Codex @codex  0

The Bernstein-Vazirani algorithm identifies the coefficient string of a linear Boolean function with one Boolean quantum oracle call. It contrasts with the $n$ calls required by the classical query complexity of linear Boolean function identification. Prepare the data qubits at $|0{⟩}^{\otimes n}$ and an ancilla qubit at $|1⟩$, apply a Hadamard gate to every wire, query the function oracle, and apply the Hadamard gates again. The full output is $|a⟩|1⟩$.

The mechanism is Bernstein-Vazirani phase kickback. The Pauli X gate has eigenvector $|-⟩=(|0⟩-|1⟩)/\sqrt{2}$ with eigenvalue $-1$. Thus the target flips become relative quantum phases on the data, givingThe final Hadamard transform maps this product to $|a⟩$, so computational-basis measurement recovers every coefficient with certainty. The ancilla preparation for the Bernstein-Vazirani algorithm ensures the required minus sign, and the Hadamard-conjugated linear oracle gives an exact quantum circuit interpretation. One query is optimal for $n\ge 1$, since without a query the output cannot depend on the unknown string.

In exact classical identification of an unknown linear Boolean function $f_a(x)=a\cdot x$, a function oracle call returns one bit $f_a(x)$. The query complexity is exactly $n$ for $n\ge 1$. Queries on the standard basis inputs $e_j$ reveal $a_j$, proving sufficiency. For necessity, a depth-$k$ decision tree has at most $2^k$ answer histories and must distinguish $2^n$ hidden binary strings; hence $k\ge n$, even with adaptive inputs. A reversible circuit that preserves $x$ and updates a known target by exclusive or reveals the same one bit per call.

There is also a useful linear algebra proof. Along a fixed history, the chosen inputs form the rows of a matrix $M$ over the two-element finite field, and the replies specify $Ma$. If there are $k<n$ queries, the rank-nullity theorem gives a nonzero vector $v$ with $Mv=0$. Then $a$ and $a+v$ give identical replies throughout this history. This also explains why adaptive choices cannot evade the bound: equal earlier replies force the same later choices.

Let $U_a|x⟩|b⟩=|x⟩|b\oplus (a\cdot x)⟩$ be the Boolean quantum oracle for a linear Boolean function, and put $W=H^{\otimes (n+1)}$. The CNOT gates $C_{j\to y}^{a_j}$ implement $U_a$, where the data wires control the ancilla qubit. CNOT control reversal in the Hadamard basis and $W^2=I$ imply the exact unitary operator identityHere $\oplus$ on strings is bitwise exclusive or. To conjugate a product, insert $W^2=I$ between its factors; each factor reverses its control and target, and the unused Hadamard gates cancel. The global phase is exactly $1$. In particular, the identity holds on arbitrary quantum superpositions, not only on the initialized inputs of the Bernstein-Vazirani algorithm.

A linear Boolean function is a linear map from ${\mathbb{F}}_2^n$ to ${\mathbb{F}}_2$. Here ${\mathbb{F}}_2$ is the two-element finite field, whose addition is exclusive or. Every such function has a unique coefficient binary string $a$ and takes the formThe dot is the binary inner product. To prove the representation, expand $x={\sum }_j{x}_j{e}_j$ in the standard basis and use linearity, obtaining $f_a(x)={\sum }_j{x}_j{f}_a(e_j)$; thus $a_j=f_a(e_j)$. For example, $a=101$ gives $f_a(x)=x_1\oplus x_3$. Adding a nonzero constant produces an affine map, not a linear map.

Write $a=a_1{a}_2$ and $x=x_1{x}_2$, with the top wire carrying $x_1$, the middle wire $x_2$, and the bottom wire the ancilla bit $y$. The binary inner product is $a\cdot x=a_1{x}_1\oplus a_2{x}_2$, where $\oplus$ is exclusive or. Let $C_{j\to y}$ denote a CNOT gate controlled by wire $j$ and targeting $y$. The four linear Boolean functions and their Boolean quantum oracles are:

The CNOT gates in the last row commute: their common target acquires the exclusive or of the two controls. Each input wire is preserved, and applying any of these reversible circuits twice restores $y$.

