PHYSICAL REVIEW A, VOLUME 62, 032312

Quantum probabilistic subroutines and problems in number theory A. Carlini and A. Hosoya Department of Physics, Tokyo Institute of Technology, Oh-Okayama, Meguro-ku, Tokyo 152, Japan 共Received 6 July 1999; published 18 August 2000兲 We present a quantum version of the classical probabilistic algorithms as studied by Rabin. The quantum algorithm is based on the essential use of Grover’s operator for the quantum search of a database and of Shor’s Fourier transform for extracting the periodicity of a function, and their combined use in the counting algorithm originally introduced by Brassard et al. One of the main features of our quantum probabilistic algorithm is its full unitarity and reversibility, which would make its use possible as part of larger and more complicated networks in quantum computers. As an example of this we describe polynomial time algorithms for studying some important problems in number theory, such as the test of the primality of an integer, the so called prime number theorem, and Hardy and Littlewood’s conjecture about the asymptotic number of representations of an even integer as a sum of two primes. PACS number共s兲: 03.67.Lx, 89.70.⫹c, 02.10.Lh

I. INTRODUCTION

Quantum computers allow a superposition of 兩 0 典 and 兩 1 典 qubits with the coefficients being complex numbers ␣ and ␤ , 兩␺典⫽␣兩0典⫹␤兩1典.

共1兲

It is this superposition that provides us with an enormous number of parallel computations by generating a superposed state of a large number of terms, for example, starting with the flat superposition ( 兩 0 典 ⫹ 兩 1 典 ) N . Quantum computers can do unitary transformations and also make quantum mechanical observations which induce an instantaneous state reduction to 兩 0 典 or 兩 1 典 with the probability 兩 ␣ 兩 2 or 兩 ␤ 兩 2 , respectively 关1–3兴. At present there are two main kinds of interesting quantum algorithms that can outperform their classical counterparts, i.e., Shor’s algorithm for factoring integers 关4兴 and Grover’s algorithm for the unstructured database search 关5兴, which achieve, respectively, an exponential and square root speed increase compared to their classical analogs. One of the most interesting algorithms where these two basic unitary blocks are exploited in conjunction is the counting algorithm introduced by Brassard et al. 关6兴 共see Sec. III for a detailed description兲, which can count the cardinality t of a set of states with a given property present in a flat superposition of N states in a time that is polynomial in the ratio N/t, and with an accuracy that can be made exponentially close to 1. In this work we shall show how an extended use of this algorithm can be exploited to construct unitary and fully reversible operators which are able to emulate at the quantum level a class of classical probabilistic algorithms. Classical probabilistic algorithms are characterized by the use of random numbers during the computation, and by the fact that they give the correct answer with a certain probability of success, which can usually be made exponentially close to 1 by repetition 共see, e.g., Ref. 关7兴兲. In this paper we show explicitly a series of quantum, fully reversible and unitary algorithms which can be seen as the quantum analog of the aforementioned classical randomized algorithms, in the sense that they naturally select the ‘‘correct’’ states with an arbi1050-2947/2000/62共3兲/032312共8兲/$15.00

trarily large probability amplitude at the end of the computation, and that the final measuring process is only an option which may not be used, e.g., in the case when the ‘‘answer’’ provided by such quantum algorithms is needed as a partial 共subroutine兲 result for further computations in a larger and more complex quantum network. The main ingredients for the construction of our quantum algorithms consist in the repeated use of the quantum counting transform of Ref. 关6兴, in the exploitation of the resulting interference and entanglement among quantum states, and, to some extent, in assigning to some extra ancilla qubits the role analog of the classical random repetitions. Previous work 关8兴 also dealt with the problem of building unitary and reversible subroutines for use in larger quantum computational networks 共see also Ref. 关9兴 for other types of subroutines in the context of generalized quantum computation兲. However, as quantum interference is not exploited, these methods in general require a larger memory space compared to our algorithms 共see also the last paragraph of Sec. III兲. The paper is structured as follows. In Sec. II we summarize the main properties of one of the prototypes of the classical randomized algorithms, i.e., Rabin’s test for primality of an integer. In Sec. III we describe the main block of our quantum algorithm and, as a preparation for Sec. IV, we study again the case of the test of primality for a given integer, comparing our results with the classical ones. In Sec. IV we extend our quantum methods to the problem of checking the so called prime number theorem concerning the distribution of primes smaller than a given integer. We conclude in Sec. V with some discussion and future perspectives. Finally, in the Appendix we suggest how one might test Hardy and Littlewood’s formula concerning the asymptotic behavior of the number of representations of a given even integer as the sum of two primes, and also comment on the possible proof of the famous Goldbach conjecture in number theory.

II. CLASSICAL RANDOMIZED PRIMALITY TEST

One of the prototype examples of classical probabilistic algorithms is that of Rabin 关7兴 for testing the primality of a

62 032312-1

©2000 The American Physical Society

A. CARLINI AND A. HOSOYA

PHYSICAL REVIEW A 62 032312

given number k.1 The algorithm is probabilistic as it uses random integers during the computation, it is always correct when it certifies a number to be composite, while it asserts primality with an arbitrarily small probability of error. The algorithm tests the following condition W k (a), for 1⭐a⬍k 共and factoring out of k⫺1 the highest power of 2 which divides it, i.e., writing k⫺1⬅2 h l, with h integer and l odd兲: 共 i兲 a k⫺1 mod k⫽1: i

共 ii兲 ᭚ i苸 关 1,h 兴 /gcd共 a (k⫺1)/2 ,k 兲 ⫽1.

