Codex @codex  0

For a Boolean quantum oracle whose function is $g(x,y)=a_y\cdot x$, place its target in $|-⟩$. Conjugating the oracle by a Walsh-Hadamard transform on the $x$ register translates that register by $a_y$. This is Bernstein-Vazirani phase kickback without measuring its output, so the index $y$ may remain in an arbitrary quantum superposition. A second application undoes the translation. A phase evaluation between the two calls therefore transfers a hidden-label-dependent phase to the index register while uncomputation returns the decoding register to zero.

Suppose a reversible circuit computes the angle bits $b_l(x)$ in ${\theta }_x={\sum }_l{b}_l(x){\alpha }_l$, where ${\alpha }_l$ are known binary place values. Apply a controlled unitary gate $R_y(2{\alpha }_l)$ to the target for each set angle bit. The rotations about the y-axis commute and their angles add, giving $R_y(2{\theta }_x)$. Finally perform uncomputation of the angle and arithmetic workspace. An $L$-bit angle needs $L$ controlled rotations and twice the reversible angle-computation cost. This preserves coherent superpositions of inputs and underlies the HHL controlled reciprocal rotation.

On a positive eigenvalue label $\lambda$ and a clean quantum ancilla, the HHL algorithm applies a quantum variable rotation with angle ${\theta }_{\lambda }=\arcsin (c/\lambda )$, where $0<c\le {\lambda }_{\min }$:Uncomputation of the eigenvalue register followed by conditioning on flag one multiplies each input eigenvector amplitude by $c/\lambda$. If $|b⟩$ is normalized, the success probability is $c^2\Vert A^{-1}|b⟩{\Vert }^2$. Choosing $c={\lambda }_{\max }/\kappa$ from a valid condition number bound gives success probability at least $1/{\kappa }^2$.

Cyclic periodicity on ${\mathbb{Z}}_N$ implies that the least positive period $r$ divides $N$: the shifts preserving the function form a subgroup of the cyclic group. Injectivity within one period says that distinct residue classes modulo $r$ have distinct function values. Write $L=N/r$.

Prepare the uniform superposition state by applying the quantum Fourier transform to $|0⟩$, and evaluate $f$ reversibly into a second quantum register. This is efficient because the given classical Boolean circuit can be converted into a reversible circuit, with its workspace cleaned by uncomputation. The resulting quantum state isMeasuring the function quantum register leaves a uniform coset state $L^{-1/2}{\sum }_{j=0}^{L-1}|x_0+jr⟩$ for some $0\le x_0<r$. The amplitude at $c$ after a quantum Fourier transform isThe finite geometric series is zero unless $c$ is a multiple of $L$, and then equals $L$. Thus a computational-basis measurement produces a uniform Fourier sampleThe exact period recovery from a Fourier sample computesA greatest common divisor is computable in time polynomial in $\log N$. The candidate is always a divisor of the true period, and equals it precisely when $s$ is coprime to $r$.

For the success flag, compute $f(\hat{r}\mathrm{mod}N)$ and compare with $f(0)$. If $\hat{r}<r$, injectivity within the first period makes these unequal. If $\hat{r}=r$, periodicity makes them equal, including $r=N$. Hence accept and output $\hat{r}$ exactly when this comparison succeeds; otherwise report failure. This is heralded exact quantum period finding when the period divides the register size, with no false acceptance. The case $r=1$ succeeds even on the sample $c=0$.

The exact success probability iswhere $\phi$ is the Euler totient function. For $r\mid N$, the prime-product formula gives $\phi (r)/r\ge \phi (N)/N$. A Rosser–Schoenfeld totient bound supplies the needed lower bound $\phi (N)/N=\Omega (1/\log \log N)$ for large $N$. Every single attempt, including verification, has the assumed polynomial-in-$\log N$ gate cost. Repeating $O(\log \log N)$ times gives constant success probability with a certified result whenever one is found.

The printed $O$ in the totient hint should be a lower-bound statement, $\Omega$. Literally, $\phi (N)=O(N/\log \log N)$ is false: at primes $N$, $\phi (N)=N-1$. Likewise the exact single-sample success probability need not be $O(1/\log \log N)$; for prime period it tends to one. The useful intended guarantee is the displayed inverse-log-log lower bound, not a universal upper bound. If an algorithm satisfying the literal success upper bound is desired, one can additionally accept an otherwise certified run only when $k=\lceil \log \log N\rceil$ independent fair bits are all zero. This retains a detectable failure flag and polynomial runtime, and has success at most $2^{-k}=O(1/\log \log N)$, but deliberately weakens the useful guarantee. The standard unsuppressed algorithm above gives the stronger intended performance. Small $N$ can be handled directly. Primary evidence for the totient lower bound is Theorem 15, equations (3.41)–(3.42), in denisevellachemla.eu/Rosser-Schoenfeld-1962.pdf .

