Theoretical Computer Science 287 (2002) 337 – 353

www.elsevier.com/locate/tcs

Quantum communication and complexity

Ronald de Wolf ∗;1
University of California, 583 Soda Hall, Berkeley, CA 94720-1776, USA

Abstract

In the setting of communication complexity, two distributed parties want to compute a func-
tion depending on both their inputs, using as little communication as possible. The required
communication can sometimes be signi-cantly lowered if we allow the parties the use of quan-
tum communication. We survey the main results of the young area of quantum communication
complexity: its relation to teleportation and dense coding, the main examples of fast quantum
communication protocols, lower bounds, and some applications.
c 2002 Published by Elsevier
Science B.V.

Keywords: Quantum computing; Communication complexity

1. Introduction

The area of communication complexity deals with the following type of problem.
There are two separated parties, called Alice and Bob. Alice receives some input x ∈X ,
Bob receives some y ∈Y , and together they want to compute some function f(x; y).
As the value f(x; y) will generally depend on both x and y, neither Alice nor Bob
will have su5cient information to do the computation by themselves, so they will have
to communicate in order to achieve their goal. In this model, individual computation
is free, but communication is expensive and has to be minimized. How many bits do
they need to communicate between them in order to solve this? Clearly, Alice can just
send her complete input to Bob, but sometimes more e5cient schemes are possible.
This model was introduced by Yao [64] and has been studied extensively, both for its

∗ Corresponding author. Tel.: +1-5106439287; fax: +1-5106425775.

E-mail address: rdewolf@cs.berkeley.edu (R. de Wolf).
1 Supported by Talent grant S 62-565 from the Netherlands Organization for Scienti-c Research (NWO).

Most of this paper was written when the author was a Ph.D. student at CWI and the University of Amsterdam,
partially supported by the EU Fifth Framework project QAIP, IST-1999-11234.

0304-3975/02/$ - see front matter  c 2002 Published by Elsevier Science B.V.

PII: S 0 3 0 4 - 3 9 7 5 ( 0 2 ) 0 0 3 7 7 - 8
338 R. de Wolf / Theoretical Computer Science 287 (2002) 337 – 353

applications (like lower bounds on VLSI and circuits) and for its own sake. We refer
to [38,45] for de-nitions and results.
An interesting variant of the above is quantum communication complexity: suppose
that Alice and Bob each have a quantum computer at their disposal and are allowed to
exchange quantum bits (qubits) and=or to make use of the quantum correlations given
by shared EPR-pairs (entangled pairs of qubits named after Einstein, Podolsky, and
Rosen [31]). Can Alice and Bob now compute f with less communication than in the
classical case? Quantum communication complexity was -rst considered by Yao [65]
for the model with qubit communication and no prior EPR-pairs, and it was shown
later that for some problems the amount of communication required in the quantum
world is indeed considerably less than the amount of classical communication.
In this survey, we -rst give brief explanations of quantum computation and com-
munication, and then cover the main results of quantum communication complexity:
upper bounds (Section 5), lower bounds (Section 6), and applications (Section 7). We
include proofs of some of the central results and references to others. Some other
recent surveys of quantum communication complexity are [16,18,41,60], and a more
popular account can be found in [59]. Our survey diKers from these in being a bit
more extensive and up to date.

2. Quantum computation

In this section we brieLy give the relevant background from quantum computation,
referring to the book of Nielsen and Chuang [53] for more details.

2.1. States and operations

The classical unit of computation is a bit, which can take on the values 0 or 1. In
the quantum case, the unit of computation is a qubit, which is a linear combination or
superposition of the two classical values:
0 |0 + 1 |1:
More generally, an m-qubit state | is a superposition of all 2m diKerent classical
m-bit strings:


| = i |i:
i∈{0;1}m

The classical state |i is called a basis state. The coe5cient i is a complex number,
which is called the amplitude of |i. The amplitudes
form a 2m -dimensional complex
2
vector, which we require to have norm 1 (i.e. i |i | = 1). If some system is in
state | and some other is in state | , then their joint state is the tensor product
| ⊗ |  = || .
We can basically do two things to a quantum state: measure it or perform a unitary
operation to it. If we measure |, then we will see a basis state; we will see |i with
probability |i |2 . Because | has norm 1, the probabilities |i |2 sum to 1, as they
 R. de Wolf / Theoretical Computer Science 287 (2002) 337 – 353 339

should. A measurement “collapses” the measured state to the measurement outcome:

if we see |i, then | has collapsed to |i, and all other information in | is gone.
Apart from measuring, we can also transform the state, i.e., change the amplitudes.
Quantum mechanics stipulates that this transformation U must be a linear transforma-
tion on the 2m -dimensional vector of amplitudes:
   
0:::0 0:::0
   
U  ...  =  ...  :
1:::1 1:::1

Since the new vector of amplitudes i must also have norm 1, it follows that the
linear transformation U must be norm-preserving and hence unitary. 2 This in turn
implies that U has an inverse (in fact equal to its conjugate transpose U ∗ ), hence
non-measuring quantum operations are reversible.