共2兲

If at least one of conditions 共i兲 or 共ii兲 is satisfied, then W k (a)⫽0 and a is said to be a witness to the compositeness of k. On the other hand, if neither 共i兲 nor 共ii兲 is satisfied, then W k (a)⫽1. The most important property of the witness function W k (a) is that for a composite number k⬅k C the number t k C of witnesses a such that W k C (a)⫽0 is 3 共 k C ⫺1 兲 t kC⭓ , 4

共3兲

i.e., for a composite k C it is guaranteed that at least 3/4 of the a⬍k C are witnesses to k C 关7–11兴 共see also Ref. 关12兴兲. For a prime number k⬅k P , instead, none of the a is a witness 关i.e., W k P (a)⫽1 for all 1⭐a⬍k P 兴. Conversely, if, for an integer 1⭐a⬍k picked at random, one finds that W k (a)⫽1, then one can correctly declare k to be prime with a probability 3/4, while, if one finds W k (a)⫽0, then k can be declared composite with certainty. The classical randomized algorithm for the test of primality of k heavily relies on this property of the witness function W k and proceeds as follows. Given the number k to be tested, one first picks up randomly h numbers a i such that 1⭐a i ⬍k (i苸 关 1,h 兴 ) and checks their witness function W k (a i ). If W k (a i )⫽0 for at least one of the a i , then k is declared composite, while if W k (a i )⫽1 for all a i , then k is declared prime. If k is declared composite the test is always correct, but if k is declared prime the test may fail with a probability 共i.e., the probability of independently picking h ‘‘false’’ witnesses兲 smaller than 1/22h 关7兴. The computational complexity S class of the algorithm, defined as its running time as a function of the number of required operations, is polynomial in the number of digits of k, i.e., S class ⯝O„h poly(log k)… 共where poly stands for polynomal兲.2 We stress once more the main point leading to the good performance of the classical randomized algorithm, i.e., the large gap between the number of witnesses in the cases when k is a prime and when it is a composite.

1

For a review of other probabilistic and deterministic classical tests of primality see, e.g., Ref. 关10兴. 2 One has to randomly generate 关e.g., by tossing O(log k) coins兴 h numbers, taking O(log k) steps for each number, and evaluate the witness function for each of these numbers, taking another O„poly(log k)… steps 关7兴.

III. QUANTUM PRIMALITY TEST

Let us now present, at first, also as a useful preparatory exercise, a quantum algorithm to test the primality of a given number k and compare it with the classical probabilistic one by Rabin. The main idea underlying our quantum computation is the repeated use of the counting algorithm COUNT originally introduced by Brassard et al. 关6兴. The algorithm COUNT makes an essential use of two of the main tools in quantum computation, i.e., Grover’s unitary operation G for extracting some elements from a flat superposition of quantum states, and Shor’s Fourier operation F for extracting the periodicity of a quantum state. Grover’s unitary transformation is given by G⫽⫺WS 0 WS 1 , where the Walsh-Hadamard transform W is defined as W兩a典⬅

1

冑k

k⫺1

兺

b⫽0

共 ⫺1 兲 a•b 兩 b 典

共4兲

关with a•b⬅ 兺 i a i b i mod2, a i (b i ) being the binary digits of a(b)兴, S 0 ⬅I⫺2 兩 0 典具 0 兩 and S 1 ⬅I⫺2 兺 w 兩 w 典具 w 兩 , which changes sign to the searched states 兩 w 典 .3 Shor’s operation is given instead by the Fourier transform4 F兩a典⬅

1

冑k

k⫺1

兺

b⫽0

e 2i ␲ ab/k 兩 b 典 .

共5兲

Then the COUNT algorithm can be summarized by the following sequence of operations: 共1兲

W 兩 0 典 ) 共 W 兩 0 典 ⫽ 兺 m兩 m 典 兺 a兩 a 典 .

共2兲

→ 共 F 丢 I 兲关 兺 m 兩 m 典 G m 共 兺 a 兩 a 典 )].

共3兲

→measure 兩 m 典 .

Since the amplitude of the set of states 兩 w 典 after m iterations of G on 兩 a 典 is a periodic function of m, the estimate of such a period by use of the Fourier analysis and the measurement of the ancilla qubits in 兩 m 典 will give information on the size t of this set, on which the period itself depends. The parameter P determines both the precision of the estimate t and the computational complexity of the COUNT algorithm 共which requires P iterations of G). Our quantum algorithm for the test of primality makes essential use of the COUNT algorithm for estimating the number of witnesses to the compositeness of k, and of R log P ancilla qubits 兩 m i 典 i 共with m i 苸 关 0,P 兴 , i苸 关 1,R 兴 , and P an integer power of 2 to be determined later兲 which are finally

3 From here onward, for simplicity, we use the compact notation according to which, e.g., assuming b⯝O(k), we have b⫽2 j b j ⫹2 j⫺1 b j⫺1 ⫹•••⫹2 0 b 0 共with j⫽ 关 log k兴) and 兩 b 典 itself is actually an acronym for the tensor product of j⫹1 qubits, i.e., 兩 b 典 ⬅ 兩 b j 典 兩 b j⫺1 典 ⫻•••⫻ 兩 b 0 典 . 4 Note that one can write the flat superposition as W 兩 0 典 ⫽F 兩 0 典 ⫽ 兺 a 兩 a 典 / 冑k.

032312-2

QUANTUM PROBABILISTIC SUBROUTINES AND . . .

PHYSICAL REVIEW A 62 032312

measured and which are necessary in order to sharpen the constructive interference of the ‘‘good’’ states. We start with the tensor product of R 兩 0 典 i states with log P qubits, and one state 兩 0 典 with log k qubits, i.e., 兩 ␺ 0 典 ⬅ 兩 0 典 1 ••• 兩 0 典 R 兩 0 典 ,

P⫺1

兩 ␺ 1典 ⬅

兺 m ⫽0

P⫺1

兩 m 1典 1

1

•••

冑P

兺 m ⫽0 R

兩 B 2典 k⬅

兺 兩a典 a⫽0

冑P

冑k

共7兲

.

