Computing on Anonymous Quantum Network

Principles of Informatics Research Division, National Institute of Informatics.

Quantum Computation and Information Project, ERATO-SORST, JST.

NTT Communication Science Laboratories, NTT Corporation.

This paper considers distributed computing on an anonymous quantum network, a network in which no party has a unique identifier and quantum communication and computation are available. It is proved that the leader election problem can exactly (i.e., without error in bounded time) be solved with at most the same complexity up to a constant factor as that of exactly computing symmetric functions (without intermediate measurements for a distributed and superposed input), if the number of parties is given to every party. A corollary of this result is a more efficient quantum leader election algorithm than existing ones: the new quantum algorithm runs in rounds with bit complexity , on an anonymous quantum network with parties and communication links. It follows that all Boolean functions computable on a non-anonymous quantum network can be computed with the same order of complexity as the quantum leader election algorithm on an anonymous quantum network. This gives the first quantum algorithm that exactly computes any computable Boolean function with round complexity and with smaller bit complexity than that of existing classical algorithms in the worst case over all (computable) Boolean functions and network topologies. More generally, any -qubit state can be shared with that complexity on an anonymous quantum network with parties. This paper also examines an important special case: the problem of sharing an -partite GHZ state among parties on an anonymous quantum network. It is proved that there exists a quantum algorithm that exactly solves this problem with rounds linear in the number of parties with a constant-sized gate set.

Keywords: quantum computing, distributed computing, leader election.

## 1 Introduction

### 1.1 Background

Distributed computing algorithms often depend on the assumption that messages sent by distinct parties can be distinguished, which is justified if every party has a unique identifier. A more general case without this assumption is an anonymous network, i.e., a network where no party has a unique identifier. Computing on anonymous networks was first considered with the leader election problem in Ref. [2] and has been further investigated in the literature (e.g., Refs. [9, 10, 1, 14, 20, 21]). This setting makes it significantly hard or even impossible to solve some distributed computing problems that are easy to solve on a non-anonymous network.

The leader election problem is the problem of electing a unique leader from among distributed parties and it is a fundamental problem: Once it is solved, the leader can gather all distributed input and locally solve any distributed computing problem (except cryptographic or fault-tolerant problems) (e.g., Ref. [15]). However, it was proved in Refs. [2, 19, 20] that no classical algorithm can exactly solve the leader election problem on anonymous networks for a certain broad class of network topologies, such as rings and a certain family of regular graphs, even if the network topology (and thus the number of parties) is known to each party prior to algorithm invocation. Here, an algorithm is said to exactly solve a problem if it solves the problem without fail in bounded time. Thus, many other problems have also been studied to clarify their solvability on anonymous networks: some were shown to be exactly solvable (for certain families of graphs) and others were not  [20]. For instance, any symmetric Boolean function can be computed on an anonymous network of any unknown topology, if the number of parties is given to each party [19, 20, 14]; in particular, efficient algorithms are known for various regular graphs (e.g., Refs. [3, 12, 14, 13]).

Surprisingly, the situation is quite different on quantum networks, i.e., networks in which quantum computation and communication are available. It was proved by the present authors in Ref. [18]111 A nice survey of this article is found in Ref. [6] that the leader election problem can exactly be solved on an anonymous quantum network of any unknown topology, if the number of parties is given to every party. This implies that quantum power substantially changes the computability of the leader election problem on anonymous networks.

Our questions are then as follows: How powerful is quantum information for solving distributed computing tasks? Does quantum power change the hardness relation among distributed computing problems (e.g., problem A is harder than problem B in the classical setting, while they have similar hardness in the quantum setting)? We give an answer to these questions by comparing the leader election problem with computing symmetric functions, well-known problems that can be solved even on an anonymous classical network. As a corollary, we provide a more efficient quantum leader election algorithm than existing ones. For every Boolean function computable on a non-anonymous quantum network (a quantum network in which every party has a unique identifier), this yields a quantum algorithm that computes it on an anonymous quantum network with the same order of complexity as the quantum leader election algorithm. In distributed quantum computing, sharing a quantum state among parties is also a fundamental problem. The above algorithm of computing Boolean functions actually solves the problem of parties sharing any quantum state. We also examine an important special case: the problem of sharing an -partite GHZ state among parties on an anonymous quantum network, called the GHZ-state sharing problem.

