Introduction to Quantum Information Science
Lecture Notes
Scott Aaronson1
Fall 2018

1 With crucial help from: Corey Ostrove and Paulo Alves

ContentsPage
1 Course Introduction and The Extended
Church-Turing Thesis

7

2 Probability Theory and Quantum Mechanics
2.1 Linear Algebra Approach to Probability Theory . . . . . . . .

11
15

3 Basic Rules of Quantum Mechanics
3.1 Quantum States and The Ket Notation . . . . . . . . . . . . .
3.2 Transforming Quantum States . . . . . . . . . . . . . . . . . .
3.3 Quantum Interference . . . . . . . . . . . . . . . . . . . . . .
3.3.1 Global and Relative Phase . . . . . . . . . . . . . . . .

19
19
21
22
23

4 Quantum Gates and Circuits, Quantum Zeno
and The Elitzur-Vaidman Bomb25
4.1 Quantum Gates . . . . . . . . . . . . . . . . . . . . . . . . . .
25
4.1.1 Generalized Born Rule . . . . . . . . . . . . . . . . . .
26
4.1.2 General Properties of Quantum Gates and Measurements 27
4.2 Quantum Circuit Notation . . . . . . . . . . . . . . . . . . . .
29
4.3 Quantum Zeno Effect . . . . . . . . . . . . . . . . . . . . . . .
32
4.4 The Elitzur-Vaidman Bomb . . . . . . . . . . . . . . . . . . .
32
5 The Coin Problem, Distinguishability, Multi-Qubit Statesand Entanglement
5.1 The Coin Problem . . . . . . . . . . . . . . . . . . . . . . . .
5.2 Distinguishability of Quantum States . . . . . . . . . . . . . .
5.3 Multi-Qubit States and Operations . . . . . . . . . . . . . . .
5.3.1 Multi-Qubit Operations . . . . . . . . . . . . . . . . .
5.3.2 Entanglement . . . . . . . . . . . . . . . . . . . . . . .
2

35
35
36
38
38
40

CONTENTS

3

6 Mixed States
6.1 Mixed States . . . . . . . . . . . . . . . . . . . . . . . . . . .
6.1.1 Density Matrices . . . . . . . . . . . . . . . . . . . . .
6.1.2 Properties of Density Matrices . . . . . . . . . . . . . .
6.1.3 Partial Trace and Reduced Density Matrices . . . . . .

43
43
44
47
48

7 The Bloch Sphere, No-Cloning Theorem andWiesner’s Quantum Money Scheme
7.1 The Bloch Sphere . . . . . . . . . . . . . . . . . . . . . . . . .
7.1.1 Quantum Gates in the Bloch Sphere Representation . .
7.2 The No-Cloning Theorem . . . . . . . . . . . . . . . . . . . .
7.3 Quantum Money . . . . . . . . . . . . . . . . . . . . . . . . .
7.3.1 Wiesner’s Quantum Money Scheme . . . . . . . . . . .

51
51
54
55
57
57

8 Quantum Money and Quantum Key Distribution
8.1 Quantum Money Attacks . . . . . . . . . . . . . . . . . . . . .
8.1.1 Interactive Attacks . . . . . . . . . . . . . . . . . . . .
8.1.2 Public-Key Quantum Money . . . . . . . . . . . . . . .
8.2 Quantum Key Distribution . . . . . . . . . . . . . . . . . . . .

59
59
60
62
62

9 Superdense Coding
9.1 Superdense Coding . . . . . . . . . . . . . . . . . . . . . . . .

66
66

10 Teleportation, Entanglement Swapping, GHZ Stateand The Monogamy of Entanglement
10.1 Quantum Teleportation . . . . . . . . . . . . . . . . . . . . . .
10.1.1 Multi-Qubit Teleportation and Entanglement Swapping
10.1.2 The GHZ State and Monogamy of Entanglement . . .

68
68
71
73

11 Quantifying Entanglement
11.1 Schmidt Decomposition . . . . . . . . . . . . . . . . . . . . . .
11.2 Von Neumann Entropy . . . . . . . . . . . . . . . . . . . . . .
11.2.1 Entanglement Entropy . . . . . . . . . . . . . . . . . .
11.3 Mixed State Entanglement . . . . . . . . . . . . . . . . . . . .

76
77
77
78
80

12 Interpretations of Quantum Mechanics
12.1 The Copenhagen Interpretation . . . . . . . . . . . . . . . . .
12.1.1 “Shut Up and Calculate” . . . . . . . . . . . . . . . . .
12.2 Schrödinger’s Cat and Wigner’s Friend . . . . . . . . . . . . .
12.3 Dynamical Collapse . . . . . . . . . . . . . . . . . . . . . . . .
12.3.1 Ghirardi-Rimini-Weber (GRW) Theory . . . . . . . . .

83
84
84
85
86
88

4

CONTENTS
12.3.2 Penrose Theory . . . . . . . . . . . . . . . . . . . . . .
12.4 The Many-Worlds Interpretation . . . . . . . . . . . . . . . .

88
91

13 Hidden Variables and Bell’s Inequality
13.1 Hidden Variable Theories . . . . . . . . . . . . . . . . . . . . .
13.1.1 Bohmian Mechanics . . . . . . . . . . . . . . . . . . .
13.1.2 Local Hidden Variable Theories . . . . . . . . . . . . .
13.2 The CHSH Game . . . . . . . . . . . . . . . . . . . . . . . . .

97
97
97
99
100

14 Nonlocal Games
104
14.1 CHSH Game: Quantum Strategy . . . . . . . . . . . . . . . . 104
14.1.1 Analysis of Protocol . . . . . . . . . . . . . . . . . . . 105
14.1.2 CHSH Game: Interpretations and Local Realism . . . . 107
14.1.3 Tsirelson’s Inequality . . . . . . . . . . . . . . . . . . . 108
14.1.4 Experimental Tests of Bell’s Inequalities . . . . . . . . 110
14.2 The Odd Cycle Game . . . . . . . . . . . . . . . . . . . . . . . 112
14.3 The Magic Square Game . . . . . . . . . . . . . . . . . . . . . 114
15 Einstein-Certified Randomness
116
15.1 Guaranteed Random Numbers . . . . . . . . . . . . . . . . . . 116
15.1.1 Leashing Quantum Systems . . . . . . . . . . . . . . . 120
16 Quantum Computing and Universal Gate Sets
121
16.1 Complexity of General Unitaries: Counting Argument . . . . . 124
16.2 Universal Gate Sets . . . . . . . . . . . . . . . . . . . . . . . . 126
16.2.1 Classical Universality . . . . . . . . . . . . . . . . . . . 126
16.2.2 Quantum Universality . . . . . . . . . . . . . . . . . . 128
16.2.3 The Solovay-Kitaev Theorem . . . . . . . . . . . . . . 130
17 Quantum Query Complexity and The Deutsch-Josza Problem132
17.1 Quantum Query Complexity . . . . . . . . . . . . . . . . . . . 133
17.2 Quantum Garbage Collection . . . . . . . . . . . . . . . . . . 135
17.3 Deutsch’s Algorithm . . . . . . . . . . . . . . . . . . . . . . . 138
17.4 Deutsch-Josza Algorithm . . . . . . . . . . . . . . . . . . . . . 139
18 Bernstein-Vazirani and Simon’s Algorithm
142
18.1 The Bernstein-Vazirani Problem . . . . . . . . . . . . . . . . . 142
18.1.1 Quantum Algorithm . . . . . . . . . . . . . . . . . . . 142
18.2 Simon’s Problem . . . . . . . . . . . . . . . . . . . . . . . . . 144
18.2.1 Classical Lower Bound . . . . . . . . . . . . . . . . . . 146
18.2.2 Quantum Algorithm . . . . . . . . . . . . . . . . . . . 147

CONTENTS

5

19 RSA and Shor’s Algorithm
151
19.1 RSA Encryption . . . . . . . . . . . . . . . . . . . . . . . . . 151
19.2 Period Finding . . . . . . . . . . . . . . . . . . . . . . . . . . 153
19.2.1 Factoring to Period-Finding Reduction . . . . . . . . . 154
19.2.2 Quantum Algorithm for Period-Finding . . . . . . . . . 157
20 Quantum Fourier Transform
159
20.1 Quantum Fourier Transform . . . . . . . . . . . . . . . . . . . 159
20.1.1 Implementing the QFT . . . . . . . . . . . . . . . . . . 162
20.1.2 Period Finding Using the QFT . . . . . . . . . . . . . 165
21 Continued Fractions and Shor’s Algorithm Wrap-Up
169
21.1 Continued Fraction Algorithm . . . . . . . . . . . . . . . . . . 170
21.2 Applications of Shor’s Algorithm . . . . . . . . . . . . . . . . 172
21.2.1 Graph Isomorphism . . . . . . . . . . . . . . . . . . . . 173
21.2.2 Lattice-Based Cryptography . . . . . . . . . . . . . . . 173
22 Grover’s Algorithm
175
22.1 The Algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . 177
22.1.1 Implementing the Diffusion Operator . . . . . . . . . . 180
22.1.2 Geometric Interpretation . . . . . . . . . . . . . . . . . 181
22.1.3 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . 182
22.1.4 Multiple Marked Items . . . . . . . . . . . . . . . . . . 185
23 BBBV Theorem and Applications of Grover’s Algorithm
189
23.1 The BBBV Theorem . . . . . . . . . . . . . . . . . . . . . . . 189
23.2 Applications of Grover’s Algorithm . . . . . . . . . . . . . . . 195
23.2.1 OR of ANDs . . . . . . . . . . . . . . . . . . . . . . . 195
24 More Grover Applications and Quantum Complexity Theory199
24.1 More Applications of Grover’s Algorithm . . . . . . . . . . . . 199
24.1.1 The Collision Problem . . . . . . . . . . . . . . . . . . 199
24.1.2 Element Distinctness . . . . . . . . . . . . . . . . . . . 201
24.2 Parity Lower Bound . . . . . . . . . . . . . . . . . . . . . . . 203
24.3 Quantum Complexity Theory . . . . . . . . . . . . . . . . . . 204
25 Hamiltonians
207
25.1 Quantum Algorithms for NP-complete Problems . . . . . . . 207
25.2 Hamiltonians . . . . . . . . . . . . . . . . . . . . . . . . . . . 208
25.2.1 Matrix Exponentiation . . . . . . . . . . . . . . . . . . 209
25.2.2 Energy . . . . . . . . . . . . . . . . . . . . . . . . . . . 212

6

CONTENTS
25.2.3 Tensor Products of Hamiltonians . . . . . . . . . . . .
25.2.4 Addition of Hamiltonians . . . . . . . . . . . . . . . .

216
216

26 The Adiabatic Algorithm
221
26.1 Local Hamiltonians . . . . . . . . . . . . . . . . . . . . . . . . 221
26.2 The Adiabatic Algorithm . . . . . . . . . . . . . . . . . . . . . 223
27 Quantum Error Correction234
27.1 Classical Error Correction . . . . . . . . . . . . . . . . . . . . 235
27.1.1 Classical Fault-Tolerance . . . . . . . . . . . . . . . . . 237
27.2 Quantum Error Correction . . . . . . . . . . . . . . . . . . . . 238
27.2.1 The Shor 9-Qubit Code . . . . . . . . . . . . . . . . . 242
27.2.2 Quantum Fault Tolerance . . . . . . . . . . . . . . . . 247
28 The Stabilizer Formalism249
28.1 The Gottesman-Knill Theorem . . . . . . . . . . . . . . . . . 253
28.1.1 The Gottesman-Knill Algorithm . . . . . . . . . . . . . 254
28.2 Stabilizer Codes . . . . . . . . . . . . . . . . . . . . . . . . . . 257
28.2.1 Transversal Gates . . . . . . . . . . . . . . . . . . . . . 259

Lecture 1: Course Introduction
and The Extended Church-Turing
ThesisI Quantum Information Science is an inherently interdisciplinary field (Physics,

CS, Math, Engineering, Philosophy)
I It’s not just about inventing useful devices and algorithms, but also

about clarifying the workings of quantum mechanics.
– We use it to ask questions about what you can and can’t do withquantum mechanics– It can help us better understand the nature of quantum mechanics
itself.
I Professor Aaronson is very much on the theoretical end of research.
I Theorists inform what experimentalists make, which in turn informs theorists’ queries
Today we’ll articulate several “self-evident” statements about the physicalworld. We’ll then see that quantum mechanics leaves some of these statements
in place, but overturns others—with the distinctions between the statements
it upholds and the ones it overturns often extremely subtle! To start with. . .
Probability (P ∈ [0, 1]) is the standard way of representing uncertainty inthe world. Probabilities have to follow certain axioms such as:
I Given a set of n mutually exclusive exhaustive events, the sum of the...

probabilities satisfies P1 + P2 + · · · + Pn = 1
I The probability of any particular event satisfies Pi ≥ 0

7

8

LECTURE 1. COURSE INTRODUCTION AND THE ECTThere’s a view that “probabilities are all in our heads.”
Which is to say that if we knew everything about the universe (let’s say position/velocity of all atoms in the solar
system) that we could just crunch the equations and seethat things either happen or they don’t.

Let’s suppose we have two points separated bya barrier with an open slit, and we want to measure
the probability that a particle goes from one point to
the other. It seems obviously true that increasing thenumber of paths (say, by opening another slit) should
increase, or at any rate not decrease, the likelihoodthat it will reach the other end. We refer to thisproperty by saying that probabilities are monotone.
Locality is the idea that things can only propagate
through the universe at a certain speed. When we
update the state of a little patch of space, it should
only require knowledge of a small neighborhood around it. Conway’s GameOf Life (left) is a good model here: changes you make to the system can affectit, but since each cell only directly interacts with its nearest neighbors thechanges only propagate at a certain speed.
In physics, locality naturally emerges due toEinstein’s Special Theory of Relativity which implies that no signal can propagate faster thanthe (finite) speed of light; this simple principle can explain a large number of physical phenomena. In special relativity anything traveling faster than the speed of light would be effectively traveling backwards in time, from someobserver’s standpoint.
Local Realism is the principle that any instantaneous update in knowledge about faraway events can be explained bycorrelations of random variables. For example, if you in Austin and a friend
in San Francisco both subscribe to the same newspaper then when you readyour copy in the morning your knowledge of the headline on your friend-inSan-Francisco’s copy instantly collapses to whatever your copy’s headline is.
Before picking up the copy in the morning your knowledge of the headline
for yourself and your friend may have been best described by a probability

9
distribution over various possibilities, but since the outcomes are perfectly
correlated, as soon as you learn the headline on your copy you instantly knowthat your friend’s must be the same.
Some popular science articles talk about how if you measure
the spin of one particle then instantaneously you can know
the spin of another particle on the other side of the galaxy.
But unless and until something more is said about it, that’s
no different from the case of the newspapers and seems
100% compatible with local realism!

Church-Turing Thesis The Church-Turing Thesis states that every physical process can be simulated by a Turing machine to any desired precision.
The way that Church and Turing understood this was as a definition of computation, but we can think of it instead as a falsifiable claim about the physicalworld. You can think about this as the idea that the entire universe is sort ofa gigantic video game: you’ve got all sorts of complicated things, like quarks
and black holes and whatnot, but at the end of the day you’ve got to beable to simulate it on a computer. The Extended Church-Turing Thesis
says moreover that, when we simulate reality on a digital computer, there’s atmost a polynomial (e.g., linear or quadratic) blowup in time, space, and othercomputational resources.
Theoretical computer science courses can be seen as basically math courses. So what does connect them to reality?
The Church-Turing Thesis.
So, what does quantum mechanics have to say about each of these principles? To give you a teaser for much of the rest of the course:
I We’ll still use probabilities. But the way we’ll calculate probabilities will

be totally different, and will violate the axiom of monotonicity. That is,increasing the number of ways for an event to happen, can decrease theprobability that it happens.
I Locality will be upheld.

But Local Realism will be overthrown. And
if those two principles sounded like restatements of each other—well,quantum mechanics will dramatically illustrate the difference between
them!

10

LECTURE 1. COURSE INTRODUCTION AND THE ECTI As we’ll see, the Church-Turing Thesis still seems to be in good shape,even in light of quantum mechanics, but the Extended Church-Turing
Thesis seems to be false, with quantum computing standing as a glaring
counterexample to it—possibly the one counterexample that our laws ofphysics allow. With that said, however, one can formulate a quantum
version of the Extended Church-Turing Thesis, which remains true as
far as anyone knows today.
You could imagine other possible counter-examples to the
Extended Church-Turing Thesis. For instance, some haveproposed that by using time dilation you could travel billionsof years in the future and get results to hard problems. Fun!
But you’d need a LOT of energy, and if you have thatmuch energy in one place you collapse to a black hole. Not
so fun!

Lecture 2: Probability Theory
and Quantum Mechanics
The famous theoretical physicist Richard Feynman said that everything about
quantum mechanics could be encapsulated in the Double Slit Experiment.
In the double-slit experiment, you shoot photons one at a time toward a wallwith two narrow slits. Where each photon lands on a second wall is probabilistic. If we plot where photons appear on the back wall, some places arevery likely, some not. In Figures 2.1 – 2.3 you can see diagrams showing
the basic experimental set-up and results from performing both single-slit anddouble-slit experiments with photons.
Note that some places on the screen being likely and others unlikely inand of itself isn’t the weird part: we could totally explain this by some theory
where each photon just had some extra degree of freedom (an “RFID tag”)
that we didn’t know about, and that determined which way it went. What’s
weird is as follows. For some interval on the second wall:
Let P be the probability that the photon lands in the interval with both
slits open.
Let P1 be the probability that the photon lands in the interval if only
slit 1 is open.
Let P2 be the probability that the photon lands in the interval if only
slit 2 is open.
You’d think that P = P1 + P2 . But experiment finds that that’s not the
case! Even places that are never hit when both slits are open, can sometimes
be hit if only one slit is open.
The weirdness isn’t that “God plays dice,” but rather that“these aren’t normal dice”!

11

12

LECTURE 2. PROBABILITY THEORY AND QM

Figure 2.1: Experimental setup for asingle-slit photon interference experiment

Figure 2.2: Experimental setup for a
double-slit photon interference experiment

Figure 2.3: Comparison of single-slit and double-slit interference patterns as
seen in an actual experiment. Notice in the double-slit pattern the appearanceof new dark spots (areas with a low probability of a photon landing there) notseen for the single-slit.

13
You may think to measure which slit the photon went through, but doing
so changes the measurement results into something that makes more sense,with just two bright patches, one for each slit. Note that it isn’t importantwhether there’s a conscious observer: if the information about which slit thephoton went through leaks out in any way into the outside environment, theresults go back to looking like they obey classical probability theory.
As if Nature says “What? Me? I didn’t do anything!”

Figure 2.4: Double-slit experiment with measuring devices on each slit whichmeasure which slit any given photon passes through. In this case the probability distribution looks like the average of the individual single slit distributions.
This reversion to classical probability theory when systems are coupled totheir environments is called decoherence. Decoherence is why the usual lawsof probability look like they work in everyday life. A cat isn’t found in asuperposition of alive and dead states, because it interacts constantly with its
environment. These interactions essentially leak information about the ‘cat
system’ out. Quantum superposition is something that happens to particles,
or groups of particles, when they’re isolated from their environments. Needing
the particles to be isolated is why it’s so hard to build a quantum computer.
And what if the particles aren’t perfectly isolated, but
merely mostly isolated? Great question! We’ll come backto it later in the course.
The story of atomic physics between roughly 1900 and 1926 is that scientists kept finding things that didn’t fit with the usual laws of mechanics
or probability. They often came up with hacky solutions that explained a

14

LECTURE 2. PROBABILITY THEORY AND QM

phenomenon without connecting it to much else. That is, until Heisenberg,
Schrödinger, etc. came up with the general rules of quantum mechanics.
Briefly, though, take the usual high schoolmodel of the electron, rotating around a nucleus in a fixed orbit. Scientists realized that
this model would mean that the electron, as
an accelerating electric charge, would be constantly losing energy in the form of radiationand spiraling inwards until it hit the nucleus.
To explain how the electron orbits could remain stable, along with the double-slit experiment and countless other phenomena, physicists eventually had to change the way probabilities were calculated.
Instead of using probabilities P ∈ [0, 1], they started using amplitudes
α ∈ C. Amplitudes can be positive or negative, or more generally complex
numbers (with real and imaginary parts). The central claim of quantum mechanics is that to fully describe the state of an isolated system, you needto give one amplitude for each possible configuration that you could find thesystem in on measuring it.
The Born Rule says that the probability you see a particular outcome isthe squared absolute value of the amplitude:
P = |α|2 = Re(α)2 + Im(α)2(2.1)

So let’s see how amplitudes being complex leads them to act differently
from probabilities. Let’s revisit the double-slit experiment using amplitudes.
We’ll say that:Let α the total amplitude of a photon landing in a certain spot on thescreen,α1 the amplitude it lands in the spot if only slit 1 is open and,α2 the amplitude it lands in the spot if only slit 2 is open.
By analogy to classical probability we have
α = α1 + α2

(2.2)

Then from the Born rule, Equation 2.1, we have
P = |α|2 = |α1 + α2 |2 = |α1 |2 + |α2 |2 + α1∗ α2 + α1 α2∗ .

(2.3)

2.1. LINEAR ALGEBRA APPROACH TO PROBABILITY THEORY

15

If, for example, α1 = 1/2 and α2 = −1/2, then we find P = 0 if both slits
are open but, P = 1/4 if only one slit is open; This phenomenon is known asinterference.
So then, to justify the electron not spiraling into the nucleus we can say
that, yes, there are many paths where the electron does do that, but somehave positive amplitudes and others have negative amplitudes and they end
up canceling each other out.
With some physics we won’t cover in this class, you’d discover that the possibilities where amplitudes don’t cancel
each other out lead to discrete energy levels, which are theplaces where the electrons can sit. The phenomenon of discrete energy levels is in turn what leads to chemistry.

2.1

Linear Algebra Approach to Probability
TheoryWe use Linear Algebra to model the states of systems as vectors and theevolution of systems in isolation as transformations of vectors. In the simplest
case, for a system with two states, we could write   0aa
M 1 = 10 .
a2
a2

(2.4)

For now, we’ll consider classical probability. Let’s look at flipping a coin.
We model this with a vector assigning a probability to each possibility: p =P (heads) and q = P (tails).
 pq

p, q ≥ 0
p+q =1(2.5)

We can apply a transformation, like turning the coin over.


0 1
1 0

   
p
q
=
q
p

(2.6)

Turning the coin over means the probability that the coin was heads is
now the probability that the coin is tails. If it helps, you can think of the

16

LECTURE 2. PROBABILITY THEORY AND QM

transformation matrix as:
P (heads|heads) P (heads|tails)
P (tails|heads) P (tails|tails)(2.7)

where P (a|b) is the conditional probability for the state of the coin to be “a”
given that it was previously in the state “b.” We could also flip the coin fairly.
1
2
1
2

1
2
1
2

   1
p
= 21
q
2

(2.8)

Which means that regardless of previous state, both possibilities are now
equally likely. Let’s say we flip the coin, and if we get heads we flip again, but
if we get tails we turn it to heads.
  
q + p2
1 p
=
p
0 q
2

1
2
1
2

(2.9)

Does this make sense? Since if the state of the coin is found to be heads we
do a fair flip we can see that given it’s heads the probability after we do theflip for heads or tails is 21 . That is, P (heads|heads) = P (tails|heads) = 21 . If
we see a tails however we always flip it back to heads and so P (tails|tails) = 0
and P (heads|tails) = 1.
So, which matrices can be used as transformations? Firstly, we know that
all entries have to be non-negative (because probabilities can’t be negative).
We also know that each column must sum to 1, since we need the sum of initialprobabilities to equal the sum of the transformed probabilities (namely, bothshould equal 1). A matrix that satisfies these conditions is called a Stochastic
Matrix.
Now let’s say we want to flip two coins, or rather, two bits. For the first
bit a = P (0) and b = P (1). For the second let c = P (0) and d = P (1).
 
a
1 b
0

 
c
1 d
0

To combine the two vectors we need a new operation, called Tensor Product:  P (00)ac   ac
P (01) ad⊗=P (10) =  bc bd
P (11)
bd(2.10)

2.1. LINEAR ALGEBRA APPROACH TO PROBABILITY THEORY

17

It’s worth noting that not all possible 4-element vectors can arise by thetensor product of two 2-element vectors. For example, suppose by contradiction that
 1
ac
2
ad  0 
  =  .
 bc   0 
1
bd
2


(2.11)

Then multiplying the first and last equations together implies that (ac)(bd) =1, while multiplying the second and third implies that (ad)(bc) = 0, giving a4
contradiction. As such, the 4-element vector on the right hand side can’t bewritten as the tensor product of two 2-element vectors.
As we did with the one-bit systems, we can describe probabilistic transformations of two-bit systems using stochastic matrices. For example, let’s say
we apply a transformation where if the first bit is 1 then we flip the second bit
and otherwise we do nothing to the system. The 4 × 4 matrix that achieves
this is given in Equation 2.12, and is called the Controlled NOT or CNOT
matrix; it will also come up often in quantum computing.
00

01

10

11

1

01 0
CNOT = 
10 0
11 0

0
1
0
0

0
0
0
1


0
0

1
0



00

(2.12)

Suppose we apply the CNOT matrix to the following vector, representing asystem where the first bit is either zero or one with 21 probablity and the second
bit is always 0:


1
0

0
0

0
1
0
0

0
0
0
1

 1
0
2
0
0
  =
1  12 
0
0

1

00

2
01 0  

10 0 1
11
2

(2.13)We see that we’ve reached an output distribution that we previously proved
can’t arise as a tensor product! Such a distribution is called correlated :learning one bit tells you something about the other bit. In this case, thetwo bits are always equal; with 50% probability they’re both 0 and with 50%
probability they’re both 1. So, we’ve learned that the CNOT matrix can create

18

LECTURE 2. PROBABILITY THEORY AND QM

correlations: it can transform an uncorrelated distribution into a correlatedone.
Quantum mechanics essentially follows the same process to model statesusing vectors, except that it uses amplitudes instead of probabilities. We candescribe transformations of vectors representing quantum states using matrices.
   a1b1
 U  a2  = b2 (2.14)a3b3
where instead of preservingP
the sum of theP3 vector2 entries we preserve the sum
32of the squared-amplitudes i=1 |ai | = i=1 |bi | = 1, which by Equation 2.1(the Born rule) implies that the probabilities of the outcomes sum to 1. Suchmatrices are called Unitary Matrices, and in the next lecture we’ll describe
their properties as well as the basic mathematical rules for handling quantum
states in much greater detail.

Lecture 3: Basic Rules of Quantum Mechanics
3.1

Quantum States and The Ket Notation

A quantum state (technically, a “pure state”) is a unit vector in CN describing
the state of a quantum system. The dimension, N , could theoretically beanything. Physics courses cover infinite-dimensional quantum states such as
position or momentum states, but we’ll stick to discrete systems (which is to
say that when we make a measurement, there are only finitely many possible
outcomes).
What does quantum mechanics say about the universe being discrete or continuous at its most basic level? It suggests a strange, hybrid picture. Even fora simple two dimensional system there’s a continuum of
possible quantum states, but every measurement has a discrete outcome. A system with two amplitudes, [α, β]> , has
uncountably infinitely many possible states (even with therestriction that |α|2 + |β|2 = 1), though note that the same
would be true even if we described states using classicalprobabilities. In both cases, classical and quantum, as longas we stick to finite-dimensional systems the continuum isnever directly observed, but is only used in calculating theprobabilities of discrete outcomes.
A qubit is the simplest interesting quantum system. It’s a two-level system(we label the levels “0” and “1”), with an amplitude for 0 and an amplitude
for 1.
A one-level quantum system would just be [1]. Not very
19

20

LECTURE 3. BASIC RULES OF QM
interesting!

Following the notation introducted by Paul Dirac, we write quantum statevectors using the so-called Ket Notation α= α |0i + β |1i = |ψi .
β
 
 
1
0
Note that |0i =and |1i =, and that we’ll often use |ψi to refer01
generically to a quantum state.
Why do we use the ket notation? One main advantage is that practicallyspeaking, we often deal with really sparse vectors (where most amplitudes
are 0). Ket notation makes it easy to represent only the values we’re talking
about.
It’s really just a formalism to make life easier, we can put
anything in ket notation.
Look, this is Schrödinger’s Cat

1
i+|
i .
in ket notation: √2 |Another motivation for adopting the ket notation is that it simplifies manyof the linear algebra operations we use frequently in quantum mechanics. Often, for example, we’ll need to take the transpose (or conjugate transpose forcomplex-valued vectors):
 


α
→ α∗ β ∗βand we can use these conjugate-transposed vectors to define a norm on our
vector space  ∗ ∗ α2||v|| = α β= |α|2 + |β|2(3.1)
β
In ket notation both of these operations can easily be represented. The
conjugate-transpose of a ket, |ψi = α |0i + β |1i, is represented by a corresponding object called a bra hψ| wherehψ| = α∗ h0| + β ∗ h1| .
We can also use the bra as we’ve just defined it to write the inner productbetween a pair of kets, |xi and |yi, as hx|yi. The norm of the ket |ψi in thisnotation is ||ψ||2 = hψ|ψi. The inner product as its been defined here has the3.2. TRANSFORMING QUANTUM STATES

21

property that hx|yi = hy|xi∗ . Note that we’ll be adopting the physics convention of denoting the conjugate-transpose with the † symbol (read dagger).
The set of all possible pure quantum states of a qubit with real coefficientsdefines a circle. The set of all possible quantum states with complex coefficientsdefines a sphere known as the Bloch sphere, which we will learn about ingreater detail in a later lecture. In addition to the states |0i and |1i (known as
the “standard basis states”) there are four other single qubit states that occur
so frequently in quantum information theory that they’ve been given specialnames:|0i + |1i√2|0i − |1i|−i = √
2|0i + i |1i
√
|ii =
2
|0i − i |1i√|−ii =
2
|+i =

(3.2)

Figure 3.1:
Standard andHadamard basis states respresented on the real plane.
The pair {|+i , |−i} is often referred to as the “Hadamard basis.” Figure 3.1
shows the positions of the standard and Hadamard basis states in the real
plane.

3.2

Transforming Quantum States

Just like with classical probability theory, one basic way to change quantum
states is by applying linear transformations.
   0αα
U |ψi = U= 0ββIn order for a linear transformation to correspond to a valid transformation ofa quantum state, we require that it be unitary. A transformation on a single

22

LECTURE 3. BASIC RULES OF QM

qubit, U , is unitary if |α|2 + |β|2 = |α0 |2 + |β 0 |2 for all input vectors [α, β]> . In
other words, U preserves the 2-norm of the vector.
Examples of 1-Qubit Unitary Transformations












1 0
0 1
1 0


0 1
1 0
0 i
Identity NOT Gate Relative Phase Shift







cos (θ) − sin (θ)sin (θ) cos (θ)
2D-Rotations(3.3)

The second-to-last unitary matrix above has the effect of mapping |0i → |0i
and |1i → i |1i; in fact, we can replace the i in this matrix with any unit
magnitude complex number of the form eiθ . Remember Euler’s equation,eiθ = cos (θ) + i sin (θ).

(3.4)

Rotations also preserve the 2-norm of vectors and so for example, we can use
the last matrix above to rotate our state in the real plane by some specified
angle θ (we denote this family of matrices Rθ ).
Since a unitary matrix, U , preserves the 2-norm of vectors it immediately
follows that it must also preserve the value of the inner product hψ|ψi. This
gives the following series of equalities hψ|ψi = (|ψi)† |ψi = (U |ψi)† U |ψi =hψ| U † U |ψi. This can only be true for all |ψi if U † U = I, which implies thatfor a unitary matrix U −1 = U † . It also implies that the rows of U must be an
orthogonal unit basis. Conversely, it’s easy to see that if U −1 = U † then U
is unitary. So you can tell if a matrix is unitary by checking if U † U = I, or
equivalently if the rows (or the columns) form an orthogonal unit basis.
This is not the “operational definition” of unitary matrices, but is a logical consequence of unitary transformations
preserving the 2-norm.
An orthogonal matrix is both unitary and real-valued. Any orthogonal
matrix is a product of rotations and reflections. For example, the matrix
Rπ/4 is orthogonal. Applying Rπ/4 repeatedly to the input state |0i gives thesequence of states |0i → |+i → |1i → − |−i · · · . You’ll get a full revolution
after applying Rπ/4 eight times.

3.3

Quantum Interference

In the classical world, if an event could happen multiple ways, but will be“random” no matter which way it happens, then it’s simply “random” overall.

3.3. QUANTUM INTERFERENCE

23

But in the quantum world, you can sometimes apply a unitary transformation
to a superposition state and get a determinate answer, even though the answer
would have been random had you applied it to any individual component of thesuperposition. Many of the most interesting phenomena in quantum mechanics
can be explained in terms of quantum interference. As an illustrative
example, suppose we start initially in the |0i state. We then apply twice a√
unitary transformation which when applied to |0i places us in |+i = |0i+|1i2√
and which when applied to |1i places us in |−i = |0i−|1i. This situation drawn
2
in Figure 3.2.

Figure 3.2: Diagram showing effect of applying a unitary operation whichmaps |0i → |+i and |1i → |−i.
To get the amplitude associated with a particular path we take the productof the amplitudes along that path. Then to get the final amplitude associatedwith a particular output, we sum the amplitudes for each of the paths throughthe tree leading to that output. In this case, the amplitude of |0i is 1 and theamplitude of |1i is 0. The paths leading to |0i interfere constructively while
the paths leading to |1i interfere destructively.

3.3.1

Global and Relative Phase

No matter what unitary transformation you apply, because it is a linear operation we always have that U (− |0i) = −U |0i or more generally U (c |0i) = cU |0i
for any constant c. When c is a unit magnitude complex number (i.e. it canbe written in the form eiθ for some θ) we call it a global phase. The states|ψi and eiθ |ψi are physically indistinguishable, which is to say: Global phase

24

LECTURE 3. BASIC RULES OF QM

is unobservable! Multiplying your entire quantum state by a scalar is like iflast night someone moved the entire universe twenty feet to the left. We canonly really measure things relative to other things!
But this leads to a second maxim: Relative phase is observable. To distinguish between the states |+i and |−i which were defined in Equation 3.1, forexample, we can rotate by 45 degrees (by applying Rπ/4 , perhaps) and thenmeasure to see whether we got |0i or |1i (see Figure 3.1). The relative phasedifference between the states |+i and |−i is observable precisely because there
is a sequence of unitary operations and measurements (an experiment) that
we can perform to distinguish between the two cases. For global phases there
is no experiment one could ever do which would distinguish between |ψi andeiθ |ψi.

Lecture 4: Quantum Gates andCircuits, Quantum Zeno and The
Elitzur-Vaidman Bomb
4.1

Quantum Gates

In quantum information theory we often refer to small unitary transformations
as “gates.” We use some of these gates so often that they have special
 names
0 1
and symbols associated with them. For example, the matrix
is called
1 0√
the NOT gate. One can also define a NOT gate,
√
1 1+i 1−i
NOT =
,
(4.1)
2 1−i 1+i√√
which you can check satisfies the property that NOT NOT = NOT. Oneof the most ubiquitous gates in quantum information is the Hadamard gate


1 1 1
H=√
2 1 −1(4.2)

The Hadamard gate is so useful because it maps the {|0i , |1i} basis to the{|+i , |−i} basis, and vice versa.
  " 1 #
√
1 1 1
1
= √12 = |+i
H |0i = √2 1 −1 0
2

Similarly, H |1i = |−i, H |+i = |0i and H |−i = |1i. Note that the{|0i , |1i} basis and {|+i , |−i} basis form different two different orthogonal(and complementary) bases with the special property that being maximally
25

26

LECTURE 4. QUANTUM GATES, CKTS, ZENO AND E-V BOMB

certain in the {|0i , |1i} basis means that you’re maximally uncertain in the{|+i , |−i} basis and vice versa. Another example of a basis changing gate is


1 1 1
√
.
(4.3)
2 i −iThis one switches us from the {|0i , |1i} basis to the {|ii , |−ii} basis. Why
would we want to use multiple bases? We like to think of vectors existing
abstractly in a vector space, but to do computations we often need to pick a
convenient basis. When we see some actual quantum algorithms and protocols,
we’ll see the power that comes from switching between bases.

4.1.1

Generalized Born Rule

We can define quantum measurement more generally. Measuring the state |ψiin the orthonormal basis {|V0 i , · · · , |VN −1 i}, you’ll get the outcome |Vi i withprobability | hVi |ψi |2 . So the probability of the outcome |Vi i is the squared
length of the projection onto that basis vector.
When talking about the Born Rule in earlier lectures, we’vebeen using the special case of the {|0i , |1i} basis for simplicity.
To implement a measurement in an arbitrary basis, you can use unitarytransformations to convert between bases. So for example, to measure in the{|V0 i , · · · , |VN −1 i} basis, you can first apply a unitary transformation U suchthat U |V0 i = |0i, U |V1 i = |1i, etc. . . , and then measure in the standard basis{|0i , · · · |N − 1i}.
There’s an extreme point of view in quantum mechanics
that unitary transformations are the only thing that reallyexist, and measurements don’t. And the converse also exists: the view that measurements are the only things thatreally exist, and unitary transformations don’t. More about
this when we talk about interpretations!

4.1. QUANTUM GATES

4.1.2

27

General Properties of Quantum Gates and Measurements

Unitary Transformations are:
I Invertible: This should be clear, since preserving the 2-norm means thatU † U = I which means U −1 = U † .
– In other words, the transformation |ψi → U |ψi can always bereversed by applying U † , since U † U |ψi = |ψi.
Interestingly this implies that unitary evolution
can never destroy information, which should imply that the universe is reversible. Physics hastreated the microscopic laws as reversible since
Galileo’s time (e.g. a time-reserved video ofa swinging pendulum still shows it obeying thelaws of physics). So for example burning a bookshouldn’t destroy the information within, as physics
says that in principle you can recover all the information from the smoke and ash left over.
I Deterministic: There is nothing probabilistic in the unitary evolution

process itself.
I Continuous: Unitary transformations take place over intervals of time
which can always be broken into smaller and smaller subintervals.
This last item is part of why it’s important that unitary matrices
 are in gen1 0
eral complex-valued. If, for example, the transformation
was applied
0 −1
by some process which took 1 second, then by applying the same process for
1 0
half of a second, we can obtainor some other square root of the trans0 i
1 0formation. But we invite you to check thathas no 2 × 2 real-valued
0 −1
square root.
By the way, if we allow ourselves the ability
 to add
 an extra dimension
1 0
then there is a 3 × 3 matrix that “squares” to
:
0 −1

2 

1 0 0
1 0
0
0 0 1 = 0 −1 0  .
0 −1 00 0 −1

28

LECTURE 4. QUANTUM GATES, CKTS, ZENO AND E-V BOMB


1 0
But, to take a square root of, either you need complex numbers, or
0 −1else you need to add a third dimension. The latter is analogous to reflecting
your three-dimensional self by rotating yourself in a fourth dimension—as insome science fiction stories!
Important: If you come back reflected after a trip into thefourth dimension, don’t eat anything without first consulting medical professionals. Normal food will have moleculesof the wrong chirality for you to digest them.
Measurements break all three rules of unitary transformations! Measurements are:
I Irreversible: Whatever information about the system you didn’t capture

is now lost.
I Probabalistic: Everything in quantum mechanics is deterministic until
measurement, but measurement outcomes are in general random.
I Discontinuous: The “collapse of the amplitude vector” is conventionallytreated as an instantaneous event.
So how can we reconcile these two sets of rules? That’s the famous Measurement Problem; we’ll talk about various points of view on it later. Despite the philosophical conflict, unitary transformations and measurement sync
up well because unitary transformations preserve the 2-norm and measurement
gives probabilities determined by the 2-norm.
Classical probability is based on the 1-norm, while quantum mechanics is based on the 2-norm. So it’s natural towonder: what about theories based on the 3-norm, 4-norm,
etc. . . ? Actually, there don’t seem to be any interesting
theories there, making quantum mechanics a bit of “an island in theory space.” If you try to adjust anything about
it in any way, you typically get junk! You could alternatively say that there seems to be “nothing near quantum
mechanics, that’s nearly as nice as quantum mechanics itself.” Another example of this are some of the (somewhat
technical) reasons why complex numbers work better than
the reals, or for that matter quaternions, as amplitudes.

4.2. QUANTUM CIRCUIT NOTATION

4.2

29

Quantum Circuit Notation

Quantum Circuit Notation gives us a graphical language to keep trackof which qubits we have, which operations we’re applying to them and inwhich order. In a quantum circuit diagram we use wires to represent qubits,
and labeled boxes and other symbols to represent unitary transformations on
those qubits. When reading a quantum circuit diagram we interpret time
(typically thought of as occurring in discrete time-steps) as flowing from left
to right. Say for example we want to represent a single qubit, initialized to the|1i state, which has two consecutive Hadamard gates applied to it, followed
by a measurement in the standard basis. This can be represented using thecircuit diagram below.

|1i

H

H

Figure 4.1: Quantum circuit representing two Hadamard gates followed by ameasurement on a qubit initialized to the |1i state.
The operations in Figure 4.1 are simple enough that we’d have no trouble
writing out the matrices and vectors explicitly, but as we add more qubits
to our system and allow for multi-qubit operations, matrix representations
quickly become unwieldy (see the final two gates in Table 4.1). Quantum circuits give us a tool for succinctly describing all manner of complicated quantum
transformations.
Quantum circuits allow for operations on an arbitrary number of qubits.
Here is a circuit containing a two-qubit gate, labeled U , which is followed bya Hadamard on the first qubit and then measurements on both qubits.

|0i
|0i

H
U

Figure 4.2: A generic two qubit operation followed by a Hadamard on the first
qubit and a pair of measurements.
In some contexts it is useful to allow our circuits to have some additional“workspace,” perhaps to save intermediate results in a calculation. To enlarge

30

LECTURE 4. QUANTUM GATES, CKTS, ZENO AND E-V BOMB

a system in this manner we can add new qubits (typically all assumed to be
initialized to |0i) to the system which are called ancilla qubits.
One final notational convention we’ll introduce in this section is for controlled gates. This includes the CNOT gate that we saw first in Section 2.1.
A controlled gate can be split into two parts, the control and the target. We
represent a control qubit using a thick solid dot on a wire. We then draw avertical line connecting to a gate on another qubit(s) which we wish to control.
In the figure below a pair of arbitrary qubits (meaning we won’t specify the
input ahead of time) has a series of controlled gates applied.

•

•
U

•

Figure 4.3: Different types of controlled operations. The first gate is a CNOT
with the first qubit as the control and the second qubit as the target. Noticethe special notation (⊕) for the target of the CNOT gate. The second is acontrolled-U operation, where U is arbitrary. This operation applies U if thecontrol qubit is |1i and does nothing otherwise. The final gate is a CNOT
gate with second qubit as the control and the first as the target. Control canrun in either direction up or down.
There are other notational conventions used for various gates relevant toquantum information, more than we can go through in detail. For a summaryof the most common ones that we’ll come across during the course see Table
4.1.1

1

Also, for more information on typesetting quantum circuits in LATEX see the package“qcircuit” on CTAN. https://ctan.org/tex-archive/graphics/qcircuit4.2. QUANTUM CIRCUIT NOTATION

31

Gate

Common NameNOT/XPauli-X or NOT

Z

Pauli-Z or Phase-FlipZ

YPauli-YY

H

Hadamard

H

S

Phase Gate

S

T

T GateT

NOT

Square-Root of NOTRθ

Rotation GateRθRφ

Phase-Shift

Rφ

CNOT

Controlled-NOT or CNOT•CPHASE/CZ

Controlled-Z√

Circuit Representation
or

NOT

√

Matrix


0 1
1 0


1 0
0 −1


0 −i
i 0


1 1
√1
2 1 −1


1 0
0 i


1
0
0 eiπ/4

1+i 1−i1−i 1+i

X

NOT


SWAP

CCNOT

Swap Gate

Toffoli or
Controlled-Controlled-NOT

•
•

or

•

or

Z

×
×

•
•

•
C-SWAP

Fredkin or Controlled-SWAP

×
×

Z
•

cos (θ) − sin (θ)
sin (θ) cos (θ)


1 0
0 eiφ


1 0 0 0
0 1 0 0
0 0 0 1
0 0 1 0

1 0 0 0
0 1 0 0 
0 0 1 0 
0 0 0 −1

1 0 0 0
0 0 1 0
0 1 0 0
0 0 0 1


1
0

0

0

0

0

0
0

1
0

0

0

0

0

0
0

0
1
0
0
0
0
0
0

0
0
1
0
0
0
0
0

0
0
0
1
0
0
0
0

0
0
0
0
1
0
0
0

0
0
0
0
0
1
0
0

0
0
0
0
0
0
0
1

0
1
0
0
0
0
0
0

0
0
1
0
0
0
0
0

0
0
0
1
0
0
0
0

0
0
0
0
1
0
0
0

0
0
0
0
0
0
1
0

0
0
0
0
0
1
0
0




0
0

0

0

0

0

1
0

0
0

0

0

0

0

0
1

Table 4.1: Circuit representations for some commonly used gates in quantum
information theory.

32

LECTURE 4. QUANTUM GATES, CKTS, ZENO AND E-V BOMB

4.3

Quantum Zeno Effect

There are several interesting phenomena that already happen in the quantum mechanics of one
qubit. Suppose we have a qubit in the state |0i.
and let’s say we want to put it in the |1i state
without using any unitary transformations. For
some small , we can measure the qubit in a basis
that’s rotated from the {|0i , |1i} by an angle .
The probability of getting the qubit to move by increases as  decreases.
P (|vi) = | h0|vi |2 = | cos ()|2 ≈ 1 − 2
P (|wi) = | h0|wi |2 = | sin ()|2 ≈ 2

|vi = cos () |0i + sin () |1i|wi = − sin () |0i + cos () |1i(4.4)
So repeating this process ≈ 1/ times, and rotating the measurement basisby an additional angle  each time, we could slowly drag the qubit from |0i
to |1i. What’s the likelihood that we’d ever get a measurement outcome thatwasn’t the one we wanted? By the union bound, it’s of order (1/) × 2 = , so
can be made arbitrarily small. This is called The Quantum Zeno Effect,
and one of its discoverers was Alan Turing.
Perhaps an everyday-life analog would be asking a stranger
to have coffee with you, then to go dancing, etc.—there’s
a higher probability of success than if you just immediately
ask them to marry you!
Another interesting variant of the same kind of effect is called the Watched
Pot Effect. Say we want to keep a qubit at |0i, but it keeps rotating towards|1i (it’s drifting). If we keep measuring it in the {|0i , |1i} basis every time
the qubit has drifted by an angle , the odds of it jumping to |1i at any given
measurement is only 2 . So if we repeat the measurements ≈ 1 times, then theprobability it ending up at |1i is only ≈ , even though it would have driftedto |1i with certainty had we not measured.

4.4

The Elitzur-Vaidman Bomb

Another interesting phenomenon is the Elitzur-Vaidman Bomb, a quantum
effect discovered in the early 1990’s.

4.4. THE ELITZUR-VAIDMAN BOMB

33

Say we’re at a quantum airport and there’s a piece of unattended luggage
which could be a bomb, but opening the suitcase would trigger it. How do wecheck if there’s a bomb there without triggering it?
Suppose the bomb is designed so it can accept a query made with a classical
bit where b = 0 means we don’t query and b = 1 means we make a query. In
that case one of two things happens, we either don’t make the query and learn
nothing, or we make the query and risk setting off the bomb if in fact there isone. Not good!
This is the quantum airport though (IATA code BQP), so suppose insteadthat we can upgrade our bit to a qubit: |bi = α |0i + β |1i. We’ll also assume
that in the case there is no bomb, the state |bi gets returned to you. If there
is a bomb, the bomb measures in the {|0i , |1i} basis. If the outcome is |0i,then |0i is returned to you, while if the outcome is |1i, the bomb explodes.

Figure 4.4: Sketch of the Elitzur-Vaidman Bomb protocol.
What we can do is start with the |0i state and apply the rotation
cos () − sin ()R =,sin () cos ()giving us cos () |0i + sin () |1i. If there’s a bomb, the probability it explodes
is sin2 () ≈ 2 , otherwise we get back |0i. If there’s no bomb, we get backcos () |0i + sin () |1i.
πtimes makes the
So repeating this process, each time applying R , about 2
πtotal probability of setting off the bomb (if there is a bomb) only 2
sin2 () ≈π
. Yet, by measuring our qubit to see whether it’s |0i or |1i, we still learn
2
whether or not a bomb was there. If there was a bomb then by the watched
pot effect the state will be |0i with high probability, and if there wasn’t thenour repeated applications of R succeeded in rotating the state by π2 and ourstate is |1i. Of course, the catch is that this requires not merely a qubit on
our end, but also a bomb that can be “quantumly interrogated”!

34

LECTURE 4. QUANTUM GATES, CKTS, ZENO AND E-V BOMB

Figure 4.5: Evolution of the qubit after multiple queries with no bomb.

Lecture 5: The Coin Problem,
Distinguishability, Multi-Qubit Statesand Entanglement
5.1

The Coin Problem

Say you have a coin, and you want to figure out if it’s fair (p = 21 ) or if it’sbiased (p = 21 + ). How would you go about doing this?
The classical approach to solving this problem would be to flip the coinover and over about 12 times, keeping track of the number of heads and tails
and appealing to the Law of Large Numbers. Standard probability stuff. Thisrequires about log ( 12 ) bits of memory to store the running totals. In fact,
there’s a theorem by Hellman and Cover from the 70s that says that any
protocol to solve this problem requires at least that many bits for storage.

Figure 5.1: Distribution for the coin-flip probability. Since the standard error
scales like √1n , where n is the number of coin flips, if we want to distinguishreliably between two distributions whose means are separated by  we need
√1 ∼  → n ∼ 12 coin flips.
nWhat if instead we used quantum states? We can start with a qubit in35

36

LECTURE 5. THE COIN PROBLEM, INNER PRODUCTS, . . .

the |0i state, and consider the two rotations R and R− , which rotate by and − radians respectively. We can repeatedly flip the coin, and if it lands
tails apply R (rotating clockwise) and if it lands heads apply R− (rotating
counterclockwise). After many flips (∼ 12 ) we can then measure the qubit andstatistically infer that if it’s in the |0i state the coin was most likely fair, while
if it’s in the |1i state the coin is most likely biased. You might raise a few
objections about the protocol:
I Won’t counting out the right number of steps again require a lot of stor-age?
– No. We can give a protocol with a half-life (some independent probability of halting at each step) causing it to repeat approximately
the number of times we want it to.
I What about if the qubit drifts by a multiple of π? Won’t that make abiased coin look fair?
– That’s possible, but we can make it so that a biased coin is more
likely to land on |1i than a fair coin.
This is our first example of a quantum protocol getting a resource advantage: the quantum solution uses 1 qubit of storage as opposed to the classicalsolution’s log ( 12 ) bits.
This result was shown by Professor Aaronson and his former student Andy Drucker. It wasn’t a particularly hard
problem, but no one had asked the question before. There’s
still “low hanging fruit,” even in the mechanics of a single
qubit!