We then act on the last 兩 a 典 state with the 兩 m 1 典 1 ••• 兩 m R 典 R -‘‘controlled’’ Grover operation G m such that

兺

W k (a)⫽0

1

兺

冑k⫺t k

W k (a)⫽1

1

兺

a⫽0

G m 1 ⫹•••⫹m R 兩 a 典 ⫽k m 1 . . . m R 兩 B 1 典 k ⫹l m 1 . . . m R 兩 B 2 典 k . 共12兲

Next we apply Shor’s Fourier transform on each of the R ancilla states 兩 m i 典 i in order to extract the periodicity ␪ k 关and therefore, via Eq. 共9兲, the number of witnesses t k 兴 which is hidden in the amplitudes k m 1 , . . . ,m R and l m 1 , . . . ,m R , i.e., we transform 兩 ␺ 2 典 into

兩 ␺ 2典 ⬅

兺

m 1 ⫽0

k⫺1

P⫺1

兩 m 1典 1

冑P

•••

兺

m R ⫽0

兩 m R典 R

冑P

兺

G

m 1 ⫹•••⫹m R

a⫽0

冑k

兩a典

兩 ␺ 3典 ⬅

,

P⫺1

兺

m 1 ,l 1 ⫽0

e 2i ␲ l 1 m 1 / P 兩 l 1 典 1 •••

P

兺

m R ,l R ⫽0

e 2i ␲ l R m R / P 兩 l R 典 R P

⫻ 共 k m 1 , . . . ,m R 兩 B 1 典 k ⫹l m 1 , . . . ,m R 兩 B 2 典 k ).

共8兲

where in G we use S 1 ⬅I⫺2 兺 W k (a)⫽0 兩 a 典具 a 兩 , which changes sign to the witnesses of the compositeness of k.5 In the following we will assume that P is at most ⯝O„poly(log k)…, so that the steps required to compute the repeated Grover operations6 G m 1 ⫹•••⫹m R are polynomial in log k. We define the quantities

兩a典,

k⫺1

P⫺1 P⫺1

兩a典,

such that we can simplify Eq. 共8兲 by use of

冑k

k⫺1

兩 m R典 R

冑t k

共11兲

共6兲

and then act on each of these states with a Walsh-Hadamard transform W in order to obtain

1

兩 B 1典 k⬅

After some elementary algebra, Eq. 共13兲 can be rewritten as 1 兩 ␺ 3典 ⬅ 2

P⫺1

兺

l 1 , . . . ,l R ⫽0

冉

兩 l 1 典 1 ••• 兩 l R 典 R e ⫺i ␲ (l 1 ⫹•••⫹l R ) P

R

(R)

⫻ e i␲ f k

兿

i⫽1

s l( P) ⫹ 共 ⫺i 兩 B 1 典 k ⫹ 兩 B 2 典 k ) i

冊

R

sin ␪ k ⬅

冑

(R)

tk k

⫹e ⫺i ␲ f k 共9兲

兿

i⫽1

s l( P) ⫺共 i 兩 B 1典 k⫹ 兩 B 2典 k) , i

共14兲

where we have introduced the following quantities:

and

f k⬅ k m 1 , . . . ,m R ⬅sin关 2 共 m 1 ⫹•••⫹m R 兲 ⫹1 兴 ␪ k , l m 1 , . . . ,m R ⬅cos关 2 共 m 1 ⫹•••⫹m R 兲 ⫹1 兴 ␪ k ,

共13兲

P␪k , ␲

冉

0⭐ f k ⭐

f (R) k ⬅ f k R⫹

共10兲

P , 2

冊

共 1⫺R 兲 , P

共15兲

and where t k is the number of a such that 1⭐a⬍k and W k (a) ⫽0, and the states

5

A unitary transformation representing the witness function W k (a) can easily be obtained by defining the quantum AND of the basic operations in 共i兲 and 共ii兲 in Eq. 共2兲, each of which can be evaluated in a time that is polynomial in log k. 6 Each G has a computational complexity S G ⯝O„poly(log k) ⫹log k…⯝O„poly(log k)…, the first term being for the quantum parallel evaluation of the witness functions, and the second term for the evaluations of the W and S 0 transforms.

s l( P) ⫾⬅ i

sin ␲ 共 l i ⫾ f k 兲 . P sin关 ␲ 共 l i ⫾ f k 兲 / P 兴

共16兲

In particular, when counting the witnesses for a given k, we have two different possibilities: either k is a prime, in which case we have that t k P ⫽0 and therefore ␪ k P ⫽ f k P ⫽0; or k is a composite, for which we have that t k C ⭓3k C /4 and ␪ k C ⭓ ␲ /3, implying that P/3⭐ f k C ⭐ P/2. Going back to Eq. 共14兲, we can see that, in the case when k is a prime, G effectively acts as an identity operator, so that 兩 ␺ 3 典 simplifies to

032312-3

A. CARLINI AND A. HOSOYA

PHYSICAL REVIEW A 62 032312

兩 ␺ 3 典 → 兩 0 典 1 ••• 兩 0 典 R 兩 B 2 典 k

共17兲

when k⫽k P .

On the other hand, when k is a composite, almost all of the ancilla qubits in 兩 ␺ 3 典 will be in a state different from 兩 0 典 1 ••• 兩 0 典 R . In fact, the probability of finally measuring 兩 0 典 1 ••• 兩 0 典 R when k is composite is