### 1.2 Main Results

Hereafter, we assume that the underlying graphs of networks are undirected and that no faults exist on networks.

Our first result shows that the leader election problem is not harder than computing symmetric functions on anonymous quantum networks. Let be the number of parties and be the function over distributed bits, which is if and only if the Hamming weight, i.e., the sum, of the bits is . Let be any quantum algorithm that exactly computes without intermediate measurements222 The condition “without intermediate measurements” is required for clear definition. It is easy to convert any quantum algorithm involving intermediate measurements into a quantum algorithm not involving them by postponing all the measurements. However, this conversion may increase the bit complexity and, thus, these two kinds of algorithms should be considered separately. For instance, consider a quantum algorithm involving intermediate measurements that uses a different subset of communication links for each intermediate measurement results, in which case the algorithm uses the union of the subsets when postponing the intermediate measurements. on an anonymous quantum network, and let and be the worst-case round and bit complexities of over all possible quantum states as input.333 Note that inputs are not limited to classical inputs when we consider the complexities of quantum algorithms that compute classical functions. For instance, can take a state of the form as input, where and . This takes it into account that the algorithm may use smaller amounts of communications when restricted to classical inputs. For instance, for each classical input, the algorithm may use a different subset of communication links, in which case it uses the union of these subsets of communication links when the input is a superposition of such classical inputs, and may result in the increase of communication complexities. Hence, the correct way of defining complexities of quantum algorithms that are used as subroutines is taking the maximum over all possible inputs, including quantum inputs.

###### Theorem 1

If the number of parties is provided to each party, the leader election problem can exactly be solved in rounds with bit complexity on an anonymous quantum network of any unknown topology.

This is the first non-trivial characterization of the complexity of leader election relative to computing Boolean functions on anonymous quantum networks. This does not have a classical counterpart, since, for some network topologies (e.g., rings), symmetric Boolean functions can exactly be computed [19, 20, 14] but a unique leader cannot exactly be elected [20]. In fact, any symmetric function can exactly be computed on an anonymous classical network of any unknown topology (and thus, on an anonymous quantum network). Therefore, Theorem 1 subsumes the computability result in Ref. [18] that the leader election problem can exactly be solved on an anonymous quantum network. Our second result is that computing is reducible to computing .

###### Theorem 2

If the number of parties is provided to each party, can exactly be computed without intermediate measurements for any possible quantum states as input in rounds with bit complexity on an anonymous quantum network of any unknown topology.

Theorem 1 together with Theorem 2 implies that the complexity of the leader election problem is characterized by that of computing . This would be helpful in intuitively understanding the hardness of the leader election problem on an anonymous quantum network, since computing can be interpreted as just a simple problem of checking if all parties have the same value.

Since Theorem 1 (Theorem 2) is proved by quantumly reducing the leader election problem (resp. computing ) to computing and (resp. computing ), the theorems provide ways of developing quantum leader election algorithms by plugging in algorithms that compute (and ). Since there is a classical algorithm that exactly computes in rounds with bit complexity for the number of edges of the underlying graph (e.g., Ref. [14]) and it can be converted into a quantum algorithm with the same complexity up to a constant factor, Theorem 1 together with Theorem 2 yields a quantum leader election algorithm.

###### Corollary 3

The leader election problem can exactly be solved in rounds with bit complexity on an anonymous quantum network for any unknown topology, if the number of parties is given to every party, where is the number of edges of the underlying graph.

This leader election algorithm has better round and bit complexity than existing algorithms — the two quantum algorithms given in Ref. [18] have the round [bit] complexity of [] and [], respectively. Actually, the proofs of Theorems  1 and 2 can be carried over asynchronous networks in a straightforward manner. Thus, the theorems hold for asynchronous networks.

#### 1.2.2 Quantum State Sharing

Once a unique leader is elected, it is possible to construct a spanning tree and assign a unique identifier drawn from to each party with the same order of complexity as that of electing a unique leader on anonymous quantum networks.444The problem of assigning unique identifiers drawn from a small domain has been widely studied even for non-anonymous networks since the length of each identifier has a great influence over the bit complexity of many problems. Then, the leader can recognize the underlying graph by gathering along the spanning tree the adjacency matrices of subgraphs with a unique identifier on each node. This implies that, if every party is given a bit as input, a unique leader (who is elected by the leader election algorithm) can compute any Boolean function that depends on the underlying graph with node label s (and send the function value to every party along the spanning tree). Here, the index of each party is introduced just for explanation, and it is not necessarily the same as the identifier assigned by the leader to the party having . An example of is a majority function that is if and only if the sum over all ’s is more than . Another example is a function that is if and only if there is a cycle in which each node has input . Similarly, if each party is given a qubit as node label so that the parties share some -qubit state , the leader can generate any quantum state computable from and the underlying graph .

