Past exam of the mathematics course of the University of Cambridge / 2017 / iii / Paper 324 (Quantum Computation)

Use the positive-exponent quantum Fourier transform convention $F_N|x⟩=N^{-1/2}{\sum }_t{e}^{2\pi ixt/N}|t⟩$. The period of a function here is the least positive translation leaving the function unchanged on the cyclic group ${\mathbb{Z}}_N$. The injective promise means $f(x)=f(x^{\prime })$ exactly when $x\equiv x^{\prime }(\mathrm{mod}r)$. In particular $r\mid N$: the subgroup of period translations is generated by $r$, and wrapping the argument by $N$ preserves its value. This is exact quantum period finding on a finite cyclic group, rather than the truncated, nondividing-period version requiring continued fractions.

Prepare a uniform superposition state in the first quantum register using $F_N|0⟩$, and perform a reversible computation of the function into a second quantum register, cleaning its workspace by uncomputation:A quantum measurement in the computational basis of the second quantum register leaves a periodic coset state in the first:For the quantum Fourier transform of this periodic coset state, the finite geometric series vanishes unless the measured label is $t=mN/r$. On those labels its normalized amplitude is $r^{-1/2}{e}^{2\pi iam/r}$. Thus $m$ has the uniform distribution on a finite set on $\{0,\dots ,r-1\}$, irrespective of $a$.

Compute the greatest common divisor by the Euclidean algorithm, and set $q=N/\gcd (t,N)$, with $\gcd (0,N)=N$. Since $t=mN/r$,The exact period recovery from a Fourier sample is therefore certified by testing $f(q\mathrm{mod}N)=f(0)$. Every candidate $q$ divides $r$ and lies between $1$ and $r$, so the injective promise makes that equality equivalent to $q=r$. This includes $r=N$, where the test uses input $0$, and $r=1$, which always succeeds. The test does not assert that an arbitrary equality of function values certifies an arbitrary period; the Fourier-derived divisor restriction is essential.

The concise result isHere $\phi$ is the Euler totient function, with $\phi (1)=1$. The totient lower bound from the Mertens product gives $\phi (r)/r=\Omega (1/\max \{1,\log \log N\})$ for $r\le N$. Each trial uses polynomial time quantum Fourier transforms, function evaluations and Euclidean algorithm arithmetic in $\log N$. Repeating $O(\max \{1,\log \log N\})$ independent trials gives constant success probability; the herald accepts only correct answers.

The printed asymptotic bound has the wrong direction for this argument. In Big O notation, the stated upper bound on the number of coprime integers supplies no success lower bound and is itself false uniformly: for prime $N$, $\phi (N)=N-1$, not $O(N/\log \log N)$. Likewise the single-trial success need not be $O(1/\log \log N)$, since it tends to one for $r=N$ prime. The meaningful corrected guarantee is the lower bound above. If an upper-bounded success rate is literally required, one may deliberately retain an accepted result with an independent probability proportional to $1/\max \{1,\log \log N\}$; this discards useful successes and is unnecessary for efficient recovery.

First require $x\ne 0$. A discrete logarithm to a generator of a group of ${\mathbb{Z}}_p^{\ast }$ exists only for nonzero $x$; the printed membership $x\in {\mathbb{Z}}_p$ inadvertently also permits zero, for which $x^{-b}$ is undefined. Zero can be rejected before any quantum circuit.

Put $M=p-1$ and write $x=g^y$. Since $g$ is a generator of a group of order $M$, the map $k\mapsto g^k$ is a bijection from ${\mathbb{Z}}_M$ to the multiplicative group of a finite field. Hence every nonzero $c$ has a unique $k\in {\mathbb{Z}}_M$ with $c=g^k$. Equality of powers of $g$ is equality of their exponents modulo $M$, givingThe fiber over $c$ is an affine coset of the subgroup $\{(yb,b):b\in {\mathbb{Z}}_M\}$, and contains exactly $M$ pairs. This identifies the hidden subgroup problem underlying discrete-logarithm Fourier sampling; knowing $k$ numerically is not needed to construct the coset state.

Let $k_0$ be the unique discrete logarithm of the measured value $c_0$, so that $c_0=g^{k_0}$. The fiber calculation gives exactly the pairs $(yb+k_0,b)$ with $b\in {\mathbb{Z}}_M$, where $M=p-1$. The initial amplitude of each pair is $1/M$, so the Born rule assigns probability $M/M^2=1/M$ to this outcome.