冏 冉

P 共 兩 0 典 1 ••• 兩 0 典 R ) 兩 k C ⫽ 共 ␣ k 兲 2R ⭐

冉 冊 2

冑3 P

kC⬅

sin ␲ f k P sin共 ␲ f k / P 兲

冊冏 2R

kC

2R

⯝O 共 P ⫺2R 兲 ,

共18兲

since we have f k C ⭓ P/3. Summarizing the above results, our quantum algorithm for testing the primality of a given number k is probabilistic in the following sense: if in the final measurement process of the R log P ancilla qubits we obtain a state with at least one of the qubits different from 兩 0 典 , we can declare with certainty that the number k is a composite; on the other hand, if all the ancilla qubits are in the state 兩 0 典 , we can claim with an error probability smaller than O( P ⫺2R ) that the number k is a prime. The use of R log P ancilla qubits and the repeated application of the Fourier transforms is made in order to sharpen the constructive interference effects at the basis of the measurement of the period ␪ k and, in this sense, can be seen as the quantum analog of the multiple random tests used in the classical primality algorithm by Rabin. Moreover, our algorithm, provided that the final measurement step is omitted, is clearly unitary and fully reversible, and as such it can be used as an intermediate unitary transform inside a larger and more complicated algorithm. The strength of this quantum algorithm then critically relies on the use of the superposition and entanglement of states, and above all on the existence of a gap between the cardinalities of different sets of the domain of a given test function 关in the case of the function W k (a) the domain is divided into the set of states with W k ⫽1, f k ⫽0, and those with W k ⫽0, f k ⭓ P/3兴.7 We will show other and more interesting problems where these properties can be fruitfully exploited in Sec. IV and in the Appendix. The computational complexity of the quantum algorithm can be written as S quant ⯝O„log k⫹R关log P⫹(log P)2 ⫹PSG兴…⯝O(R PS G ),8 with the number of steps required for Taking f good ⫽0 共i.e., ␣ good ⫽1) and, more generally f bad ⫽ ␰ P/2 with ␰ 苸(0,1 兴 , and requiring a success probability exponentially close to 1, we have to choose, e.g., ␣ bad ⭐( P sin ␲␰/2) ⫺1 ⬍1/2 in Eq. 共18兲. Thus, actually even small values of ␰ „but ␰ ⬎ 关 poly(log N)兴⫺1… are good enough for the quantum test to be sufficiently reliable, provided one takes P⭓O( ␰ ⫺1 ). 8 The first term is for the construction of the flat superposition 兺 a 兩 a 典 , while the other terms arise, in the order from left to right, from the evaluations of the R flat superpositions of the ancilla states 兺 m i 兩 m i 典 i (i苸 关 1,R 兴 ), the R Fourier transforms on the same states, and the operation G 兺 m i , requiring PR repetitions of the basic block G. 7

G given by S G ⯝O„poly(log k)… 关see the first paragraph Eq. 共6兲兴, so that we obtain S quant ⯝O„R poly(log k)…. One might observe that, in fact, it is not necessary to use COUNT for primality testing, but one could simply build the state 关 兺 a 兩 a 典 兩 W k (a) 典 ] 共for the bases a of the integer k), measure the ancilla qubit 兩 W k (a) 典 , and repeat the procedure h times. This would imply the same error probability P e ⯝2 ⫺2h 共after h trials兲, computational complexity S quantum ⯝O„poly(log k)…, and memory space required M ⫽log k⫹1 as in our algorithm with the choice R⫽1,P⯝O(1) repeated h times, and in the classical algorithm of Ref. 关7兴. However, this method of repeated trials would not make the subroutine for primality testing unitary and reversible. To achieve this goal, one might instead consider 共see, e.g., Ref. 关8兴兲 the initial state 关 兺 a 1 兩 a 1 典 兩 W k (a 1 ) 典 ]••• 关 兺 a R 兩 a R 典 兩 W k (a R ) 典 ] and check in parallel for the R ancilla qubits 兩 W k (a i ) 典 , for which the error probability would be P e,Bennett ⯝2 ⫺2R , the computational complexity would be S quantum,Bennett ⯝O(R„poly(log k)…) and the memory space used would be M Bennett ⫽R(log k⫹1). With the choice P⯝O(1) and R ⯝O(log k), however, our algorithm has the same error probability and computational complexity, but requires logarithmically less memory space. This makes explicit the advantage of exploiting the interference among quantum states which is inherent in our method via the use of COUNT. IV. COUNTING K P ËN AND THE PRIME NUMBER THEOREM

One of the problems in which the quantum algorithm of the previous section can be explicitly used, as the basic block of another more complex unitary operation, is the case of the testing of the so called prime number theorem 共see, e.g., Ref. 关10兴 and references therein兲, according to which the total number t N of primes k P smaller than a given number N is given by the formula t N⬅ ␲共 N 兲⯝

N . log N

共19兲

Our quantum algorithm essentially consists of a subloop which checks for the primality of a given k⬍N by counting its witnesses, a main loop for the counting of primes less than N, and a final measurement of some ancilla qubits. In more detail, we can schematically summarize the main operations in the following steps: Main loop: Count: 兵 k 兩 k⫽k P ⬍N 其 using COUNT with G ˜ ˜ 1 ⬅1⫺2 兺 k 兩 k P 典具 k P 兩 共parameter Q). →G and S 1 →S P Subloop: Parallel primality tests ᭙k⬍N 共parameter P) and (approximate) construction of ˜S 1 . Let us start from the subloop of the algorithm first. The unitary transform ˜S 1 to be computed should approximate with a high level of accuracy the following basic operation:

032312-4

˜S 1 :

1

冑N

N⫺1

兺

k⫽0

兩k典→

1

冑N

N⫺1

兺

k⫽0

共 ⫺1 兲 F k 兩 k 典 ,

共20兲

QUANTUM PROBABILISTIC SUBROUTINES AND . . .

