Codex @codex  0

A quantum computing apparatus needs a scalable quantum register of controllable qubits, reproducible initialization, a universal quantum gate set, sufficiently long quantum coherence, and selective readout. A qubit is a two-dimensional state space; several qubits occupy a tensor product space and can develop entanglement. Quantum state preparation must establish a known low-entropy input and supply fresh ancillas during quantum error correction. A universal quantum gate set may use arbitrary single-qubit rotations with an entangling two-qubit gate such as controlled-NOT gate. Quantum coherence and control fidelity must suffice for the intended circuit, and measurement must recover chosen output probabilities without uncontrolled disturbance of other qubits. These are the five DiVincenzo criteria.^[ref]

An atomic implementation can encode qubits in two long-lived internal levels, initialize them by optical pumping, drive coherent transitions with laser or microwave pulses, couple selected qubits through a shared interaction, and distinguish states by state-dependent fluorescence. For trapped ions, a shared vibrational mode can mediate entangling gates, so motional control and cooling are part of the computational apparatus. The motion is a resource only while uncontrolled heating does not erase the required quantum coherence.

The computational resource is coherent control of amplitudes and entanglement, with interference making useful outcomes likely. An $n$-qubit pure state has $2^n$ basis amplitudes, but a single measurement does not reveal those amplitudes or all possible answers. Algorithms exploit structure rather than simply reading out parallel classical computations. The Shor algorithm gives factoring with polynomial resource scaling in the input bit length, compared with the best known classical algorithms' superpolynomial scaling; an exponential classical lower bound has not been proved.^[ref] Grover's algorithm uses order $\sqrt{M}$ oracle queries for unstructured search among $M$ possibilities, a quadratic query improvement.^[ref] Quantum simulation is a further motivation because interacting quantum systems can require exponentially many classical amplitudes for a direct generic representation.

The main challenges are quantum decoherence, fluctuating control fields, imperfect gates, leakage out of the qubit subspace, readout errors, crosstalk, and the difficulty of scaling connectivity and calibration. Faster control can introduce extra errors, while stronger isolation can make preparation and readout harder. Quantum error correction encodes logical information redundantly in several physical qubits and extracts error syndromes without measuring the unknown logical state itself. Fault-tolerant quantum computation prevents the correction apparatus and gates from spreading a few faults into uncorrectable logical errors. It requires error rates below an architecture- and noise-dependent threshold and substantial resources; there is no universal numerical threshold for all implementations. Advantages are task-dependent, while reliable scaling requires both coherent hardware and error control.

Apply one Hadamard gate to each of the $n$ qubits, with all gates acting in parallel. This quantum circuit implements the tensor product $H^{\otimes n}$; it needs $n$ single-qubit gates and one layer. For one qubit,Taking the tensor product of these expressions multiplies the probability amplitudes and adds their exponents, givingHere the dot product is evaluated using modular arithmetic modulo two.

In particular, an initially zero quantum register becomes the uniform quantum superpositionThis is useful at the start of a quantum algorithm because a subsequent quantum oracle acts on all these components coherently. Later quantum interference can reveal a global property of the function. Measuring immediately would merely produce a uniformly random binary string; the useful resource is the preserved quantum coherence, rather than the ability to read every function value in one run.

Write $\oplus$ for bitwise exclusive or. Both quantum registers begin in $|0^n⟩$. After the first Hadamard transform their joint quantum state isThe quantum oracle $U_f$ maps each component $|x⟩|0^n⟩$ to $|x⟩|f(x)⟩$. By linearity, the required quantum state is thereforeThe different first-register computational-basis states are orthogonal, so there are $2^n$ orthogonal joint components of squared probability amplitude $2^{-n}$, even though some second-register values coincide. Thus the displayed quantum state is normalized.