###### Corollary 4

Suppose that every party is given the number of parties and a qubit as node label so that the parties share some -qubit state . Let be any -qubit quantum state computable from and the underlying graph. Then, state can exactly be shared among the parties in rounds with bit complexity on an anonymous quantum network, where is the number of edges of the underlying graph. A special case of is a Boolean function that is determined by the underlying graph in which each node is labeled with a bit . If every party is given and , function can exactly be computed in rounds with bit complexity on an anonymous quantum network.

This gives the first quantum algorithm that exactly computes any computable Boolean function with round complexity and with smaller bit complexity than that of existing classical algorithms [20, 14, 18] in the worst case over all (computable) Boolean functions and network topologies.

##### GHZ-State Sharing

From the viewpoint of quantum information, our leader election algorithm exactly solves the problem of sharing an -partite -state (e.g., a state for the three-party case). As described above, this essentially solves the more general problem of sharing an -qubit state . We are then interested in whether a certain non-trivial can be shared with less computational resources than a -state. Specifically, we focus on the number of distinct quantum gates required to share , since, for the leader election problem, all known exact algorithms (including ours) require quantum gates that depend on the number of parties.

Among non-trivial quantum states other than -states, an -partite GHZ state would be one of the most interesting quantum states, since it would be a useful resource for quantum computing and communication. We give exact quantum algorithms that solve, with a constant-sized gate set, the problem of sharing an -partite GHZ state (or an -partite cat state) with qubits, and the problem of sharing an -partite generalized-GHZ state with -level qudits for a constant integer , among parties on an anonymous quantum network. We call this problem the GHZ-state sharing problem. Notice that -level qudits are physically realizable [16] and are just qubits for . Let be a function such that for distributed inputs . Let be any quantum algorithm that exactly computes without intermediate measurements on an anonymous network, and let and be the worst-case round and bit complexities, respectively, of over all possible quantum states as input.

###### Theorem 5

If every party is given the number of party and an integer , the GHZ-state sharing problem can exactly be solved on an anonymous quantum network in rounds with bit complexity . Moreover, every party uses only a constant-sized gate set to perform all operations for any integer constant , if an algorithm is given as a black box.

For every integer constant , there is an algorithm that exactly and reversibly computes for any possible quantum state as input in rounds with bit complexity on an anonymous classical/quantum network of any unknown topology [18]. Therefore, the theorem implies that there exists a quantum algorithm that exactly solves the GHZ-state sharing problem with a constant-sized gate set for any constant . For , we have the following corollary.

###### Corollary 6

The GHZ-state sharing problem with can exactly be solved on an anonymous quantum network for any number of parties with a gate set that can perfectly implement the Hadamard transformation and any classical reversible transformations. In particular, the problem can exactly be solved with either the Shor basis or the gate set consisting of the Hadamard gate, the CNOT gate, and the Toffoli gate.

If much more rounds are allowed, there exists a more bit-efficient algorithm that exactly solves the GHZ-state sharing problem in rounds with bit complexity by using only a constant-sized gate set for any . The algorithm is obtained by modifying Algorithm I in Ref. [18].

### 1.3 Related Work

Refs. [17, 7] have dealt with the leader election and GHZ-state sharing problems in a different setting where pre-shared entanglement is assumed but only classical communication is allowed. The relation between several network models that differ in available quantum resources is discussed in Ref. [8].

### 1.4 Organization

Section 2 describes the network model, and some tools and notations used in the paper. Sections 3 and 4 prove Theorems 1 and 2. Section  5 then gives a quantum leader election algorithm as a corollary of the theorems. Section 6 considers the problems of computing Boolean functions and sharing a quantum state. Section 7 presents a quantum algorithm for the GHZ-state sharing problem.

## 2 Preliminaries

### 2.1 Distributed Computing

##### The Network Model:

A classical network is composed of multiple parties and bidirectional classical communication links connecting parties. In a quantum network, every party can perform quantum computation and communication, and each adjacent pair of parties has a bidirectional quantum communication link between them (we do not assume any prior shared entanglement). When the parties and links are regarded as nodes and edges, respectively, the topology of the network is expressed by a connected undirected graph. We denote by the set of all -node connected undirected graphs with no multiple edges and no self-loops. In what follows, we may identify each party/link with its corresponding node/edge in the underlying graph for the system, provided that doing so is not confusing. Every party has ports corresponding one-to-one to communication links incident to the party. Every port of party has a unique label , , where is the number of parties adjacent to . More formally, the underlying graph has a port numbering [20], which is a set of functions such that, for each node of degree , is a bijection from the set of edges incident to to . It is stressed that each function may be defined independently of any other . In our model, each party knows the number of his ports and the party can appropriately choose one of his ports whenever he transmits or receives a message.

Initially, every party has local information , the information that only party knows, such as his local state and the number of his adjacent parties, and global information , the information shared by all parties (if it exists), such as the number of parties in the system (there may be some information shared by not all parties, but it is not necessary to consider such a situation when defining anonymous networks). Every party runs the same algorithm, which is given local and global informations, and , as its arguments. If all parties have the same local information except for the number of ports they have, the system and the parties in the system are said to be anonymous. For instance, if the underlying graph of an anonymous network is regular, this is essentially equivalent to the situation in which every party has the same identifier (since we can regard the local information of each party as his identifier). This paper deals with only anonymous networks, but may refer to a party with its index (e.g., party ) only for the purpose of simple description.

A network is either synchronous or asynchronous. In the synchronous case, message passing is performed synchronously. The unit interval of synchronization is called a round. Following the approach in Ref. [15], one round consists of the following two sequential steps, where we assume that two (probabilistic) procedures that generate messages and change local states are defined in the algorithm invoked by each party: (1) each party changes his local state according to a procedure that takes his current local state and the incoming messages as input, and then removes the messages from his ports; (2) each party then prepares messages and decides the ports through which the messages should be sent by using the other procedure that takes his current local state as input, and finally sends the messages via the ports. Notice that, in the quantum setting, the two procedures are physically realizable operators. A network that is not synchronous is asynchronous. In asynchronous networks, the number of rounds required by an algorithm is defined by convention as the length of the longest chains of messages sent during the execution of the algorithm.

This paper focuses on the required number of rounds as a complexity measure (called round complexity). This is often used as an approximation of time complexity, which includes the time taken by local operations as well as that taken by message exchanges. Another complexity measure we use is bit complexity, which is the number of bits, including qubits, communicated over all communication links. In this paper, we do not assume any faulty party and communication link.

### 2.2 Leader Election Problem in Anonymous Networks

The leader election problem is formally defined as follows.

###### Definition 7 (n-party leader election problem (LEn))

Suppose that there is an -party network whose underlying graph is in , and that each party in the network has a variable initialized to . Create the situation in which for a certain and for every in the rest .

This paper considers on an anonymous network (when each party has his own unique identifier, i.e., for all distinct , can deterministically be solved in rounds in both synchronous and asynchronous cases [15]).

The leader election problem on an anonymous network was first investigated by Angluin [2]. Subsequently, Yamashita and Kameda [20] gave a necessary and sufficient condition on network topologies under which can exactly be solved for given . Their result implies that cannot exactly be solved for a broad class of graphs, including rings, complete graphs, and certain families of regular graphs. Interested readers should consult Refs. [1, 22] and the references in them for detailed information about the leader election problem on anonymous networks.

### 2.3 Quantum Computing

We assume that readers have some basic knowledge of quantum computing introduced in standard textbooks [16, 11]. The following well-known theorem is called “exact quantum amplitude amplification”, which will be used repeatedly.

###### Theorem 8 ([4, 5])

Let be any quantum algorithm that searches for such that without using measurements, where is any Boolean function. Suppose that

 |Ψ⟩=A|0⟩⊗n=∑zαz|z⟩

for orthonormal basis . Let be an operator

 −AF0(ϕ)A−1Fχ(θ),

where multiplies by a factor of if , and multiplies by a factor of if .

