1 Introduction: Phase Kick-Back and notation

The term Phase Kick-Back is taken from [1]. This technique is central to some classical quantum algorithms, such as the Deutsch–Jozsa algorithm, the Bernstein–Vazirani algorithm, Simon’s algorithm or Grover’s algorithm, and first appeared in [2] for solving the Deutsch–Jozsa problem. Here, we will generalise the Deutsch–Jozsa problem and the Bernstein–Vazirani problem and give a new algorithm for Simon’s problem that improves the classical one.

Some of these problems have already been generalised in different directions. In [3], multidimensional versions for the Deutsch–Jozsa problem and Bernstein–Vazirani were first considered and solved. This was further expanded in [4] by considering the problems of evenly distributed and evenly balanced functions.

Regarding other directions, in [5] the Deutsch–Jozsa problem is generalised by considering functions that are balanced in abelian subgroups of \(\{0,1\}^{n}\). In [6, 7], the problem of filtering and distinguishing quantum states is studied, while in [8] a problem where Boolean functions that are balanced in certain subsets of \(\{0,1\}^{n}\) is proposed. Furthermore, Deutsch’s problem is generalised in [9] by determining arbitrary Boolean functions \(f:\{0,1\}^{2}\rightarrow \{0,1\}^{}\).

The Bernstein–Vazirani problem was also generalised in [10, 11] by considering and solving the 2-dimensional hidden linear function problem using shallow quantum circuits.

The Deutsch–Jozsa algorithm—and thus the Phase Kick–Back technique—has been implemented using different quantum models, such as by the application of NMR in [12], or via Rydberg blockade interaction in [13].

Let us introduce the notation we will use, which will be that of [1, 14]. These two books, along with [15, 16], can be consulted for more context on the topic of quantum computing.

Remark 1

First of all, we will call the elements \({\textbf{x}}\in \{0,1\}^{n}\) binary strings and note them in bold, underlining their structure as vectors in the space \({\mathbb {F}}_2^n\).

Let \({\textbf{y}}, {\textbf{z}}\in \{0,1\}^n\) be two strings, written

$$\begin{aligned} {\textbf{y}} = y_{n-1} \ldots y_1 y_0, \quad \quad {\textbf{z}} = z_{n-1} \ldots z_1 z_0, \end{aligned}$$

and let \(\oplus \) denote the exclusive or addition (which is addition modulo 2). We define the exclusive or operation for strings as the exclusive or bitwise, that is,

$$\begin{aligned} {\textbf{y}} \oplus {\textbf{z}} = \left( y_{n-1} \oplus z_{n-1} \right) \ldots \left( y_1 \oplus z_1 \right) \left( y_0 \oplus z_0 \right) , \end{aligned}$$

and we will denote the pairing in \(\{0,1\}^n\) (not a scalar product, though) by

$$\begin{aligned} {\textbf{y}} \cdot {\textbf{z}} = \left( y_0 \cdot z_0 \right) \oplus \ldots \oplus \left( y_{n-1}\cdot z_{n-1} \right) . \end{aligned}$$

Note that, as the xor operation is performed bitwise, we have

$$\begin{aligned} {\textbf{x}} \cdot ( {\textbf{y}} \oplus {\textbf{z}} ) = ({\textbf{x}} \cdot {\textbf{y}}) \oplus ({\textbf{x}} \cdot {\textbf{z}}). \end{aligned}$$

We will also write \({\textbf{0}}\) to refer to the zero n-string \({\textbf{0}} = 00\cdots 0\).

To represent quantum states, we will use the Bra-Ket or Dirac notation, where given a binary string \({\textbf{x}}\in \{0,1\}^{n}\) of length n we represent the n-dimensional qubit state of the computational basis corresponding to \({\textbf{x}}\) by \(|{\textbf{x}}\rangle _n\). For one-dimensional qubit systems, we will often simply write the ket \(|{\textbf{x}}\rangle \) without the subindex. If we have more than one qubit system, we will write the number of qubits of each register separated by commas. For example, in \(|{\textbf{x}}\rangle _{n,m,r}\) we would have three registers of n, m and r qubits, respectively. We will often note \(N=2^n\).

Let R be an \(m\times n\) Boolean matrix—i.e., a matrix whose components are either 0 s or 1 s—and let \({\textbf{r}}_i\) be the binary string determined by the i-th file of R, we will define the result of the operation \(R\cdot {\textbf{x}}\) as the string whose i-th component is \({\textbf{r}}_i\cdot {\textbf{x}}\) (that is, the usual matrix–vector operation).

We will say that a Boolean function is a function \(f:\{0,1\}^{n}\rightarrow \{0,1\}^{m}\). It is well known—consult [15] for more information—that given a Boolean function one can construct the quantum gate \({\textbf{U}}_f\) whose effect is the following:

$$\begin{aligned} {\textbf{U}}_f\Big (|{\textbf{x}}\rangle _n\otimes |{\textbf{y}}\rangle _m\Big ) = |{\textbf{x}}\rangle _n\otimes |{\textbf{y}}\oplus f({\textbf{x}})\rangle _m. \end{aligned}$$

Before proceeding, we must recall the Hadamard basis:

$$\begin{aligned} |+\rangle = \frac{|0\rangle +|1\rangle }{\sqrt{2}}, \quad |-\rangle = \frac{|0\rangle -|1\rangle }{\sqrt{2}}. \end{aligned}$$

The result in which the Phase Kick-Back technique is based is the following:

Lemma 1

Let \(f:\{0,1\}^{n}\rightarrow \{0,1\}^{}\) be a Boolean function, and let \({\textbf{U}}_f\) be the quantum gate that computes it. Then, in the \(n+1\) qubit system, vectors of the form \(|{\textbf{x}}\rangle _n\otimes |-\rangle \) are eigenvectors with eigenvalue \((-1)^{f({\textbf{x}})}\) for every \({\textbf{x}}\in \{0,1\}^{n}.\)

The Phase Kick-Back technique is almost always used to mark the amplitudes of the states of the computational basis whose image through f is 1. In that sense, we would have

$$\begin{aligned} \Big ({\textbf{H}}_n|{\textbf{0}}\rangle _n\Big )\otimes |-\rangle = \left( \frac{1}{\sqrt{2^n}}\sum _{{\textbf{x}}\in \{0,1\}^{n}} |{\textbf{x}}\rangle _n\right) \otimes |-\rangle , \end{aligned}$$

where \({\textbf{H}}_n\) is the Hadamard matrix of dimension n, which can be defined as:

$$\begin{aligned} {\textbf{H}}_n = {\textbf{H}}^{\otimes n}, \, \text { where } {\textbf{H}} = \frac{1}{\sqrt{2}} \left( \begin{array}{rr} 1 &{} 1 \\ 1 &{} -1 \end{array} \right) , \end{aligned}$$

and whose effect on an element of the computational basis \({\textbf{x}}\in \{0,1\}^{n}\) is the following:

$$\begin{aligned} {\textbf{H}}_n|{\textbf{x}}\rangle _n = \frac{1}{\sqrt{2^n}} \sum _{{\textbf{z}}\in \{0,1\}^{n}} (-1)^{{\textbf{x}}\cdot {\textbf{z}}} |{\textbf{z}}\rangle _n. \end{aligned}$$

This can be easily proven by induction. In particular, when \({\textbf{x}} = {\textbf{0}}\), we would have:

$$\begin{aligned} {\textbf{H}}_n|{\textbf{0}}\rangle _n = \frac{1}{\sqrt{2^n}} \sum _{{\textbf{z}}\in \{0,1\}^{n}} |{\textbf{z}}\rangle _n. \end{aligned}$$

Summarising, we would have a summation over all the states of the computational basis, all of them with the same amplitude in the first n-qubit register. The idea of the Phase Kick-Back is to apply \({\textbf{U}}_f\) to this state and mark the aforementioned elements with a negative amplitude.

$$\begin{aligned} {\textbf{U}}_f\left( \frac{1}{\sqrt{2^n}}\sum _{{\textbf{x}}\in \{0,1\}^{n}} |{\textbf{x}}\rangle _n\otimes |-\rangle \right) = \left( \frac{1}{\sqrt{2^n}}\sum _{{\textbf{x}}\in \{0,1\}^{n}} (-1)^{f({\textbf{x}})}|{\textbf{x}}\rangle _n\right) \otimes |-\rangle . \end{aligned}$$

2 Generalised Phase Kick-Back

Let us now present a generalisation of the Phase Kick-Back idea. This approach was already suggested in [3]. This generalisation will consist on the expansion of the technique to general Boolean functions \(f:\{0,1\}^{n}\rightarrow \{0,1\}^{m}\), where the target qubit—the one in the second register of the Deutsch–Jozsa algorithm—becomes a register of m qubits.