2.2. Quantum algorithms

We describe quantum algorithms in the quantum circuit model [29,65], rather than
the somewhat more cumbersome quantum Turing machine model [14,28]. A classical
Boolean circuit is a directed acyclic graph of elementary Boolean gates (usually AND,
OR, and NOT), only acting on one or two bits at a time. It transforms an initial vector
of bits (containing the input) into the output. A quantum circuit is similar, except that
the classical Boolean gates now become elementary quantum gates. Such a gate is a
unitary transformation acting only on one or two qubits, and implicitly acting as the
identity on the other qubits of the state. A simple example of a 1-qubit gate is the
Hadamard transform, which maps basis state |b to √12 (|0 + (−1)b |1). In matrix
form, this is

1 1 1
H=√ :
2 1 −1
An example of a 2-qubit gate is the controlled-NOT (CNOT) gate, which negates the
second bit of the state depending on the -rst bit: |c; b → |c; b ⊕ c. In matrix form,
this is
 
1 0 0 0
0 1 0 0
C= 0 0 0 1:


0 0 1 0

It is known that the set of gates consisting of CNOT and all 1-qubit gates is universal,
meaning that any other unitary transformation can be written as a product of gates
from this set. We refer to [6,53] for more details.
2 Both quantum measurements and quantum operations allow for a somewhat more general description
than given here (POVMs and superoperators, respectively, see [53]), but the above de-nitions su5ce for
our purposes.
340 R. de Wolf / Theoretical Computer Science 287 (2002) 337 – 353

The product of all elementary gates in a quantum circuit is a big unitary transforma-
tion that transforms the initial state (usually a classical bitstring containing the input x)
into a -nal superposition. The output of the circuit is then the outcome of measuring
some dedicated part of the -nal state. We say that a quantum circuit computes some
function f: {0; 1}n → Z exactly if it always outputs the correct value f(x) on input x.
The circuit computes f with bounded error if it outputs f(x) with probability at least
2=3, for all x. Notice that a quantum circuit involves only one measurement; this is
without loss of generality, since it is known that measurements can always be pushed
to the end at the cost of a moderate amount of extra memory.
The complexity of a quantum circuit is usually measured by the number of ele-
mentary gates it contains. A circuit is deemed e8cient if its complexity is at most
polynomial in the length n of the input. The most spectacular instance of an e5cient
quantum circuit (rather, a uniform family of such circuits, one for each n) is still
Shor’s 1994 e5cient algorithm for -nding factors of large integers. It -nds a factor
of arbitrary n-bit numbers with high probability using only n2 polylog(n) elementary
gates. This compromises the security of modern public-key cryptographic systems like
RSA, which are based on the assumed hardness of factoring.

2.3. Query algorithms

A type of quantum algorithms that we will refer to later are the query algorithms.
In fact, most existing quantum algorithms are of this type. Here the input is not part
of the initial state, but encoded in a special “black box” quantum gate. The black box
maps basis state |i; b to |i; b ⊕ xi , thus giving access to the bits xi of the input. Note
that a quantum algorithm can run the black box on a superposition of basis states,
gaining access to several input bits xi at the same time. One such application of the
black box is called a query. The complexity of a quantum circuit for computing some
function f is now the number of queries we need on the worst-case input; we do
not count the complexity of other operations in this model. In the classical world, this
query complexity is known as the decision tree complexity of f.
A simple but illustrative example is the Deutsch–Jozsa algorithm [26,30]: suppose
that n is a power of 2, and we get the promise that the input x ∈ {0; 1}n is either 0 : : : 0
(“constant”) or has exactly n=2 0s and n=2 1s (“balanced”). De-ne DeJo(x) = 1 in the
-rst case and DeJo(x) = 0 in the second. It is easy to see that a deterministic classical
computer needs n=2 + 1 queries for this (if the computer has queried n=2 bits and they
are all 0, then the function value is still undetermined). On the other hand, here is a
1-query quantum algorithm for this problem:
(1) Start in a basis state |0 : : : 01 of log n zeroes followed by a 1.
(2) Apply a Hadamard transform to each of the log n + 1 qubits.
(3) Query the black box once.
(4) Apply a Hadamard transform to the -rst log n qubits.
(5) Measure the -rst log n qubits, output 1 if the observed state is |0 : : : 0 and output
0 otherwise.
By following the state through these steps, it may be veri-ed that the algorithm always
outputs 1 if the input x is constant, and 0 if it is balanced.
 R. de Wolf / Theoretical Computer Science 287 (2002) 337 – 353 341

Another important quantum query algorithm is Grover’s search algorithm [35], which
-nds an i such that xi = 1 if such√ an i exists in the n-bit input. It has error probability
61=3 on each input and uses O( n) queries, which is optimal [10,15,66]. Note that the
algorithm can also be viewed as computing the OR-function: it can determine whether
at least one of the input bits is 1.