5.2

Distinguishability of Quantum States

Given two orthogonal quantum states |vi and |wi, there’s a basis we canmeasure in which distinguishes them with certainty. Given a pair of states
which are co-linear (like |vi and − |vi) however, they are indistinguishable.
This points us towards the magnitude of the inner product | hv|wi | as agood measure of the distinguishability for arbitrary pure states. Suppose we’re
given states like those in Figure 5.4 and we want to know: What measurement
would minimize the chance of making a mistake in differentiating |vi from |wi,assuming that being given either is equally likely?

5.2. DISTINGUISHABILITY OF QUANTUM STATES

37

Figure 5.3: Co-linear states
Figure 5.2: Orthogonalstates
You may want to measure in the |vi, |v ⊥ i basis, as it would eliminate one
kind of error completely (not getting |vi ensures the state was |wi). But if you
just want to maximize the probability of getting the right answer, and if |vi
and |wi are equally likely, then there’s a better way, illustrated in Figure 5.5.
Take the bisector of |vi and |wi and define the measurement basis by using thestates 45◦ to either side. When we perform the measurement in this basis we
output the original vector closest to the measurement result as the outcome.

Figure 5.4: Nonorthogonal states|vi and |wi.

Figure 5.5:
Optimal measurement basis for minimizing the error of distinguishing nonorthogonalstates |vi and |wi.

38

5.3

LECTURE 5. THE COIN PROBLEM, INNER PRODUCTS, . . .

Multi-Qubit States and Operations

A general state of two qubits is:|ψi = α |00i + β |01i + γ |10i + δ |11i
where the probabilities of the four outcomes are given by the Born rule, aswith a single qubit:
P (|00i) = |α|2
P (|10i) = |γ|2

P (|01i) = |β|2
P (|11i) = |δ|2

In principle there’s no distance limitation between entangled qubits. One
qubit could be with you on Earth, and the other could be with your friend on
the moon. In such a case, though, you’d only be able to measure the first qubit.
The probability of getting |0i is |α|2 + |β|2 because those are the amplitudes
compatible with the first qubit being |0i. The probability of getting |1i is|γ|2 + |δ|2 .
Suppose I measure the first qubit and get the outcome |0i. What can I say
about the second qubit?
Well, we’ve narrowed down the possibilities for the joint state to |00i and|01i. The state is thus now in the superposition
α |0i + β |1i,|0i ⊗ p|α|2 + |β|2

(5.1)

p
where the factor of |α|2 + |β|2 in the denominator ensures that the result isproperly normalized. This is called the Partial Measurement Rule. This isactually the last “basic rule” of quantum mechanics that we’ll see in the course;
everything else is just a logical consequence of rules we’ve already covered.

5.3.1

Multi-Qubit Operations

One of the most common 2-qubit operations we’ll encounter is one we’ve already seen: the CNOT gate, which flips the second bit if and only if the first
bit is 1. Recall that the matrix corresponding to this operation is given by
1 0 0 0
0 1 0 0
(5.2)
0 0 0 1 .
0 0 1 0

5.3. MULTI-QUBIT STATES AND OPERATIONS

39

What if instead we wanted to apply an operation where we do nothing to thefirst qubit and apply a NOT to the second qubit? The matrix corresponding
to this operation is
0 1 0 0
1 0 0 0
(5.3)
0 0 0 1 .
0 0 1 0which can be written in tensor product notation as

 

1 0
0 1
I ⊗ NOT =
⊗
0 1
1 0

(5.4)

Likewise, if we want to apply a NOT to the first qubit and do nothing to
the second qubit we can apply NOT ⊗ I, which in matrix representation is
00

01

10

11

0
01 0
NOT ⊗ I = 
10 1
11 0

0
0
0
1

1
0
0
0


0
1

0
0



00

(5.5)

Remember that rows represent input amplitudes and columns represent
output amplitudes, so for NOT ⊗ I the amplitude on 00 in the input is theamplitude on 10 in the output.
Very often in quantum information we’ll want to take a group of qubits
and perform an operation on one of them: say, “Hadamard the third qubit.”
What that really means is applying the unitary matrix I ⊗ I ⊗ H ⊗ I ⊗ · · · ⊗ I.
The desired operation on the relevant qubit(s) is tensor-producted with theidentity operation on all the other qubits.
What’s H ⊗ H?


1 1
1
1

1
1 −1 1 −1
(5.6)
2 1 1 −1 −1
1 −1 −1 1
Why should it look like this? Let’s look at the first row: H ⊗ H |00i = |++i.
For the second row, H ⊗ H |01i = |+−i, and so on. All of the two-qubit unitaries we’ve seen were built up using tensor products of single-qubit unitaries,
except for the CNOT, where the first qubit affects the second. We’ll need
operations like CNOT in order to have one qubit affect another.

40

LECTURE 5. THE COIN PROBLEM, INNER PRODUCTS, . . .

5.3.2

Entanglement

Let’s see the multi-qubit operations of Section 5.3.1 in action by calculating
the result of applying the circuit below. The sequence of operations in Figure
5.6 and their effects on the input are given in ket notation in Equation 5.7 andin vector notation in Equation 5.8.

|0i

H

•

|0i
Figure 5.6: Circuit for producing a Bell pair.
|00i + |10i
|00i + |11i
√
√
→
2
2
 
1
1
√
√
1
2
2
0
0
0
 

 
(CNOT)(H ⊗ I) 0 → CNOT  √1  →  0 
2
√1
0
0
2
|00i → |+i ⊗ |0i =

(5.7)

(5.8)

The action of the CNOT can also be written as |x, yi → |x, y ⊕ xi. The√
state that this circuit ends on, |00i+|11i, is called the Singlet or the Bell Pair
2or the EPR Pair. This state is particularly interesting because measuring thefirst qubit collapses the state of the second qubit. The state can’t be factored
into a tensor product of the first qubit’s state and the second qubit’s state.
Such a state is called entangled , which for pure states simply means: notdecomposable into a tensor product.
A state that’s not entangled is called unentangled or separable or a productstate (for pure states, which are the only kind being discussed at this point,
all three of these mean the same thing).
The basic rules of quantum mechanics, which we saw earlier, force entanglement to exist. It was noticed quite early in the history of the field. It turns
out that most states are entangled.
As we mentioned earlier, entanglement was arguably what troubled Einstein the most about quantum mechanics. He thought that it meant thatquantum mechanics must entail “spooky action at a distance.” That’s because, while typically particles need to be close to become entangled, once
they’re entangled you can separate them to an arbitrary distance and they’ll

5.3. MULTI-QUBIT STATES AND OPERATIONS

41

stay entangled (assuming nothing else is done to them). This has actually
been demonstrated experimentally for distances of up to 150 miles (improved
to a couple thousand miles by Chinese satellite experiments, while this course
was being taught!).
Let’s say that Alice and Bob entangle a pair of particles by setting their√. Then Alice brings her particle to the moon while Bob stays on
state to |00i+|11i
2
Earth. If Alice measures her particle, she can instantaneously know whether
Bob will observe a |0i or a |1i when he measures his.

Figure 5.7: We often denote shared entanglement between two parties with asquiggly line (you know, cause entanglement is “spooky” and “weird”).
This bothered Einstein, but others thought that it wasn’t that big a deal.
After all, Alice doesn’t get to control the outcome of her measurement! Shesees |0i and |1i with equal probability, which means that in this case, the“spooky action” can be explained as just a correlation between two randomvariables, as we could already see in the classical world. However, a famous
1935 paper of Einstein, Podolsky, and Rosen brought up a further problem:
namely, there are other things Alice could do instead of measuring in the{|0i , |1i} basis.
What happens if Alice measures in the {|+i , |−i} basis? She’ll get either|+i or |−i, as you might expect. Indeed, we can model the situation by Alice
Hadamarding her qubit and then measuring in the {|0i , |1i} basis. Alice
Hadamarding gives us the state|00i + |01i + |10i − |11i
|00i + |11i=.
(H ⊗ I)
2
2
So now, applying the partial measurement rule what is Bob’s state? If Alicesees |0i, then Bob’s qubit collapses to|0i + |1i√
= |+i .
2
Conversely, if Alice sees |1i then Bob’s qubit collapses to|0i − |1i√
= |−i .
2

42

LECTURE 5. THE COIN PROBLEM, INNER PRODUCTS, . . .

Einstein, Podolsky and Rosen went on to talk about how this is moretroubling than before. If Alice measures in the {|0i , |1i} basis, then Bob’s
state collapses to |0i or |1i, but if she measures in the {|+i , |−i} basis, thenBob’s state collapses to |+i or |−i. And that looks a lot like faster-than-light
communication!
How can we explain this? One thing we can do is ask “what happens if
Bob makes a measurement?”
I In the case where Alice measured her qubit in the {|0i , |1i} basis, Bob

will see |0i or |1i with equal probability if he measures his qubit in thesame basis.
I In the case where Alice measured her qubit in the {|+i , |−i} basis, Bob
will still see |0i or |1i with equal probability if he measures his qubit inthe {|0i , |1i} basis (as an exercise, check this).
So, at least in this case, the probability that Bob sees |0i or |1i is thesame regardless of what Alice chooses to do. So, it looks like there might besomething more general going on here! In particular, a different description
should exist of Bob’s part of the state that’s totally unaffected by Alice’s
measurements—thereby making manifest the principle of no faster-than-light
communication. Which brings us to the next lecture. . .

Lecture 6:

Mixed States

So far we’ve only talked about pure states (i.e., isolated superpositions), but
you can also have quantum superposition layered together with regular, oldprobabilistic uncertainty. This becomes extremely important when we talkabout states where we’re only measuring one part. Last time we discussed
the Bell Pair, and how if Alice measures her qubit in any basis, the state of
Bob’s qubit collapses to whichever state she got for her qubit. Even so, there’s
a formalism that helps us see why Bob can’t do anything to learn which basis
Alice makes her measurement in, and more generally, why Alice can’t transmit
any information instantaneously—in keeping with special relativity. This is
the formalism of. . .

6.1

Mixed States

Mixed states in some sense are just probability distributions over quantum
superpositions. We can define a mixed state as a distribution over quantum
states, {pi , |ψi i}, meaning that with probability pi the state is |ψi i.
Note that the |ψi i’s don’t have to be orthogonal
Thus, we can think of a pure state as a degenerate case of a mixed state
where all the probabilities are 0 or 1. The tricky thing about mixed states isthat different probability distributions over pure states, can give rise to exactly
the same mixed state (we’ll see an example shortly). But to make manifest
why information doesn’t travel faster than light, we need a representation formixed states that’s unique. This representation is called Density Matrices.
43

44

LECTURE 6. MIXED STATES

6.1.1

Density Matrices

The density matrix representation of a mixed state {pi , |ψi i} is given byXρ=pi |ψi i hψi |(6.1)
iwhere |ψi i hψi | denotes the outer product of |ψi with itself. The outer product is the matrix which you get by multiplying
|α0 |2α0
 α1  
 



∗
 ..  α0∗ α1∗ · · · αN
−1 = 
 . 



αN −1


...
αj αi∗

αi αj∗
..
.



.


(6.2)

|αN −1 |2

Note that αi αj∗ = (αi∗ αj )∗ , which means that the matrix is its own conjugatetranspose ρ = ρ† . This makes ρ a Hermitian Matrix. For the standard basis
states, for example, we get




0 0
1 0
|0i h0| =and |1i h1| =
.
0 0
0 1
Therefore, an even mixture of them would be1 I|0i h0| + |1i h1|0= 2 1 = .
0 2
2
2

(6.3)

Similarly,
1|+i h+| =

2
1
2

1
2
1
2

 1


|−i h−| =

2

− 12

− 21



1
2

and
1 
I
|+i h+| + |−i h−|0= 2 1 = .
0 2
2
2

(6.4)

Notice that an equal mixture of |0i and |1i is different from an equalsuperposition of |0i and |1i (a.k.a. |+i), and so they have different density
matrices. However, the mixture of |0i and |1i and the mixture of |+i and |−ihave the same density matrix, which makes sense because Alice converting
between the two bases in our Bell pair example should maintain Bob’s density
matrix representation of his state.

6.1. MIXED STATES

45

In fact, this is true of whichever basis Alice chooses:
for any two orthogonal vectors |vi and |wi, we have thatI|vi hv| + |wi hw|
= .
2
2

(6.5)

Measuring ρ in the basis {|0i · · · |N − 1i} gives us outcome |ii with probability P (|ii) = ρii = hi|ρ|ii. So the
diagonal entries of the density matrix directly represent probabilities.
You don’t need to square them or anything because the Bornrule is already encoded in the density matrix (i.e. αi αi∗ =|αi |2 )In particular, a density matrix that’s diagonal is just a fancy way of writing
a classical probability distribution.


p0
0


..
(6.6)


.
0
pN −1
A purestate written as a density matrix, for example |+i h+|, would look1
1
like 12 21 , a matrix of rank one. Indeed, a density matrix has rank 1 if and22

only if it represents a pure state.
What if we want to measure a density matrix in a different basis? Measuring ρ in the basis {|vi , |wi} will give P (|vi) = hv|ρ|vi and P (|wi) = hw|ρ|wi.
You can think of a density matrix as encoding not just one
but infinitely many probability distributions, because you
can measure in any basis.
The matrix I/2 that we’ve encountered above as the even mixture of |0i
and |1i (and also of |+i and |−i) is called the Maximally Mixed State.
This state is basically just the outcome of a classical coin flip, and it has a
special property: regardless of the basis we measure it in, both outcomes will
be equally likely. So for every basis {|vi , |wi} we get the probabilities
11
I
hv| |vi = hv|vi = ,
2
2
2
I
1
1
hw| |wi = hw|wi = .
2
2
2

46

LECTURE 6. MIXED STATESThis explains why Alice, no matter what she tries, is unsuccessful in sendinga message to Bob by measuring her half of a Bell pair. Namely, because themaximally mixed state in any other basis is still the maximally mixed state.
The generalization of this fact to any state shared by Alice and Bob and to any
operation performed by Alice is called the No-Communication Theorem.
So
Phow do we handle unitary transformations with density matrices? Sinceρ = i pi |ψi i hψi |, applying U to ρ means that ρ gets mapped to!
X†pi (U |ψi i)(U |ψi i) =

i

X

†

pi U |ψi i hψi | U = UiXpi |ψi i hψi | U † = U ρU † .

i

(6.7)
You can pull out the U ’s since it’s the same one applied to each state in the
mixture.
It’s worth noting that getting n2 numbers in the density matrix isn’t someformal artifact; we really do need all those extra parameters. What do theoff-diagonal entries represent?
1|+i h+| =

2
1
2

1
2
1
2



The off-diagonal entries are where the “quantumness” of the state resides. They’re where the potential interference between |0i and |1i is represented. The off-diagonal entries can vary depending on relative phase: |+i h+|has positive
entries, |−i h−| has negative off-diagonal entries and off-diagonal|ii hi| =

1
2
i
2

−i
2
1
2

has off-diagonal entries of opposite signs. Later we’ll see thatas a quantum system interacts with the environment, the off-diagonal entries
tend to get pushed down toward 0.
The density matrices in experimental
1
 quantum information papers typically look like 2∗ 1 . The bigger the off 2
diagonal values, the better the experiment, because it represents them seeing more of the quantum effect! A caveat
though: off-diagonal entries are basis-dependent. In fact,
as we’ll see, they can always be made 0 by a suitable changeof basis.

6.1. MIXED STATES

6.1.2

47

Properties of Density Matrices

Which matrices can arise as densityPmatrices? We’re effectively asking: what
constraints does the equation ρ = i pi |ψi i hψi | put on the matrix ρ? Well,
such a ρ must be:
I SquareI Hermitian
I Trace 1 (which is to say



1
2

P

i ρii = 1)−10

be a density matrix?
1−10
2
No! Measuring this in the {|+i , |−i} basis would give h+|M |+i = 19/2. Bad!
Remember that you can always transform ρ to U ρU † , whose diagonal thenhas to be a probability distribution. If we want that condition to hold for all
U , then we need to add the restriction:
Could M =I All eigenvalues are non-negative (ρ is positive-semidefinite or PSD)

As a refresher, for the matrix ρ, the eigenvectors |xi are the vectors thatsatisfy the equation ρ |xi = λ |xi for some eigenvalue λ. If we had an eigenvector |xi with a negative eigenvalue then the probability hx|ρ|xi = λ would
be negative, which is nonsense.
Could we have missed a condition? Let’s check. We claim: any Hermitian
PSD matrix with trace 1 can arise as a density matrixPof a quantum state.
For such a ρ, we can represent it in the form ρ = i λi |ψi i hψi | where the|ψi i are the (normalized) eigenvectors of ρ. Then hψi |ρ|ψi i = λi , so the λi ’s
sum to T r(ρ) = 1. This process of obtaining eigenvalues and eigenvectors iscalled eigendecomposition. We know the eigenvalues will be real because
the matrix is Hermitian and they’re non-negative because the matrix is PSD.
For every density matrix ρ, there’s a U such that U ρU † is diagonal (with ρ’seigenvalues along it’s diagonal). Namely, the U that switches between thestandard basis and ρ’s eigenbasis.
One important quantity you can always compute for density matrices is
the rank defined asrank(ρ) = The number of non-zero eigenvalues λ (with multiplicity). (6.8)
A density matrix of rank n might look, for example, like that in Equation 6.6,
while a density matrix of rank 1 represents a pure state.

48

LECTURE 6. MIXED STATESWe know from linear algebra that the rank of an n × n matrix is always at most n. Physically, this means that every
n-dimensional mixed state can be written as a mixture ofat most n pure states.

In general, rank tells you the minimum number of pure states that you haveto mix to reach a given mixed state.

6.1.3

Partial Trace and Reduced Density Matrices

Now, consider the 2-qubit pure state|00i + |01i + |10i
√
.
(6.9)
3
We’ll give the first qubit to Alice and the second to Bob. How does Bob
calculate the density matrix corresponding to his system, also called the Reduced Density Matrix or Local Density Matrix? Start by picking someorthogonal basis for Alice’s side. The state can be rewritten asrr
2
1|0i |+i +|1i |0i ,33which lets you calculate Bob’s density matrix as 2 1
1 1 0
2
12 21 12|+i h+| + |0i h0| =+= 13 313
3
3 12 12
3 0 0
3
3
P −1
In general, if you have a bipartite pure state, it’ll look like |ψi = N
i,j=0 αi,j |ii |ji
and Bob’s reduced density matrix can be obtained usingX∗(ρB )j,j 0 =αi,j αi,j(6.10)
0.
i

The process of going from a pure state of a composite system, to the mixed
state of part of the system, is called tracing out.
The key points:
I A density matrix encodes all of the physically observable information

about a quantum system.
– Two quantum states will lead to different probabilities for somemeasurement iff they have different density matrices.
I No-Communication Theorem

6.1. MIXED STATES

49– If Alice and Bob share an entangled state, nothing Alice chooses to
do will have any effect on Bob’s reduced density matrix.

In other words, there’s no observable effect on Bob’s end.
Which is the fundamental reason why quantum mechanics
is compatible with the limitations of relativity.
We’ve already seen particular examples of both statements. But both ofthem hold in full generality, and you’ll prove that in your homework!
OK, just to get you started a bit: recall that the No-Communication Theorem says that, if Alice and Bob share an entangled state
|ψi =

N
−1
X

αi,j |iiAlice |jiBob ,i,j=0

there’s nothing that Alice can do to her subsystem that affects Bob’s reduced
density matrix. You already have the tools to prove this: just calculate Bob’s
reduced density matrix, then apply a unitary transformation to Alice’s side,then see if Bob’s density matrix changes. Or have Alice measure her side, andsee if Bob’s reduced density matrix changes.
Note that if we condition on the outcome of Alice’s measurement, then we do need to update Bob’s local density
matrix to reflect the new knowledge: if Alice sees i thenBob sees j, etc. . . But that’s not terribly surprising, since
the same would also be true even with classical correlation!
In particular, this doesn’t provide a mechanism for fasterthan-light communication.
To review, we’ve seen three different types of states in play, each moregeneral than the last:
I Basis States or Classical States– Individual states in some computational basis e.g. |ii.
I Pure StatesP– Superpositions of basis states |ψi = i αi |ii
I Mixed StatesP– Classical probability distributions over pure states ρ = i pi |ψi i hψi |.

50

LECTURE 6. MIXED STATESWhich represents the actual physical reality: pureor mixed states? It’s complicated. Sometimes we use
density matrices to represent our probabilistic ignorance ofa pure state. But when we look at part of an entangledstate, a mixed state is the most complete representation
possible that only talks about the part that we’re looking at.
We’ll generally just focus on what these representations areuseful for.

Lecture 7: The Bloch Sphere, NoCloning Theorem and Wiesner’s
Quantum Money Scheme
7.1

The Bloch Sphere

The Bloch Sphere is a geometric representation of the set of all possible
mixed states of a qubit. We’ve often drawn the state of a qubit as a point on
the unit circle, which is already a little awkward: half of the circle is going towaste since |ψi and − |ψi both represent the same physical state (they havethe same density matrix).
Instead, what if we chose a representation where vectors that pointed in
opposite directions were orthogonal? With this choice of convention we get
the Bloch sphere, as seen in Figure 7.1.
We can see that |+i and |−i should be between |0i and |1i. Then we canadd |ii and |−ii as a third dimension. In this representation points on thesurface of the sphere are pure states, such that if they’re 180◦ apart they’reorthogonal.
What about mixed states? Well we know that the maximally mixed state,I, can be defined as
2|0i h0| + |1i h1|,2|+i h+| + |−i h−||ii hi| + |−ii h−i|
, or
.
2
2
⊥

⊥

More generally we can define the maximally mixed state as |vihv|+|v2 ihv | forany orthogonal pair of states |vi and |v ⊥ i. The sum of any two of these vectors
on the sphere is the origin.
More generally, we can in this way represent any mixed state as a point
inside of the sphere. A mixture of any states |vi and |wi, represented as points
on the surface of the sphere, will be a point on the line segment connecting
51

52

LECTURE 7. BLOCH SPHERE, NO-CLONING. . .

Figure 7.1: The Bloch sphere representation of a qubit state. Antipodal points
on the surface of the sphere correspond to orthogonal states. Pure states liveon the surface of the sphere while mixed states correspond to points in theinterior. The center of the sphere is a special point and corresponds to the
maximally mixed state I2 .
the two.
We can show geometrically that every 1-qubit mixed state can be written asa mixture of only two pure states. Why? Because you can always draw a linethat connects any pure state you want to some point in the sphere representing
a mixed state, and then see which other pure state the line intersects on its
way out. The point can then be described as some convex combination of thevectors representing the pure states. This is visually represented in Figure 7.2.
Experimentalists love the Bloch sphere, because it works identically to
how spin works with electrons and other spin- 21 particles. You can measure
the particle’s “spin” relative to any axis of the sphere, and the result will bethat the electron is spinning either clockwise or counterclockwise relative tothe axis. The particle’s spin state is literally a qubit, which collapses to oneof the two possible spin states on measurement.
The weird part about spin- 12 particles is that you could have asked the
direction of the spin relative to any other axis and still would have gotten that
it was either clockwise or counter-clockwise relative to that axis. So what’s
really going on: what’s the real spin direction? Well, the actual state is justsome point on the Bloch sphere, so there is a “real spin direction,” but there’s
also no measurement that reliably tells us that direction. The crazy part here

7.1. THE BLOCH SPHERE

53

Figure 7.2: A mixed state of a qubit can always be represented by a convex
combination of pure states on the surface of the Bloch sphere. To get one such(there are infinitely many) representation, pick some state on the surface |vi
and draw a line through |vi and the point representing the state ρ. The otherpoint on the surface gives |wi, the other state in the mixture. The relative
lengths of the line segments between |vi and ρ and between |wi and ρ give theweights of the mixture.

54

LECTURE 7. BLOCH SPHERE, NO-CLONING. . .

is how the three-dimensionality of the Bloch sphere perfectly syncs up withthe three-dimensionality of actual physical space.

7.1.1

Quantum Gates in the Bloch Sphere Representation

It’s often useful to visualize the effect of quantum gates geometrically by mapping their behavior to corresponding changes on the Bloch sphere. In the
Bloch sphere representation, every quantum gate can be described as a 3D
rotation by some angle θ about some axis defined by the eigenvectors of thegate. Some examples of this can be seen in Figure 7.3.

Figure 7.3: Applying gates X, Y , Z or H is the same as doing a half-turnabout their respective axes. S corresponds to a quarter turn around the Zaxis (in the |+i to |1i direction). T 2 = S, so T corresponds to an eighth turnaround the Z-axis. Rπ/4 corresponds to a quarter turn about the Y -axis.

7.2. THE NO-CLONING THEOREM

7.2

55

The No-Cloning Theorem

We’ve seen how entanglement seems to lead to “non-local effects,” like for√, where if Alice measures her qubit then she learns the state
the state |00i+|11i
2
of Bob’s. The reason that Alice isn’t communicating faster than light boils
down to Bob not being able to tell if his qubit’s state is in the {|0i , |1i} basisor the {|+i , |−i} basis. But what if Bob could make unlimited copies of his
qubit? He could figure out which state he had through repeated measurements,and so he’d be able to tell what basis Alice measured in. Faster than light
communication!
Learning a classical description of a quantum state, given
lots of copies of the state, is called Quantum State Tomography.
It turns out that we can prove that a procedure to reliably copy an unknown quantum state cannot exist. It’s easy to prove, but it’s a fundamental
fact about quantum mechanics. In fact, we already saw one proof: namely,
cloning would imply superluminal communication, which would violate the
No-Communication theorem that you proved in the homework! But let’s see
more directly why cloning is impossible.
Let’s try to clone a single qubit, |ψi = α |0i + β |1i.
In our quantum circuit we want to apply some unitary transformation thattakes |ψi and an ancilla as input, and produces two copies of |ψi as output.
|ψi

|ψi
|0i

U

|ψi

Algebraically our cloner U would need to implement the transformation(α |0i + β |1i) ⊗ |0i → (α |0i + β |1i) ⊗ (α |0i + β |1i)
= α2 |00i + αβ |01i + αβ |10i + β 2 |11i .

(7.1)

In matrix notation this looks like



 
α2
α
αβ 
0
  = U  .
αβ 
β 
2
β
0

(7.2)

56

LECTURE 7. BLOCH SPHERE, NO-CLONING. . .

The problem? This transformation isn’t linear (it has quadratic terms), so it
can’t be unitary!
To clarify, a known procedure that outputs some state |ψi can be rerun to
get many copies of |ψi. What the No-Cloning Theorem says is that if |ψi isgiven to you but is otherwise unknown then you can’t make a copy of it.
Another clarification: CNOT seems like a copying gate—as it maps |00i →|00i and |10i → |11i. So why doesn’t it violate the No-Cloning Theorem?
Because it only copies if the input state is |0i or |1i. Classical information can√be copied. Doing CNOT on |+i |0i produces the Bell pair |00i+|11i; this sort of2
copies the first qubit in an entangled way, but that’s different than making a
copy of |+i. Having two qubits in the local state I2 is not the same as having
two in the state |+i. In general, for any orthonormal basis you can clone thebasis vectors, if you know that your input state is one of them.
Since the No-Cloning Theorem is so important, we’ll present another proofof it. A unitary transformation can be defined as a linear transformation that
preserves inner product. Which is to say that the angle between |vi and |wi
is the same as the angle between U |vi and U |wi. Thus hv|U † U |wi = hv|wi.
What would a cloning map do to this inner product? Let | hv|wi | = c; then|(hv| ⊗ hv|)(|wi ⊗ |wi)| = | hv|wi hv|wi | = c2 .
Now, c only ever equals c2 if c = 0 or c = 1, so the transformation can only
copy perfectly if |vi and |wi belong to the same orthonormal basis.
There’s a fact in classical probability that provides a nice analog to the
No-Cloning Theorem. If we’re given the outcome of a coin flip—from a cointhat lands heads with some unknown probability p—can we simulate a second
independent flip of the same coin without having access to the coin? To do so
we’d need a stochastic S matrix whose effect is




p2
p
p(1 − p)
=S 0 p(1 − p)
1 − p2(1 − p)0
but once again the transformation we’d need isn’t even linear, let alone stochastic.
The No-Cloning Theorem has all sorts of applications toscience fiction, because you can’t make arbitrary copies ofa physical system (say for teleporting yourself ) if any of
the relevant information (say, in your brain) were encoded7.3. QUANTUM MONEY

57

in quantum states that didn’t belong to a known orthogonalbasis.

7.3

Quantum Money

Quantum Money is a striking application of the No-Cloning Theorem. In
some sense it was the first idea in quantum information and was involved in
the birth of the field. The original quantum money scheme was proposed by
Wiesner in 1969, though it was only published in the 80’s.
Wiesner had left research by then and had chosen to becomea manual laborer.
Wiesner realized that the quantum No-Cloning Theorem—though it wasn’t
yet called that—could be useful to prevent counterfeiting of money. In practice, mints use special ink, watermarks, etc. . . , but all such devices basicallyjust lead to an arms race with the counterfeiters. So Wiesner proposed using qubits to create money that would be physically impossible to counterfeit.
The immediate problem is that a money scheme needs not only unclonability
but also verifiability—that is, you need to be able to check whether a bill isgenuine. How did Wiesner solve this problem?

7.3.1

Wiesner’s Quantum Money Scheme

The bank prints quantum bills (we’ll assume for simplicity that they’re allsame denomination). Each bill has:
I A classical serial number s ∈ {0, 1}m
I A quantum state |ψf (s) i– The qubits in this state are unentangled, and each will always bein one of four states: |ψ00 i = |0i, |ψ01 i = |1i, |ψ10 i = |+i, or|ψ11 i = |−i.
The bank maintains a giant database that stores for each bill in circulation
the classical serial number s as well as a string f (s) that encodes what thequantum state attached to bill is supposed to be.
Wiesner’s scheme, like all quantum money schemes, has
an important practical problem though: you need to ensure

58

LECTURE 7. BLOCH SPHERE, NO-CLONING. . .

that the qubits in a bill don’t lose their state (coherence).
With current technology, qubits in a lab decohere in anywhere from nanoseconds to an hour. Qubits stored in awallet would decohere much faster!
To verify a bill, you bring it back to the bank. The bank verifies the billby looking at the serial number, and then measuring each qubit in the billin the basis in which it was supposed to be prepared. That is, if the qubit
was supposed to be |0i or |1i, then measure in the {|0i , |1i} basis; if it was
supposed to be |+i or |−i, then measure in the {|+i , |−i} basis. For eachmeasurement, check that you get the expected outcome.
Consider a counterfeiter who doesn’t know which basis each qubit is supposed to be in, so they guess the bases uniformly at random. They only havea ( 12 )n chance of making all n guesses correctly. Of course one could imagine
a more sophisticated counterfeiter, but it’s possible to prove that regardless ofwhat the counterfeiter does, if they map a single input bill to two output bills
then the output bills will both pass verification with probability at most ( 34 )n .
Wiesner didn’t actually prove the security of his scheme at
the time he proposed it. Professor Aaronson asked about it
on Stack Exchange a few years ago which prompted Molina,
Vidick, and Watrous to write a paper that formally proved
the scheme’s security.

Lecture 8: Quantum Money and
Quantum Key Distribution
8.1

Quantum Money Attacks

Last time we discussed how classical money is copyable and described a scheme
for making money uncopyable through an application of the No-Cloning Theorem. Let’s consider a counterfeiter who wants to take a copy of a legitimate
bill B and submit it for verification. Say the counterfeiter decides to measure
all qubits in the {|0i , |1i} basis. They then make a new bill with the classicalserial number copied and the quantum state given by the measurement resultsin the {|0i , |1i} basis of the original state.

Figure 8.1: Possible result of counterfeiter trying to clone a bill by measuring
each qubit in the standard basis.
When the bank goes to measure each qubit they’ll find that the ones thatshould be in the {|0i , |1i} basis are correct all of the time. But, the ones thatshould be in the {|+i , |−i} basis are correct on both bills only 14 of the time.
Thus the probability that the counterfeiter succeeds (i.e., that both bills passverification) is ( 85 )n .
As we mentioned last time, it was shown in 2012 that any
possible attack succeeds with probability at most ( 43 )n .

59

60

LECTURE 8. QUANTUM MONEY AND QKD

8.1.1

Interactive Attacks

There’s a clever attack on Wiesner’s scheme based around the assumption
that, after verification, the bank returns the bill regardless of whether or notit passed verification. We can start with a legitimate bill, then repeatedly go
to the bank and ask them to verify it, manipulating each of the bill’s qubits
one at a time. For example, if we set the first qubit to |0i and the bill still
passes verification each and every time then we’ve learned that the first qubit
should be |0i. Otherwise, we can successively try setting the first qubit to |1i,|+i and |−i and see which choice makes the bank consistently happy. Then,
once we know, we move on to toggling the second qubit and so on.
OK, but surely the bank wouldn’t be so naı̈ve as to return the bill even if
it fails verification! We should assume instead that if verification fails (or fails
often enough), then the bank alerts the police or something. Can we come up
with an attack that works even then? A recent paper by Nagaj and Sattath
points out that we can!
Recall the Elitzur-Vaidman Bomb discussed in Section 4.4. The generalidea is that by making a succession of measurements, none of which reveals
that much by itself, we can with a high probability of success learn whethera system is a certain state, without triggering the “bad event” that would
happen if the system were actually measured to be in that state (such as abomb going off). Nagaj and Sattath applied a similar idea to quantum money.
Elitzur-Vaidman Bomb Attack
Let |ψi i be the qubit of the banknote we want to learn. The protocol for the
Elitzur-Vaidman bomb attack goes as follows:
I Initialize a qubit |ci to |0i.
I Repeat π2times:– Apply the rotation gate R to |ci.
– Apply a CNOT gate to |ci |ψi i.
– Send bill to the bank for verification
Suppose |ψi i = |0i. Then each time we apply CNOT, we get
CN OT (cos () |0i + sin () |1i) |0i = cos () |00i + sin () |11i .

(8.1)

Following the measurement of the bill, most of the time |ci will snap back to|0i. At each step the probability of getting caught (i.e. failing verification) is8.1. QUANTUM MONEY ATTACKS

61

π
sin2 () ≈ 2 . Thus the total probability of getting caught after the 2iterations
2π
is upper-bounded by  2 = O() by the union bound. A similar analysis can bedone if |ψi i is |1i or |−i; we’re unlikely to get caught, and |ci keeps “snappingback” to |0i. But if |ψi i = |+i then something different happens; in that case
the CNOT gate has no effect, so |ci gradually rotates from |0i to |1i. So, when
we measure at the end we can distinguish |+i from the other states because
it’s the only one that causes |ci to rotate to |1i. By symmetry we can give
analogous procedures to recognize the other three possible states for |ψi i. So
then we just iterate over all n qubits in the bill, learning them one by one justlike in the previous interactive attack on Wiesner’s scheme.

Can Wiesner’s scheme be fixed to patch this vulnerability? Yes! The bankcan just give the customer a new bill (of the same value) after each verification,
instead of the bill that was verified.
There’s an additional problem with Wiesner’s scheme, as we’ve seen it.
Namely, it requires the bank to hold a huge amount of information, one secretfor every bill in circulation. However, a paper by Bennett, Brassard, Breidbart
and Wiesner, from 1982, points out how to circumvent this by saying: let f
be a pseudorandom function with a secret key k, so that for any serial numbers, the bank can compute fk (s) for itself rather than needing to look it up. Of
course the bank had better keep k itself secret—if it leaks then out the entire
money system collapses! But assuming that k remains a secret, why is thissecure?
We use a reduction argument. Suppose that the counterfeiter can copy
money by some means. What does that say about fk ? If fk were truly random,
then the counterfeiter wouldn’t have succeeded, by the security of Weisner’s
original scheme. So by checking whether the counterfeiter succeeds, we candistinguish fk from a random function. So fk wasn’t very good at being pseudorandom! Note that with this change, we give up on information-theoretic
security of the sort that we had with Wiesner’s original scheme. Now we “only”
have security assuming that it’s computationally intractable to distinguish fk
from random. Moreover, a recent result by Prof. Aaronson shows that somecomputational assumption is necessary if we don’t want the bank to have tostore a giant database.
However, even after we make the improvements above, Wiesner’s scheme
still has a fundamental problem, which is that to verify a bill you need to takeit back to the bank. If you have to go to the bank, then arguably you might
as well have used a credit card or something instead! The point of cash is
supposed to be that we don’t need a bank to complete a transaction. This
leads to the concept of Public-Key Quantum Money.

62

LECTURE 8. QUANTUM MONEY AND QKD

8.1.2

Public-Key Quantum Money

Public-Key Quantum Money refers to quantum money schemes in whichanyone can verify a bill using a “public key,” but where a bill can only be
produced or copied by using a “private key” known only to the bank. For
formal definitions see (Aaronson 2009), (Aaronson, Christiano 2012). With
this sort of scheme you’ll always need computational assumptions on the powerof the counterfeiter in addition to the structure of quantum mechanics. Why?
Because a counterfeiter with infinite computational power could always just try
every possible quantum state (or an approximation thereof) on the appropriate
number of qubits until it found one that made the public verification procedure
accept.

8.2

Quantum Key Distribution

Now we’ll discuss something closely related to quantum money, but that
doesn’t require storing quantum states for long times, and that for that reason
is actually practical today (though so far there’s only a tiny market for it).
Key distribution is a fundamental task in cryptography. It just means causing
two agents, Alice and Bob, to share a secret key (without loss of generality, auniformly random string) when they didn’t have one before. Once Alice andBob share a long enough key, they can then exchange secret messages using
the central technique in cryptography called the One-Time Pad, which works
as follows:
I Given that Alice and Bob have a shared key k ∈ {0, 1}n , Alice can takeher secret message m ∈ {0, 1}n and encode it by the ciphertext c = m⊕k,where ⊕ denotes the bit-wise XOR.
I Bob, after receiving c, can decode the message using his copy of thesecret key, using the fact that c ⊕ k = m ⊕ k ⊕ k = m.
As its name implies, the One-Time Pad can only be used once securely
with a given key, so it requires a large amount of shared key. In fact, inthe classical world Claude Shannon proved that if they want to communicate
securely, Alice and Bob either need a shared secret key that’s at least as long as
all the messages that they want to send, or else they must make computational
assumptions about the eavesdropper “Eve”. The great discovery of Quantum
Key Distribution (QKD) was that quantum mechanics lets us get secure key
distribution with no need for computational assumptions! We do, however,need communication channels capable of sending quantum states.

8.2. QUANTUM KEY DISTRIBUTION

63

In cryptography, besides secrecy, an equally important goal
is authentication. However, we’re only going to deal withsecrecy in this course.

The BB84 Protocol
In this section we’ll describe the BB84 scheme, the first full quantum key
distribution scheme. This scheme was proposed by Bennett and Brassard in
1984, though it was partly anticipated in Wiesner’s paper (the same one that
introduced quantum money!). It circumvents the issues we’ve seen in maintaining a qubit’s coherence for a long time because it only requires coherence
for the time it takes for communication between Alice and Bob.
There are companies and research groups that are alreadydoing quantum key distribution through fiber optic cables
over up to about 10 miles and through free-space nearly 90
miles. In addition, just a few years ago, in 2017, a teamfrom China demonstrated QKD over distances of thousandsof miles by sending photons to and from a satellite that was
launched into space for that express purpose.
The basic idea is that you’re trying to establish some shared secret knowledge and you want to know for certain that no eavesdroppers on the channel
can uncover it. You’ve got a channel to transmit quantum information and achannel to transmit classical information. In both eavesdroppers may be able
to listen in (no secrecy). But, in the classical channel we’ll assume you at least
have authentication; Bob knows that any messages really come from Alice andvice versa. The BB84 protocol proceeds as follows:
I Alice chooses uniformly at random a pair of strings x, y ∈ {0, 1}n .
I Alice then generates an n-qubit state |ψi where Alice uses the bits of y

to determine which basis to encode her qubits in (0 for {|0i , |1i} and 1
for {|+i , |−i}), and she uses the bits of x to determine the element ofthat basis (0 → |0i / |+i and 1 → |1i / |−i).
I Alice sends the quantum state |ψi to Bob.
I Bob picks a string y 0 uniformly at random from {0, 1}n .
I Bob uses the bits of y 0 to determine the basis in which to measure eachof the qubits sent from Alice. He then records the results of the measurements in the string x0 (|0i / |+i → 0 and |1i / |−i → 1).

64

LECTURE 8. QUANTUM MONEY AND QKDI Now Alice and Bob share which bases they picked to encode and measure

the state |ψi (the strings y and y 0 ). They discard any bits of x and x0
for which they didn’t pick the same basis (which will be about half thebits). What remains of x and x0 is now their shared secret key.

Figure 8.2: Sketch of the BB84 protocol.
In Figure 8.2 we roughly sketch the protocol visually.
At this point we consider an eavesdropper Eve who was watching the qubits
as they were sent over. The whole magic of using qubits is that if Eve tries tomeasure the qubits then she inherently changes what Bob receives! Sure, if shemeasures a |0i or |1i and the qubit was prepared in the {|0i , |1i} basis thenthe qubit doesn’t change. But, what if she’s unlucky and measures a qubit ina basis it wasn’t prepared in? Eventually she almost certainly will be unlucky
and have this happen.
In more detail, suppose Alice sent |+i and Eve measures in the wrong basis and sees |0i, which gets passed along to Bob. Then, even if Bob measuresin the {|+i , |−i} basis (i.e., the “right” basis), he has a 50% chance of measuring |+i and a 50% chance of measuring |−i. In the latter case Alice and
Bob will be able to see that the channel was tampered with. So, Alice andBob can verify that no one listened in to their qubit transmission by making
sure that the portion of their qubits that should match, do match. Of course,
after Alice and Bob discuss those qubits over the channel they aren’t going
to be secret anymore! But they’ve still got all the others. If a large enoughfraction of the qubits didn’t match then Alice and Bob deduce that Eve eavesdropped. So then they can just keep trying again and again until they can
get a batch where no one listened in. At worst, Eve can prevent Alice andBob from ever communicating by listening in constantly. But we can preventa situation where Alice and Bob think their shared key is secure even though
it isn’t. Again, once Alice and Bob share a secret key, they can then use some

8.2. QUANTUM KEY DISTRIBUTION

65

classical encryption scheme, like the One-Time Pad, or a scheme that depends
on computational assumptions (if they want to make their shared secret key
last longer).

Lecture 9:
9.1

Superdense Coding

Superdense Coding

Superdense Coding is the first protocol we’ll see that requires entanglement.
Basic information theory (Shannon) tells us that “by sending n bits, you can’t
communicate more than n bits of information.” Now, by contrast, we’ll see
how Alice can send Bob two classical bits by sending him only one qubit,
though there is a catch: Alice and Bob must share some entanglement aheadof time. In the scenario with no prior entanglement, Alice can’t send morethan one bit per qubit—–a fundamental result known as Holevo’s Theorem.
We’re not going to prove Holevo’s theorem here, but the intuition is pretty
simple; if Alice sends |ψi = α |0i + β |1i to Bob he can only measure it oncein some basis and then the rest of the information in |ψi is lost.
Instead, let’s suppose that Alice and Bob share a Bell pair in advance√. We claim that Alice can manipulate her half, then send her|ψi = |00i+|11i
2
half to Bob and finally Bob can measure both qubits and get two bits of
information from Alice. The key is to realize that Alice can get three different
states, all of them orthogonal to the original Bell pair and to each other, byapplying the following gates to her qubit 
|00i + |11i
|01i + |10i√√=
(X ⊗ I)22
 |00i + |11i
|00i − |11i√√
(Z ⊗ I)
=
(9.1)
2
2

 

|00i + |11i
|01i − |10i√√
(Z ⊗ I)(X ⊗ I)=2
2√
, form an orthonormal basis. So,
These three states, together with |00i+|11i
2
suppose Alice wants to transmit two bits x, and y:

I If x = 1, she applies the X gate.

669.1. SUPERDENSE CODING

67

I If y = 1, she applies a Z gate.
I Then she sends her qubit to Bob.

For Bob to decode this transformation, he’ll want to use the transformation


1 0
0
1
1 1 0
0 −1
,
√ 
(9.2)

0
2 0 −1 1
0 1 −1 0
which corresponds to the circuit•

H

So, Alice transforms the Bell pair into one of the four orthogonal states
above, then Bob decodes that two-qubit state into one of the four possiblecombinations of |0i and |1i, corresponding to the original bits x and y. For√
example, if Bob receives |01i−|10i, then applying CNOT gets him |1i ⊗ |−i and2√, then applying
the then Hadamard gives him |1i ⊗ |1i. If Bob receives |00i−|11i2
CNOT gets him |0i ⊗ |+i and the Hadamard then gives him |0i ⊗ |1i.
Naturally, we could ask: if Alice and Bob had even more pre-shared entanglement, could Alice send an arbitrarily large amount of information bytransmitting only one qubit? There’s a theorem that says no. It turns outthat given a qubit and any number of pre-shared entangled qubits (ebits), you
can send two bits of classical information, but no more. That is, we can write
the inequality

1 qubit + 1 ebit ≥ 2 bits,(9.3)

but, we can’t write 1 qubit + ebits ≥ k bits for any k > 2. As far as quantum
speed-ups go, a factor of two isn’t particularly impressive, but it is pretty coolthat it challenges the most basic rules of information theory established by
Shannon himself.

Lecture 10: Teleportation, Entanglement Swapping, GHZ Stateand The Monogamy of Entanglement
10.1

Quantum Teleportation

Quantum Teleportation is a foundational discovery from 1991 that came asa great surprise. Science journalists still love it given its irresistible name. In
this lecture we’ll see what it can and can’t do. Firstly, what does teleportation
mean? You might think it implies sending qubits instantaneously over vastdistances, but that can’t be done, as it violates the causal structure of theuniverse dictated by the laws of special relativity. So we’re only going to send
qubits at most at the speed of light, no faster. Of course, there are other ways
to move qubits at the speed of light or slower, like just picking them up andmoving them, or putting them on a bus! (It doesn’t sound as sexy that way.)
OK, but what if you only had a phone line, or a standard Internet connection?
That would let you send classical bits, but not qubits. With teleportation,
though, we’ll achieve something surprising. We’ll show that it’s possible for
Alice and Bob to use pre-shared entanglement plus classical communication
to perfectly transmit a qubit.
The inequality here is almost the converse of the one for superdense coding:
1 ebit + 2 bits ≥ 1 qubit(10.1)

Which is to say, you need one pair of entangled qubits plus two classical bitsin order to transmit one qubit. This can also be shown to be optimal. So,
let’s say Alice wants to get a qubit over to Bob, without using a quantum
communication channel, but with a classical channel together with preshared6810.1. QUANTUM TELEPORTATION

69

entanglement. How should Alice go about this? Once the question is posed,
you can play around with different combinations of operations and you’d eventually discover that what works is this:|ψi
|00i+|11i
√
2


•

H

Figure 10.1: Quantum circuit for performing quantum teleportation protocol.
where |ψi = α |0i + β |1i is the state Alice wishes to send. The top two qubits
in the circuit above are Alice’s. At the end, will Alice also have |ψi? No.
A logical consequence of the No-Cloning Theorem is that there can only be
one copy of the qubit. Could we hope for a similar protocol without sendingclassical information? No, because of the No-Communication Theorem.
Now let’s analyze the behavior of the circuit in Figure 10.1 in more detail.
The qubit Alice wants to transmit is |ψi = α |0i + β |1i. The combined stateof her qubit, along with the entangled Bell Pair she shares with Bob is(α |0i + β |1i) ⊗α |000i + α |011i + β |100i + β |111i|00i + |11i√√=
. (10.2)
2
2

Following the CNOT the state of the system is
α |000i + α |011i + β |110i + β |101i√.
(10.3)
2
Next, Alice applies a Hadamard to her first qubit which results in the state1√ (α |+00i + α |+11i + β |−10i + β |−01i)21= (α |000i + α |100i + α |011i + α |111i + β |010i − β |110i + β |001i − β |101i)
2(10.4)
Finally, Alice measures both of her qubits in the {|0i , |1i} basis. This leads
to four possible outcomes for the state of Bob’s qubit conditioned on her

70 LECTURE 10. TELEPORTATION, ENTANGLEMENT SWAPPING. . .
measurement results, as shown in Table 10.1. We’re deducing information
about by Bob’s state by using the partial measurement rule. E.g., if Alice sees
|00i, then we narrow down the state of the entire system to the possibilities
that fit, namely |000i and |001i.

If Alice Sees:
00
01
Then Bob’s qubit is: α |0i + β |1i α |1i + β |0i

10
α |0i − β |1i

11
α |1i − β |0i

Table 10.1: Summary of Bob’s output state conditioned on Alice’s measurement results.

What is Bob’s state, if he knows that Alice measured, butdoesn’t know the measurement outcome? It’s an equal mixture of all four possibilities, which is just the Maximally
Mixed State. This makes sense given the No-Communication
Theorem! Until Alice sends information over, Bob’s qubit
can’t possibly depend on |ψi.
Next, Alice tells Bob her measurement results via a classical channel andBob uses the information to “correct” his qubit to |ψi. If the first bit sent
by Alice is 1 then Bob applies Z, and if the second bit sent by Alice is 1
then Bob applies X. These transformations will bring Bob’s qubit to thestate |ψi = α |0i + β |1i. That means they’ve successfully transmitted a qubit
without a quantum channel!
Note this protocol never assumed that Alice knew what |ψiwas.
For the protocol to work, Alice had to measure her syndrome bits andcommunicate the result to Bob. These measurements were destructive (since
we can’t ensure that they’ll be made in a basis orthonormal to |ψi), and thus
Alice doesn’t have |ψi at the end. Alice and Bob also “use up” their Bell pairin the process of teleporting |ψi.
Something to think about: Where is |ψi after Alice’s measurement, but before Bob does his operations?

10.1. QUANTUM TELEPORTATION71

FAQ
How do people come up with this stuff ?
Well it’s worth pointing out that quantum mechanics was discovered in
1926 and that quantum teleportation was only discovered in the 90’s. These
sorts of protocols can be hard to find. Sometimes someone tries to prove thatsomething is impossible, and in doing so eventually figures out a way to get it
done. . .
Aren’t we fundamentally sending infinitely more information than
two classical bits if we’ve sent over enough information to perfectly
describe an arbitrary qubit, since the qubit’s amplitudes could bearbitrary complex numbers?
In some sense, but at the end of the day, Bob only really obtains the information that he can measure, which is significantly less. Amplitudes may “exist” physically, but they’re different from other physical quantities like length,
in that they seem to act a lot more like probabilities. Like, there’s a state of asingle qubit α |0i + β |1i such that the binary encoding of β corresponds to thecomplete works of Shakespeare—–the rules of quantum mechanics don’t put alimit on the amount of information that it takes to specify an amplitude. With
that said, we could also encode the complete works of Shakespeare into theprobability that a classical coin lands heads! In both cases, the works of Shakespeare wouldn’t actually be retrievable by measuring the system, assuming we
didn’t have an immense number of copies of it.

10.1.1

Multi-Qubit Teleportation and Entanglement Swapping

Can we go further? What would it take to teleport an arbitrary quantum state,
say of n qubits? To answer this question, let’s notice that nothing said that aqubit that’s teleported has to be unentangled with the rest of the world. You
could run the protocol and have |ψi be half of another Bell pair. That would
entangle the fourth qubit to Bob’s qubit (you can check this via calculation).
This operation is depicted in Figure 10.2. This is not a particularly interesting
operation since it lands you where you started with one qubit of entanglement
between Alice and Bob, but it does have an interesting implication. It suggeststhat it should be possible to teleport an arbitrary n-qubit entangled state, bysimply teleporting the qubits one at a time, thus using n ebits of presharedentanglement and 2n bits of classical communication. Indeed, it’s not hard tocheck that this works.
One further consequence of this is that two qubits don’t need to interact

72 LECTURE 10. TELEPORTATION, ENTANGLEMENT SWAPPING. . .

Figure 10.2: Diagrammatic depiction of teleportation in which Alice uses one
ebit of pre-shared entanglement with Bob to teleport over one half of somearbitrary entangled state that she has control of.
directly to become entangled. In some sense, we already knew that. Consider,for example, the following circuit:

H

•
×
×

The final gate in this circuit is a SWAP gate between the last two qubits. Notethat the first and third end up entangled even though there’s never “direct”
contact between them. The second qubit serves as an intermediary.
What does it take for Alice and Bob to get entangled? The
obvious way is for Alice to create a Bell pair and then send
one of the qubits to Bob. In most real-world experiments
the entangled qubits are created somewhere between Aliceand Bob and then one qubit is sent to each.
Anyway, teleportation leads to a more surprising protocol than this, called
Entanglement Swapping. Imagine we have four parties: Alice, Bob, Charlieand Diane. Alice and Bob share a Bell pair, as do Alice and Charlie and Charlieand Diane, as depicted in Figure 10.3. Now suppose that Alice teleports her
half of the Bell pair that she shares with Charlie to Bob, and that Charlie

10.1. QUANTUM TELEPORTATION

73

teleports his half of the Bell pair that he shares with Alice to Diane. The
result of this series of teleportations is that Bob and Diane now both have one
half of a Bell pair—even though the two qubits Bob and Diane possess were
never in causal contact with one another!

Figure 10.3: Entanglement swapping procedure depicted. Initially Alice andBob share a Bell pair, as do Charlie and Diane and Alice and Charlie. Following a pair of teleportations from Alice to Bob and from Charlie to Diane
we find that Bob and Diane now share a Bell pair (even though they neverinteracted directly).

This process has been used in real experiments, such as therecent “loophole-free Bell tests,” which we’ll learn aboutlater in the course. Quantum teleportation itself has been
demonstrated experimentally many times.

10.1.2The GHZ State and Monogamy of Entanglement

We’ve seen the Bell pair, and what it’s good for. There’s a 3-qubit analogue of√. We’ll see the GHZ state again later in theit called the GHZ state, |000i+|111i
2

74 LECTURE 10. TELEPORTATION, ENTANGLEMENT SWAPPING. . .
course, but for now we’ll use it to illustrate an interesting conceptual point.
Let’s say that Alice, Bob, and Charlie hold random bits, which are either all
0 or all 1 (so, they’re classically correlated). If all three of them get together,
they can see that their bits are correlated and the same is true even if only
two of them are together.
Now suppose instead that the three players share a GHZ state. With all
three of them together they can see that the state is entangled, but what
if Charlie is gone? Can Alice and Bob see that they’re entangled with eachother? No. To see this observe that by the No-Communication Theorem,
Charlie could’ve measured without Alice and Bob knowing. But, if he did,then Alice and Bob would clearly have classical correlation only: either both
|0i’s (if Charlie got the measurement outcome |0i) or both |1i (if Charlie got|1i). From this it follows that Alice and Bob have only classical correlation
regardless of whether Charlie measured or not.
A different way to see this is to look at the reduced density matrix of thestate shared by Alice and Bob,

1
0 0 0
2
0 0 0 0ρAB = 
0 0 0 0 .
0 0 0 21
Notice that this is different than the density matrix of a Bell pair,
1

1
0
0
2
2
0 0 0 0.
ρBell = 
0 0 0 01
0 0 122This is one illustration of a general principle called the Monogamy of Entanglement.
Simply put, if Alice has a qubit that is maximally entangled with Bob’s qubit, then that
qubit can’t also be maximally entangled withCharlie’s qubit. With the GHZ state, you can
only see the entanglement if you have all threequbits together. This is sometimes analogized to
the Borromean Rings, an arrangement of threerings with the property that all three are linked together, but removing any
one ring unlinks the other two.
There are other 3-qubit states that behave differently than the GHZ state.
√, there’s some entanglement between Alice andIn the W state, |100i+|010i+|001i3

10.1. QUANTUM TELEPORTATION

75

Bob, and there’s some entanglement between Alice and Charlie, but neither
pair is maximally entangled.
In the next lecture, we’ll make more rigorous precisely what we mean bysaying Alice and Bob share “some” entanglement when we talk about how toquantify entanglement.

Lecture 11:
glement

Quantifying Entan-

How do you quantify how much entanglement there is between two quantum
systems? It’s worth noting that we get to decide what we think a measure ofentanglement ought to mean. We’ve seen how it can be useful to think of Bellpairs as a resource, so we can phrase the question as “how many ‘Bell pairs ofentanglement’ does a given state correspond to?”A priori, there could be different incomparable kinds of entanglement that are good for different things. That’s actually the case for entangled mixed states, or entangled purestates shared by three or more parties. But, for the special case of an entangled pure state shared by two parties,
it turns out that there’s a single measure of entanglement
which counts the number of Bell pairs needed to form thestate, or equivalently the number of Bell pairs that can beextracted from it.
So, given a bipartite stateX

αij |iiA |jiB ,(11.1)ij

how do we calculate many Bell pairs it’s worth? Our first observation is thatgiven any bipartite pure state you can always find a change of basis on Alice’s
side and another change of basis on Bob’s side that puts the state into thesimpler formXλi |vi i |wi i ,(11.2)iwhere the set of states {|vi i} form an orthonormal basis and likewise for the set76

11.1. SCHMIDT DECOMPOSITION

77

of states {|wi i}—though the sets of states {|vi i} and {|wi i} are not necessarily
orthonormal with respect to each other. We call the form of the state inEquation 11.2 the Schmidt Decomposition or Schmidt Form.

11.1

Schmidt DecompositionP
Suppose we have a quantum state written in the form ij αij |iiA |jiB . Then
we can rewrite the coefficients αij in matrix form, given byα0,0 α1,0
A =  ..
 .

α0,1 · · ·
α1,1
..
.

αn−1,0α0,n−1.
(11.3)

αn−1,n−1

We can then use the Singular Value Decomposition (SVD) to rewrite
our matrix as A = U ΛV † , where U and V are n × n unitary matrices, andΛ is an n × n diagonal matrix whose entries we call the singular values of A.
Rearranging the factorization we find that Λ = U † AV , and so the changes ofbasis which Alice and Bob would need to perform in order to get their state
into Schmidt form are given by U † and V respectively.
Note that while we won’t prove it here there are efficientalgorithms for calculating the SVD of a matrix and these
are available out-of-the-box in any linear algebra software.
Measuring in the {|vi i |wi i} basis would yield the probability distribution>|λ0 |2 , · · · , |λn−1 |2 .

11.2

Von Neumann Entropy

Recall that for a classical probability distribution P = [p0 , · · · , pn−1 ]> , its
Shannon entropy is
n−1
X

 
1
.
H(P ) =
pi log2pi
i=0(11.4)

There’s a generalization of this measure that works for quantum states

78

LECTURE 11. QUANTIFYING ENTANGLEMENT(both pure and mixed), called the von Neumann Entropy. The von Neumann entropy of a mixed state ρ is
n−1
X

 
1
S(ρ) =
γi log2γii=0(11.5)

where {γi } are the eigenvalues of ρ. If you diagonalize a density matrix,
the diagonal represents a probability distribution over n possible outcomes(corresponding to the eigenstates of ρ), and taking the Shannon entropy ofthat distribution gives you the von Neumann entropy of your quantum state.
Note that physicists often use an alternate convention for the von Neumannentropy using the natural logarithm rather than base-2 (we’ll always use base-2
in this course).
Another way we can think about the von Neumann entropy is as follows.
Say you looked at all the possible probability distributions that could arise bymeasuring the mixed state ρ in all possible orthogonal bases. Then the von
Neumann entropy of ρ is the minimum of the Shannon entropies of all those
distributions,S(ρ) = min H diag U ρU †
U



,

(11.6)

where diag(A) is the length-n vector obtained from the diagonal of the n × nmatrix A. This alternative definition makes it immediately clear that the
von Neumann entropy of any pure state |ψi is 0, because there’s always somemeasurement basis (namely, a basis containing |ψi) that returns a definite
outcome.
For example, you could choose to measure the state |+i in the {|0i , |1i}
basis and you’ll have complete uncertainty and a Shannon entropy of 1. But,
if you measure |+i in the {|+i , |−i} basis you’ll have a Shannon entropy of 0
because you’ll always get the outcome |+i. As such, the von Neumann entropyof |+i is 0. By contrast, the von Neumann entropy of the maximally mixed
state, I2 , is 1; similarly, the von Neumann Entropy of the n-qubit maximally
mixed state is n.

11.2.1

Entanglement Entropy

We can now begin to answer the question posed at the start of this lecture:
how do you quantify how much entanglement there is between two quantum

11.2. VON NEUMANN ENTROPY

79

systems? Suppose Alice and Bob share a bipartite pure state
|ψi =

X

αij |iiA |jiB .

(11.7)

ij

To quantify the entanglement of this state we’ll use a measure called the
Entanglement Entropy. The entanglement entropy of a (pure) bipartite
state is given by>E(|ψi) = S(ρA ) = S(ρB ) = H( |λ0 |2 , · · · , |λn−1 |2 )(11.8)

where ρA an ρB are the reduced density matrices corresponding to Alice and>
Bob’s subsystems respectively and where |λ0 |2 , · · · , |λn−1 |2 is the probability distribution corresponding to the Schmidt form of Alice and Bob’s sharedstate. This definition has the desirable properties that the entanglement entropy of any product state |ψi ⊗ |φi is 0 and the entanglement entropy of a√
is 1.
Bell pair |00i+|11i
2
You can think of the entanglement entropy of a state as either the numberof Bell pairs it would take to create it or as the number of Bell pairs that you
can extract from it. It’s not immediately obvious that these numbers are thesame, but for pure states they are. For mixed states they need not be!
As an example, suppose Alice and Bob share the state
|ψi =

4
3
|0i |+i + |1i |−i .
55Then we can calculate the entanglement entropy using any of the three equivalent definitions in Equation 11.8. In this case we already have the state written
in Schmidt form, so we can directly use the last definition in Equation 11.8:
 2
 2 !  2
 2 !
35
4
5
E(|ψi) =
log2
+
log2
≈ .942.
5
3
5
4This means that if Alice and Bob shared 1000 copies of |ψi, they’d be able toteleport about 942 qubits. We can also confirm that the other two definitions
for the entanglement entropy, in terms of the von Neumann entropies of Aliceand Bob’s reduced density matrices, do in fact give the same value. Suppose
Bob measures his state in the {|+i , |−i} basis. Bob sees |+i with probability
9/25, in which case Alice’s qubit is |0i, and he sees |−i with probability 16/25,
in which case Alice’s qubit is |1i. As such, the reduced density matrix for
Alice’s qubit is

80

LECTURE 11. QUANTIFYING ENTANGLEMENT

ρA =

9
16
|0i h0| +|1i h1| .
25
25

Likewise, suppose Alice measures her qubit in the {|0i , |1i} basis. Alice willsee |0i with probability 9/25, in which case Bob’s qubit is |+i, and she’ll see|1i with probability 16/25, in which case Bob’s qubit is |−i. As such, thereduced density matrix for Bob’s qubit is
ρB =

16
9
|+i h+| +|−i h−| .
25
25

Both of these reduced density matrices are already diagonalized and so we canimmediately see that they share the same eigenvalues—though they have different eigenvectors. Moreover, the values of the eigenvalues correspond exactly
to the values of the squared coefficients of the Schmidt form of the state. As
such, we’ll find precisely the same value for the entanglement entropy regardless of whether we calculate it by finding the Schmidt form of a given state orby finding one of the reduced density matrices. In practice, this means you
should feel free to use whichever method is most convenient.

11.3

Mixed State Entanglement

For bipartite mixed states, there are two values to consider. The Entanglement of Formation, EF (ρ), is the number of ebits needed per copy of ρ
created in the asymptotic limit of a large number of copies of ρ. We assume
Alice and Bob are allowed unlimited local operations and classical communication (called “LOCC” in the lingo) for free in any protocols they use. The
Distillable Entanglement, ED (ρ), is the number of ebits that Alice and Bob
can extract per copy of ρ in the asymptotic limit where they have many copiesof ρ, again assuming LOCC is free.
Clearly EF ≥ ED , since if you could ever get out more entanglement thanyou put in it would give you a way to increase entanglement arbitrarily using
LOCC, which is easily seen to be impossible. But, what about the other direction? It turns out that there exist bipartite pure states for which EF  ED ,which is to say that those states take a lot of entanglement to make, but then
you can only extract a small fraction of the entanglement that you put in.
There are even states (called bound entangled states) for which EF > 0, but
ED = 0. A detailed treatment of such states is beyond the scope of this course.

11.3. MIXED STATE ENTANGLEMENT81

We call a bipartite mixed state ρ separable if there’s any way to write it
as a mixture of product states,ρ=X

pi |vi i hvi | ⊗ |wi i hwi | .

(11.9)i

A mixed state is called entangled if and only if it’s not separable. This condition is subtle, as it sometimes happens that a density matrix looks entangled,
but it turns out there’s some non-obvious decomposition which shows it’s actually separable. It’s important to note that the converse of the separability
criterion in Equation 11.9 is not true. That is, being able to decompose amixed state into a convex combination of entangled states does not imply
that the mixed state is entangled. A simple counterexample is the two-qubit
maximally mixed stateI|00i h00| + |01i h01| + |10i h10| + |11i h11|=.
(11.10)44This state clearly satisfies the criterion in Equation 11.9, and so this state isseparable. However, we can also write the maximally mixed state as
3I
1X=|φi i hφi | ,4
4 i=0where the |φi i’s are each one of the 4 Bell states|00i − |11i
|00i + |11i√√
|φ1 i =
2
2
|01i + |10i
|01i − |10i√√
|φ2 i =
|φ3 i =
2
2
|φ0 i =In a sense we got some initial intuition about the difficulty of this problem
in Lectures 6 and 7, where we saw that even for the case of a one-qubit mixed
state there are an infinite number of decompositions as convex combinationsof pure states. Indeed, in 2003 Leonid Gurvits proved a pretty crazy fact: if
you’re given as input a density matrix ρ for a bipartite state, then deciding
whether ρ represents a separable or entangled state is an NP-hard problem!
As a result, unless P = NP, there can be no “nice characterization” fortelling apart entangled and separable bipartite mixed states—–in contrast to
the situation with bipartite pure states.
This helps to explain why there are endless paper writing

82

LECTURE 11. QUANTIFYING ENTANGLEMENT
opportunities in trying to classify different types of entanglement. . .

Lecture 12: Interpretations of Quantum Mechanics
At this point in the course, we’re finally in a position to step back and ask,
what is quantum mechanics telling us about reality? It should be no surprisethat there isn’t a consensus on this question (to put it mildly)! But, regardless of your own views, it’s important to know something about the various
positions people have defended over the years, as the development of these
positions has sometimes gone hand in hand with breakthroughs in quantum
mechanics. We’ll see an example of this later with the Bell inequality, and arguably quantum computing itself is another example. Most discussions about
the implications of quantum mechanics for our understanding of reality centeraround the so-called Measurement Problem. In most physics texts (and in
this class for that matter) measurement is introduced as just a primitive operation whose implications we don’t try to understand more deeply. However,there’s a fundamental weirdness about measurement in QM, which stems fromthe fact that the theory seems to demand both:
I Unitary evolution in which |ψi → U |ψi.
I Measurements in which a state collapses to some outcome |ii with prob-

ability | hψ|ii |2 .
In other words, quantum mechanics seems to work in a way that’s deterministic, reversible, and continuous most of the time, except during measurement
which is the only time we see it work in a way that’s probabilistic, irreversible,and discontinuous. So we can phrase the question as: How does the universe
know when to apply unitary evolution and when to apply measurement? People have argued about the correct interpretation of quantum mechanics foralmost 100 years. The discussion is sometimes compared to the discussion
about the nature of consciousness (which has gone on for millennia) in thatthey both tend to devolve into people talking in circles around each other.
But, it’s nonetheless worthwhile to understand the main schools of thought.
83

84

LECTURE 12. INTERPRETATIONS OF QUANTUM MECHANICS

12.1

The Copenhagen Interpretation

The Copenhagen Interpretation was the preferred interpretation of most of
the founders of quantum mechanics. It’s closely associated with Niels Bohr andhis institute in Copenhagen (hence the name) and with Werner Heisenberg.
Note that the different founders said different and sometimes contradictory
things, sometimes in very abstruse language, so it’s notoriously hard to pin
down what the “Copenhagen Interpretation” actually is! Essentially though,the Copenhagen viewpoint is that there are two different worlds (or parts ofreality): the quantum world and the classical world. We live in the classicalworld where objects have definite locations and states and where objects canbe measured without significantly altering them. But, in doing experiments
we’ve discovered that there also exists the quantum world “beneath” ours
which obeys very different rules. Measurement in this view is the operationthat bridges the two worlds. It lets us “peek under the hood” into the quantum
world and see what’s going on.
Bohr wrote long tracts in which he argues that even making statements
about the outcomes of quantum measurements presupposes that there must bea classical world in which those statements can be sensibly made. So, there’s
some “boundary” or “cut” between the quantum and classical worlds. The
exact location of this boundary might be fuzzy and might vary dependingon what sort of question we’re asking. In any case, we should never makethe error of insisting that our commonsense classical concepts remain valid on
the quantum side of the boundary. Believers in the Copenhagen interpretation
tend to say things like “if this doesn’t make sense to you, then you’re just stuckin the old classical way of thinking, and you need to change; the problem is
not with quantum mechanics, it’s with you.”12.1.1“Shut Up and Calculate”

Our next option is closely related to the Copenhagen interpretation. This isprobably one of the preferred “interpretations” for many physicists, chemists
and others who work with quantum mechanics. It says that at the end of
the day quantum mechanics works and it correctly predicts the results ofexperiments. This is all we can reasonably ask of a scientific theory, or at least
all that it’s fruitful to ask. Prof. Aaronson likes to say that the Copenhagen
interpretation is basically just shut up and calculate (SUAC) without the SU
part! Copenhagen starts from the idea that “it’s pointless to philosophize
about what this means,” but then elevates that to a philosophy which ofcourse is a little ironic.

12.2. SCHRÖDINGER’S CAT AND WIGNER’S FRIEND

85

While the SUAC view has some obvious practical advantages, it seems
clear that it can’t satisfy people’s curiosity forever. This is not only because
science has always aspired to understand what the world is like, with experiments and predictions a means to that end. A second reason is that as experimenters become able to create ever larger and more complicated quantum
superpositions—in effect “breaching” the Copenhagen boundary between thequantum and classical worlds—it becomes less and less viable to “quarantine”
quantum mechanics as simply a weird mathematical formalism that happens
to work for predicting the behavior of electrons and photons. The more QM
impinges on the world of our everyday experience, the more it seems necessary
to come to terms with whatever it says about that world.

12.2

Schrödinger’s Cat and Wigner’s Friend

There were physicists in the 20’s and 30’s who never accepted the Copenhagen
interpretation, the most famous of whom were Einstein and Schrödinger. Between them they came up with various thought experiments designed to try
and show just how untenable it is to have a rigid boundary between the quantum and classical worlds. By far the most famous example is Schrödinger’sCat, which first appears with Einstein remarking in a letter that if you thinkof a pile of gunpowder as being inherently unstable you could model it as aquantum state which looks like
| i+| i√2
Then, Schrödinger adds some flair by asking what happens if we create aquantum state that corresponds to a superposition of states, in one of whicha cat is alive and the other the cat is dead? (Or perhaps a superposition of
happy and sad, √12 (| i + | i), if you prefer a less grisly thought experiment).
He isolates the state of the cat from the external environment by putting it in
a box. The point of Einstein and Schrödinger’s thought experiment is that theformal rules of quantum mechanics apply whenever you have distinguishable
states, regardless of their size. In particular, they say that in principle you cancreate arbitrary linear combinations of such states. By the time we’re talking
about something as big as a cat, it seems patently obvious that we should haveto say something about the nature of what’s going on before measurement.
Otherwise we’d devolve into extreme solipsism—saying, for example, that thecat only exists once we’ve opened the box to observe it.

86

LECTURE 12. INTERPRETATIONS OF QUANTUM MECHANICS

Wigner’s Friend is a similar thought experiment proposed by the theoretical physicist Eugene Wigner in 1961. Suppose that Wigner could be put
into an equal superposition of thinking one thought and thinking another one(say wanting either pancakes or eggs for breakfast), which we model as||Wigner0 i + |Wigner1 i
√
=
2

i+|
√
2

i

.

Now, consider the joint state of Wigner and a friend who is capable of measuring the state of Wigner’s mind, but hasn’t done so yet.
|Wigner0 i + |Wigner1 i√=
2|Wigner’s Friendi |Wigner0 i + |Wigner’s Friendi |Wigner1 i√
2|Wigner’s Friendi ⊗From Wigner’s point of view, he’s thinking one thought or the other one. But,
from his friend’s point of view, Wigner isn’t thinking either of them until
a measurement gets made. After Wigner’s friend makes a measurement, thestate of his own mind will change to either a state in which he saw that Wigner
wanted pancakes or one where he saw Wigner wanted eggs. At that point we’ll
have an entangled state like
|Wigner’s Friend0 i |Wigner0 i + |Wigner’s Friend1 i |Wigner1 i√
2
But then what happens if another friend comes along, and then another? The
point is to highlight an apparent incompatibility between the perspectivesof different observers. It seems like either we need to retreat into a sort ofsolipsism—holding that an event that happened for Wigner might not have
happened for his friend—or else we need some way of regarding the measurement as fictitious.

12.3

Dynamical Collapse

If quantum mechanics doesn’t make sense to us, it’s worth at least considering
the possibility that it’s not a complete theory. That is, maybe it does a goodjob of describing microscopic systems but there are additional unaccountedfor rules needed to describe reality as a whole. Perhaps there may be somephysics that we haven’t discovered yet which would show that qubits normally
evolve via unitary transformations, but that for sufficiently large systems the12.3. DYNAMICAL COLLAPSE

87

superposition states tend to spontaneously collapse to some classical state. Inthat case, we could view collapse as a straightforward physical process thatturns pure states into mixed states. Theories which posit the existence of suchan undiscovered collapse mechanism are generally referred to as Dynamical
Collapse Theories. In order to make contact with existing quantum theory,
dynamical collapse theories generally suppose that the new mechanism has theeffect of physically instantiating the collapse of superposition states to classicaloutcomes with probabilities given by the Born rule. That is,Xαi |ii → |ii

with probability |αi |2iIn the Schrödinger’s cat example, dynamical collapse theories would saythat it doesn’t matter how isolated the box is, there is some yet-unknown
physical law that says that a system that big would quickly evolve into amixed state.
| ih | + | ih || i+| i√→22Note that in principle, there’s a measurement that can distinguish the twostates above.
Such a measurement would admittedly be absurdly hard to
implement. In fact, a recent result by Prof. Aaronson says
informally that if you have the technological capability to
distinguish the two states above, then you also have thetechnological capability to rotate between the cat’s “alive”
and “dead” states. For this reason, the Schrödinger’s cat
experiment involves far less animal cruelty than most people say! If you can do the experiment at all and prove thatyou did it, then you can also bring a dead cat back to life!
Setting aside technological difficulties, for us the relevant point is that insaying that a superposition state can evolve to a mixed state we’re necessarily
proposing new physics. This prediction is different from what we’d find using
standard quantum mechanics and so in principle has testable implications. In
other words, this isn’t really interpreting quantum mechanics so much as it’sproposing a rival theory! Physicists have a high bar for such proposals; theburden of proof is on the person proposing the new law to explain in quantitative detail how it works. In this case that would mean giving a criterion forexactly which systems are “big” enough, or whatever, to trigger a collapse like

88

LECTURE 12. INTERPRETATIONS OF QUANTUM MECHANICS

the above—ideally deriving that criterion from more fundamental laws. Somesuggestions include:
I Collapse happens when some number of atoms get involved.
I Collapse happens after a certain total mass is reached.
I Collapse happens when a system reaches a certain level of “complexity.”On their face all these views seem contradictory to our understanding ofphysics which relies on reductionism; each atom’s dynamics obey the same
set of simple equations regardless of how big or complicated a system theatom might be part of.

12.3.1

Ghirardi-Rimini-Weber (GRW) Theory

Ghirardi-Rimini-Weber (GRW) Theory avoids the contradiction with
reductionist principles by positing that each atom has some tiny probabilityof collapsing at each point in time. For a system like Schrödinger’s cat, we only
need one atom to collapse in order to cause the entire cat to collapse to the“alive” or “dead” states. This is consistent with the usual partial measurement
rule of quantum mechanics. By analogy, measuring just one qubit of|0 · · · 0i + |1 · · · 1i√
2will cause all of the qubits to collapse to either |0 · · · 0i or |1 · · · 1i. While theprobability for some given atom to collapse is minuscule, with a sufficiently
large number of atoms in our system (say ∼ 1023 for a typical cat) the probability that at least one of the atoms has collapsed can be overwhelming. In the
GRW proposal, macroscopically large superposition states (often called catstates) are inherently unstable—the bigger the system, the shorter expected
lifetime of maintaining a Schrödinger-cat-like state.

12.3.2

Penrose Theory

Penrose Theory is an alternative approach to dynamical collapse which saysthat superpositions spontaneously collapse when the superposed objects havea sufficiently large mass and are separated by a sufficiently large distance. Why
mass and distance? Say we have a large massive object in a superposition of
two different spatial locations:
1
√ |
2

..
.

i+|

..
.


i .

12.3. DYNAMICAL COLLAPSE

89

General relativity tells us that mass curves nearby space-time in a manner
analogous to a weight deforming a mattress. This means that a mass in one
location would make spacetime curve differently than the same mass in adifferent location. The thing is, no one really knows how to combine generalrelativity and quantum mechanics; it’s one of the biggest unsolved problems
in physics. Ordinary quantum mechanics presupposes a fixed space and time,or at the very least fixed causal structure. In terms of quantum circuits, if
you like, we require the ability to assign to a collection of qubits some definite
order to the gates acting on those qubits. No one quite knows what it means tohave a quantum superposition of different causal structures—yet, that seems
to be what we’d be talking about in the situation with the widely-separated
masses. So, Penrose’s proposal is basically that this could be the place where
quantum mechanics breaks down and is superseded by a more complete theory
that includes gravitationally-induced “spontaneous collapses.”Penrose then has further ideas about how all of this might
be related to consciousness, which we won’t go into.
One difficulty with dynamical collapse theories is that experimental groups
have continued to produce examples of larger and larger states in superposition. As long as that continues, it seems like the believers in these theories
will always need to be on the defensive—adjusting their answers to questions
like “how much mass is enough to collapse a state?” to avoid contradicting thelatest experiments. Early in this course we discussed the significance of the
double-slit experiment performed with photons. In 1999 the Zeilinger group
the University of Vienna managed to perform the double-slit experiment withbuckyballs (molecules with 60 carbon atoms and hundreds of electrons). In
2019 a collaborative effort between experimentalists at the University of Vienna and the University of Basel successfully performed the experiment withlarge organic molecules consisting of ∼ 2000 atoms.
Superconducting Circuits
Beyond the double-slit experiment, another quantum phenomenon which isroutinely used today to perform experiments with a macroscopically large
number of particles is superconductivity. If you take a metallic coil (made ofaluminum, for example) that is perhaps a micrometer across and cool it tonearly absolute zero, it is possible to induce a dissipationless current flow ina superposition of clockwise or counterclockwise around the coil. A picture ofsuch a loop can be found in Figure 12.1. The number of electrons constituting

90

LECTURE 12. INTERPRETATIONS OF QUANTUM MECHANICS

this current can number in the billions or trillions and so this is an example
of a quantum superposition involving billions of particles!

Figure 12.1: Scanning electron microscope (SEM) image of a superconducting flux qubit fabricated at the NTT Basic Research Lab in Japan, from
DOI:10.1142/9789812774705 0003. When cooled to near absolute zero temperature the current in the loop can be in a superposition of circulating clockwise
and counter-clockwise.
We’ll come back to these superconducting coils at the end of
the course as they’re an important technology for quantum
computers.

Limitations of Dynamical Collapse
Penrose made a specific prediction for the mass scale at which collapse happens—about 1 Planck mass, which is roughly the mass of a dust mite—which might
be testable in our lifetime. But, with GRW the prediction is basically justmade to avoid contradicting any existing experiments.
One position, popular among quantum computing skeptics, says that:
Perhaps a frog can be in a superposition of two states. However, acomplex quantum computer wouldn’t work because quantum systems spontaneously collapse after they achieve “sufficient complexity” (whatever that means).
This position is interesting because it could be falsified by building a scalable quantum computer. Making potentially falsifiable claims is what enables
us to move these discussions from the realm of philosophy to science.

12.4. THE MANY-WORLDS INTERPRETATION

91

But what happens if we keep doing experiments and quantum mechanics
keeps perfectly describing everything we see? In particular, suppose we don’t
want to add any new physical laws but, we also insist on being scientificrealists—holding that there exists a real state of the universe and that the jobof physics is to describe that state, not just to predict the results of measurements. The next interpretation is an attempt to satisfy those constraints bygetting rid of a fundamental role for measurement altogether.

12.4

The Many-Worlds Interpretation

In 1957 Hugh Everett III, then a PhD student working under John Archibald
Wheeler at Princeton, proposed a new interpretation of quantum mechanics
he called the “relative state formulation.” We now refer to this interpretation
as the Many-Worlds Interpretation (MWI) of quantum mechanics. Thisfamous view holds that the entire universe has a single quantum state |ψi andthe entire history of the universe is just the result of the vector |ψi undergoing
unitary evolution.
In the MWI what we call “measurement” or “collapse” is a result of quantum systems becoming entangled with each other when they interact. In
particular, your brain—not to mention your measuring apparatus, the air
molecules in the room, etc. . . —all become entangled with the quantum systemthat you’re measuring. You can think of it as a giant CNOT gate with thesystem you’re observing as the control qubit and you and the environment as
the target qubit. This situation is analogous to what we saw in the Wigner’sfriend though experiment.
|0i |You0 i + |1i |You1 i|0i + |1i√√
|Youi →
2
2
The thing is, if you take this view seriously it implies that you yourself
have now “branched” into two possibilities, one where you observed the qubit
in the |0i state and another where you observed the qubit in the |1i state.
Because unitary evolution is linear, these two branches are unlikely ever tointerfere with each other again, or at least not for many quadrillions of years(more about that later). So, we might imagine, your experience is as if only
one of the branches was realized—but, in truth neither branch is more real
than the other.

92

LECTURE 12. INTERPRETATIONS OF QUANTUM MECHANICS

More generally, according to MWI the universe“branches” each and every time a microscopic quantum state gets amplified to have macroscopic effect—
even if there’s no one around to observe the amplification (e.g., if it’s in the interior of the Sun or something). There’s a staggering amount of branching
happening! So for example, there are some branchesof the quantum state of the universe where Austin
is sunny at a specific moment one month from now,others where it’s rainy, others where it’s been destroyed in a nuclear war, etc., and no one of these branches is more “real”
than the rest.
Some variants of the MWI choose words carefully to avoid sounding likethere’s literal branching into different, equally-real worlds of experience, but
that’s basically what they all imply. In fact, when Everett first came up with
MWI as a grad student at Princeton, John Wheeler told him to remove fromhis paper all references to the physical reality of parallel worlds, because Bohrand his friends had strenuously objected to the idea. Everett did so, and partly
as a result it took 15 years for the rest of the physics community to rediscoverEverett’s proposal and understand what it meant.
After publishing his thesis about MWI Everett left theoretical physics to become a nuclear war strategist for thePentagon. One of the only public lectures he ever gave on
MWI was here at UT Austin, decades later, when people
were finally coming around to the idea. David Deutsch,
the biggest current advocate of the MWI and one of thefounders of quantum computing, was there.
One issue that we should return to is interference between branches of
the wavefunction. If different branches could interfere with each other, it
would be as if not just the future but the past was constantly shifting, withdestructively interfering paths (and their respective histories) having fleeting
existences. There would be no definite history of things that happened andwere recorded. To avoid this we need the |0i |You0 i branch to not affect the|1i |You1 i branch and vice versa. Both branches might be equally real, but once
you’re in one of the branches you ought to be able to continue doing physics as
if your branch was the only real one. Fortunately, the usual rules of quantum
mechanics ensure this is the case; we don’t need to add anything extra. Recall
that to calculate the amplitude of a given basis state following some sequence12.4. THE MANY-WORLDS INTERPRETATION

93

of unitary transformations, you add up a contribution from every possible
path that ends at that state. We saw an example of this in process in Figure
3.2. Interference happens only if two different paths lead to exactly the sameoutcome—meaning every single atom in the universe in the exact same state.
While that’s not impossible, it’s massively “thermodynamically disfavored,”which basically means that it’s unlikely to happen for the same reason an egg
unscrambling itself is unlikely to happen. In fact, the constant proliferation of
branches—the way the universe’s state, |ψi, constantly sprouts new branchs
but almost never recombines them—can be seen as literally an instance of theSecond Law of Thermodynamics in action, a process that constantly increases
the universe’s entropy.
Interestingly, if we also believed that the universe was only finitely large—
and in particular that it could be fully described by the unitary evolution ofa finite number of qubits (say 10122 of them)—then eventually we’d run outof room and the branches would necessarily start colliding with each other.
Even under that assumption, there doesn’t seem to be any reason for this tohappen even in (say) the next 10100 years.
We said before that measurement is the one random and irreversible part ofquantum mechanics. However, the MWI denies that even that part is random
or irreversible. After applying a unitary transformation U which induces abranching corresponding to a “measurement”, we could in principle always
apply U † to unperform the “measurement.” Just like with unscrambling an
egg though, thermodynamics isn’t going to make it easy.
Let’s now discuss some of the most common other questions people haveabout Many Worlds.
Even if we accept that “measurements” have no fundamental physical status—
still, where do the apparent probabilities come from? That is, why does measuring a qubit α |0i + β |1i in the {|0i , |1i} basis yield the outcomes |0i and|1i with probabilities |α|2 and |β|2 respectively?
It’s not enough to say that sometimes we see |0i and sometimes we see |1i,
quantum mechanics gives very specific probabilities for each of these events tooccur. If the world is just branching once for each observation, then how can
we justify these probabilities as corresponding to anything meaningful? Doesan “|α|2 fraction of your soul” go down one branch while a “|β|2 fraction ofyour soul” goes down the other?
Some philosophers don’t like this because if all the worlds are equally real,then why wouldn’t they just occur with equal probabilities? Why botherwith amplitudes at all? Everett’s response was to argue that if the universe
branched many times in succession then in “almost all branches” (where “almost all” is measured by amplitude) it would look like the Born probability

94

LECTURE 12. INTERPRETATIONS OF QUANTUM MECHANICS

rule was obeyed. But, many people in the past half-century have been unsatisfied with that argument, seeing it as circular—as it essentially smuggles theBorn rule into the definition of “almost all branches”! So, proponents havecontinued to look for something better.
There are many arguments, which we won’t go into here, that try to formalize the intuition that the Born probabilities are naturally “baked into”
how quantum mechanics works. After all, unitary evolution already singles
out the 2-norm as special by preserving it, so then why shouldn’t the probabilities also be governed by the 2-norm? More pointedly, one can argue that,
if the probabilities were governed by something other than the 2-norm, thenwe’d get bizarre effects like faster-than-light communication. But, while thesearguments help explain why the Born rule is perhaps the only choice of probability rule that makes internal mathematical sense, they still leave slightly
mysterious how probability enters at all into Everett’s vision of a deterministically evolving wavefunction. In Everett’s defense, one could ask the samequestions—where do these probabilities come from? why should they follow the
Born rule, rather than some other rule? —in any interpretation, not just in
MWI.
If there’s no experiment that could differentiate the Copenhagen Interpretation from Many Worlds, why bother arguing about it?
Many Worlders say that the opponents of Galileo and Copernicus could
also claim the same about the Copernican versus Ptolemaic theories, since
Copernican heliocentrism made no difference to the predictions of celestial
movement. Today we might say that the Copernican view is better since if
you were to fly outside of the solar system and see all the planets (including
Earth) rotating around the far more massive sun, you’d realize that the Copernican was closer to reality; it’s only our parochial situation of living on Earththat ever motivated geocentrism in the first place. If we push this analogy
further, it might be harder to think of anything similar for the Many Worlds
interpretation, since quantum mechanics itself explains why we can’t really
get outside of the state |ψi to see the branching—or even get outside our own
branch to interact in any way with the other decoherent branches.
There is one neat way you could imagine differentiating the two, though.
Before we talked about doing the double-slit experiment with larger and larger
systems. Bringing that thread to its logical conclusion, what if we could run
the double-slit experiment with a person going through the slits? It seems
like it would then be necessary to say that “observers” can indeed exist insuperpositions of having one experience and having a different one. This iswhat the MWI said all along, but it seems to put a lot of rhetorical strain on
the Copenhagen interpretation. If you talk to modern Copenhagenists about12.4. THE MANY-WORLDS INTERPRETATION

95

this they’ll often take a quasi-solipsistic view, saying that if this experimentwere run “the person behaving quantumly doesn’t count as an observer; onlyI, the experimenter, do.” Of course, the Wigner’s Friend thought experiment
was trying to get at this same difficulty.

Figure 12.2: Potential experimental design for double-slit experiment using
people. Best of luck to the future physicists who need to get this past their
university’s IRB.
Let’s say I buy into the argument that the universe keeps branching. In
what basis is this branching occurring?
This third question is called the Preferred Basis Problem. We talked
about Schrödinger’s cat as branching into the | i state and the | i state.
But mathematically we could equally well have decomposed the cat’s state ina basis like:| i+| i√2

| i−| i√2

So, is there anything besides our intuition to “prefer” the first decomposition over the second one? There’s a whole field of physics that tries to answer
questions like these, called Decoherence Theory. The central idea is that
there are certain bases whose states tend to be robust to interactions with theenvironment; most bases, however, don’t have this property. In the example
above, decoherence theory would explain that an alive cat doesn’t easily decohere if you poke it, but a cat in the √12 (| i + | i) state does, because the | i
and | i branches interact differently with the environment. This, according
to decoherence theory, is more-or-less how the laws of physics pick out certain
bases as being special.

96

LECTURE 12. INTERPRETATIONS OF QUANTUM MECHANICS

From the standpoint of decoherence theory we can say that an event has“definitely happened” only if there exist many records of the event spreadthrough the environment, so that it’s no longer feasible to erase them all.
This is perhaps best compared to putting an embarrassing
picture on Facebook. If only a few friends share it, you
can still take it down. On the other hand, if the picturegoes viral, then the cat is out of the bag and deleting all the
copies becomes next to impossible.

Lecture 13: Hidden Variables andBell’s Inequality
13.1

Hidden Variable Theories

In the last lecture we discussed four different attitudes people take toward
quantum mechanics: Copenhagen, “Shut Up and Calculate,” Dynamical Collapse, and Everett’s Many-Worlds Interpretation. You might think that all
the options we’ve seen so far are bizarre and incomprehensible, and wonder if
we could come up with a theory that avoids all of the craziness. One strategy
for the development of such a theory is the introduction of hidden variables inthe system. These hidden variables are typically additional degrees of freedom
which we either don’t have access to or haven’t yet discovered. The resulting
theories are called Hidden Variable Theories.
Hidden variable theories supplement quantum state vectors with the addition of hidden ingredients. The idea is to have a state, like α |0i + β |1i,
represent “merely” a way of making a prediction about what the universe has
already set the result of measuring the qubit to be: either |0i or |1i.

13.1.1

Bohmian Mechanics

The most famous hidden-variable theory is Bohmian Mechanics, which wasdeveloped by David Bohm in the 1950s. It’s also called the “de Broglie-Bohm
theory,” because it turns out that Louis de Broglie had the exact same idea
in the 1920s—although de Broglie quickly disavowed it after the idea faced apoor reception from other quantum mechanics pioneers.
Normal quantum mechanics says that a particle is in a superposition of locations, which we can use to calculate the probability that the particle will befound in one place or another when measured—and moreover, that this superposition exhausts what can be said about the particle’s location. But, while
keeping that superposition as part of physics, we now want to say that there’s
97

98

LECTURE 13. HIDDEN VARIABLES AND BELL’S INEQUALITY

also a “real place” where the particle is, even before anyone measures it. To
make that work we need to give a rule for how the superposition “guides” thereal particle. This rule should have the property that, if anyone does measure
the particle, they’ll find exactly the result that quantum mechanics predicted
for it—since we certainly don’t want to give up on quantum mechanics’ empirical success!
At first, you might think that it would be tricky to find such a rule; indeed, you might wonder whether such a rule is possible at all. However, thereal problem turns out to be more like an embarrassment of riches! There
are infinitely many possible rules that could satisfy the above property—andby design, they all yield exactly the same predictions as standard quantum
mechanics. So there’s no experimental way to know which one is correct.
To explain this in a bit more detail, let’s switch from particle positions
back to the discrete quantum mechanics that we’re more comfortable within this course. Suppose we have a quantum pure state, represented as anamplitude vector in some fixed basis. Then when we multiply by a unitarytransformation, suppose we want to be able to say: “this is the basis state wewere really in before the unitary was applied, and this is the one we’re reallyin afterwards.” In other words, we want to take the equation


 
β0
U0,1
 ..   ..
 . = .
βn−1

Un−1,1···..
.

U0,n−1
Un−1,n−1α0  ..  . 

(13.1)

αn−1

and map it to an equation


 


|β0 |2|α0 |2
 ..  S   ...  . =|βn−1 |2|αn−1 |2

(13.2)

for some choice of stochastic matrix S (possibly depending on the input andoutput vectors). There are many, many such matrices S. For example, you
could put [|β0 |2 , · · · , |βn−1 |2 ]> in every column, which would say that you’realways jumping randomly around, but in a way that preserves the Born rule.
You could have been in a different galaxy one Planck time (∼ 10−43 seconds)
ago; now you’re here (with fictitious memories planted in your brain); whoknows where you’ll be a Planck time from now?
Bohm, however, thought not about this discrete setting, but mostly about
the example of a particle moving around in continuous Euclidean space. In
the latter case it turns out that one can do something nice that isn’t possible

13.1. HIDDEN VARIABLE THEORIES

99

with finite-dimensional unitary matrices. Namely, one can give a deterministic rule for how the particle moves around—a differential equation—that still
reproduces the Born rule at every instant in time, provided only that it reproduces the Born rule at any one time. More poetically, “God needs to use arandom-number generator to initialize the hidden variables at the beginningof time”—say, at the Big Bang—but afterwards, they just follow the differential equation. Furthermore, while the choice of differential equation isn’t quite
unique, in simple scenarios (like a particle moving around in space) there’s one
choice that seems better, simpler, and more motivated than the rest.
However, in thinking through the implications of Bohmian mechanics,
Bohm and others noticed lots of weird things. It looks very elegant withjust one particle, but new issues arise when there are two entangled particles.
Bohmian mechanics says that you need to give a definite position for both particles, but people noticed that acting on Alice’s particle would instantaneously
change the Bohmian position of Bob’s particle, however far away the particles
were—even while Bob’s density matrix remained unchanged because of the
No-Communication Theorem. Because of these instantaneous changes in theBohmian position, we refer to Bohmian mechanics as a Nonlocal Hidden
Variable Theory.
While unsettling, this still wouldn’t be useful for fasterthan-light communication, since the Bohmian hidden variables are explicitly designed to have no measurable effects
beyond the effects we’d predict using the quantum state itself.
When Bohm proposed his interpretation, he was super eager for Einstein(whose objections to quantum mechanics we’ve discussed previously) to accept
it, but Einstein didn’t really go for it, probably because of this nonlocality
problem. What Einstein really seems to have wanted (in modern terms) is a
Local Hidden Variable Theory where hidden variables not only exist, but
can be localized to specific points in space and are only influenced by things
happening close to them.

13.1.2

Local Hidden Variable Theories√, is created the qubits secretly
Imagine that when an entangled pair, |00i+|11i
2
flip a coin and decide, “if anyone measures us in the {|0i , |1i} basis let’s bothbe |0i.” More broadly, imagine that they agree in advance on such answers for
all questions that could be asked (i.e., all bases in which they could possibly

100

LECTURE 13. HIDDEN VARIABLES AND BELL’S INEQUALITY

be measured), and that each qubit carries around its own local copy of theanswers.
This is not Bohmian mechanics. In fact, around 1963 John Bell wrote a
paper that drew attention to the nonlocal character of Bohmian mechanics.
Bell remarked that it would be interesting to prove that all hidden variable
theories must be nonlocal. In other words that nonlocality isn’t just some
defect of Bohm’s proposal, but inherent to hidden variable theories in general.
The paper has a footnote saying that as the paper was going to press, such a
proof was found. This was the first announcement of one of the most famous
discoveries ever made about quantum mechanics, what we now call Bell’sTheorem.
Einstein and others had already touched on the idea of local hidden variable
theories in their philosophical debates in the 1930s. Bell was the first to ask: do
local hidden variables have any empirical consequences that disagree with thepredictions of quantum mechanics? Is there an actual experiment that could
rule out the possibility of local hidden variables? Bell came up with such an
experiment. We’ll describe it differently from how Bell did originally—more
computer sciencey—as a game with two cooperating players named (whatelse?) Alice and Bob, where the achievable win probability can be improved
through shared entanglement (to a value higher than is possible classically).
This game is called the CHSH Game.

13.2

The CHSH Game

The CHSH Game is named after four people (Clauser, Horne, Shimony, andHolt) who in 1969 wrote a paper saying “this is how to think about what
Bell did.” The game itself doesn’t involve quantum mechanics, but quantum
mechanics can help us win it.
The CHSH game could be seen as a precursor to quantum
computing, in that it’s one of the first cases where people
looked to see which information processing tasks quantum
mechanics helps us solve better—and where they enforced aconceptual separation between the task itself (which is classical) and the strategy to solve it (which can be quantum).
The idea is that Alice and Bob are placed in separate rooms and are both
given a challenge bit (x and y, respectively) by a referee, Charlie. The challenge
bits are chosen uniformly at random, and independently of each other. Alice13.2. THE CHSH GAME

101

sends an answer bit, a, back to the referee and Bob sends back an answer bit
b. Alice and Bob “win” the game iff
a + b = xy (mod 2).

(13.3)

Alice and Bob are allowed to agree on a strategy in advance (in other words
correlate their answers) and to share random bits. This situation is shown in
Figure 13.1.

Figure 13.1: Diagrammatic depiction of the CHSH game. Charlie, the referee,prepares two challenge bits x and y uniformly at random and sends themto Alice and Bob respectively. Alice and Bob in response send bits a and b
respectively (which could depend on their inputs) back to Charlie with thegoal of having a + b = xy (mod 2). In other words, Alice and Bob want toselect bits such that the parity of their selected bits is equal to the AND oftheir input bits.
A classical strategy to maximize winning probability is simply that Aliceand Bob always send the referee a = b = 0, regardless of what x and y are.
In this case, Alice and Bob win 75% of the time, losing only if x and y areboth 1. To prove that this is optimal the first step is to notice that, without
loss of generality, Alice and Bob’s strategy can be assumed to be deterministic(i.e., to involve no random bits besides x and y themselves). Any probabilistic
strategy is equivalent to a mixture of deterministic ones. As such, the win
probability for a probabilistic strategy is the weighted average over all thedeterministic strategies the probabilistic strategy employs. There must be
some deterministic strategy in the mixture that does at least as well as theaverage, so we can derandomize the protocol without negatively impacting theoverall success probability; this is called a convexity argument. This convexity

102

LECTURE 13. HIDDEN VARIABLES AND BELL’S INEQUALITY

argument holds true even if we assume that Alice and Bob have access toshared randomness.
Let’s treat Alice’s output bit a as a function of her input bit x and Bob’s
output bit b as a function of his input bit y. In order to win the game theyneed to select bits a and b satisfying the the equationa(x) + b(y) = xy (mod 2) .

(13.4)

You can easily check by enumerating cases (as we do in Table 13.1) that thisequation can’t possibly hold for all 4 values of x and y! At best it can holdfor 3 of the 4 values, which is exactly what the trivial strategy above (always
send back 0) achieves.
Strategy

x

y

a

b a+b

xy

Always Send 0

0
0
1
1

0
1
0
1

0
0
0
0

0
0
0
0

0
0
0
0

0
0
0
1

Always Send 1

0
0
1
1

0
1
0
1

1
1
1
1

1
1
1
1

0
0
0
0

0
0
0
1

Same as Input

0
0
1
1

0
1
0
1

0
0
1
1

0
1
0
1

0
1
1
0

0
0
0
1

Opposite of Input

0
0
1
1

0
1
0
1

1
1
0
0

1
0
1
0

0
1
1
0

0
0
0
1

Table 13.1: Enumeration of all possible deterministic strategies for the CHSH
game. Lines where a + b 6= xy (mod 2) are colored red.
The Bell Inequality, in this framework, is just the slightly boring statement that we proved above. Namely, that the maximum classical win probability in the CHSH game is 75%. Bell noticed an additional fact, though. If√
Alice and Bob have access to a pre-shared Bell pair, |00i+|11i, then there’s a2
better strategy. In that case, in fact, their maximum win probability is13.2. THE CHSH GAME

103

P = cos2

π 

≈ 85%
8
How do they use entanglement to achieve an improvement over the classicalwin probability? Tune in next time to find out!

Lecture 14:
14.1

Nonlocal GamesCHSH Game: Quantum Strategy

In the previous lecture we talked about the CHSH Game, and how no classicalstrategy lets Alice and Bob win it more than 75% of the time. In this lecture
we’ll see how, by using entanglement, they can win ≈ 85% of the time, anddelve deeper to try to understand what’s going on.
The quantum strategy for the CHSH game assumes that before Alice andBob go to their separate rooms and receive their challenges they pre-share
1 ebit of entanglement. In other words Alice and Bob each share 1 half of√. Upon receiving their challenge bits from the referee,a Bell pair, |00i+|11i
2
Charlie, Alice and Bob then measure their respective qubits in different bases
depending on whether their input bits x and y are 0 or 1. Based on the resultsof their measurements, Alice and Bob then output bits a and b based on theoutcomes.
Before explicitly stating the protocol we’ll first quickly introduce notation
for four states which will play a crucial roll in the protocol. These four statesare|π/8i = cosπ 
8|0i + sin

π 
8

|1i ,

5π
| i = cos
8



5π
8




|0i + sin

5π
8


|1i
(14.1)


3π|0i +sin|1i
8(14.2)The states correspond to a rotation of the standard basis either π/8 radianscounterclockwise, as in Equation 14.1, or π/8 radians clockwise, as in Equation
14.1. We actually saw at least one of these states in a different context back in
Section 5.2 when discussing the distinguishability of quantum states—though
 π
 π
|−π/8i = cos −|0i +sin −
|1i ,
8
8

104

3π
| i = cos
8



3π
8





14.1. CHSH GAME: QUANTUM STRATEGY105

we may not have written it explicitly in this form—and on the homework in
calculating the optimal basis for distinguishing the |0i state from the |+i state.
Recall that measuring in a basis {|vi , |wi} is equivalent to applying a unitarytransformation into the standard basis followed by a measurement in the standard basis. As such, we can perform measurements in the {|π/8i , |5π/8i} and{|−π/8i , |3π/8i} bases by applying unitary transformations (in this case Rπ/8
and R−π/8 , respectively) followed by a measurement in the standard basis.
Alice and Bob’s measurement strategy is as follows:
I If x = 0 then Alice measures in the {|0i , |1i} basis.

If the outcome of
Alice’s measurement is |0i, then she sends back a = 0. If the outcomeof Alice’s measurement is |1i, then she sends back a = 1.
I If x = 1 then Alice measures in the {|+i , |−i} basis. If the outcome of
Alice’s measurement is |+i, then she sends back a = 0. If the outcomeof Alice’s measurement is |−i, then she sends back a = 1.
I If y = 0 then Bob measures in the {|π/8i , |5π/8i} basis. If the outcomeof Bob’s measurement is |π/8i, then he sends back b = 0. If the outcomeof Bob’s measurement is |5π/8i, then he sends back b = 1.
I If y = 1 then Bob measures in the {|−π/8i , |3π/8i} basis. If the outcomeof Bob’s measurement is |−π/8i, then he sends back b = 0. If theoutcome of Bob’s measurement is |3π/8i, then he sends back b = 1.
This strategy has the amazing property that Alice and Bob win with probability cos2 (π/8) for all possible values of x and y.

14.1.1Analysis of Protocol

So why does this strategy work 85% of the time? Let’s analyze the results
on a case-by-case basis. We can assume without loss of generality that Alicemeasures first, due to the No-Communication Theorem. The first case is where
Alice gets x = 0 and Bob gets y = 0. As always, Alice and Bob will win if
they return a and b such that a + b = xy = 0 (mod 2). Alice measures inthe {|0i , |1i} basis and Bob measures in the {|π/8i , |5π/8i} basis. Suppose
Alice sees |0i. Then the state of Bob’s qubit also collapses to |0i. When Bob
measures his now collapsed qubit in the {|π/8i , |5π/8i} basis he sees either|π/8i or |5π/8i with probabilities
P (|π/8i) = |h0|π/8i|2 = |cos (π/8)|2 = cos2

π 

8
π 
P (|5π/8i) = |h0|5π/8i| = |cos (5π/8)| = |sin (π/8)|2 = sin2
82

2

(14.3)

106

LECTURE 14. NONLOCAL GAMESNow suppose Alice sees |1i. Then Bob’s qubit collapses to |1i and when
he measures in the {|π/8i , |5π/8i} basis he sees either |π/8i or |5π/8i withprobabilities
P (|π/8i) = |h1|π/8i|2 = |sin (π/8)|2 = sin2

π 

8
 
2
2 π
P (|5π/8i) = |h1|5π/8i| = |sin (5π/8)| = |cos (π/8)| = cos
82

2(14.4)

Recall that the goal is to output a and b such that a + b = xy (mod 2). In
this first case xy = 0 so Alice and Bob win if they return either a = b = 0 ora = b = 1. The probability they win is thus given by
P (a = 0)P (b = 0|a = 0) + P (a = 1))P (b = 1|a = 1)
  1
 
1
2 π
2 π
= cos
+ cos
2  8
2
8
2 π
= cos
8
The analysis for the case where x = 0 and y = 1 and the case wherex = 1 and y = 0 is very similar to the case above, so we’ll leave it to thereader to verify that the protocol indeed succeeds with probability cos2 (π/8)
in those cases. Somewhat more interesting is the case where x = y = 1. Inorder to analyze this case it is useful to note that the Bell state takes thesame general form regardless of which basis we choose to right it in. In other√√= |vvi+|wwi
for any orthonormal basis {|vi , |wi}. In this casewords, |00i+|11i
2
2√. Therefore, when Alice measures in the
we’ll choose to write it as |++i+|−−i2{|+i , |−i} basis she sees both |+i and |−i with equal probability. In either
case, Bob’s qubit collapses to the same outcome. Suppose Alice sees |+i. Then
when Bob measures his qubit in the {|−π/8i , |3π/8i} basis he sees |−π/8i withprobability
 
2
2 π
(14.5)
P (|−π/8i) = |h+| − π/8i| = sin
8and he sees |3π/8i with probability

P (|3π/8i) = 1 − P (|−π/8i) = 1 − sin2

π 
8= cos2π 
8(14.6)

Likewise, when Alice sees |−i, Bob sees either |−π/8i with probabilityπ P (|−π/8i) = |h−| − π/8i|2 = cos2
(14.7)
8

14.1. CHSH GAME: QUANTUM STRATEGY

107

or |3π/8i with probability
P (|3π/8i) = 1 − P (|−π/8i) = 1 − cos2

π 
8= sin2π 
8.

(14.8)

The win condition for Alice and Bob when x = y = 1 is for a and b to have
odd parity. As such, the win probability is:
P (a = 0)P (b = 1|a = 0) + P (a = 1)P (b = 0|a = 1)
π  1π 
1= cos2+ cos22  8
2
8
2 π
= cos
8
So to sumup, in all four cases the quantum protocol achieves a win probabilityof cos2 π8 ≈ 85%, higher than the classical win probability of 75%.

14.1.2

CHSH Game: Interpretations and Local Realism

How does this game relate to hidden-variable theories? Well, if all correlations
between the qubits could be explained by stories like “if anyone asks, we’reboth 0,” then we’d make a firm prediction that Alice and Bob can win the
CHSH game with at most 75% probability (because that’s how well they can
do by pre-sharing arbitrary amounts of classical randomness). This would beconsistent with the principle of local realism, which we discussed in Lecture
1. So, if they play the game repeatedly and demonstrate that they can win
more than 75% of the time, then we must conclude local realism doesn’t hold.
Notice that nowhere in this argument did we ever need to presuppose thatquantum mechanics is true.
Does Alice and Bob’s ability to succeed more than 75% of the time meanthat they are communicating? Well, we know it’s not possible for either to senda signal to the other using entanglement by the No-Communication Theorem.
One way to understand what’s going on is to work out Alice and Bob’s density
matrices explicitly.
Bob’s initial local density matrix is
1 
0
2
0 12
and after Alice measures it’s still
1
2

0

0
1
2


.

108

LECTURE 14. NONLOCAL GAMES

So in that sense, no signal has been communicated from Alice to Bob.
Nevertheless, if you knew both Alice’s measurement and its outcome, then
you could update Bob’s local density matrix to that of a pure state. Thatshouldn’t worry us though since, even classically, if you condition on what
Alice sees then you can change your predictions for Bob.
Imagine a hierarchy of possibilities for what the universe allows. Classical
Local Realism is at the bottom. Here you only ever need to use classical probability theory when you have incomplete information about physical systems,
and also signals propagate at most at the speed of light. At the top of thehierarchy is the Faster-Than-Light (FTL) Science-Fiction Utopia, where Aliceand Bob can communicate instantaneously, can travel faster than light, and soforth. People tend to believe that reality must be one or the other. So when
they read pop-science articles about how classical local realism doesn’t hold,they think, “OK, then we must live in the FTL sci-fi utopia.” Instead, thetruth—according to quantum mechanics—is somewhere in between these two,and the distinction is so subtle that perhaps no science-fiction writer would
ever have had the imagination to invent it. We live in a world where there’s
no classical local realism, but no faster-than-light communication either. Or,
to put it another way, a purely classical simulation of our universe would haveto include FTL communication, but our universe itself does not.
Maybe no science fiction writer ever came up with this possibility simply because it’s hard to think of a plot that requires Alice and Bob to win the CHSH game 85% of thetime instead of 75%!
Indeed, experimental violations of the Bell inequality are a key piece ofevidence that our world really is quantum and is not secretly classical behindthe scenes; we know from Bell that the latter possibility would require FTL
communication.

14.1.3Tsirelson’s Inequality

from anyways? It seems so arbitrary. . . It
So where is that cos2 π8 coming
may seem like the cos2 π8 is simply coming from our particular approachto the problem. You may think that maybe if we came at it another way,
we could use entanglement to win even more than
 85% of the time, perhaps
even 100% of the time. Surprisingly, the cos2 π8 win probability turns out
to be optimal for quantum strategies, even if Alice and Bob share unlimited
amounts of entanglement. This result is known as Tsirelson’s Inequality or14.1. CHSH GAME: QUANTUM STRATEGY

109

Tsirelson’s Bound and was proved in 1980 by Boris Tsirelson.
It requires a bit too much machinery to give a complete proof of Tsirelson’s
Inequality here. Instead we’ll convey the intuition by showing that among
strategies “similar to the one we used,” ours was the optimal one. Let’s saythat Alice has two angles, θ0 and θ1 , corresponding to the bases obtained byapplying Rθ0 and Rθ1 to the elements of the standard basis. If Alice receives
the input x = 0 then she measures her half of the Bell pair in the θ0 basis, andif she receives the input x = 1 she measures in the θ1 basis. Similarly, Bob has
a pair of angles φ0 and φ1 , that correspond to his measurement bases when hereceives y = 0 and y = 1, respectively. For the quantum strategy we discussed
earlier, Alice’s angles are θ0 = 0 and θ1 = π/4, and Bob’s angles are φ0 = π/8
and φ1 = −π/8.
Following essentially the same case-by-case analysis of the win probability
we did above, it can be shown that the overall win probability as a functionof θ0 , θ1 , φ0 and φ1 is given by1 2
cos (θ0 − φ0 ) + cos2 (θ0 − φ1 ) + cos2 (θ1 − φ0 ) + sin2 (θ1 − φ1 ) .
4(14.9)
Each of the four input pairs has an equal chance of occurring. In the first
three cases, Alice and Bob win iff they output the same bit. The probability ofthis is given by the squared inner product of corresponding measurement basis
elements, which is equal to the squared cosine of the difference between theirmeasurement angles. In the fourth case, Alice and Bob win iff they output
different bits. As such, we take the squared sine of the difference between theirmeasurement angles. Using the power-reduction identity from trigonometry,
we can rewrite 14.9 as
P (win) =P (win) =1 1+ [cos (2(θ0 − φ0 )) + cos (2(θ0 − φ1 )) + cos (2(θ1 − φ0 )) + sin (2(θ1 − φ1 ))]2 8(14.10)We can then get rid of the 2’s inside the cosines by folding them into our
original angles. It will be helpful to think of the cosines as the inner products
between unit vectors. In that case, we can rewrite the above as
1 1+ [u0 · v0 + u0 · v1 + u1 · v0 − u1 · v1 ]2 8
1 1
= + [u0 · (v0 + v1 ) + u1 · (v0 − v1 )] .
2 8

(14.11)110

LECTURE 14. NONLOCAL GAMES

Since u0 , u1 , v0 , and v1 are all unit vectors, the above is upper-bounded by
1 1
1 1+ [u0 · (v0 + v1 ) + u1 · (v0 − v1 )] ≤ + [||v0 + v1 || + ||v0 − v1 ||] . (14.12)
2 8
2 8
Using the parallelogram law (2||x||2 + 2||y||2 = ||x + y||2 + ||x − y||2 ), we get
i
p
1 1
1 1h
2
+ [||v0 + v1 || + ||v0 − v1 ||] = +||v0 + v1 || + 4 − ||v0 + v1 || .
2 8
2 8
(14.13)√
Next, since v0 and v1 are orthornormal, ||v0 + v1 || = 2. So we find
√ i 1 1h √ i
1 1 h√+
2+ 2 = +
2 2
2 8
2 8
 
1
1
2 π
= + √ = cos
.
2 2 2
8
So cos2π8(14.14)

really is the maximum winning probability for the CHSH game.
There’s been a trend in the last 15 years to study theories that would go past quantum mechanics by letting you
violate Tsirelson’s Inequality, but that would still prohibit
faster-than-light signals. In such a world, it’s been proven(among other things) that if Alice and Bob wanted to schedule something on a calendar, they could decide if there’s adate where they’re both free by exchanging only one bit ofcommunication. That’s a lot better than can be done under
the rules of quantum mechanics!

14.1.4

Experimental Tests of Bell’s Inequalities

When Bell initially proved his inequality he was primarily trying to make aconceptual point about the need for nonlocal influences in any hidden-variable
theory underlying quantum mechanics. But, by the 1980s, technology had
advanced to the point where playing the CHSH game was actually a feasible
physics experiment! Alain Aspect (and others) ran the experiment and theresults were fully consistent with quantum mechanics, and extremely problematic for local hidden variable theories.

14.1. CHSH GAME: QUANTUM STRATEGY111

The experiments don’t quite get to 85% success probability, given the usual difficulties that afflict quantum experiments. But, you can reach a high statistical confidence thatyou’re winning more than, say, 80% of the time, well above
the classical limit of 75%.
This was evidence, not only that local realism was false, but also thatentanglement had been created. Most physicists shrugged, already sold on
quantum mechanics (and on the existence of entanglement). But a few, still
committed to a classical view of the world, continued to look for loopholes
in the experiment. Skeptics pointed out two main loopholes in the existing
experiments, essentially saying “if you squint enough, classical local realism
might still be possible”:
I Detection Loophole– Sometimes detectors fail to detect a photon, or they detect nonexistent photons (called “dark counts”). Enough noise in the experiments turns out to make a local hidden-variable explanation
possible again.
I The Locality Loophole– Performing the measurements and storing their results in a computer memory takes some time, maybe nanoseconds or microseconds. Now, unless Alice and Bob and the referee are very far awayfrom each other, this opens the possibility of a sort of “local hidden
variable conspiracy,” where as soon as Alice measures, some particle (unknown to present-day physics) flies over to Bob and says
“hey, Alice got the measurement outcome 0, you should return themeasurement outcome 0 too.” The particle would travel only at
the speed of light, yet could still reach Bob before his computer
registered the measurement outcome.
By the 2000s physicists were able to close the locality loophole, but only
in experiments still subject to the detection loophole and vice versa. Finally,in 2016 several teams managed to do experiments that closed both loopholes
simultaneously.
There are still people who deny the reality of quantum entanglement, but
through increasingly solipsistic arguments. The last stronghold for these skeptics is the idea of Superdeterminism. Superdeterminism and the related“Freedom-of-Choice Loophole” explains the results of CHSH experiments bysaying “we only think Alice and Bob can choose measurement bases randomly.

112

LECTURE 14. NONLOCAL GAMESIn actuality, there’s a grand cosmic conspiracy involving all of our brains, ourcomputers, and our random number generators, with the purpose of rigging
the measurement bases to ensure that Alice and Bob can win the CHSH game
85% of the time. But that’s all this cosmic conspiracy does! It doesn’t allow
FTL communication or anything like that, even though it easily could.” Nobel
Laureate Gerard ’t Hooft (the ’t is pronounced like “ut”) advocates superdeterminism, so it’s not like the idea lacks distinguished supporters, at the very
least.

14.2

The Odd Cycle Game

Now we’ll look at some other non-local games, to see what else entanglement
can help with. First we’ll look at the Odd Cycle Game. Suppose we havea cycle with an odd number of vertices n. Alice and Bob claim that they
have a two-coloring of the cycle, but basic graph theory tells us that this isn’t
possible. Nevertheless, Alice and Bob make it their goal to try to convincea referee that they’ve found a two-coloring anyway. They’ll do that by using
entanglement to coordinate their responses to challenges from a referee.
The referee performs two obvious consistency checks:
I He can ask them both the color of a random vertex v, in the two-coloring

they found.
– They pass this test iff their answers are the same.
I He can ask Alice the color of a random vertex v, and Bob the color ofan adjacent vertex w.
– They pass the test iff their answers are different.
The referee chooses between these tests with equal probability—and crucially, he doesn’t tell Alice or Bob which test he’s performing. In a single runof the game, the referee performs one such test, and gets answers from Aliceand Bob. We’ll assume their answers are always RED or BLUE.
What strategy provides the best probability that Alice and Bob will pass thereferee’s test and win the game? Classically we know that, regardless of what
Alice and Bob do, P (win) < 1. Why? One can show that for Alice and Bob
to answer all possible challenges correctly they’d need an actual two-coloring,which is impossible. The best they can do is agree on a coloring for all but
one of the vertices, which gives them a win probability ofP (win) = 1 −1.
2n(14.15)

14.2. THE ODD CYCLE GAME

113

Figure 14.1: A 5-node cycle with a partial two-coloring. Notice that there isno consistent way to fill in a color for the node labeled “?”.
Nevertheless, we claim that quantum mechanically Alice and Bob can dobetter and can achieve 
1
P (win) = 1 − O(14.16)n2
if they pre-share a single Bell pair. The strategy is as follows: Alice and Bob
both measure their qubits in a basis depending on the vertex they’re asked
about. The measurement bases for adjacent vertices are rotated with respectπ
to each other by 2n. The first basis has outcome |0i map to answering BLUEπi
and outcome |1i map to answering RED. The second basis has outcome | 2nππmap to RED and | 2 + 2n i map to BLUE. They continue alternating this forthe remaining bases. This scheme is sketched out in Figure 14.2.
When Alice and Bob are asked about the same vertex, they both measurein the same basis and thus always answer with the same color. On the other
hand, when Alice and Bob are asked about adjacent vertices we get a similar
situation to the CHSH game, where the probability of Bob producing the
opposite output as Alice (and passing the test as a result) is the squared
cosine of the angle between their measurement basis vectors. As such, theprobability that they lose is2

P (lose) = 1 − cos

π
2n

2

= sin

π
2n

≈

 π 2
2n


=O

1
n2


.

(14.17)

114

LECTURE 14. NONLOCAL GAMES

Figure 14.2: Diagrammatic depiction of the measurement bases and coloring
convention used in the Odd Cycle game’s quantum strategy.

14.3

The Magic Square Game

In the Magic Square Game (also called the Mermin-Peres Magic Square)
Alice and Bob claim they can fill a 3 × 3 grid with +1’s and −1’s such thatevery row has a positive product while every column has a negative product. To verify this claim, the referee asks Alice to provide the entries of arandomly-chosen row of the grid and asks Bob to provide the entries of arandomly-chosen column. Alice and Bob “win” if and only if:
I The row has a positive product.
I The column has a negative product.
I The row and column agree on the square where they intersect.

As with the Odd Cycle game, there is no classical strategy that allows Aliceand Bob to win with certainty, as that would require an actual assignment of
entries on the grid that satisfies all the constraints on the rows and columns.
The constraints on the rows require the total number of −1’s in the grid tobe even, while the constraints on the columns require the number to be odd.
This implies that there’s no classical strategy that lets Alice and Bob win thegame with probability 1.
Nevertheless, David Mermin discovered a quantum strategy where Aliceand Bob win with probability 1. This strategy requires them to share 2 ebits

14.3. THE MAGIC SQUARE GAME

115

of entanglement. We won’t describe the strategy in detail in this class, since
it is complicated to state without the additional concepts that we haven’t
yet seen. But, the Magic Square Game is just the tip of the iceberg of avery rich and interesting body of research on so-called Quantum PsuedoTelepathy Games—that is, games with a perfect quantum strategy but noperfect classical strategy.

Lecture 15:
domness

Einstein-Certified Ran-

Until recently, the Bell inequality was taught because it was historically andconceptually important, not because it had any practical applications. Sure,it establishes that you can’t get away with a local hidden variable theory,
but in real life, no one actually wants to play the CHSH game, do they?
Recently, however, the Bell inequality has found applications in one of the mostimportant tasks in computing and cryptography: the generation of guaranteed
random numbers.

15.1

Guaranteed Random Numbers

Generating random numbers is one of the most important tasks in computing(and certainly in cryptography). Once we have quantum mechanics you might
think that the solution is trivial. After all, you can get a random bit bymeasuring the |+i state in the {|0i , |1i} basis. Easy, right? But, this solution
often isn’t good enough for cryptography. Cryptographers are paranoid people
and they want the ability to maintain security even if the hardware they’reusing was designed by their worst enemy.
These sorts of assumptions aren’t just academic speculation, especially given the Snowden revelations. For example, NIST (the National Institute of Standards and Technology) put out a standard for pseudo-random number generation based on elliptic curves to be used for encryption.
This standard was later discovered to have a backdoor, apparently created by the NSA, that would allow an attacker
to predict the output numbers, thus being able to break systems encrypted under this standard.

11615.1. GUARANTEED RANDOM NUMBERS

117

Cryptographers want to base their random number generation on the smallest set of assumptions possible. They want bits that are guaranteed to berandom, and to be sure that no one added predictability through any sort of
backdoor. You might think that, logically, one can never prove that numbers
are truly random: that the best one can ever say is “I can’t find any pattern
here.” After all, you can’t prove a negative, and if not the NSA, who’s to saythat the universe itself isn’t playing tricks on us by inserting a pseudorandom
pattern into the workings of quantum mechanics?
Though presumably, if a higher power wanted to read ouremails they could also do it some other way...
That’s what makes so interesting (and non-obvious) that the Bell inequality
lets us certify numbers as being truly random under very weak assumptions.
These assumptions basically boil down to “no faster-than-light travel is possible.” Let’s now explain how.
Suppose you have two boxes that share quantum entanglement. We’ll
imagine the boxes were designed by your worst enemy, so you trust nothing
about them. All we’ll assume is that the boxes can’t send signals back andforth, say because you put them in Faraday cages, or separated them by solarge a distance that light doesn’t have enough time to travel between themduring the duration of your interaction. A referee sends the boxes challenge
numbers, x and y and the boxes return numbers a and b. If the returned
numbers pass a test, we’ll declare them to be truly random.
So what’s the trick? Well, we already saw the trick; it’s just the CHSH
game! The usual way to present the CHSH game is as a way for Alice and Bob
to prove that they share entanglement, and thus that the universe is quantummechanical and that local hidden-variable theories are false. However, winning
the CHSH game more than 75% of the time also establishes that a and b musthave some randomness, and that there was some amount of entropy generated.
Why? Because suppose instead that a and b were deterministic functions.
That is, suppose they could be written as a(x, r) and b(y, r) respectively, interms of Alice and Bob’s inputs as well as shared random bits. In that case,whatever these functions were, they’d define a local hidden-variable theory,
which is precisely what Bell’s Theorem rules out! So the conclusion is that,
if x and y are random and there’s no communication between Alice and Bob,then there must exist at least some randomness in the outputs a and b.
Around 2012, Umesh Vazirani coined the term Einstein-Certified Randomness for this sort of thing. The basic idea goes back earlier, for example,
to Roger Colbeck’s 2006 PhD thesis and (in cruder form) to Prof. Aaronson’s

118

LECTURE 15. EINSTEIN-CERTIFIED RANDOMNESS

2002 review of Stephen Wolfram’s “A New Kind of Science,” which used theidea to refute Wolfram’s proposal for a deterministic hidden-variable theory
underlying quantum mechanics.
OK, so how do we actually extract random bits from the results of the
CHSH game? You could just take the stream of all the a’s and b’s that are
outputted after many plays of the CHSH game. Admittedly, this need not give
us a uniform random string. In other words, if the output string has lengthn, then its Shannon entropy,Xxpx log21
px(15.1)

where px is the probability of string x, will in general be less than n. However,
we can then convert x into an (almost) uniformly random string on a smallernor something, by using a well-known tool from classicalnumber of bits, say 10
theoretical computer science called a randomness extractor. A randomness
extractor is a function that crunches down many sort-of-random bits (and,typically, a tiny number of truly random bits, called the seed ) into a smaller
number of very random bits.
If you’re interested in learning more about these, consider
taking a course with David Zuckerman (here at UT) who
is an expert on randomness extractors.
OK, but there’s an obvious problem with this whole scheme. Namely, we
needed the input bits to be uniformly random in order to play the CHSH
game. But, that means we put in two perfect random bits, x and y, in orderto get out two bits a and b that are not perfectly random! In other words, theentropy we put in is greater than the entropy we get out, and the whole thing
is a net loss. A paper by Pironio et al. addressed this by pointing out that you
don’t have to give Alice and Bob perfectly random bits every time the CHSH
game is played. Instead, you can just input x = y = 0 most of the time, andoccasionally stick in some random x’s and y’s to prevent Alice and Bob fromusing hidden variables. Crucially, if Alice or Bob gets a 0 input in a given
round, then they have no way of knowing whether that round is for testingor for randomness generation. So, if they want to pass the randomly-inserted
tests, then they’ll need to play the CHSH game correctly in all the rounds (oralmost all of them), which means generating a lot of randomness.
At this point it all comes down to a quantitative question of how much
entropy can we get out, per bit of entropy that we put in? There was a race
to answer this by designing better and better protocols that got more and15.1. GUARANTEED RANDOM NUMBERS

119

more randomness out per bit of randomness invested. First, Colbeck showed
how to get cn bits out for n bits in, for some constant c > 1. Then, Pironio
et al. showed how to get ∼ n2√bits out per n bits in. Then, Vazirani and
Vidick showed how to get ∼ e n bits out per n bits in, which is the firsttime we had exponential randomness expansion. But, all this time an obvious
question remained in the background: why not just use a constant amountof randomness to jump-start the randomness generation, and then feed therandomness outputted by Alice and Bob back in as input, and so on forever,thereby getting unlimited randomness out?
It turns out that a naı̈ve way of doing this doesn’t work. If you just feed
Alice and Bob the same random bits that they themselves generated, thenthey’ll recognize those bits, so they won’t be random to them. This will allow
Alice and Bob to cheat, making their further outputs non-random.
Remember: We’re working under the assumption that “Alice” and “Bob” are machines designed by our worst enemy!
If you don’t have a limit on the number of devices used, then a simple fix
for this problem is to feed Alice and Bob’s outputs to two other machines,
Charlie and Diane. Then you can feed Charlie and Diane’s outputs to two
more machines, Edith and Fay, and so on forever, getting exponentially more
randomness each time. But what if we have only a fixed number of devices(like 4, or 6) and we still want unlimited randomness expansion? In that case,a few years ago Coudron and Yuen, and independently Chung, Miller, Shi, andWu, figured out how to use the additional devices as “randomness launderingmachines.” These extra machines are used to convert random bits that Aliceand Bob can predict into random bits that they can’t predict, so that theoutput bits can be fed back to Alice and Bob for further expansion.
One question that these breakthrough works didn’t address was exactly how
many random seed bits are needed to jump-start this entire process. Like, are
we talking a billion bits or 2 bits? In a student project supervised by Prof.
Aaronson, Renan Gross calculated the first explicit upper bound, showing thata few tens of thousands of random bits suffice. That’s likely still far from thetruth, and finding a tighter upper-bound is still an open question. For all weknow it might be possible with as few as 10 or 20 random bits.
It’s also worth mentioning that this sort of protocol has already been experimentally demonstrated at NIST, and indeed is part of what’s used for
NIST’s public randomness beacon.

120

15.1.1LECTURE 15. EINSTEIN-CERTIFIED RANDOMNESS

Leashing Quantum Systems

You might wonder what else can you certify about two separated boxes, by seeing them win at the CHSH game? It turns out that the answer is an enormous
number of things. In a tour-de-force paper from 2012, Reichardt, Unger, andVazirani showed how to use a sequence of CHSH-like challenges to certify that
Alice and Bob performed a specific sequence of unitary transformations on
their qubits (up to local changes of basis). This means that, just by making Alice and Bob repeatedly win the CHSH game, you can force them to do
any quantum computation of your choice. Reichardt et al. describe this as a“classical leash for a quantum system.”This sort of thing constitutes one of the main current ideas for how aclassical skeptic could verify the operation of a quantum computer. For aproblem like factoring a huge integer into primes, for example, we can easily
verify the output of a quantum algorithm by simply multiplying the claimed
factors and seeing if they work! But this isn’t believed to be the case for all
problems that a quantum computer can efficiently solve. Sometimes the best
way to efficiently verify a quantum computer is working correctly might involve
using quantum resources yourself. What Reichardt et al. show is that, as longas we have two quantum computers that are entangled with each other, but
unable to exchange messages, we can use the CHSH game to verify that thecomputers are behaving as expected.
It turns out, however, that even if we only have a single quantum computerand a classical verifier, it is still possible to leash the quantum computer andforce it to perform any computation we want. In a groundbreaking paper from2018, Urmila Mahadev (then a graduate student at UC Berkeley) developed
such a protocol.
This brings us nicely to quantum computation, which is probably the subject that most of you took the course to learn about! We’ll begin discussing
quantum computation in earnest in the next lecture.

Lecture 16: Quantum Computing and Universal Gate Sets
Having seen lots of quantum protocols, we’re finally ready to tackle the holygrail of the field: a programmable quantum computer, a single machine that
could do any series of quantum-mechanical operations. Quantum computation
has two intellectual origins. One comes from David Deutsch, who was thinking about experimentally testing the Many-Worlds Interpretation (of which
he was and remains a firm believer) during his time as a postdoc here at UTAustin1 . Much like with Wigner’s friend, Deutsch imagined creating an equalsuperposition of a brain having measured a qubit as |0i, and the same brain
having measured the qubit as |1i. In some sense, if you ever had to ascribesuch a superposition state to yourself then you’d have gone beyond the Copenhagen Interpretation. But, how could we ever test this? Given the practicalimpossibility of isolating all the degrees of freedom in a human brain, the firststep would presumably have to be: take a complete description of a humanbrain, and upload it to a computer. Then, the second step would be to put thecomputer into a superposition of states corresponding to different thoughts.
This then naturally leads to more general questions: could anything ascomplicated as a computer be maintained in a superposition of “semanticallydifferent” states? How would you arrange that, in practice? Would such a
computer be able to use its superposition power to do anything that it couldn’t
do otherwise?
The other path to the same questions came from Richard Feynman, whogave a famous lecture in 1982 concerned with the question how do you simulate quantum mechanics on a classical computer? Chemists and physicists
had known for decades that this is hard, essentially because the number ofamplitudes that you need to keep track of increases exponentially with thenumber of particles. This is the case because, as we know, an n-qubit state in
1

David Deutsch is arguably more famous, however, for his pivotal role in the Avengers’
defeat of the evil tyrant Thanos, in the movie Avengers Endgame.

121

122

LECTURE 16. QC AND UNIVERSAL GATE SETS

the most general case requires 2n amplitudes to specify completely. Chemists
and physicists know many approximation methods for such simulation problems. These include methods such as Density Functional Theory and Quantum Monte Carlo, which often work well in practice. In the worst case though,there’s no known shortcut to dealing with the whole vector of amplitudes. So
Feynman raised the question, Why don’t we build computers out of qubits,
which themselves could take advantage of superposition and interference andentanglement? Of course he then faced the question: supposing we built sucha computer, what would it be useful for? At that time, he was really only
able to suggest one answer to that question. Namely, it would be good for
simulating quantum mechanics itself! More specifically, he ended his talk withthe following:
Nature isn’t classical, dammit, and if you want to make a simulation of nature, you’d better make it quantum mechanical, and by
golly it’s a wonderful problem, because it doesn’t look so easy
If and when quantum computers really become practical quantum simulation is arguably still the most important application we know for them. In any
case, no one knew at the time whether quantum computers would be useful for“classical” tasks as well; that’s a different, harder question, which will occupy
us for much of the rest of the course.
We already have all the tools we need to discuss quantum computers. The
basic picture of a quantum computer is that it’s just a quantum circuit, but
we’re jumping from working with 1, 2, or 3 qubits at a time to n qubits—where
n could be, say, a million or more. You apply a sequence of gates on thesequbits, each gate acting on just a few qubits (say, 1 or 2 of them), then measuresome or all of the qubits to get your result.
Let’s address a few conceptual questions before proceeding further:Will we able to solve any problem on a quantum computer that literally
can’t be solved on a classical computer, regardless of resources? It’s easy to
see that the answer is no. Using a classical computer one can always simulatea quantum computer with n qubits by just explicitly storing the vector of 2n
amplitudes (to some suitable precision, enough to approximate the final probabilities), and updating the vector whenever a unitary transformation gets applied. For this reason, we see that a quantum computer could “only, at most”
achieve an exponential speedup over a classical computer; it could only falsify
the Extended Church-Turing Thesis, rather than the original Church-Turing
Thesis. Quantum computers might change what’s computable in polynomial
time—how drastically, we don’t yet know—but they’re not going to change

123
what’s computable in general. As such, they certainly can’t let us solve thehalting problem or anything of that kind.
Why does each gate act on only a few qubits? Where is this assumption
coming from?
It’s similar to how classical computers don’t have gates act on arbitrarily large numbers of bits, and instead use small gates like AND, OR, andNOT to build up complex circuits. The laws of physics provide us with local
interactions—one particle colliding with another one, two currents flowing intoa transistor, etc. . . —and it’s up to us to string together those local interactions
into something more complicated.
In the quantum case, you could imagine a giant unitary matrix U , whichtakes qubits, interprets them as encoding an instance of the 3SAT problem (orsome other NP-complete problem) and then CNOTs the answer (1 for yes, 0
for no) into an extra qubit. That U formally exists and is formally allowedby the rules of quantum mechanics. But how would you go about actually
implementing it in practice? Well, you’d need to build it up out of smaller
components—say, components that act on only a few qubits at a time.
It turns out that it’s possible to implement any unitary U you want using
exponentially many simple components (we’ll say more about that later inthe lecture). The question that will most interest us in quantum computing
theory is which U ’s can be implemented using only polynomially many simple
components. Those are the U ’s that we’ll consider feasible or efficient.
What is the role of interference in quantum computing?
Quantum amplitudes can cancel each other out; that’s the most important
way in which they differ from classical probabilities. The goal in quantum
computing is always to choreograph a pattern of interference such that, foreach wrong answer, some of the contributions to its amplitude are positive andothers are negative (or, for complex amplitudes, they point every which way
in the complex plane), so on the whole they interfere destructively and cancel
each other out. Meanwhile, the contributions to the correct answer’s amplitude
should interfere constructively (say, by pointing along the same direction in
the complex plane). If we can arrange that, then when we measure, the rightanswer will be observed with high probability.
Note that if it weren’t for interference, then we might as well have just useda classical computer with a random-number generator and saved the effortof building a quantum computer. In that sense, all quantum-computational
advantage relies on interference.
What is the role of entanglement in quantum computing?
In some sense, we can develop the entire theory of quantum computing
without ever talking about entanglement. However, pretty much any time124

LECTURE 16. QC AND UNIVERSAL GATE SETS

we’re doing an interesting quantum computation, entanglement is somethingthat will be there. The reason for this is simply that an unentangled purestate of n qubits can always be written as(α0 |0i + β0 |1i) ⊗ (α1 |0i + β1 |1i) ⊗ · · · ⊗ (αn−1 |0i + βn−1 |1i)
Specifying such a state requires only 2n amplitudes, so we can store it efficiently. Thus, if for some reason the (pure) state of our quantum computer
never had any entanglement in it, then a classical computer would be able
to simulate it efficiently, and would be unable to achieve any speedup. By
contrast, a general entangled state of n qubits,
|ψi =

X

αx |xi ,(16.1)

x∈{0,1}nrequires 2n amplitudes to specify. It very quickly becomes hopelessly intractable to store and manipulate all these amplitudes on a classical computer.
With 300 qubits, we already have more amplitudes to deal
with than there are atoms in the observable universe.

16.1

Complexity of General Unitaries: Counting Argument

It’s a theorem, which we won’t prove in this class, that any unitary transformation on any number of qubits can be decomposed as a product of 1- and2-qubit gates.However, if you just run the decomposition blindly, it will produce a quantum circuit with something like 4n gates—just like, if you use themethod of truth tables to build a circuit to compute some arbitrary Booleanfunction, f : {0, 1}n → {0, 1}, you’ll get something with about 2n AND, OR,
and NOT gates. Just like in the classical world, our real interest is in which
Boolean functions that can be efficiently computed—say, using a polynomial
number of AND, OR, and NOT gates—so too in the quantum world, our realinterest is in which n-qubit unitary transformations can be realized using only
polynomially many 1 and 2-qubit gates.
That being so, it behooves us to ask: is it possible that all n-qubit unitaries
can be realized by polynomial-size circuits? The answer turns out to be no.
In fact, just like “almost all” Boolean functions require exponentially large

16.1. COMPLEXITY OF GENERAL UNITARIES: COUNTING ARGUMENT125
circuits to compute them, so too “almost all” unitaries require exponentiallylarge quantum circuits. As in the classical case, the way to prove this is using
a counting argument.
Counting arguments in circuit complexity go back to Claude Shannon in1949. Shannon observed that almost every n-bit Boolean function requires ancircuit of at least ∼ 2n AND, OR and NOT (or equivalently NAND) gates tocompute it. The reason for this, in one sentence, is that there are too many
Boolean functions, and not enough small circuits! In more detail, there aren
22 different Boolean functions f : {0, 1}n → {0, 1}. For a circuit with T gates
there are ∼ (n + T )O(T ) different circuits that can be constructed, which canbe seen as follows. Without loss of generality suppose we choose to construct
our circuit out of NAND gates, with a bounded fan-in of 2. For each NAND
gate in our circuit we have
N +T −1≤ (N + T )2
2
ways to select the inputs. Since there are T gates, the number of different
circuits we can construct this way is upper bounded by(N + T )2T = (N + T )O(T ) .

(16.2)

Since each circuit can only compute one function, we can simply set the two
expressions equal and solve for T .
n

22 = (n + T )T ≈ T T(16.3)Taking the log of both sides gives
2n = T log T(16.4)

2nThis is satisfied for T ≈ n . Moreover, if T is smaller then (N + T )O(T ) isnminuscule compared to 22 , so almost every function must require a circuit ofnsize O( 2n ).
Strikingly, and famously, this argument doesn’t give us asingle example of a hard-to-compute Boolean function. It
merely tells us that such functions must exist, and indeed
are ubiquitous!
We can use a similar sort of argument in the quantum case—although,since 2n × 2n unitary matrices form a continuous manifold, it’s easier to talkin terms of dimensionality rather than cardinality. For simplicity, let’s even

126

LECTURE 16. QC AND UNIVERSAL GATE SETS

restrict attention to those 2n × 2n unitary matrices that are diagonal. Eventhen, specifying such a matrix clearly requires us to specify 2n independent
complex numbers of norm 1 (or 2n − 1, if we ignore global phase). By contrast,
a quantum circuit with T gates, each acting on at most 2 qubits, can be
specified using only O(T ) continuous parameters (plus some discrete choices
about where to apply the gates, which won’t affect the argument). So we havea 2n -dimensional manifold in the one case, and a union of O(T )-dimensional
manifolds in the other. Clearly, for the one to cover the other, we need T togrow at least like ∼ 2n . Hence there exist n-qubit unitary transformations that
require exponentially many gates to implement. In fact, “almost all” (now inthe technical, measure-theory sense of 100% of them) have this property.
You might complain that we’ve only showed that exponentially many gatesare needed to implement most n-qubit unitary transformations exactly. Whatabout approximately implementing them? That is, implementing them up tosome small error  (say, in each entry)? In fact, a little algebraic geometry(which we won’t go into here) is enough to show that exponentially manygates are needed to approximate most n-qubit unitaries as well, or even mostn-qubit diagonal unitary transformations.
Once again, these arguments don’t give us a single example
of a hard-to-implement unitary transformation. They justtell us that that this is the norm. The easy-to-implement
unitaries are the rare exceptions! Yet, rare though theymight be, the subset of unitaries that are easy (i.e., that canbe implemented by polynomial-size quantum circuits) are
the main ones that will interest us in quantum computing.

16.2

Universal Gate Sets

Up till now, we’ve assumed that any 1 and 2-qubit gates are available, but itturns out that assumption isn’t actually necessary. This brings us to our next
topic, Universal Gate Sets for quantum computing.

16.2.1

Classical Universality

In classical computing, you’re probably familiar with logic gates like AND,OR, NOT, NAND, etc. A (classical) gate set is called universal if, by stringing
together enough gates from the set, you can express any Boolean function on

16.2. UNIVERSAL GATE SETS

127

any number of bits. For example, the NAND gate by itself is universal. The
diagram in Figure 16.1 shows how you’d construct an OR gate out of NANDs.
You can also work out how to construct an AND gate and a NOT gate, andfrom there you can get anything else. By contrast, the set {AND, OR} is notuniversal, because it can only express monotone Boolean functions; that is,changing an input bit from 0 to 1 can never change an output bit from 1 to
0. Likewise, the set {NOT, XOR} is not universal, because it can only express
Boolean functions that are linear or affine mod 2. So, while “most” gate setsare universal, being universal isn’t completely automatic.

Figure 16.1: Simulating an OR gate using NAND gates.
Next let’s discuss classical reversible gates, reversible mappings from nbit strings to n-bit strings. We call a set of reversible gates universal if, bycomposing enough of them, you can express any reversible transformation on
any number of bits. Here we allow the use of “ancilla bits” (extra bits used
as a resource to implement a particular gate), as long as the ancilla bits are
returned to their initial states by the end of the computation. The use ofancilla bits is provably necessary for universality in this setting.
The most famous example of a universal reversible gate—the reversible
analogue of the NAND gate—is called the Toffoli Gate. The Toffoli gate,
also known as controlled-controlled-NOT, is a 3-bit gate that flips the third
bit iff the first two bits are both set to 1.
To show that Toffoli is capable of universal computation, we constructa NAND gate out of a Toffoli gate in the diagram in Figure 16.2. Because
Toffoli can simulate NAND, it can also simulate any ordinary (non-reversible)
Boolean circuit (given a sufficient number of ancillary bits).

A
B
1

•
•
1 ⊕ AB = ¬AB

Figure 16.2: Circuit for simulating the effect of NAND using a Toffoli gate
along with an ancillary bit.

128

LECTURE 16. QC AND UNIVERSAL GATE SETS

Note that this argument does not yet establish that Toffoli is a universal
reversible gate in the sense we defined above, because for that we need to
implement all possible reversible transformations, not just compute all Booleanfunctions. However, a more careful argument, part of which we’ll give later inthe course, shows that Toffoli is universal in that stronger sense as well.
A good example of a gate that separates the two kinds of universality is
the Fredkin Gate, which is also called Controlled-SWAP or CSWAP. This isa 3-bit gate that swaps the second and third bits iff the first bit is set to 1.
Just like the Toffoli gate, the Fredkin gate can simulate a NAND gate (we’ll
leave the construction as an exercise for the reader) and is therefore capableof universal computation. However, the Fredkin gate is not universal in thestronger sense, because it can never change the total number of 1’s in the
input string, also called the Hamming weight. For example, it’s impossible tocompose any number of Fredkin gates in order to map the string 000 to 111.
A gate with the property that it always preserves the Hamming weight of the
input is called conservative.
There are also reversible gates that are not even capable, on their own, of
universal computation. An important example is the CNOT gate, which we
saw earlier. By composing CNOT gates, we can only express Boolean functions
that are affine mod 2. For example, we can never express AND or OR. Moregenerally, and in contrast to the irreversible case, it turns out that no 2-bit
classical reversible gate is capable of universal computation. For universality,
we need reversible gates (such as Toffoli or Fredkin) that act on at least 3 bits.
It’s worth noting that any classical reversible gate can also be used as aquantum gate (i.e., it’s unitary). From this we can immediately see that,
if nothing else, a quantum circuit can compute any function that a classicalcircuit of similar size can compute. We simply need to transform the classicalcircuit into one made of, say, Toffoli gates.

16.2.2

Quantum Universality

We’ll call a set of quantum gates S universal if, by composing gates from S,
you can approximate any unitary transformation on any number of qubits toany desired precision. Note that if S is finite then approximation is all we canhope for, because there are uncountably many unitary transformations, but
only a countable infinity of quantum circuits that we can build using finitely
many gates from S. Just like with classical reversible gates, there are weakerkinds of universality for quantum gate sets that are often enough in practice. That is, even if gates can’t be used to approximate an arbitrary unitary
to any desired precision, they’ll often suffice anyway for universal quantum

16.2. UNIVERSAL GATE SETS

129

computation. We’ll see examples of this soon.
Let’s list some of the ways a quantum gate set could be limited, in such a
way that it fails to be universal. We’ll discuss four such ways, three of themobvious and one of them not.
I Your gate set doesn’t create interference/superposition.

– Example: The set S = {CNOT} can only map computational basis
states, like |10i, to other computational basis states, like |11i. It canmaintain existing superpositions, but it can’t create a superpositionof basis states where there wasn’t one already.
I Your gate set can create superpositions, but not entanglement.
√– Example: The set S = {Hadamard} can map |0i to |0i+|1i, thereby2
creating a superposition. But, it should be obvious that the Hadamard
gate can’t map a product state to an entangled state, since it acts
on only one qubit. In fact, any quantum circuit made of only
Hadamard gates—or any 1-qubit gates, for that matter—will justact independently on each of the n qubits, so it will be trivial tosimulate classically.
I Your gate set only has real gates.

– Example: The set S = {CNOT, Hadamard} is getting closer to universality, as it’s capable of creating entangled superposition states.
But, the CNOT and Hadamard matrices have real entries only, so
composing them could never give us a unitary transformation like


1 0
S=
.
0 i
I Your gate set is “contained in the stabilizer set.”– This is the non-obvious case. Later in the course, we’ll explain
stabilizer gates in more detail, as well as their central importancefor quantum error correction. For now, though, the stabilizer gatesare the following three quantum gates: CNOT, Hadamard, andS, where S is the matrix above. These gates pass every test foruniversality that we saw before: they can generate superposition,and entanglement, and complex amplitudes. Furthermore, they’reenough to demonstrate many of the quantum phenomena that we’veseen in this course, such as teleportation and superdense coding.
Nevertheless, it turns out that the particular set
S = {CNOT, Hadamard, S}

130

LECTURE 16. QC AND UNIVERSAL GATE SETS
is not universal. Indeed, a famous result called the GottesmanKnill Theorem shows that these gates generate only a discrete
subset of unitary transformations and that furthermore, any circuit consisting only of stabilizer gates, applied to the initial state|0 · · · 0i, can be simulated in polynomial time by a classical computer. Thus, despite containing an interesting subset of quantum
mechanics, these gates still aren’t enough to realize exponential
quantum speedups.

Are there any other ways for a set of quantum gates, acting on qubits,
to fail to be universal? That’s currently an open question! It’s one of Prof.
Aaronson’s personal favorites. Not many people in the field care about thisparticular question, since we have lots of universal gate sets that work, and somost just roll with it. But it would be nice to know, and you should go solveit.
So then, what are come examples of universal quantum gate sets? It turns
out that the stabilizer set, S = {CNOT, Hadamard, S}, becomes universal if
you swap out the Hadamard gate for nearly anything else. So, for example,
S = {CNOT, Rπ/8 , S} is universal, as is S = {Toffoli, Hadamard, S} by a 2002
result of Yaoyun Shi. Additionally, if you just pick a 2-qubit gate uniformly
at random, then it’s known to have a 100% chance (in the measure-theoretic
sense) of being universal. With universality, the whole difficulty comes fromthe remaining 0% of gates! Above, we listed bad cases—ways of failing to beuniversal—but there are also general criteria such that if your gate set meetsthem then it’s universal. We won’t cover this, but see the paper of Shi, forexample, for such criteria.

16.2.3The Solovay-Kitaev Theorem

So far, in discussing universal gate sets, we’ve swept an important question
under the rug. Namely, a universal gate set lets us approximate any unitary
to any desired accuracy , but how does the number of gates scale with respect1
to ? If, for example, the number scaled like 2  , then our gate set would
be “universal,” but not especially useful. Fortunately, there’s a central resultin quantum computing theory called the Solovay-Kitaev Theorem, thatshows the number of gates needed to approximate a unitary to precision scales manageably.
The Solovay-Kitaev Theorem says that, using any universal gate set S
that’s closed under inverses (that is, if G ∈ S then so is G−1 ), we can approximate any unitary on qubits to within precision  (say, entrywise precision)

16.2. UNIVERSAL GATE SETS

131

using only O(4n polylog( 1 )) gates. In other words, if we treat n as fixed, thenthe complexity scales only like some power of log ( 1 ). This means that all
universal gate sets, or at least the ones closed under inverses, “fill in the spaceof all unitary transformations reasonably quickly.” Furthermore, the gate sequences that achieve the Solovay-Kitaev bound can actually be found by areasonably fast algorithm. Whether the closed-under-inverses condition canbe removed remains an unsolved problem to this day.
The original proofs of Solovay-Kitaev from the late 1990s required a numberof gates which grew like log3.97 ( 1 ). However, more recently it’s been shown
that, at least if we use special universal gate sets arising from algebra andnumber theory, we can get the number of gates to grow only like log ( 1 ). This is
not only much more practical, but it’s also the best one could possibly hope foron information-theoretic grounds. The proof of the Solovay-Kitaev Theorem isbeyond the scope of this course, but it’s contained in many quantum computing
textbooks, including Nielsen & Chuang.

Lecture 17: Quantum Query Complexity and The Deutsch-Josza Problem
People often want to know where the true power of quantum computing comesfrom.
I Is it the ability of amplitudes to interfere with one another?
I Is it the huge size of Hilbert space (the space of possible quantum states)?
I Is it that entanglement gives us 2n amplitudes to work with?

But that’s sort of like dropping your keys and asking what made them fall?
I Is it their proximity to the Earth?
I Is it the curvature of spacetime?
I Is it the fact that you dropped them?