During this generalisation, we will take \({\textbf{U}}_f\) as presented before and we will notate the states given by \({\textbf{H}}_n|{\textbf{y}}\rangle _n\) as \(|\gamma _{{\textbf{y}}}\rangle _n\), where \(|{\textbf{y}}\rangle _n\) are the elements of the computational basis.

Let us begin by presenting an analogous version to that of Lemma 1, which will constitute the core idea of this technique.

Lemma 2

Let \(|\gamma _{{\textbf{y}}}\rangle _m = {\textbf{H}}_m|{\textbf{y}}\rangle _m\) with \({\textbf{y}} \in \{0,1\}^m\). Then, for each \({\textbf{x}} \in \{0,1\}^n\), the vector \(|{\textbf{x}}\rangle _n\otimes |\gamma _{{\textbf{y}}}\rangle _m\) is an eigenvector of \({\textbf{U}}_f\) with eigenvalue \((-1)^{{\textbf{y}}\cdot f({\textbf{x}})}.\)

Proof

We know that

$$\begin{aligned} |\gamma _{{\textbf{y}}}\rangle _m = \frac{1}{\sqrt{2^m}} \sum _{{\textbf{z}}\in \{0,1\}^m} (-1)^{{\textbf{y}}\cdot {\textbf{z}}}|{\textbf{z}}\rangle _m. \end{aligned}$$

If we now apply \({\textbf{U}}_f\) to \(|{\textbf{x}}\rangle _n\otimes |\gamma _{{\textbf{y}}}\rangle _m\), we get the following:

$$\begin{aligned} {\textbf{U}}_f\Big (|{\textbf{x}}\rangle _n\otimes |\gamma _{{\textbf{y}}}\rangle _m\Big ) = |{\textbf{x}}\rangle _n\otimes \left( \frac{1}{\sqrt{2^m}} \sum _{{\textbf{z}}\in \{0,1\}^m} (-1)^{{\textbf{y}}\cdot {\textbf{z}}}|{\textbf{z}}\oplus f({\textbf{x}})\rangle _m \right) . \\ = (-1)^{{\textbf{y}}\cdot f({\textbf{x}})}|{\textbf{x}}\rangle _n\otimes \left( \frac{1}{\sqrt{2^m}} \sum _{{\textbf{z}}\in \{0,1\}^m} (-1)^{{\textbf{y}}\cdot {\textbf{z}}\oplus {\textbf{y}}\cdot f({\textbf{x}})}|{\textbf{z}}\oplus f({\textbf{x}})\rangle _m \right) \\ = (-1)^{{\textbf{y}}\cdot f({\textbf{x}})}|{\textbf{x}}\rangle _n\otimes \left( \frac{1}{\sqrt{2^m}} \sum _{{\textbf{z}}\in \{0,1\}^m} (-1)^{{\textbf{y}}\cdot ({\textbf{z}}\oplus f({\textbf{x}}))}|{\textbf{z}}\oplus f({\textbf{x}})\rangle _m \right) \\ = (-1)^{{\textbf{y}}\cdot f(x)}|\mathbf {{\textbf{x}}}\rangle \otimes |\gamma _{{\textbf{y}}}\rangle _m, \end{aligned}$$

as for a fixed \(f({\textbf{x}})\), \(|{\textbf{z}}\oplus f({\textbf{x}})\rangle _m\) runs through all of \(\{0,1\}^m\) just as \({\textbf{z}}\) does. \(\square \)

As we can see, it is a completely analogous idea to the previous one, with the difference that we can now choose a marker, \({\textbf{y}}\in \{0,1\}^{n}\), which will work as a fixed reference and multiply each \(f({\textbf{x}})\).

3 A first approach to the GPK

We will consider the Boolean function \(f:\{0,1\}^3 \rightarrow \{0,1\}^2\) which will eliminate the last bit, that is, \(f(xyz) = xy\) where \(x,y,z\in \{0,1\}\) and xyz stands for the concatenation of bits.

To use our new tool, we will need a 5-qubit system divided into a 3-qubit register and a 2-qubit register, both of them starting on \(|{\textbf{0}}\rangle \):

$$\begin{aligned} |\varphi _0\rangle _5 = |{\textbf{0}}\rangle _3\otimes |{\textbf{0}}\rangle _2. \end{aligned}$$

We will begin by choosing a marker, i.e., the \({\textbf{y}}\in \{0,1\}^2\) that will encode the information we want to look for in f. In this case, we will take \({\textbf{y}} = 01\), that is, we will mark those values whose image through f is 01 or 11. To do so, we will begin by preparing the second register to \({\textbf{y}}\), which is easily achieved by applying the Pauli \({\textbf{X}}\) gate on the last qubit.

$$\begin{aligned} |\varphi _1\rangle _5 = \left( {\textbf{I}}^{\otimes 4}\otimes {\textbf{X}}\right) |\varphi _0\rangle _5 = |{\textbf{0}}\rangle _3\otimes |01\rangle _2. \end{aligned}$$

Once we have prepared our basic state, we will apply Hadamard gates to all qubits to obtain a superposition state.

$$\begin{aligned} |\varphi _2\rangle _5 = {\textbf{H}}_5|\varphi _1\rangle _5 = \left( \frac{1}{\sqrt{8}}\sum _{{\textbf{x}}\in \{0,1\}^3} |{\textbf{x}}\rangle _3\right) \otimes |\gamma _{01}\rangle _2 =\frac{1}{\sqrt{8}}\sum _{{\textbf{x}}\in \{0,1\}^3} \Big (|{\textbf{x}}\rangle _3\otimes |\gamma _{01}\rangle _2\Big ). \end{aligned}$$

Let us remark now that each state of the aforementioned superposition satisfies the conditions of Lemma 2.1, and thus, if we apply the \({\textbf{U}}_f\) gate, we will mark the states of the superposition depending on their image.

$$\begin{aligned} |\varphi _3\rangle _5 = {\textbf{U}}_f|\varphi _2\rangle _5 = \frac{1}{\sqrt{8}}\sum _{{\textbf{x}}\in \{0,1\}^3}(-1)^{f({\textbf{x}})\cdot 01}\Big (|{\textbf{x}}\rangle _3\otimes |\gamma _{01}\rangle _2\Big ). \end{aligned}$$

Remark 2

Another way of looking at this Generalised Phase Kick-Back idea is to write the state \(|\gamma _{{\textbf{y}}}\rangle \) as a tensor product of \(|+\rangle \) and \(|-\rangle \) states. As an example, in the instance we are dealing with we have:

$$\begin{aligned} |\gamma _{01}\rangle _2 = |+\rangle \otimes |-\rangle . \end{aligned}$$

In general, for a given \({\textbf{y}}\in \{0,1\}^m\) we would have a \(|+\rangle \) in the i-th position if the i-th bit of \({\textbf{y}}\) is 0 and \(|-\rangle \) if it is 1. In that sense, we could look at this Generalised Phase Kick-Back as a cascade of Phase Kick-Backs in those positions of \({\textbf{y}}\) in which there is a 1.