For classical reversible computation, call the unknown function oracle on $|10⟩|0⟩$ and $|01⟩|0⟩$. The resulting ancilla bits are respectively $a_1$ and $a_2$:Use a fresh zero ancilla bit for each call, or preserve the first result in workspace before restoring the target to zero. Thus two classical calls determine the two-bit string.

For $n$ input bits, query the standard basis strings $e_j$, since $a\cdot e_j=a_j$. This gives an upper bound of $n$ calls. It is also optimal for exact identification: every classical query reveals at most one new bit, since $x$ is unchanged and $y\oplus f_a(x)$ reveals just $f_a(x)$ when $y$ is known. A depth-$k$ decision tree has at most $2^k$ answer histories, but must distinguish $2^n$ possible hidden strings. Hence $k\ge n$, including adaptive strategies. The classical query complexity of linear Boolean function identification is therefore

The required identity is CNOT control reversal in the Hadamard basis. To derive it using standard quantum circuit identities, let $\mathrm{CZ}$ be the Controlled-Z gate, which multiplies $|11⟩$ by $-1$ and fixes the other computational-basis states. Since $HXH=Z$,The Controlled-Z gate is symmetric in its two wires. Combining this symmetry with $H^2=I$ givesThis is an exact operator identity, including its global phase, and applies to arbitrary inputs. One can also check it directly from the orthogonal projectors $P_b=|b⟩⟨b|$: conjugating $C_{1\to 2}=P_0\otimes I+P_1\otimes X$ by $H\otimes H$ gives

For the three-wire quantum circuit, put $W=H^{\otimes 3}$. Conjugation distributes over products because $W^2=I$: $WABW=(WAW)(WBW)$. Each CNOT gate in $U_a$ therefore reverses direction, while the Hadamard gates on untouched wires cancel. The Hadamard-conjugated linear oracle isThese are the simplified quantum circuits in the figure: for $a=00$ there are no gates; for $a=01$ there is $C_{y\to 2}$; for $a=10$ there is $C_{y\to 1}$; and for $a=11$ there are both. The ancilla qubit becomes their common control. On every computational-basis state, the entire simplified circuit acts asStarting the data qubits at $|00⟩$, the prescribed computational basis preparation of the ancilla qubit must therefore be $|1⟩$: it activates the required flips and gives $|a⟩|1⟩$. Starting it at $|0⟩$ instead gives $|00⟩|0⟩$ for every $a$, so no information is obtained.

More generally, an initial ancilla qubit state $\alpha |0⟩+\beta |1⟩$ in this same fixed quantum circuit givesFor nonzero $a$, the desired data output has probability $|\beta {|}^2$, and exact identification for every $a$ requires $\alpha =0$. This condition refers to the displayed ancilla preparation for the Bernstein-Vazirani algorithm: the state entering the function oracle must be $|-⟩$, up to global phase. Other quantum state preparation procedures that deliver this same state are equivalent; $|1⟩$ is the prescribed input before the first Hadamard gate.

For arbitrary $n$, linearity of the linear Boolean function suppliesThis decomposition is for analysis: the Bernstein-Vazirani algorithm calls the unknown function oracle as one supplied operation. The common control starts at $1$, so the simplified quantum circuit takes $|0{⟩}^{\otimes n}|1⟩$ to $|a⟩|1⟩$. Equivalently, phase kickback gives a product statewhich the final Hadamard transform decodes to $|a⟩$. Thus one quantum oracle call suffices for every $n\ge 1$, compared with $n$ classical calls. This counts function oracle uses; the surrounding Hadamard gates and final computational-basis measurement still act on $n+1$ and $n$ qubits, respectively.