If the initial success probability of is exactly known and at least , then

 Q(A,χ,ϕa,θa)|Ψ⟩=1√a∑z:χ(z)=trueαz|z⟩

for some values and computable from .

### 2.4 Notations

A Boolean function depending on variables, with , is said to be symmetric if is determined by the Hamming weight of , i.e., . In particular, symmetric function is defined as if and only if is . We say that parties exactly compute a Boolean function if every party has variables (initialized to “”) and before computation, and set to with certainty after computation. If a quantum algorithm exactly computes without intermediate measurements on an anonymous quantum network, we say that the algorithm is an -algorithm.

In general, an -algorithm transforms (with ancilla qubits) an input state into , for any , where is “garbage” left after computing . For the algorithms over networks with bidirectional communication links, any -algorithms are reversible. Hence we can totally remove the “garbage” by standard garbage-erasing technique, as the -algorithm exactly and reversibly computes . Putting everything together, we may assume without loss of generality (at the cost of doubling each complexity) that any -algorithm transforms an input state

 ∑→x∈{0,1}nα→xn⨂i=1(|xi⟩|true⟩)

into

 ∑→x∈{0,1}nα→xn⨂i=1(|xi⟩|f(→x)⟩),

for any with , where . Similarly, for the more general function depending on distributed variables with , we say that a quantum algorithm is an -algorithm, if the algorithm exactly computes without intermediate measurements on an anonymous quantum network. For an -algorithm on an anonymous quantum network with the underlying graph , we denote by and the worst-case bit and round complexities, respectively, of over all possible quantum states given as input. For simplicity, we may write and if is clear from context.

## 3 Proof of Theorem 1

### 3.1 Basic Idea

Initially, every party is eligible to be the leader and is given the number of parties as input. Every party flips a coin that gives heads with probability and tails with . If exactly one party sees heads, the party becomes a unique leader. The probability of this successful case is given by

 s(n)=(n1)⋅1n⋅(n−1n)n−1=(1−1n)n−1>1e>14.

We shall amplify the probability of this case to one by applying the exact quantum amplitude amplification in Theorem 8. To do this, we use an -algorithm in a black-box manner to check (in ) whether or not a run of the above randomized algorithm results in the successful case, and use an -algorithm in a black-box manner to realize the diffusion operator (more strictly, ). In other words, we shall quantumly reduce the leader election problem to computing and . In our algorithm, all communication is performed for computing , and their inversions. The non-trivial part is how to implement and in a distributed way on an anonymous network, where , since every party must run the same algorithm.

### 3.2 The Algorithm

Before describing the algorithm, we introduce the concept of solving and unsolving strings. Suppose that each party has a bit , i.e., the parties share -bit string . A string is said to be solving if has Hamming weight one. Otherwise, is said to be unsolving. We also say that an -qubit pure state shared by the parties is solving (unsolving) if only for that is solving (unsolving).

Fix an -algorithm and an -algorithm, which we are allowed to use in a black-box manner.

##### Base algorithm A:

Let be the two-by-two unitary matrix defined by

 A=1√n(√n−111−√n−1).

At the beginning of the algorithm, each party prepares three single-qubit quantum registers , , and , where the qubit in is initialized to , the qubits in and are initialized to (the qubits in and will be used as ancillary qubits when performing phase-shift operations on the qubit in ). First, each party applies to the qubit in to generate the quantum state . Equivalently, all parties share the -qubit quantum state

 |Ψ⟩=|ψ⟩⊗n=(√1−1n|0⟩+√1n|1⟩)⊗n

in their ’s. Let be the set of solving strings of length , and let be the quantum state which is the uniform superposition of solving strings of length . Notice that is a superposition of the solving state and some unsolving state :

 |Ψ⟩=αsolving|Ψsolving⟩+αunsolving|Ψunsolving⟩.

The amplitude of is given by .

##### Exact amplitude amplification:

Now the task for the parties is to amplify the amplitude of to one via exact amplitude amplification, which involves one run of for since the initial success probability is .