Let us now focus our attention on the first 3-qubit register and use that \(f({\textbf{x}})\cdot 01 = {\textbf{x}} \cdot 010\):

$$\begin{aligned} |\varphi _4\rangle _3 = \frac{1}{\sqrt{8}}\sum _{{\textbf{x}}\in \{0,1\}^3}(-1)^{f({\textbf{x}})\cdot 01}|{\textbf{x}}\rangle _3 = \frac{1}{\sqrt{8}}\sum _{{\textbf{x}}\in \{0,1\}^3}(-1)^{{\textbf{x}}\cdot 010}|{\textbf{x}}\rangle _3. \end{aligned}$$

And finally, if we apply Hadamard gates to this 3-qubit system, we will get the state \(|010\rangle _3\).

$$\begin{aligned} |\varphi _5\rangle _3 = {\textbf{H}}_3|\varphi _4\rangle _3 = |010\rangle _3. \end{aligned}$$

It is not clear now how this idea is helpful, as the final result is directly determined by the initial \({\textbf{y}}\) we chose, and if we had fixed \({\textbf{y}} = 10\), then the final result would have been 100. However, suppose now that we do not know which of the bits f eliminates, and we want to determine which one it is. We only have three possibilities, and we could easily check with one classical call to f which of the bits is eliminated—simply compute f(010)—but it is interesting to do it by using our new tool.

Lemma 3

Let \(f:\{0,1\}^n\rightarrow \{0,1\}^{n-1}\) be a Boolean function that eliminates one bit; then, we can use the algorithm above to determine which bit is eliminated.

Proof

To do so, we just apply the generalised version of the algorithm mentioned above \(n-1\) times, using each time one of the vectors of the canonical basis of \(\{0,1\}^{n-1}\) as an \({\mathbb {F}}_2\) vector space. If we denote by \({\textbf{e}}_i\) the string of bits whose only 1 is in the i-th position (starting by 0)—i.e., the i-th element of the canonical basis—then each of the \(n-1\) iterations of the algorithm would go as follows:

$$\begin{aligned} |\varphi _0\rangle _{n,n-1} = |{\textbf{0}}\rangle _n\otimes |{\textbf{0}}\rangle _{n-1}. \end{aligned}$$

First, we obtain \({\textbf{e}}_i\) in the second register by applying the \({\textbf{X}}\) gate wherever we need:

$$\begin{aligned} |\varphi _1\rangle _{n,n-1} = |{\textbf{0}}\rangle _n\otimes |{\textbf{e}}_i\rangle _{n-1}. \end{aligned}$$

Second, we apply Hadamard gates:

$$\begin{aligned} |\varphi _2\rangle _{n,n-1} = \left( {\textbf{H}}_{2n-1}\right) |\varphi _1\rangle _{2n-1}. \end{aligned}$$

Then, we use the \({{\,\textrm{GPK}\,}}\) (Generalised Phase Kick-Back):

$$\begin{aligned} |\varphi _3\rangle _{n,n-1} = {\textbf{U}}_f|\varphi _2\rangle _{2n-1}. \end{aligned}$$

And finally, we apply Hadamard gates to the first register and measure:

$$\begin{aligned} |\varphi _4\rangle _{n,n-1} = ({\textbf{H}}_n\otimes {\textbf{I}}^{\otimes (n-1)})|\varphi _3\rangle _{n,n-1}. \end{aligned}$$

After we have done so with all \(n-1\) possible \({\textbf{e}}_i\), we will have obtained \(n-1\) of the n vectors of the canonical basis of \({\mathbb {F}}_2^n\), and the one left indicates which of the bits is eliminated. \(\square \)

This, of course, does not give us an improvement of any sort over the classical case—it is actually the opposite, as we could have just computed the image of \({\textbf{x}} = 101010\ldots \) and checked for repeated characters—but it illustrates the inner workings of the technique.

Some other examples such as this could be constructed. Another one is the problem of, given an f that switches one unknown bit, finding out which one. However, we will now focus on a problem in which this idea allows for an improvement over the classical situation.

4 The generalised Deutsch–Jozsa problem

An easy follow-up to the previous section would be to solve a generalised version of the Deutsch–Jozsa problem using this technique. As we have seen, many such generalisations have been considered, but the one we propose generalises the evenly balanced one proposed both in [3] and in [4].

Definition 1

(Generalised Deutsch–Jozsa problem.) We say that a Boolean function is balanced if half of the input values output one string and the other half output another.

Given then a Boolean function \(f:\{0,1\}^n\rightarrow \{0,1\}^m\) that can either be constant or balanced, we will denote by Generalised Deutsch–Jozsa problem the one of finding out in which of the cases are we.

The Deutsch–Jozsa problem is clearly one instance of this general problem where \(m = 1\), and thus, we will show how we can solve this problem by using an algorithm inspired by that of Deutsch and Jozsa.

Remark 3

It is clear that if we want to solve this problem using classical deterministic methods, we will need something of the order of \({\mathcal {O}}(2^{n-1})\) applications of f. We will see how we can improve this with a quantum algorithm to an order of \({\mathcal {O}}(m)\) calls to f. Note also that this includes the already known case where \(m=1\).

Let us limit ourselves to the instance where constant means that \(f({\textbf{x}}) = {\textbf{0}}\) for every \({\textbf{x}}\in \{0,1\}^n\) and balanced means that half of the values are \({\textbf{0}}\) and the other half a fixed string different from \({\textbf{0}}\).

Given \({\textbf{e}}_i = 0^{(m-1)-i} \ 1 \ 0^{i}\), where \(i=0,\ldots ,m-1\), we will repeat the following algorithm for each \({\textbf{e}}_i\), but it could actually be done for any binary string \({\textbf{y}}\in \{0,1\}^m\).

\(\mathbb {STEP} 1\)

\(|\varphi _0\rangle _{n,m} = |{\textbf{0}}\rangle _n\otimes |{\textbf{0}}\rangle _m.\)

We begin with two registers of n and m qubits, both at the state \(|{\textbf{0}}\rangle \).

\(\mathbb {STEP}\) 2

\(|\varphi _1\rangle _{n,m} = \left( {\textbf{I}}^{\otimes n}\otimes {\textbf{I}}^{\otimes (m-1-i)}\otimes {\textbf{X}}\otimes {\textbf{I}}^{\otimes i}\right) |\varphi _0\rangle _{n,m}.\)

We apply the \({\textbf{X}}\) gate to achieve the desired \(|{\textbf{e}}_i\rangle \) state in the second register. If we want any other binary string \({\textbf{y}}\) to act as a marker, we should apply the corresponding \({\textbf{X}}\) gates in the necessary positions.

\(\mathbb {STEP}\) 3

\(|\varphi _2\rangle _{n,m} = {\textbf{H}}_{n+m}|\varphi _1\rangle _{n,m}.\)

We apply Hadamard gates to obtain the desired superposition in the first register and \(|\gamma _{{\textbf{e}}_i}\rangle \) in the second.

\(\mathbb {STEP}\) 4

\(|\varphi _3\rangle _{n,m} = {\textbf{U}}_f|\varphi _2\rangle _{n,m}.\)

We apply \({\textbf{U}}_f\) to use the \({{\,\textrm{GPK}\,}}\) technique.

\(\mathbb {STEP}\) 5

\(|\varphi _4\rangle _{n,m} = \left( {\textbf{H}}^{\otimes n}\otimes {\textbf{I}}^{\otimes m}\right) |\varphi _3\rangle _{n,m}.\)

At this point, the second register might be discarded and we apply Hadamard gates to the first one.

\(\mathbb {STEP}\) 6

We measure the first register and name the result \(\delta _i\).

If after repeating these steps for each i we obtain only \(\delta _i = {\textbf{0}}\) strings, then the function is constant; otherwise it is balanced.

Definition 2

(Generalised Phase Kick-Back algorithm.) The only variable in the algorithm is the choice of the marker \({\textbf{y}}\) used for the Phase Kick-Back. We will refer to this algorithm as GPK algorithm for \({\textbf{y}}\) or \({{\,\textrm{GPK}\,}}({\textbf{y}})\). From now on, the notation regarding this algorithm will be the same as before.

Theorem 1

(Correctness of the algorithm) The aforementioned algorithm correctly determines whether a function is constant or balanced in the case where the image set of f includes \({\textbf{0}}\).

