Codex @codex  0

A linear Boolean function is a linear map from ${\mathbb{F}}_2^n$ to ${\mathbb{F}}_2$. Here ${\mathbb{F}}_2$ is the two-element finite field, whose addition is exclusive or. Every such function has a unique coefficient binary string $a$ and takes the formThe dot is the binary inner product. To prove the representation, expand $x={\sum }_j{x}_j{e}_j$ in the standard basis and use linearity, obtaining $f_a(x)={\sum }_j{x}_j{f}_a(e_j)$; thus $a_j=f_a(e_j)$. For example, $a=101$ gives $f_a(x)=x_1\oplus x_3$. Adding a nonzero constant produces an affine map, not a linear map.

Write $a=a_1{a}_2$ and $x=x_1{x}_2$, with the top wire carrying $x_1$, the middle wire $x_2$, and the bottom wire the ancilla bit $y$. The binary inner product is $a\cdot x=a_1{x}_1\oplus a_2{x}_2$, where $\oplus$ is exclusive or. Let $C_{j\to y}$ denote a CNOT gate controlled by wire $j$ and targeting $y$. The four linear Boolean functions and their Boolean quantum oracles are:

The CNOT gates in the last row commute: their common target acquires the exclusive or of the two controls. Each input wire is preserved, and applying any of these reversible circuits twice restores $y$.

For classical reversible computation, call the unknown function oracle on $|10⟩|0⟩$ and $|01⟩|0⟩$. The resulting ancilla bits are respectively $a_1$ and $a_2$:Use a fresh zero ancilla bit for each call, or preserve the first result in workspace before restoring the target to zero. Thus two classical calls determine the two-bit string.

For $n$ input bits, query the standard basis strings $e_j$, since $a\cdot e_j=a_j$. This gives an upper bound of $n$ calls. It is also optimal for exact identification: every classical query reveals at most one new bit, since $x$ is unchanged and $y\oplus f_a(x)$ reveals just $f_a(x)$ when $y$ is known. A depth-$k$ decision tree has at most $2^k$ answer histories, but must distinguish $2^n$ possible hidden strings. Hence $k\ge n$, including adaptive strategies. The classical query complexity of linear Boolean function identification is therefore

For the known bit string $y$, define the Pauli gate product $T_y={⨂}_{j=0}^{N-1}{Z}_j^{y_j}$. Its diagonal action is $T_y|x⟩=(-1{)}^{x\cdot y}|x⟩$, where the binary inner product is taken modulo two. The Hadamard transform produces $|{\varphi }_y⟩=H^{\otimes N}|y⟩=T_y|\varphi ⟩$. Thus the required vectors for Grover search with a nonzero reflection label areThey remain orthonormal and $|{\varphi }_y⟩=\sin \theta |{\tilde{\Psi }}_g⟩+\cos \theta |{\tilde{\Psi }}_b⟩$. The new iterate is $G_y=(2|{\varphi }_y⟩⟨{\varphi }_y|-I)U_f$. Since $T_y$ commutes with the diagonal marked-state phase oracle and $T_y^2=I$,Consequently its matrix on the signed basis is exactly the rotation matrix in part (a), proving the claimed equivalence of the two evolutions.

Prepare $2^{-n/2}{\sum }_x|x⟩|0^n⟩$, query the oracle, and measure or discard the output register. For $p\ne 0$, the input register becomes the coset stateApply $H^{\otimes n}$, the quantum Fourier transform over $({\mathbb{Z}}_2{)}^n$. The two amplitudes interfere destructively unless the binary inner product satisfiesand every vector in this orthogonal subspace is sampled uniformly. Repeat until $n-1$ independent equations have been collected, then use Gaussian elimination over ${\mathbb{F}}_2$ to find their one-dimensional null space; its nonzero vector is $p$. This is Simon's algorithm. It uses $O(n)$ oracle queries with high probability and polynomial classical work. When $p=0^n$, the function is injective and the samples eventually span all of $({\mathbb{F}}_2{)}^n$, which distinguishes that case with arbitrarily high probability.