There can be many complementary explanations for the same fact, all ofthem valid, and that’s the case here. If there weren’t a huge number of amplitudes, quantum mechanics would be easy to simulate classically. If theamplitudes were instead standard probabilities, rather than complex numbersthat could interfere with each other, QM would also be easy to simulate classically. If no entanglement were allowed, then all pure states would be productstates, once again easy to represent and simulate classically. If we were restricted to stabilizer operations, QM would be easy to simulate classically by
the Gottesman-Knill Theorem. But as far as we know, full QM—involving
interference among exponentially many amplitudes in complicated, entangledstates and with non-stabilizer group operations—is hard to simulate classically, and that’s what opens up the possibility of getting exponential speedups
using a quantum computer.
132

17.1. QUANTUM QUERY COMPLEXITY

17.1

133

Quantum Query Complexity

There are two major ways we look at the complexity of quantum algorithms.
The Circuit Complexity of a unitary transformation, U , is the size (i.e.,
number of gates) of the smallest circuit that implements U . We like unitaries
with polynomial circuit complexity. Alas, typically it’s extremely hard to determine the circuit complexity of a unitary; the best we can do is to prove
upper bounds, and conjecture lower bounds on the basis of hardness assumptions and reduction arguments. Note that the reasons why this sort of problem
is insanely hard have nothing to do with quantum mechanics.
“What’s the smallest circuit that solves Boolean satisfiability?” is a similarly hard problem, indeed closely related to
P vs NP.
Given the difficulty of determining the circuit complexity, we often makeuse of an alternative, albeit more limited model, of complexity. This alternative model is called Query Complexity. Here we count the number of calls analgorithm makes to an oracle (or black box function). The idea is that your oracle takes an input x and produces an output f (x), where f : {0, 1}n → {0, 1}.
In quantum mechanics, our first guess for what this would mean might be that
we map the input state |xi to the output state |f (x)i, or maybe the output
state |xi |f (x)i.
Here, though, we run into trouble because such a transformation is notunitary. To make the transformation unitary we need a so-called answer ortarget register. So we give the black box two inputs, x, which is unchanged,
and y, which has the answer f (x) written into it in a reversible way:|x, yi → |x, y ⊕ f (x)i .
If we took care to ensure that y = 0 initially, then this would map |x, 0i to|x, f (x)i, exactly like in the classical case. We’ll call an oracle constructed inthis way a XOR Oracle.

|xi
|yi

Uf

|xi
|y ⊕ f (x)iFigure 17.1: Diagram of the XOR oracle.
Later, we’ll see that it’s often most convenient to consider quantum queries

134

LECTURE 17. QC AND DEUTSCH-JOSZA

that map each basis state |xi to (−1)f (x) |xi. In other words, queries thatwrite the function value into the phase of the amplitude, rather than storing
it explicitly in memory. Or, more precisely, we consider queries that map eachbasis state |x, bi to (−1)f (x)·b |x, bi, where b is a bit that controls whether thequery should even take place or not. This sort of Phase Oracle doesn’t reallyhave any classical counterpart, but it is extremely useful for setting up desiredinterference patterns.
It behooves us to ask: how do the phase oracle and XOR oracle compare?
Could one be more powerful than the other? Happily, it turns out that they’reequivalent, in the sense that either can be used to simulate the other with nocost in the number of queries. This is a result that we’ll need later in thislecture. To see the equivalence, all we need to do is consider what happens
when the second register is placed in the |−i state before a query using a
Hadamard gate. You can check that this converts a XOR oracle into a phaseoracle as follows:|x, 0 ⊕ f (x)i − |x, 1 ⊕ f (x)i|x, 0i − |x, 1i
√
√
→
2
2

(17.1)

if f (x) = 0 then the state is|x, 0i − |x, 1i√= |x, −i2(17.2)and if f (x) = 1 then the state is|x, 1i − |x, 0i√= − |x, −i2(17.3)

we can rewrite both outcomes as just (−1)f (x) |x, −i. Meanwhile, if the second
register is placed in the |+i state, then nothing happens, so we really do get
the |x, bi → (−1)f (x)·b |x, bi behavior. Conveniently, the converse is also true!
That is, if we have a phase oracle, then by placing the output register in oneof the states |+i or |−i, we can simulate the effect of a XOR oracle, with thephase oracle causing |+i and |−i to be swapped if and only if f (x) = 1.
Taking a step back, though, what are we really doing when we design
a quantum algorithm in the query model? We’re abstracting away part ofthe problem, by saying “Our problem involves some function, f (x), that wewant to learn some property of in a way that only requires evaluating f (x)on various inputs, while ignoring the details of how f is computed.” Becauseof this abstracting away of details, the query model is also referred to as theBlack-Box Model. So, for example, you might want to learn: is there some17.2. QUANTUM GARBAGE COLLECTION

135

input x such that f (x) = 1?, Does f (x) = 1 for the majority of x’s? Does fsatisfy some global symmetry, such as periodicity, or is it far from any function
satisfying the symmetry? etc. . . We then want to know how many queries tof are needed to learn this property.
In this model we ignore the cost of any quantum gates thatare needed before or after the queries; those are treated as“free.”Why do we care about the black-box model? You’re debating how you’dphrase your wishes if you found a magical genie. Who cares? The truth ismore prosaic, though. You can think of a black box as basically a huge input
string. From that standpoint, querying f (x) just means looking up the xth
element in the string. Or another perspective is to imagine you’re writingcode that calls a subroutine that computes f (x). You don’t want to modify
the subroutine (or even examine it’s internal workings). You just want toknow how many calls to it are needed to find some information about f . We
assume in the quantum case that calls to the subroutine can happen on asuperposition of different input values and that we get back a superposition ofdifferent answers.

17.2

Quantum Garbage Collection

To justify the quantum black-box model there’s one technical question we needto answer. Suppose we did have a small circuit to compute a function f . Could
we then implement the quantum black-box behavior that we described above?
That is, could we implement the behavior of an XOR oracle? The reason
this isn’t entirely obvious is that quantum circuits have to be reversible. So
just because there’s a small circuit to compute f , doesn’t immediately imply
that there’s a small circuit that maps the basis state |x, yi to the basis state|x, y ⊕ f (x)i while leaving nothing else lying around.
Indeed, let’s step back, and think about the constraints on computationthat are imposed by reversibility. To start with the obvious, if we had areversible circuit that maps |xi to |f (x)i, then f must be an injective function.
But, now for the subtle part, even if f (x) is both injective and efficiently
computable, that still doesn’t imply (at least, as far as we know) that the map|xi → |f (x)i is efficiently computable. Why not? Well, imagine that f (x) is
an injective one-way function, a function that’s easy to compute but hard to
invert. Such functions are the basic building blocks of cryptography and are

136

LECTURE 17. QC AND DEUTSCH-JOSZA

strongly conjectured to exist, even in a world with quantum computers.
Note that even though quantum computers can break a few
supposedly one-way functions, like those based on factoringand discrete log, there are many, many more “generic, lessstructured” one-way functions that don’t seem threatenedby quantum computers. We’ll have more to say about such
issues later.
Now suppose we had a small circuit C such that C |xi = |f (x)i. Then,simply by running that circuit backwards (inverting all the gates and reversing
their order) we could get C −1 |f (x)i = |xi. Thereby inverting the supposed
one-way function! But why doesn’t this contradict our starting assumption thatf was easy to compute? Because a reversible circuit for f would at best give us
a mapping like |xi |0i → |xi |f (x)i, a mapping that leaves x around afterward.
Inverting that mapping will only take us from f (x) to x if we know x already,so the reversible mapping is no help in breaking the one-way function after all.
This still leaves the question of how we efficiently implement the mapping|xi |0i → |xi |f (x)i if given a small non-reversible circuit for f . In the lastlecture we saw how it’s possible to take any non-reversible circuit and simulate
it by a reversible one by, for example, using Toffoli gates to simulate NAND
gates. The trouble is that along the way to the final answer, the construction
also produces all sorts of undesired results in the ancillary bits. The technicalname for this is Garbage (yes, really).
Why is garbage such a problem for quantum computing?
Because garbage can prevent the desired interference patterns from showing up, and the whole point of quantum
algorithms is to create those interference patterns.
√√
and having |00i+|11i,
For example, what’s the difference between having |0i+|1i22
where we treat the second qubit as unwanted garbage? The garbage is entangled with the first qubit, which is the qubit we care about. In the second case,when we look at only the first qubit, we see the maximally mixed state rather
than the |+i state we wanted.
Returning to the original question, suppose you have a circuit to computef . How you we get a circuit that maps

Xx

αx |x, 0i →Xx

αx |x, f (x)i

17.2. QUANTUM GARBAGE COLLECTION

137

without all the garbage? Back in the 1970s, Charles Bennett (while studying
this problem in the context of classical reversible computation) invented a trick
for this called Uncomputing. It’s simple, though also strange when you firstsee it. The trick to getting rid of garbage is to run computations first forward
and then in reverse. Let’s say I have some circuit C such that
C |x, 0, . . . , 0i → |x, gar(x), f (x)i ,where gar(x) is a generic term for all the garbage produced as a byproduct of
the computation. Then I do the following:
I First run the circuit C to get |x, gar(x), f (x)i.
I Then

CNOT the answer f (x) into a register initialized to 0 to get|x, gar(x), f (x), f (x)i (in other words, make a copy of f (x) in a safe
place).

I Finally, run the inverse circuit, C −1 , to get |x, 0, . . . , 0, f (x)i, or just|x, f (x)i if we ignore the 0’s.

|xi

|xi

|0i

|0i

|0i
..
.
|0i
|0i

C −1

C
•

|0i
..
.
|0i
|f (x)i

Figure 17.2: Circuit depicting the uncomputation of garbage.
The reason why we can copy f (x) in spite of the No-Cloning Theorem isthat we’re assuming that f (x) is a classical answer. This won’t work if theoutput of the circuit is a general quantum state.
With uncomputing out of the way we’re finally ready to talk about somequantum algorithms.

138

17.3

LECTURE 17. QC AND DEUTSCH-JOSZA

Deutsch’s Algorithm

Deutsch’s Algorithm was, by some definitions, the first quantum algorithm.
It was proposed in the mid-1980s by David Deutsch and while its speedup
is perhaps initially unimpressive, it makes use of many of the same building
blocks that we’ll reuse later on. Deutsch’s algorithm computes the parity of
two bits using only one (superposed) query to the bits.
In more detail, suppose we’re given oracle access to two unknown bits,f (0) and f (1). Given an index x ∈ {0, 1}, our oracle returns the bit f (x).
Classically this would clearly take two queries since we need to know bothbits. Using a quantum algorithm we can do it in one.
Let’s start with a qubit initialized to |0i. We’ll then apply a Hadamard
gate to it to get |+i. Next we’ll apply a phase query, which multiplies theamplitude of each basis state |xi by (−1)f (x) . This yields:|0i →(−1)f (0) |0i + (−1)f (1) |1i|0i + |1i
√
√
→
2
2

(17.4)

So now, if f (0) = f (1), that is we have even parity, we get(−1)f (0)|0i + |1i√
2

(17.5)

while if f (0) 6= f (1), meaning we have odd parity, we get(−1)f (0)|0i − |1i√
2

(17.6)

We can ignore the phase out front, since global phase doesn’t affect measurement. Applying another Hadamard gate now gets our quantum state back tothe {|0i , |1i} basis. If we have even parity, f (0) = f (1), then the output is|0i and if we have odd parity, f (0) 6= f (1), then the output |1i. A completequantum circuit for the algorithm is given in Figure 17.3.
Note that if we wanted the parity of an n-bit input string, Deutsch’s algorithm would let us get that with n2 queries. We simply need to break the string
up into n2 blocks of 2 bits each, use Deutsch’s algorithm to learn the parity, pB ,of each block B (using n2 queries in total), and then calculate the parity of thepB ’s. This last step doesn’t increase the query complexity because it doesn’t
involve making any additional queries to f . This turns out to be optimal—any
quantum algorithm to compute the parity of an n-bit string requires at leastnqueries—but we won’t prove it in this course.
2

17.4. DEUTSCH-JOSZA ALGORITHM

|0i
|1i

H

139

H
UF

H

Figure 17.3: Quantum circuit for Deustch’s algorithm with the additional
ancillary qubit used for simulating the phase query shown explicitly.

17.4

Deutsch-Josza Algorithm

Suppose we have a black box that computes a Boolean function f : {0, 1}n →{0, 1}, and suppose we’re promised that f is either a constant function (theoutput is always 0 or 1, independent of the input), or a balanced function(there are the same number of 0 outputs as 1 outputs). The problem is todecide which. Classically, deterministically, you could solve this problem byexamining 2n−1 + 1 values of the function. If all the values match then thefunction is constant; otherwise the function is balanced. If you want no possibility of error then it’s not hard to see that this is the best you can do. Of
course, you can do much better by using random sampling. You’d only needa constant number of queries to get an answer with small probability of error. If all of your samples match, you can guess that the function is constant.
Otherwise you know that it’s balanced.
What the Deutsch-Jozsa algorithm does is to solve the problem perfectly(that is, with zero probability of error) with only one quantum query. That’s
something that isn’t possible in the classical world.
Truth is, this speedup still isn’t all that impressive, because
the classical probabilistic algorithm is nearly as fast, andwould be perfectly fine in practice. Until 1994 or so, non of
the quantum speedups that we knew were very impressive!
The quantum circuit for the Deutsch-Jozsa algorithm is given in Figure17.4. You’ll begin to notice that some patterns appear a lot in quantum
algorithms.
I You start by putting everything in superposition.
I You then query a function f —in this case, using a phase query.
I You then apply a change a basis—in this case, another round of Hadamards.
I Finally, you measure to get the information you want to know.

140

LECTURE 17. QC AND DEUTSCH-JOSZA

|0i

H

|0i
..
.

H

|0i

H

H
UF

H
..
.
H

Figure 17.4: Quantum circuit for the Deutsch-Josza algorithm.
If you can’t figure out what to do next in a quantum algorithm, a round of Hadamards is usually a good guess!
So, given the circuit for the Deutsch-Josza above (call it C), what’s the probability of getting back the state |0 · · · 0i? This is given by | h0 · · · 0|C|0 · · · 0i |2 .
The first step in the algorithm is to apply a Hadamard gate to each of the ninput qubits. As we mentioned above, applying a round of Hadamard gates toeach qubit in our circuit is such a common primitive in quantum algorithms
that it will be helpful to describe the effect of the transformation on arbitrarystandard basis states. The first thing to note is that we can rewrite the effectof the Hadamard gate on a single qubit as
H |xi =

|0i + (−1)x |1i√
2(17.7)

As such, given an input state |xi = |x0 , · · · , xn−1 i the result of applying
Hadamard gates to each qubit is|0i + (−1)xn−1 |1i|0i + (−1)x0 |1i |0i + (−1)x1 |1i√√√⊗⊗ ··· ⊗.
2
2
2

(17.8)

With a bit of algebra this can be simplified toX1
H ⊗n |xi = √(−1)x·y |yi .
n2 y∈{0,1}n(17.9)

Here x · y denotes the inner product. This formula essentially says that wepick up a –1 phase for every i such that xi = yi = 1. Now, coming back to17.4. DEUTSCH-JOSZA ALGORITHM

141

the Deutsch-Jozsa algorithm, after we Hadamard all n of the qubits and thenquery the oracle, we get the stateX1√(−1)f (x) |xi .
2n x∈{0,1}n(17.10)

Following the second round of Hadamards we get
1
2n

X

X

(−1)f (x)(−1)x·y |yi .

(17.11)y∈{0,1}nx∈{0,1}nRather than simplifying this entire sum, let’s take a shortcut by just looking
at the amplitude for the state y = |0 · · · 0i. This amplitude is given by
12nX(−1)f (x) .

(17.12)x∈{0,1}nIf f is constant then the above amplitude is either 1 (if f is always 0) or –1(if f is always 1). On the other hand, if f is balanced then the amplitude is
0. So when we measure, if we see the outcome |0 · · · 0i then we know that f isconstant, and if we see any other outcome then we know that f is balanced!

Lecture 18: Bernstein-Vazirani
and Simon’s Algorithm
18.1

The Bernstein-Vazirani Problem

We ended last lecture with the Deutsch-Jozsa problem. In this lecture we’ll
start with another black-box problem for which quantum algorithms provide
an advantage, the Bernstein-Vazirani Problem. Here we’re given access toa black box function f : {0, 1}n → {0, 1}. We’re promised thatf (x) = s · x (mod 2),
for some secret string s. The problem is to find s. Classically, you could get
an answer one bit at a time by querying all the strings of Hamming weight
one. For example, with n = 4,
f (1000) = s1
f (0100) = s2
f (0010) = s3
f (0001) = s4
But, no classical algorithm can do better than this, since each query can only
provide one new bit of information about s, and s has n bits. The BernsteinVazirani algorithm, however, solves the problem quantumly using only one
query!

18.1.1

Quantum Algorithm

We’ll start the quantum algorithm for the Berstein-Vazirani problem the same
way we did for the Deustch-Josza problem, by creating a uniform superposition
over all possible input states and then applying a phase query. If our initial14218.1. THE BERNSTEIN-VAZIRANI PROBLEM

|0i

H

|0i
..
.

H

|0i

H

143

H
UF

H
..
.
H

Figure 18.1: Quantum circuit for the Bernstein-Vazirani algorithm. Note that,aside from having a different oracle, the circuit is identical to Figure 17.4.
state is the all zero string |0 · · · 0i, then after a round of Hadamards, the stateof the system is given by
X
1
|xi .
|ψi = √
2n x∈{0,1}n(18.1)

Then, after a phase query, the state of the system is given by
XX
11(−1)f (x) |xi = √(−1)s·x |xi .
|ψi = √
2n x∈{0,1}n2n x∈{0,1}n(18.2)The question is how do we measure the resulting state in a way that gives
us information about the secret string s? To see how to proceed, let’s startby restating the observation originally made in Equations 17.8 and 17.9, thatgiven an input state |xi = |x0 , · · · , xn−1 i the effect of applying a Hadamard
gate to all n qubits is(|0i + (−1)xn−1 |1i)(|0i + (−1)x0 |1i) (|0i + (−1)x1 |1i)√√√⊗⊗ ··· ⊗
2
2
2
X
1
=√
(−1)x·y |yi .
2n y∈{0,1}n

H ⊗n |xi =(18.3)The key observation is that the state of the system following the phase queryhas precisely the same form as the state in Equation 18.3 above.
By reversibility, this means that if we Hadamard all the qubits again, we’llchange the qubits that picked up a phase (i.e., for which si = 1) from |−i to144

LECTURE 18. B-Z AND SIMON’S ALGORITHM|1i and the qubits that didn’t pick up a phase (si = 0) from |+i to |0i:X1
H ⊗n  √(−1)s·x |xi = |si(18.4)n2 x∈{0,1}nSo, from here we can simply measure the qubits in the standard basis toretrieve |si = |s0 , · · · , sn−1 i.
This convenient result isn’t a coincidence, you can see that Bernstein andVazirani designed their problem around what a quantum computer would be
able to do!
Don’t tell anyone, but this is actually pretty common inthis field.

18.2

Simon’s Problem

The next algorithm we’ll study was discovered in 1994 by Daniel Simon andsolves a problem now known as Simon’s Problem. The story goes that Simon
looked at the quantum algorithms coming out and he didn’t believe that anyof them would give a “serious” speedup. Even the Bernstein-Vazirani problem
is easy classically, a classical computer can find the n bits of s with n queries.
Sure, the quantum algorithm needs only one query, but it also requires O(n)gates, so maybe it’s not that impressive after all. Simon believed there wasa limit that would prevent you from getting a “true” exponential speedupfrom a quantum computer and he set out to prove it. What he ended up
finding instead was that there is a true exponential speedup, at least in theblack-box setting. As we’ll see, this then played a central role in subsequent
progress in quantum algorithms, particularly Shor’s algorithm which cameshortly afterward.
In Simon’s problem we’re once again given an oracle function f , this time
mapping n bits to n bits, f : {0, 1}n → {0, 1}n . We’re promised that there’s asecret string s 6= 0n , such thatf (x) = f (y) ⇐⇒ y = x ⊕ s(18.5)

for all inputs x and y, where ⊕ is the bitwise XOR. The problem is to find thesecret string s by querying f as few times as possible. Compared to BernsteinVazirani, there’s more freedom in the choice of function f . In Simon’s problem
all we require is that f has a “hidden XOR-mask,” that is, a subset of bits

18.2. SIMON’S PROBLEM

145

such that when you flip the bits in that subset the output is unaffected. What
does this mean? Let’s do an example with 3-bit inputs and with secret strings = 110. Let’s say we query f a few times and get the following outputs
f (000) = 5
f (110) = 0
f (001) = 6
f (111) = 6
We’re given no information about how to interpret the outputs themselves,
so it doesn’t really matter whether we think of them as strings, integers, orwhatever. The only thing that does matter is whether two inputs map to thesame output. Since f (001) = f (111) = 6, we now know that s = 001 ⊕ 111 =110.
This is simple enough with 3 bits, but we’re more interested in f ’s with,say, 1000-bit inputs. In that case, we claim that finding the secret string is
prohibitively expensive classically. How expensive? Well, it’s not hard to showthat any deterministic algorithm needs to query f at least 2n−1 +1 times, by anargument similar to the one that we used for Deutsch-Jozsa. But once again,
the more relevant question is how many queries are needed for a randomized
algorithm.
We claim that we can do a little bit better with a randomized algorithm,
getting down to O(2n/2 ) queries. This is related to the famous Birthday
Paradox, which isn’t really a paradox so much as a “birthday fact.” It simply
says that, if you gather merely 23 people in a room, that’s enough to have a∼ 50% probability of getting at least one pair of people who share a birthday.
√
More generally, if there were n days in the year, then you’d need about npeople in the room for a likely birthday collision. At least assuming birthdays
are uniformly distributed, in reality they’re not exactly, e.g., there are clustersof them about 9 months after major holidays1 . The takeaway here is that the
number of pairs of people is what’s important and that scales quadraticallywith the number of people.
The Birthday Paradox is also useful in cryptanalysis. For example, cryptographic hash functions need to make it intractable to find any two inputs x andy with the same hash value, f (x) = f (y). But, by using a “birthday attack”—
i.e., repeatedly choosing a random input x, then comparing f (x) against f (y)for every previously queried input y—we can find a collision using a numberof queries that scales only like the square root of the size of f ’s range. This isquadratically faster than one might have expected naively.
1

But it can be shown that any nonuniformities only make collisions more likely.

146

LECTURE 18. B-Z AND SIMON’S ALGORITHM

Whatever other structure it has, Simon’s problem involves a two-to-one
function in which we’re looking for a collision, so it also admits a birthday
attack. Roughly speaking, given two randomly-chosen inputs x and y, we’ll
observe f (x) = f (y) with probability p ≈ 2−n and while these events aren’tquite independent between the various (x, y) pairs they’re nearly so. If wewant to observe a collision with high probability then we need to query f∼ 2n/2 times.

18.2.1

Classical Lower BoundIs there a better classical algorithm? Let’s prove that the answer is no. We’ll
use an Adversary Argument, essentially asking “If my worst enemy got tochoose f , what would they do?” Presumably they would choose a secret strings uniformly at random among all possible s’s, to make it as hard as possible
to find an underlying structure in f . Then, perhaps, they’d choose a random
f among all those consistent with that choice of s.
Now, once we fix such a strategy for the adversary we can assume without
loss of generality that the algorithm is deterministic. This is because any
randomized algorithm can be thought of as just a probabilistic mixture ofdeterministic algorithms, and there must be at least one algorithm in the
mixture that does at least as well as the average! This observation—together
with the complementary observation that all randomized lower bounds can beproved in this way—is sometimes referred to as Yao’s minimax principle.
So, let the deterministically queried inputs be x0 , x1 , etc. Then the questionis what information can we derive about s after the first t queries?
If after t queries we’ve found a collision pair, f (xi ) = f (xj ) for some i 6= j,then we’re done since we know that s = xi ⊕ xj . So let’s assume that hasn’t
happened yet. In that case, all we can conclude about s is that s 6= xi ⊕ xj
for every i 6= j pair queried thus far. This rules out at most t2 possible valuesof s, with all the other possibilities remaining equally likely given what we’veseen so far (i.e., having equal posterior probabilities). It follows that unless
we observe a collision, narrowing the possibilities down to a single s requiresΩ(2n/2 ) queries. The probability that we observe a collision by the tth queryis onlyt22n − 1,so, by the union bound, with high probability we won’t observe any collisions
at all until we’ve made ∼ 2n/2 queries. And that’s the adversary argument.

18.2. SIMON’S PROBLEM

18.2.2

147

Quantum Algorithm

Output Register

Input Register

Amazingly, in contrast to the Ω(2n/2 ) classical lower bound, we can solve
Simon’s problem on a quantum computer using only O(n) queries to f . The
quantum algorithm that does this is known as Simon’s Algorithm. The
quantum circuit is given in Figure 18.2


|0i





 |0i
..


.




|0i

|0i





 |0i
..


.




|0i

H

H

H

H
..
.

H

H
UF

..
.

Figure 18.2: Quantum circuit for the Deutsch-Josza algorithm.
The algorithm follows a now-familiar pattern:
I Start with 2n qubits initialized to the |0 · · · 0i state. The first n will be

the input register and the second n will be the answer register.
I Hadamard the first n qubits.
I Query f using an XOR oracle.

This yields the stateX1√|xi |f (x)i .
2n x∈{0,1}n(18.6)

This time the function f has a large output so we need to write out its
values in a separate n-qubit answer register rather than just encoding it into
the phase. But, it’s important to note that the answers themselves aren’t what
we care about! We’re only writing them out because by doing so, we create a148

LECTURE 18. B-Z AND SIMON’S ALGORITHM

desired interference pattern in the input register. Indeed, at this point in thealgorithm we could simply discard the answer register, or do anything else we
liked with them. For pedagogical simplicity let’s assume we now measure theanswer register, and let’s assume that the result of the measurement is |wi.
Keeping track of all of the w’s we could have seen would’ve
resulted in a mixed state. Instead, we’re just conditioning
on a particular |wi.
By the partial measurement rule we’re left with an equal superposition
over all the different inputs that are consistent with the value of w that we
observed. In Simon’s problem, there are necessarily two such inputs. In otherwords, we’re left with a superposition|xi + |yi√such that f (x) = f (y) = w
2(18.7)

By the Simon promise, this means in particular that s = x ⊕ y. So what is thisstate good for? First, observe that if we could just measure the state twice,then with high probability we’d get both x and y. Bitwise-XORing the twostrings would then give us the secret string s and we’d be done!
Alas, in quantum mechanics we only get one chance to measure a state, so
we’ll see either x or y, which tells us nothing about s. We could of course repeat
the whole algorithm from the beginning, but if we did then with overwhelming
probability we’d get a different w corresponding to a new pair.
So, we’ll need to be more clever—although not that much more clever!
In particular, let’s see what happens if we measure the state in Equation
18.7 in the Hadamard basis. For starters, we know from Equation 18.3 thatHadamarding all n qubits in the standard basis state |xi maps it toX1√(−1)x·z |zi ,n
2 z∈{0,1}nand likewise, Hadamarding all n qubits of |yi givesX1√(−1)y·z |zi .
n
2 z∈{0,1}n
By linearity, this means that applying H ⊗n to an equal superposition of

18.2. SIMON’S PROBLEM

149|xi and |yi must give

H

⊗n



|xi + |yi
√
2


=√

1

X

2n+1

z∈{0,1}n[(−1)x·z + (−1)y·z ] |zi .

(18.8)

Now we’ll measure this state in the standard basis. Which z’s could we getwhen we do so? For a given z to be observed, it must have a nonzero amplitude.
This means that (−1)x·z and (−1)y·z must be equal, which occurs if and only
if x · z = y · z (mod 2). Or, rewriting this equation a bit:x · z + y · z = 0 (mod 2)(x ⊕ y) · z = 0 (mod 2)
s · z = 0 (mod 2)(18.9)

So, what we get when we measure is an n-bit string z, chosen uniformly
at random from among all of the 2n−1 strings whose inner product with s is
0. In other words, we haven’t yet learned s itself, but we’ve learned a bit of
information about s, which I hope you’ll grant is something! What if we reallywant s itself ? In that case, we can just repeat Simon’s algorithm over andover, starting from the beginning each time! This will give us a collection ofstrings {z0 , · · · , zk−1 }, which are selected uniformly random and independentof each other, and which all have even inner products with s:s · z0 = 0 (mod 2)
s · z1 = 0 (mod 2)..
.
s · zk−1 = 0 (mod 2)(18.10)

Now that we’ve got these equations, what should we tell a classical computer
to do with them? Well, suppose k = n + c, where c is some large constant.
Then we now have a collection of n + c linear equations in n unknowns over afinite field with two elements. We can solve this system of equations efficiently
using a classical computer.
Using an algorithm called “Run Matlab.” Or Gaussianelimination, taking O(n3 ) time. Or, if you’re feeling fancy—
and impractical, since the constant factor overheads aremonumental—the fastest known algorithm for solving linear systems takes O(n2.373 ) time.

150

LECTURE 18. B-Z AND SIMON’S ALGORITHM

It’s not hard to do a probabilistic analysis showing that after we’ve seenslightly more than n equations, with overwhelming probability we’ll be left
with a system of equations that has exactly two solutions. Namely, 0n and s
itself. We can throw away 0n , because we assumed s 6= 0n . So that leaves us
with s.
So, with O(n) queries along with a polynomial amount of additional classical computation we can find s, in sharp contrast to the provably exponential
number of queries needed to solve Simon’s problem classically. A few additional questions:
Does Simon’s algorithm have a deterministic counterpart? Yes, one canmodify the algorithm so that it succeeds with certainty rather than “merely”
overwhelming probability. We won’t go into the details here.
Why doesn’t this just prove that quantum algorithms are better? It’s sort oftricky to translate Simon’s algorithm from the black-box setting into the “realworld.” To get a speedup over classical computing in terms of the sheer numberof gates or computational steps, we’d need some small circuit to compute afunction f that was actually like our magical Simon function.
To illustrate, f (x) = Ax for some rank-(n–1) Boolean matrix A would
satisfy the Simon promise. But, the difficulty in getting a quantum speedup
this way is that once we pin down the details of how we’re computing f —in our example, as soon as we give the actual matrix A—we then need tocompare against classical algorithms that know those implementation details
as well. As soon as we reveal the innards of the black box, the odds of an
efficient classical solution become much higher! In our example, if we knew
the matrix A then we could solve Simon’s problem in classical polynomial
time just by calculating A’s nullspace. More generally, no one to this day has
found a straightforward “application” of Simon’s algorithm, in the sense of aclass of efficiently computable functions f that satisfy the Simon promise andfor which any classical algorithm plausibly needs exponential time to solve
Simon’s problem when the algorithm is given the implementation details of f .
The story goes that Daniel Simon wrote a paper about this theoretical
black-box problem with an exponential quantum speedup and the paper got
rejected. But there was one guy on the program committee who was like,“hey, this is interesting.” He figured that if you changed a few aspects of what
Simon was doing, you could get a quantum algorithm to find the periods ofperiodic functions, which would in turn let you do all sorts of fun stuff. Thatguy was Peter Shor and the algorithm he invented will be the focus of our next
three lectures.

Lecture 19:
gorithm
19.1

RSA and Shor’s Al-

RSA Encryption

In this lecture we’ll see Shor’s algorithm. Given a positive integer N , which
we’ll assume for simplicity is a product of two primes p and q, this algorithm
lets you find p and q using only about O(log2 (N )) steps. Shor’s algorithm
captured the world’s attention because RSA, one of the most widely-usedpublic-key encryption methods, relies on the assumption that factoring is hard.
So, before we start in on Shor’s algorithm, which will take a few lectures tocover completely, let’s briefly review RSA.
The basic idea is that some website, say Amazon, wants you to be able
to send them messages that only they can decrypt (your credit card number,for example). But, they’ve never met with you in private to agree on a secretencryption key, so private-key cryptography is off the table. And we don’t havethe hardware for quantum key distribution! So, what Amazon does instead isfind two large primes p and q (say a thousand digits each), which they keep
secret. Amazon then multiplies them to get N = pq, which they publish to
the world. The fact that Amazon can efficiently pick two huge random prime
numbers p and q and know for sure that they’re prime is already not quite
obvious, but it follows from some classical number theory that we won’t go
into.
Now, you can encrypt a message using the public key, N . If your plaintext
message is x, then in the simplest version of RSA, your encrypted message
would just be x3 mod N . Given that encrypted message along with knowledgeof the prime factors p and q there’s an efficient algorithm for Amazon torecover x—it’s again some basic number theory that we won’t go into rightnow, although we’ll see aspects of it later. The key idea is that if you know
p and q, then you also know the order of the multiplicative group modulo N ,and that knowledge lets you do things like efficiently take cube roots modulo
151

152

LECTURE 19. RSA AND SHOR’S ALGORITHM

N . By contrast, an eavesdropper who doesn’t know p and q, but only knows
N , seems to face an exponentially hard problem in recovering the plaintext—
though it’s been proven neither that factoring is hard, nor even that breaking
RSA is necessarily as hard as factoring.
Some number theorists conjecture that factoring is in P, or
profess agnosticism. The problem of factoring’s complexity
has only been seriously worked on for, like, 40 years. In any
case, if you can factor, then you can break RSA, and thatcertainly provides more than enough reason to be interested
in the complexity of factoring.
The naı̈ve algorithm to factor N is trial division,√ which in the worst caserequires√ you to test all possible divisors up to N (every divisor greaterthan N must have an accompanying divisor that’s smaller). We call thisan “exponential-time” algorithm since the running time is exponential inn = log (N ), which is the number of digits needed to specify N . Number theorists have discovered several faster
algorithms. The Quadratic Field Sieve,√
O( N ), a milder exponential. The Number Field
from 1981, runs in roughly 2
1/3
Sieve brings that down to 2O(N ) , though its correctness depends on the proofof a yet-unproven conjecture.
This is why 512-bit, 768-bit, and maybe even 1024-bit encryption aren’t quite secure anymore. They can be cracked
using known algorithms given sufficient time and money
for hardware. In the Snowden documents there’s evidenceof the NSA allocating money for this sort of thing. In a
way that’s almost reassuring to people who worry that the
NSA can break anything. . .
Another public-key cryptosystem in widespread use is Diffie-Hellman,
which is based on a different problem called discrete logarithms. While we
won’t cover this system in this lecture, it turns out that Shor’s algorithm also
solves the discrete-log problem in polynomial time, thereby breaking DiffieHellman as well.
No one has shown that factoring and discrete log are necessarily related, e.g. by giving a reduction between them.
In practice, though, advances in solving one problem almost always seem to lead to advances in solving the other19.2. PERIOD FINDING

153

in short order.
We now know that both RSA and Diffie-Hellman were first discovered insecret—by the mathematician Clifford Cocks for the former and by James H.
Ellis, Clifford Cocks and Malcolm J. Williamson for the latter—at GCHQ (theBritish NSA) before they were rediscovered in public about a few years later.

19.2

Period Finding

What Shor’s algorithm really does, under the hood, is solve a problem called
Period-Finding. One of Shor’s key observations was that, for classical number theory reasons having nothing to do with quantum mechanics, a fast algorithm for period-finding leads to a fast algorithm for problems like factoringand discrete logarithm. Period-finding is a black-box problem similar in somerespects to Simon’s Problem. In period-finding, we’re given oracle access to afunction f : N → N, and promised that there’s some secret integer s > 0 suchthat for all x and yf (x) = f (y) ⇐⇒ s|(y − x).

(19.1)

We call s the period of the function f . The problem is to find s.
How many queries to f do we need to solve period-finding classically? Let’s
assume that s ∼ 2n (i.e., that s is an n-bit integer) and give our answer interms of n. Observe that once you find a pair x and y such that f (x) = f (y),you then know that s divides y − x and are very close to solving the problem.
Indeed, if you found a few such collisions you could just take their greatest
common divisor gcd(x1 − y1 , x2 − y2 , x3 − y3 , . . . ). We won’t give the analysis
here, but after not too many collisions the odds are high that this will yield
the period.
Incidentally, how do we get the gcd of two integers in polynomial time? We
use Euclid’s GCD Algorithm—possibly the oldest interesting polynomialtime algorithm in history! To find the gcd of x and y (with x > y), we find q
and r that satisfy
x = qy + r,

(19.2)

such that qy is the greatest multiple of y less than x. This means that y > r.
Then, we find the gcd of y and r and we keep recursing in this way untilr = 0. The size of the numbers involved in each recursive step goes down by
a constant factor each time, which means the whole algorithm runs in time
linear in n, the number of digits of x and y.

154

LECTURE 19. RSA AND SHOR’S ALGORITHM

OK, but how do we find the collisions classically? This is the birthday
paradox all over again. Recall from the last lecture that something like ∼ 2n/2
queries to f are both necessary and sufficient.
This is still a huge number of queries, if (say) n = 2000.

19.2.1

Factoring to Period-Finding Reduction

The first part of Shor’s algorithm is a purely classical reduction from factoringto period-finding. We’ll talk about this reduction first, before moving on to
the quantum algorithm for efficiently solving the period-finding problem.
Why is factoring reducible to period finding? The main connection between
the two is the multiplicative group modulo N , typically denoted Z×
N . This isa finite abelian group—that is, a finite set with a commutative, associative,
invertible multiplication operation—that’s one of the most basic examples ofa group in all of math. The multiplicative group modulo N is given by theset of positive integers less than N which are relatively prime to N , meaningthat the only common factor they share with N is 1. The group operation
is multiplication mod N . For a prime p, the multiplicative group consistsof the set {1, 2, . . . , p − 1}, with the group operation being multiplication
modulo p. The restriction to integers relatively prime to N is essential when
N is composite, since otherwise you won’t have a multiplicative inverse. For
example, when N = 15 the multiplicative group mod N consists of the 8element set {1, 2, 4, 7, 8, 11, 13, 14}. In general, the size of this group, given
N = pq, is going to be |Z×
N | = (p − 1)(q − 1), since that’s how many positive
integers less than N are relatively prime to N . For example, when N = 15,
we saw that the size of the group is (5 − 1)(3 − 1) = 8.
An extremely useful fact about finite groups G is that, for any element
x, we have x|G| = 1. This has a few corollaries, such as Fermat’s Little
Theorem, which states that for all primes p and integers x ∈ {1, . . . , p − 1}
xp−1 ≡ 1

mod p(19.3)

Another important corollary is a generalization of Fermat’s little theorem
called Euler’s Theorem, which says that for all primes p and q, and for
integers x relatively prime to p and q, the following holds:x(p−1)(q−1) ≡ 1

mod pq(19.4)

19.2. PERIOD FINDING

155

Euler’s Theorem is super important in RSA encryption as
well.
Euler’s Totient Function ϕ(N ) returns the order of the multiplicative
group mod N , which is the number of integers from 1 to N that are relatively
prime to N . For example, if p and q are prime, then ϕ(p) = p − 1 andϕ(pq) = (p − 1)(q − 1). If n = pq, then we can rewrite Euler’s theorem fromabove in terms of the totient function:xϕ(N ) ≡ 1

mod N(19.5)

Why is this important? Well, let’s say we want to factor some number
N = pq, a product of distinct primes. Then here’s an approach: pick an x
such that gcd(x, N ) = 1.
Such x’s are easy to find. Indeed, in the rare event that wepick an x and it happens that gcd(x, N ) > 1, we can run
Euclid’s algorithm on x and N to factor N right then andthere!
Shor’s algorithm relies crucially on the properties of the modular exponentiation function,f (r) = xr

mod N.

(19.6)

What can we say about this function? First of all, how hard is it to compute?
A naive approach would use r–1 multiplications, but r can be large and so thiscan end up being exponential in n = log(N ). But there’s a much, much fasterapproach called Repeated Squaring. It’s best illustrated with an example.
Say we want to calculate 1321 mod 15. We could calculate 13 × 13 × · · · × 13
mod 15 by alternating multiplication with reducing mod 15, but that’s still 20
multiplications. Instead, let’s rewrite it as a product of 13 raised to various
powers of 2:1316 × 134 × 13

mod 15.

We can further rewrite this as


 2
2 2

13

2

× 132

2

× 13

mod 15156

LECTURE 19. RSA AND SHOR’S ALGORITHM

This may be ugly, but it requires considerably fewer multiplications (6 intotal), an advantage that grows rapidly as the exponent increases. Indeed, thetotal time needed is polynomial in n.
Once again, repeated squaring also plays a central role in
RSA decryption. Ironically, many of the same number theory facts that led to RSA also allow lead to Shor’s algorithm, which breaks RSA.
OK, so f (r) = xr mod N is efficiently computable. It’s also, clearly, aperiodic function, with a period that divides φ(N ), the order of Z×
N . What
could we learn by figuring out its period? Here’s the key point: we claimthat finding the period of f will let us factor N . Why? First, some intuition.
Suppose we were able to learn ϕ(N ), the order of the multiplicative group mod
N . Then we’d surely be able to factor N into pq. This is becauseϕ(N ) = (p − 1)(q − 1) = pq − p − q + 1
So, if we know ϕ(N ) we now know both N = pq and p + q, and we can use thequadratic formula to solve for p and q themselves. Unfortunately, this doesn’tquite work with Shor’s algorithm, because the period of f might not equalϕ(N ), the most we can say is that the period divides ϕ(N ).
Here’s what we’ll do instead. Let’s pick a random x relatively prime toN , and find the period s of f (r) = xr mod N . We then have that xs ≡ 1
mod N . Now, let’s imagine we’re lucky and s is even (which intuitively should
happen maybe half the time?). In that case we can write
xs − 1 = (xs/2 − 1)(xs/2 + 1) ≡ 0

mod N.

(19.7)

In other words, the product (xs/2 − 1)(xs/2 + 1) is an integer multiple of N .
Now, suppose we get lucky a second time, and neither xs/2 − 1 nor xs/2 + 1 isitself a multiple of N . Then that means we’ve learned a factor of N . We justcompute gcd(xs/2 − 1, N ), which will give us either p or q. This is because ifneither xs/2 −1 nor xs/2 +1 is a multiple of N , then in order to satisfy Equation
19.7, one term must be a multiple of p and the other a multiple of q.
Furthermore, both of these “imagine we get lucky” steps can be shownto happen with a constant probability over the choice of x by using a little
number theory that we won’t go into here. The precise statement is for any
N , if x is randomly chosen from the numbers relatively prime to N , then withprobability at least 38 :I s is even.

19.2. PERIOD FINDING

157

I Neither xs/2 − 1 not xs/2 + 1 is a multiple of N .

This gives us a plan of attack for factoring N . The key remaining problem—
and the one we’ll use quantum mechanics to solve—is finding the period off.

19.2.2

Quantum Algorithm for Period-Finding

We’ll now give a quantum algorithm that solves the black-box problem of
period-finding in time polynomial in n = log(N ). We’ll then apply that algorithm to find the period of the function f (r) = xr mod N , for a randomly
chosen value of x relatively prime to N . That is, we’ll use f to “instantiate”
the black box. By the previous discussion, f can be computed in polynomial
time using repeated squaring. Better yet, the ability to find its period implies
the ability to factor N .
Recall that for any given x the probability that it satisfies
the constraints we need in order to use the period of f tofactor a given N is ∼ 83 , so we might need to try several
different values of x until we find one that works.
The first step in the quantum period finding algorithm is to make an equalsuperposition over all nonnegative integers less than some upper bound Q,
q−1

1 X
√
|ri |f (r)i ,Q r=0(19.8)

with each integer written in its binary representation. For technical reasons
we’ll explain in a later lecture, we set Q to be a power of 2 of order N 2 . We
can prepare this state by Hadamarding the log(Q) qubits in the input register,then querying f and writing the output into the log(Q) qubit of the answer
register (with uncomputing to get rid of garbage).
Unlike with Simon’s algorithm, in Shor’s algorithm Uf is not just an abstract black box. We can find an actual quantum circuit to implement Uf ,because f is just the modular exponentiation function.
By using the repeated squaring trick, we can create actual circuit for Ufthat maps |ri |0 · · · 0i to |ri |f (r)i out of a network of polylog(N ) Toffoli gates.
Just like with Simon’s algorithm, we won’t care at all about the actual
value of f (r), but only about the effect that computing f (r) has on the |ri
register. So for pedagogical purposes, we’ll immediately measure the |f (r)i
register and then discard the result.

158

LECTURE 19. RSA AND SHOR’S ALGORITHM

What’s left in the input register? By the partial measurement rule, what’s
left is an equal superposition over all the possible r’s that could’ve led to theobserved value f (r). Since f is periodic with a secret period s, these values
will differ from each other by multiples of s. In other words, we now have thestate|ri + |r + si + |r + 2si + · · · + |r + (L − 1)si√
(19.9)
L
where L is an appropriately chosen normalization constant.
The central challenge of Shor’s algorithm is to measure the above state ina way that reveals useful information about the period s.
Just like in Simon’s Algorithm, if we could measure the state multiple times
in the standard basis (without collapsing it), then we could take the gcds ofthe differences to find s. But we can’t do that! We can repeat the wholealgorithm from the beginning, but if we do then we’ll almost certainly end up
with a different offset r, preventing useful comparisons.
This simply means that—just like with everything else in quantum computing—to see a speedup we’ll have to exploit the magic of minus signs: interference,cancellations, change of basis, whatever term you want to use.How do wechange the basis to one that reveals the period, and moreover do so efficiently?
In the next lecture we’ll see how to do just that, using the Quantum Fourier
Transform!
|ψi =Lecture 20:
form

Quantum Fourier Trans-

In the previous lecture we started in on Shor’s algorithm, a quantum algorithm
that can factor N into its prime factors p and q in polynomial time by reducing
the problem to period-finding. Now we’ll see how to solve period-finding in
polynomial time. Before we do, though, let’s address a conceptual question:
Is Shor’s algorithm provably faster than any classical algorithm for the sametask?
If by “Shor’s algorithm,” we mean the period-finding core of the algorithm,
then the answer is yes. If, on the other hand, we think of Shor’s algorithm asa way to factor integers, then the speedup remains conjectural. Indeed it has
to be, because no one has even proven that P 6= NP—and if P = NP, then ofcourse factoring is classically easy. The way to reconcile these two statements
is simply to observe that there are many ways to factor a number besides byreducing factoring to period-finding. In fact, the best known classical factoringalgorithms—the Quadratic Field Sieve and Number Field Sieve mentioned in
the last lecture—do much better than the naı̈ve classical birthday attack by
exploiting additional structure in the factoring problem. The most we cancurrently prove is that Shor’s algorithm achieves an exponential speedup overany classical factoring algorithm that works via the last lecture’s reduction toperiod-finding.

20.1

Quantum Fourier Transform

We left off last time with our quantum state in the form
|ψi =|ri + |r + si + |r + 2si + · · · + |r + (L − 1)si√L

Now we’ll see how to measure this state to extract useful information about
159

160

LECTURE 20. QUANTUM FOURIER TRANSFORM

the period s. In science and engineering, any time you have a periodic signal
and you’re trying to extract its period there’s an essential tool used called theFourier Transform. There are many types of Fourier transforms: continuous, Boolean, etc. For us, though, the Q-dimensional Quantum Fourier
Transform or QFT will be the Q × Q matrix FQ defined as follows:ω ij(20.1)(FQ )i,j = hi|FQ |ji = √Qwhere ω = e2πi/Q is a Qth root of unity. Here’s some useful intuition for how
the Fourier transform works. In graduate school you can easily fall into a 26hour-per-day cycle. So, one day you wake up at 8am, the next day you wakeup at 10am, then 12pm, and so forth so that if nothing interrupts you, you
cycle all the way around. Suppose you’ve fallen into such a cycle and you wantto figure out how long the cycle is without doing any complicated calculations
like subtraction.
What you can do is install a series of clocks in your room, each tracking“days” of different lengths. So, you’d have a 23-hour clock, a 24-hour clock, a25-hour clock, etc. . . In addition, you install a bulletin board below each clock
and place a single thumbtack in its center. Now, every time you wake up you
go to each clock and move the thumbtack one inch in the direction the hour
hand points.
What will happen if you keep doing this, week after week? If you’re reallykeeping 26-hour days, then the thumbtack corresponding to the 26-hour clock
will always move in the same direction. This is constructive interference!
And the same is true for the 13-hour clock (as well as the 1-hour and 2-hourclocks). All the others—the 23-hour clock, the 24-hour clock, etc.—will havethe thumbtack move around, sometimes one direction, sometimes another, sothat it eventually returns to the origin.
The Quantum Fourier Transform is essentially this, but with quantummechanical amplitudes instead of thumbtacks.
There are two questions we need to answer here:
I How do we implement the Quantum Fourier Transform using a small

quantum circuit?
– Since it’s a Q × Q matrix, it’s not obvious whether we can do it
using a circuit with only polylog(Q) gates.
I Once we’ve applied the QFT and measured, how do we make sense of theoutcome?
– Complications can arise because in all likelihood, the period s won’t
evenly divide Q.

20.1. QUANTUM FOURIER TRANSFORM

161

Figure 20.1: A series of clocks, each corresponding to “days” of different
lengths. A thumbtack below the clock is shifted in the direction of the hour
hand each morning upon waking up. Only the thumbtack corresponding to
the correct length “day”—as well as “days” whose length divides the correct
day length—will cause the thumbtack to move in the same direction each time.
This is an example of constructive interference.

162

20.1.1LECTURE 20. QUANTUM FOURIER TRANSFORM

Implementing the QFT

To figure out how to implement the QFT, let’s look at some examples of QFT
matrices for a few different sizes.