After projective measurement and normalization, the first two quantum registers are in the coset stateThe measured third quantum register factors as $|c_0⟩$ and may be omitted. There is no loss of coherence between the $M$ terms in this post-measurement state: the quantum measurement reveals the common function value, not an individual input pair.

Apply the same positive-exponent quantum Fourier transform to each of the two quantum registers. The amplitude at $(c_1,c_2)$ of the coset state isThe finite geometric series is $M$ when $y{c}_1+c_2\equiv 0(\mathrm{mod}M)$ and zero otherwise. ThereforeThere are $M$ allowed pairs, with $c_1$ following the uniform distribution on a finite set. The factor $e^{2\pi i{k}_0{c}_1/M}$ changes the probability amplitudes by phases depending on the output label $c_1$, but has no effect on their probabilities. Using an inverse rather than forward quantum Fourier transform on both quantum registers gives the same support relation.

A modular inverse of $c_1$ exists precisely when $\gcd (c_1,M)=1$. In that case the discrete logarithm isIt cannot generally be determined from every allowed pair. Put $d=\gcd (c_1,M)$. The supported linear congruence has $d$ solutions modulo $M$, and determines only $y$ modulo $M/d$; $(0,0)$ gives no information when $M>1$. For instance $p=5$ and $(c_1,c_2)=(2,2)$ are compatible with both $y=1$ and $y=3$. One may verify a candidate by modular exponentiation, checking $g^y=x$. Repeated discrete-logarithm Fourier sampling finds an invertible $c_1$ with per-trial probability $\phi (M)/M$, which has the same totient lower bound from the Mertens product as before. When $p=2$, the group is trivial and $x=1,y=0$ are determined without Fourier samples.

Assume first $0<k<N$. Define the orthonormal quantum statesand $\theta \in (0,\pi /2)$ by $\sin \theta =\sqrt{k/N}$. The relevant invariant subspace is the two-dimensional span of these quantum states, not the entire Hilbert space. The uniform quantum superposition is $|{\psi }_0⟩=\cos \theta |B⟩+\sin \theta |G⟩$.

In the ordered orthonormal basis $(|B⟩,|G⟩)$, the marked-state phase oracle is the reflection operator $I_G=\mathrm{diag}(1,-1)$. Since $I_0=I-2|0^n⟩⟨0^n|$, conjugation by the Walsh-Hadamard transform gives the Grover diffusion operatorIt is the reflection in the line through $|{\psi }_0⟩$. The product of these two reflection operators is a rotation matrix by $2\theta$ toward the marked quantum state:Thus the Born rule gives $P_j={\sin }^2((2j+1)\theta )$. Choose a nonnegative integer $j_{\ast }$ nearest to $\pi /(4\theta )-1/2$. Rounding changes the angle from $\pi /2$ by at most $\theta$, soEach Grover search algorithm iteration uses one marked-state phase oracle query; all other gates are known. A final quantum measurement in the computational basis therefore produces a uniformly chosen marked item, conditional on success, with probability better than one half when $k<N/2$. This uses the supplied marked count $k$ to select the stopping time; an unknown $k$ needs an additional search schedule or counting procedure. If $k=N$, no oracle query is needed; if $k=0$, no marked item exists, so a successful search is impossible.

Interpret a function collision as two distinct inputs with equal outputs. Without distinctness the request is vacuous, since an input paired with itself always qualifies. Set $m=\lceil N^{1/3}\rceil$ (handling small $N$ by direct queries), choose a known set $A$ of size $m$, and query all its inputs. Store a classical table of their outputs and corresponding inputs. If this table contains a function collision, return it immediately.

Otherwise the table contains $m$ distinct outputs. Because $g$ is exactly two-to-one, each $a\in A$ has exactly one partner in $B$, the known complement of $A$. None lies in $A$, and different table outputs have different partners. Thus exactly $m$ inputs in $B$, of size $L=N-m$, satisfy the known-table membership predicateBuild a marked-state phase oracle for this predicate by a compute-phase-uncompute construction: use $U_g$ on a clean answer quantum register, reversibly compare its output against the classical table, apply the conditional minus sign, undo the comparison, and apply $U_g$ again. Since the answer operation is bitwise exclusive or, $U_g^{-1}=U_g$. All workspace returns to zero, and each phase query costs two calls to $U_g$.

Perform known-subset Grover search in the span of the computational basis states labelled by $B$, starting in their uniform superposition state. Reflection about this known state uses no $U_g$ queries; choosing $A$ as an initial interval makes $B$ a known interval that can also be encoded by its own $L$ labels. Its marked fraction is $m/L$, so the previous Grover rotation angle analysis uses $O(\sqrt{L/m})$ phase queries. On measuring $b$, one further $U_g$ query checks the output and retrieves its partner $a$ from the table. The inputs are distinct because the two sets are disjoint.