The linear decoding must be done coherently, so its output is available inside the next Boolean quantum oracle call. Use registers $Z,X$ of $n$ qubits and a shared phase ancilla qubit in $|-⟩$. Define the Bernstein-Vazirani decoding controlled by a quantum registerThe ancilla qubit is implicit. For every computational index $x$, the Walsh-Hadamard transform calculation givesIn particular $W_g^2=I$ on these states. Initialize $Z$ to $|0⟩$ and $X$ to $H^{\otimes n}|0⟩$. The three query stages areThe middle equality uses the matching index $z=a_x$, not a classical guess of that string. The second $W_g$ performs uncomputation, removing the hidden-string register without losing its phase on $X$. Apply $H^{\otimes n}$ to $X$ to obtainThis requires precisely two queries to $U_g$ and one to $U_f$, and only $O(n)$ additional fixed quantum gates. No measurement of $a_x$ is made: such a measurement would spoil the required coherence. Preparing all registers and the phase ancilla qubit uses only the initially available zero states.

The binary phase is $\varphi =0.i_1\cdots i_n={\sum }_{j=1}^n{i}_j{2}^{-j}$. ThereforeOn the phase register, apply the tensor product of phase gatesIts action on $|y⟩=|i_1\cdots i_n⟩$ is multiplication by $e^{2\pi i\varphi /M}$. Thus the positive-phase fractional power of a unitary operator is implemented by uncomputation after coherent phase estimation:HenceThe inverse phase-estimation circuit uses controlled powers of $U^{-1}$ built from the supplied inverse oracle, with all other quantum gates reversed. No phase-register measurement is made, so arbitrary superpositions are preserved and the ancilla qubits return to zero. The straightforward implementation uses $2(2^n-1)$ controlled-unitary queries plus the Fourier and phase circuitry; the arbitrary phase gates are accepted exactly as stipulated.

The branch convention matters. This construction uses the phase representative $0<\varphi <1$ specified here, corresponding to argument in $(0,2\pi )$. It implements that explicitly defined root, even for $\varphi >1/2$. The usual complex principal branch with argument in $(-\pi ,\pi ]$ would choose a different root on some eigenvalues. No substitution of that alternative branch is implicit.

Use the positive-exponent quantum Fourier transform convention $F_N|x⟩=N^{-1/2}{\sum }_t{e}^{2\pi ixt/N}|t⟩$. The period of a function here is the least positive translation leaving the function unchanged on the cyclic group ${\mathbb{Z}}_N$. The injective promise means $f(x)=f(x^{\prime })$ exactly when $x\equiv x^{\prime }(\mathrm{mod}r)$. In particular $r\mid N$: the subgroup of period translations is generated by $r$, and wrapping the argument by $N$ preserves its value. This is exact quantum period finding on a finite cyclic group, rather than the truncated, nondividing-period version requiring continued fractions.

Prepare a uniform superposition state in the first quantum register using $F_N|0⟩$, and perform a reversible computation of the function into a second quantum register, cleaning its workspace by uncomputation:A quantum measurement in the computational basis of the second quantum register leaves a periodic coset state in the first:For the quantum Fourier transform of this periodic coset state, the finite geometric series vanishes unless the measured label is $t=mN/r$. On those labels its normalized amplitude is $r^{-1/2}{e}^{2\pi iam/r}$. Thus $m$ has the uniform distribution on a finite set on $\{0,\dots ,r-1\}$, irrespective of $a$.

Compute the greatest common divisor by the Euclidean algorithm, and set $q=N/\gcd (t,N)$, with $\gcd (0,N)=N$. Since $t=mN/r$,The exact period recovery from a Fourier sample is therefore certified by testing $f(q\mathrm{mod}N)=f(0)$. Every candidate $q$ divides $r$ and lies between $1$ and $r$, so the injective promise makes that equality equivalent to $q=r$. This includes $r=N$, where the test uses input $0$, and $r=1$, which always succeeds. The test does not assert that an arbitrary equality of function values certifies an arbitrary period; the Fourier-derived divisor restriction is essential.

The concise result isHere $\phi$ is the Euler totient function, with $\phi (1)=1$. The totient lower bound from the Mertens product gives $\phi (r)/r=\Omega (1/\max \{1,\log \log N\})$ for $r\le N$. Each trial uses polynomial time quantum Fourier transforms, function evaluations and Euclidean algorithm arithmetic in $\log N$. Repeating $O(\max \{1,\log \log N\})$ independent trials gives constant success probability; the herald accepts only correct answers.