PHYSICAL REVIEW A 62 032312

where F k ⬅1 for a prime k⫽k P and F k ⬅0 for a composite k⫽k C . In order to construct such an ˜S 1 , we start from the flat superposition of states 兩 k 典 tensored with two ancilla states 兩 0 典 P and 兩 0 典 k with, respectively, log P and log k qubits, i.e., 兩¯ ␺ 0典 ⬅

N⫺1

1

冑N

兺

k⫽0

兩 k 典 兩 0 典 P兩 0 典 k ,

P⫺1 N⫺1

1

兺 兩k典 冑N k⫽0

兺

m⫽0

k⫺1

兩m典 P

兺

a⫽0

冑P

B 2,k 共 b 兲 ⬅

共21兲

and we act on the first two states ( 兩 k 典 and 兩 0 典 P ) in Eq. 共21兲 with an F transform and a 兩 k 典 -‘‘controlled’’ F operation, respectively, to get

兩¯ ␺ 1典 ⬅

B 1,k 共 b 兲 ⬅

兩¯ ␺ 2典 ⬅

冉

N⫺1

冑N

兺

k⫽0

P⫺1

兩 k 典 ␣ k兩 0 典 P兩 A 0典 k⫹

兺

m⫽1

冊

兩⌿典⬅

共23兲

兩 k 典 共 兩 0 典 P 兩 0 典 k ⫺2 兩 C 1 典 P,k )

共24兲

兺 兺

e ⫺2i ␲ nr/ P 关共 Im Z k,r 兲 B 1,k 共 b 兲

⫹ 共 Re Z k,r 兲 B 2,k 共 b 兲兴 and

兩 n 典 P兩 b 典 k

P 冑k

共28兲

共 ⫺1 兲 F k 兩 k 典 兩 0 典 P 兩 0 典 k ,

共29兲 2

冑N

兺

k⫽k C

兩 k 典 兩 C 1 典 P,k ,

4 N

兺

k⫽k C

␣ 2k

冉 冊 2

冑3 P

2

⯝O 共 P ⫺2 兲 .

共30兲

U 1 ⬅F 关 C兩 m 典 P 共 G 兲兴关 C兩 k 典 共 F 兲 ]F,

共31兲

we have, in fact, ˜S 1 ⬅U †1 S 0 U 1 .

共32兲

Let us now consider the main loop of the algorithm, i.e., that ˜ counting the total number of k P ⬍N. Grover’s transform G entering this part of the algorithm can then be written as (k) ˜ ⬅U 2˜S 1 , U 2 ⬅⫺W (k) S (k) G 0 W ,

共33兲

and with the caveats that now the operations W (k) and S (k) 0 appearing in the operator U 2 of Eq. 共33兲 are acting on the states 兩 k 典 , and that the states to be counted finally are those with k⫽k P . Defining as usual

P⫺1 k⫺1 n,r⫽0 b⫽0

共27兲

Defining, in a symbolic notation, the sequence of operations

共25兲

with 兩 C 1 典 P,k ⬅ ␣ k

k⫽0

⭐4

N⫺1

兺

兺

冑N

具E兩E典⫽

( P) while sin ␪k , 兩 B 1,2典 k , f k , s m⫾ , and ␣ k have been defined, respectively, in Eqs. 共9兲, 共11兲, 共15兲, 共16兲, and 共18兲, and the phase ␾ m ⬅exp关i␲m(1⫺1/P) 兴 . We now act with the phase change operator S 0 on the first ancilla state 兩 • 典 P , and then undo again all the previous operations (F, G m , and the two initial Fs兲 finally obtaining the state

k⫽0

,

which realize, as wanted, the operation ˜S 1 of Eq. 共20兲, with the norm of the correction term 兩 E 典 upper bounded by

( P) 兩 A m 典 k ⬅ 关 e ⫺i ␲ f k s m⫺ 共 i 兩 B 1典 k⫹ 兩 B 2典 k)

冑N

冑k⫺t k

N⫺1

1

兩 E 典 ⬅⫺

兩 A 0 典 k ⬅sin ␲ f k 兩 B 1 典 k ⫹cos ␲ f k 兩 B 2 典 k ,

1

e ⫺2i ␲ ab/k

W k (a)⫽1

where

where

兩¯ ␺ 3典 ⬅

兺

,

˜S 1 兩 ¯␺ 0 典 ⫽ 兩 ¯␺ 3 典 ⬅ 兩 ⌿ 典 ⫹ 兩 E 典 ,

共22兲

␾ m兩 m 典 P兩 A m典 k ,

( P) ⫹e i ␲ f k s m⫹ 共 ⫺i 兩 B 1 典 k ⫹ 兩 B 2 典 k )]/2,

冑t k

Noting the properties that P,k 具 C 1 兩 C 1 典 P,k ⫽ ␣ 2k and, for a prime k P , ␣ k P ⫽1, with 兩 C 1 典 P,k P ⫽ 兩 0 典 P 兩 0 典 k P , we can also rewrite Eq. 共25兲 as

关with P⯝O„poly(log N)…]. Then, as usual, we operate with an 兩 m 典 P - ‘‘controlled’’ Grover transform G m on the last ancilla states 兩 a 典 k followed by a Fourier transform F on 兩 m 典 P , obtaining 1

e ⫺2i ␲ ab/k

Z k,r ⬅e i ␲ f k e ⫺2i ␲ f k r/ P .

兩a典k

冑k

兺

W k (a)⫽0

共26兲

sin ␪ N ⬅

冑

tN N

and the ‘‘good’’ and ‘‘bad’’ states, respectively, as 032312-5

共34兲

A. CARLINI AND A. HOSOYA

兩G典⬅

PHYSICAL REVIEW A 62 032312

P

冑t N

兩 k 典 兩 0 典 P兩 0 典 k 兺 k C

兩B典⬅

f Q ⬅Q ␪ N / ␲

兩 k 典 兩 0 典 P兩 0 典 k 兺 k

冑N⫺t N

共35兲 ,

(Q) and s n⫾ are defined in Eq. 共16兲. Now, the last step of the algorithm consists in measuring the value of the state 兩 • 典 Q in 兩 ¯␺ 5 典 . Using the expected estimate that ␪ N ⯝O(1/冑log N), which gives f Q ⯝O(Q/ 冑log N), and by choosing

Q⯝O„共 log N 兲 ␤ ],

we have then ˜S 1 兩 G 典 ⫽⫺ 兩 G 典 , ˜S 1 兩 B 典 ⫽ 兩 B 典 ⫹sec ␪ N 兩 E 典 .

