Richard Cleve DC 3524 cleve@cs.uwaterloo Course web site at:

Introduction to Quantum Information ProcessingCS 467 / CS 667Phys 467 / Phys 767C&O 481 / C&O 681 Richard Cleve DC 3524 cleve@cs.uwaterloo.ca Course web site at: http://www.cs.uwaterloo.ca/~cleve Lecture 7 (2005)

Contents • Recap of phase estimation problem/algorithm • How the algorithm works for general phases • Recap of the order-finding problem/algorithm • How to bypass the need for an eigenstate

Recap of phase estimation problem/algorithm • How the algorithm works for general phases • Recap of the order-finding problem/algorithm • How to bypass the need for an eigenstate

mqubits Input: black-box for and a copy of  U nqubits Phase estimation problem U is a unitary operation on n qubits  is an eigenvector of U, with eigenvalue e2i (0≤  <1) Output: (m-bit approximation)

0 H 0 H 0 H   U When = 0.a1a2…am : Therefore, applying the inverse of FM yields the digits of  Algorithm for phase estimation

What is the amplitude ofa1a2…am? Arbitrary phases (I) What if is not of the nice form = 0.a1a2…am? Example:= ⅓ = 0.0101010101010101… Let’s calculate what the previously-described procedure does: Let a/2m= 0.a1a2…am be an m-bit approximation of , in the sense that =a/2m+  , where || ≤1/2m+1

State is: e2i2m 1 e2i 1 Arbitrary phases (II) geometric series! The amplitude of y , for y = a is Numerator: Denominator: lower bounded by 2i2m(2/) >42m upper bounded by 2 Therefore, the absolute value of the amplitude of y is at least the quotient of (1/2m)(numerator/denominator), which is 2/

4 2 0000 0001 0010 0011 0100 0101 0110 0111 1000 1001 1010 1011 1000 1101 1110 1111  Arbitrary phases (III) Therefore, the probability of measuring an m-bit approximation of  is always at least 4/2  0.4 For example, when= ⅓ = 0.01010101010101… , the outcome probabilities look roughly like this:

Example: Z21*= {1,2,4,5,8,10,11,13,16,17,19,20} The powers of 10 are: 1, 10, 16, 13, 4, 19, 1, 10, 16, … Therefore,ord21(10) = 6 Order-finding problem Let M be an m-bit integer Def: ZM*= {x  {1,2,…, M1} : gcd(x,M) = 1} (a group) Def: ordM (a) is the minimum r> 0 such that ar=1(mod M) Order-finding problem: given a and M, find ordM (a)

Order-finding algorithm (I) Define:U (an operation on m qubits) as: Uy =ay mod M Define: Then

2nqubits U nqubits Order-finding algorithm (II) corresponds to the mapping: xy xaxy mod M Moreover, this mapping can be implemented with roughly O(n2) gates The phase estimation algorithm yields a2n-bit estimate of1/r From this, a good estimate of r can be calculated by taking the reciprocal, and rounding off to the nearest integer Exercise: why are 2n bits necessary and sufficient for this? Problem: how do we construct state1 to begin with?

Bypassing the need for 1(I) Let Can still uniquely determine k and r, provided they have no common factors (and O(log n) trials suffice for this) Any one of these could be used in the previous procedure, to yield an estimate of k/r, from which r can be extracted What if kis chosen randomly and kept secret?

0 H F†M 0 H 0 H 11+22 U It will be an estimate of 1 with probability |1|2 2 with probability |2|2 Bypassing the need for 1(II) Returning to the phase estimation problem, suppose that 1 and 2 have respective eigenvalues e2i1ande2i2, and that 11 +22 is used in place of an eigenvalue: What will the outcome be?

Is it hard to construct the state ? Bypassing the need for 1(III) Using the state yields results equivalent to choosing a k at random In fact, it’s easy, since This is how the previous requirement for 1 is bypassed

THE END

Richard Cleve DC 3524 cleve@cs.uwaterloo Course web site at: