Understanding Quantum Algorithms via Query Complexity

Understanding Quantum Algorithms via Query Complexity

Andris Ambainis Faculty of Computing, University of Latvia, Raina bulvāris 19, Riga, LV-1586, Latvia, ambainis@lu.lv
Abstract

Query complexity is a model of computation in which we have to compute a function of variables which can be accessed via queries. The complexity of an algorithm is measured by the number of queries that it makes. Query complexity is widely used for studying quantum algorithms, for two reasons. First, it includes many of the known quantum algorithms (including Grover’s quantum search and a key subroutine of Shor’s factoring algorithm). Second, one can prove lower bounds on the query complexity, bounding the possible quantum advantage. In the last few years, there have been major advances on several longstanding problems in the query complexity. In this talk, we survey these results and related work, including:

  • the biggest quantum-vs-classical gap for partial functions (a problem solvable with 1 query quantumly but requiring queries classically);

  • the biggest quantum-vs-determistic and quantum-vs-probabilistic gaps for total functions (for example, a problem solvable with queries quantumly but requiring queries probabilistically);

  • the biggest probabilistic-vs-deterministic gap for total functions (a problem solvable with queries probabilistically but requiring queries deterministically);

  • the bounds on the gap that can be achieved for subclasses of functions (for example, symmetric functions);

  • the connections between query algorithms and approximations by low-degree polynomials.

1 Introduction

Quantum computers open new possibilities for computing, by being able to solve problems that are considered intractable classically. The most famous example is factoring large numbers which is thought to require time classically but is efficiently solvable by a quantum computer, due to Shor’s quantum algorithm [42]. Another example is simulating quantum physical systems which is thought to require time classically but is also solvable in polynomial time quantumly [25, 27].

This naturally leads to a question: how large is the advantage of quantum computers? Can we put limits on it?

In the Turing machine model, we have where and denote the classes of problems that are solvable by deterministic or quantum Turing machines within the respective time bound. However, it is very difficult to prove unconditional separations between complexity classes and we cannot even show that is larger than .

For this reason, the power of quantum computers is often studied in the query model (also known as the decision tree model [23]). In this model, we have to compute a function of an input , with accessible via queries to a black box that, given , outputs . The complexity is measured by the number of queries that an algorithm makes.

The query model is very interesting in the quantum case because it captures most of the known quantum algorithms. Some of the problems that can be described in it are:

Search. Given black box access to , determine whether there exists (or find such ).

Search requires queries classically but can be solved with queries quantumly [29]. It can be viewed as a black box model for a generic exhaustive search problem where one has to check possibilities (without any information which of those possibilities are more likely) and implies quantum speedups for a variety of problems (for example, a quadratic quantum speedup over the best probabilistic algorithm for 3-SAT [9]).

Period-finding. Given black box access to , determine the smallest such that for all (and for all and ), under a promise that such exists and is smaller than for some .

Period-finding is solvable with queries quantumly and requires queries classically [42, 24]. It is at the heart of Shor’s factoring algorithm [42] which consists of a classical reduction from factoring to period-finding and a quantum algorithm for period-finding.

Element distinctness. Given black box access to , determine if there are such that .

Element distinctness requires queries classically and queries quantumly [10, 8]. It is related to black box models of algorithms for breaking collision-resistant hash functions (an important cryptographic primitive). The quantum algorithm for element disticntness is also useful as a subroutine for other quantum algorithms, from checking matrix products [22] to solving typical instances of subset sum (which is also important for cryptography) [16].

Many other quantum query algorithms are known, as can be seen from Quantum Algorithms Zoo (a website collecting information about all quantum algorithms [30]). From a complexity-theoretic perspective, the query model is very interesting because it allows to prove lower bounds on quantum algorithms and it is often possible to characterize the quantum advantage within a big-O factor.

The current survey is focused on characterizing the maximum possible quantum advantage in the query model, for different types of computational tasks. Let and denote the number of queries for the best quantum and randomized algorithm, respectively. For partial Boolean functions, we describe a gap of vs [4]. For total functions, the biggest known gap is much smaller: [7]. Imposing symmetry constraints on also decreases the maximum possible gap.

As a side result, this research has lead to new results on classical query algorithms. This includes solutions to two well known problems in the classical query complexity which had been open for about 30 years (such as determining the maximum gap between randomized and deterministic query complexities [41, 14]). We describe those developments, as well.

2 Computational Models

2.1 Deterministic, randomized and quantum query algorithms

We now formally define the models of query complexity that we use. We consider computing a function of variables . By default, we assume that the variables are -valued. (If we consider with values in a larger set, this is explicitly indicated.) The function can be either a total function (defined on the entire ) or a partial function (defined on a subset of ).

Deterministic algorithms. Deterministic query algorithms are often called decision trees, because they can be described by a tree (as in figure 1). At each node of this tree, we have the name of a variable that is asked if the algorithm gets to this node. Depending on the outcome of the query, the algorithm proceeds to the child or to the child of the node. If the algorithm gets to a leaf of the tree, it outputs the value of the function listed at this leaf.

Figure 1: Example of a decision tree

The complexity of an algorithm is the maximum number of queries that it can make. Deterministic query complexity is the smallest complexity of a deterministic which outputs if the queries are answered according to , whenever is defined.

Randomized algorithms. In a randomized query algorithm, the algorithm may choose the variable for the next query randomly from some probability distribution.

Randomized algorithms are usually studied either in the zero-error setting or in the bounded error setting. In the zero-error setting, the algorithm is required to output with probability at least 1/2 and may output ”don’t know” otherwise but must not output a value that is different from . In the bounded-error setting, algorithm is required to output with probability at least 2/3 and may output anything otherwise. In both cases, the requirement has to be satisfied for every for which is defined.

The complexity of an algorithm is measured by the largest number of queries that is made by , for the worst choice of and the worst random choices of . and are the smallest complexities of a zero-error randomized and a bounded error randomized algorithm for , respectively. (Alternatively, one can define randomized query complexity via the expected number of queries for the worst case but this changes the complexities and by at most a constant factor.)

Quantum algorithms. Unlike in the probabilistic case, different branches of a quantum algorithm can recombine at a later stage. For this reason, a quantum query algorithm cannot be described by a tree.

Instead, a quantum query algorithm is defined by an initial state and transformations . The initial state and transformations are independent of . are the queries - transformations of a fixed form that depend on ’s. The algorithm consists of performing on and measuring the result (as shown in Figure 2). The algorithm computes if, for every for which is defined, this measurement produces .

Figure 2: Structure of a quantum query algorithm

To define the model more precisely, we must define the notions of a quantum state, a transformation, and a measurement. (For more details on these notions, we refer the reader to the book [35].) The state space of a quantum algorithm is a complex vector space of dimension (where can be choosen by the designer of the algorithm). Let be an orthonormal basis for this vector space. A quantum state is a vector

of unit length (i.e. satisfying ). A unitary transformation is a linear transformation on that preserves the length of . The principles of quantum mechanics allow to perform any unitary on a quantum state.

A measurement is the way of obtaining information from a quantum state. Measuring a state with respect to yields the result with probability .

To define a quantum query algorithm, we allow the starting state to be an arbitrary quantum state. ’s can be arbitrary unitary transformations that do not depend on . is the query transformation, defined in a following way111Since most of this survey considers functions of variables , we only give the definition of a query for this case.. We rename the basis states from to with and for some and define

It can be argued that this is a natural quantum conterpart of a probabilistic query in which we choose according to a probability distribution and get the corresponding .

After the last transformation, the state of the algorithm is measured w.r.t. and the result is transformed into the answer of the algorithm according to a predefined rule. (For example, if the answer should be -valued, we could take the first bit of the measurement result as the answer.)

Two most frequently considered types of quantum query algorithms are exact and bounded error algorithms. A quantum query algorithm computes exactly if its answer is always the same as , whenever is defined. A quantum query algorithm computes with bounded error, if for every , for which is defined, the probability that outputs as the answer is at least 2/3. and are the smallest numbers of queries in quantum algorithms that compute exactly and with bounded error, respectively.

2.2 Quantities that are related to query complexity

In this section, we define several quantities that provide upper and lower bounds on different query complexities. Using them, we can prove bounds on the maximum gaps between query complexity measures (for example, that [36] and [15] for any total Boolean function ).

Block sensitivity. For an input and a subset of variables , is the input obtained from by changing all to opposite values. The block sensitivity is the maximum for which there is an input and pairwise disjoint subsets with for all .

Block sensitivity is a lower bound on all the query complexity measures: , [36] and [15]. It also provides an upper bound on for total Boolean functions : [36]. Combining these relations yields and - the best upper bounds on the gap between and or .

Certificate complexity. For an input , a certificate is a set with the property that the variables determine the value of . (More precisely, is a certificate on an input if, for any such that for all , we have .) is the minimum size of a certificate on the input . The certificate complexity is the maximum of over all .

Certificate complexity provides a better upper bound on for total : [36]. If one could show that , this would imply , improving the best known relation between and .

Randomized certificate complexity [1]. For an input , is the minimum number of queries in a bounded-error randomized query algorithm that accepts and rejects all . The randomized certificate complexity is the maximum of over all .

Unlike for the standard certificate complexity, it is known that [1]. Proving for total (which is not known) would also imply .

Polynomial degree. The exact degree, , is the degree of the multilinear polynomial which satisfies for all . The approximate degree, , is the smallest degree of a multilinear polynomial which satisfies for all .

Both of these measures also provide lower bounds on quantum query complexity: and [15].

3 Maximum quantum-classical gap for partial functions

In this section, we consider the question: what is the maximum possible gap between and the most general of classical complexities , for a partial function if we do not place any constraints on ?

As we already mentioned, period finding has and . In the form defined in section 1, period-finding is not a Boolean function (it has variables instead of Boolean variables). While it is possible to define a Boolean version of period-finding with almost the same gap, there is Boolean function with an even bigger gap:

Theorem 1

[4] There exists with and .

The function is defined as follows [4]. We have variables. For technical convenience, we denote variables and assume that the possible values for variables are (instead of 0 and 1). Let be the matrix (with rows and columns indexed by ) defined by where is the inner product between and interpreted as -bit strings and . (In terms of quantum computing, where is the standard Hadamard matrix.) We define

The thresholds and are chosen so that:

  • if we choose for uniformly at random and then choose , we get with a high probability;

  • if we choose both and uniformly at random form , we get with a high probability.

Thus, by solving , we are effectively distinguishing between being the vector of signs of where and being independently random.

is shown by a quantum algorithm that generates a quantum state

This quantum state can be generated by just 1 query. We then apply the transformation to basis states , transforming the state to

We then use the SWAP test [20], a well known test for testing similarity of coefficient vectors of two parts of a quantum state.

The proof of the lower bound, , is quite intricate. We define a corresponding problem (which we call REAL FORRELATION) with real valued variables in which we have to distinguish between two cases:

  1. all and are i.i.d. random with Gaussian distribution ;

  2. ’s are i.i.d random with Gaussian distribution and are obtained by applying Fourier transform to a vector consisting of ’s: .

In [4], we show that any algorithm for FORRELATION implies an algorithm for REAL FORRELATION with a similar complexity. Thus, it suffices to show a classical lower bound on REAL FORRELATION.

REAL FORRELATION is, in turn, a special case of a more general problem, GAUSSIAN DISTINGUISHING, in which we have to determine whether a set of real-valued variables has a hidden structure. Let , , be a set of vectors in for some . We have to distinguish between two cases:

  1. all are i.i.d. random with Gaussian distribution ;

  2. are generated by choosing a random (whose entries are i.i.d. random variables) and taking .

The lower bound on REAL FORRELATION is a special case of

Theorem 2

Let be such that for all . Then, GAUSSIAN DISTINGUISHING requires queries.

In the case of REAL FORRELATION, , , are the computational basis states , , and are , , . Then, , implying a lower bound of on REAL FORRELATION. This bound is nearly tight, as shown by

Theorem 3

Let be a 1-query quantum algorithm. There is a probabilistic algorithm that makes queries and, on every input , outputs an estimate such that (where is the accepting probability of on ) with a high probability.

The simulation makes use of the connection between quantum algorithms and polynomials:

Lemma 1

[15] Let be a quantum algorithm that makes queries to an input , . The accepting probability of can be expressed as a polynomial in variables of degree at most .

Since the accepting probability of an algorithm must be between 0 and 1, we have whenever . Theorem 3 then follows from a more general result about estimating bounded polynomials:

Lemma 2

[4] For every polynomial with and for any , there is a probabilistic algorithm that makes queries and outputs an estimate such that with a high probability, for every input .

More generally, if we have a bounded polynomial with , its value can be estimated with queries. Together with lemma 1, this implies a probabilistic simulation of query quantum algorithms with queries. Unlike for , we do not know whether this is optimal.

Open Problem 1

Let . Is there a partial function with and ?

The problem remains open, if instead of (which matches our upper bound), we ask for a weaker lower bound of , and, even, if instead of a constant , we allow .

Open Problem 2

Is there a partial function with for some and for ?

The well known examples of problems with a large quantum-classical gap (such as Simon’s problem [43] or period-finding) typically have . In [4], we give a candidate problem, -FOLD FORRELATION for which we conjecture that bounds of Problem 1 hold. This is, however, the only candidate problem that we know.

4 Total functions: pointer function method

For total functions , the possible gaps between , and are much smaller: all of these complexity measures are polynomially related.

It is well known that [15] and [36]. For exact/zero error algorithms we know that [33] and [41]. The question is: how tight are these bounds?

For a very long time, the best separations were:

  • Quantum vs. probabilistic/deterministic: has due to Grover’s quantum search algorithm and .

  • Probabilistic vs. deterministic: the binary AND-OR tree function of depth has and , implying that [41].

Both of these separations were conjectured to be optimal by a substantial part of the respective research community.

For exact quantum query complexity, the best separation was vs. for the -bit XOR function [15] until 2013 when an example with was discovered [11].

In 2015, major improvements to all of these bounds were achieved, via two new methods. The first of them, the pointer function method was first invented by Göös, Pitassi and Watson [28] for solving the communication vs. partition number problem in classical communication complexity. It was then quickly adapted to separating query complexity measures by Ambainis et al. [12]:

Theorem 4

[12]

  1. There exists a total Boolean function with .

  2. There exists a total Boolean function with .

  3. There exists a total Boolean function with .

The first two results provide major improvements over the previosly known results mentioned at the beginning of this section. The third result is the first ever superlinear gap between and for a total .

We now illustrate the method by describing the simplest function by Göös, Pitassi and Watson [28] and sketch a proof that it achieves , a slightly weaker result than the second item above. Consider , with variables indexed by . The variables are interpreted as elements of an table and pairs of variables are interpreted as pointers to entries in this table222As described, this is a function of variables with a larger set of values but it can be converted into a function with -valued variables, with complexities changing by at most a logarithmic factor. .

We define that if the following conditions are satisfied:

  1. the table has a unique column in which all entries are 1;

  2. in this column, there is exactly one for which ;

  3. if we start at this and repeatedly follow the pointers (that is, consider the sequence defined by and for ), then:

    1. for each , there is a unique with ,

    2. ,

    3. for all .

This function has the following properties:

  1. : for any deterministic algorithm, an adversary may choose the values for variables so that at least one of , , needs to be queried for each .

  2. If , this can be certified by showing variables for different : the all-1 column and the cells in the sequence of pointers. Moreover, there is one and only one way to certify this.

To show a gap between and , it suffices to show that a randomized algorithm can find this certificate faster than a deterministic algorithm. For that, we set and consider the following randomized algorithm (due to Mukhopadhyay and Sanyal [34]):

  1. times repeat:

    1. Choose a random entry of the table in a column that has not been eliminated yet.

    2. While , , and is not a column that has been already eliminated:

      • eliminate column ;

      • set and .

    3. If but or , eliminate column .

  2. If all columns are eliminated or more than 100 columns remain, output 0.

  3. Otherwise, test each of remaining columns by checking whether it satisfies the conditions for a certificate.

If , each time when we choose a random entry in a column that is not the all-1 column, there is an probability of choosing the entry that is a part of the pointer chain. This means that, during repetitions, this happens times. Each time, the columns that are after this entry in the pointer chain get eliminated. On average, half of remaining columns are after the entry that gets chosen. This means that, with a high probability, after times, only columns are not eliminated. Then, one can test each of them with queries.

This basic construction can be modified in several ways [12]. To separate two models of computation, we should make the certificate for easy to find in one of them but difficult in the other model. (For example, hard to find by zero-error probabilistic algorithms but easy to find by bounded error probabilistic algorithms.) For different separations, the modifications include:

  • Arranging the cells with pointers (in columns that are not the all-1 column) into a binary tree instead of a chain.

  • Introducing back pointers at the end of the pointer chain or at the leaves of the tree, pointing back to the all-1 column.

  • Having more than one all-1 column with pointers among the all-1 columns.

Besides the three major results in Theorem 4, this approach gives better-than-before separations between exact quantum query complexity and all classical complexity measures (, , and ), between bounded-error quantum and zero-error probabilistic complexity (), and between polynomial degree and randomized query complexity () [12].

5 Total functions: cheat sheet method

5.1 Query complexity

After the developments described in the previous section, the biggest separation between quantum and randomized complexities still remained . This was improved to in a breakthrough paper by Aaronson, Ben-David, and Kothari [7], using another new method, cheat sheets.

The key feature of cheat sheet method is that it takes separations for partial functions and transforms them into separations for total functions, by adding extra variables that allow to check that the input satisfies the promise for one of two cases when the partial function is defined. The main result is

Theorem 5

[7] Let be a partial function with , and . Then, there exists a total function with and .

Let be the partial function obtained by composing , and on variables each. From the complexities of , and and composition properties of the complexity measures it follows that , and , implying

Theorem 6

[7] There exists a total Boolean function with .

Moreover, if Problem 1 was resolved in affirmative, we could substitute the corresponding instead of FORRELATION and Theorem 5 would imply .

The cheat sheet method also gives new separations betwen and many of combinatorial complexity measures: , , and . Moreover, several of results proven via the pointer function method (for example, the separation) can be reproven via cheat sheets [7].

To show Theorem 5, Aaronson et al. [7] define the cheat-sheet function in a following way. has variables (for an appropriately chosen ) which we denote , (where ). We interpret the blocks of variables as inputs to the function and and the blocks as descriptions for certificates of function , with the description containing both the set of variables and and the values that , must take. (We refer to those blocks as cheat-sheets, as they allow to verify the values of , , with less queries than it takes to compute them.)

We interpret the -bit string , as an index for the block . We define that if the block contains certificates for , , and the values of corresponding input variables in inputs match the ones specified by the corresponding certificate. Otherwise, .

To compute by a quantum algorithm, we proceed as follows:

  1. compute , , , repeating each computation times, to make the error probability at most for each (then, the probability that all are all simultaneously correct is at least 9/10);

  2. check whether the certificates in the block are satisfied by inputs , by using Grover’s quantum search to search for a variable in one of which does not match the corresponding certificate.

The complexity of the stage is . The complexity of the stage is , since we have to search among variables ( certificates, each of which contains variables), Grover’s quantum search [29] allows to search among them by testing possibilities, and testing each possibility requires reading variables in the block . Thus, the overall complexity is quantum queries.

Classically, queries are required to solve instances of . Moreover, if the number of queries is substantially smaller (of an order ), then, with a high probability, most of are not solved yet and, at that point, a classical algorithm cannot make use of certificate descriptions in because there are too many possible . This suggests that and Aaronson et al. [7] show that this is indeed the case.

5.2 Communication complexity

The cheat sheet method has also found applications in a different domain, communication complexity [31, 32]. In the standard model of communication complexity, we have two parties, Alice and Bob, who want to compute a function , with Alice holding the input and Bob holding the input . The task is to compute with the minimum amount of communication between Alice and Bob. Communication complexity has a number of applications, from designing efficient communication protocols for various tasks to proving lower bounds on other models of computation (for example, streaming algorithms).

If quantum communication is allowed, the communication complexity may decrease exponentially. Similarly to query complexity, let , and denote the bounded-error quantum, exact quantum and bounded error randomized communication complexity of . A partial function with an exponential gap between and was first constructed by Raz in 1999 [39]. In a later work, it was shown that quantum protocols can be exponentially more efficient even if the quantum protocol is restricted to one message from Alice to Bob [40] but it is compared against randomized protocols that can send an arbitrary number of messages back and forth.