Proof

Given \(i=0,\ldots ,m-1\), let us keep track of the states step by step:

As we are applying the \({\textbf{X}}\) gate on the i-th qubit of the second register (counting from 0), then

$$\begin{aligned} |\varphi _1\rangle _{n,m} = |{\textbf{0}}\rangle _n\otimes |{\textbf{e}}_i\rangle _m, \end{aligned}$$

Next,

$$\begin{aligned} |\varphi _2\rangle _{n,m} = \frac{1}{\sqrt{N}} \sum _{{\textbf{x}}\in \{0,1\}^n} |{\textbf{x}}\rangle _n\otimes |\gamma _{{\textbf{e}}_i}\rangle _m, \end{aligned}$$

just by the definition of \(|\gamma _{{\textbf{e}}_i}\rangle \) and the known effect of Hadamard gates on the \(|{\textbf{0}}\rangle \) state. Finally, we obtain

$$\begin{aligned} |\varphi _3\rangle _{n,m} = \left( \frac{1}{\sqrt{N}} \sum _{{\textbf{x}}\in \{0,1\}^n} (-1)^{f({\textbf{x}})\cdot {\textbf{e}}_i}|{\textbf{x}}\rangle _n\right) \otimes |\gamma _{{\textbf{e}}_i}\rangle _m, \end{aligned}$$

by applying Lemma 2.

If we focus now only on the first register, we will have the following state:

$$\begin{aligned} \frac{1}{\sqrt{N}} \sum _{{\textbf{x}}\in \{0,1\}^n} (-1)^{f({\textbf{x}})\cdot {\textbf{e}}_i}|{\textbf{x}}\rangle _n. \end{aligned}$$

Then, after applying the Hadamard gates, we will have:

$$\begin{aligned} {\textbf{H}}_n\frac{1}{\sqrt{N}} \sum _{{\textbf{x}}\in \{0,1\}^n} (-1)^{f({\textbf{x}})\cdot {\textbf{e}}_i}|{\textbf{x}}\rangle _n = \frac{1}{\sqrt{N}} \sum _{{\textbf{x}}\in \{0,1\}^n} (-1)^{f({\textbf{x}})\cdot {\textbf{e}}_i}{\textbf{H}}_n|{\textbf{x}}\rangle _n \\ = \frac{1}{\sqrt{N}} \sum _{{\textbf{x}}\in \{0,1\}^n} (-1)^{f({\textbf{x}})\cdot {\textbf{e}}_i}\left( \frac{1}{\sqrt{N}}\sum _{{\textbf{z}}\in \{0,1\}^n} (-1)^{{\textbf{x}}\cdot {\textbf{z}}}|{\textbf{z}}\rangle _n\right) \\ = \frac{1}{N}\sum _{{\textbf{z}}\in \{0,1\}^n} \left[ \sum _{{\textbf{x}}\in \{0,1\}^n} (-1)^{f({\textbf{x}})\cdot {\textbf{e}}_i \oplus {\textbf{x}}\cdot {\textbf{z}}}\right] |{\textbf{z}}\rangle _n. \end{aligned}$$

It is easy to check that if the function is constant and equal to \({\textbf{0}}\), then regardless of the value of i the amplitude of \(|{\textbf{0}}\rangle _n\) in the previous superposition is the following:

$$\begin{aligned} \frac{1}{N}\sum _{{\textbf{x}}\in \{0,1\}^n} (-1)^{f({\textbf{x}})\cdot {\textbf{e}}_i} = \frac{1}{N}\sum _{{\textbf{x}}\in \{0,1\}^n} (-1)^0 = 1. \end{aligned}$$

Thus, we will always obtain \(\delta _i = {\textbf{0}}\) no matter which marker we use.

If f is not constant, then when \(f({\textbf{x}}) \ne {\textbf{0}}\) there must be an \(i\in \{0,\ldots ,m-1\}\) for which \(f({\textbf{x}})\cdot {\textbf{e}}_i = 1\). If we take such a \({\textbf{e}}_i\), then the amplitude for \(|{\textbf{0}}\rangle _n\) is:

$$\begin{aligned} \frac{1}{N}\sum _{{\textbf{x}}\in \{0,1\}^n} (-1)^{\left( f({\textbf{x}})\cdot {\textbf{e}}_i\right) \oplus \left( {\textbf{x}} \cdot {\textbf{0}}\right) } = \frac{1}{N}\sum _{{\textbf{x}}\in \{0,1\}^n} (-1)^{f({\textbf{x}})\cdot {\textbf{e}}_i} = 0, \end{aligned}$$

because \(f({\textbf{x}})\) is balanced, and thus, half the elements of the sum will be 1 and the other half \(-1\). This implies that we would get a result different from \({\textbf{0}}\) for that i. \(\square \)

Note that the choice of the canonical basis is not compulsory and that we could have chosen any other basis of \({\mathbb {F}}_2^m\) as our markers.

The same idea works for the general case of the Generalised Deutsch–Jozsa problem.

Theorem 2

(General correctness) The previous algorithm correctly determines whether a function is constant or balanced.

Proof

The only thing left to analyse is the final amplitudes in the general case. To do so, we need to recall that the final state is:

$$\begin{aligned} \frac{1}{N}\sum _{{\textbf{z}}\in \{0,1\}^n} \left[ \sum _{{\textbf{x}}\in \{0,1\}^n} (-1)^{\left( f({\textbf{x}})\cdot {\textbf{e}}_i\right) \oplus \left( {\textbf{x}}\cdot {\textbf{z}}\right) }\right] |{\textbf{z}}\rangle _n. \end{aligned}$$

If we analyse now the amplitude of \(|{\textbf{z}}\rangle _n = |{\textbf{0}}\rangle _n\), we would be left with:

$$\begin{aligned} \frac{1}{N}\sum _{{\textbf{x}}\in \{0,1\}^n} (-1)^{\left( f({\textbf{x}})\cdot {\textbf{e}}_i\right) \oplus \left( {\textbf{x}} \cdot {\textbf{0}}\right) } = \frac{1}{N}\sum _{{\textbf{x}}\in \{0,1\}^n} (-1)^{f({\textbf{x}})\cdot {\textbf{e}}_i}. \end{aligned}$$

If \(f({\textbf{x}})\) is constant, then \(f({\textbf{x}})\cdot {\textbf{e}}_i\) is either always 0 or always 1, as \({\textbf{x}}\) varies. Whichever the case, the final amplitude will be either 1 or \(-1\), and thus, we will always get \({\textbf{0}}\) at the end of the algorithm.

On the other hand, if \(f({\textbf{x}})\) is balanced with possible values \({\textbf{f}}_1, {\textbf{f}}_2\in \{0,1\}^m\) such that \({\textbf{f}}_1\ne {\textbf{f}}_2\), then there is a \(i\in \{0,\ldots ,m-1\}\) such that \({\textbf{f}}_1\cdot {\textbf{e}}_i \ne {\textbf{f}}_2\cdot {\textbf{e}}_i\), and for that i the amplitude of \({\textbf{z}} = {\textbf{0}}\) would be:

$$\begin{aligned} \frac{1}{N}\sum _{{\textbf{x}}\in \{0,1\}^n} (-1)^{f({\textbf{x}})\cdot {\textbf{e}}_i}. \end{aligned}$$

As the function is balanced between \({\textbf{f}}_1\) and \({\textbf{f}}_2\), that amplitude is 0 and thus we would get a result different from \({\textbf{0}}\). \(\square \)

This algorithm not only allows us to distinguish constant and balanced functions, but it also allows us to determine the values of the function. In the balanced situation, it would not be possible to do that efficiently in a deterministic way.

Corollary 1

It is possible to determine the possible values of f by applying the aforementioned algorithm and making a classical call to the function.