Consequently the quantum query complexity isFor large $N$, rounding the optimal Grover search algorithm iteration count gives success at least $1-m/(N-m)>1/2$. An internal table function collision already gives certain success. The balance $m\asymp \sqrt{N/m}$ explains the cube-root choice. This is the Brassard–Høyer–Tapp collision algorithm: its table uses $O(m\log N)$ classical bits. The bound counts calls to $U_g$, as requested; it does not charge table lookup and its reversible implementation as constant-time gates, or claim an overall polynomial time in $\log N$.

Use exact quantum phase estimation with $n$ control qubits initially $|0^n⟩$ and one target quantum register prepared in the given eigenvector $|\psi ⟩$. Apply Hadamard gates to the control qubits. If control bit $x_j$ has significance $2^j$, apply a controlled unitary gate $U^{2^j}$ from that qubit to the target. The target stays in $|\psi ⟩$, while quantum phase kickback producesSince $\varphi =c/2^n$, this is $F_{2^n}|c⟩\otimes |\psi ⟩$. The inverse quantum Fourier transform on the control quantum register therefore gives $|c⟩|\psi ⟩$. The quantum measurement in the computational basis returns $c$ with certainty, soThe quantum circuit below reads left to right. The upper wires are control qubits, with $q_0$ least significant; the vertical ellipsis represents the intervening control wires and powers. The inverse quantum Fourier transform acts on the entire control quantum register, including any bit-order permutations.

A supplied controlled-$U$ can implement controlled-$U^{2^j}$ by $2^j$ repetitions with the same control. Hence this exact quantum circuit uses $2^n-1$ calls to the supplied controlled-$U$, unless controlled powers are additionally available cheaply. The cost of exact phase estimation on a dyadic spectrum is not automatically polynomial in $n$; the question asks for an exact algorithm, not that stronger complexity guarantee. Exactness also uses the promised dyadic eigenphase, ideal gates, and the supplied inverse quantum Fourier transform.

Let $V$ denote the coherent exact quantum phase estimation unitary operator from the preceding part, with the data quantum register written first. For every eigenvector of $A$,because $e^{2\pi iA}|u_j⟩=e^{2\pi i{\lambda }_j}|u_j⟩$ and ${\lambda }_j=c_j/2^n$ lies in $[0,1)$, with no phase-aliasing ambiguity. Apply $V$ coherently to the input quantum state and a clean quantum register; do not measure the eigenvalue label. By linearity it produces ${\sum }_j{\beta }_j|u_j⟩|c_j⟩$.

Append a quantum ancilla in $|0⟩$, and use the provided quantum variable rotation with ${\theta }_{c_j}=\arcsin {\lambda }_j$, choosing the nonnegative cosine. The resulting normalized quantum state isThe sum covers both terms; this fixes the potentially ambiguous sum placement in the abbreviated display. The orthonormal basis of eigenvectors and the unit length of each rotated quantum ancilla show that its norm is one. This is quantum spectral filtering by multiplication, not the reciprocal rotation used in the HHL algorithm.

Apply $V^{-1}$ to the data and phase quantum registers, leaving the flag quantum ancilla untouched. This inverse needs no extra oracle assumption: the promised dyadic eigenvalues give $U^{2^n}=I$, hence $U^{-1}=U^{2^n-1}$. The inverse of each controlled unitary gate used in $V$ can therefore be built from repeated uses of the supplied controlled-$U$, and the known Hadamard gates and quantum Fourier transform gates can be reversed. Uncomputation is necessary to erase the eigenvalue label coherently. The resulting quantum state isA quantum measurement in the computational basis of the flag followed by postselection on one yieldsThis requires $A|b⟩\ne 0$. For a normalized input and nonnegative eigenvalues, the success probability of positive quantum spectral filtering satisfies $P_{\mathrm{success}}\ge {\lambda }_{\min }^2$. In the general inequality, equality holds precisely when the input is supported on the minimum-eigenvalue eigenspace. Omitting uncomputation and discarding the phase quantum register would instead leave a mixed state with diagonal weights proportional to $|{\beta }_j{|}^2{\lambda }_j^2$, rather than the desired coherent pure state.