However, similarly to query complexity, quantum advantages for total functions have been much more limited, with the best known separation of [21, 2] for the set disjointness problem which is the natural communication counterpart of Grover’s search. Anshu et al. [13] have adapted the cheat sheet method to communication complexity, proving

Theorem 7

[13]

  1. There is a total function with ;

  2. There is a total function with ;

6 Quantum-classical separations on almost all inputs?

All known partial functions with a superpolynomial quantum advantage have the property that takes one of values and on a very small subset of inputs. For example, for FORRELATION, the fraction of inputs with is exponentially small in the number of variables . This had led to a following conjecture (known as a folklore since about 1999):

Conjecture 1

[3] Let be a quantum algorithm that makes queries and let . There is a deterministic algorithm with a number of queries that is polynomial in , and and approximates the probability of outputting 1 to an additive error on at least fraction of all inputs.

For total function, this conjecture implies that quantum and deterministic complexity are polynomially equivalent in the setting of approximately computing . That is, for a total function , let and be the smallest number of queries for a (deterministic or quantum) algorithm that outputs the correct answer on at least fraction of inputs . Then, Conjecture 1 implies that and are polynomially related, for all constant with .

There is a natural path towards proving Conjecture 1. Due to Lemma 1, Conjecture 1 is implied by

Conjecture 2

[3] Let be a polynomial of degree which satisfies for all and let . There is a deterministic algorithm with a number of queries that is polynomial in , and and approximates to an additive error on at least fraction of all inputs.

The natural way to design such a deterministic algorithm is by repeatedly choosing the variable that has the biggest influence on the value of (with the influence defined as with the expectation over a random choice of ). To prove Conjecture 2, it suffices to show

Conjecture 3

[3] Let be a polynomial of degree which satisfies for all . Assume that

Then, there is a variable with for some constant .

Conjecture 3 connects with research in the analysis of Boolean functions. In particular, work of Dinur et al. [26] implies a weaker form of the conjecture, with . Improving it to is a challenging open problem which is interesting for both analysis of Boolean functions and quantum query complexity.

7 Structure of quantum speedups?

Another related question is: when can we achieve large quantum speedups? From the known examples of exponential and superexponential speedups for partial functions, we can observe that they are typically achieved for problems with an algebraic structure. For example, Simon [43] showed an exponential speedup for the following problem:

Simon’s problem. Let . We are promised that the input (where ) satisfies one of two promises:

  1. the mapping is 2-to-1 with some such that for all , with denoting bitwise addition modulo 2;

  2. the mapping is 1-1.

As shown by Simon, but . However, randomly permuting inputs turns Simon’s problem into the problem of distinguishing whether is 2-1 or 1-1 for which it is known that but [17, 4], with the exponential quantum speedup disappearing. Similarly, permuting the input variables destroys the superexponential quantum speedup for the FORRELATION problem.

This leads to a question: can we show that quantum speedup is at most polynomial for any partial function that is symmetric with respect to permuting the input variables ? A positive answer would imply that large quantum speedups require problems with a structure (typically, of algebraic nature) that disappears if inputs are permuted.

For the case when ’s are binary, evaluating a partial symmetric function essentially requires counting the number of up to a certain precision (which is sufficient for distinguishing whether the input satisfies or ). Quantum algorithms can count quadratically faster than classical algorithms [18] and it is easy to show that larger speedups cannot be obtained.

For non-binary inputs there are two possible ways of defining a “symmetric function”:

  1. is symmetric, if for any permutation on ;

  2. is symmetric, if for any permutations on and on .

For example, the property of being 1-1 or 2-1 is preserved both if are permuted and if the values for are permuted. Thus, it is symmetric in the second, stronger sense. Similarly, element distinctness (determining whether are all distinct) and other natural properties are symmetric in the second sense. For such properties, we have

Theorem 8

Assume that a partial function is symmetric in the second sense. Then, .

It has been conjectured since about 2000 that a similar result also holds for with a symmetry of the first type.

A related question has been studied by Aaronson and Ben-David [6]: given a total function , can we define a subproblem ( restricted to some subset ) for which ?

For example, if , then, for any restriction, the quantum advantage is at most quadratic. (An intuitive explanation is that computing OR is essentially equivalent to finding and, for search, the quantum advantage is quadratic whatever the number of is.) In contrast, both MAJORITY and PARITY can be restricted so that quantum advantage becomes exponential.

The next theorem gives a full characterization when superpolynomial speedups can be achieved:

Theorem 9

[3] A promise