Proof

Let us begin by the case in which the possible images are \({\textbf{0}}\) and \({\textbf{f}}_1\). In this situation, the values of i for which we obtain a result different from \(\delta _i = {\textbf{0}}\) mark the bits of \({\textbf{f}}_1\) that are different from 0, thus determining exactly the value of \({\textbf{f}}_1\), so \({\textbf{f}}_1 = \varvec{\lambda }= \lambda _{m-1}\ldots \lambda _1\lambda _0\), where we define \(\lambda _i\) as:

$$\begin{aligned} \lambda _i = {\left\{ \begin{array}{ll} 0 &{} \text { if } \delta _i = {\textbf{0}} \\ 1 &{} \text { otherwise}. \end{array}\right. } \end{aligned}$$

In the general case, if we note the two possible images by \({\textbf{f}}_1\) and \({\textbf{f}}_2\), the \(\varvec{\lambda }= \lambda _{m-1}\ldots \lambda _1\lambda _0\) string tells us that the Boolean bitwise difference between \({\textbf{f}}_1\) and \({\textbf{f}}_2\)—i.e., \({\textbf{f}}_1\oplus {\textbf{f}}_2\). Thus, we would know that \({\textbf{f}}_1 = {\textbf{f}}_2 \oplus \varvec{\lambda }\). If we now classically calculate one of the possible images—for instance \(f({\textbf{0}})\)—we would be able to retrieve both values. \(\square \)

Remark 4

We also have to point out that we have solved the problem by applying the quantum gate \({\textbf{U}}_f\) m times, which is an exponential improvement over the deterministic classical situation when m is of linear order with respect to n.

Remark 5

There is a pattern that will reappear in the following section, which is that the \({{\,\textrm{GPK}\,}}\) algorithm is unable to detect translations. That is, given two Boolean functions \(f_1, f_2:\{0,1\}^{n}\rightarrow \{0,1\}^{m}\) for which there is an \({\textbf{s}}\in \{0,1\}^{n}\) such that \(f_1({\textbf{x}}) = f_2({\textbf{x}})\oplus {\textbf{s}}\) for every \({\textbf{x}}\in \{0,1\}^{n}\), if we analyse the first register of \(|\varphi _4\rangle _{n+m}\) for function \(f_2\) using \({\textbf{y}}\in \{0,1\}^{m}\) as a marker, we get:

$$\begin{aligned} \frac{1}{N}\sum _{{\textbf{z}}\in \{0,1\}^n} \left[ \sum _{{\textbf{x}}\in \{0,1\}^n} (-1)^{f_2({\textbf{x}})\cdot {\textbf{y}} \oplus {\textbf{x}}\cdot {\textbf{z}}}\right] |{\textbf{z}}\rangle _n. \end{aligned}$$

And if we now use that \(f_2({\textbf{x}}) = f_1({\textbf{x}})\oplus {\textbf{s}}\), we get:

$$\begin{aligned} \frac{1}{N}\sum _{{\textbf{z}}\in \{0,1\}^n} \left[ \sum _{{\textbf{x}}\in \{0,1\}^n} (-1)^{\left( f_1({\textbf{x}})\oplus {\textbf{s}}\right) \cdot {\textbf{y}} \oplus {\textbf{x}}\cdot {\textbf{z}}}\right] |{\textbf{z}}\rangle _n \\ = (-1)^{{\textbf{s}}\cdot {\textbf{y}}}\frac{1}{N}\sum _{{\textbf{z}}\in \{0,1\}^n} \left[ \sum _{{\textbf{x}}\in \{0,1\}^n} (-1)^{f_1({\textbf{x}})\cdot {\textbf{y}} \oplus {\textbf{x}}\cdot {\textbf{z}}}\right] |{\textbf{z}}\rangle _n. \end{aligned}$$

And, as we can observe, we end up getting a quantum state equivalent to the one we would get by applying the \({{\,\textrm{GPK}\,}}\) algorithm for the function \(f_1\), which does not affect the probabilities of the final result. This is the reason behind the fact that what we get in the general case of the balanced situation in the Generalised Deutsch–Jozsa algorithm is the sum of the two possible values \(\varvec{\lambda }\), and why we must make an extra step to find both values.

Remark 6

In order to solve the generalised Deutsch–Jozsa problem we have computed m applications of the \({{\,\textrm{GPK}\,}}\) algorithm with the elements of the computational basis as markers. What we want to show now is that this choice of markers is not compulsory and that any basis of \(\{0,1\}^{m}\) would suffice.

Let \({\textbf{y}}_1,\ldots ,{\textbf{y}}_m\in \{0,1\}^{m}\) be any such basis; we will compute now the \({{\,\textrm{GPK}\,}}\) algorithm for each of these markers. It becomes clear that if \(f({\textbf{x}})\cdot {\textbf{y}}_i\) is constant for all \({\textbf{x}}\in \{0,1\}^{n}\), then the result of the i-th iteration of the algorithm will be \({\textbf{0}}\), while if \(f({\textbf{x}})\cdot {\textbf{y}}_i= 0\) for half of the values and 1 for the other half, then the result will be any other binary string.

Let \(\varvec{\lambda }= {\textbf{f}}_1\oplus {\textbf{f}}_2\) be the sum of the two possible values of the function as before—if the function is constant we would have \(\varvec{\lambda }= {\textbf{0}}\)—then what we end up with is a system of equations:

$$\begin{aligned} \{{\textbf{y}}_i\cdot \varvec{\lambda }= \delta _i\mid i = 1,\ldots , m\}, \end{aligned}$$

where \(\varvec{\lambda }\) is the string of unknowns. This system is always made up of m linearly independent equations, as the \({\textbf{y}}_i\) are a basis of \(\{0,1\}^{m}\), so the sole solution will be the desired \(\varvec{\lambda }\).

5 A Bernstein–Vazirani inspired algorithm

Once again we will put our focus on generalising an already known problem which was first studied in [17]. The problem we propose was already solved in [3], but we will further expand the idea and use it to better understand the technique. Let us begin by recalling the Bernstein–Vazirani problem in the one-dimensional situation.

Definition 3

(Bernstein–Vazirani problem.) Let \(f:\{0,1\}^n\rightarrow \{0,1\}\) be a function such that there is an \({\textbf{r}} \in \{0,1\}^n\) for which \(f({\textbf{x}}) = {\textbf{r}} \cdot {\textbf{x}}\), we want to find the binary string \({\textbf{r}}\).

Let us note that the condition stated in the Bernstein–Vazirani problem just asks for f to be linear. This is relevant because in the generalisation of this problem we will consider a linear \(f:\{0,1\}^{n}\rightarrow \{0,1\}^{m}\) and ask to exactly determine it.

Regarding the complexity of this problem, we should note that a linear function \(f:\{0,1\}^{n}\rightarrow \{0,1\}^{}\) can be determined in n calls to f, as we only have to calculate the image through f of the elements of one basis of \(\{0,1\}^{n}\). In particular, we can calculate \(f({\textbf{e}}_i)\) for each element in the canonical basis and the i-th element of \({\textbf{r}}\) would be \(r_i = f({\textbf{e}}_i)\). The exact same can be done in the general case.

We will show how we can solve this problem with a quantum algorithm making a single call to \({\textbf{U}}_f\). The algorithm we will describe is exactly the same as we used to solve the Deutsch–Jozsa problem.