1 1 1
1 ω0 ω0
F2 = H = √0
1 =2 1 −12 ω ω(20.2)
1 1 1 11 1 1 1
1 1
1
1
1
2
3



1 1 ω 1 ω 2 ω 3 
 = 1 1 ω 2 ω 0 ω 2  = 1 1 i −1 −i 
F4 = 
2
4
6
2 1 ω ω ω  2 1 ω ω ω  2 1 −1 1 −1
1 ω3 ω6 ω9
1 ω3 ω2 ω1
1 −i −1 i(20.3)

1
1

1

1 
1
F8 = √ 
2 2 1
1

1
1

1
ω1
ω2
ω3
ω4
ω5
ω6
ω7

1
ω2
ω4
ω6
1
ω2
ω4
ω6

1
ω3
ω6
ω1
ω4
ω7
ω2
ω5

1
ω4
1
ω4
1
ω4
1
ω4

1
ω5
ω2
ω7
ω4
ω
ω6
ω3

1
ω6
ω4
ω2
1
ω6
ω4
ω2


1
ω7

ω6

ω5

ω4

ω3

ω2
ω1

(20.4)As in Equation 20.1, the ω’s in the examples above are Qth roots of unity
where Q is the dimension of the matrix. We could design an algorithm toapply these matrices by brute force, but there’s a better way. This method isrelated to one of the most widely used classical algorithms, the Fast Fourier
Transform or FFT.
Suppose we have a vector of length Q, and we want to apply a Q×Q matrix
A to it. In general this requires us to do the full matrix-vector multiplication
which takes ∼ Q2 . However, if we know that A is the Fourier transform, thenthe FFT lets us apply it in only O(Q log(Q)) steps, by exploiting regularities
in the Fourier matrix.
What regularity is there in the Fourier matrix? Look at F4 . If we swap
the second and third columns, we get:




1 1
1
1
1 1
1
1



1
1 i −1 −i  → 1 1 −1 i −i 2 1 −1 1 −1
2 1 1 −1 −1
1 −i −1 i
1 −1 −i i20.1. QUANTUM FOURIER TRANSFORM

163

Notice how the matrix can be broken up into 4 blocks, each either equal to H
or related to H by the application of a diagonal matrix. In fact if we define
the matrix B as


1 0
B=
0 i


(20.5)

then we can rewrite the transformed F4 matrix above as
1 H BH√2 H −BH(20.6)

You can do a similar procedure for F8 , moving all the odd columns to theleft and the even columns to the right. Simplifying the ω’s, we get

1
1

1

1 
1
√ 

2 2 1
1

1
1

1
i
−1
−i
1
i
−1
−i

1
−1
1
−1
1
−1
1
−1

1
−i
−1
i
1
−i
−1
i

1
ω
i
ω3
−1
ω5
−i
ω7

1
ω3
−i
ω
−1
ω7
i
ω5

1
ω5
i
ω7
−1
ω
−i
ω3


1
ω7 

−i 

ω5 

−1

ω3 

i 
ω

Which we can rewrite as
1 F4 BF4√
2 F4 −BF4(20.7)

where the matrix B is now given by

1
0
B=
0
0


0 0 0
ω 0 0
.
0 ω2 0 
0 0 ω3(20.8)

You can work out why it happens on your own, but it turns out that we
can define FQ in terms of this nesting recurrence:
1 FQ/2 BQ/2 FQ/2
FQ = √,
2 FQ/2 −BQ/2 FQ/2

(20.9)

164

LECTURE 20. QUANTUM FOURIER TRANSFORM

where we’ve now defined the generalization of the diagonal B matrix above,
BQ/2 , as (omitting the zeros on the off-diagonal)


1
 ω



2


ω
(20.10)

.


...


Q

ω 2 −1

If we let C(FQ ) be the number of steps needed to apply FQ , we get therecurrence relation
C(FQ ) ≤ 2C(FQ/2 ) + O(Q),(20.11)for which the solutions is C(FQ ) = O(Q log(Q)).
In the quantum case, we’re actually interested in the unitary transformation |ψi → FQ |ψi, where |ψi is a quantum state of log2 (Q) qubits. In one
sense, our new goal is less ambitious since we don’t need the result vector
written explicitly in memory anywhere; it only needs to be encoded implicitly
in a vector of amplitudes. In another sense, though, our new goal is more
ambitious, since we now want to apply a Fourier transform in time polynomial
in only log (Q).
So how do we do it? We can use the same recursion that we used for the
FFT, plus the additional observation that the recursion behaves “linearly”
with respect to quantum states. Let’s think of our log(Q) qubits as representing an integer from 0 to Q−1 in binary notation and let’s order the bits of that
integer from most to least significant. But let’s also reorder the bits, so thatthe one that was previously the least significant is now the most significant(the analogue of reordering the columns in our recursion for FQ ). Then we cantry applying the circuit FQ/2 to the “first half” of the number. In other words,
we apply FQ/2 to all but the (now) most significant bit. This corresponds toapplying the matrix (in block notation)


FQ/2
0
FQ/2 ⊗ I2 =(20.12)0
FQ/2
To get a B in the bottom right quadrant, we can apply a controlled-B gateusing the most significant bit as the control. A controlled-B gate can be
written in the form


I 0
.
(20.13)0 B

20.1. QUANTUM FOURIER TRANSFORM
So after we apply the controlled-B gate, we have


 

I 0 FQ/2
0
FQ/2
0
=
.
0 B
0
FQ/2
0
BFQ/2

165

(20.14)

We can implement B using a linear number of gates, because it simply
amounts to the following:
I If the most significant bit is 1, then do a rotation by some angle θ
I If the second bit is 1, then do a rotation that’s half as big
I If the third bit is 1, then do a rotation that’s a quarter as big
I etc. . .

By the time you reach the last couple of bits, the rotation is exponentiallysmall.
When they first learn about Shor’s algorithm, some people
object that it’s “unphysical,” since there’s no practical way
to apply such tiny rotations. But it turns out that the exponentially small rotations don’t matter for the algorithm—
indeed, there’s a theorem that says that you can just omit
these tiny rotations. Doing so even improves the size ofthe quantum circuit that implements FQ , from O(log2 (Q))
to O(log(Q)loglog(Q)).
The final step to get the matrix we want is a Hadamard gate applied tothe most significant bit,
1 IQ/2 IQ/2,
(20.15)H ⊗ IQ/2 = √2 IQ/2 −IQ/2
which results in the final matrix


 

1 I I
FQ/2
0
FQ/2 BFQ/2√=.
0
BFQ/2 =
FQ/2 −BFQ/2
2 I −I(20.16)

Figure 20.2 contains the finished quantum circuit.

20.1.2

Period Finding Using the QFT

Now that we’ve seen how to implement the Quantum Fourier Transform as
a quantum circuit, it’s time to answer our second question. What comes out
when we measure and how can we use it to learn s?

166

LECTURE 20. QUANTUM FOURIER TRANSFORM
×

Most-Significant Bit

×
×

..
.

..
.

FQ/2

A

×
×
Least-Significant Bit

×| {z }
Reorder Qubits

H

Figure 20.2: Complete circuit for recursively implementing the Quantum
Fourier Transform.
Recall from the previous lecture that after we compute f (r) and then measure the second register, we have a quantum state of the form
|ψi =|ri + |r + si + |r + 2si + · · · + |r + (L − 1)si√L

(20.17)After we apply FQ , as described in Equation 20.1, the above state is transformed to
Q−1 L−1

1 X X (r+ls)k
√
ω
|ki .
QL k=0 l=0(20.18)What’s going on with the above state? Let’s start with an easy specialcase, and only later handle the general case. The easy case is that s divides
Q. Assuming that s divides Q, let’s answer the question: which k’s can beobserved, when we measure the above state in the computational basis?
What we want to know is, for a given k, do the various contributions to k’s
amplitude interfere constructively or destructively? To answer this question
we can ignore the global phase ω rk and just look at the sum
L−1
X

ω ksl

l=0

The key is to identify whether ks is a multiple of Q. If ks is not a multipleof Q then we have destructive interference because the terms ω ks , ω 2ks , ω 3ks ,20.1. QUANTUM FOURIER TRANSFORM

167

etc. . . are all pointing in different directions in the complex plane and they
cancel each other out.
Just like the thumbtack’s movement coming back to the origin.
If ks is a multiple of Q, or equivalently, if k = c Qs for some integer c, then we
have constructive interference. Since ω was a Qth root of unity the terms ω ks ,
ω ks2 , ω 3ks , etc. . . all point in the same direction in the complex plane.
If we repeat the algorithm several times then we’ll generate a list of suchk’s, each of which is an integer multiple of Qs . Afterwards, one can show that
we just need to take their GCD to get Qs itself (with overwhelming probability),
from which we can compute s, given our knowledge of Q.
Remember: This is only possible because we assumed thats divides Q.
The harder, general case is that s doesn’t divide Q. In this case, if we calculate the final amplitude for a specific basis state k, then ignoringP
the global
ksl
kr.
phase ω and the normalization, we’ll still get a sum of the form L−1
l=0 ωSo, how likely we are to observe k will still depend on whether this sum constructively or destructively interferes. What changes is that now Q/s isn’t an
integer, and as a result, neither the constructive nor the destructive interference will be perfect. But we’ll see that they’re still good enough for the periods to be efficiently recovered.
If k 6= bc Qs e then we’ll claim that we see mostly destructive interference.
We claim that if k is close to an integer multiple of Qs , then we mostly see
constructive interference. If k is far from any integer multiple of Qs , then we’ll
see mostly destructive interference.
Let’s look at the constructive case first. Assume we get a bit lucky and we1have (say) k = c Qs + where || ∼ 10
. That means that, ignoring normalization,
the final amplitude of basis state k has the form
L−1
X
l=0

ω

(c Q
+)sl
s

=

L−1
X

ω cQl ω sl .

(20.19)l=0

We can drop the ω cQl because ω cQl = e(2πi/Q)(cQl) = e2πicl = 1. We’re thenleft with justs the ω sl part. For the sake of clarity we can rewrite this term asP
L−1 (2πi) Q l. Recall now that L ∼ Qs . As such, the sum above corresponds
l=0 e
to a sum over complex numbers constrained to an  fraction of the unit circle,

168

LECTURE 20. QUANTUM FOURIER TRANSFORM

ranging roughly from 1 to e2πi . Assuming  is relatively small, this means thecomplex numbers all point in close to the same direction and so we mostly
have constructive interference. This situation is illustrated in Figure 20.3.

Figure 20.3: Sum over complex numbers constrained to an  fraction of theunit circle. So long as  is relatively small we still have mostly constructive
interference.
Next suppose k isn’t close to an integer multiple of Qs . In that case, as wevary l, the term ω ksl will loop all the way around the unit circle one or moretimes. As such, we’ll get mostly destructive interference except for a small
amount of constructive interference from the final rotation. If you plot the
final amplitude as a function of k, you get something like the graph in Figure
20.4.

Figure 20.4: Sketch of the magnitude of amplitudes in our post-QFT quantum
state Shor’s algorithm when s does not divide Q.

Lecture 21: Continued Fractions
and Shor’s Algorithm Wrap-Up
In this lecture we’ll finish Shor’s algorithm and then discuss some of its implications. Last we saw our protagonists, they were in a superposition of the
form
|ψi =

|ri + |r + si + |r + 2si + · · · + |r + (L − 1)si√Land we were trying to use the Quantum Fourier Transform (QFT) to extract
the period s. Our first order of business was to give a polynomial-size quantum
circuit to implement the QFT. Our second order of business was to understandwhat we observe after we apply the QFT and then measure in the computational basis. Recall that there were two cases:
I If s divides Q then each possible measurement outcome has either per-fectly constructive or perfectly destructive interference. The outcomeswith constructive interference are all integer multiples of Qs . From a few
random outcomes it’s easy to recover s itself, given our knowledge of Q.
I If s doesn’t divide Q then the pattern of constructive and destructive

interference is no longer perfect, but has some noise to it. That’s because
c Qs is no longer generally an integer, but the algorithm’s output stillneeds to be an integer. So we effectively get a rounding effect, where thenearest integers to c Qs have the strongest constructive interference.
We’ve addressed the first case, so we’ll now focus on the second case. Say werun the algorithm once getting an integer k1 = bc1 Qs e and then run it again to
get k2 , k3 , etc. The question is then, given these integers almost all of which
are close to integer multiples of Qs , how do we use them to deduce s itself ?
169

170

LECTURE 21. CONTINUED FRACTIONS AND SHOR WRAP-UP

21.1

Continued Fraction Algorithm

This brings us to the final step of Shor’s algorithm, which is another piece ofclassical number theory called the Continued Fraction Algorithm. Whenever an outcome k is observed, we’d like to determine whether it’s close to
an integer multiple of Qs and if so what the multiple is; this is where we use
continued fractions. Continued fractions are those expressions like
√
1+ 5
1
.
=φ=
1+
1
2
1 + 1+···How do continued fractions help us approximate rational numbers? It’seasiest to illustrate with an example, so let’s look at the continued fraction
expansion of an approximation of π, 3.14.
3.14 = 3 +141
1= 3 + 100 = 3 +
2 = ···
100
7 + 14
14

The idea is that we keep pulling out the largest integer we can and rewriting
our expression until we have an approximation of Qs to within an accuracy of
about Q12 . The reason why the method works is that s is a relatively small
integer, so Qs is not only rational but has a relatively small denominator. In
more detail, let’s write
k=c

Q
±
s

(21.1)

where  is some small value. Then we divide the above equation through by
Q to get
c

k
= ±
Q
s Q

(21.2)

This immediately implies the following inequality
k
c

− ≤
Q s
Q

(21.3)

We’ll exploit the key inequality above, along with the following:
I We know l.
I We know Q (because we picked it, it’some power of 2 of order N 2 ).

21.1. CONTINUED FRACTION ALGORITHM

171

I We know that s isn’t too large.

s ≤ N because the order of the multiplicative groupis less than N , and the order of any element in thegroup is at most the number of elements.
So Qk isn’t just close to any rational number sc , it’s close to a rational
number with a pretty small denominator, and that doesn’t happen by random
chance. This is the reason why we set Q to be ∼ N 2 in the first place; doing
so ensures that the rational approximation sc to Qk is more-or-less unique andmoreover that there’s an efficient algorithm to find it.
There’s math that backs this up, we’re just not covering it
here.
Suppose I give you a rational number, say 0.25001, and I tell you that it’sclose to a rational number with an unusually small denominator. How could
you figure out which such rational number it’s close to without having to try
all possible small denominators, of which there might still be too many? In
this particular example you just stare at the thing and immediately see that1is the answer! OK, but what would be a more systematic way of doing it?
4
A more systematic way is to expand the input number as a continued
fraction until the leftover part is so small that we can safely discard it. To
illustrate:.25001 =

1
25001
1
1
1
= 100000 ==24997 =
1
1000003 + 25001
3 + 25001
3 + 1+ 1 4
25001
24997

24997

4
Now we’ve reached 24997, a number small enough for us to discard, which leaves
us with1
3 + 1+

1
4
24997

≈

1
1
1 =
4
3+ 1

So now we have a way to find sc . Are we done? Well, we still have the samedifficulty that we encountered in the s divides Q case. Namely that k and s
might share a nontrivial divisor. If, for example, k and s were even, then we’dc/2
have no possible way to tell sc apart from s/2. We solve this using exactly thesame approach as before. We repeat the algorithm several times to generate

172

LECTURE 21. CONTINUED FRACTIONS AND SHOR WRAP-UP

c1 c2 c3
, , , etc. . . One can then show that the least common multiple of the si ’s
s1 s2 s3

will be s itself, with high probability.

Today, half of pop-science articles still say that “quantum
computers would factor numbers by trying all the possible
divisors in parallel.” If you’ve taken anything away fromour discussion of how Shor’s algorithm works, I hope you
now agree that it’s more subtle than that! In the next lecture, we’ll see how a quantum speedup for “pure, brute-force
search” does exist, but it’s not exponential, but “merely”
quadratic.

21.2

Applications of Shor’s Algorithm

The ink wasn’t dry on Shor’s paper before people started asking: what elsemight Shor’s algorithm be good for, besides factoring?
For starters, as we mentioned a couple lectures ago and as Shor showed in
his original paper, it also gives exponential speedup for Discrete Log, whichis the following problem:. given a prime p, and integers g and a, find an x suchthat g x = a mod p. This is how Shor’s algorithm breaks the Diffie-Hellman
cryptosystem.
It was noted shortly afterward that Shor’s algorithm can also be modified
to break Elliptic Curve cryptosystems. Indeed, people quickly figured out that
Shor’s algorithm can be modified to solve pretty much any problem related
to finding hidden structures in abelian groups. Almost all the public-key
cryptosystems that we currently use in practice involve finding such hidden
structures.
In the years after Shor’s algorithm, a lot of research in quantum algorithms
was directed towards answering the question of to what extent can we generalize
Shor’s algorithm to solve problems about non-abelian groups? By now, though,many people have given up on this research direction. It turns out that finding
hidden structures in non-abelian groups is very, very hard.
Why did people care about non-abelian groups? Well, if Shor’s algorithm
could be generalized to handle them, there are two famous problems thatwould help us solve.

21.2. APPLICATIONS OF SHOR’S ALGORITHM

21.2.1

173

Graph Isomorphism

In the Graph Isomorphism problem, we’re given two undirected graphs
and need to decide whether they’re isomorphic—that is, whether there’s somepermutation of vertex labels such that the two graphs have the same edges.
Graph isomorphism is a problem that no one yet knows how to solve in polynomial time, but that famously seems to have “too much structure” to be
NP-complete. In the early 1970s when Leonid Levin co-discovered the theory of NP-completeness legend has it that he sat on his discovery for morethan a year because he was trying to show that Graph Isomorphism is NPcomplete—something that we now believe is impossible.
People quickly realized that if you could generalize Simon’s and Shor’s algorithms to a situation where the underlying group is the symmetric group Sn ,instead of an abelian group like Zn2 or Z×
N , then it would be possible to solve
Graph Isomorphism in quantum polynomial time. In 2016, though, Babai(who’s been studying Graph Isomorphism for forty-plus years) found a classical algorithm to solve Graph Isomorphism in quasipolynomial time, meaningO(npolylog(n) ). Many people suspect that Graph Isomorphism is in P, for one
thing because the problem is easy in practice almost all of the time. In any
case, since we now know that Graph Isomorphism is at worst quasipolynomialclassically, there’s no longer any possibility of getting an exponential quantum
speedup for the problem.

21.2.2

Lattice-Based Cryptography

There’s a type of public-key cryptography called Lattice-Based Cryptography, which is becoming increasingly important theoretically and even practically, and which we don’t know how to break (yet) even with a quantum computer. Given a collection {z0 , · · · , zn−1 } of vectors in Rn , the lattice spannedby the collection is the set of all integer linear combinations of the vectors:
L = {a0 z0 + · · · + an−1 zn−1 |a1 , · · · an−1 ∈ Z}

(21.4)A typical problem relevant to lattice-based cryptography would be, forexample: given {z0 , ..., zn−1√ }, find the shortest nonzero vector in L—or at least,a vector that’s within a n factor of being the shortest. It turns out that you
can create entire public-key cryptosystems around these sorts of problems.
There was an important result by Oded Regev in 2005 which says that
we could break lattice-based cryptography if we could generalize Shor’s algorithm to work for a nonabelian group called the dihedral group. Needlessto say (because otherwise I would’ve told you!), no one has yet succeeded in

174

LECTURE 21. CONTINUED FRACTIONS AND SHOR WRAP-UP

doing so. So, lattice-based cryptography is currently an attractive alternative to RSA and Diffie-Hellman for those who are paranoid about quantum
computers. But it’s also attractive for other reasons, including the prospect of
Fully Homomorphic Encryption: the ability to do arbitrary computations
on encrypted data without ever decrypting it. This would let people submit
their data to cloud computing servers and then get back the results without
the cloud server ever learning what computation it did. In 2009 Craig Gentry
proposed the first fully homomorphic encryption scheme using lattice-based
crypto; since then other schemes have been proposed. Again, these are notencryption schemes that we know how to break even using a quantum computer. There’s still a practical problem with these schemes: the key sizes,
message sizes, and computation times tend to be large. But the schemes havebeen steadily improving, and many of them are now either practical or nearing
practicality.

Lecture 22:

Grover’s Algorithm

The next quantum algorithm we’ll cover is Grover’s Algorithm which was
discovered in 1995 shortly after Shor’s algorithm.
Both Grover and Shor were working at Bell Labs at thetime.
Grover’s algorithm gives a smaller speedup than Shor’s (quadratic rather
than exponential), but for a much wider range of problems. Just like with theother quantum algorithms we’ve seen, it’s easiest to think of Grover’s algorithm
in the black box setting. Given an oracle function f : {0, · · · , N − 1} → {0, 1}
we’d like to answer two questions:
I Is there an x such that f (x) = 1?
I If so, what is such an x?

The basic problem that Grover’s algorithm addresses is unordered search,that is looking through an unstructured list of bits for a 1 bit. Classically
we’d need a linear number of queries, Ω(N ), to solve this problem deterministically. Why? Simply, because if we want to know for certain whether there’s
a treasure hidden in one of N boxes, then even after opening N –1 boxes andfinding them empty we still need to open the N th box! Even if we only careabout how long it takes on average, and we know a treasure is guaranteed
to be in some box, finding it takes still takes ∼ N2 queries, which is linear inN . √Grover’s algorithm solves both problems, with high probability, using only
O( N ) quantum queries to the function f .
This might sound impossible—but, as we’ll see, it’s quite
similar to how the Elitzur-Vaidman bomb worked.
The number of qubits needed to run Grover’s algorithm is very low, O(log (N )),and the number of gates required (besides those needed to compute f itself)
175

176

LECTURE 22. GROVER’S ALGORITHM√
is also reasonable, O( N log (N )). However, for Grover’s algorithm to work
we do need to assume that we have access to f that lets us apply the unitary transformation |x, ai → |x, a ⊕ f (x)i. This wasn’t important in Shor’s
Algorithm because we only made one query and then discarded the result.
There are two main example applications to keep in mind with Grover’s
algorithm. The first application is solving combinatorial search and optimization problems, such as NP-complete problems. Here, we think of N = 2n as
being exponentially large, and we think of each candidate solution x ∈ {0, 1}nas an n-bit string. We then set, for example, f (x) = ϕ(x), where ϕ is an
instance of Satisfiability or some other NP-complete problem. Then, Grover’s
algorithm can find an x such that ϕ(x) = 1 in O(2n/2 )poly(n)) time. Thatis, N = 2n/2 queries to f , and poly(n) time to implement each query (say,by checking whether a given x satisfies ϕ). This is an apparent speedup for
NP-complete problems—but at most a quadratic one and also only conjectural, because of course we can’t even rule out the possibility of P=NP, which
would annihilate this sort of speedup.
For an NP-complete problem like CircuitSAT, we can be pretty confident
that the Grover speedup is real, because no one has found any classical algorithm that’s even slightly better than brute force. On the other hand, for more“structured” NP-complete problems, we do know exponential-time algorithms
that are faster than brute force. For example, 3SAT is solvable classically inabout O(1.3n ) time. So then, the question becomes a subtle one of whether
Grover’s algorithm can be combined with the best classical tricks that we know
to achieve a polynomial speedup even compared to a classical algorithm thatuses the same tricks. For many NP-complete problems the answer seems tobe yes, but it need not be yes for all of them.
The second example application of Grover’s algorithm to keep in mind issearching an actual physical database. Say you have a database of personnel
records and you want to find a person who matches various conditions (haircolor, hometown, etc.). You can set f (x) = 1 if person x meets the criteria andf (x) =
√ 0 otherwise. Grover’s algorithm can search for an x such that f (x) = 1
in O( N ) steps. One big advantage of Grover’s algorithm as applied to actual
physical databases is that the quantum speedup is provable; it doesn’t rely on
any unproved computational hardness assumptions.
Some people have questioned the practicality of using Grover’s algorithm tosearch a physical database, because the database needs to support “superposed
queries.” That is, you need to be able to query many records in superposition
and get back a superposition of answers. A memory that would support thesekinds of queries is called a “quantum RAM.” Building one is a whole additional
technological problem beyond building a quantum computer itself. It remains

22.1. THE ALGORITHM

177

unclear whether people will be able to build quantum RAMs without n active,
parallel computing elements—which, if you had them, would remove the needto run Grover’s algorithm.
In this lecture, though, we’ll treat such things as “mereengineering difficulties”!

22.1

The Algorithm

OK, so without further ado, how does Grover’s algorithm work? For simplicity,
let’s assume that a solution exists and is unique. We call the unique x∗ suchthat f (x∗ ) = 1 the “marked item”. We’ll also assume for simplicity thatN = 2n is a power of 2. This will allow us to do our favorite trick: start by
Hadamarding n qubits. Doing so brings the initially all-0 state to a uniform
superposition
N −1

1 X
√
|xi ,
N x=0

(22.1)

where each x ∈ {0, . . . , N −1} is represented as an n-bit string. Then we querywith Uf , a unitary transformation that flips the amplitude of the marked item:
Uf |xi = (−1)f (x) |xi .

(22.2)

As we’ve already seen in this course, if we can apply |x, ai →|x, a ⊕ f (x)i, then we can also apply the phase oracle |xi →(−1)f (x) |xi. Phase oracles are more convenient for the
purposes of Grover’s algorithm.
Next, we apply a unitary matrix D below.
2
N



D=


−1
2
N

..
.

2
N

2
N

···
2
− 1 ···
N
...
···

2
N
2
N





.. 
. 
2
−1
N

(22.3)

This is the so-called Grover Diffusion Operator, which has the effect of

178

LECTURE 22. GROVER’S ALGORITHM

flipping all N amplitudes about the mean amplitude ᾱ = N1
αx → 2ᾱ − αx .

PN −1

x=0 αx ,(22.4)

So why does applying D help us? Well, let’s look at what’s happening after
a single Grover iteration of applying Uf and D pictorially, using the depiction
shown in Figures 22.1–22.4. After a single diffusion operation, we’ve managed
to increase the amplitude of the marked item to roughly √3N and decrease theamplitudes of all the other items accordingly.
Then, we keep repeating by applying another Uf and then another D and
so on. By doing so, we can increase the amplitude of the marked item further
as pictured in Figures 22.5–22.7.

Figure 22.1: The initial amplitudesof the system, an even superposition state.

Figure 22.2: The amplitudes following the first application of thephase oracle. Note that the amplitude of the marked item has had its
sign flipped.

Figure 22.3: The average amplitude ᾱ has been explicitly drawn
in.

Figure 22.4: The amplitudes following the first Grover diffusion operator.

22.1. THE ALGORITHM

Figure 22.5: Amplitudes following
the second application of the phaseoracle. Note that the amplitude of
the marked item has had its sign
flipped again.

179

Figure 22.6: Amplitudes following
the second application of the phaseoracle with the new average amplitude ᾱ explicitly drawn in.

Figure 22.7: Amplitudes following
the second Grover diffusion operator.

180

LECTURE 22. GROVER’S ALGORITHM

As an approximation, we can say that when the number of queries is small,the repetition increases the marked item’s amplitude as √1N , √3N , √5N , √7N . . .
√√Notice that it would take O( N ) steps for this series to reach √N= 1. ThisN
represents a quadratic speedup: classically, we’d need about N queries tofind the answer, since after t queries we’d have a probability of Nt of having
found the marked item. Meanwhile, if we measure after t queries in Grover’s
2
algorithm we find the marked item with probability of order ∼ ( √2tN )2 = 4tN .
This picture isn’t exactly right, though, because we ignored some details. Over
time the mean gets smaller, so the increase in the marked item’s amplitude
slows down.
Which makes sense, because otherwise the amplitude would
continue increasing past 1! We’ll see exactly what happens
shortly.
First, though,to ask about Grover’s algorithm is why√ a natural question√
3
should it take N steps? Why not N or log N ? We see here that in somesense the ultimate source of the N is the fact that amplitudes are the squareroots of probabilities. Instead of adding ∼ N1 probability to the marked itemwith each query, quantum mechanics lets us add ∼ √1N amplitude, resulting
in quadratically faster convergence. This intuition will be made more rigorousin the next lecture when we learn about the BBBV Theorem.

22.1.1

Implementing the Diffusion Operator

Of course, if we want to use Grover’s algorithm
in practice, then in addition√
to bounding the number of queries by O( N ), we’ll also need to find a small
quantum circuit to implement the Grover diffusion operator D. Say we want
to implement D on an n-qubit state (N = 2n ). It’s easiest if we look at what
D does in the Hadamard basis. In the Hadamard basis, the y th amplitude
would beN −1

1 X(−1)y·x αx .
βy = √
N x=0(22.5)P −1
The first of these amplitudes plays a special role. If y = 0 we have √1N N
x=0 αxwhich is proportional to the average, which is good because our goal was toinvert about the average. The other y values play no particular role in Grover’s
algorithm.

22.1. THE ALGORITHM

181

So, in the Hadamard basis what we want is to perform the diagonal matrix
A,

1
 −1

A=
...





.

−1

(22.6)

This A is easy to implement as a quantum circuit by using some ancilla qubits
to check whether the input is all 0’s, inverting the phase if not, and finally uncomputing garbage (the details of this implementation are left as an exercise).
In order to implement D we therefore:
1. Move to the Hadamard basis using a round of Hadamard gates applied
to each of the qubits.
2. Apply A.
3. Move back to the computational basis by applying another round of
Hadamards.
The final circuit for implementing Grover’s algorithm is shown in Figure
22.8.
|0i

|0i

H
..
.
H

Uf

H
..
.
H

A

H
..
.
H

Diffusion Operator

Uf

H
..
.
H

A

H
..
.

···

H

···

Diffusion Operator

Figure 22.8: Complete circuit for running Grover’s algorithm.

22.1.2

Geometric Interpretation

We described above how the Grover diffusion operator D in Equation 22.3 has
the effect of flipping all of the amplitudes about the mean. It will be useful todescribe a different way to think about the Grover diffusion operator’s effect.

182

LECTURE 22. GROVER’S ALGORITHM

The first thing to note is that we can write the unitary operation A in Equation
22.6 as



A=




1
−1



 = 2 |0i h0| − I.
..

.
−1

(22.7)

When applied to a general state,|ψi = α0 |0i + α1 |1i + · · · + αN −1 |N − 1i ,this produces
A |ψi = −α0 |0i + α1 |1i · · · αN −1 |N − 1i .
In other words, the A matrix flips the sign of all of the amplitudes except thatof the |0i state (equivalently you could say A flips the sign of α0 while leaving
the rest of the amplitudes alone). This has the effect of reflecting our state
about the |0i axis in the N -dimensional Hilbert space of the system.
Recall that D = H ⊗n AH ⊗n . Thus,
D = H ⊗n AH ⊗n= H ⊗n (2 |0i h0| − I)H ⊗n= 2H ⊗n |0i h0| H ⊗n − H ⊗n IH ⊗n
2 |φi hφ| − I,(22.8)

P −1
where |φi = √1N N
x=0 |xi is the uniform superposition state. Notice thesimilarity between the form of this operator and the form of A in Equation
22.7. Indeed, just as we saw that the result of applying A is a reflection of thestate about the |0i axis in N -dimensional Hilbert space, D reflects about the|φi axis.
Similarly, Uf corresponds to a reflection about the |x∗ i axis in N -dimensional
Hilbert space, where |x∗ i is the basis state corresponding to the marked item.

22.1.3

Analysis

Now let’s analyze Grover’s algorithm more carefully and actually prove that
it works.

22.1. THE ALGORITHM

183

The initial state of the system following the first round of Hadamards
shown in Figure 22.8 is
N −1

1 X
|xi .
|ψi = √
N x=0

(22.9)

Somewhere in the N -dimensional space is the basis state |x∗ i corresponding
to the marked item we’re looking for. Our initial state |ψi overlaps only veryslightly with the state of the marked item |x∗ i: hψ|x∗ i = √1N . So |ψi and|x∗ i are not quite orthogonal, but nearly so. Now, these two states |ψi and|x∗ i span a two-dimensional subspace of the overall N -dimensional Hilbert
space. A crucial insight about Grover’s algorithm is that it operates entirely
within this subspace. Why? Simply because if we start in the subspace thenneither the queries nor the Grover diffusion operations ever cause us to leave
it! This means that we can visualize everything Grover’s algorithm is doingby just drawing a picture in the 2D plane. The axes here are given by |x∗ i
and |unmarkedi, where |unmarkedi is an equal superposition state over all of
the unmarked items:
X
1
|xi .
|unmarkedi = √N − 1 x6=x∗(22.10)Note that |x∗ i and |unmarkedi are clearly orthogonal to each other. We’ve
seen already how the algorithm alternates between two types of operations:
I Inverting the component of our state that points in the |x∗ i direction by

querying Uf as shown in Figure 22.9.

Figure 22.9: Applying the oracle Uf t0 the initial state |ψi to get the newstate |ψ 0 i.

184

LECTURE 22. GROVER’S ALGORITHM

I Reflecting our state about |φi, the uniform superposition state, using

the diffusion operator D ,as shown in Figure 22.10:

Figure 22.10: Applying the Grover diffusion operator D to reflect |ψ 0 i about
the state |φi and get the new state |ψ 00 i.

Initially, the angle of |ψi with the horizontal is θ = arcsin ( √1N ) ≈ √1N .
After each iteration, we’ve rotated by an additional √2N . Hence, the probabilityof success after the tth iteration is given by
2t + 1∗
2
2√
P (success) = | hx |ψi | = sin.
(22.11)NThis means that we’ll get super close to|x∗ i and have a high probability of√observing x∗ if we measure after about π4 N iterations—something that you
can directly see from the geometric picture. We might not get exactly to 1 if
the step size of the rotations causes us to overshoot slightly, but at any rate
we’ll get close.
We can see right away that, unlike any classical algorithm, Grover’s algorithm has the amusing property that it’s success probability starts getting
worse if we run it for too long!
Grover’s algorithm has been compared to baking a soufflé.
Once risen it must be taken out of oven or it’ll deflateagain. On the other hand Grover’s algorithm has at least
one property not shared by soufflés. Namely, if you “leaveit in the oven” for even longer it rises a second time, thengoes down a second time and so on forever!
Graphing the success probability as a function of the number of iterations
produces a sinusoidal curve as seen in Figure 22.11. Grover’s algorithm can

22.1. THE ALGORITHM

185

Figure 22.11: Success probability of Grover’s algorithm as function of thenumber of iterations, assuming 1 marked item out of N .
also put you into an interesting dilemma: suppose
you’ve run the algorithm√π
for a given number of iterations, fewer than 4 N . Then you could measureright away and take your chances with whether you’ll observe the solution, or
you could let it run longer to boost your chances. If you measure right now
and don’t see the solution then you need to start over from the very beginning.
This could make for an interesting science-fiction story:
the heroes need to break a cryptographic code to beat thevillains, so they run Grover’s algorithm over all the possible
decryption keys. They’ve run it for a day and gotten up
to 45% probability of observing the solution, but now thevillains have entered their compound and are closing in on
them. So, do they measure now or do they let the algorithm
run a bit more?
√
Are you better off measuring after fewer than π4 N iterations? It depends
on your desired level of confidence in getting the right answer. If your goal
is just to minimize the average number of queries√ until you learn the answer,
then it turns out to be optimal to stop after c N iterations, for some c < π4(details left as an exercise).

22.1.4Multiple Marked Items

For simplicity, above we assumed exactly one marked item. What happens if
there are more? The simple answer is that the entire cycle happens faster. In
particular, if K items out of N are marked then the success probability for

186

LECTURE 22. GROVER’S ALGORITHM

qN
queries. This is straightforward to see in
Grover’s algorithm peaks at π4 K
the geometric picture. With K marked items, our two-dimensional subspace|x∗ i+···+|x∗ iis spanned by the uniform superposition |φi and |x∗ i = 1 √K k , an equalsuperposition over all K marked items. These have an inner productrK
hφ|x∗ i =.
(22.12)Nqq
K
Thus, our state initially starts with an angle of θ = arcsin( N ) ≈ K.
N∗
After each iteration the state rotates an additional 2θ toward the |x i axis,
meaning that after t iteration the success probability isr !
KP (success) = sin2 (2t + 1)
(22.13)Nq
πN
Hence, P (success) ≈ 1 after about T = 4 K
iterations.

Figure 22.12: Success probability of Grover’s algorithm as function of thenumber of iterations with more than one marked item. Each additional marked
item causes the success probability to oscillate with an increased frequency.
One of the first questions people asked about Grover’s algorithm was: what
if the number of marked items, K,isn’t known? You can sort of see the danger.
It’s possible to run Grover’s algorithm the right number of times to hit thepeak success probability when there’s a single marked item, but that mightovershoot and lead to success probability near 0 is there are more marked
items.
The most basic way to solve this problem is simply√ to run the algorithm fora random number of iterations, say between 0 and N . If we do this then mostof the time we expect to end up somewhere around the middle of a sinusoid(neither at a trough nor a peak), where we have a constant probability (say,
40% or 60%) of observing a solution if we measure. This is perfectly sufficient22.1. THE ALGORITHM

187

from an algorithmic standpoint, since it means that we only need to repeat thealgorithm O(1) times√ on average until we see a marked item. This gives us anupper bound of O( N ) queries to find a marked item with high probability,
regardless of how many marked items there are (assuming there’s at least one).
What happens if we run Grover’s algorithm, but the database turns out tohave no marked items? When we query f nothing happens. When we apply
the diffusion operator nothing happens. So, the state just remains a uniform
superposition over all N items for the entire duration of the algorithm. Thismeans that when we measure we just get a random item. We can check that
item and see that it isn’t marked.
How can we be certain that there are no marked items? This is the questionthat arises in the decision version of Grover’s algorithm. In fact, no matter how
many times we run Grover’s algorithm, we never become 100% sure that there
are no marked items since we could’ve just gotten unlucky and failed to find theitems every time. However, after O(1) repetitions, the algorithm has as a higha probability as we like (say, > 99.99%) of finding a marked item assumingthat there’s at least one of them. If, after we’ve run Grover’s algorithm asufficient number of times, we still haven’t found a marked item, then wecan√deduce that there almost certainly weren’t any. This again requires only
O( N ) queries.
We’ve√ said that if there are K marked items then we find one of themin O( N ) queries without knowing K.qIn fact we can do even better thanNthat and find a marked item in only O( K
) queries; again without knowing
K. This is the same performance as if we did know K, so how does thiswork? Assume for simplicity that N is a power of 2. First, we guess that
almost all items are marked, do a single query and then measure. If we finda marked item, great. If not, we guess that N2 items are marked and run
Grover’s algorithm with K = N2 . If we find a marked item, great. Next we run
Grover’s algorithm with K = N4 , then K = N8 and so on, repeatedly halving
our guess for the number of marked items until either we’ve found a marked
item or we’ve searched unsuccessfully with K = 1.
This method wastes some queries on “wrong” values of K. Crucially, because the number of queries is increasing exponentially, the number of wasted
queries is only a constant factor greater than the number of queries used in
the final iteration; the one that guesses an approximately correct value of K.
Details of the analysis are left as an exercise for the reader.
Let’s end by mentioning a different way to handle the case of multiple
marked items that achieves essentially the same performance using a purely
classical trick. Again suppose we have N items, K of which are marked. We

188

LECTURE 22. GROVER’S ALGORITHM

want to reduce this to the case of just a single marked item. How do we doNitems uniformly at random and then run Grover’s
that? Simple, we pick K
algorithm on that subset only. The number of marked items that we’ll catchin the subset is well approximated by a Poisson distribution, and one cancalculate the probability of catching exactly one marked item in our sampleN
items using Grover’s algorithm foras ∼ 1e . So, we search that subset of Kq
N
the single marked item case (which uses O( K
) queries). If we don’t find amarked item we can try again with a new random subset.
Exercise for the reader: Show that, if there are√ K marked items and wewant to find all of them, we can do that using O( N K) queries.

Lecture 23: The BBBV Theorem and Applications of Grover’s
Algorithm
23.1

The BBBV Theorem

It’s great that we can get a quadratic speedup with Grover’s algorithm, but
we were able to get an exponential speedup with Shor’s algorithm. So, why
can’t we get a bigger speedup for unordered search? By now you should havesome intuition for the differences between Shor’s algorithm and Grover’s algorithm. Shor’s algorithm provided an exponential speedup by orchestratinga very “global” phenomenon, involving an interference effect that revealed
the period of a black-box periodic function. Grover’s algorithm let us turna little amplitude into a bigger amplitude by adding ∼ √1N with each query.
It’s√faster than classical brute-force search, but still laborious (still needing
O( N ) time).
We’re still hand-waving the issue though. We haven’t ruled out the possibility ofa quantum algorithm that beats Grover, solving unordered search√3
in, say, N or log(N ) queries or whatever. For that we need a key result of
from 1994 called The BBBV Theorem. This theorem is named for Bennett, Bernstein, Brassard and Vazirani, and proved that Grover’s algorithm isindeed asymptotically optimal for the black-box unordered search problem.
Note that the BBBV Theorem was published in 1994, so it
actually predates Grover. Grover’s algorithm thus has therare distinction of being proved to be optimal before it was
discovered to exist.
Amusingly, BBBV were trying to prove that there’s no magic way to search
faster using a quantum computer. They were able to get a lower bound of
189

190

LECTURE 23. BBBV AND GROVER APPLICATIONS√Ω( N ), and figured that tightening the bound to Ω(N ) was a technical issue
that they could leave for the future—that is, until Grover came along andshowed why such a tightening is impossible!
While by now we know many proofs of the BBBV Theorem, the original(and still most self-contained) proof uses what’s called a Hybrid Argument.
Imagine we’re using an arbitrary quantum algorithm to search for a single
marked item in a list of size N . Without loss of generality we can say that thealgorithm makes a total of T queries and follows some sequence of operations
that looks like

U0 → Q0 → U1 → Q1 → U2 → Q2 → · · ·(23.1)

where each Qt is a query and each Ut is some unitary transformation (independent of the data in the list). We start by doing a test run of the algorithm
on the all-zero list (without a marked item) and see what happens. What we’llthen show if that if we change the value of some item in the list from 0 to 1 (inother words introduce a marked item), the algorithm won’t notice the changevery much. This is done by exploiting the fact that unitary transformations
are linear and norm-preserving. More concretely, we’ll show that the final
state of the algorithm is at most O( √TN ) away from what it would have been
had we kept the list all-zero. The argument is called “hybrid” because we’llcreate hybrid oracles which answer the first m queries as if they’re the all-zerooracle but then switch partway through, and for the last T − m queries answer
as they should for a list with a single 1 entry.
While we’ll only consider algorithms that apply unitarytransformations, exactly the same proof carries over to algorithms that have intermediate measurements—because we
can always model a measurement by a unitary transformation on a larger set of qubits, just like in the Many-Worlds
Interpretation.
We’ll let |ψt i denote the state immediately following the tth query. Let
x ∈ {0, . . . N − 1} denote and index of a queried list element and suppose
we allow the algorithm to use an unlimited number of ancillary qubits forworkspace, the state of which will be denoted w. In general, |ψt i can be
written as a superposition of the list elements x and the possible values of the23.1. THE BBBV THEOREM

191

workspace qubits w as follows:|ψt i =

N
−1 X
X
x=0

αx,w,t |x, wi .

(23.2)

w

Here αx,w,t is the amplitude of the basis state |x, wi following the tth iteration.
In Grover’s algorithm there’s hardly any workspace to speakof. We do use ancillary qubits to implement the diffusion operator, but those qubits are reset to their originalstate by the time the diffusion operator is finished. The
BBBV Theorem, to be fully general, will allow for unlimited√workspace, and still will show that the algorithm needs∼ N queries.
Before we move on it will be useful to introduce a new quantity called
the Query Magnitude. The query magnitude for some list element x ∈{0, 1, · · · , N − 1} is given byMx =T −1 XX
t=0|αx,w,t |2 .

(23.3)

w

Note that |αx,w,t |2 is the probability of finding the item x if we were to measure
after the tth iteration. The query magnitude Mx is therefore the sum over allof the probability that we would find item x if we measured at iteration t.
Rearranging, we find that the sum of all the query magnitudes is
N
−1 X
T X
X
x=0 t=1w

2|αx,w,t | =

T N
−1 X
X
X
t=1 x=02|αx,w,t | =w

TX

1 = T.

(23.4)

t=1

From this it immediately follows that the average query magnitude is
N −1

1 X
T
Mx = .
N x=0
N(23.5)

Furthermore, given any list of numbers there must be at least one numberin the list whose value is at most the average. Thus let’s fix some index
Tx∗ ∈ {0, . . . , N − 1} such that Mx∗ ≤ N.
This is sometimes referred to as the “Lake Wobegon Principle,” after the fictional town where everyone was above
average.

192

LECTURE 23. BBBV AND GROVER APPLICATIONS

Now that we’ve defined the query magnitude we can explain the hybrid argument.
Picture a table like the one to the right where
each row is our database at a particular point
in time, with time increasing upwards. Initially the table is filled with zeros, meaningthat the oracle answers all queries with zero.
Now we’re going to change the table foritem x∗ , the oracle returns 1 for the lastquery, and only for the last query. The modified table is given in Figure 23.1.
This means that the state of the algorithm after the final query |ψT i, isgoing to change from what it was before. Let the new state following the final
query be |ψT0 i, where the superscript denotes the fact that we’ve changed justthe final query to return f (x∗ ) = 1.

Figure 23.1: Modified table with the final query changed to return 1 for x∗ .

So how much can changing the result of the last query change the final
state? Before the final query, the states are identical: |ψt i = |ψt0 i for t < T .
The effect of the final query is to flip the phase of the amplitudes associated23.1. THE BBBV THEOREM

193

Figure 23.2: For the hybrid argument we repeat the process of swapping out
the all-zero oracle for more and more queries until we’ve replaced it with theoracle returning 1 for x∗ for every iteration of the algorithm.
with x∗ . In terms of Euclidean distance,|ψT i − |ψT0 i

=

N
−1 X
X
x=0

= 2

!
αx,w,T |x, wi

!
−

x6=x∗

w

X

XX

αx,w,T |x, wi −wX

αx∗ ,w,T |x∗ , wiw

αx∗ ,w,T |x∗ , wi

w

s
X
=2
|αx∗ ,w,T |2 .
w

(23.6)
Suppose now that the hybrid oracle returns 1 for x∗ on the last two queries.
How much will the output state differ from that in the all-zero case now? Weagain know that up to the second-to-last query the states are the same. The
distance between |ψT −1 i and |ψT0 −1 i is then (following the exact same process
as above)|ψT −1 i − |ψT0 −1 i= 2Xαx∗ ,w,T −1 |x∗ , wi

w

s
X
=2
|αx∗ ,w,T −1 |2(23.7)w

But we’re not done yet, because what about the final query? We’ll define thenew vectors |eT i = |ψT i − |ψT0 i and |eT −1 i = |ψT −1 i − |ψT0 −1 i. Rearranging,
we can rewrite |ψT0 i as |ψT i − |eT i and |ψT0 −1 i as |ψT −1 i − |eT −1 i. Then, by

194

LECTURE 23. BBBV AND GROVER APPLICATIONS

linearity, the final state is given by
QT UT |ψT0 −1 i = QT UT |ψT −1 i −QT UT |eT −1 i .
|{z}(23.8)0 i|ψT

The first term above is precisely the output state |ψT0 i that we had when wechanged only the final query to include the marked item. So we can rewrite
the above as
QT UT |ψT0 −1 i = |ψT i − |eT i − QT UT |eT −1 i(23.9)So letting |ψT00 i = QT UT |ψT0 −1 i, we have|ψT00 i − |ψT i=|eT i + QT UT |eT −1 i

≤

|eT i

+ QT UT |eT −1 i=≤ |eT i + |eT −1 issXX|αx∗ ,w,T |2 + 2|αx∗ ,w,T −1 |2=2w(23.10)w

Here the third line crucially used the fact that QT and UT are unitary.
It is straightforward to generalize this to replacing more and more of thequeries with ones that return f (x∗ ) = 1, as shown in Figure 23.2. Let’s(T )call the state corresponding to replacing the oracle for all T iterations |ψT i(where the superscript
denotes the numberPof times we’ve modified the oracle).
P
T
2
Let Mx,t =t=1 Mx,t , where Mx is the query
w |αx,w,t | , so that Mx =magnitude of x. Then(T )|ψT i − |ψT i

≤2

T
X
t=1

s
X

|αx∗ ,w,t|2 = 2TX
pMx∗ ,t .

(23.11)t=1w

Now recall that, using the “Lake Wobegon Principle,” we had
T.
(23.12)N
Subject to the above P
constraint,
the Cauchy-Schwarz inequality tells us thatpthe way to maximize Tt=1 Mx∗ ,t is to set Mx∗ ,1 = · · · = Mx∗ ,T = N1 . In that
case,
Mx∗ ≤

(T )

|ψT i − |ψT i = 2

T
X
p
2T
Mx∗ ,t ≤ √ .
N
t=1(23.13)

23.2. APPLICATIONS OF GROVER’S ALGORITHM

195

Finally, in order to achieve a Ω(1) probability of seeing the marked item
x when we measure the state at the end of the algorithm, we need the above
distance to be Ω(1) as well. Achieving this requires us to use at least T ∼√N iterations. With that we’ve proved the√BBBV theorem, that any blackbox quantum search algorithm requires Ω( N ) queries in order to achieve a
constant success probability of seeing the marked item.
∗

The BBBV theorem has since been enormously generalized
and now constitutes a whole theory about lower bounds on
quantum query complexity. Unfortunately we won’t reallyenter into that in this course, but see Prof. Aaronson’s
graduate course for more!

23.2

Applications of Grover’s Algorithm

23.2.1

OR of ANDs

We can apply Grover’s algorithm solve many,
many problems that are not quite as simple asunordered search. Our first example of this is
the OR of ANDs problem. Suppose we have N
input
bits arranged into a square table of size√√
N × N . The problem is to determine whether
there are there any rows with all 1s. Classically,
it’s clear that in the worst case you have to lookthrough almost the entire table, searching eachrow until you’ve found a 0, until you find a row
is all 1’s.
Such problems let us encode many other problems that involve multiple quantifiers. For example, in chess we may
want to know “Is there a move I can make such that my
opponent has no possible response that checkmates me?”Quantumly we could speed this up by searching each row for ap0 using√
Grover’s algorithm. The query complexity for each row would be ∼
N=
1/4
1/4
N , or technically N log(N ) if we repeat the Grover search on each row
enough times to have (say) a N1 probability of error. This means that searching√
the whole table would take ∼ N N 1/4 log(N ) = N 3/4 log(N ) queries.

196

LECTURE 23. BBBV AND GROVER APPLICATIONS

Alternatively, we could do Grover’s algorithm over all the rows, counting
each row as a “marked item” if and only if a classical algorithm (which we run
as an inner loop) finds no zero in that row. This also has an ∼ N 3/4 log(N )runtime.
Naturally the next idea is to run Grover’s algorithm recursively, where theouter Grover (over the rows) will count a given row as being marked if andonly if the inner Grover failed to find a zero in that row. Again, because
Grover’s algorithm has some probability of error we have to repeat the innerruns about log(N ) times to push the error probability per row down to about
1. So our final query complexity is
N
O(

1/4
N
|{z}

Outer Grover

×

N 1/4
|{z}

Inner Grover×log(N )
| {z }√) = O( N log(N ))Error Reduction

which up to log-factor achieves the full Grover speedup.
With some cleverness people have since been able to remove
the log(N ) factor.
Why couldn’t we just do Grover’s algorithm once, over the whole table?
Well, just because there’s a 0 somewhere in the table doesn’t mean that there
couldn’t be a row of all 1’s somewhere else.
The first problem in quantum computing that Professor
Aaronson worked on was trying to generalize the BBBV
Theorem to show that “recursive Grover”’ is optimal for
the OR-of-ANDs. The obvious lower bound is only ∼ N 1/4 .
After a whole summer trying to solve this problem using the“polynomial method,” it remained unsolved. Shortly afterward, Andris Ambainis, then a PhD student at Berkeley,invented a totally new method for proving lower bounds on
quantum query complexity, and applied it to solve this problem.