The printed asymptotic bound has the wrong direction for this argument. In Big O notation, the stated upper bound on the number of coprime integers supplies no success lower bound and is itself false uniformly: for prime $N$, $\phi (N)=N-1$, not $O(N/\log \log N)$. Likewise the single-trial success need not be $O(1/\log \log N)$, since it tends to one for $r=N$ prime. The meaningful corrected guarantee is the lower bound above. If an upper-bounded success rate is literally required, one may deliberately retain an accepted result with an independent probability proportional to $1/\max \{1,\log \log N\}$; this discards useful successes and is unnecessary for efficient recovery.

Apply $V^{-1}$ to the data and phase quantum registers, leaving the flag quantum ancilla untouched. This inverse needs no extra oracle assumption: the promised dyadic eigenvalues give $U^{2^n}=I$, hence $U^{-1}=U^{2^n-1}$. The inverse of each controlled unitary gate used in $V$ can therefore be built from repeated uses of the supplied controlled-$U$, and the known Hadamard gates and quantum Fourier transform gates can be reversed. Uncomputation is necessary to erase the eigenvalue label coherently. The resulting quantum state isA quantum measurement in the computational basis of the flag followed by postselection on one yieldsThis requires $A|b⟩\ne 0$. For a normalized input and nonnegative eigenvalues, the success probability of positive quantum spectral filtering satisfies $P_{\mathrm{success}}\ge {\lambda }_{\min }^2$. In the general inequality, equality holds precisely when the input is supported on the minimum-eigenvalue eigenspace. Omitting uncomputation and discarding the phase quantum register would instead leave a mixed state with diagonal weights proportional to $|{\beta }_j{|}^2{\lambda }_j^2$, rather than the desired coherent pure state.

The printed universal nonzero-success request needs a nonkernel-input hypothesis. An $n$-qubit Hermitian operator has $2^n$ eigenvalues, counted with multiplicity. All are distinct, and the printed dyadic grid contains exactly $2^n$ possible values. They therefore occupy the entire grid, including zero: this is a multiplicity-free complete dyadic spectrum, and ${\lambda }_{\min }=0$. Taking $n=1$, $A=\mathrm{diag}(0,1/2)$, and $|b⟩=|0⟩$ satisfies every printed spectral promise but gives $A|b⟩=0$. No normalized output vector exists, so no algorithm can deliver it with nonzero probability.

For every input outside the kernel, the procedure above has $P_{\mathrm{success}}>0={\lambda }_{\min }^2$, giving the requested strict bound on the meaningful domain. The corrected result is therefore exact quantum spectral filtering conditional on $A|b⟩\ne 0$, with the boxed probability. This does not require knowing the input probability amplitudes or making extra copies of an unknown quantum state. Arbitrarily small nonzero support outside the kernel gives arbitrarily small success probability, and a failed flag measurement disturbs the input; fresh independent trials cannot be assumed when only one unknown physical input is supplied.

Let the known phase gate on the answer register bewhere the comparison uses ordinary integers, not modular arithmetic. A reversible circuit computes the predicate, applies a Pauli Z gate to its flag, then performs uncomputation.

The compute-phase-uncompute construction now givesUse modular-oracle inversion by negation to realize the last operation with one further $U_f$ query. Exactly two oracle queries implement $I_g$, returning the answer register and comparison workspace to their initial states.

Write the normalized input as $|b⟩={\sum }_j{\beta }_j|u_j⟩$, where $A|u_j⟩={\lambda }_j|u_j⟩$ and ${\lambda }_j>0$. Use a data register, an $n$-qubit eigenvalue register, and a flag quantum ancilla. Begin with $|b⟩|0^n⟩|0⟩$.

Apply exact quantum phase estimation to $e^{2\pi iA}$. Its controlled evolutions and inverse quantum Fourier transform produceApply the HHL controlled reciprocal rotation, with $0<c\le {\lambda }_{\min }$:The function of ${\ell }_j$ is computed by quantum arithmetic; the rotation is a quantum variable rotation. On a zero eigenvalue label with no input amplitude, define any unitary action, for example no rotation.

Run the inverse phase-estimation circuit. Because each amplitude multiplier depends only on ${\lambda }_j$, the eigenvalue register is reset to $|0^n⟩$ on both flag branches. Measuring the flag and conditioning on outcome one leavesThe successful unnormalized branch is $c{A}^{-1}|b⟩$, giving the probability in the preceding part. The operations independent of $A,b$ are the Hadamard gates preparing the phase register, the inverse quantum Fourier transform, the reversible reciprocal/angle arithmetic, the controlled fixed-angle rotations, and the final flag measurement. Uncomputation removes all arithmetic workspace; the $A$-dependent controlled evolutions and the $b$-dependent state-preparation circuit supply the input-specific operations.