First, we will have two registers of n and 1 qubits, respectively:

$$\begin{aligned} |\varphi _{0}\rangle _{n,1} = |{\textbf{0}}\rangle _n\otimes |1\rangle \end{aligned}$$

We can obtain the \(|1\rangle \) in the second register by applying the \({\textbf{X}}\) gate to the last qubit. Secondly, we will apply Hadamard gates to all the qubits in order to obtain the state:

$$\begin{aligned} |\varphi _{1}\rangle _{n,1} = {\textbf{H}}_n|\varphi _0\rangle _{n,1} = \left( \frac{1}{\sqrt{N}} \sum _{{\textbf{x}}\in \{0,1\}^{n}} |{\textbf{x}}\rangle _n\right) \otimes |-\rangle , \end{aligned}$$

where \(N = 2^n\). This state is now ready to use the Phase Kick-Back technique by applying \({\textbf{U}}_f\):

$$\begin{aligned} |\varphi _{2}\rangle _{n,1} = {\textbf{U}}_f|\varphi _1\rangle _{n,1} = \left( \frac{1}{\sqrt{N}} \sum _{{\textbf{x}}\in \{0,1\}^{n}} (-1)^{f({\textbf{x}})}|{\textbf{x}}\rangle _n\right) \otimes |-\rangle . \end{aligned}$$

Using now that \(f({\textbf{x}}) = {\textbf{r}}\cdot {\textbf{x}}\), we arrive at:

$$\begin{aligned} |\varphi _{2}\rangle _{n,1} = \left( \frac{1}{\sqrt{N}} \sum _{{\textbf{x}}\in \{0,1\}^{n}} (-1)^{{\textbf{r}}\cdot {\textbf{x}}}|{\textbf{x}}\rangle _n\right) \otimes |-\rangle . \end{aligned}$$

Recalling the effect of \({\textbf{H}}_n\) on the computational basis, we can easily check that the first register of this state is exactly \({\textbf{H}}_n|{\textbf{r}}\rangle \), so after applying \({\textbf{H}}_n\) to the first register we obtain:

$$\begin{aligned} |\varphi _{3}\rangle _{n,1} = \left( {\textbf{H}}_n\otimes {\textbf{I}}\right) |\varphi _2\rangle _{n,1} = |{\textbf{r}}\rangle _n\otimes |-\rangle . \end{aligned}$$

Then, after measuring the first register we will obtain \({\textbf{r}}\).

Let us consider now a slight modification to the Bernstein–Vazirani problem.

Definition 4

(Modified Bernstein–Vazirani problem.) Let \(f:\{0,1\}^{n}\rightarrow \{0,1\}^{}\) be a Boolean affine function—i.e., a Boolean function such that there are \({\textbf{r}}\in \{0,1\}^{n}\) and \(r_0\in \{0,1\}\) for which \(f({\textbf{x}}) = r_0\oplus {\textbf{r}}\cdot {\textbf{x}}\) for all \({\textbf{x}}\)—then we want to exactly determine said function.

This problem can be solved by the previous algorithm with just a final step to determine \(r_0\).

Proposition 1

The Bernstein–Vazirani algorithm solves the modified Bernstein–Vazirani problem with certainty with a final classical deterministic call to f to determine \(r_0\).

Proof

Following the previous exposition of the Bernstein–Vazirani algorithm, the only difference in this situation is that we would end up with the state:

$$\begin{aligned} |\varphi _2\rangle _{n,1} = \left( \frac{1}{\sqrt{N}} \sum _{{\textbf{x}}\in \{0,1\}^{n}} (-1)^{r_0\oplus {\textbf{r}}\cdot {\textbf{x}}}|{\textbf{x}}\rangle _n\right) \otimes |-\rangle \\ = (-1)^{r_0}\left( \frac{1}{\sqrt{N}} \sum _{{\textbf{x}}\in \{0,1\}^{n}} (-1)^{{\textbf{r}}\cdot {\textbf{x}}}|{\textbf{x}}\rangle _n\right) \otimes |-\rangle . \end{aligned}$$

This is equivalent to the state we had in the previous situation, and thus, we would end up getting \({\textbf{r}}\) after measuring \(|\varphi _3\rangle _{n,1}\).

To get \(r_0\), we must only classically calculate \(f({\textbf{0}}) = r_0\). \(\square \)

Again, we arrive at the same pattern, where the \({{\,\textrm{GPK}\,}}\) cannot distinguish a translation in f, but only the linear structure it has.

This idea can be used to generalise the Bernstein–Vazirani problem to arbitrary dimensions.

Definition 5

(Generalised Bernstein–Vazirani problem.) Let \(f:\{0,1\}^{n}\rightarrow \{0,1\}^{m}\) be an affine function, i.e., one such that there is an \(m\times n\) matrix R and an \({\textbf{r}}_0\in \{0,1\}^{m}\) for which \(f({\textbf{x}}) = {\textbf{r}}_0\oplus R\cdot {\textbf{x}}\). The Generalised Bernstein–Vazirani problem is that of exactly determining f.

Remark 7

Let us analyse the classical deterministic complexity of this problem. It is easy to prove that we can exactly determine R by calculating \(f({\textbf{e}}_i)\) for each element of the computational basis, as the binary string determined by the i-th file of R, \({\textbf{r}}_i\), will be exactly \(f({\textbf{e}}_i)\oplus {\textbf{r}}_0\). We can finally calculate \({\textbf{r}}_0\) by computing \(f({\textbf{0}})\), so the total calls to f will be \(n+1\).

It can be seen that with the \({{\,\textrm{GPK}\,}}\) we can do this with \(m+1\) calls to the function, so in a way we will switch the roles of \(\{0,1\}^{n}\) and \(\{0,1\}^{m}\).

We will now prove that we can solve the Generalised Bernstein–Vazirani problem by computing m iterations of the \({{\,\textrm{GPK}\,}}\) algorithm by each of the elements of the computational basis of \(\{0,1\}^{m}\) and a final classical computation of \(f({\textbf{0}})\).

Theorem 3

(Correctness of the algorithm) It is possible to exactly determine the matrix R by computing \({{\,\textrm{GPK}\,}}({\textbf{e}}_i)\) for each of the elements \({\textbf{e}}_i\) of the computational basis of \(\{0,1\}^{m}\).

Proof

We will only prove that the result of the algorithm \({{\,\textrm{GPK}\,}}({\textbf{e}}_i)\) is the binary string that determines the i-th row of R, which is an \({\textbf{r}}_i\) such that \(f({\textbf{x}})_i = ({\textbf{r}}_0)_i\oplus {\textbf{r}}_i\cdot {\textbf{x}}\).

Let us calculate the amplitude of \({\textbf{r}}_i\) in the final state of the \({{\,\textrm{GPK}\,}}\) algorithm using \({\textbf{e}}_i\) as marker.

$$\begin{aligned} |\varphi _4\rangle _{n} = \frac{1}{N}\sum _{{\textbf{z}}\in \{0,1\}^n} \left[ \sum _{{\textbf{x}}\in \{0,1\}^n} (-1)^{f({\textbf{x}})\cdot {\textbf{e}}_i \oplus {\textbf{x}}\cdot {\textbf{z}}}\right] |{\textbf{z}}\rangle _n. \end{aligned}$$

Therefore, the amplitude of \({\textbf{r}}_i\) is:

$$\begin{aligned} \frac{1}{N}\sum _{{\textbf{x}}\in \{0,1\}^n} (-1)^{f({\textbf{x}})\cdot {\textbf{e}}_i \oplus {\textbf{x}}\cdot {\textbf{r}}_i} = \frac{1}{N}\sum _{{\textbf{x}}\in \{0,1\}^n} (-1)^{\left( {\textbf{r}}_0\oplus {\textbf{r}}_i\cdot {\textbf{x}}\right) \oplus {\textbf{x}}\cdot {\textbf{r}}_i}. \end{aligned}$$

As \(f({\textbf{x}})\cdot {\textbf{e}}_i = ({\textbf{r}}_0)_i\oplus {\textbf{r}}_i\cdot {\textbf{x}}\). If we expand now the expression, we get:

$$\begin{aligned} \frac{1}{N}\sum _{{\textbf{x}}\in \{0,1\}^n} (-1)^{\left( {\textbf{r}}_0\oplus {\textbf{r}}_i\cdot {\textbf{x}}\right) \oplus {\textbf{x}}\cdot {\textbf{r}}_i} = (-1)^{{\textbf{r}}_0} \frac{1}{N}\sum _{{\textbf{x}}\in \{0,1\}^n} (-1)^{{\textbf{x}} \cdot \left( {\textbf{r}}_i \oplus {\textbf{r}}_i\right) } = (-1)^{{\textbf{r}}_0}, \end{aligned}$$

and we are assured to get \({\textbf{r}}_i\).