To realize in a distributed manner, where if is solving and otherwise, each party wants to multiply the amplitude of any basis state for by a factor of , where . This will multiply the amplitude of the basis state by a factor of as a whole. At this point, however, no party can check if for each basis state , since he knows only the content of his . Thus, every party runs the -algorithm with and , which sets the content of to “” if the number of ’s among the contents of ’s of all parties is exactly one and sets it to “” otherwise (recall that the -algorithm computes for each basis state in a superposition). This operation transforms the state as follows:

 |Ψ⟩|true''⟩⊗n↦αsolving|Ψsolving⟩|true''⟩⊗n+αunsolving|Ψunsolving⟩|false''⟩⊗n,

where the last qubits are those in ’s. Every party then multiplies the amplitude of each basis state by a factor of , if the content of is “” (here, no party measures ; every party just performs the phase-shift operator controlled by the qubit in ). Namely, the state over ’s and ’s of all parties is transformed into

Finally, every party inverts every computation and communication of the -algorithm to disentangle .

The implementation of is similar to that of , except that multiplies the all-zero basis state by . First, every party runs the -algorithm with and , which sets the content of to “” in the case of the all-zero state, and sets it to “” otherwise. Next, every party multiplies the amplitude of the all-zero state by a factor of , if the content of is “”. Finally, every party inverts every computation and communication of the -algorithm to disentangle .

More precisely, every party sets his classical variable to , and runs Algorithm QLE with and , given in Figure 1. After the execution of the algorithm, exactly one party has the value in . Since all communication is performed to compute and and their inversions, the algorithm runs in rounds with bit complexity for any graph , where and are the -algorithm and algorithm, respectively, that we fixed. This completes the proof of Theorem 1.

## 4 Proof of Theorem 2

The proof consists of the following two steps:

• Reduce computing to computing and the consistency function , where is a Boolean function that is if and only if a subset (specified by ) of all parties has the same classical value (its formal definition will be given later).

• Reduce computing to computing .

Actually, the second step is almost trivial. We start with the first step.

### 4.1 Basic Idea

Suppose that every party is given a Boolean variable . We can probabilistically compute with the following classical algorithm, where : Every party with sets a variable to or each with probability and sends to all parties (by taking rounds for the diameter of the underlying graph); every party with sets variable to “” and sends to all parties. It is not difficult to see that the following three hold: (i) if , every party receives only “”, (ii) if , either no party receives “” or no party receives “”, and (iii) if , every party receives both “” and “” with probability . Therefore, every party can conclude that () with probability one if () and that with probability if . Roughly speaking, our quantum algorithm for computing is obtained by first quantizing this probabilistic algorithm and then applying the exact quantum amplitude amplification to boost the success probability to one. More concretely, we amplify the probability that there are both and among all ’s by using the exact amplitude amplification. Let and be the values of before and after, respectively, applying the amplitude amplification. Obviously, if , then also. Hence, for , . For , could be boosted to one if the exact value of were known to every party. However, is determined by , the value of which may be harder to compute than to just decide whether or not. Therefore, instead of actual , we run the amplitude amplification for each , a guess of , in parallel. We can then observe that exactly one of the runs boosts to one if and only if .

### 4.2 Terminology

Suppose that each party has a bit , i.e., the parties share -bit string . For convenience, we may consider that each expresses an integer, and identify string with the integer it expresses. For an index set , string is said to be consistent over if is equal to for all in . Otherwise is said to be inconsistent over . Here, index set is used just for the definition (recall that no party has an index or identifier in the anonymous setting). Formally, we assume that every party has a variable , and is defined as the set of all parties with . If is the empty set, any is said to be consistent over . We also say that an -qubit pure state shared by the parties is consistent (inconsistent) over if only for ’s that are consistent (inconsistent) over (there are pure states that are neither consistent nor inconsistent over , but we do not need to define such states).

We next define the consistency function , which decides if a given string distributed over parties is consistent over . Namely, returns “” if is consistent over and “” otherwise.

### 4.3 The H1-Algorithm

As in the previous section, we fix an -algorithm and a -algorithm, which we use in a black-box manner. At the beginning of the algorithm, every party prepares two one-qubit registers and . We shall describe an -algorithm that exactly computes function over the contents of ’s and sets the content of each to the function value. Here, we assume that registers ’s are initialized to for an orthonormal basis of . We basically follow the idea in Section 4.1 to reduce computing to computing the binary-valued functions and . However, the idea actually represents a three-valued function, i.e., distinguishes among three cases: , , and . Thus, we cast the idea into two yes-no tests. Namely, the algorithm first tests if is 0 or not. If , then it concludes . The algorithm then performs another test to decide if or , which determines .