3. Quantum communication

The area of quantum information theory deals with the properties of quantum infor-
mation and its communication between diKerent parties. We refer to [12,53] for general
surveys, and will here restrict ourselves to explaining two important primitives: tele-
portation [11] and superdense coding [13]. These pre-date quantum communication
complexity and show some of the power of quantum communication.
We -rst show how teleporting a qubit works. Alice has a qubit 0 |0 + 1 |1 that
she wants to send to Bob via a classical channel. Without further resources this would
be impossible, but Alice also shares an EPR-pair √12 (|00 + |11) with Bob. Initially,
their joint state is
1
(0 |0 + 1 |1) ⊗ √ (|00 + |11):
2
The -rst two qubits belong to Alice, the third to Bob. Alice performs a CNOT on her
two qubits and then a Hadamard transform on her -rst qubit. Their joint state can now
be written as
1
2 |00(0 |0 + 1 |1)
+ 12 |01(0 |1 + 1 |0)
+ 12 |10(0 |0 − 1 |1)
+ 12 |11 (0 |1 − 1 |0) :



Alice Bob

Alice then measures her two qubits and sends the result (two random classical bits) to
Bob, who now knows which transformation he must do on his qubit in order to regain
the qubit 0 |0 + 1 |1. For instance, if Alice sent 11 then Bob knows that his qubit
is 0 |1 − 1 |0. A bit-Lip (|b → |1 − b) followed by a phase-Lip (|b → (−1)b |b)
will give him Alice’s original qubit 0 |0 + 1 |1. In fact, if Alice’s qubit had been
entangled with other qubits, then teleportation preserves this entanglement: Bob then
receives a qubit that is entangled in the same way as Alice’s original qubit was.
Note that the qubit on Alice’s side has been destroyed: teleporting moves a qubit
from A to B, rather than copying it. In fact, copying an unknown qubit is impos-
sible [62], which can be seen as follows. Suppose C were a 1-qubit copier, i.e.
C||0 = || for every qubit |. In particular C|0|0 = |0|0 and C|1|0 = |1|1.
But then C would not copy | = √12 (|0 + |1) correctly, since by linearity C||0 =
√1 (C|0|0 + C|1|0) = √12 (|0|0 + |1|1) = ||.
2
342 R. de Wolf / Theoretical Computer Science 287 (2002) 337 – 353

In teleportation, Alice uses two classical bits and one EPR-pair to send 1 qubit to
Bob. Superdense coding achieves the opposite: using 1 qubit and one EPR-pair, Alice
can send two classical bits b1 ; b2 to Bob. It works as follows. Initially they share an
EPR-pair √12 (|00 + |11). First, if b1 = 1 then Alice applies a phase-Lip to her half
of the pair. Second, if b2 = 1 she applies a bit-Lip. Third, she sends her half of the
EPR-pair to Bob, who now has one of four states |b1 b2 :

|00  = √12 (|00 + |11);

|01  = √12 (|10 + |01);
|10  = √12 (|00 − |11);
|11  = √12 (|10 − |01):

Since these states are orthogonal, Bob can apply a unitary transformation that maps
|b1 b2  → |b1 b2  and thus learn b1 and b2 .
Suppose Alice wants to send n classical bits of information to Bob and they do not
share any prior entanglement. Alice can just send her n bits to Bob, but, alternatively,
Bob can also -rst send n=2 halves of EPR-pairs to Alice and then Alice can send n
bits in n=2 qubits using dense coding. In either case, n qubits are exchanged between
them. If Alice and Bob already share n=2 prior EPR-pairs, then n=2 qubits su5ce by
superdense coding. The following result shows that this is optimal. We will refer to it
as Holevo’s theorem, because the -rst part is an immediate consequence of a result of
[36] (the second part was derived in [27]).

Theorem 1 (Holevo [36]). If Alice wants to send n bits of information to Bob via a
qubit channel, and they do not share prior entanglement, then they have to exchange
at least n qubits. If they do share unlimited prior entanglement, then Alice has to
send at least n=2 qubits to Bob, no matter how many qubits Bob sends to Alice.

A somewhat stronger and more subtle variant of this lower bound was derived by
Nayak [48], improving upon [2]. Suppose that Alice does not want to send Bob all
of her n bits, but just wants to send a message that allows Bob to learn one of her
bits xi , where Bob can choose i after the message has been sent. Even for this weaker
form of communication, Alice has to send an (n)-qubit message.

