2 2
for FN .

4
3.4 Circuit Analysis

Now we will show that the circuit above actually implements the unitary FN . We prove this by
calculating the action of the circuit on all basis states |x1 , . . . , xn i.

Case 1: xn = 0. Let y = (x1 , . . . , xn−1 ) be the (n − 1)-bit prefix of x. Then the states of the
circuit are as follows:

• Beginning: |xi = |x1 , . . . , xn i = |y, 0i

• After applying FN/2 : (FN/2 |yi) ⊗ |0i
• After the controlled AN/2 (which )doesn’t do anything): (FN/2 |yi) ⊗ |0i.

• After applying H on the last qubit: √1 FN/2 |yi ⊗ (|0i + |1i).

2

• After the shift: √1 (|0i + |1i) ⊗ FN/2 |yi

2

Why is this correct?

N/2−1  
1 X 2πijy
FN/2 |yi = p exp |j1 . . . jn−1 i
N/2 N/2
j=0
N/2−1  
1 X 2πij(2y)
=p exp |j1 . . . jn−1 i
N/2 j=0 N
N/2−1  
1 X 2πijx
=p exp |j1 . . . jn−1 i
N/2 N
j=0

The last equality holds because

n
X n−1
X n−1
X
n−i n−i
x= xi 2 = xi 2 =2 xi 2n−i−1 = 2y.
i=1 i=1 i=1

5
Since j is a (n − 1)-bit number, it is interpreted as j = j1 2n−2 + j2 2n−3 + . . . + jn−1 . Plugging this
back in, the final state of the circuit is
N/2−1  
1 X 2πijx
= √ (|0i + |1i) ⊗ exp |j1 . . . jn−1 i
N N
j=0
 
N/2−1   N/2−1  
1 X 2πijx X 2πijx
=√  exp |0, j1 , . . . , jn−1 i + exp |1, j1 , . . . , jn−1 i
N N N
j=0 j=0

Claim: Fix j = (j1 , . . . , jn−1 ). For i = 0, 1 let ki = (i, j1 , . . . , jn−1 ). Then

   
2πijx 2πik0 x
exp = exp obvious because as integers k0 = j
N N
 
2πik1 x
= exp k1 = 2n−1 + j1 2n−2 + . . . + jn−1
N
but notice that
2πi(2n−1 + j)x
   
2πik1 x
exp = exp
N N
n−1
   
2πi2 x 2πijx
= exp exp
N N
n
 
2πi2 y
= exp x = 2y
N
=1
Then we can rewrite our state as
N −1  
1 X 2πikx
√ exp |ki
N k=0 N

which is exactly FN |x1 . . . xn i, as desired.

Case 2: xn = 1. Let y = (x1 , . . . , xn−1 ), and note that x = 2y + 1. Then we have the output of
the circuit being
1
√ (|0i − |1i) ⊗ AN/2 FN/2 |yi
2
Let’s calculate this:
N/2−1  
1 X 2πijy
= √ (|0i − |1i) ⊗ exp AN/2 |j1 . . . jn−1 i
N N/2
j=0
N/2−1  
1 X 2πij(2y + 1) 
j

= √ (|0i − |1i) ⊗ exp |j1 . . . jn−1 i AN/2 |ji = ωN = exp(2πij/N )
N N
j=0
N −1  
1 X 2πikx
=√ exp |ki
N N
k=0
= Fn |xi.

6
4 Implementation of AN

Recall the definition of AN :

 
1 0 0 ... 0
0 ω2N 0 ... 0  2πi
AN =  ..  , where ω2N = e 2N
 
.. 2 .. ..
. . ω2N . . 
N −1
0 0 0 ... ω2N

For any integer 0 ≤ x < 2n , we can write AN |xi = ω2N

x |xi. Since x can also be expressed as the

sum of its binary digits, i.e.

x = x1 2n−1 + x2 2n−2 + · · · + xn ,

We have the following:

x1 2 n−1 +x n−2 +···+x n−1 n−2

22 x1 2 x2 2 xn
AN = ω2N n
|x1 x2 . . . xn i = (ω2N |x1 i) ⊗ (ω2N |x2 i) ⊗ . . . (ω2N |xn i)

We can also rewrite

t 2πi2t 2πi
2
ω2N = e 2·2n = e 2·2n−t = ω2(2n−t )
 
1 0
Let Rθ = . This matrix adds a phase eiπθ if the state is |1i, or nothing if the state is |0i.
0 eπiθ
By substituting a series of Rθ into the previous equation, we get

AN = (R 1 |x1 i) ⊗ (R 1 |x2 i) ⊗ . . . (R2−(n+1) |xn i)

4 8

This leads to the design of our controlled AN/2 unitary (as used in the QFT circuit) as the following:

R1
4

R1
8
.. ..
. .
R2−n
• • •

According to the Solovay-Kitaev Theorem, we can implement each conditional-rotation gate up to

 accuracy very efficiently in terms of our universal gate set.

Question: Unrolling the recursion, how many elementary gates does FN require?

7
Answer: We need O(n) gates for the implementation of AN/2 (which acts on n − 1 qubits), and
then we invoke the circuit for FN/2 (which acts on n − 1 qubits as well). There is also O(n) gates
needed to implement the cyclic shift of qubits at the end. Thus, if we let T (n) denote the number
of gates needed to implement FN , the total number of elementary gates required would be

T (n) = O(n) + T (n − 1) = O(n2 ).

5 Applications of Quantum Fourier Transform

5.1 Phase Estimation

Setup: Consider a unitary operation U on n-qubits.