#### 4.3.1 First Test

To test if , each party prepares a single-qubit register , the content of which is initialized to . Each party then performs the -algorithm to exactly compute the value of over the contents of ’s, and stores the computed value in each .

From the definition of the -algorithm, this transforms the state in ’s and ’s as follows:

 n⨂i=1(|xi⟩X|true''⟩Y|true''⟩S0) ↦n⨂i=1(|xi⟩X|% true''⟩Y|H0(→x)⟩S0), by rearranging registers,

If the content of is “”, then the content of will be set to later (because this means ).

#### 4.3.2 Second Test

Next each party tests if or with certainty. Recall the probabilistic algorithm in which every party sets a variable to or each with probability if and sets variable to “” if , and then sends to all parties. Our goal is to amplify the probability that that there are both and among all ’s by using the exact amplitude amplification. The difficulty is that no party knows the value of (). The test thus uses a guess of and tries to amplify assuming that . If , then the procedure obviously outputs the correct answer with probability one. If , the procedure may output the wrong answer. As will be proved later, however, we can decide if or without error from the outputs of -runs of the test for , which are performed in parallel.

We now describe the test procedure for each . Assume that one-qubit register is initialized to . The initial state is thus

 ∑→x∈{0,1}nα→xn⨂i=1(|xi⟩X|unmarked ''⟩Zt),

where registers and are omitted to avoid complication.

The base algorithm (to be amplified) is described as follows. If the content of is , the party flips the content of to “”, where is an orthonormal basis in . This operation just copies the contents of to those of (in the different orthonormal basis) for parallel use over all . The state is thus, for any fixed ,

 n⨂i=1(|xi⟩X|zt(xi)⟩Zt)=(|1⟩X|marked ''⟩Zt)⊗|S|⊗(|0⟩X|unmarked ''⟩Zt)⊗(n−|S|),

where is the content of when the content of is , and is the set of the parties whose is in the state (note that ).

If the content of is“”, apply the Hadamard operator to the qubit in to create (note that register of each party is the quantum equivalent of 555 Here, the contents of ’s of “unmarked” parties are set to , while the classical equivalents, variables ’s, of the parties are set to “” (instead of 0). Actually, the symbol “” is used to distinguish between and . However, we do not need it any longer due to the first test.). The state is now represented as, for the ,

 (|1⟩X|marked ''⟩Zt|0⟩Rt+|1⟩Rt√2)⊗|S|⊗(|0⟩X|unmarked ''⟩Zt|0⟩Rt)⊗(n−|S|).

By rearranging registers, we have

 |→x⟩X′s|zt(→x)⟩Z′ts(|0⟩Rt+|1⟩Rt√2)⊗|S||0⟩⊗(n−|S|)Rt=|→x⟩X's|zt(→x)⟩Zt's|ψt(→x)⟩Rt's,

where is the -tensor product of or corresponding to , and

 |ψt(→x)⟩=⎛⎜⎝1√2|S|∑→y∈{0,1}|S||→y⟩⎞⎟⎠|0⟩⊗(n−|S|).

This is the end of the base algorithm .

We then boost the amplitudes of the basis states superposed in such that there are both and in ’s of parties in , i.e., the amplitudes of the states that are inconsistent over , with amplitude amplification. Here, function in Theorem 8 is the consistency function and is used as the success probability . For convenience, we express as

 |ψt(→x)⟩=|ψinconsistent⟩+|ψconsistent⟩,

where,

 |ψinconsistent⟩ =⎛⎜⎝1√2|S|∑→y∈{0,1}|S|:|→y|≠0,|S||→y⟩⎞⎟⎠|0⟩⊗(n−|S|), |ψconsistent⟩ =1√2|S|(|0⟩⊗|S|+|1⟩⊗|S|)|0⟩⊗(n−|S|).

To realize , every party prepares a single-qubit register initialized to and then performs the next operations: (1) Perform a -algorithm with , and , which computes for each basis state of and sets the content of to value of ; (2) Multiply the amplitude of each basis state of by a factor of if the content of is “”; (3) Finally invert every computation and communication of (1) to disentangle . The state evolves with the above operations as follows:

 |zt(→x)⟩|ψt(→x)⟩|consistent''⟩⊗n ↦|zt(→x)⟩(|ψinconsistent⟩|inconsi