4. Quantum communication complexity: the model

First we sketch the setting for classical communication complexity, referring to

[38,45] for more details. Alice and Bob want to compute some function f : D → {0; 1},
where D ⊆ X × Y . If the domain D equals X × Y then f is called a total function,
otherwise it is a promise function. Alice receives input x ∈X , Bob receives input y ∈Y ,
with (x; y) ∈D. As the value f(x; y) will generally depend on both x and y, some com-
munication between Alice and Bob is required in order for them to be able to compute
f(x; y). We are interested in the minimal amount of communication they need.
 R. de Wolf / Theoretical Computer Science 287 (2002) 337 – 353 343

A communication protocol is a distributed algorithm where -rst Alice does some

individual computation, and then sends a message (of one or more bits) to Bob, then
Bob does some computation and sends a message to Alice, etc. Each message is called
a round. After one or more rounds the protocol terminates and outputs some value,
which must be known to both players. The cost of a protocol is the total number of
bits communicated on the worst-case input. A deterministic protocol for f always has
to output the right value f(x; y) for all (x; y) ∈D. In a bounded-error protocol, Alice
and Bob may Lip coins and the protocol has to output the right value f(x; y) with
probability ¿2=3 for all (x; y) ∈D. We use D(f) and R2 (f) to denote the minimal
cost of deterministic and bounded-error protocols for f, respectively. The subscript ‘2’
in R2 (f) stands for two-sided bounded error. For R2 (f) we can either allow Alice and
Bob to toss coins individually (private coin) or jointly (public coin). This makes not
much diKerence: a public coin can save at most O(log n) bits of communication [50],
compared to a protocol with a private coin.
Some often studied total functions where X = Y = {0; 1}n :
• Equality: EQ(x; y) = 1 iK x = y.

• Inner product: IP(x; y) = PARITY(x ∧ y) = i xi yi (mod 2)
(for x; y ∈ {0; 1}n , xi is the ith bit of x and x ∧ y ∈ {0; 1}n is the bit-wise AND of
x and y).
• Disjointness: DISJ(x; y) = NOR(x ∧ y). This function is 1 iK there is no i where
xi = yi = 1 (viewing x and y as characteristic vectors of sets, the sets are disjoint).
It is known that D(EQ) = D(IP) = D(DISJ) = n + 1, R2 (IP) = R2 (DISJ) = (n). How-
ever, R2 (EQ) is only O(1), as follows. Alice and Bob jointly toss a random string
r ∈{0; 1}n . Alice sends the bit a = x · r to Bob (where ‘·’ is inner product mod 2). Bob
computes b = y · r and compares this with a. If x = y then a = b, but if x = y then
a = b with probability 1/2. Thus, Alice and Bob can decide equality with small error
using O(n) public coin Lips and O(1) communication. Since public coin and private
coin protocols are close, this also implies that R2 (EQ) ∈O(log n) with a private coin.
Now what happens if we give Alice and Bob a quantum computer and allow them
to send each other qubits and/or to make use of EPR-pairs that they share at the start
of the protocol? Formally speaking, we can model a quantum protocol as follows. The
total state consists of three parts: Alice’s private space, the channel, and Bob’s private
space. The starting state is |x|0|y: Alice gets x, the channel is initially empty, and
Bob gets y. Now Alice applies a unitary transformation to her space and the channel.
This corresponds to her private computation as well as to putting a message on the
channel (the length of this message is the number of channel-qubits aKected by Alice’s
operation). Then Bob applies a unitary transformation to his space and the channel,
etc. At the end of the protocol Alice or Bob makes a measurement to determine the
output of the protocol. We use Q(f) to denote the minimal communication cost of
a quantum protocol that computes f(x; y) exactly (= with error probability 0). This
model was introduced by Yao [65]. In the second model, introduced by Cleve and
Buhrman [25], Alice and Bob share an unlimited number of EPR-pairs at the start of
the protocol, but now they communicate via a classical channel: the channel has to be
in a classical state throughout the protocol. We use C ∗ (f) for the minimal complexity
of an exact protocol for f in this model. Note that we only count the communication,
344 R. de Wolf / Theoretical Computer Science 287 (2002) 337 – 353

not the number of EPR-pairs used. The third variant combines the strengths of the other
two: here Alice and Bob start out with an unlimited number of shared EPR-pairs and
they are allowed to communicate qubits. We use Q∗ (f) to denote the communication
complexity in this third model. By teleportation, one EPR-pair and two classical bits
can replace 1 qubit of communication, so we have Q∗ (f)6C ∗ (f)62Q∗ (f). Similarly
we de-ne Q2 (f), Q2∗ (f), and C2∗ (f) for bounded-error quantum protocols. Note that a
shared EPR-pair can simulate a public coin toss: if Alice and Bob each measure their
half of the pair, they get the same random bit.
Before continuing to study this model, we -rst have to face an important question:
is there anything to be gained here? At -rst sight, the following argument seems to
rule out any signi-cant gain. By de-nition, in the classical world D(f) bits have to be
communicated in order to compute f. Since Holevo’s theorem says that k qubits cannot
contain more information than k classical bits, it seems that the quantum communication
complexity should be roughly D(f) qubits as well (maybe D(f)=2 to account for
superdense coding, but not less). Fortunately and surprisingly, this argument is false,
and quantum communication can sometimes be much less than classical communication
complexity. The information-theoretic argument via Holevo’s theorem fails, because
Alice and Bob do not need to communicate the information in the D(f) bits of the
classical protocol; they are only interested in the value f(x; y), which is just 1 bit.
Below we will survey the main examples that have so far been found of gaps between
quantum and classical communication complexity.