共36兲

with

冉兺

冊

n

兩 E n 典 ⬅sec ␪ N

j⫽1

˜ j⫺1 U 2 兩 E 典 , l n⫺ j G

共37兲

共38兲

where we have again used the variables k m ⬅sin(2m⫹1)␪N and l m ⬅cos(2m⫹1)␪N , the formulas

W⭓

1

冑Q

共39兲

Q⫺1

兺

m⫽0

兩 m 典 Q兩 ¯ ␺ 0典

共40兲

关with Q an integer power of 2 to be chosen later of O„poly(log N)…兴. Then we act on 兩 ¯␺ 0 典 with the ˜ m and with F on 兩 m 典 Q , getting 兩 m 典 Q -‘‘controlled’’ G 兩¯ ␺ 5典 ⬅

⫽

1 Q 1 2

兺

兺

where

1 Q

共46兲

which, substituted in the formula for W E n and then in Eq. 共44兲, finally gives the estimate W⭓

8 关 1⫺O„共 log N 兲 ⫺( ␥ ⫺ ␤ ) …兴 . ␲2

共47兲

This means that with a high probability we will always be able to find one of the states 兩 f ⫾ 典 Q or 兩 P⫺ f ⫾ 典 Q and, therefore, to evaluate the number t N from Eqs. 共34兲 and 共42兲.10 Of course, as explained in Ref. 关6兴, since in general f Q is not an integer, the measured ˜f Q will not match exactly the true value of f Q , and we will have some errors. In particular, defining ˜t N ⬅N sin2˜␪N , with ˜␪ N ⫽˜␪ N (˜f Q ), we have for the error over t N the estimate 关6兴 兩 ⌬t N 兩 expt ⬅ 兩˜t N ⫺t N 兩 ⭐ ␲

e 2i ␲ mn/Q 兩 n 典 Q 共 k m 兩 G 典 ⫹l m 兩 B 典 ⫹ 兩 E m 典 )

冉 冑冊

N ␲ ⫹2 Q Q

⯝O„N 共 log N 兲 ⫺ ␤ ⫺1/2….

tN N

共48兲

(Q) e i ␲ n(1⫺1/Q) 兩 n 典 Q 关 e ⫺i ␲ f Q s n⫺ 共 i兩G典⫹兩B典)

The condition 共45兲 is sufficient but not necessary in order to have 兩 W E n 兩 Ⰶ1. In fact, one can also choose P⫽cQ, provided that the constant cⰆ1. 10 We note that, as an alternative to choosing P as in Eq. 共45兲, one could also repeat the counting algorithm a sufficient number of times, as we did in the previous section 关see Eq. 共7兲兴, in order to reduce the ‘‘error’’ probability W E n . 9

(Q) ⫹e i ␲ f Q s n⫹ 共 ⫺i 兩 G 典 ⫹ 兩 B 典 )]

⫹

共45兲

from Eq. 共30兲 we then get the estimate9

Q⫺1 n⫽0

共44兲

P⯝O„共 log N 兲 ␥ …, ␥ ⬎ ␤ ,

Q⫺1 m,n⫽0

8 ⫺ 兩 W E n兩 , ␲2

具 E n 兩 E n 典 ⭐O„共 log N 兲 ⫺2( ␥ ⫺ ␤ ) …Ⰶ1,

and Eq. 共36兲. We have now all the building blocks necessary to proceed with the construction of the quantum algorithm counting the number of k P such that k P ⬍N. We start from 兩 ¯␺ 0 典 given by formula 共21兲 and tensor it with a flat superposition of ancilla states 兩 m 典 Q with log Q qubits, i.e., 兩¯ ␺ 4典 ⬅

共43兲

where W E n is the contribution coming from terms involving 兩 E n 典 , and whose explicit form we omit here for simplicity. Using the upper bound 具 E n 兩 E n 典 ⭐O(n 2 ) 具 E 兩 E 典 and choosing

兩¯ ␺ 0 典 ⫽sin ␪ N 兩 G 典 ⫹cos ␪ N 兩 B 典 , 兩 ⌿ 典 ⫽⫺sin ␪ N 兩 G 典 ⫹cos ␪ N 兩 B 典 ,

␤ ⬎1/2,

we get the ansatz 1⬍ f Q ⬍Q/2⫺1 of Ref. 关6兴. Then it can easily be shown, exactly as in Ref. 关6兴, that the probability W of obtaining any of the states 兩 f ⫺ 典 Q , 兩 f ⫹ 典 Q , 兩 Q⫺ f ⫺ 典 Q , or 兩 Q⫺ f ⫹ 典 Q 共where f ⫺ ⬅ 关 f Q 兴 ⫹ ␦ f and f ⫹ ⬅ f ⫺ ⫹1, with 0 ⬍ ␦ f ⬍1) in the final measurement is given by

Consequently, we can derive a formula for the iteration of ˜ acting on the state 兩 ¯␺ 0 典 , i.e., the operator G ˜ n 兩 ¯␺ 0 典 ⫽G n 兩 ¯␺ 0 典 ⫹ 兩 E n 典 , G

共42兲

Q⫺1

兺

m,n⫽0

e 2i ␲ mn/Q 兩 n 典 Q 兩 E m 典 ,

共41兲

032312-6

QUANTUM PROBABILISTIC SUBROUTINES AND . . .

PHYSICAL REVIEW A 62 032312

On the other hand, if we want to check the theoretical formula t N ⬅ ␲ (N) up to some power ␦ ⬎0 in log N, i.e., with 兩 ⌬t N 兩 theor ⯝O„N 共 log N 兲 ⫺ ␦ ⫺1 …,

共49兲

we have to impose the requirement that the measuring error over t N is smaller than the precision required for testing t N , i.e., we should have 兩 ⌬t N 兩 expt 具 兩 ⌬t N 兩 theor , which can be satisfied provided that

␤ ⬎ ␦ ⫹1/2.