OR of ANDs Tree
We could easily generalize the scheme we used for the OR of ANDs problem
to evaluate (e.g.) an OR of ANDs of ORs by doing three recursive layers ofGrover search and so forth. If we allow an arbitrary number of layers thenwe enter a setting commonly seen in A.I. research: game trees for two-player

23.2. APPLICATIONS OF GROVER’S ALGORITHM

197

games of alternation such as chess and Go. In this setting the goal is to finda move you can make (represented by an OR over various options), such thatgiven any move that your opponent makes (represented by ANDs over various
options), there is a move that you can make in response, etc. . . that eventuallywins you the game.

Figure 23.3: An example of an OR of ANDs tree.
The problem is that as the game tree gets deeper and deeper, the advantage
of Grover’s algorithm over classical search seems to get weaker and weaker.
This is for two reasons: first, the amplification that’s needed at each layer toprevent error buildup and second, the constant factors, which multiply acrossthe layers. With regards to the second reason you might object that theconstant factor for Grover’s algorithm is π4 < 1, so if we multiply this constantfactor across layers you’d think we’d do better and bettwe with increasing
depth! Note however that each layer actually needs to run Grover’s algorithm
on the layer below it twice: once to evaluate |xi → |xi |f (x)i for that layer,
and a second time to uncompute any garbage generated (which would havethe effect of destroying the interference effects needed for higher levels of therecursion). So the constant factor actually becomes π2 > 1.
In short, we still haven’t answered the natural question: can a quantum
computer help you play chess? For game-tree search with a deep enough tree,
Prof. Aaronson and others conjectured that the diminishing returns from
Grover’s algorithm would end up negating any asymptotic advantage over aclassical computer.
In 2007, however, Farhi, Goldstone, and Gutmann along with others who

198

LECTURE 23. BBBV AND GROVER APPLICATIONS

built on their work dramatically refuted that conjecture. The upshot is that
we now know
√ how to evaluate any game tree with N leaves, no matter how
deep, in O( N ) time on a quantum computer. This is also known to be
asymptotically optimal.
So, yes, quantum computers probably would help you play chess! (At leastis brute-force game tree evaluation is a component of the classical algorithm
you’re competing against). To attach some numbers to this claim, Claude
Shannon famously estimated the number of possible board positions in chessas ∼ 1043 , which is certainly out of range for any existing computer on earth.
But if quantum computers brought that down to ∼ 1021.5 , solving chess mightjust be doable.
Though it raises a philosophical question: have you actually“solved” chess if you don’t have a solution table that anyone
can examine, but only a quantum computer that always
wins?

Lecture 24: More Applicationsof Grover’s Algorithm and Quantum Complexity Theory
24.1

More Applications of Grover’s Algorithm

24.1.1The Collision Problem

In the simplest version of the so-called Collision Problem, we’re given quantum black-box access to a function f : {1, · · · , N } → {1, · · · , N }, where N
is even, and we’re promised that f is two-to-one. The problem is to find x
and y such that x 6= y and f (x) = f (y). Since f is two-to-one, there arelots of collisions to be found and the challenge is just to find one of them. In
another version of the problem, we’re promised that either f is one-to-one or
it’s two-to-one, and the problem is to decide which. Clearly if we could solve
the search version then we could also solve the decision version, by simply
outputting that f is two-to-one if a collision is found or that f is one-to-one
if not. Conversely, any lower bound for the decision version implies the same
lower bound for the search version (but there’s no obvious reduction in theother direction).
The collision problem often arises in cryptography when
we’re trying to break collision resistant hash functions. You
can think of the collision problem as being a lot like Simon’s
problem but with less structure—or alternatively, as being
like the Grover search problem but with more structure.
√
With a classical randomized algorithm given black-box access to f , Θ( N )queries are necessary and sufficient to solve the collision problem. Why? The
upper bound follows from the famous “birthday attack,” which we first saw in
199

200

LECTURE 24. MORE GROVER. . .

Lecture 18 when discussing Simon’s√ algorithm. If there are N days in the year,
then you only need to ask about N people before there’s an excellent chancethat you’ll find two with the same birthday. This is because what matters isthe number of pairs of people, which grows quadratically with the number ofpeople asked. The lower bound can be proven using the union bound. Witha random two-to-one function, each pair has only a ∼ N1 chance of being acollision, so to find a collision with constant√ probability you need to look at∼ N pairs or more (and therefore make ∼ N queries).
What about quantumly? Well,
we could of course simulate the above ran√domized √algorithm to get ∼ N . But there’s also a completely different way
to get ∼ N . Namely, we could first query f (1), and then do a Grover search
for an x 6= 1 such that f (x) = f (1). So a question√naturally arises: can we
combine the two approaches to do even better than N ?
In 1997 Brassard, Hoyer and Tapp (BHT) showed how to do exactly that.
Here’s their algorithm:
I First, pick N 1/3 random inputs to f , query them classically and sort theresults for fast lookup.
I Next, run Grover’s algorithm on N 2/3 more random inputs to f (inputs

that weren’t queried in the first step). In this Grover search, count each
input x as marked if and only if f (x) = f (y), where y is one of the N 1/3
inputs that was already queried in the first step. This requires lookups
to our sorted list, but no additional queries to f .
This algorithm makes N 1/3 × N 2/3 = N pairwise comparisons and the runtime
is√(24.1)
N 1/3 + N 2/3 = O(N 1/3 )The centerpiece of Prof. Aaronson’s PhD thesis was showing that you can’t improve on this by much. It was latershown by Yaoyun Shi that you can’t improve on it at all.
The BHT algorithm gives a good illustration of one way quantum algorithms can end up with weird running times. You have two or more phases of
the algorithm that you try to balance against each other in order to minimize
the total time.
At a high level you can see why the BBBV proof that we used to prove theoptimality of Grover’s algorithm doesn’t work for the collision problem. In the
BBBV proof we changed a single element from 0 to 1 and then showed that24.1. MORE APPLICATIONS OF GROVER’S ALGORITHM

201

it would take many iterations for the algorithm to notice. With the collision
problem, by contrast, the key issue is that turning a one-to-one function intoa two-to-one function requires changing half the elements. Instead, Aaronson
and Shi used polynomial approximation theory (a branch of mathematics) torule out super-fast quantum algorithms for the collision problem.
In some sense, proving a quantum lower bound for the collision problem
should be harder than proving one for the Grover problem, because if the lower
bound for collision did too much then it would rule out things like Simon’salgorithm or Shor’s algorithm. The details of the proof are beyond the scope of
this course, but generally what allows a lower bound for the collision problem
is that it has permutation symmetry that Simon’s and Shor’s problems lack: if
you take a one-to-one function and permute its inputs and outputs arbitrarily,then it’s still a one-to-one function, and likewise for a two-to-one function.

24.1.2Element Distinctness

In addition to the collision problem, there’s also the closely related problem of
Element Distinctness. Here you’re given black-box access to the function
f : {1, · · · , N } → {1, · · · , N }, with no promises about f . The problem is to determine if f is one-to-one. In other words, are there any duplicates/collisions?
Classically, the optimal strategy is to hash the elements (or sort them, or
use a binary search tree, etc. . . ), which would take N queries plus the amountof computation required for hashing/sorting (say, N log(N ) steps).
Quantumly, there’s an algorithm that takes only O(N 3/4 ) queries, as shownin a paper from Buhrman et al.√from 2000. Givena list of the N values of√the function we split them into N blocks of N values each. We then picka block at random and query all elements in it. If we find a collision in theblock, you’re already done! If we don’t, then sort the elements in the block forfast lookup. Next, do a Grover search on the other items in the list, counting
an item as marked if and only if it equals an element from the first block we’vequeried. As long as we were lucky enough to pick a block that contains atleast one element of a collision pair, this algorithm will find such a pair withconstant probability. Hence it succeeds with √1N probability overall. This√algorithm uses O( N ) queries and we’ll be using it as a subroutine.
In order to achieve a constant success probability (rather than the √1Nprobability we found√for the algorithm above) naı̈vely we’d need to repeat thesubroutine above O( N ) times. We can do better than that though. In orderto do√so we’ll introduce an outer layer of Grover search that searches throughthe N different starting blocks we could’ve chosen among, as the initial

202

LECTURE 24. MORE GROVER. . .

block we query in the subroutine above. We’ll count a block as “marked” if
and only if the inner subroutine finds a collision involving that block. The
total runtime for this algorithm is (ignoring for the moment any log-factors
from error reduction)
O(

√
N
|{z}

Inner Subroutine

×

N 1/4
|{z}

) = O(N 3/4 )Outer Grover

Here is high-level summary complete algorithm:

Inner Subroutine:
I Given a list of the N values of the function we randomly split them into√√
N blocks of N values each.
I We then pick a block at random and query all elements in it.

– Sort elements for fast lookup. This doesn’t require any extra queries.
– If we find a collision, return it and halt.
I If we don’t find a collision then use Grover to search for collisions between
the block we initially selected and the rest of the list. If we find a collision,
return it and halt.
Outer Grover:I Run Grover over the choice of which of the√

N blocks we query initiallywhen running the inner subroutine above.
– If any of the inner subroutines being Grover searched over return acollision, then return it and halt.
What’s the lower bound on Element Distinctness? As a baseline, we know
the query complexity
has to be at least that of searching a list for a given i,√
which is √∼ N . Pinning down the query complexity of Element Distinctness
between N and N 3/4 was an open problem for several years. As it turns out,
the answer is N 2/3 .
First, Yaoyun Shi noticed that an ∼ N 2/3 lower bound follows from the∼ N 1/3 lower bound for the collision problem. Suppose for a contradictionthat we could solve Element Distinctness in t = o(N 2/3 ) queries. The claim
is this would let us solve the collision√problem in t = o(N 1/3 ) queries. How?
Given a two-to-one function f , pick N inputs uniformly at random. Since,by the birthday paradox, we can expect to find a collision within that set of24.2. PARITY LOWER BOUND

203

inputs with constant probability, we now simply run our hypothesized Element
algorithm on that subset. This gives a query complexity of√ Distinctness
2/3o(( N ) ) = o(N 1/3 ), which contradicts the lower bound we proved for the
Collision Problem.
Matching this lower bound, in 2003 Andris Ambainis found a quantum algorithm that solves Element Distinctness with O(N 2/3 ) queries. His algorithm
uses “quantum walks,” which are vaguely like Grover’s algorithm but moresophisticated. It also requires a huge amount of workspace qubits, namely∼ N 2/3 of them. Whether this large number of workspace qubits is necessary
remains open to this day.

24.2

Parity Lower Bound

Given a string x ∈ {0, 1}n , suppose we just want to determine the parity ofthe string x1 ⊕ x2 ⊕ · · · ⊕ xn . That is, whether the total number of 1 bits is
odd or even.
Classically, of course, this requires n queries. Quantumly, we’ve seen that
we can do it in n2 queries, by splitting x into n2 pairs and then applying theDeutsch-Jozsa algorithm separately to each pair. A beautiful result shows that
this is optimal: any quantum algorithm for parity requires n2 queries. This wasshown to be the case using a technique known as the polynomial method byBeals et al. in 1998.
As a complement to Parity, it’s also worth briefly discussing the n-bit
Majority function, which outputs 0 or 1 depending on whether the input stringhas more 0’s or 1’s respectively. The quantum query complexity of Majority
turns out to be order n—i.e., there is no asymptotic quantum speedup for thisproblem. This lower bound can also be proved using the polynomial method.
However, there is a quantum speedup for a problem closely related to Majority.
For a poll to be accurate within an error of , how many people do you
need to query classically? If you imagine that this poll has two options andthat people’s preferences correspond to either 0 or 1, then this is equivalent
to approximating the Hamming weight (i.e., number of 1’s) of an n-bit input
string to within an additive error ±n. Classically you can do this by sampling∼ 12 uniformly random bits and taking their average; this is also tight.
This fact is extremely useful to know when, e.g., choosing the sample size for a political poll to achieve a desired
margin of error like, say ±3%.

204

LECTURE 24. MORE GROVER. . .

Quantumly it turns out that we can solve this problem using only 1 queries,
a quadratic speedup, by using a clever application of Grover’s algorithm (weomit the details here).

24.3

Quantum Complexity Theory

To conclude this lecture let’s talk a bit about Quantum Complexity Theory, the generalization of computational complexity theory to the quantum
realm. That way we can understand the broader context of the quantum
algorithms we’ve seen.
Classically we define complexity classes such as:
I P (Polynomial-Time)– the class of decision problems solvable by a stan-dard, deterministic digital computer in polynomial time.
– Examples: linear programming, connectivity of graphs, primality
testing. . .
I NP (Nondeterministic Polynomial-Time)– the class of decision problems
for which there’s a deterministic polynomial-time algorithm to verify yesanswers.
– Examples: factoring, graph isomorphism. . .
problems to which every NP
problem can be reduced in polynomial time. In particular, if you had
an oracle to solve some NP-hard problem in polynomial time, then you
could use it to solve everything in NP in polynomial time.
I NP-complete problems– those that are both in NP and NP-hard. Informally, they’re “the hardest problems in NP.
I NP-hard problems– roughly speaking,– Examples: Traveling Salesman, 3SAT, Max Clique, Bin Packing,
VLSI layout, Sudoku, Super Mario. . .
This picture already involves an enormous mathematical unknown. Famously, no one has ruled out the possibility that P = NP, in which case
all NP problems—and in particular, all NP-complete problems—would besolvable in polynomial time.
Where does quantum computing fit in? In 1993 Bernstein and Vazirani defined the complexity class BQP (Bounded-Error Quantum Polynomial-Time)
as a quantum generalization of P. Loosely speaking, BQP contains all decision
problems that can be solved in polynomial time with a quantum computer.
How does BQP relate to classical complexity classes?

24.3. QUANTUM COMPLEXITY THEORY205

We know that P ⊆ BQP, because Toffoli gates can simulate AND, OR,
and NOT gates and hence universal classical digital computation. So any classical digital calculation can be simulated by a quantum computer. We also
know from Shor’s algorithm that Factoring (when suitably phrased as a decision problem) is in BQP, though it’s not known (to put it mildly) whether
Factoring is in P. We also don’t know whether NP ⊆ BQP: that is, whether
quantum computers can solve all NP problems (including NP-complete problems) in polynomial time. The BBBV Theorem does tell us that there isn’t an“easy” proof of NP ⊆ BQP to be had, one that just treats the NP problem
as a black box.
Can quantum computers solve NP-complete problems in polynomial time?
remains one of the big open problems of quantum complexity theory. Of
course, if P = NP then NP ⊆ BQP, so any proof of NP * BQP would
require proving P 6= NP at the least. No reduction or equivalence between
the P = NP and NP ⊆ BQP problems is currently known.
We could also ask the converse, Is BQP ⊆ NP? In other words, for every
problem that a quantum computer can solve, is there a short proof of the answer
that’s easy to verify classically? It’s possible that there are counterexamples
to this, but we don’t have any good candidates right now—that is, unless
we broaden the definitions of BQP and NP beyond decision problems, tocapture more general problems such as promise problems, search problems
and sampling problems.
The last important question to ask here is: if BQP doesn’t seem to becontained in P, and maybe not even in NP, then what is it contained in?
What classical class gives an upper bound on what a quantum computer can
do? Well, Bernstein and Vazirani showed that it’s possible to simulate aquantum computer classically with exponential time and polynomial memory,
basically by writing an amplitude of interest as a sum of exponentially many
contributions, and then evaluating the contributions one by one, reusing thesame memory each time and adding the results to a running total. This gives us
an upper bound: BQP ⊆ PSPACE, where PSPACE (Polynomial Space)is the class of problems solvable on a digital computer using a polynomial
amount of memory, but possibly exponential time. It’s possible to get a better
upper bound on BQP, but it involves other complexity classes that we won’t
define here.
So, what would it take to prove that P is different from BQP? Of course
this would follow if factoring wasn’t in P, but proving the latter would require
showing P 6= NP! It’s also not clear that there is any better hope for proving
P 6= BQP in the near future than there is for proving P 6= NP. The reason
is that BQP is sandwiched between P and PSPACE:206

LECTURE 24. MORE GROVER. . .

P ⊆ BQP ⊆ PSPACE.
For this reason, any proof of P 6= BQP would also need to show that P 6=
PSPACE, which is a big unsolved problem in itself.

Figure 24.1: Where BQP fits in with classical computational complexity
classes, as best as we know it today.

Lecture 25:
25.1

Hamiltonians

Quantum Algorithms for NP-complete Problems

We’ve seen how it’s an open question whether quantum computers can solve
NP-complete problems in polynomial time. If this turned out to be possible
it would be world-changing.
Like, it would be time for a Manhattan Project to build
scalable quantum computers. . .
But even if it turns out that quantum computers can’t solve NP-complete
problems in polynomial time, the question still remains how close can they
get? We know from the BBBV Theorem that any approach that ignores the
structure of NP-complete problems can at most yield the Grover speedup.
There have been many papers on the preprint repository
arXiv.org that claim to solve NP-complete problems inpolynomial time with a quantum computer, but do so inways that violate the BBBV Theorem. Virtually all quantum computing papers can be found on arXiv.org, but thesite has no peer review so reader beware.
So to do better than Grover we’d need to exploit problem structure in someway. For example, with Boolean satisfiability we could imagine devising somequantum algorithm that dealt with certain parts of the formula first and worried about other parts later. If we managed to show that any NP-complete
problem was in BQP (i.e., solvable in polynomial time by a quantum computer), then by definition all of NP would be in BQP. However, if we’retalking about small (polynomial) speedups, then the choice of NP-complete
problem might actually matter, because the process of reduction from one
207

208

LECTURE 25. HAMILTONIANS

NP-complete problem to another might cancel out a speed advantage.
The Adiabatic Algorithm, proposed by Farhi, Goldstone, Gutmann,and Sipser in 2000 is a famous attempt to achieve a quantum speedup for
NP-complete problems (conceivably even an exponential speedup) by actually exploiting their structure. It’s an extremely important quantum algorithm, but unlike (say) Shor’s or Grover’s algorithms, it doesn’t come withany rigorous analysis guaranteeing it will run fast in all cases—and indeed, we
now know that it doesn’t. To this day, no one really knows how useful thisalgorithm will be in practice.
It’s something that people will eagerly experiment with assoon as they have reliable large-scale quantum computers
to test it on!
For some instances of optimization problems, the adiabatic algorithm might
give a huge speed advantage, but for other instances it gives little or no advantage or is even outperformed by classical algorithms. People are still trying tofigure out for which types of instances the algorithm is most useful.
To understand the adiabatic algorithm, we first need to back up and familiarize ourselves with a central concept in quantum mechanics called Hamiltonians.
In a physics course on quantum mechanics Hamiltonians
would be day-one material and we’d only get to quantum
computing and information at the very end (if at all). In
this course it’s exactly the opposite!

25.2

Hamiltonians

Recall that unitary matrices are discrete-time linear transformations of quantum states:|ψi → U |ψi
But in physics, time is typically treated as continuous. Rather than viewing the transformation of |ψi to U |ψi as a discrete jump, it is viewed as theresult of a continuous process causing the state to evolve over some intervalof time. Hamiltonians are just the instantaneous time generators of unitarytransformations. That is, they’re things that give rise to unitary transforma-25.2. HAMILTONIANS

209

tions when you “leave them running” for some period of time. Like density
matrices, Hamiltonians are described by Hermitian matrices. Unlike density
matrices, however, Hamiltonians don’t need to be positive semidefinite or tohave trace 1. Physically, Hamiltonians are operators that are used to represent
the total energy of a system.
Remember: for H to be Hermitian means that H = H †From a physics perspective the central equation of quantum mechanics is
Schrödinger’s Equation:id|ψi = H |ψi ,dt(25.1)

with H being some Hamiltonian. This equation describes the evolution of an
isolated quantum pure state in continuous time.
The full version of Schrödinger’s equation also includes theso-called Planck’s constant ~, which is needed to convert between units of time and units of energy. But unless we’redealing with actual experimental data (involving real units
like meters, seconds, joules, and so forth) it’s more convenient just to set ~ = 1, the convention we’ll adopt throughout the rest of the course! For future reference, if it evercomes up, the speed of light c is also 1.
Assuming that H is time-independent, we can solve Schrödinger’s equation
to find that the state after time t is|ψ(t)i = e–iHt |ψ(0)i .

(25.2)

Schrödinger’s equation describes a whole system of linear differential equations—
one for each coordinate of the vector |ψi—but we can formally solve it bypretending that the matrix H is a scalar.

25.2.1

Matrix Exponentiation

We need to back up to address a mathematical point: what does it mean toraise e to the power of a matrix? The “right” definition turns out to be based

210

LECTURE 25. HAMILTONIANS

on the standard Taylor series for the exponential function,
A

e =

∞
X
Ak

k!
k=0

,

(25.3)

where we now just plug in a matrix instead of a scalar in order to get a matrixvalued result. Here are some examples:

 

0 0
1 0
exp
=
0 0
0 1


 

1 0
e 0
exp
=
0 0
0 1

(25.4)

More generally, for any diagonal matrix we have
exp 




e λ0
 
...
 = 

λ0
...
λn−1


e

λn−1


.

(25.5)

In other words, you can exponentiate a diagonal matrix by exponentiatingeach diagonal term individually.
The above equation for diagonal matrices might look like a very specialcase, but for Hermitian matrices it’s really all we need! Suppose we’re given
a Hermitian matrix, A. By the Spectral Theorem, we can write A = U DU †where D is diagonal and U is some unitary transformation. To compute eA ,we can then write
eA =

∞
X
(U DU † )k

k!

k=0

=U

∞
X
Dk
k=0
D †

k!

!
U†

(25.6)= Ue UThus, in order to exponentiate any Hermitian matrix we simply need to diagonalize it first.
What leverage do we get from H being Hermitian? For what we’ve said tomake sense—and in particular, for it to be consistent with the discrete-timeversion of QM we’ve used in the rest of the course—it better be the case thatthe matrix e–iHt is unitary. Let’s now prove this to be true, by using the factthat H is Hermitian.
First claim: If H is Hermitian, then all its eigenvalues are real.

25.2. HAMILTONIANS

211

Proof: Suppose λ is an eigenvalue of H. Then by definition, there’s someeigenvector |vi such that H |vi = λ |vi. If we multiply both sides by thecorresponding bra hv| we get
hv|H|vi = λIf we take the complex conjugate of both sides we get
hv|H † |vi = hv|H|vi = λ∗This implies λ = λ∗ , therefore λ ∈ R.
As we stated above, every Hermitian matrix is diagonalizable. This follows
directly from the spectral theorem. We won’t go through the details of proving
the spectral theorem here, but we will make use of an immediate consequencethat any Hermitian matrix can be written as
H = U DU †(25.7)

where U is a unitary transformation and D is diagonal and real-valued. Now,
to show that e–iHt is unitary just diagonalize H:†

e–iHt = e−itU DU = U e–itD U † .

(25.8)

We know from Equation 25.5 that e−itD has the forme−itλ0..
e−itD = ,.

(25.9)e−itλn−1

which is clearly unitary because the λi ’s are reals. Therefore, e−iHt = U e−iDt U †is unitary as well.
Note that if |vi is an eigenvector of H associated with the eigenvalue λ then|vi is also an eigenvector of e–iHt with the eigenvalue e–iλt . So eigenvectors of
H give rise to eigenvectors of the corresponding unitary.
Now, what about going backwards? Given a unitary U , can we always finda Hermitian matrix H such that U = e–iHt ? Yes, this is not hard. Firstdiagonalize U (which we can always do for unitary matrices, again by thespectral theorem) to get U = V DV † . We then just need to take matrix
logarithm—like the matrix exponential, this can be defined in terms of the
Taylor expansion. Similar to what we found for the matrix exponential, thelogarithm of a diagonal matrix, D, can be obtain by taking the logarithmof each entry. For each diagonal element of D, Djj , we find a λj such that

212

LECTURE 25. HAMILTONIANS

Djj = e–iλj t . Will the set of {λj } that we get by solving this be unique? No,
because by Euler’s formula we can always add 2πi to the exponent and theequation will still hold. We saw, for example that


0 0
0 0
is a logarithm of the identity matrix. What else is?

 

2πi 0
4πi 0
,
,···
0 6πi
0 2πi

(25.10)Thus, any given unitary can arise from infinitely many different Hamiltonians.

25.2.2

EnergyPhysicists have a special name for the eigenvalues that you get by diagonalizing
a Hamiltonian. They call them energies. Note that they’re all real and cantherefore can be ordered from least to greatest:


λ0


...
(25.11)
λn−1with λ0 ≤ λ1 ≤ · · · ≤ λn−1 . To each energy λj there corresponds an energy eigenstate |vj i such that H |vj i = λj |vi. Why are they called energies?
Because they are possible values for the system’s energy.
Quantum mechanics gives us one explanation for why theconcept of “energy” arises in physics. Because unitary matrices arise by exponentiating Hamiltonians and Hamiltonians can be diagonalized and have real eigenvalues.
If we apply the unitary transformation e–iHt to the energy eigenstate |vj i,we gete–iHt |vj i = e−iλj t |vj i ,(25.12)

meaning that nothing has happened apart from the state picking up a global
phase (unobservable by itself) dependent on the energy. The energy eigenstates25.2. HAMILTONIANS

213

form a complete basis (we won’t prove that at the moment, but it is indeedtrue), so we can write an arbitrary state as a superposition over the energy
eigenstates:|ψi = α0 |v0 i + · · · + αn−1 |vn−1 i .

(25.13)

From this perspective, applying the Hamiltonian H for some amount of t is
equivalent to doing
e−iHt |ψi = α0 e−iλ0 t |v0 i + · · · + αn−1 e−iλn−1 t |vn−1 i .

(25.14)This presents a terrifyingly boring picture of the history of universe! In thispicture, all that has ever happened, and all that ever will happen, is that thevarious energy eigenstates of the universe pick up phases, with each rotatingaround the unit circle at a speed proportional to its energy.
From the utter lack of interesting activity when we view
the world in the energy eigenbasis, we conclude that life isa basis-dependent phenomenon.
But the above picture is actually extremely useful. For one thing, it suggeststhat we can simply define energy as the speed at which a quantum state picks
up a phase.
It’s not obvious that this corresponds to the usual conceptions of energy in physics, but it turns out that it does.
You’ll have to go to the physics department for the full details though!
One thing that’s clear from our definition is that energy is conserved. Moreformally, the expectation value of the energy in the state |ψi,hψ|H|ψi =X|αj |2 λj ,jstays the same over time.
We have a special nomenclature for energy eigenstates. The eigenstate |v0 i
corresponding to the lowest energy is called the ground state, which we’ll see
plays an extremely special role in the adiabatic algorithm. The corresponding
energy λ0 is the ground state energy. The eigenstate |v1 i, corresponding to
the second-lowest energy, is called the first excited state. The eigenstate |v2 i iscalled the second excited state, and so forth. If there’s more than one energy

214

LECTURE 25. HAMILTONIANS

eigenvalue equal to λ0 , then we get what’s called a ground state degeneracy.
There’s no longer a unique ground state, but rather a subspace of two or
more dimensions in which every state equally minimizes the energy. We cansimilarly get degenerate excited states if λj = λj+1 for some larger j. For themost part, though, we’ll be able to ignore this.
The standard game plan for much of modern physics goes like this:I Write down the Hamiltonian H of your system (or some approximationto H).
I Diagonalize H.
I Extract the energy eigenstates.
I Then, as a first guess, see if your system is just sitting in its ground state

doing nothing.
This initial guess that your system is in the ground state turns out towork very well much of the time. Why are quantum systems often foundsitting in their ground states? Intuitively, it’s because physical systems “like”
to minimize their energy: when lower energy states are available, they tend
towards them. The ground state, by definition, is the lowest they can go.
But since quantum mechanics is time-reversible, how is it even possible for asystem to be “attracted” to a certain state? Excellent question! You can thankthe Second Law of Thermodynamics and the conservation of energy for
this.
The same question arises in classical physics,
which is time-reversible too. If you leave a ballrolling around in a basin and return a while later
you probably won’t find it in an “excited state”—
i.e. continuing to roll around. Whatever energy
it had in its excited state, it could reach a lower
energy by rolling downhill and giving off heat (energy) via friction, eventually coming to a rest.
When this happens, the kinetic energy that used to be in the ball dissipatesaway in the heat.
In principle it’s possible that the reverse could happen: the heat in thebasin could coalesce back into the ball and make it spontaneously move. But
we essentially never observe that, and the reason comes down to entropy. For
all the heat to coalesce back into the motion of the ball would require an
absurdly finely-tuned “conspiracy,” in which a massive number of particles
synchronize their random motion to impart a kick to the ball. The probabilityof this synchronized behavior occurring by chance falls off exponentially with

25.2. HAMILTONIANS

215

the number of particles. But the reverse process, motion dissipating into heat,requires no similar conspiracy; it only requires that our universe does containlow-entropy objects like balls.
This, in turn, can ultimately be traced back to the low
entropy of the universe at the Big Bang—something thatno one has satisfactorily explained in terms of anything
deeper, but we’ll be content to leave it there!
Pretty much exactly the same story works in the quantum case and explains
why, when we find quantum systems in nature, they’re often sitting in their
ground states. If they weren’t then their interactions with surrounding systems
would tend to carry away excess energy until they were. By contrast, all thequantum algorithms and protocols that we’ve seen in this course are examplesof quantum systems that don’t just sit in their ground states. Stuff happens,
the system evolves!
We as people don’t just sit in ground states either.

Figure 25.1: Hydrogen atom emitting a photon due and dropping toa lower energy level.

Figure 25.2: Hydrogen atom absorbing a photon and jumping up
to a higher energy level.

To give an example of these concepts that the physicists really love, let’stalk about the hydrogen atom. In the ground state, a hydrogen atom has its
electron sitting in the lowest energy shell (the one closest to the nucleus). The
first excited state has the electron in the next shell up (a bit farther away on
average from the nucleus). If the atom is in its first excited state, it’s easy for
it to drop back down to its ground state by emitting a photon. The photon
carries away an amount of energy that’s exactly equal to the difference between
the ground and the first excited energies. Conversely, a hydrogen atom in its

216

LECTURE 25. HAMILTONIANS

ground state can jump up to its first excited state via the electron absorbinga photon. But the latter process is not spontaneous; it requires a photon justhappening to come by. That’s why hydrogen atoms in nature are most often
found in their ground states.

25.2.3Tensor Products of Hamiltonians

Just like with unitaries, we can take the tensor produce of two or more Hamiltonians to produce a Hamiltonian acting on a larger system:
H = H0 ⊗ H1 .
We do not, in general, have e−i(H0 ⊗H1 ) = e−iH0 ⊗e−iH1 . However, that equation
does hold (up to a global phase) if either H0 or H1 is the identity matrix.
In that case, we can think of H as acting nontrivially on only one of thetwo subsystems and trivially on the other (just like with tensor products ofunitaries).

25.2.4

Addition of Hamiltonians

Our final topic for this lecture is an important operation that we can do with
Hamiltonians, but which we couldn’t generally do with unitaries. Namely, we
can add them! We can do this simply because we the sum of two Hermitianmatrices is itself Hermitian, and every Hermitian matrix is a valid Hamiltonian:H = H0 + H1 = H0† + H1† = H † .

(25.15)What does this mean physically? Intuitively, it just means we’ve got two
things going on at the same time. For example, H0 and H1 could correspondto two different forces acting on our system.
Building a complicated Hamiltonian by summing local terms
could also be seen as somewhat analogous to building a complicated quantum circuit by composing 1 and 2-qubit gates.
To illustrate, at an extremely high level we could write the Hamiltonian
for the Standard Model of elementary particle physics as
HSM = HKinetic + HEM + HStrong + HWeak

25.2. HAMILTONIANS

217

where HKinetic is the Hamiltonian corresponding to the kinetic energy andwhere HEM , HStrong , and HWeak are the Hamiltonians corresponding to electromagnetism and to the strong and weak nuclear forces respectively. This
isn’t exactly right for all sorts of reasons, but is good enough to get across thepoint.
The Standard Model excludes gravity.
If A and B are matrices is it generally the case that eA+B = eA eB ? Alas,no. Indeed it’s not hard to find a 2 × 2 counterexample (we’ll leave that as an
exercise). On the other hand you can check using the Taylor series definition
that if A and B commute (that is, AB = BA), then eA+B = eA eB does hold.
We’ll care a lot about unitary transformations of the form e−it(A+B) , ortheir counterparts with many more than two Hamiltonians being summed. In
particular, we’ll need a way to apply these sorts of unitaries efficiently given
only the ability to apply A and B by themselves—even if A and B don’t happen
to commute. Fortunately there’s a trick for this, known as Trotterization.
The trick is to use the following approximation:
B
eA+B ≈ e|A eB eA e{z· · · eA eB}

(25.16)1
Times
This basically means that we can achieve the same effect as A and B occurring
simultaneously by repeatedly switching between doing a tiny bit of A and a tiny
bit of B. We won’t do it here, but it’s possible to prove that the approximation
improves as  decreases, becoming an exact equality in the limit  → 0. Thisis important for the question of how to simulate a real-world quantum systemusing a quantum computer. Indeed, the straightforward approach is just:I Discretize all the degrees of freedom (positions, momenta, etc. . . )thataren’t already discrete.
I Write the total Hamiltonian H acting on the system as a sum of “simple”
terms (say, terms that act on only 1 or 2 particles as a time).
I Trotterize H in order to approximate it by a product of “simple” unitarytransformations.
To flesh this out a bit more we ought to say something about what the
Hamiltonians of real physical systems tend to look like. Suppose we model
the universe as a gigantic lattice of qubits, say in 2 or 3 dimensions (hey, it isa quantum computing class!). This is actually exactly the sort of model used
to study many condensed matter systems. Suppose too that we only consider

218

LECTURE 25. HAMILTONIANS

interactions between neighboring qubits. In that case, the total Hamiltonianthat acts on the qubits can be written
H=

X

Hj +

j

X

Hj,k .

(25.17)j∼k

Here Hj is a Hamiltonian that acts only on the qubit j and trivially (i.e., as
the identity, which has no effect) on all the others, for example:


 



h1 h2
1 0
1 0
H0 =
⊗
⊗ ··· ⊗
h3 h4
0 1
0 1
Meanwhile, for every edge (j, k) in the lattice, Hjk is a Hamiltonian that acts
nontrivially on the neighboring qubits j and k and trivially on all the other
qubits, for example:

0
 0


0



⊗n−2

⊗ 1 0.

0 1
1Figure 25.3: Example of a lattice of qubits with some set of pairwise nearestneighbor interactions (blue squiggly lines) between them.
So each qubit “talks” only to its immediate neighbors in the lattice. Evenso, evolving the Hamiltonian over time gives us effects that can propagate
arbitrarily far.
As soon as we’ve written this, though, we face a puzzle. Won’t this lead tofaster-than-light travel? Indeed, even when t is arbitrarily small, one can checkthat the unitary matrix e–iHt will generally contain effects coupling every qubit
in the lattice to every other one. Granted, the magnitude of these effects will

25.2. HAMILTONIANS

219

fall off exponentially with distance, but causality demands that there should
be literally zero effects propagating across the lattice faster than light.
So what’s the resolution? Basically it’s just that the picture we’re using
comes from non-relativistic quantum mechanics, so it yields a good approximation only if the relevant speeds are small compared to the speed of light.
When the speeds are larger, we need the framework of quantum field theory,
which does ensure that faster-than-light influences are exactly zero.
OK, now we’re ready to set things up for the next lecture. Suppose that H,
a Hamiltonian acting on n qubits, is the sum of many “simple” Hamiltonians
acting on a few qubits each:

H = H0 + · · · + Hm−1 .
Since H is a 2n × 2n , matrix figuring out its ground state (or ground states) by
brute-force diagonalization could be extremely time-consuming. This leads toa question: if I know the ground states of the Hj ’s individually, can I combine
them in some simple way to get the ground state of H itself ? Alas, the answer
is almost certainly “no.” More precisely, we claim that finding the groundstate of a Hamiltonian of this form is an NP-hard problem. To prove thiswe’ll show how to take any instance of the famous 3SAT problem and encode
it into the ground state problem. Suppose we have a Boolean formula in nvariables,

ϕ(x0 , · · · , xn−1 ) = c0 ∧ · · · ∧ cm−1 ,(25.18)an AND of m clauses, where each clause ci acts on at most 3 variables. We
can now define an n-qubit Hamiltonian H as follows:

H=

m−1
X

Hi

(25.19)i=0

The term Hi acts on at most 3 qubits, corresponding to the bits acted on by
ci , and as the identity on all the other qubits. It imposes an “energy penalty”
if and only if the qubits are set in such a way that ci is violated. For example,

220

LECTURE 25. HAMILTONIANS

we could encode the clause (v0 ∨ v1 ∨ v2 ) by the Hamiltonian


1
 0





0




0
.
H=


0




0



0 
0

(25.20)This Hamiltonian will yield 0 (no energy penalty) unless all three qubits are set
to 0, which corresponds to the case where the clause is not satisfied. It’s not
hard to see that to minimize the energy for such a Hamiltonian, without loss ofgenerality you just set all the variables classically (superposition states won’t
help reduce the energy in this case), in whichever way leads to the smallest
energy. In other words, you solve 3SAT! In particular, H’s ground-state energy
will be 0 if ϕ is satisfiable, or some positive value if ϕ is unsatisfiable. So not
only is this problem NP-hard, it’s NP-hard for reasons that have nothing to
do with quantum mechanics.
Could this observation somehow let nature solve NP-hardproblems in polynomial time? For more, tune in next time!

Lecture 26:
gorithm
26.1

The Adiabatic Al-

Local Hamiltonians

At the end of the last lecture, we saw that the following problem is NP-hard:
Given as input an n-qubit Hamiltonian H of the form H = H1 + · · · + Hm ,with each Hi acting on at most 3 of the n qubits, estimate H’s ground stateenergy. We call this problem the Local Hamiltonians Problem.
This is a quantum generalization of the 3SAT problem whicharises very naturally in condensed matter physics.
How do you give someone a Hamiltonian like that? Providing the full2 × 2n Hermitian matrix would be wasteful. Instead you can simply list the
local terms {H0 , . . . , Hm−1 } (to some suitable precision), together with thequbits to which they’re applied.
Is this problem NP-complete? Since we know it’s NP-hard, what we’reasking here is whether it’s also in NP. In other words, when we claim that the
ground-state energy of some Hamiltonian is at most (say) 5, can we prove it bygiving a short witness? It turns out that we can—but, as far as anyone knows
today, only by giving a quantum witness! A quantum witness that works is
simply the n-qubit ground state itself. Thus, the Local Hamiltonians problem
is not known to be in NP; it’s only known to be in the quantum analogue ofNP, which is called QMA (Quantum Merlin-Arthur). An important theorem
from around 1999 says that Local Hamiltonians is actually complete for QMA,
just like 3SAT is complete for NP.
n

For the specific Hamiltonian H we constructed in the lastlecture—the one that encoded 3SAT—there would be ashort classical witness. Because H was a diagonal ma221

222

LECTURE 26. THE ADIABATIC ALGORITHM
trix, its ground state is always just a classical basis state.
But what if H is non-diagonal and its ground state is somecomplicated entangled state?

So, if natural quantum systems like to settle into their ground states, and if
finding the ground state is NP-hard, does this mean that we could use quantum
systems to solve NP-hard problems? People talked about such questions even
before the concept of quantum computing was in place. But there’s a serious
problem. It’s not always true that natural quantum systems quickly settle
into their ground states. Starting from hard instances of 3SAT might produce
complicated and exotic Hamiltonians, far from physicists’ usual experience.
Those complicated Hamiltonians might be ones for which it’s hard to reachthe ground state.

Figure 26.1: Optimization landscape with a local minimum that the particle
might get trapped in.

In the hillside above, will the ball get to the point that minimizes its gravitational potential energy? Probably not anytime soon! If we wait a million
years, maybe a thunderstorm will push the ball up over the hill in the middle,
or something. But for the foreseeable future, it’s much more likely for the ballto rest at the local minimum on the left.
In hard real-world optimization problems you may have a very bumpy
landscape, with thousands of dimensions and plenty of local optima to gettrapped in. You might wonder if quantum computing could help us wadethrough these local optima, and it certainly seems plausible. In fact, the hope
it could was a central starting point for today’s topic.

26.2. THE ADIABATIC ALGORITHM

26.2

223

The Adiabatic Algorithm

This is the last quantum algorithm we’ll cover in this course. At the core of
the Adiabatic Algorithm is a theorem from the 1920s called the Adiabatic
Theorem. This theorem says the following: suppose you apply some initial
Hamiltonian Hi to a system in Hi ’s ground state. So far nothing happens, butthen suppose you slowly and continuously change Hi into some final Hamiltonian Hf . Provided that the transition was slow enough, the final state of thesytem you’ll end up in is (extremely close to) the ground state of Hf .
Assuming a few fine-print conditions that we won’t go into.
So, gradually changing the Hamiltonian moves us from one ground state toanother ground state. In the minds of Farhi, Goldstone, Gutmann and Sipser
this suggested a plan to solve NP-hard problems using Hamiltonians.
Here’s how the adiabatic algorithm would work with 3SAT as an example.
First we need to pick a Hamiltonian with a known and easy to prepare groundstate. For example, the Hamiltonian



1 −1
H=
,
−1 1

(26.1)

with eigenstates |+i and |−i. The energy of |+i is 0 and the energy of |−i is2, so |+i is the ground state. We can create an initial Hamiltonian Hi (note
we’re using i here to denote “initial,” not as an index) by applying H to each
qubit individually:

Hi =

n−1 
X
1
j=0


−1
.
−1 1 j(26.2)

Here the subscript j is meant to denote that the j th term acts nontriviallyon qubit j, tensored with the identity matrix on the remaining n − 1 qubits.
The ground state of Hi , namely |+i⊗n , has the advantage that it is easy to
prepare on a quantum computer. We then gradually change Hi to another
Hamiltonian Hf , which encodes some n-bit 3SAT instance that we’d like tosolve:

Hf =

m−1
X
j=0

hj ,

(26.3)

224

LECTURE 26. THE ADIABATIC ALGORITHM

Figure 26.2: Potential plot of energy eigenvalues as a function of time in the
adiabatic algorithm.
where each of the hj ’s in Hf encodes one of the m clauses, imposing an energy penalty on non-satisfying assignments. In the simplest version of thealgorithm, we interpolate between Hi and Hf linearly, by adjusting a timeparameter t ∈ [0, 1] as follows
Ht = (1–t)Hi + tHf .

(26.4)

Since each Ht is a sum of terms acting on a few qubits only we can apply
these Ht ’s using Trotterization (discussed in the last lecture). If everything
goes according to plan we’ll end up in the ground state of Hf —in other words,
the optimal solution to our 3SAT instance. So what’s the catch? Well, thecrux is that the transition from Hi to Hf must be sufficiently slow, but wehaven’t defined what we mean by “sufficiently slow” yet. How slow do we needto go for this to work?
To build intuition, let’s plot an example of what the eigenvalues of Ht
might look like as a function of the time parameter t (see Figure 26.2). Ht
could have as many as 2n eigenvalues. We’re especially interested in the smallest eigenvalue (the ground energy) and the one right above that (the firstexcited energy). Our goal is to stay in the ground state throughout the entire
evolution. The eigenvalues, also called energy levels, can change continuously
over time. Sometimes two energy levels can even cross each other. Physicists call that a level crossing. When they almost cross it’s an avoided levelcrossing. If the two lowest energies cross each other, then we leave the groundstate. Even if the two lowest energies barely avoid crossing each other there’s
a significant risk that we’ll leave the ground state. The closer together the twolowest energies get, the slower we have to run the algorithm to avoid leaving

26.2. THE ADIABATIC ALGORITHM

225

the ground state. We define the Minimum Eigenvalue Gap, g, as the minimum of the energy difference between the first excited energy and the groundenergy as a function of the time t.
g = min (λ1 (t) − λ0 (t)).

(26.5)

t∈[0,1]

We’ll call the time at which g is minimized tmin . The gap g turns out to be a
crucial quantity for determining how long the adiabatic algorithm will take tosolve a given problem instance. Roughly speaking, in order to remain in the
ground state throughout the entire computation, we need to ensure that neartmin the rate of evolution of the system is ∝ g 2 . This requirement means thatthe overall computation will run in something like ∼ g12 time.
1
If we could show that g was always lower-bounded by nO(1)for 3SAT (orsome other NP-complete problem), then we’d get NP ⊆ BQP; quantum computers would be able to solve all NP problems in polynomial time. In reality
we’re approximating the Hamiltonians with discrete-time unitary transformations so we’d end up with something close to the ground state of Hf , not the
ground state itself. But even that would still be good enough to solve ourNP-hard problem.
So the question boils down to: what is the behavior of the minimum spectral
gap for the problem instances that we want to solve?
Ed Farhi once went to an expert in condensed matter physics
and asked “this is the system we’re looking at, do you thinkthat g will decrease polynomially or exponentially as a function of n?” The expert said: “I think it will decrease exponentially.” That’s not the answer Farhi wanted to hear.
So Farhi asked “why? What’s the physical reason?” After
thinking about it some more, the expert responded “because
otherwise your algorithm would work.”
What emerged after a couple of years is that, for hard instances of 3SAT(or even 2SAT, for that matter), the minimum eigenvalue gap often does get
exponentially small. At the avoided level crossing you’d need to run the algorithm for an exponential number of steps in order to remain in the groundstate and thereby solve your SAT instance.
But the story doesn’t end here. The physicists regrouped and said, “Okay,so maybe this technique doesn’t always work, but it might still give big advantages for some types of optimization problems!”
By now there’s been lots of research on classifying the types of solution

226

LECTURE 26. THE ADIABATIC ALGORITHM

Figure 26.3: Optimization landscape where a sharp thin peak separates theglobal minimum from the rest of the landscape.
landscapes where the adiabatic algorithm performs well and those where it
performs poorly. Some encouraging results came from Farhi, Goldstone, Gutmann in 2002. These authors constructed landscapes that had a global minimum at the bottom of a wide basin, but also a tall thin spike blocking theway to that minimum. Starting from the far left a classical algorithm basedon steepest descent would get stuck forever at the base of the spike (i.e., at a
local minimum) and would never reach the global minimum.
OK, but before we examine the performance of the adiabatic algorithm
on this sort of landscape shouldn’t we first look at better classical algorithms?
Indeed, one example of such an algorithm is Simulated Annealing which,much like the adiabatic algorithm, will always eventually reach the global
minimum if you run it for long enough. In some regards simulated annealing
can be thought of as a classical counterpart to the adiabatic algorithm.
The basic idea of simulated annealing is to evaluate the fitness function
around the current point and then:
I Most of the time: Make a move that improves fitness.
I Some of the time: make a move that worsens fitness.

The probability of making a move that worsens the fitness is time-dependentand decreases as time goes on. Simulated annealing makes a trade-off between
exploration of the general landscape and focusing in on the current steepest
path downwards.

26.2. THE ADIABATIC ALGORITHM

227

The name “simulated annealing” comes from a technology
7000 years old. Annealing is the process of making a metalstronger by heating it up and then slowly cooling it.This
gives the atoms in the metal a chance to bounce around andescape from a local optima that might be causing brittlenessand then slowly settle into a better optimum.
On the fitness landscape with the spike in Figure 26.3, simulated annealing
would eventually get over the spike despite how energetically unfavorable it is.
However, if the spike is tall enough then it would take an exponential amountof time.
We’d be waiting for the thunderstorm, so to speak.
On the other hand, if the spike is thin enough then, Farhi et al. showedthat the adiabatic algorithm can get past it in only polynomial time. It doesso by exploiting a well-known quantum phenomenon called Tunneling.
Popular articles explain tunneling by saying that a quantum particle canget through barriers that a classical particle could never get through. It would
probably be more accurate to say: “in places that a classical particle would
need exponential time to get through, sometimes a quantum particle can get
through in polynomial time.” In terms of interference, we can say, “The paths
that involve the particle not going over the spike interfere destructively andcancel each other out, leaving only paths where the particle does get over it.”
The phenomenon of tunneling is important in many
places in physics. For one thing, it’s why the sun canshine! Nuclear fusion requires hydrogen atoms to get super close before they realize that it’s energetically favorable for them to fuse. The trouble is, when they’re notquite so close, they strongly repel each other (because
both nuclei are positively charged). When quantum mechanics came along, it explained how, while the energy
barrier would prevent fusion classically, it still happens
because the nuclei are able to tunnel past the barrier.
Anyway, the 2002 paper of Farhi et al. was good news for the adiabatic
algorithm, but tunneling only helps if the spike is sufficiently thin. Since
then, we’ve learned more about the types of fitness landscapes for which the
adiabatic algorithm is expected to help. In a landscape like the one pictured
in Figure 26.4 simulated annealing and the adiabatic algorithm would bothhave trouble, and would both take an exponential amount of time.

228

LECTURE 26. THE ADIABATIC ALGORITHM

Figure 26.4: An optimization landscape where a very tall thick hill separates
the global minimum from the rest of the landscape. The thicker the barrier,the less helpful tunneling is in practice.
Or consider the fitness landscape in Figure 26.5 (we can only draw a 1dimensional cross-section, but imagine that all of the 2n solutions in an ndimensional hypercube have equal values except for the one good solution).
This would also take exponential time for both simulated annealing and theadiabatic algorithm to traverse. We actually already know this by the BBBV
Theorem—because in this case we’re effectively just querying a black box in
an attempt to find a unique marked item.

Figure 26.5: Black-box search style optimization landscape in which only asmall region of the landscape is a lower energy then the remaining (flat) landscape.
It turns out that if you’re clever about how you run the adiabatic algorithm,
you can achieve the Grover speedup in the case above, but not anything faster.
Indeed, the BBBV Theorem tells us that Ω(2n/2 ) steps are needed using theadiabatic algorithm or any other quantum algorithm. What’s cool is that justby knowing BBBV, without any physics, that the spectral gap has to decrease
exponentially.
Just like the expert who Farhi consulted was alluding to withhis wisecrack, physicists can use knowledge from quantum
algorithms to learn new things about spectral gaps.