An observed value $k$ must lie in the image of $f$. Choose either preimage $x_k$. The two-to-one function promise and $s\ne 0^n$ imply that its preimages are exactly $x_k$ and $x_k\oplus s$. A computational-basis measurement of the second quantum register projects the joint quantum state onto the unnormalized vectorBy the Born rule, $\mathrm{Pr}(k)=2^{1-n}$. Dividing by its square root gives the conditional first-register pure stateChoosing the other preimage merely interchanges the two summands. The result is a Simon coset state, retaining quantum coherence between the two inputs that share the measured function value. Outcomes outside the image have probability zero and hence no conditional state to normalize.

Apply the Hadamard transform to the conditional quantum state from c. Since $(x_k\oplus s)\cdot z=x_k\cdot z+s\cdot z$ modulo two, its output isIf $s\cdot z=1$, the two probability amplitudes cancel by destructive quantum interference. If $s\cdot z=0$, they add, givingThus every observed string obeys $\boxed{z\cdot s=0}$. This Simon Fourier sampling is uniform on the $(n-1)$-dimensional vector subspace $s^{\perp }$ over the two-element field. Indeed, the nonzero linear functional $z\mapsto z\cdot s$ has a kernel of dimension $n-1$ by the rank-nullity theorem. The distribution does not depend on $k$, so measuring or discarding the second quantum register gives the same statistics for the first.

The Walsh-Hadamard transform is the tensor product of one Hadamard gate on each qubit. Indeed,The network therefore consists of $n$ parallel Hadamard gates, with no interaction between wires. Applied to an all-zero quantum register, it produces the uniform quantum superposition of all $2^n$ input strings. This lets a Boolean quantum oracle act coherently on all those inputs; a subsequent operation can turn their relative phases into useful interference. It does not permit reading all oracle values from a single measurement in quantum mechanics.

For the supplied linear-phase input, the amplitude on output $y$ isEach factor is obtained by summing over the independent bit $x_j$. This directly proves the relevant orthogonality of the binary Fourier phases, and yields the output state $|a⟩$ exactly.

For exact classical identification, query the Boolean function at the $n$ standard unit vectors: $f(e_j)=a_j$. Hence $n$ oracle calls suffice. They are also necessary in the worst case, even with adaptive queries: every answer supplies one binary linear equation in the unknown string. With fewer than $n$ queries, their coefficient matrix has matrix rank at most the number of queries, so its null space contains a nonzero string $h$. The strings $a$ and $a\oplus h$ give identical answers along that adaptive transcript and cannot both be identified correctly. Equivalently, a depth-$t$ binary decision tree has at most $2^t$ leaves and must distinguish $2^n$ possibilities. Thus the exact classical query count is $n$. This concerns exact recovery, rather than allowing an arbitrary error probability.

The quantum network in the lower panel starts its data quantum register in $|0{⟩}^{\otimes n}$ and its answer ancilla qubit in $|-⟩$, which can be prepared as $H|1⟩$. Apply Hadamard gates to the data wires, make one Boolean quantum oracle call, then apply Hadamard gates again to all data wires. Quantum phase kickback producesA computational-basis measurement of the data wires gives all bits of $a$ with certainty. This is Bernstein-Vazirani phase kickback: one quantum query, $2n$ data Hadamard gates, and one answer-state preparation suffice. The answer ancilla qubit stays separate from the data at the output.

Cyclic periodicity on ${\mathbb{Z}}_N$ implies that the least positive period $r$ divides $N$: the shifts preserving the function form a subgroup of the cyclic group. Injectivity within one period says that distinct residue classes modulo $r$ have distinct function values. Write $L=N/r$.