The printed universal nonzero-success request needs a nonkernel-input hypothesis. An $n$-qubit Hermitian operator has $2^n$ eigenvalues, counted with multiplicity. All are distinct, and the printed dyadic grid contains exactly $2^n$ possible values. They therefore occupy the entire grid, including zero: this is a multiplicity-free complete dyadic spectrum, and ${\lambda }_{\min }=0$. Taking $n=1$, $A=\mathrm{diag}(0,1/2)$, and $|b⟩=|0⟩$ satisfies every printed spectral promise but gives $A|b⟩=0$. No normalized output vector exists, so no algorithm can deliver it with nonzero probability.

For every input outside the kernel, the procedure above has $P_{\mathrm{success}}>0={\lambda }_{\min }^2$, giving the requested strict bound on the meaningful domain. The corrected result is therefore exact quantum spectral filtering conditional on $A|b⟩\ne 0$, with the boxed probability. This does not require knowing the input probability amplitudes or making extra copies of an unknown quantum state. Arbitrarily small nonzero support outside the kernel gives arbitrarily small success probability, and a failed flag measurement disturbs the input; fresh independent trials cannot be assumed when only one unknown physical input is supplied.

The basic one-bit teleportation primitive uses the input as qubit 1 and a fresh $|+⟩$ quantum ancilla as qubit 2. Apply the Controlled-Z gate $E_{12}$ and measure qubit 1 in the equatorial qubit measurement basis with angle $\alpha$. If $s\in \{0,1\}$ is the result, the normalized post-measurement state on qubit 2 isBoth results have probability one half. For example, writing $|\psi ⟩=a|0⟩+b|1⟩$, the unnormalized branch is $(a|+⟩+(-1{)}^s{e}^{i\alpha }b|-⟩)/\sqrt{2}=X^{s}J(\alpha )|\psi ⟩/\sqrt{2}$. Thus $J(\alpha )$ is applied deterministically as a logical gate with known Pauli frame $X^s$; a permitted conditional Pauli X gate would remove this byproduct physically.

The literal resource restriction does not need an unstated direct Pauli X gate. A Pauli Z gate can be enacted by applying $E$ to the data and a fixed $|1⟩$ quantum ancilla. Two consecutive angle-zero one-bit teleportations, with results $p,q$, map an arbitrary current state $|\chi ⟩$ to $X^{q}H{X}^{p}H|\chi ⟩=X^q{Z}^p|\chi ⟩$. Apply the available $Z^p$ to remove the latter factor, up to an irrelevant global phase. This implements a heralded $X^q$: if $q=0$, the input is unchanged; if $q=1$, the required Pauli X gate has been applied.

If the original result is $s=1$ and a physically corrected output is required, repeat this heralded Pauli X correction using controlled-Z and measurements until $q=1$. Each attempt succeeds with probability one half independent of the input, so it terminates with probability one, using two attempts on average. Only $E$, fixed ancillary quantum states and single-qubit quantum measurements are used. This exact physical correction has no finite worst-case measurement bound; the standard finite deterministic realization is the logical Pauli frame version, which suffices for the later output-simulation parts.

Label the measured vertex of the four-cycle by $0$, its two neighbours by $1,3$, and the opposite vertex by $2$. The edges are $01,12,23,30$. By the definition of a graph state,All Controlled-Z gates commute. Conditioning on the computational basis value $r$ of vertex $0$, the factors on edges $01$ and $03$ act on their other endpoints as $Z_1^r$ and $Z_3^r$, since $E|r,a⟩=(-1{)}^{ra}|r,a⟩$. The remaining edges form the three-vertex path $1-2-3$:The Born rule gives probability one half for either result. Normalizing provesThis is computational-basis measurement of a graph-state vertex: remove the measured vertex and apply a known Pauli Z gate byproduct to each neighbour. The chosen labels specify precisely which factors occur; any vertex of the square can serve as vertex $0$ by relabelling.

The path graph state is $|{\psi }_3⟩=E_{23}{E}_{12}|+{⟩}_1|+{⟩}_2|+{⟩}_3$. The factor $Z_3^r$ commutes with both the Controlled-Z gates and the quantum measurement of vertex $1$. Treat $Z_1^r|+{⟩}_1$ as the input of one-bit teleportation. The equatorial qubit measurement result $s$ therefore gives the normalized stateHere the subscript on $Z_2^r$ expresses the teleported input factor; it is not an extra operation on the already measured vertex. Use $J(\alpha )Z^r=X^{r}J(\alpha )$ to obtainThe exclusive or exponent is equivalent to the printed sum $r+s$ because $X^2=I$. The conditional probability of $s$ is one half for either $r$, by the one-bit teleportation branch norm. This calculation concerns an equatorial measurement of a graph-state leaf; no third remaining qubit or extra $|-⟩$ factor is present.

Let the ideal two-qubit output before final quantum measurements beThe PDF places $J(\alpha )$ only on the upper wire, followed by the Controlled-Z gate and a quantum measurement in the computational basis on each output wire. Measure vertex $0$ of the square in the computational basis, obtaining $r$, then vertex $1$ of the surviving path in the fixed equatorial qubit measurement basis at angle $\alpha$, obtaining $s$. Put $t=r\oplus s$. The previous part gives $E_{23}{X}_2^{t}J(\alpha {)}_2{Z}_3^r|++⟩$.

Commute its Pauli frame through the Controlled-Z gate. Since $E_{23}{X}_2^t=X_2^t{Z}_3^t{E}_{23}$ and $E_{23}$ commutes with $Z_3^r$, the actual output isFinally measure vertices $2,3$ in the computational basis, with raw results $d_2,d_3$. A Pauli X gate flips a computational basis result, whereas a Pauli Z gate changes only its phase. Thus the purely classical correction isThis four-cycle graph-state simulation of an entangle-and-measure circuit reproduces the full joint output distribution, not just each marginal. All measurement bases are fixed beforehand, and no physical byproduct correction is necessary. As a check, the ideal Controlled-Z gate is diagonal in the output basis, so $P(k,l)=\frac{1}{2}{\cos }^2(\alpha /2)$ for $k=0$ and $\frac{1}{2}{\sin }^2(\alpha /2)$ for $k=1$, independently of $l$. The measurement procedure gives exactly these probabilities after its classical relabelling.

The logical depth of a measurement pattern counts sequential layers of quantum measurements forced by dependence of measurement bases on earlier outcomes. Depth one means every basis can be fixed before measurements start, allowing all quantum measurements on distinct qubits to be performed in parallel. This does not require depth-one resource-state preparation or constant-depth classical parity processing.

Suppose the circuit contains $m$ gates $J({\alpha }_1),\dots ,J({\alpha }_m)$ in time order, with each ${\alpha }_j\in \{0,\pi /2\}$. Prepare an $(m+1)$-vertex path graph state from $|+{⟩}^{\otimes (m+1)}$ and Controlled-Z gates between neighbours. Its first qubit supplies the specified input $|+⟩$. Measure vertex $j-1$ in the fixed equatorial qubit measurement basis at angle ${\alpha }_j$ for $j=1,\dots ,m$, obtaining $s_j$. Measure the final vertex in the computational basis, obtaining $d$.

Track the Pauli frame as $X^{a_j}{Z}^{b_j}$, starting with $a_0=b_0=0$. A hypothetical sequential reading of the same quantum measurements gives the step $X^{s_j}J({\alpha }_j)X^{a_{j-1}}{Z}^{b_{j-1}}$. The supplied commutation rules imply, up to global phase,For ${\alpha }_j=0$, the sign is irrelevant. For ${\alpha }_j=\pi /2$, the identity $J(-\pi /2)=XJ(\pi /2)$ absorbs the possible sign change into the Pauli frame. If $t_j=0$ for ${\alpha }_j=0$ and $t_j=1$ for ${\alpha }_j=\pi /2$, the update isInductively the final unmeasured quantum state would be $X^{a_m}{Z}^{b_m}J({\alpha }_m)\cdots J({\alpha }_1)|+⟩$. The final computational basis outcome is corrected by $a_m$ and is unaffected by $b_m$. The induction on a sequential interpretation proves the joint statistics; projectors on distinct vertices commute, so the identical fixed-basis pattern can actually be measured simultaneously, including its final vertex.

The first printed commutation formula has an incorrect exact scalar phase: with the printed matrix definition, $J(\alpha )X=e^{i\alpha }ZJ(-\alpha )$, rather than the negative-exponent prefactor. For example, at $\alpha =\pi /4$ the two versions differ by a factor $i$. They agree up to global phase, so this error does not affect the Pauli frame recurrence or any quantum measurement probability.

Consequently a fixed-basis path-state pattern of logical depth one simulates every such circuit. Only Pauli measurements occur: the angle-zero basis measures $X$, and the angle-$\pi /2$ basis measures $-Y$ with the printed eigenvector labels. Classical exclusive or processing suffices for all output corrections. These gates are Clifford gates, which explains why angle adaptation can be eliminated. For $m=0$, simply measure the initial $|+⟩$ in the computational basis; it is already a depth-one pattern.