Once again, \({{\,\textrm{GPK}\,}}\) only allows us to determine R, but tells us nothing about the translation \({\textbf{r}}_0\), which we have to classically determine by computing \(f({\textbf{0}})\). \(\square \)

Remark 8

The choice of computing the \({{\,\textrm{GPK}\,}}\) algorithm with the elements of the computational basis is actually arbitrary. If we chose to do so with any other basis, we would end up getting the matrix of the linear application in said basis.

Again, we see that the \({{\,\textrm{GPK}\,}}\) is more effective when applied to functions with a certain linear structure.

6 A new algorithm to solve Simon’s problem

The last problem we will try to solve by means of the \({{\,\textrm{GPK}\,}}\) algorithm will be Simon’s problem. This problem was introduced by Daniel Simon in [18]. Further generalisations of this problem can be found in [1].

Definition 6

(Simon’s problem.) Let \(f:\{0,1\}^n\rightarrow \{0,1\}^n\) be a Boolean function which satisfies that there is a secret \({\textbf{s}}\in \{0,1\}^n\) such that if \(f({\textbf{z}}) = f({\textbf{y}})\) then \({\textbf{z}}={\textbf{y}}\oplus {\textbf{s}}\) or \({\textbf{y}} = {\textbf{z}}\). This kind of function is called a Simon function, and Simon’s problem is to determine such \({\textbf{s}}\).

Simon’s problem is solved by means of Simon’s algorithm, which works as follows.

\(\mathbb {STEP}\) 1

\(|\psi _0\rangle _{n,n} = |{\textbf{0}}\rangle _n\otimes |{\textbf{0}}\rangle _n.\)

We begin with the \({\textbf{0}}\) state.

\(\mathbb {STEP}\) 2

\(|\psi _1\rangle _{n,n} = \left( {\textbf{H}}_n\otimes {\textbf{I}}_m\right) |\psi _0\rangle _{n,n} = \left( \displaystyle \frac{1}{\sqrt{N}}\displaystyle \sum _{{\textbf{x}}\in \{0,1\}^{n}} |{\textbf{x}}\rangle _n \right) \otimes |{\textbf{0}}\rangle _m.\)

We get a superposition of all the states in the computational basis with the same amplitude in the first register.

\(\mathbb {STEP}\) 3

\(|\psi _2\rangle _{n,n} = {\textbf{U}}_f |\psi _1\rangle _{n,n} = \displaystyle \frac{1}{\sqrt{N}}\displaystyle \sum _{{\textbf{x}}\in \{0,1\}^{n}} |{\textbf{x}}\rangle _n\otimes |f({\textbf{x}})\rangle _n.\)

We apply the \({\textbf{U}}_f\) gate, so now we can measure the second register.

\(\mathbb {STEP}\) 4

We measure the second register, getting a specific value \(f({\textbf{x}})\) and collapsing the first register to:

\(|\psi _3\rangle _{n} = \displaystyle \frac{1}{\sqrt{2}} \left( |{\textbf{x}}\rangle _n + |{\textbf{x}}\oplus {\textbf{s}}\rangle _n\right) ,\) for some \(\textbf{x}\in \{0,1\}^{n}\), getting a superposition of two related states.

\(\mathbb {STEP}\) 5

\(|\psi _4\rangle _{n} = {\textbf{H}}_n|\psi _3\rangle _{n} = \displaystyle \frac{1}{\sqrt{2N}} \displaystyle \sum _{{\textbf{z}}\in \{0,1\}^{n}} \left( (-1)^{{\textbf{z}}\cdot {\textbf{x}}} + (-1)^{{\textbf{z}}\cdot ({\textbf{x}}\oplus {\textbf{s}})} \right) |{\textbf{z}}\rangle _n.\)

If we further analyse this final state, we get:

$$\begin{aligned} |\psi _4\rangle _{n} = \frac{1}{\sqrt{2N}} \sum _{{\textbf{z}}\in \{0,1\}^{n}} (-1)^{{\textbf{z}}\cdot {\textbf{x}}}\big (1 + (-1)^{{\textbf{z}}\cdot {\textbf{s}}} \big )|{\textbf{z}}\rangle _n. \end{aligned}$$

And the amplitude of \({\textbf{z}}\) is 0 if \({\textbf{z}}\cdot {\textbf{s}} = 1\) and \((-1)^{{\textbf{z}}\cdot {\textbf{x}}}\sqrt{2/N}\) if \({\textbf{z}}\cdot {\textbf{s}} = 0\).

We thus get a uniform probability distribution over all the states \({\textbf{z}}\) such that \({\textbf{z}}\cdot {\textbf{s}} = 0\) where the probability of each such \({\textbf{z}}\) is \(p({\textbf{z}}) = 2/N\). The idea is now to iterate this algorithm to get enough independent states of that kind and solve the corresponding linear system.

We will now present an alternative to this algorithm using the \({{\,\textrm{GPK}\,}}\). The main idea is that we will arrive at a superposition of the same basic states, but with different amplitudes.

Proposition 2

Let \(f:\{0,1\}^{n}\rightarrow \{0,1\}^{n}\) be a Simon function and \(\textbf{y}\in \{0,1\}^{n}\). If we apply \({{\,\textrm{GPK}\,}}(\textbf{y})\) to f we obtain a superposition of the same basic states as in Simon’s algorithm.

Proof

We will follow the notation in Definition 2. The final state of the algorithm after discarding the second register in Step 4 will be:

$$\begin{aligned} |\varphi _4\rangle _{n} =\frac{1}{N}\sum _{{\textbf{z}}\in \{0,1\}^n} \left[ \sum _{{\textbf{x}}\in \{0,1\}^n} (-1)^{f({\textbf{x}})\cdot {\textbf{y}} \oplus {\textbf{x}}\cdot {\textbf{z}}} \right] |{\textbf{z}}\rangle _n. \end{aligned}$$

If we study the amplitude of each \({\textbf{z}}\) in this superposition, we get two distinct cases. If \({\textbf{z}}\cdot {\textbf{s}} = 1\), then \({\textbf{z}}\cdot {\textbf{x}} \ne {\textbf{z}}\cdot ({\textbf{x}}\oplus {\textbf{s}})\), which together with the fact that \(f({\textbf{x}}) = f({\textbf{x}}\oplus {\textbf{s}})\) implies that the amplitude is 0. In the other case, we cannot easily determine the amplitude of \({\textbf{z}}\).

Thus, we end up with a sum of states of the computational basis, which fulfil the same property as those in Simon’s algorithm but with different probabilities. \(\square \)

At this point in Simon’s algorithm, we would iterate the algorithm until we get enough linearly independent states to solve the system and find \({\textbf{s}}\). Our algorithm improves this.

Theorem 4

(Random marker selection algorithm) Let \(f:\{0,1\}^{n}\rightarrow \{0,1\}^{m}\) be a Simon function with \(\textbf{s}\in \{0,1\}^{n}\) as its secret string. If we apply the \({{\,\textrm{GPK}\,}}\) algorithm with random marker selection among \(\{0,1\}^{n}\), then the probability of obtaining a given \(\textbf{z}\in \{0,1\}^{n}\) as a result is:

$$\begin{aligned} p(\textbf{z}) = {\left\{ \begin{array}{ll} 2/N &{} \text {if } \textbf{z}\cdot \textbf{s} = 0 \\ 0 &{} \text {otherwise.} \end{array}\right. } \end{aligned}$$

Proof

We will simply prove that choosing the marker at random among all the possible elements of \(\{0,1\}^{n}\) we get a uniform distribution as in the Simon’s algorithm.