Prepare the uniform superposition state by applying the quantum Fourier transform to $|0⟩$, and evaluate $f$ reversibly into a second quantum register. This is efficient because the given classical Boolean circuit can be converted into a reversible circuit, with its workspace cleaned by uncomputation. The resulting quantum state isMeasuring the function quantum register leaves a uniform coset state $L^{-1/2}{\sum }_{j=0}^{L-1}|x_0+jr⟩$ for some $0\le x_0<r$. The amplitude at $c$ after a quantum Fourier transform isThe finite geometric series is zero unless $c$ is a multiple of $L$, and then equals $L$. Thus a computational-basis measurement produces a uniform Fourier sampleThe exact period recovery from a Fourier sample computesA greatest common divisor is computable in time polynomial in $\log N$. The candidate is always a divisor of the true period, and equals it precisely when $s$ is coprime to $r$.

For the success flag, compute $f(\hat{r}\mathrm{mod}N)$ and compare with $f(0)$. If $\hat{r}<r$, injectivity within the first period makes these unequal. If $\hat{r}=r$, periodicity makes them equal, including $r=N$. Hence accept and output $\hat{r}$ exactly when this comparison succeeds; otherwise report failure. This is heralded exact quantum period finding when the period divides the register size, with no false acceptance. The case $r=1$ succeeds even on the sample $c=0$.

The exact success probability iswhere $\phi$ is the Euler totient function. For $r\mid N$, the prime-product formula gives $\phi (r)/r\ge \phi (N)/N$. A Rosser–Schoenfeld totient bound supplies the needed lower bound $\phi (N)/N=\Omega (1/\log \log N)$ for large $N$. Every single attempt, including verification, has the assumed polynomial-in-$\log N$ gate cost. Repeating $O(\log \log N)$ times gives constant success probability with a certified result whenever one is found.

The printed $O$ in the totient hint should be a lower-bound statement, $\Omega$. Literally, $\phi (N)=O(N/\log \log N)$ is false: at primes $N$, $\phi (N)=N-1$. Likewise the exact single-sample success probability need not be $O(1/\log \log N)$; for prime period it tends to one. The useful intended guarantee is the displayed inverse-log-log lower bound, not a universal upper bound. If an algorithm satisfying the literal success upper bound is desired, one can additionally accept an otherwise certified run only when $k=\lceil \log \log N\rceil$ independent fair bits are all zero. This retains a detectable failure flag and polynomial runtime, and has success at most $2^{-k}=O(1/\log \log N)$, but deliberately weakens the useful guarantee. The standard unsuppressed algorithm above gives the stronger intended performance. Small $N$ can be handled directly. Primary evidence for the totient lower bound is Theorem 15, equations (3.41)–(3.42), in denisevellachemla.eu/Rosser-Schoenfeld-1962.pdf .

Put $M=2^m$ and prepare $m$ control qubits in $|0{⟩}^{\otimes m}$ and the target in the supplied eigenstate $|\psi ⟩$. Apply a Hadamard gate to every control qubit. Let $k={\sum }_{j=0}^{m-1}{2}^j{k}_j$ denote the integer encoded in that quantum register.

For every $j$, apply a controlled unitary gate $U^{2^j}$ with control $k_j$ and the same target. The quantum phase kickback yieldsApplying ${\mathrm{QFT}}_M^{-1}$ to the controls therefore produces $|x⟩$ exactly. A computational-basis measurement returns $x$ with certainty, and the algorithm outputsThis is exact quantum phase estimation; exactness uses the finite dyadic phase promise, not a rounding argument.

Only a controlled-U gate is supplied as a primitive. Its $2^j$ repetitions implement controlled-$U^{2^j}$, so the total number of black-box uses is ${\sum }_{j=0}^{m-1}{2}^j=2^m-1$. Access to powers as unit-cost primitives would be a different quantum query complexity model. This distinction is the cost of exact phase estimation on a dyadic spectrum.

The quantum circuit has one control wire per binary digit and one target quantum register. Every control starts in $|0⟩$, receives a Hadamard gate, controls the corresponding power $U^{2^j}$, and then enters the collective inverse quantum Fourier transform. Only the control register is measured; the target stays in $|\psi ⟩$.