共50兲

of couples of primes. Our quantum algorithm may also be useful for other similar tests and counting problems if there exists a classical probabilistic algorithm which somehow can guarantee a good success probability 共e.g., problems related to the distribution of primes and pseudoprimes in number theory etc.兲.12 It is well known that in a classical computation one can count, by using Monte Carlo methods, the cardinality of a set which satisfies some conditions, provided that the distribution of the elements of such a set is assumed to be known 共e.g., homogeneous兲. One further crucial strength and novelty to our algorithm is also in the ability of efficiently and successfully solve problems where such a knowledge or regularities may not be present.

The computational complexity of the quantum algorithm can be written as S Q ⯝O„log N⫹log Q⫹(log Q)2⫹Q(log N⫹S1)…, where for the subloop we have S 1 ⯝O 关 log N⫹log P⫹PSG ⫹(log P)2)…, and which, using Eqs. 共43兲 and 共45兲 and S G ⯝O„poly(log N)…, finally gives the polynomial complexity S Q ⯝O(Q PS G )⯝O„poly(log N)…. As noted in Ref. 关6兴, moreover, one can further minimize the errors by successive repetitions of the whole algorithm. In particular, it is easily seen that the success probability W can be boosted exponentially close to 1 and an exponential accuracy can be achieved by repeating the whole algorithm many times and using the majority rule, still leaving the whole algorithm for the test of the prime number theorem polynomial in log N.11 We conclude by stressing, once again, that the power of our quantum probabilistic method essentially relies on the gap between the cardinalities of the domains of the test function W k ; the fact that the probability of obtaining any of the states f ⫾ or Q⫺ f ⫾ is bigger than 1/2 共which is true provided that the ‘‘error’’ terms 兩 E n 典 have sufficiently small amplitude兲; and the fact that, finally, the error over the estimate of t N is smaller than the precision we need 共the last two conditions being strongly dependent on the choice of Q, Q/ P, 冑k/t k , and 冑N/t N ).

where the four ancilla states 兩 0 典 i have, respectively, log P qubits for i⫽1,2 and log(2N⫺1) qubits for i⫽3,4. Then, as in Sec. IV, we construct an operator S ⬘1 such that

V. DISCUSSION

S 1⬘ : 兩 ␾ 0 典 → 兩 ⌽ 0 典 ⫹ 兩 E ⬘ 典 ,

In this paper we have shown a method to build a quantum version of the classical probabilistic algorithms developed by Rabin. Our quantum algorithms make essential use of some of the basic blocks of quantum networks known so far, i.e., Grover’s operator for the quantum search of a database, Shor’s Fourier transform for extracting the periodicity of a function, and their combination in the counting algorithm of Ref. 关6兴. The most important feature of our quantum probabilistic algorithms is that the coin tossing used in the correspondenting classical probabilistic algorithms is replaced here by a unitary and reversible operation, so that the quantum algorithm can even be used as a subroutine in larger and more complicated networks. In particular, we described polynomial time algorithms for studying some problems in number theory, e.g., a primality test, the ‘‘prime number theorem,’’ and a conjecture concerning a certain distribution

11 The average computational complexity can be further reduced slightly by use of parallelism and anticipate measurements 关6,12兴.

APPENDIX: TESTING HARDY AND LITTLEWOOD’S CONJECTURE

A very similar procedure can be followed for testing Hardy and Littlewood’s conjecture 关14兴 that the number, which we call r 2 (2N), of the possible representations of an even number 2N as the sum of two primes k P ,l P ⬍2N such that k P ⫹l P ⫽2N, should be given by the asymptotic formula 关modulo O(log log N) factor corrections 关14兴兴 r 2 共 2N 兲 兩 theor ⯝O

冋

N 共 log N 兲 ␮

册

,

␮ ⯝2.

共A1兲

The quantum algorithm for counting such couples and testing the conjecture can be built starting from the state 兩 ␾ 0典 ⬅

2N⫺1

1

兺

冑2N

k⫽0

兩 k 典 兩 2N⫺k 典 兩 0 典 1 兩 0 典 2 兩 0 典 3 兩 0 典 4 , 共A2兲

共A3兲

with the main contribution 兩 ⌽ 0 典 given by the wanted phase change for the ‘‘good’’ states 兩 k P 典 兩 (2N⫺k) P 典 , i.e., 兩 ⌽ 0典 ⬅

1

冑2N

2N⫺1

兺

k⫽0

共 ⫺1 兲 G k 兩 k 典 兩 2N⫺k 典 兩 0 典 1 兩 0 典 2 兩 0 典 3 兩 0 典 4 ,

共A4兲

where G k ⬅1 for the ‘‘good’’ couples 兩 k P 典 兩 (2N⫺k) P 典 and G k ⬅0 for all the other couples, and 兩 E ⬘ 典 is a correction whose amplitude should be negligible with respect to that of 兩 ⌽ 0 典 . This result is achieved, once again, starting from 兩 ␾ 0 典 and acting with an F on the first two ancilla states, with a

12 Other quantum algorithms dealing with problems in number theory, such as integer factoring, finding discrete logarithms, or a Pocklington-Lehmer primality test can be found, respectively, in Refs. 关4兴 and 关13兴. The extent to which the algorithm presented in the latter work, however, can be actually used as an efficient primality test is very questionable to us.

