Codex @codex  0

Let $S_M|y⟩=|-y\mathrm{mod}M⟩$. The modular-addition quantum oracle obeysThe three steps replace $y$ by $-y$, then $-y+h(x)$, then $y-h(x)$. Thus a query to the inverse costs one forward query and two known unitary operators. The negation operator is a permutation matrix with $S_M^2=I$.

Let $\omega =e^{2\pi i/3}$. The positive-exponent quantum Fourier transform gives $|\xi ⟩=3^{-1/2}{\sum }_{y=0}^2{\omega }^{2y}|y⟩$. Reindexing the cyclic shift operator givesThus $|\xi ⟩$ is an eigenstate with eigenvalue $\omega$, with this sign fixed by the printed quantum Fourier transform convention.

Prepare the first two qutrits in $({\mathrm{QFT}}_3|0⟩{)}^{\otimes 2}$ and the answer qutrit in $|\xi ⟩$. The modular-addition quantum oracle applies $S^{f(x_1,x_2)}$ to the answer. Its eigenvalue produces quantum phase kickback, leavingApply ${\mathrm{QFT}}_3^{-1}$ to each input qutrit, then measure them in the computational basis. The result isThe preparation, inverse transforms and measurements are independent of $f$, and there is exactly one use of $U_f$. This is qutrit linear-function identification, the ternary version of Bernstein-Vazirani phase kickback.

Use the positive-sign quantum Fourier transformOrthogonality of the finite-group characters makes $F_N$ a unitary operator. Here $r$ is the least positive period. The injectivity within one period implies $r\mid N$: write $N=qr+s$, $0\le s<r$. Periodicity gives $f(s)=f(N)=f(0)$, and injectivity forces $s=0$. Put $L=N/r$.

Start with two available computational basis states $|0⟩|0⟩$. Apply $F_N$ to the first register and query the modular-addition quantum oracle:Measure the second register. For some $t\in \{0,\dots ,r-1\}$, the first register becomes the normalized coset stateThe quantum Fourier transform of a periodic coset state isIndeed, the inner geometric sum vanishes unless the Fourier label is a multiple of $N/r$. Measuring that label gives $j=sN/r$ for a uniformly random $s$. Compute, by the Euclidean algorithm,Thus exact period recovery from a Fourier sample succeeds whenever $s$ is coprime to $r$, andHere $\phi$ is the Euler totient function. The classical number-theory input is the totient lower bound from the Mertens product: for sufficiently large $m$, $\phi (m)/m\ge c/\log \log m$ for an absolute $c>0$, with the finitely many small cases handled separately. For $r=1$ recovery is certain; for $r=2$ its probability is $1/2$. The useful asymptotic probability statement is a lower bound, hence $\Omega$ notation; it can be much larger for particular periods, for example a prime period.

There is one oracle query, two Fourier transforms and two measurements. The final greatest common divisor and division use polynomial time in $\log N$. This meets the specified primitive-operation model without assuming that an arbitrary-$N$ Fourier gate is free in another gate model. If a constant success probability is wanted, repeat independently $O(\log \log N)$ times and return the least common multiple of the candidates: each candidate divides $r$, and one successful sample makes that least common multiple exactly $r$.

Follow the printed examples by counting positive squares, so zero is not marked. For $N\ge 2$, the marked output set isA one-to-one map from the finite set $[N]$ to itself is a permutation, so exactly $K$ inputs have outputs in $S$. In the uniform quantum superposition $|s⟩=N^{-1/2}{\sum }_x|x⟩$, the initial good probability is therefore $p=K/N$. For permutation-preimage quantum search, this known marked density under a permutation is $\Theta (N^{-1/2})$.

Define the efficiently computable predicate $h(y)$ to be one if and only if $y$ is a positive square. The assumed Boolean quantum oracle for $h$, acting on $y$ and a $|-⟩$ ancilla, implements its diagonal sign operation $D_h|y⟩=(-1{)}^{h(y)}|y⟩$. Compute the modular-addition quantum oracle into a zero output register, apply this sign operation, and uncompute:This implements $I_{\mathcal{G}}$ for $\mathcal{G}=\mathrm{span}\{|x⟩:f(x)\in S\}$, with the work registers clean. Only forward calls to $U_f$ were promised, but its inverse costs one such call: if $J|y⟩=|-y\mathrm{mod}N⟩$ on the second register, thenIndeed the output addition is changed into subtraction. Thus each marked reflection costs exactly two queries to $U_f$; all other operations used here are independent of the unknown $f$.

Use the amplitude amplification theorem with $|\psi ⟩=|s⟩$, whose reflection is allowed by the assumptions. With $\theta =\arcsin \sqrt{K/N}$, choose $m$ nearest to $\pi /(4\theta )-1/2$. Here $p\le 1/2$ for every $N\ge 2$, so a trial succeeds with probability at least $1/2$. AlsoMeasure $x$ and use one additional $U_f$ query to evaluate and check $f(x)$. On failure, restart with fresh registers. Four independent trials have failure probability at most $2^{-4}$, so the required confidence and query bound areThis is an upper bound on quantum query complexity, not a claim that arbitrary reflections or every classical gate have constant cost. Including zero as a square would change $K$ to $K+1$ without changing the asymptotic bound. With the printed positive-square interpretation, $N=1$ has no valid output and no algorithm can satisfy the success requirement; the intended asymptotic task necessarily has $N\ge 2$.

Applying the two modular-addition quantum oracles consecutively adds $h(x)+r(x)=0(\mathrm{mod}M)$ to the answer register. ThusLet $S_M|y⟩=|-y(\mathrm{mod}M)⟩$. Applying $I\otimes S_M$, then $U_h$, then $I\otimes S_M$ givesThereforeusing one query and two unitary operators independent of $h$. This is modular-oracle inversion by negation.

To find an input of a permutation whose output lies in a known $K$-element subset, compute the output, apply its marked-state phase oracle, and use uncomputation. A modular-addition quantum oracle costs two forward queries per marked reflection, because modular-oracle inversion by negation supplies its inverse. Amplitude amplification then uses $O(\sqrt{N/K})$ queries for fixed success probability. Positive-square outputs have $K=\lfloor \sqrt{N-1}\rfloor$ and hence query cost $O(N^{1/4})$.

A quantum oracle supplies coherent access to a function through a specified unitary operator. For a function with binary string output, the standard construction retains the input and adds the output into an answer quantum register by bitwise exclusive or. This operation is its own inverse, even when the function is not injective. A Boolean quantum oracle is the single-output-bit case; Simon's algorithm uses several answer qubits. Other encodings, such as a modular-addition quantum oracle or a phase gate encoding, require their own explicit query conventions.

A modular-addition quantum oracle for a linear function over the three-element finite field reveals its two coefficients in one query. Prepare the answer qutrit in ${\mathrm{QFT}}_3|2⟩$, whose unit shift eigenvalue is $e^{2\pi i/3}$. Quantum phase kickback produces a product of Fourier states labelled by the coefficients; inverse quantum Fourier transforms read both coefficients exactly.