The probability of choosing a given \({\textbf{y}}\in \{0,1\}^{n}\) is 1/N, so the final probability of getting a certain \({\textbf{z}}\in \{0,1\}^{n}\) at the end of the algorithm would be:

$$\begin{aligned} p({\textbf{z}}) = \frac{1}{N}\sum _{{\textbf{y}}\in \{0,1\}^{n}} \alpha _{{\textbf{y}}}({\textbf{z}})^2, \end{aligned}$$

where \(\alpha _{{\textbf{y}}}({\textbf{z}})\) is the amplitude of \({\textbf{z}}\) in the final state of the \({{\,\textrm{GPK}\,}}\). As we have seen, this amplitude is:

$$\begin{aligned} \alpha _{{\textbf{y}}}({\textbf{z}}) = \frac{1}{N} \sum _{{\textbf{x}}\in \{0,1\}^n} (-1)^{f({\textbf{x}})\cdot {\textbf{y}} \oplus {\textbf{x}}\cdot {\textbf{z}}}. \end{aligned}$$

Therefore,

$$\begin{aligned} \begin{array}{rcl} p({\textbf{z}}) &{}=&{} \displaystyle \frac{1}{N^3}\sum _{{\textbf{y}}\in \{0,1\}^{n}} \left[ \sum _{{\textbf{x}}\in \{0,1\}^n} (-1)^{f({\textbf{x}})\cdot {\textbf{y}} \oplus {\textbf{x}}\cdot {\textbf{z}}}\right] ^2 \\ &{}=&{} \displaystyle \frac{1}{N^3}\sum _{{\textbf{y}}\in \{0,1\}^{n}} \sum _{{\textbf{x}}\in \{0,1\}^n} \left[ (-1)^{f({\textbf{x}})\cdot {\textbf{y}} \oplus {\textbf{x}}\cdot {\textbf{z}}}\left( \sum _{{\textbf{x}}'\in \{0,1\}^n} (-1)^{f({\textbf{x}}')\cdot {\textbf{y}} \oplus {\textbf{x}}'\cdot {\textbf{z}}} \right) \right] \\ &{}=&{} \displaystyle \frac{1}{N^3}\sum _{{\textbf{y}}\in \{0,1\}^{n}} \sum _{{\textbf{x}},{\textbf{x}}'\in \{0,1\}^n} (-1)^{\left( f({\textbf{x}})\oplus f({\textbf{x}}')\right) \cdot {\textbf{y}} \oplus \left( {\textbf{x}}\oplus {\textbf{x}}'\right) \cdot {\textbf{z}}} \\ &{}=&{} \displaystyle \frac{1}{N^3} \sum _{{\textbf{x}},{\textbf{x}}'\in \{0,1\}^n} \left[ \sum _{{\textbf{y}}\in \{0,1\}^{n}} (-1)^{\left( f({\textbf{x}})\oplus f({\textbf{x}}')\right) \cdot {\textbf{y}} \oplus \left( {\textbf{x}}\oplus {\textbf{x}}'\right) \cdot {\textbf{z}}} \right] . \end{array} \end{aligned}$$

If we now analyse this final expression, in particular the sum on \({\textbf{y}}\) for each particular pair \({\textbf{x}},{\textbf{x}}'\), we get:

$$\begin{aligned} \sum _{{\textbf{y}}\in \{0,1\}^{n}} (-1)^{\left( f({\textbf{x}})\oplus f({\textbf{x}}')\right) \cdot {\textbf{y}} \oplus \left( {\textbf{x}}\oplus {\textbf{x}}'\right) \cdot {\textbf{z}}}. \end{aligned}$$

It is easy to see that if \(f({\textbf{x}})\ne f({\textbf{x}}')\), then this sum is 0, as \({\textbf{x}},{\textbf{x}}'\) and \({\textbf{z}}\) are fixed and \(\left( f({\textbf{x}})\oplus f({\textbf{x}}')\right) \cdot {\textbf{y}}\) would take value 1 for half of the values of \({\textbf{y}}\) and 0 for the other half.

Considering this, in the situation of Simon’s problem we would get:

$$\begin{aligned} \begin{array}{rcl} p({\textbf{z}}) &{}=&{} \displaystyle \frac{1}{N^3}\sum _{{\textbf{x}}\in \{0,1\}^{n}}\sum _{{\textbf{y}}\in \{0,1\}^{n}} \left( (-1)^{\left( {\textbf{x}}\oplus {\textbf{x}}\right) \cdot {\textbf{z}}} + (-1)^{\left( {\textbf{x}}\oplus {\textbf{x}}\oplus {\textbf{s}}\right) \cdot {\textbf{z}}} \right) \\ &{}=&{} \displaystyle \frac{1}{N^3}\sum _{{\textbf{x}}\in \{0,1\}^{n}}\sum _{{\textbf{y}}\in \{0,1\}^{n}} \left( 1 + (-1)^{{\textbf{s}}\cdot {\textbf{z}}} \right) , \end{array} \end{aligned}$$

which is 0 if \({\textbf{s}}\cdot {\textbf{z}}\) is 1 and 2/N if \({\textbf{z}}\cdot {\textbf{s}} = 0\). \(\square \)

In each iteration of Simon’s algorithm, we have the same probability of obtaining each string such that \({\textbf{x}}\cdot {\textbf{s}} = 0\), including the string \({\textbf{0}}\), which does not give us any information. Let us prove that we are reducing the probability of obtaining \({\textbf{0}}\) without hurting the balance among the rest of the strings.

Corollary 2

The \({{\,\textrm{GPK}\,}}\) with random marker selection among \(\{0,1\}^{n}\setminus \{\textbf{0}\}\) improves Simon’s algorithm.

Proof

If we chose now \({\textbf{0}}\) as marker, we would get \({\textbf{0}}\) with complete certainty, so if we eliminate the possibility of choosing \({\textbf{0}}\) as a marker we will reduce the probability of getting \({\textbf{0}}\) as a result to:

$$\begin{aligned} \frac{2}{N}-\frac{1}{N} = \frac{1}{N}, \end{aligned}$$

while the probability of every other state \({\textbf{z}}\) such that \({\textbf{z}}\cdot {\textbf{s}} = 0\) would increase to:

$$\begin{aligned} 2\frac{N-1}{N(N-2)}. \end{aligned}$$

\(\square \)

Remark 9

(Example 2.) In order to show an example of this algorithm, we will take \(f:\{0,1\}^{4}\rightarrow \{0,1\}^{4}\) as follows:

$$\begin{aligned} f(0000) = f(0101) = 1111&f(0001) = f(0100) = 0001 \\ f(0010) = f(0111) = 0010&f(0011) = f(0110) = 0011 \\ f(1000) = f(1101) = 0100&f(1001) = f(1100) = 0101 \\ f(1010) = f(1111) = 0110&f(1011) = f(1110) = 0111, \end{aligned}$$

In this case, the secret is \({\textbf{s}} = 0101\). Our first step will be to randomly choose a marker different from \({\textbf{0}}\), so each possible marker will have 1/15 probability. Let us suppose that we chose \({\textbf{y}} = 0111\). After applying \({{\,\textrm{GPK}\,}}(0111)\) to f, we would get the state:

$$\begin{aligned} \frac{1}{16}\big (-4|0000\rangle _4-4|0010\rangle _4-4|0101\rangle _4 \\ -4|0111\rangle _4-4|1000\rangle _4-4|1010\rangle _4-4|1101\rangle _4+12|1111\rangle _4\big ), \end{aligned}$$

which is composed only by states of the computational basis \(|{\textbf{x}}\rangle _4\) with \({\textbf{x}}\cdot {\textbf{s}} = 0\), but not all with the same amplitude. If we measured we would get one of them, which will probably be 1111. This binary string will translate into an equation:

$$\begin{aligned} s_0\oplus s_1\oplus s_2\oplus s_3 = 0. \end{aligned}$$

where \({\textbf{s}} = s_0 s_1 s_2 s_3\). If we repeated the algorithm again, we would choose a new marker \({\textbf{y}} = 0011\) and apply \({{\,\textrm{GPK}\,}}(0101)\) to f, which would in turn give us:

$$\begin{aligned} |1101\rangle _4. \end{aligned}$$

After measuring, we would get 1101 with complete certainty, which will translate into the equation:

$$\begin{aligned} s_0\oplus s_1\oplus s_3 = 0. \end{aligned}$$

We would repeat the algorithm until we get three independent linear equations. The main improvement over Simon’s algorithm is that we have globally diminished the probability of getting \({\textbf{0}}\) after each iteration of the algorithm, as we are not choosing \({\textbf{0}}\) as a marker.