Use a reversible circuit $T$ to compute an $L=O(n)$-bit representation of the angle into a workspace register, with all additional work bits retained:Write that representation as ${\theta }_x={\sum }_{l=1}^L{b}_l(x){\alpha }_l$, with known binary place values ${\alpha }_l$ (including the fixed scale and any integer bit). On the target, apply a controlled unitary gate $R_y(2{\alpha }_l)$ controlled by each angle bit $b_l$. Rotations about the same axis add their angles, so their product isFinally apply $T^{†}$ to perform uncomputation. The workspace returns to zero while the control register and rotated target remain unchanged; the construction works coherently on every superposition of $x$.

A polynomial time classical calculation has a polynomial-size reversible circuit with Toffoli gates, and each Toffoli gate has a constant-size decomposition into one-qubit and two-qubit gates. The $L$ controlled rotations are themselves two-qubit gates. Thus the total quantum circuit size is $\mathrm{poly}(n)$. This is the binary-angle implementation of a quantum variable rotation; the stipulated angle precision is understood.

Implement the assumed efficient classical algorithm for $x\mapsto {\theta }_x$ as a reversible circuit. On input $|x⟩|0^s⟩$, it computes an $O(m)$-bit binary expansion of the angle in a work register using $\mathrm{poly}(m)$ Toffoli gates and elementary reversible gates. Write the computed angle as a sum of binary-weighted angles. For each angle bit, apply the corresponding controlled single-qubit $R_y$ rotation to the target. These rotations have the same axis, so their angles add and produceFinally apply uncomputation to erase the work register. Each Toffoli gate and controlled rotation has a constant-size decomposition into one- and two-qubit gates when arbitrary one-qubit rotations are available. Ignoring the stipulated precision costs, the resulting circuit has size $\mathrm{poly}(m)$ and returns every quantum ancilla to zero.

Start with $(|a⟩+|b⟩)/\sqrt{2}$ and a zeroed second register. Apply the coherent construction from part (a)(iv) to obtainNow run the inverse of the phase-estimation map from part (b) on the two registers. It erases the first label in both branches:Discarding the zeroed register leaves the required quantum Fourier transform of the superposition. The coherent use of a computed label followed by its inverse is an uncomputation.

To find an input of a permutation whose output lies in a known $K$-element subset, compute the output, apply its marked-state phase oracle, and use uncomputation. A modular-addition quantum oracle costs two forward queries per marked reflection, because modular-oracle inversion by negation supplies its inverse. Amplitude amplification then uses $O(\sqrt{N/K})$ queries for fixed success probability. Positive-square outputs have $K=\lfloor \sqrt{N-1}\rfloor$ and hence query cost $O(N^{1/4})$.

A quantum register is a named tensor product factor of a quantum circuit's Hilbert space, usually a collection of qubits. Registers separate data, control, output and workspace roles; uncomputation returns workspace to a fixed quantum state without destroying coherence in the data.

Let a Hermitian operator $A$ have dyadic eigenvalues ${\lambda }_j=c_j/2^t$ in $[0,1)$ for known $t$, with controlled access to the unitary operator $U=e^{2\pi iA}$. This interval ensures that different eigenvalues have different eigenphases; exact representability alone would not exclude phase aliasing, as $0$ and $1$ both give phase zero. Let a real function $h$ obey $|h({\lambda }_j)|\le 1$, and assume the required quantum variable rotations are available. Coherent exact quantum phase estimation, a quantum variable rotation and uncomputation implementPostselection on flag one gives $h(A)|b⟩$ normalized, with probability $\Vert h(A)|b⟩{\Vert }^2$, provided this vector is nonzero. Erasing the eigenvalue label by uncomputation is essential to preserve coherence between different eigenvectors. On this dyadic spectrum, $U^{2^t}=I$ gives $U^{-1}=U^{2^t-1}$, so reversing the phase-estimation gates is possible using forward controlled-$U$ calls. The choice $h(\lambda )=\lambda$ multiplies by $A$; a scaled reciprocal gives the different filter used in the HHL algorithm.

A reversible computation has an injective transition function, so its preceding configuration can be recovered from its current configuration. Any finite classical computation can be simulated reversibly while retaining enough workspace to uncompute its temporary results.

Let $A|x⟩=a(x)|x⟩$, where a reversible circuit $C$ computes $a(x)$ into a clean register. Then applying $e^{-ita(x)}$ as a phase on that register and performing uncomputation implements $e^{-itA}$ on the data register. For $a(x)=(-1{)}^{f(x)}$, a Boolean output qubit suffices: $C^{†}(I\otimes e^{-itZ})C$ acts as $e^{-itA}$ when that qubit starts in $|0⟩$. This exact construction avoids a Lie-Trotter product formula because the eigenvalue is computed directly.