5. Quantum communication complexity: upper bounds

5.1. Initial steps

Quantum communication complexity was introduced by Yao [65] and studied by

Kremer [44], but neither showed any advantages of quantum over classical communi-
cation. Cleve and Buhrman [25] introduced the variant with classical communication
and prior entanglement, and exhibited the -rst quantum protocol provably better than
any classical protocol. It uses quantum entanglement to save 1 bit of classical commu-
nication. This gap was extended by Buhrman et al. [19] and, for arbitrary k parties,
by Buhrman et al. [23].

5.2. Buhrman, Cleve, Wigderson

The -rst impressively large gaps between quantum and classical communication com-
plexity were exhibited by Buhrman et al. [21]. Their protocols are distributed versions
of known quantum query algorithms, like the Deutsch–Jozsa and Grover algorithms.
The following lemma shows how a query algorithm induces a communication protocol.

Lemma 1 (BCW [21]). Let g : {0; 1}n → {0; 1} and f(x; y) = g(x ? y), where ? is any
binary connective ( for instance ⊕ or ∧). If there is a T -query quantum algorithm
for g, then there is a protocol for f that communicates T (2 log n + 4) qubits (and
 R. de Wolf / Theoretical Computer Science 287 (2002) 337 – 353 345

uses no prior entanglement) and that has the same error probability as the query
algorithm.

Proof. The quantum protocol consists of Alice’s simulating the quantum query algo-
rithm A on input x ? y. Every query in A will correspond to two rounds of commu-
nication.

Namely, suppose Alice at some point wants to apply a query to the state
| = i; b ib |i; b (for simplicity we omit Alice’s workspace). Then she adds a |0-
qubit to the state, applies the unitary mapping |i; b; 0 → |i; b; xi , and sends the resulting
state to Bob. Bob now applies the unitary mapping |i; b; xi  → |i; b ⊕ (xi ? yi ); xi  and

Alice applies |i; b; xi  → |i; b; 0, takes oK the last qubit,
sends the result back to Alice.
and ends up with the state i; b ib |i; b ⊕ (xi ? yi ), which is exactly the result of apply-
ing an x ? y-query to |. Thus, every query to x ? y can be simulated using 2 log n+4
qubits of communication. The -nal quantum protocol will have T (2 log n + 4) qubits
of communication and computes f(x; y) with the same error probability as A has on
input x ? y.

Now consider the disjointness function: DISJ(x; y) √

= NOR(x ∧ y). Since Grover’s
algorithm can compute the NOR of n variables with O( n) queries with bounded-error,
√
the previous lemma implies a bounded error protocol for disjointness with O( n log n)
qubits. On the other hand, the linear lower bound for disjointness is a well-known
result of classical communication complexity [39,56]. Thus we obtain the following
near-quadratic separation:
√
Theorem 2 (BCW [21]). Q2 (DISJ)∈O( n log n) and R2 (DISJ) ∈(n).

HHyer
√ and de Wolf [37] slightly improved the upper bound on Q2 (DISJ) to
∗
O( nclog n ) for some constant c¿1, thus showing that the log n in the upper bound
can be replaced by a function that grows slower than any iterated logarithm.
Another separation is given by a distributed version of the Deutsch–Jozsa problem of
Section 2.3: de-ne EQ (x; y) = DeJo(x⊕y). This is a promise version of equality, where
the promise is that x and y are either equal or are at Hamming distance n=2. Since there
is an exact 1-query quantum algorithm for DeJo, Lemma 1 implies Q(EQ ) ∈O(log n).
In contrast, Buhrman et al. use a combinatorial result of Frankl and RUodl [33] to prove
the classical lower bound D(EQ )∈(n). Thus we have the following exponential
separation for exact protocols:

Theorem 3 (BCW [21]). Q(EQ )∈O(log n) and D(EQ ) ∈(n).

5.3. Raz

Notice the contrast between the two separations of the previous section. For the
Deutsch–Jozsa problem we get an exponential quantum-classical separation, but the
separation only holds if we force the classical protocol to be exact; it is easy to
see that O(log n) bits are su5cient if we allow some error (the classical protocol
can just try a few random positions i and check if xi = yi or not). On the other
hand, the gap for the disjointness function is only quadratic, but it holds even if we
346 R. de Wolf / Theoretical Computer Science 287 (2002) 337 – 353

allow classical protocols to have some error probability. Ran Raz [55] has exhibited a
function where the quantum-classical separation has both features: the quantum protocol
is exponentially better than the classical protocol, even if the latter is allowed some
error probability. Consider the following promise problem P:
Alice receives a unit vector v ∈Rm and a decomposition of the corresponding
space in two orthogonal subspaces H (0) and H (1) . Bob receives an m × m unitary
transformation U . Promise: Uv is either “close” to H (0) or to H (1) . Question:
which of the two?
As stated, this is a problem with continuous input, but it can be discretized in a natural
way by approximating each real number by O(log m) bits. Alice and Bob’s input is
now n = O(m2 log m) bits long. There is a simple yet e5cient two-round quantum
protocol for this problem: Alice views v as a log m-qubit vector and sends this to
Bob. Bob applies U and sends back the result. Alice then measures in which subspace
H (i) the vector Uv lies and outputs the resulting i. This takes only 2 log m = O(log n)
qubits of communication.
The e5ciency of this protocol comes from the fact that an m-dimensional vector can
be “compressed” or “represented” as a log m-qubit state. Similar compression is not
possible with classical bits, which suggests that any classical protocol for P will have to
send the vector v more or less literally and hence will require a lot of communication.
This turns out to be true but the proof (given in [55]) is surprisingly hard. The result
is the -rst exponential gap between Q2 and R2 :