The omitted intermediate wires continue the pattern $j=0,1,\dots ,m-1$. The inverse quantum Fourier transform black box is defined on the integer basis $|k⟩$ with $k={\sum }_j{2}^j{k}_j$, so the displayed ordering introduces no hidden bit reversal. The measured bits satisfyEach controlled power box represents $2^j$ sequential controlled-$U$ uses when only that primitive is available.

Write $X$ and $Y$ for the classical quantum registers $\tilde{X}$ and $\tilde{Y}$. By the quantum mutual information formula $I(U:V)=S(U)+S(V)-S(UV)$, expanding the right-hand side of the quantum mutual information balance identity givesAll Von Neumann entropies here are evaluated in $\omega$.

We use three facts: quantum mutual information is nonnegative by nonnegativity of quantum relative entropy; a local quantum channel cannot increase it by data processing for quantum mutual information; and the quantum mutual information of a classical-quantum state is its ensemble's Holevo quantity. Write $\chi (\mathcal{T})$ for the Holevo capacity, the supremum of the output Holevo quantity over finite input ensembles.

The $XB$ marginal is an output ensemble for $\mathcal{E}$, with inputs $\rho (x{)}_A={\mathrm{Tr}}_C\rho (x{)}_{AC}$. Consequently $I(X:B{)}_{\omega }\le \chi (\mathcal{E})$. Also ${\omega }_{XBD}$ is obtained from ${\sigma }_{XYD}$ by a quantum channel on $XY$ which retains $X$ and prepares $B$ from $Y$. HenceTo bound the latter even for entangled states $\rho (x{)}_{AC}$, exhibit the conditional input ensemble after a local measurement. Setwhen $q(y|x)>0$; zero-weight outcomes can be omitted. The numerator is a positive operator, its trace is $q(y|x)$, and the $q(y|x)$ sum to one. ThusThis is a classical-quantum state with an output ensemble for $\mathcal{N}$, so $I(XY:D{)}_{\sigma }\le \chi (\mathcal{N})$. Combining these bounds with $I(B:D{)}_{\omega }\ge 0$ yieldsThe last step takes the supremum over all input ensembles on $AC$. The left-hand channel direction is $B\leftarrow A$, as established in part (i); the printed $A\leftarrow B$ in the last inequality is a typographical reversal. Independent product ensembles also give the reverse inequality, so this proves Holevo-capacity additivity for entanglement-breaking channels.

Use the positive-exponent quantum Fourier transform convention $F_N|x⟩=N^{-1/2}{\sum }_t{e}^{2\pi ixt/N}|t⟩$. The period of a function here is the least positive translation leaving the function unchanged on the cyclic group ${\mathbb{Z}}_N$. The injective promise means $f(x)=f(x^{\prime })$ exactly when $x\equiv x^{\prime }(\mathrm{mod}r)$. In particular $r\mid N$: the subgroup of period translations is generated by $r$, and wrapping the argument by $N$ preserves its value. This is exact quantum period finding on a finite cyclic group, rather than the truncated, nondividing-period version requiring continued fractions.

Prepare a uniform superposition state in the first quantum register using $F_N|0⟩$, and perform a reversible computation of the function into a second quantum register, cleaning its workspace by uncomputation:A quantum measurement in the computational basis of the second quantum register leaves a periodic coset state in the first:For the quantum Fourier transform of this periodic coset state, the finite geometric series vanishes unless the measured label is $t=mN/r$. On those labels its normalized amplitude is $r^{-1/2}{e}^{2\pi iam/r}$. Thus $m$ has the uniform distribution on a finite set on $\{0,\dots ,r-1\}$, irrespective of $a$.