26.2. THE ADIABATIC ALGORITHM

229

Figure 26.6: High-level sketch of the strategy for getting a Grover speedup
using the adiabatic algorithm. The key idea is that we only need to run thealgorithm slowly in the vicinity of the minimum eigenvalue gap.
OK, here’s a subtler question. Suppose the adiabatic algorithm had worked
to solve 3SAT in polynomial time. Would that have violated the BBBV Theorem? It turns out that the answer is no. The BBBV Theorem applies only to
black-box search. The Hamiltonian encoding a 3SAT instance contains richer
information than the black box considered by BBBV. In particular, it encodes
not merely whether each possible solution is satisfying or unsatisfying, butalso the number of clauses that it violates. A 2002 paper by van Dam, Mosca,
and Vazirani showed that that information alone is enough to reconstruct the
3SAT instance in polynomial time—and hence also to solve the instance inpolynomial time if we assumed (for example) that P = NP! This means that
there’s no hope of proving a black-box lower bound like BBBV in this setting.
We also know classical algorithms that can solve 3SAT in less than 2n/2
time, the best currently known is O(1.3n ). This is another way of seeing thatthe BBBV Theorem can’t encompass everything that it’s possible to do on
3SAT.
OK, let’s consider one more type of landscape: the type pictured in Figure26.7. Here a funny thing happens: simulated annealing gets into the local
minimum, but the algorithm then escapes it, crosses the plateau and reaches
the global minimum in polynomial time. Meanwhile the adiabatic algorithm
just keeps returning to the local minimum and takes exponential time to reachthe global minimum!
Sometimes a classical algorithm performs better.
There’s even further problem with establishing quantum speedups for adi-

230

LECTURE 26. THE ADIABATIC ALGORITHM

Figure 26.7: The adiabatic algorithm struggles with this sort of optimization
landscape while classical algorithms like simulated annealing have little difficulty.
abatic optimization, which is that classical computing is a moving target. A
classical computer is not limited to simulated annealing or any other specificalgorithm. Thus, even if we established that the adiabatic algorithm was
exponentially faster than simulated annealing for some class of “real-world”
optimization landscapes, we’d still need to compare against other classicalalgorithms, which might exploit detailed knowledge about the landscapes inquestion. Particularly relevant here is the Quantum Monte Carlo (QMC)
algorithm—which, despite its name, is a quantum-inspired algorithm thatruns on a classical computer. QMC is widely used in many-body physics.
We won’t explain QMC in any detail but will simply say that, even in theartificial cases where the adiabatic algorithm exponentially outperforms simulated annealing, recent work suggests that QMC can often match the adiabatic
algorithm’s asymptotic performance classically (albeit often with a much larger
constant prefactor). Research continues; there are other cases where adiabatic
optimization appears to do better than QMC.
So, what about the optimization landscapes that arise in real-world, industrial applications? Do there or don’t there exist any that the adiabatic algorithm
can traverse exponentially faster than any classical algorithm? The truth is,
we really don’t know yet. Reaching a consensus on this might require building
a scalable quantum computer and then testing the algorithm out!
Which brings us to our final point about the adiabatic algorithm. We’ve
talked about implementing the adiabatic algorithm on a conventional, gatebased quantum computer, by using Trotterization to approximate Hamiltonians by discrete sequences of gates. But you might complain that that approachseems roundabout. Since the underlying physics that describes our qubits isbased on Hamiltonians anyway, why not just directly map the adiabatic algorithm onto the continuous-time evolution of the qubits and skip the Trotter-26.2. THE ADIABATIC ALGORITHM

231

ization part? Indeed, the adiabatic algorithm could be seen not only as analgorithm but also as a proposal for the physical implementation of quantum
computers. An important result by Dorit Aharonov et al., from 2004, says thatadiabatic quantum computers would be universal for quantum computation;that is, able to solve all BQP problems efficiently.
There’s a venture-capital-backed startup called D-Wave that’s been building special-purpose devices to implement a noisy approximation to the adiabatic algorithm (called quantum annealing), using physical Hamiltonians
themselves. D-Wave’s latest model has about 2000 superconducting qubits.
You can encode an optimization problem of your choice onto their chip bychoosing the interaction Hamiltonian for each pair of neighboring qubits.
D-Wave was all over the press because they actually sold a
few of their machines to companies like Google and Lockheed Martin and were notorious for claiming that quantum
computing is “already useful in practice.” They were evenon the cover of Time magazine!
Professor Aaronson has been to D-Wave’s headquarters. Funnily enough their machine is literally a room-sized
black box (most of the hardware inside the box is devoted
to cooling; the actual qubits are on a chip no larger thanan ordinary computer chip).

Figure 26.8: D-wave’s room-sized
2000-qubit quantum annealing device.

Figure 26.9: Close-up view of
one D-Wave’s quantum annealing
chips.

So what’s the verdict? Experimental data shows that the D-Wave device
is indeed able to solve optimization problems encoded in its special format
at a speed that’s often competitive with the best known classical algorithms.

232

LECTURE 26. THE ADIABATIC ALGORITHM

Unfortunately, results over the past decade do not clearly show any quantum
speedup over the best classical algorithms. Why not? Roughly speaking there
are three main possible causes for the lack of speedup on D-Wave’s current
devices. As far as we know, the truth might be any combination of them.
I Inherent limitations of the adiabatic algorithm.

– Even if we had a perfect quantum computer, running at absolute
zero temperature, the minimum spectral gaps might simply be exponential small for almost all interesting optimization problems—
in which case, the adiabatic algorithm could provide only limited
speedups even in theory.
I Limitations in the quality of D-Wave’s qubits.
– Even if the minimum spectral gap were inverse-polynomial, it still
probably wouldn’t be constant. That is, it would presumably shrink
to zero as a function of the input size. This is a problem for thefollowing reason: it turns out that, if the temperature of the qubits
is such that the average amount of thermal energy is of the sameorder as the minimum eigenvalue gap, then we’ll typically see levelcrossings even if we run the adiabatic algorithm at the “right” speed.
The D-Wave qubits are cooled to about 10 milliKelvin. By normal
standards that sounds extremely cold, but it might not be coldenough to avoid level crossings on instances of interesting sizes!
What one really wants here is absolute zero—but of course, thecooling cost would increase enormously as one approached that,eventually becoming prohibitive.
I Stoquastic Hamiltonians.
– A Hamiltonian H is called stoquastic if all its off-diagonal terms arereal and non-positive. One can show that if H is stoquastic, then H
has a ground state involving nonnegative real amplitudes only. As aresult, it turns out that stoquastic Hamiltonians are often much easier than arbitrary Hamiltonians to simulate on a classical computer.
For example, the QMC algorithm mentioned earlier tends to work
extremely well for approximating the ground states of stoquastic
Hamiltonians, and less well for non-stoquastic Hamiltonians. Unfortunately D-Wave’s hardware has been limited to applying stoquastic Hamiltonians only. Thus, even if quantum annealing wereable to yield an exponential speedup at a fixed nonzero temperature (like 10 milliKelvin), it might be that it could only do so with
non-stoquastic Hamiltonians.

26.2. THE ADIABATIC ALGORITHM

233

This sounds pretty bad! Why is anyone optimistic that quantum computing
could scale even in principle? We’ll see why in the next lecture when we
explore the basics of quantum error-correction, a technique that has not yet
been demonstrated (by D-Wave or by anyone else), but that many researchers
expect will ultimately be necessary for scalable quantum computing.

Lecture 27:
rection

Quantum Error Cor-At the end of the last lecture we discussed some of the difficulties with achieving a quantum speedup using currently available quantum computing devices
such as the one manufactured by D-Wave’s. We saw how D-Wave’s devices
are cooled to 10 milliKelvin, but even that might be too hot and lead to toomuch decoherence and error! In the setting of adiabatic quantum computing
this shows up mostly as unwanted level crossings. Based on this you might
wonder if even 10 milliKelvin isn’t cold enough—if nothing short of absolute
zero and perfect isolation seem to suffice—then why should building a scalable
quantum computer be possible at all?
We need to separate two issues. First, there’s the “engineering challenge”
of building a scalable quantum computer. Everyone agrees that at a bareminimum it will be staggeringly hard to achieve the required degree of isolation
for thousands or millions of qubits when those qubits also need to interact witheach other in a carefully choreographed way. Maybe various practical problems
will prevent human beings from doing it in the next 50 or 100 years. Maybe it
will be too expensive. Theory alone can’t answer such questions. Then there’s
the question of whether anything prevents scalable quantum computing even in
principle. If quantum mechanics itself were to break down that could certainly
prevent quantum computing from being possible—but it would also represent
a much more revolutionary development for physics than “merely” building aquantum computer! So, short of a breakdown of quantum mechanics, on what
grounds have people argued that scalable quantum computers aren’t possible?
I Large entangled states are inherently fragile, so they might be impossible

to maintain.
– If only one qubit in the computer decoheres then the entire system
could decohere.
– If only one qubit in a “Schrödinger cat” type state leaks out into
234

27.1. CLASSICAL ERROR CORRECTION

235

the environment the quantum coherence between the |Alivei and|Deadi components is destroyed.
I Applying unitary gates may produce lots of errors, which will snowballover time.
– Maybe your Rπ/4 gate rotates by 46◦ instead of 45◦ . If so, then overmany applications of the gate the errors would pile up.
If you pick up a CS textbook from the 1950’s you’ll see
plenty of discussion surrounding “analog vs digitalcomputers”. The disappearance of analog computersfrom the scene had much to do with the difficulty ofcorrecting continuous errors. Is a quantum computer
simply another kind of analog computer? We’ll see
the answer shortly.
I The No-Cloning Theorem presents inherent limits to error-correction.

– Classically the most simple way to deal with errors is by repetition.
Because of the No-Cloning Theorem it seems that we can’t do thesame with quantum computers.
However, despite these potential problems there were fundamental discoveries in the mid-1990s that addressed all three of these concerns. These discoveries convinced most physicists and computer scientists that, short of somerevolutionary change to known physics, the difficulties of building a scalable
QC are “merely” difficulties of engineering and not of principle.

27.1

Classical Error Correction

Before discussing Quantum Error Correction let’s briefly review how error
correction works classically.
You could take a whole course about this subject. We’ll do
the 5-minute version here.
The most simple form of classical error correction is based on the idea of
introducing redundancy by directly using repetition. The simplest repetitionbased error correcting code is the 3-bit Repetition Code which lets us
encode one logical bit using 3 physical bits. We encode a logical 0, denoted
0̄, as 000. Likewise we encode a logical 0, denoted 1̄, as 111. We call the bit

236

LECTURE 27. QUANTUM ERROR CORRECTION

strings selected to encode the logical states the codewords. We claim that thiscode lets us both detect and correct an error in any one physical bit. Givenan 3-bit input string x = x0 x1 x2 we do error detection by checking whether
x0 = x1 = x2 . Assuming that at most one bit experiences an error we’ll beable to identify it. If we detect an error (say in x0 ) we can do error correction
by setting x = MAJORITY(x0 , x1 , x2 ).
It can be shown that any code that can both detect and correct a single
bit-flip error must use at least 3 bits. By contrast, if we just want to detect asingle bit-flip error and not correct it 2 bits suffice.
More sophisticated codes are able to encode many logicalbits at once, not just a single bit, while detecting and correcting a large number of errors (say, any 10% of the physical bits being flipped). In this lecture, though, we’ll focus on
encoding just a single bit (or qubit) and protecting against
just a single error in order to get the main conceptual points
across.

Figure 27.1: Graphical representation of the 3-bit bit-flip code. Each cornerof the cube is labeled with a particular 3-bit string, with adjacent corners
differing in exactly one bit. The bottom (green) cloud encloses the set ofstates reachable from 000 when at most one bit-flip occurs. The upper (blue)
cloud encloses the set of states reachable from 111 when at most one bit-flip
occurs. In order for our error correcting code to work, the set of states in thetwo clouds cannot have any overlap.

27.1. CLASSICAL ERROR CORRECTION

237

A useful geometric picture for why the 3-bit repetition code works is given
in Figure 27.1. We can associate each of the 8 3-bit strings with a corner of acube selected such that each point differs from its neighbor in exactly one place(the hamming distance is 1). Essentially, the code simply picks two points on
the cube that are maximally far from each other and declares one to be theencoding of 0 and the other to be the encoding of 1. This idea generalizes
to codes with longer codewords, in which case the set of possible bit strings
correspond to points on the boolean hypercube.
000 and 111 can each get corrupted to any point in theirrespective “clouds”, but since the two “clouds” don’t overlap we’re able to correct the error. We’ll seek to replicate
this behavior in the quantum case.

27.1.1

Classical Fault-Tolerance

In the early days of classical computing there were skeptics who doubted thatthe technology would ever scale. “Obviously,” they said, “once the machine
has enough vacuum tubes some of them will fail and that will cause the entire
computer to fail.” John von Neumann was annoyed by this line of reasoning,
so he went off and proved a result we now know as The Classical FaultTolerance Theorem. Von Neumann showed given logic gates (like AND,OR, and NOT) which fail independently with some probability  so long as
 is sufficiently small it’s possible to build a reliable circuit for any Booleanfunction f . Moreover, the circuit only needs to be a small factor larger thana circuit for f built of perfect gates. Informally this means you can build areliable computer out of unreliable parts.
Admittedly, if the output of the circuit is just a single bit then that bit
can’t possibly take the correct value with probability greater than 1 − —forwhat if the very last gate is erroneous? However, one way to deal with thisissue is to let the output be a long string of bits which is then processed by(say) a simple majority to get the value of f . This final majority computation
is assumed to be error-free.
How did von Neumann prove the classical fault-tolerance theorem? We
won’t go through all the details, but the basic idea is to use the 3-bit repetitioncode recursively. Doing so pushes the probability of an error down further andfurther by taking a majority of majorities (on 9 bits for two levels of recursion),or a majority of majorities of majorities (on 27 bits for three levels), and so on.
Now, this seems to raise a conceptual puzzle: our error-correction circuits will

238

LECTURE 27. QUANTUM ERROR CORRECTION

themselves be subject to error, so when we compute these recursive majorities
won’t we simply be introducing more errors than we correct? Fortunately, von
Neumann found that as long as the physical error probability  is small enougheach round of error-correction will be a “net win,” making things better rather
than worse.
Anyway, von Neumann’s whole idea ended up being mostly unnecessary
when transistors replaced vacuum tubes, since transistors err with such minuscule probabilities (in your entire computer, with its billions of transistors,
perhaps one transistor will output a wrong result per year when it’s hit by acosmic ray).
Could such a thing happen with quantum computing? That is, a “QC transistor,” which implements 1 and 2-qubit gates so reliably that error correctionis then superfluous? Maybe! In the final lecture we’ll discuss an approach toquantum computing called topological quantum computing which some physicists think could get us part of the way towards this dream. For now, though,we seem to be stuck in von Neumann’s situation with quantum gates that dohave significant probabilities of error.
Since we discussed D-Wave in the last lecture: a potentially
fateful decision that D-Wave made early on was that they
weren’t going to do any error correction. However, even DWave might now be coming around to the view that somedegree of error correction is necessary.
Crucially, until you get over the hurdle of error correction, it may not look
like your quantum computer is doing much of anything useful. This is the main
reason why progress in experimental quantum computing has often seemedslow (with the world record for Shor’s algorithm remaining the factorizationof 21 into 3 × 7, etc. . . ). Many people believe that practically important
speedups will come only after we’ve overcome this hurdle.

27.2

Quantum Error Correction

You might worry that nothing like the 3-bit repetition code could possibly
work in the quantum case, because quantum errors form a continuum; it’s nota yes-or-no question whether an error has happened. For example, we might
get the error|0i →√1 − 2 |0i +  |1i .

(27.1)

27.2. QUANTUM ERROR CORRECTION

239

It’s said, only half-jokingly, that “80% of the work of building a quantum computer is reliably implementing the identity transformation.”
Early in this course, though, we saw that the Quantum Zeno Effect (see Section 4.3) was a way to keep adrifting qubit in check. The trick is to just to keep measuring the qubit in the |1i , |1i} basis. If you get |1i thencorrect it to |0i. If you get |0i then even if there had
been an error now there’s not!
It’s like the joke where someone calls 911 to report a deadbody and the operator asks the caller if they’re sure theperson is actually dead. Gunshots are heard; then the callersays, “OK, now what?”
But the quantum Zeno effect only solves the problem of quantum errorcorrection if the following two things are true:
I The only thing we’re worried about is continuous drift (rather than, e.g.,

discrete bit-flips).
I We know a basis in which our qubit is supposed to be one of the basis
vectors.
So how can we go further? If we only needed to correct bit-flip errors we
could just use a quantum analogue of the 3-bit repetition code. Namely, we
introduce the codewords (now quantum states instead of bit strings)|0̄i = |000iand|1̄i = |111i(27.2)

But bit-flip errors aren’t the only things we’re worried about! For an
example of what else could go wrong let’s look at the encodings of |+i and|−i under the above 3-bit repetition code:|+̄i →|000i + |111i
√
2

and

|−̄i →|000i − |111i√2(27.3)How many qubits of |+̄i do we need to act on to convert it to |−̄i? Only one!
It suffices to apply a Z gate to any qubit. We call such an error a phaseflip error. You might think the problem is even worse still. Suppose we did
manage to design a code that could correct both bit-flip errors and phase-flip
errors. Even then, aren’t there infinitely many other ways for a qubit to err?

240

LECTURE 27. QUANTUM ERROR CORRECTION|ψi = α |0i + β |1i
|0i
|0i

•

•




α |000i + β |111i

Figure 27.2: Circuit for encoding an input state in the 3-qubit bit-flip code.
Won’t we need to add an infinite amount of additional redundancy to our codeto account for all these different error modes?
Here’s where a little piece of magic comes in and saves us. It turns out that
if a quantum error-correcting code protects against both bit-flip and phase-flip
errors then that’s automatically enough to protect against all possible 1-qubit
errors. Why? Without loss of generality let’s assume that we have an error
on the first qubit of the entangled state |ψ0 i|ψ0 i = α |0i |vi + β |1i |wi(27.4)A bit-flip error on the first qubit would result in|ψ1 i = α |1i |vi + β |0i |wi(27.5)A phase-flip on the first qubit would result in|ψ2 i = α |0i |vi − β |1i |wi(27.6)

And both a bit-flip and a phase flip error (we’ll call it a bit-phase flip for short)
would result in|ψ3 i = α |1i |vi − β |0i |wi(27.7)The key observation is that these four states constitute a basis for the 4dimensional subspace of all possible states that you could reach from |ψ0 i bytransformations on the first qubit. By linearity, this means that any linear
transformation (be it unitary or even non-unitary) that you apply to the first
qubit can be expanded as a superposition of bit-flip, phase-flip and bit-phaseflip errors occurring to our qubit.
This is extremely similar to superdense coding. In bothcases entanglement doubles the number of independent transformations that we can apply to a given qubit, while leaving
a perfect record of which transformation was applied.

27.2. QUANTUM ERROR CORRECTION|ψi = α |0i + β |1i

•

•

|0i

H
H

|0i

H

241





α |+ + +i + β |− − −iFigure 27.3: Circuit for encoding an input state into the 3-qubit phase-flip
code.
So, the simplest possible goal of quantum error-correction is now as follows: assuming that the error was on the first qubit only get us back to |ψ0 ifrom wherever we might happen to be in this 4-dimensional “error subspace.”
Simply measuring all the qubits would be a really bad idea—since even if that
told us where we were in the error subspace it would be a “pyrrhic victory”
that destroyed our quantum state in the process. Instead, maybe we can do ameasurement that causes our state to collapse to one of the four basis vectors
we saw {|ψ0 i , |ψ1 i , |ψ2 i , |ψ3 i}. Ideally this measurement should also returna flag indicating which of the states we collapsed to so that we can do theappropriate correction operation. Before we explain how to perform such ameasurement, known as syndrome detection, we first need a code which candetect and correct against both bit-flip, phase-flip and bit-phase flip errors.
For starters, if we just wanted to detect and correct just phase-flip errors we
could do so using a code which is effectively the 3-qubit repetition code except
in the Hadamard basis|+̄i = |+i |+i |+i

and|−̄i = |−i |−i |−i(27.8)OK, but just like the 3-qubit bit-flip code failed to protect against phaseflip errors, this code fails to protect against bit-flip errors. We can see this by
first writing the logical states |0̄i and |1̄i using the above code11|0̄i = √ (|+̄i + |−̄i) = √ (|+i |+i |+i + |−i |−i |−i)221
= (|000i + |011i + |101i + |110i)
21
1|1̄i = √ (|+̄i − |−̄i) = √ (|+i |+i |+i − |−i |−i |−i)221
= (|001i + |010i + |100i + |111i)
2(27.9)

We now observe that by applying a bit-flip to any qubit we can change |0̄i

242

LECTURE 27. QUANTUM ERROR CORRECTION

to |1̄i or vice versa. This observation brings us to our first serious quantum
error-correcting code.

27.2.1The Shor 9-Qubit CodeIn 1995 Peter Shor proposed the first quantum error correction code able tocorrect against arbitrary single-qubit errors. His proposal was, simply put,to combine the bit-flip and phase-flip codes we’ve seen. For the first level of
encoding, we’re going to ensure protection from phase flip errors by encoding
our logical |0̄i and |1̄i states using the 3-qubit phase flip code:|0̄i = |+i |+i |+i

and|1̄i = |−i |−i |−i .

(27.10)Note we’re labeling our codeword differently than we did in Equation 27.8
(that’s ok, we have some freedom in how we choose to label the codewords).
As we noted above though, this encoding is susceptible to bit-flip errors. To
protect from bit-flip errors we take each of the states comprising the codewords
above and encode those using the 3-qubit bit-flip code, which yields:|0̄i =|000i + |111i
√
2

⊗3


and

|1̄i =|000i − |111i√2

⊗3(27.11)

We claim that this code lets us detect and correct a bit-flip or a phase-flip(and hence, any possible error) on any one of the 9 qubits.
How does this detect and correct bit-flip errors? We just need build aquantum circuit that checks whether all 3 of the qubits in a given block havethe same value and if they don’t it sets the wayward qubit equal to the majorityof all 3 qubits in the block. We then apply that circuit to each of the 3 blocks
separately. The circuit for performing this check can be found in Figure 27.5.
More interestingly, how does this code also detect and correct phase-flip
errors? We can build a quantum circuit that computes the relative phasebetween |000i and |111i within each block, checks whether all 3 phases havethe same value, and sets any wayward phases equal to the majority of all 3phases. A circuit for performing this check can be found in Figure 27.6.
We can combine both of the error checking circuits in Figures 27.5 and27.6. We call the resulting circuit the syndrome detecting circuit. We first
apply the circuit from 27.5 to each of the three blocks of qubits encoded withthe bit-flip code in order to fix any bit-flip errors in these blocks. We thenapply a version of 27.6 to detect phase-flip errors on a block-by-block basis.
Note that a phase-flip on any qubit in a block modifies the overall state of the27.2. QUANTUM ERROR CORRECTION••|ψi = α |0i + β |1i

243

H

•

•

H

•

•

H

•

•

|0i
|0i
|0i
|0i
|0i
|0i
|0i
|0i
Figure 27.4: Encoding circuit for Shor’s 9-qubit code. Indentation meant toemphasize the concatenated nature of the encoding scheme. Reproduced fromNielsen and Chuang’s “Quantum Computation and Quantum Information.”

α |000i + β |111i











•

X ¬x∧y
•

•

X x∧y
•

X x∧¬y

|0i

x

|0i

y

Figure 27.5: Circuit for detecting and correcting bit-flip errors on an encoded
input state. The final round of X gates is applied conditionally based on thevalues of x and y observed.

244

LECTURE 27. QUANTUM ERROR CORRECTION

α |000i + β |111i











H
H

•
•

•
•

H

X ¬x∧y

H

X x∧y

H

X x∧¬y

H

|0i

x

|0i

y

Figure 27.6: Circuit for detecting and correcting phase-flip errors on an encoded input state. The final round of X gates are applied conditionally basedon the values of x and y observed.
qubits in the block in exactly the same way (you can verify this by applying
a phase-flip error to the phase-flip code codewords and seeing what happens).
The final measurements applied to the ancillary qubits in Figure 27.7 produce
an output string whose value depends on precisely which error occurred andon which qubit; this output string is called the syndrome.
Table 27.1: Syndrome-error correspondence for the bit-flip code. Subscripts
on the errors denote which qubit the error occurred on.
x

y

Error

0
1
1
0

0
0
1
1

No Error
X0
X1
X2

The complete table of possible syndromes and the corresponding errors
is too long to warrant including here, but in Tables 27.1 and 27.2 we givethis table for the bit-flip and phase-flip codes respectively—since the Shor
code is a combination of these two codes, the syndrome-error correspondence
follows from these two tables in a fairly straightforward way. One of the
key requirements is that there be a one-to-one correspondence between the
syndromes and the errors (otherwise we couldn’t reliably reverse the errors),
which we can see from Tables 27.1 and 27.2 is satisfied here.
The measurements we apply to the ancilla not only have the effect of giving us information about which error occurred, they also have the effect of27.2. QUANTUM ERROR CORRECTION

245

Table 27.2: Syndrome-error correspondence for the phase-flip code. Subscripts
on the errors denote which qubit the error occurred on.
x

y

Error

0
1
1
0

0
0
1
1

No Error
Z0
Z1
Z2

collapsing our state such that only the error corresponding to the syndrome
occurred—subject to the assumption that we really only had one qubit experience an error. We recommend trying this out directly for an arbitrary logicallyencoded input state and a few different errors. The reason the state collapses
following the measurement is that our syndrome detection circuit generates
entanglement between the qubits we use to encode our state and the ancillaqubits we use to detect the errors.
There is no small irony in the fact that in our battle against
decoherence—resulting from unwanted entanglement between
our system and the environment—one of our main weapons
is the strategic use of more entanglement!
You can check that both of the operations above work not just for |0̄i and|1̄i, but for arbitrary superpositions of the form α |0̄i + β |1̄i. So, the above
will fix any stray unitary transformations that get applied to any one qubit.
But what about errors that involve decoherence or measurement? We claimthat once we’ve handled all possible unitary transformations, we’ve automatically handled all possible errors—because an arbitrary error might turn purestates into mixed states, but it still keeps us within the same 4-dimensional
subspace. The measurements performed at the end of the circuits in Figure27.7 still project us down to one of the orthogonal states corresponding tosome particular error occurring. We can still get back to our original state|ψ0 i by applying bit flips and phase flips as needed.
Shor’s 9-qubit code was the first quantum error correcting code. Not longafterward Andrew Steane found a shorter code that could also detect andcorrect any error on 1 qubit. Steane’s code encoded 1 logical qubit into only 7
physical qubits. Then, Raymond Laflamme and others found codes that used
only 5 qubits. Five qubits turns out to be the least possible if you want bothto detect and to correct an arbitrary 1-qubit error, just like 3 bits is the least

246

LECTURE 27. QUANTUM ERROR CORRECTION•

X ¬a∧b••Z g∧¬hX a∧b•

X a∧¬b

|0i

a

|0i

b
•

X ¬c∧d
•

•

Z g∧h

X c∧d
•

X c∧¬d

|0i

c

|0i

d
•

X ¬e∧f••Z ¬g∧hX e∧f•

X e∧¬f

|0i

e

|0i

f
|0i

H

|0i

H

•
•

H

g

H

h

Figure 27.7: Quantum circuit for performing the full syndrome detection anderror correction procedure for the Shor 9-qubit code. We’ve structured thecircuit to highlight the concatenated nature of the error correction. We first use
the circuit from 27.5 on each block of 3 qubits to detect and correct any bit-flip
errors. We then use a version of the syndrome detection circuit in 27.6—we’ve
made liberal use of the identities X = HZH and (H⊗H)(CNOTi→j )(H⊗H) =CNOTj→i , where the subscripts on CNOTi→j denote that qubit i controls qubit
j, to reduce the size of the circuit for the sake of brevity—to detect and correct
any phase-flip errors.

27.2. QUANTUM ERROR CORRECTION

247

possible for a classical error correcting code. We won’t prove this.
In the next lecture we’ll discuss the stabilizer formalism, which gives us
an amazingly compact and efficient notation for manipulating these sorts ofquantum error-correcting codes.

27.2.2

Quantum Fault Tolerance

So, we can encode a qubit, let the qubit sit around passively and protect itagainst a single physical error. How about doing a full fault tolerant quantum
computation? That’s the subject of the famous Quantum Fault-Tolerance
Theorem, also known as the Threshold Theorem. Proved independently
by several groups (Aharonov & Ben-Or / Zurek et al. ∼1996), the theorem
says the following: suppose that in your quantum computer, each qubit fails
at each time step with independent probability  (where “fails” could mean,e.g., it is replaced by the maximally mixed state). Then assuming we’re able
to:
I Apply gates to many qubits in parallel.
I Measure and discard bad qubits.
I Pump in fresh |0i qubits
I Do extremely fast and reliable classical computation.

we can still solve any problem in BQP, so long as  is sufficiently small. Moreover, we can simulate any error-free quantum circuit with only an additional
polylog(n)-factor overhead in the number of gates.
The initial estimates for  were ∼ 10−6 . That’s since been
improved by 3-4 orders of magnitude, depending on the assumptions you’re willing to make.
Since its discovery, the threshold theorem has set much of the research
agenda for experimental quantum computing. It says that once we can decrease error below a certain threshold, we’ll effectively be able to make it arbitrarily small by applying multiple recursive layers of quantum error-correction.
Journalists often try to gauge progress in experimental quantum computing by
asking about the number of qubits, but at least as important is the reliabilityof the qubits. It’s reliability that will determine when (if ever) we cross thethreshold that would let us get to arbitrarily small error and add as many
additional qubits as we liked.
No one there yet, but lots of progress is being made on two fronts:

248

LECTURE 27. QUANTUM ERROR CORRECTION

I Making physical qubits more reliable– In the earliest quantum computing experiments, the probability of
failure per qubit per time step was of order ∼ 1, meaning thatthe quantum state would barely remain coherent at all. But overthe last twenty years, there have been improvements in reliability
by several orders of magnitude (in multiple proposed architectures
including superconducting qubits and trapped ions). Today, anyone can access a 5-qubit superconducting device over the Internet(IBM’s “Quantum Experience”) that has decoherence rates that
weren’t been achievable a decade ago. Meanwhile, a few years ago
the group of John Martinis at Google demonstrated decoherence
rates for one or two qubits in isolation that are already below thecurrent fault-tolerance thresholds. So is the problem solved? Unfortunately not, because integrating more qubits on a single chippushes the decoherence rate back up. The challenge now is to figure out how to scale up to 100 or 300 qubits while still keeping theerror rate down.
I Inventing better error-correcting codes and fault-tolerance schemes– There are many tradeoffs here. For example, it’s now known (atleast heuristically) how to handle error rates of up to 3-5%, but only
via fault-tolerance schemes that use thousands of physical qubits forevery one logical qubit. One big challenge is to invent schemes that
can handle large error and also have low overheads. Topologicalqubits, could also help with this tradeoff.
Here’s one milestone that has been achieved fairly recently, in 2016 theresearch groups of Michel Devoret and Robert Schoelkopf at Yale reported theuse of a quantum error correcting code to keep a logical qubit alive for longer
that the physical qubits comprising it.

Lecture 28:
malismThe Stabilizer For-In this lecture we’ll see a beautiful formalism that was originally invented todescribe quantum-error correcting codes, but now plays many different roles
in quantum computation. First, some definitions:
10
I Stabilizer Gates are the gates CNOT, Hadamard and S =
(also
0 i
called the “Phase Gate”).
I Stabilizer Circuits are quantum circuits made entirely of stabilizer
gates.
I Stabilizer States are the states that a stabilizer circuit can generatestarting from |0 · · · 0i .
We briefly met stabilizer gates earlier in the course when we discussed
universal quantum gate sets and needed to include a warning that the set
S = {CNOT, H, S} is not universal. This failure of universality might be surprising. After all, the set S seems to have everything we need: the Hadamard
gate can create superpositions, CNOT acts on two qubits and can create complicated entangled states and S can even add complex phases. What’s more,
many of the weird quantum effects and protocols that we saw in this course
can be demonstrated entirely using stabilizer gates. Examples include: superdense coding, quantum teleportation, BB84 quantum key distribution, Wiesner’s quantum money, the Deutsch-Jozsa algorithm, the Bernstein-Vazirani
algorithm and the Shor 9-qubit code.
So then, what prevents S from being universal? Well, if you try playing
around with the CNOT, Hadamard and S gates you’ll notice that you tend
to reach certain discrete states, but never anything between them. You’llalso notice that whenever you create an n-qubit superposition that assigns
nonzero amplitudes to the strings in some set A ⊆ {0, 1}n , it’s always an
249

250

LECTURE 28. THE STABILIZER FORMALISM

equal superposition over A (possibly with ±1 or ±i phases). Furthermore, A
is always an affine subspace of F2n (so in particular, |A| is always a power of2).
With only 1 qubit, the H and S gates can only get us to 6 states in total(ignoring global phases), via the reachability diagram shown on the right.
These 6 states, {|0i , |1i , |+i , |−i , |ii , |−ii}, are the 1-qubit stabilizer states.
What about with two qubits? Now you can reach some more interesting√√or |01i−i|10i. But these always follow certain patterns as
states, like |00i+i|11i
2
2
mentioned above. For example, they’re always equal superpositions over anumbers of strings that is a power of 2. Moreover, a measurement of a given
qubit in the {|0i , |1i} basis always produces one of the possible outcomes:
I |0i with probability 1
I |1i with probability 1
I |0i and |1i with equal probabilities

So what gives? In order to explain,it will help to define a few concepts.
We say that a unitary U stabilizes a pure state |ψi if U |ψi = |ψi. In otherwords, if |ψi is an eigenstate of U with eigenvalue +1. Crucially, global phasematters here! If U |ψi = – |ψi, then U does not stabilize |ψi.
Notice that if U and V both stabilize |ψi, then any product of them, likeU V or V U , also stabilizes |ψi. Likewise, if U stabilizes |ψi, then its inverse
U −1 must also stabilize |ψi. The identity matrix stabilizes everything. Since
matrix multiplication is associative, this means that the set of unitaries thatstabilize |ψi forms a group under multiplication.
The next ingredient we need is the Pauli Matrices. We’ve already encountered these four matrices, and they come up constantly in quantum physics.
To remind you, they are:


1 0
I=
0 1





0 1
X=
1 0





0 −i
Y =
i 0






1 0
Z=
0 −1

(28.1)

Notice that these matrices match up with the errors we needed to worry about
in quantum error-correction (the last one up to a global phase).
No Error → I

Bit-flip → X

Phase-flip → Z

Bit-flip + Phase-flip → Y

Note that for Y gate this is equivalent to the bit-phase-flip error we saw inthe previous lecture up to a global phase. The Pauli matrices satisfy several

251
beautiful identities:
XY = iZY X = –iZY Z = iXZY = –iX
ZX = iY
XZ = –iY22
2
X =Y =Z =I(28.2)

If you’ve seen the quaternions, you might recall that they’re defined using
the same kinds of relations. This is not a coincidence!
Nothing is a coincidence in math!
In addition, all four Pauli matrices are both unitary and Hermitian. So what
does each Pauli matrix stabilize?
I stabilizes everything
X stabilizes |+i
Z stabilizes |0i
Y stabilizes |ii–I stabilizes nothing–X stabilizes |−i–Z stabilizes |1i–Y stabilizes |−ii

So each of the six 1-qubit stabilizer states has a corresponding Pauli matrix
that stabilizes it.
Next, given an n-qubit pure state |ψi, we define |ψi’s stabilizer group to be
the group of all tensor products of Pauli matrices that stabilize |ψi. We know
this is a group since the set of Pauli matrices is closed under multiplicationand so is stabilizing |ψi. Stabilizer groups have the additional property of
being Abelian (the group multiplication operation is commutative).
To illustrate, the stabilizer group of |0i is {I, Z}. The stabilizer group of|+i is {I, X}. The stabilizer group of |0i ⊗ |+i is the Cartesian product of
those two groups:{I ⊗ I, I ⊗ X, Z ⊗ I, Z ⊗ X}.

(28.3)As a convention, we’ll omit the ⊗’s from now on when unambiguous. For theexample above this convention gives us {II, IX, ZI, ZX}.
For a slightly more interesting example, what’s the stabilizer group of a
Bell pair? We know XX is in it because(X ⊗ X) |00i + (X ⊗ X) |11i
|11i + |00i
|00i + |11i
√
√
√
=
=
.
2
2
2

252

LECTURE 28. THE STABILIZER FORMALISM

By a similar argument, –Y Y must be in the group. We can get another elementby multiplying these two elements (remember the product of two stabilizers isa stabilizer)(XX)(–Y Y ) = (X ⊗ X)(–Y ⊗ Y ) = –(iZ) ⊗ (iZ) = Z ⊗ Z = ZZ√
is {II, XX, –Y Y, ZZ}. You can check that it
So the stabilizer group of |00i+|11i
2
doesn’t contain anything else. You can similarly compute the stabilizer group√of |00i−|11ito be {II, –XX, Y Y, ZZ}.
2
Now, here’s an amazing fact, which we won’t prove: the n-qubit stabilizer
states are exactly the n-qubit states that have a stabilizer group of size 2n . So
the 1-qubit stabilizer states are those states with a 2-element stabilizer group,the 2-qubit stabilizer states are those states with a 4-element stabilizer groupand so on. This is a completely different characterization of the stabilizer
states, which gives deeper insight into their structure. It makes no mention ofstabilizer circuits, but tells us something about the invariant that stabilizer
circuits are preserving.
OK, so suppose we have an n-qubit stabilizer state which (by the above)
has a 2n -element stabilizer group G. Then here’s the next thing we might wantto know: How can we succinctly specify G? In particular we want to knowwhether G always has a small generating set—that is, a few elements fromwhich we can get all the others by multiplication. The answer turns out to be
yes—indeed, every finite group G has a generating set with at most log2 (|G|)
elements (proof left as an exercise).
More concretely, given any n-qubit stabilizer state, its stabilizer group isalways generated by only n elements (i.e., signed tensor products of Paulimatrices). So, to specify a stabilizer group (and hence, a stabilizer state) you
only need to specify n generators. Let’s see an example. To specify the Bellpair, which has stabilizer group {II, XX, –Y Y, ZZ}, it’s enough to give thefollowing generating set:


XX
ZZ

We could also give a different generating set, like


XX
−Y Y
How many bits does it take to store such a generating set in your computer?
Well, there are n generators and each one takes 2n + 1 bits to specify: 2 bits

28.1. THE GOTTESMAN-KNILL THEOREM

253

for each of the n Pauli matrices plus 1 additional bit for the sign. So the total
number of bits is n(2n + 1) = 2n2 + n = O(n2 ). Naı̈vely writing out the entire
amplitude vector or the entire stabilizer group would have taken ∼ 2n bits, so
we’ve gotten an exponential savings. We’re already starting to see the powerof the stabilizer formalism.

28.1

The Gottesman-Knill Theorem

But the power of the stabilizer formalism turns out to go much further. Around1998, Daniel Gottesman and Manny Knill proved the Gottesman-Knill Theorem. This theorem says that there’s a polynomial-time classical algorithm
to simulate any stabilizer circuit that acts on a stabilizer state (e.g. |0 · · · 0i).
Here “simulate” means pretty much anything you could ask for: you can compute the probability of any possible sequence of measurement outcomes or you
can simulate the measurement outcomes if given access to a random bit source.
A pessimistic interpretation of this theorem is that stabilizer states and gates, by themselves, are useless for producing superpolynomial quantum speedups.
So, how does the classical simulation work? In a nutshell it works bykeeping track at each point in time of a list of generators for the current
state’s stabilizer group. The algorithm then updates the list of generators
whenever a CNOT, Hadamard, Phase, or measurement gate is applied.
Almost the only time that Professor Aaronson (being a theorist) ever wrote code that other people actually used waswhen he did a project in grad school for a computer architecture course. He wrote a fast simulator for stabilizer circuits called CHP which could handle thousands of qubits on
a normal laptop (limited only by the available RAM). The
challenge of actually implementing the Gottesman-Knill algorithm in an optimized way led to the discovery of an evenfaster classical algorithm for simulating stabilizer circuits,
so Aaronson ended up publishing a paper with Gottesman
about this. Truth be told, this project had very little to
do with computer architecture; he’s still not sure why theprofessor accepted it!

254

28.1.1LECTURE 28. THE STABILIZER FORMALISM

The Gottesman-Knill Algorithm

So how does the Gottesman-Knill algorithm work? For simplicity, let’s assume
the initial state is |0 · · · 0i. Then the first step is to find a stabilizer representation (that is, a list of generators) for |0 · · · 0i. We know the stabilizer groupcontains I · · · I, but we won’t put that into the generating set (it’s implied).
Since |0i is a +1 eigenstate of Z you can check that the following generating
set works:
ZIII · · · I
IZII · · · I IIZI · · · I 




..


.
IIII · · · Z
For purposes of the algorithm it’s useful to write these lists of generators
in a slightly different way which we call the Tableau Representation. Here
we’ll keep track of two n × n matrices of 1’s and 0’s (as well as n signs). The
two matrices can be combined entrywise to represent an {I, X, Y, Z} matrix
like the one above. For the state |0000i the tableau representation is given by
the following:
+
0 0 0 0 1 0 0 0
+ 
 0 0 0 0 0 1 0 0 (28.4)
0 0 0 0 0 0 1 0 +
0 0 0 0 0 0 0 1+
In the tableau above, each row represents a particular generator of the stabilizer gorup. The first column gives the overall sign of each generator. Of
the remaining columns, the first half of the columns (the second through fifth
columns above) are the “X-matrix” and the second half of the columns are
the “Z-matrix.” The values in the ith position of some row of the X and Z
matrices specify the the corresponding Pauli matrix in the ith position of thegenerator’s tensor product. A 0 in both the X and Z-matrices represents an
identity in the generator. A 1 in the X-matrix and 0 in the Z-matrix or viceversa represents either an X or a Z respectively. Finally, a 1 in both the X
and Z matrices represents a Y in the generator. Thus, the first row of theabove tableau represents the generator +ZIII, the second +IZII, the third+IIZI and the fourth +IIIZ. So this is just another way to represent thegenerating set {ZIII, IZII, IIZI, IIIZ} for the state |0000i.
We’re now going to provide rules for updating this tableau representation
whenever a CNOT, Hadamard, or Phase gate is applied. We won’t prove that28.1. THE GOTTESMAN-KNILL THEOREM255

the rules are correct, but you should examine them one by one and see if you
can convince yourself. We’re also going to cheat a little. Keeping track of
the +’s and –’s is tricky and not particularly illuminating, so we’ll just ignore
them. What do we lose by ignoring them? Well, whenever measuring a qubit
has a definite outcome (say, either |0i or |1i), we need the +’s and −’s tofigure out which of the two it is. On the other hand, if we only want to knowwhether measuring a qubit will give a definite outcome or a random outcome(and not which definite outcome in the former case), then we can ignore thesigns.

256

LECTURE 28. THE STABILIZER FORMALISM

The Algorithm:
I To apply H to the ith qubit:– Swap the ith column of the X-matrix and the ith of the Z-matrix.
This should be pretty intuitive: the whole point of the
Hadamard gate is to “swap the X and Z bases.”
I To apply S to the ith qubit:– Bitwise XOR the ith column of the X-matrix into the ith column ofthe Z-matrix.
I To apply CNOT from with the ith qubit as the control and the j th as thetarget:– Bitwise XOR the ith column of the X-matrix into the j th columnof the X-matrix.
– Bitwise XOR the j th column of the Z-matrix into the ith column ofthe Z-matrix.
The first of these rules seems reasonable enough. For
the second rule, we need to remember that a CNOT
from i to j is equivalent to a CNOT from j to i whenviewed in the Hadamard basis!
I Finally, whenever the ith qubit is measured in the {|0i , |1i} basis themeasurement will have a determinate outcome if and only if the ith column of the X matrix is all 0’s.
There are also rules for updating the tableau in case the measurement outcome
is not determinate, but we won’t cover them here.
Here’s another cool fact: the number of basis states that have nonzero
amplitudes is just 2k , where k is the rank of the X-matrix. In the example inEquation 28.4, rank(X) = 0, corresponding to the fact that our “superposition” only contains a single basis state, namely |0000i.

28.2. STABILIZER CODES

|0i

257

H

•

S

|0i
Let’s test this all out by keeping track of the tableau for the circuit above.
We start with the state |00i which has the tableau representation
0 0 1 0.
(28.5)
0 0 0 1
Applying the Hadamard to the first qubit has effect of swapping the firstcolumns of the X-matrix and Z-matrix.

1 0 0 0(28.6)
0 0 0 1
You could convert this back into the generators by saying that the current
state is the one generated by +XI and +IZ; this makes sense since those do
indeed generate the stabilizer group for |+i |0i. Now, to apply the CNOT we
bitwise XOR the first column in the X-matrix into the second column in the
X-matrix and likewise bitwise XOR the second column in the Z-matrix into
the first column in the Z-matrix. This results in the tableau
1 1 0 0.
(28.7)
0 0 1 1
The generators corresponding to this tableau are {XX, ZZ}, which as we saw
earlier are indeed the stabilizer generators for a Bell pair as we expect. Finally,
we apply the Phase gate by bitwise XORing the first column in the X-matrix
into the first column of the Z-matrix. This results in the tableau
1 1 1 0.
(28.8)
0 0 1 1This final tableau corresponds to the generators {Y X, ZZ}, which you can√check are the stabilizers for the state |00i+i|11i
.
2

28.2

Stabilizer Codes

A Stabilizer Code is a quantum error-correcting code in which the encoding
and decoding can be done entirely by stabilizer circuits. In particular, thismeans that all the codewords are stabilizer states. In quantum computing

258

LECTURE 28. THE STABILIZER FORMALISM

research, most (though not all) of the error-correcting codes that have been
seriously considered are stabilizer codes. The reason is similar to why linear
codes play such a central role in classical error correction. Namely, it makes
everything much easier to calculate and reason about, and by insisting on
it we don’t seem to give up any of the error-correcting properties that wewant. As a result, the stabilizer formalism is the lingua franca of quantum
error-correction; it’s completely indispensable in this setting.
Shor’s 9-qubit code is an example of a stabilizer code. Recall that with that⊗3√
. These two codewords correspond tocode we had the codewords (|000i±|111i)
2 2
the stabilizer group generators below.

Z Z I I I I I I II Z Z I I I I I I I I I Z Z I I I I 




I
I
I
I
Z
Z
I
I
I



I I I I I I Z Z I (28.9)

I I I I I I I Z Z X
X X X X X I I I I I I X X X X X X ± X X X X X X X X X
The sign on the last line gives either |0̄i for + or |1̄i for –.
We can use intuition to see why the above elements are in the stabilizer
group. Firstly, phase-flips applied to any pair of qubits in the same block
cancel each other out. Secondly, bit-flips applied to all of the qubits in a given
block also take us back to where we started, though possibly with the additionof a global −1 phase. You then just need to check that these 9 elements arelinearly independent of each other, meaning that there aren’t any more to befound.
Now that we know the stabilizer formalism, we’re finally ready to see an“optimal” 5-qubit code for detecting and correcting an arbitrary error on
any one qubit. The codeword states would be a mess if we wrote them out
explicitly—they’re given by superpositions over 32 different 5-bit strings! Everything is much more compact if we use the stabilizer formalism. The code
corresponds to the following set of stabilizer group generators:
X Z Z X II X Z Z X 




X
I
X
Z
Z
(28.10)
Z X I X Z ± X X X X X

28.2. STABILIZER CODES

259

Once again the sign on the last generator is + if we want the |0̄i, state or − if
we want the |0̄i state. One can check (we won’t prove it here) that this code
can indeed detect and correct a bit-flip, phase-flip, or bit-phase-flip error on
any one of the five qubits.

28.2.1

Transversal Gates

To conclude this lecture let’s say a tiny bit about doing actual quantum computations on qubits that are encoded using stabilizer codes. Suppose we haven logical qubits, each encoded with a stabilizer code, and we want to apply agate to one or two of the logical qubits. The “obvious” way to do this wouldbe:
I First decode the qubits.
I Apply the desired gate to the “bare,” unencoded qubits.
I Re-encode the result.

But doing all that is expensive and creates lots of new opportunities for error!
While the qubits are unencoded there’s nothing to protect them from decoherence. So it would be awesome if we had a code where applying gates to encoded
qubits was hardly more complicated than applying them to unencoded qubits.
This motivates the following definition: the gate G is transversal for the code
C if in order to apply G to logical qubits encoded using C, all you need to
do is apply G independently to each of the physical qubits. For example, theHadamard gate is transversal if you can Hadamard a logical qubit by justseparately Hadamarding each of the physical qubits. You should check, forexample, that the Hadamard gate is transversal for Shor’s 9-qubit code.
It turns out that there are quantum error-correcting codes for which the
CNOT, Hadamard, and Phase gates are all transversal. Thus, if you use oneof these codes, then applying any stabilizer circuit to the encoded qubits isextremely cheap and easy. Unfortunately, we already saw that the stabilizer
gates are non-universal. Moreover, there’s a theorem due to Zeng, Cross andChuang in 2007 that says that for any useful stabilizer code C the corresponding set of transversal gates can’t be universal. Eastin and Knill generalized
this to show that no useful quantum error-correcting code can have a universal
set of transversal gates. This means that if we want a universal error-corrected
quantum computer we’re going to need to figure out how to implement somenon-stabilizer gate (say Toffoli or T ) in a non-transversal manner, probably
via some sequence of gates that is much more expensive.

260

LECTURE 28. THE STABILIZER FORMALISM

Quantum computing researchers who study this problem tend to adopt aworldview wherein stabilizer gates are “free”—they’re so cheap to implementthat you might as well not even count them—and the “complexity” of a quantum circuit equals the number of non-stabilizer gates needed to implement
it. The non-stabilizer gates are so much more expensive that they completely
dominate the running time.
In practice, a lot of this research has boiled down to designing improved andless-expensive methods for getting non-stabilizer gates into a circuit. There arevarious tricks, a famous example being Magic State Distillation. The idea
iπ/4
here is that if you can just produce certain non-stabilizer states like |0i+e√2 |1i(so-called “magic states”), then by applying certain stabilizer operations tothose states and performing measurements (adapting your procedure as necessary based on the outcome of the measurements), you can simulate the effectof applying non-stabilizer gates. In Figure 28.1 we give a circuit which uses
the state √12 (|0i + eiπ/4 |1i) along with stabilizer gates and measurements tosimulate the effect of applying a T gate. In other words: with help from magicstates, stabilizer operations can break out of the “Gottesman-Knill prison” andget all the way up to universal quantum computation. On the other hand, actually realizing this idea seems to require building a quantum computer where
the overwhelming majority of the work would happen in “magic state factories,” with the actual quantum computation on the magic states almost anafterthought.

|ψi

•

S

T |ψi

√1 (|0i + eiπ/4 |1i)
2

Figure 28.1: Circuit for simulating a T gate using stabilizer operations andmeasurements with the magic state √12 (|0i + eiπ/4 |1i).
There’s a different way to understand the importance of non-stabilizer gatesfor quantum computation. The paper by Aaronson and Gottesman from 2004,
mentioned earlier, also proved the following result: suppose we have a quantum
circuit on n qubits, which contains mostly stabilizer gates (say, nO(1) of them)
but also a small number t of non-stabilizer gates. Then there’s a classicalalgorithm to simulate the circuit in time that’s polynomial in n and exponential
in t. This tells us that if we want an exponential quantum speedup, then not
only do we need non-stabilizer gates in our circuit, we need many such gates.