Theorem 4 (Raz [55]). Q2 (P) ∈O(log n) and R2 (P) ∈(n1=4 = log n).

6. Quantum communication complexity: lower bounds

In the previous section we exhibited some of the power of quantum communication

complexity. Here we will look at its limitations, -rst for exact protocols and then for
the bounded-error case.

6.1. Lower bounds on exact protocols

Quite good lower bounds are known for exact quantum protocols for total functions.
For a total function f : X × Y → {0; 1} let Mf [x; y] = f(x; y) be the communication
matrix of f. This is an |X | × |Y | Boolean matrix that completely describes f. Let
rank(f) denote the rank of Mf over the reals. Mehlhorn and Schmidt [47] proved
that D(f)¿ log rank(f), which is the main source of lower bounds on D(f). For
Q(f) a similar lower bound follows from techniques of Yao and Kremer [44,65], as
-rst observed in [21]. This bound was later extended to the case where Alice and
Bob share unlimited prior entanglement by Buhrman and de Wolf [24]. Their result
turned out to be equivalent to a result in Nielsen’s thesis [52, Section 6.4.2]. The
result is:

Theorem 5. Q∗ (f)¿ 12 log rank(f) and C ∗ (f)¿ log rank(f).

 R. de Wolf / Theoretical Computer Science 287 (2002) 337 – 353 347

Hence quantum communication complexity in the exact model with prior entangle-
ment is maximal whenever Mf has full rank, which happens for almost all functions,
including equality, (the complement of) inner product, and disjointness. For Q(f), the
model without prior entanglement, the same bounds apply and it is open whether the
factor of 12 can be removed in this case. For the equality and disjointness functions,
the optimal bounds Q(EQ) = Q(DISJ) = n + 1 were shown recently by HHyer and de
Wolf [37].
How tight is the log rank(f) lower bound? It has been conjectured that D(f)6(log
rank(f))O(1) for all total functions, in which case log rank(f) would characterize D(f)
up to polynomial factors. If this log-rank conjecture is true, then Theorem 5 implies that
Q∗ (f) and D(f) are polynomially close for all total f, since then Q∗ (f)6D(f)6(log
rank(f))O(1) 6(2Q∗ (f))O(1) . Some small classes of functions where this provably holds
are identi-ed in [24]. It should be noted that, in fact, no total f is known where Q∗ (f)
is more than a factor of 2 smaller than D(f) (the factor of 2 can be achieved by
superdense coding).

6.2. Lower bounds on bounded-error protocols

The previous section showed some strong lower bounds for exact quantum protocols.
The situation is worse in the case of bounded-error protocols, for which only a few
good lower bounds are known. One of the few general lower bound techniques known
to hold for bounded-error quantum complexity (without prior entanglement) is the so-
called “discrepancy method”. This was shown by Kremer [44], who used it to derive
an (n) lower bound for Q2 (IP). Cleve et al. [27] later independently proved such a
lower bound for Q2∗ (IP).
We will sketch the very elegant proof of [27] here for the case of exact protocols.
The proof uses the IP-protocol to communicate Alice’s n-bit input to Bob, and then
invokes Holevo’s theorem to conclude that many qubits must have been communicated
in order to achieve this. Suppose Alice and Bob have some protocol for IP. They can
use this to compute the following mapping:

|x|y → |x(−1)x·y |y:

Now suppose Alice starts
with an arbitrary n-bit state |x and Bob starts with the
uniform superposition √12n y∈{0;1}n |y. If they apply the above mapping, the -nal
state becomes
1

|x √ (−1)x·y |y:
2n y∈{0;1}n

If Bob applies a Hadamard transform to each of his n qubits, then he obtains the basis
state |x, so Alice’s n classical bits have been communicated to Bob. Theorem 1 now
implies that the IP-protocol must communicate n=2 qubits, even if Alice and Bob share
unlimited prior entanglement. With some more technical complication, the same idea
gives an 12 (1 − 2()2 n lower bound for (-error protocols [27]. The constant factor in this
bound was recently improved to the optimal 12 by Nayak and Salzman [49].
348 R. de Wolf / Theoretical Computer Science 287 (2002) 337 – 353

The above proof works for IP, but does not easily yield good bounds in general.
Neither does the discrepancy method, or an approximate version of the rank lower
bound that was noted in [21]. New lower bound techniques for quantum communi- √
cation are required. Of particular interest is whether the upper bound of roughly n
on Q2 (DISJ) is tight. Because disjointness can be reduced to many other problems
(it is in fact “coNP-complete” [4]), a good lower bound for disjointness √ would im-
ply many other lower bounds as well. HHyer and de Wolf proved an ( n) lower
bound for a restricted class of protocols, namely those whose acceptance probability
is a function of x ∧ y, rather than x and y separately. All known quantum protocols
for disjointness fall in this class, but it is still rather limited. Klauck [42] extended
the classical Fourier analysis-based lower bound technique of Raz [54] to the quan-
tum case. The technique gives good lower bounds on Q2 (f) for threshold functions
(where f(x; y) = 1 iK |x ∧ y|¿t) with su5ciently large threshold t. Unfortunately,
it fails to give good bounds for the t = 1 case, which is exactly the complement of
disjointness.
Then, in a recent breakthrough, Razborov [57] established the expected lower bound,
using a clever multidimensional version of the discrepancy method:
√
Theorem 6 (Razborov [57]). Q2∗ (DISJ) = ( n).

Moreover, his lower bound method gives nearly optimal lower bounds on Q2∗ (f) for
all functions that are of the form f(x; y) = g(x ∧ y) for some g depending only on the
Hamming weight of its input.

7. Quantum communication complexity: applications

The main applications of classical communication complexity have been in proving

lower bounds for various models like VLSI, Boolean circuits, formula size, Turing
machine complexity, data structures, automata size, etc. We refer to [38,45] for many
examples. Typically one proceeds by showing that a communication complexity prob-
lem f is “embedded” in the computational problem P of interest, and then uses com-
munication complexity lower bounds on f to establish lower bounds on P. Similarly,
quantum communication complexity has been used to establish lower bounds in vari-
ous models of quantum computation, though such applications have received relatively
little attention so far. We will brieLy mention some.
Yao [65] initially introduced quantum communication complexity as a tool for prov-
ing a superlinear lower bound on the quantum formula size of the majority function (a
“formula” is a circuit of restricted form). More recently, Klauck [40] used one-round
quantum communication complexity lower bounds to prove lower bounds on the size
of quantum formulae.
Since upper bounds on query complexity give upper bounds on communication com-
plexity (Lemma 1), lower bounds on communication complexity give lower bounds on
query complexity. For instance, IP(x; y) = PARITY(x ∧ y), so the (n) bound for IP
(Section 6.2) implies an (n= log n) lower bound for the quantum query complexity
 R. de Wolf / Theoretical Computer Science 287 (2002) 337 – 353 349

of the parity function, as observed by Buhrman et al. [21]. This query lower bound
was later strengthened to n=2 in [7,32].
Furthermore, as in the classical case, lower bounds on one-round communication
complexity imply lower bounds on the size of quantum ?nite automata. This was
used by Klauck [40] to show that Las Vegas (zero-error) quantum -nite automata
cannot be much smaller than classical deterministic -nite automata.
Again, as in the classical case, lower bounds on quantum communication complexity
give rise to lower bounds on the size of certain quantum data structures. For exam-
ple, tradeoKs between size and access time for the “static predecessor” and “static
membership” problems were obtained recently by Sen and Venkatesh [58].
Finally, Ben-Or [9] has applied the lower bounds for IP in a new proof of the
security of quantum key distribution.

8. Other developments and open problems

Here we mention some other results in quantum communication complexity or related

models:
• Quantum sampling. For the sampling problem, Alice and Bob do not want to com-
pute some f(x; y), but instead want to sample an (x; y)-pair according to some
known joint probability distribution, using as little communication as possible. Am-
bainis et al. [3] give a tight algebraic characterization of quantum sampling complex-
ity, and exhibit an exponential gap between the quantum and classical communication
required for a sampling problem related to disjointness.
• Spooky communication. Referring to Einstein’s description of certain quantum ef-
fects as “spooky action at a distance” (“spukhafte Fernwirkungen”), Brassard et
al. [17] exhibit tasks that can be achieved in the quantum world with entangle-
ment and no communication whatsoever, but that would require communication
in the classical world. They also give upper and lower bounds on the amount of
classical communication needed to “simulate” EPR-pairs. Their results—and subse-
quent ones [46]—may be viewed as quantitative extensions of the famous Bell in-
equalities [8].
• Las Vegas protocols. In this survey we just considered two modes of computation:
exact and bounded-error. An intermediate type of protocols are zero-error or Las
Vegas protocols. These never output an incorrect answer, but may claim ignorance
with probability at most 1/2. Some quantum-classical separations for zero-error pro-
tocols may be found in [22,40].
• One-round communication. Suppose the communication consists of just one round:
Alice sends a message (depending on x) to Bob, who should then compute f(x; y).
Klauck [40] showed for all total functions that quantum one-round communication
is not signi-cantly better than classical one-round communication in the case of
exact or zero-error protocols. For the case of bounded-error protocols this is still
open.
• Quantum ?ngerprinting. The model of simultaneous message passing is even more
restricted than the one-round setting. Here there are three parties: Alice has x, Bob
350 R. de Wolf / Theoretical Computer Science 287 (2002) 337 – 353