Fact: the eigenvalues of U are all on the unit circle: e2πiθ . Without loss of generality, we assume
that 0 ≤ θ < 1.
Suppose we are given an eigenvector |ψi of U as a quantum state. It has the eigenvalue e2πiθ , but
θ is not known to us, and it is what we would like to find out.

j
Suppose we are also given the ability to apply controlled U 2 for a range of j’s. In other words, we
are able to run the following quantum circuits:

• • •
U U2 ... U2
j

Using this ability, along with the eigenvector |ψi, we can obtain a good estimate of θ with high
probability.

Assumption: Suppose that θ = 0.θ1 θ2 . . . θt can be represented using exactly t bits. Equivalently,
θ = θ21 + θ42 + · · · + 2θtt . Then the circuit below would be able to solve the Phase Estimation problem:

|0i H •
|0i H •
.. .. ... QF T2−1 ..
. . t
.
|0i H •
|0i H •

|ψi U U2 ... U2
t−2
U2
t−1

Illustration of why it works:

|φ0 i : |0i⊗t ⊗ |ψi

8
 1
|φ1 i : (H|0i)⊗t ⊗ |ψi = (|0i + |1i) ⊗ (|0i + |1i) ⊗ · · · ⊗ (|0i + |1i) ⊗|ψi
2t/2 | {z }
t

1
|φ2 i : (|0i + |1i) ⊗ (|0i + |1i) ⊗ · · · ⊗ (|0i + ei2πθ |1i) ⊗ |ψi
2t/2

..
.

1 t−1 t−2 1 X
|φt+1 i : (|0i+ei2πθ2 |1i)⊗(|0i+ei2πθ2 |1i)⊗· · ·⊗(|0i+ei2πθ |1i)⊗|ψi = ei2πθx |xi|ψi
2t/2 2t/2
x∈{0,1}t

θ1 θ2 θt
As was mentioned above, θ = 2 + 4 + ··· + 2t .

Let θ̃ = 2t θ = 2t ( θ21 + θ2
4 + ··· + θt
2t ) = 2t−1 θ1 + 2t−2 θ2 + · · · + θt . Then we have

1 X x
|φt+1 i = ei2πθ̃ 2t |xi|ψi
2t/2
x∈{0,1}t

Notice that the binary expansion of θ̃ is θ1 θ2 . . . θt . Therefore, applying the inverse Quantum Fourier
Transform gate QF T2−1t to |φt+1 i will give us |θ̃i|ψi. After this step, we have recovered θ in the
output qubits.

Question: What happens when θ is not expressable as t bits?

Answer: We can show that we have got a good approximation to θ, which requires some more
detailed calculations.

5.2 Order Finding

In this lecture, we won’t talk about Shor’s algorithm in full, as there’s a fair amount of details.
Instead, we will illustrate the core quantum part of Shor’s algorithm, which solves the problem of
Order Finding.

Factoring problem: Given N > 0, find a nontrivial factor 1 < p < N such that p divides N.
Using a few tricks from basic number theory, the Factoring problem can be reduced to the problem
of

9
Order finding: Given x, N > 0 such that x < N and gcd(x, N ) = 1, find the order of x in Z∗N ,
i.e. the smallest integer r such that xr = 1 mod N .
There is no known efficient classical algorithm for this problem. However, there exists an efficient
quantum algorithm using Phase Estimation.

Important Note: When we say the algorithm is ”efficient”, it means that the algorithm has to
run in polynomial time of the input size, i.e. poly(log(N )) = poly(n).
Given the input to the Order Finding problem: x, N , we will set up an instance of the Phase
Estimation problem. Let r be the order of x, which is what we want to solve.
Let 2n−1 < N < xn , which means that N can be represented with n bits.
Let U be the n − qubit unitary operator such that for y ∈ 0, 1n ,

(
|xy mod N i 0≤y<N
U |yi =
|yi otherwise

Claim: U is a unitary operator, because y 7→ xy mod N is a one-to-one mapping (since x is

invertible).

Let the eigenvector be

r−1
1 X −2πisk k
|us i = √ exp[ ]|x mod N i where 0 ≤ s < r.
r r
k=0

r−1
1 X −2πisk
U |us i = √ exp[ ]U |xk mod N i
r r
k=0

r−1
1 X −2πisk k+1
=√ exp[ ]|x mod N i
r r
k=0

r−1
2πis 1 X −2πisk k 2πis
= exp[ ]√ exp[ ]|x mod N i = exp[ ]|us i
r r r r
k=0

Thus, the eigenvalue of |us i is exp[ 2πis

r ].
s
This indicates that we can use Phase Estimation to get r and compute r if:

j
1. we can implement the controlled gates U 2 efficiently;

2. we can get our hands on |us i.

10
First, we only need O(n) bits to represent rs , so we can do Phase Estimation on this for t ≈ n. This
n
means that we will need to have the ability to implement controlled U 2 .

n n
U 2 |yi = |xy 2 mod N i

This is a very high power of y, but we can do this efficiently using modular exponentiation: the
idea is to compute smaller powers of y and then combine them while doing mod N . For example,

y8 mod N = (y 4 mod N )2 mod N = ((y 2 mod N )2 mod N )2 mod N

Therefore, we can do this in poly(n) time.

Regarding the access to |us i, we don’t know how to prepare a specific |us i, but we can easily prepare
a superposition of them:

r−1
1 X
√ |us i = |1i
r s=0

If we run the Phase Estimation algorithm and get

r−1
1 X
√ |us i|s/ri
g
r s=0

g is an approximation of s/r. If we measure the second register, we will get θ ≈ s

Here s/r r for a
uniformly random s.

Question: How do we recover r since we just have the binary expansion of rs ?

Answer: We use something called the Continued Fractions algorithm. The point is, we are
looking for a fraction with the smallest numerator and denominator that is close to θ. This will
get us rs with high probability. In the end, this allows us to get r with high probability.

11