Compute the greatest common divisor by the Euclidean algorithm, and set $q=N/\gcd (t,N)$, with $\gcd (0,N)=N$. Since $t=mN/r$,The exact period recovery from a Fourier sample is therefore certified by testing $f(q\mathrm{mod}N)=f(0)$. Every candidate $q$ divides $r$ and lies between $1$ and $r$, so the injective promise makes that equality equivalent to $q=r$. This includes $r=N$, where the test uses input $0$, and $r=1$, which always succeeds. The test does not assert that an arbitrary equality of function values certifies an arbitrary period; the Fourier-derived divisor restriction is essential.

The concise result isHere $\phi$ is the Euler totient function, with $\phi (1)=1$. The totient lower bound from the Mertens product gives $\phi (r)/r=\Omega (1/\max \{1,\log \log N\})$ for $r\le N$. Each trial uses polynomial time quantum Fourier transforms, function evaluations and Euclidean algorithm arithmetic in $\log N$. Repeating $O(\max \{1,\log \log N\})$ independent trials gives constant success probability; the herald accepts only correct answers.

The printed asymptotic bound has the wrong direction for this argument. In Big O notation, the stated upper bound on the number of coprime integers supplies no success lower bound and is itself false uniformly: for prime $N$, $\phi (N)=N-1$, not $O(N/\log \log N)$. Likewise the single-trial success need not be $O(1/\log \log N)$, since it tends to one for $r=N$ prime. The meaningful corrected guarantee is the lower bound above. If an upper-bounded success rate is literally required, one may deliberately retain an accepted result with an independent probability proportional to $1/\max \{1,\log \log N\}$; this discards useful successes and is unnecessary for efficient recovery.

Apply the same positive-exponent quantum Fourier transform to each of the two quantum registers. The amplitude at $(c_1,c_2)$ of the coset state isThe finite geometric series is $M$ when $y{c}_1+c_2\equiv 0(\mathrm{mod}M)$ and zero otherwise. ThereforeThere are $M$ allowed pairs, with $c_1$ following the uniform distribution on a finite set. The factor $e^{2\pi i{k}_0{c}_1/M}$ changes the probability amplitudes by phases depending on the output label $c_1$, but has no effect on their probabilities. Using an inverse rather than forward quantum Fourier transform on both quantum registers gives the same support relation.

A modular inverse of $c_1$ exists precisely when $\gcd (c_1,M)=1$. In that case the discrete logarithm isIt cannot generally be determined from every allowed pair. Put $d=\gcd (c_1,M)$. The supported linear congruence has $d$ solutions modulo $M$, and determines only $y$ modulo $M/d$; $(0,0)$ gives no information when $M>1$. For instance $p=5$ and $(c_1,c_2)=(2,2)$ are compatible with both $y=1$ and $y=3$. One may verify a candidate by modular exponentiation, checking $g^y=x$. Repeated discrete-logarithm Fourier sampling finds an invertible $c_1$ with per-trial probability $\phi (M)/M$, which has the same totient lower bound from the Mertens product as before. When $p=2$, the group is trivial and $x=1,y=0$ are determined without Fourier samples.

Let $k_0$ be the unique discrete logarithm of the measured value $c_0$, so that $c_0=g^{k_0}$. The fiber calculation gives exactly the pairs $(yb+k_0,b)$ with $b\in {\mathbb{Z}}_M$, where $M=p-1$. The initial amplitude of each pair is $1/M$, so the Born rule assigns probability $M/M^2=1/M$ to this outcome.

After projective measurement and normalization, the first two quantum registers are in the coset stateThe measured third quantum register factors as $|c_0⟩$ and may be omitted. There is no loss of coherence between the $M$ terms in this post-measurement state: the quantum measurement reveals the common function value, not an individual input pair.

Interpret a function collision as two distinct inputs with equal outputs. Without distinctness the request is vacuous, since an input paired with itself always qualifies. Set $m=\lceil N^{1/3}\rceil$ (handling small $N$ by direct queries), choose a known set $A$ of size $m$, and query all its inputs. Store a classical table of their outputs and corresponding inputs. If this table contains a function collision, return it immediately.

Otherwise the table contains $m$ distinct outputs. Because $g$ is exactly two-to-one, each $a\in A$ has exactly one partner in $B$, the known complement of $A$. None lies in $A$, and different table outputs have different partners. Thus exactly $m$ inputs in $B$, of size $L=N-m$, satisfy the known-table membership predicateBuild a marked-state phase oracle for this predicate by a compute-phase-uncompute construction: use $U_g$ on a clean answer quantum register, reversibly compare its output against the classical table, apply the conditional minus sign, undo the comparison, and apply $U_g$ again. Since the answer operation is bitwise exclusive or, $U_g^{-1}=U_g$. All workspace returns to zero, and each phase query costs two calls to $U_g$.

Perform known-subset Grover search in the span of the computational basis states labelled by $B$, starting in their uniform superposition state. Reflection about this known state uses no $U_g$ queries; choosing $A$ as an initial interval makes $B$ a known interval that can also be encoded by its own $L$ labels. Its marked fraction is $m/L$, so the previous Grover rotation angle analysis uses $O(\sqrt{L/m})$ phase queries. On measuring $b$, one further $U_g$ query checks the output and retrieves its partner $a$ from the table. The inputs are distinct because the two sets are disjoint.

Consequently the quantum query complexity isFor large $N$, rounding the optimal Grover search algorithm iteration count gives success at least $1-m/(N-m)>1/2$. An internal table function collision already gives certain success. The balance $m\asymp \sqrt{N/m}$ explains the cube-root choice. This is the Brassard–Høyer–Tapp collision algorithm: its table uses $O(m\log N)$ classical bits. The bound counts calls to $U_g$, as requested; it does not charge table lookup and its reversible implementation as constant-time gates, or claim an overall polynomial time in $\log N$.

Use exact quantum phase estimation with $n$ control qubits initially $|0^n⟩$ and one target quantum register prepared in the given eigenvector $|\psi ⟩$. Apply Hadamard gates to the control qubits. If control bit $x_j$ has significance $2^j$, apply a controlled unitary gate $U^{2^j}$ from that qubit to the target. The target stays in $|\psi ⟩$, while quantum phase kickback producesSince $\varphi =c/2^n$, this is $F_{2^n}|c⟩\otimes |\psi ⟩$. The inverse quantum Fourier transform on the control quantum register therefore gives $|c⟩|\psi ⟩$. The quantum measurement in the computational basis returns $c$ with certainty, soThe quantum circuit below reads left to right. The upper wires are control qubits, with $q_0$ least significant; the vertical ellipsis represents the intervening control wires and powers. The inverse quantum Fourier transform acts on the entire control quantum register, including any bit-order permutations.

A supplied controlled-$U$ can implement controlled-$U^{2^j}$ by $2^j$ repetitions with the same control. Hence this exact quantum circuit uses $2^n-1$ calls to the supplied controlled-$U$, unless controlled powers are additionally available cheaply. The cost of exact phase estimation on a dyadic spectrum is not automatically polynomial in $n$; the question asks for an exact algorithm, not that stronger complexity guarantee. Exactness also uses the promised dyadic eigenphase, ideal gates, and the supplied inverse quantum Fourier transform.

Apply $V^{-1}$ to the data and phase quantum registers, leaving the flag quantum ancilla untouched. This inverse needs no extra oracle assumption: the promised dyadic eigenvalues give $U^{2^n}=I$, hence $U^{-1}=U^{2^n-1}$. The inverse of each controlled unitary gate used in $V$ can therefore be built from repeated uses of the supplied controlled-$U$, and the known Hadamard gates and quantum Fourier transform gates can be reversed. Uncomputation is necessary to erase the eigenvalue label coherently. The resulting quantum state isA quantum measurement in the computational basis of the flag followed by postselection on one yieldsThis requires $A|b⟩\ne 0$. For a normalized input and nonnegative eigenvalues, the success probability of positive quantum spectral filtering satisfies $P_{\mathrm{success}}\ge {\lambda }_{\min }^2$. In the general inequality, equality holds precisely when the input is supported on the minimum-eigenvalue eigenspace. Omitting uncomputation and discarding the phase quantum register would instead leave a mixed state with diagonal weights proportional to $|{\beta }_j{|}^2{\lambda }_j^2$, rather than the desired coherent pure state.

The printed universal nonzero-success request needs a nonkernel-input hypothesis. An $n$-qubit Hermitian operator has $2^n$ eigenvalues, counted with multiplicity. All are distinct, and the printed dyadic grid contains exactly $2^n$ possible values. They therefore occupy the entire grid, including zero: this is a multiplicity-free complete dyadic spectrum, and ${\lambda }_{\min }=0$. Taking $n=1$, $A=\mathrm{diag}(0,1/2)$, and $|b⟩=|0⟩$ satisfies every printed spectral promise but gives $A|b⟩=0$. No normalized output vector exists, so no algorithm can deliver it with nonzero probability.

For every input outside the kernel, the procedure above has $P_{\mathrm{success}}>0={\lambda }_{\min }^2$, giving the requested strict bound on the meaningful domain. The corrected result is therefore exact quantum spectral filtering conditional on $A|b⟩\ne 0$, with the boxed probability. This does not require knowing the input probability amplitudes or making extra copies of an unknown quantum state. Arbitrarily small nonzero support outside the kernel gives arbitrarily small success probability, and a failed flag measurement disturbs the input; fresh independent trials cannot be assumed when only one unknown physical input is supplied.

Let $V$ denote the coherent exact quantum phase estimation unitary operator from the preceding part, with the data quantum register written first. For every eigenvector of $A$,because $e^{2\pi iA}|u_j⟩=e^{2\pi i{\lambda }_j}|u_j⟩$ and ${\lambda }_j=c_j/2^n$ lies in $[0,1)$, with no phase-aliasing ambiguity. Apply $V$ coherently to the input quantum state and a clean quantum register; do not measure the eigenvalue label. By linearity it produces ${\sum }_j{\beta }_j|u_j⟩|c_j⟩$.

Append a quantum ancilla in $|0⟩$, and use the provided quantum variable rotation with ${\theta }_{c_j}=\arcsin {\lambda }_j$, choosing the nonnegative cosine. The resulting normalized quantum state isThe sum covers both terms; this fixes the potentially ambiguous sum placement in the abbreviated display. The orthonormal basis of eigenvectors and the unit length of each rotated quantum ancilla show that its norm is one. This is quantum spectral filtering by multiplication, not the reciprocal rotation used in the HHL algorithm.

Given a function $f$ with an $m$-bit output, accessed through the unitary operator $U_f|x⟩|y⟩=|x⟩|y\oplus f(x)⟩$, quantum collision finding asks for distinct inputs with equal outputs. Here $\oplus$ is bitwise exclusive or on the $m$-bit answer quantum register. The distinctness requirement excludes the uninformative pair $(x,x)$. For a two-to-one function on $N$ inputs, Grover search algorithm methods yield a cube-root quantum query complexity, despite a square-root cost for finding a partner of just one preselected input.

A quantum oracle supplies coherent access to a function through a specified unitary operator. For a function with binary string output, the standard construction retains the input and adds the output into an answer quantum register by bitwise exclusive or. This operation is its own inverse, even when the function is not injective. A Boolean quantum oracle is the single-output-bit case; Simon's algorithm uses several answer qubits. Other encodings, such as a modular-addition quantum oracle or a phase gate encoding, require their own explicit query conventions.

In Simon's algorithm, conditioning on a function value leaves the first quantum register in an equal coherent sum of its two preimages. This is a pure state, even though discarding the second quantum register without retaining its outcome generally leaves a mixed state. The label $x$ depends on the measured value; the period $s$ does not.