032312-7

A. CARLINI AND A. HOSOYA

PHYSICAL REVIEW A 62 032312

兩 k 典 - and a 兩 2N⫺k 典 - ‘‘controlled’’ operator F, respectively, on each of the last two ancilla states, then operating with a controlled-G transform on each of the last two ancilla states and with an F transform on each of the first two ancilla states, inverting the phase of the state 兩 0 典 1 兩 0 典 2 兩 0 典 3 兩 0 典 4 , and finally undoing the previous operations again. Doing so, one obtains as promised Eqs. 共A3兲 and 共A4兲, with the explicit formula for the state 兩 E ⬘ 典 given by 共we omit all the algebraic details of the derivation for the sake of simplicity兲 兩 E ⬘ 典 ⬅⫺

2

冑2N

2N⫺1

兺

k ⬘ ⫽0

␣ k ⬘ ␣ (2N⫺k) ⬘ 兩 k ⬘ 典 兩 共 2N⫺k 兲 ⬘ 典 兩 C 2 典 k ⬘ , 共A5兲

where the sum k ⬘ is over all couples except 兩 k P 典 兩 (2N ⫺k) P 典 , and the norm of the state 兩 C 2 典 k ⬘ 共a certain tensor product of the four ancilla states兲 is of O(1). To count the number of ‘‘good’’ couples one has to repeat exactly the same steps as described from Eq. 共33兲 共with ˜S 1 →S 1⬘ ) to Eq. 共48兲 关with t N →r 2 (2N)兴 in Sec. IV, and the final result is that, again, the expected theoretical behavior of r 2 (2N) can be tested up to exponential accuracy in a polynomial number of steps. In particular, if one takes

the condition 兩 ⌬r 2 (2N) 兩 expt 具 兩 ⌬r 2 (2N) 兩 theor in this case requires that

␳ ⬎ ␮ /2⫹ ␯ .

共A8兲

The evaluation of the quantum computational complexity of the algorithm can be shown to be polynomial in the number 2N in a fashion similar to that of Sec. IV. Finally, we should comment that the method used could be easily extended to other similar counting problems, such as the case, e.g., when one wants to check that a given integer is the sum of more than two primes or their certain powers, etc. In fact, provided that one is able to check with this quantum algorithm that any odd integer less than N 0 ⫽1043 000 关15兴 can be written as the sum of three primes, then one might also have a numerical 共although probabilistic兲 tool to prove with a polynomial computational complexity the weaker version of a famous Goldbach conjecture, i.e., that every odd integer N⬎5 is the sum of three primes 共see, e.g., Ref. 关10兴兲. ACKNOWLEDGMENTS

共A7兲

The research of A.H.’s was partially supported by the Ministry of Education, Science, Sports and Culture of Japan, under Grant No. 09640341. The research of A.C. was supported by the EU under the Science and Technology Fellowship Program in Japan, Grant No. ERBIC17CT970007; he also thanks the cosmology group at Tokyo Institute of Technology for thein kind hospitality during this work. Both authors would like to thank Professor T. Nishino for introducing them to Rabin’s primality test and Professor N. Kurokawa for helpful discussions.

P. Benioff, J. Stat. Phys. 22, 563 共1980兲. D. Deutsch, Proc. R. Soc. London, Ser. A 400, 96 共1985兲. R.P. Feynman, Found. Phys. 16, 507 共1986兲. P.W. Shor, in Proceedings of the 35th Annual Symposium on Foundations of Computer Science, edited by S. Goldwater 共IEEE Computer Society Press, New York, 1994兲, p. 124; P.W. Shor , SIAM J. Comput. 26, 1484 共1997兲. 关5兴 L.K. Grover, in Proceedings of the 28th Annual ACM Symposium on the Theory of Computing 共ACM Press, New York, 1996兲, p. 212; L.K. Grover Phys. Rev. Lett. 79, 325 共1997兲. 关6兴 G. Brassard, P. Hoyer, and A. Tapp, e-print quant-ph/9805082; M. Boyer, G. Brassard, P. Hoyer, and A. Tapp, in Proceedings of the 4th Workshop on Physics and Computation, edited by T. Toffoli et al. 共New England Complex Systems Institute, Boston, 1996兲, p. 36; e-print quant-ph/9605034; Fortschr. Phys. 46, 493 共1998兲. 关7兴 M.O. Rabin, J. Number Theory 12, 128 共1980兲; in Algorithms

and Complexity, Recent Results and New Directions, edited by J.F. Traub 共Academic Press, New York, 1976兲, p. 21; C.L. Miller, J. Comput. Syst. Sci. 13, 300 共1976兲. C. Bennett, E. Bernstein, G. Brassard, and U. Vazirani, SIAM J. Comput. 26, 1510 共1997兲. D. Aharonov, A. Kitaev, and N. Nisan, in Proceedings of the 30th Annual ACM Symposium on The Theory of Computing, 共ACM Press, New York, 1998兲, p. 20. P. Ribenboim, The New Book of Prime Number Records 共Springer-Verlag, New York, 1996兲. L. Monier, Theor. Comput. Sci. 12, 97 共1980兲. R. Gingrich, C. Williams, and N. Cerf, e-print quant-ph/9904049. H.F. Chau and H.K. Lo, e-print quant-ph/9508005. G.H. Hardy and J.E. Littlewood, Acta Math. 44, 1 共1923兲; I.M. Vinogradov, Dokl. Akad. Nauk SSSR 15, 169 共1937兲. J.R. Chen and Y. Wang, Acta Math. Sci. Sin. 32, 702 共1989兲.

Q⯝O„共 log N 兲 ␳ …, ␳ ⬎ ␮ /2, P⯝O„共 log N 兲 ␴ …. ␴ ⬎ ␳ ,

共A6兲

so that 1⬍ f Q ⬍Q/2⫺1 in the main loop of the algorithm, and W⭓8/␲ 2 关 1 then 具 E n⬘ 兩 E n⬘ 典 ⭐O( P ⫺2( ␴ ⫺ ␳ ) ) ⫺( ␴ ⫺ ␳ ) ⫺O( P ) 兴 . If we want to test the 2N dependence of r 2 (2N) with a theoretical error 兩 ⌬r 2 共 2N 兲 兩 theor ⯝O„N 共 log N 兲 ⫺ ␮ ⫺ ␯ …, ␯ ⬎0,

关1兴 关2兴 关3兴 关4兴

关8兴 关9兴

关10兴 关11兴 关12兴 关13兴 关14兴 关15兴

032312-8