has y, they do not share entanglement or randomness but they can each send one
message to a referee, who wants to determine f(x; y). Buhrman et al. [20] gave
an e5cient quantum protocol for the equality function in this model: Alice and
Bob send O(log n)-qubit “quantum -ngerprints” of their respective inputs to the
referee, who can then decide with high success
√ probability whether x = y. In contrast,
classically the equality function requires +( n) bits of communication in this model
[1,51,5].
• Rounds. In classical communication complexity it is well known that allowing Alice
and Bob k + 1 rounds of communication instead of k reduces the required com-
munication exponentially for some functions. An analogous result has been shown
for quantum communication by Klauck et al. [43], using a quantum version of the
classical “round elimination” technique. This technique has been further strengthened
by Sen and Venkatesh [58], giving for instance tight communication-rounds tradeoKs
for the “greater than” function.
• Non-deterministic communication complexity. A non-deterministic protocol has pos-
itive acceptance probability on input (x; y) iK f(x; y) = 1. Classically, the non-
deterministic communication complexity is characterized by the logarithm of the
cover number of the communication matrix Mf . The quantum non-deterministic
communication complexity has been shown equal to the logarithm of the rank of
a non-deterministic version of Mf [37,61]. There exist total functions where the
quantum non-deterministic complexity is exponentially smaller than the classical
one [61].
Finally, here is a list of interesting open problems in quantum communication com-
plexity:
• Very few interesting quantum protocols are known. For what other problems can
quantum mechanics save communication?
• Raz’s exponential gap only holds for a promise problem. Are R2 (f) and Q2∗ (f)
polynomially related for all total f? A similar question can be posed for the relation
between D(f) and Q∗ (f). As we showed in Section 6.1, a positive answer to this
last question would be implied by the classical log-rank conjecture.
• Does entanglement add much power to qubit communication? That is, what are the
biggest gaps between Q(f) and Q∗ (f), and between Q2 (f) and Q2∗ (f)? (We only
know Q2 (EQ)∈+(log n) and Q2∗ (EQ)∈O(1).)
• Classically, Yao [63] used the minimax theorem from game theory to show an
equivalence between deterministic protocols with a probability distribution on the
inputs, and bounded-error protocols. Is some relation like this true in the quantum
case as well? Some preliminary results on quantum versions of Yao’s result may be
found in [34].

Acknowledgements

Thanks to Andris Ambainis for pointing out a mistake in an earlier version of this
paper.
 R. de Wolf / Theoretical Computer Science 287 (2002) 337 – 353 351

References

[1] A. Ambainis, Communication complexity in a 3-computer model, Algorithmica 16 (3) (1996) 298–301.
[2] A. Ambainis, A. Nayak, A. Ta-Shma, U. Vazirani, Quantum dense coding and a lower bound for 1-way
quantum -nite automata, in: Proc. 31st ACM STOC, 1999, pp. 376 –383, quant-ph=9804043.
[3] A. Ambainis, L. Schulman, A. Ta-Shma, U. Vazirani, A. Wigderson, The quantum communication
complexity of sampling, in: Proc 39th IEEE FOCS, 1998, pp. 342–351.
[4] L. Babai, P. Frankl, J. Simon, Complexity classes in communication complexity theory, in: Proc. 27th
IEEE FOCS, 1986, pp. 337–347.
[5] L. Babai, P.G. Kimmel, Randomized simultaneous messages: solution of a problem of Yao in
communication complexity, in: Proc. 12th Annu. IEEE Conf. on Computational Complexity, 1997,
pp. 239 –246.
[6] A. Barenco, C.H. Bennett, R. Cleve, D.P. DiVincenzo, N. Margolus, P. Shor, T. Sleator, J. Smolin,
H. Weinfurter, Elementary gates for quantum computation, Phys. Rev. A 52 (1995) 3457–3467
quant-ph=9503016.
[7] R. Beals, H. Buhrman, R. Cleve, M. Mosca, R. de Wolf, Quantum lower bounds by polynomials, in:
Proc. 39th IEEE FOCS, 1998, pp. 352–361, quant-ph=9802049.
[8] J.S. Bell, On the Einstein–Podolsky–Rosen paradox, Physics 1 (1965) 195–200.
[9] M. Ben-Or, Security of quantum key distribution, Unpublished manuscript, 1999.
[10] C.H. Bennett, E. Bernstein, G. Brassard, U. Vazirani, Strengths and weaknesses of quantum computing,
SIAM J. Comput. 26 (5) (1997) 1510–1523 quant-ph=9701001.
[11] C. Bennett, G. Brassard, C. CrWepeau, R. Jozsa, A. Peres, W. Wootters, Teleporting an unknown quantum
state via dual classical and Einstein–Podolsky–Rosen channels, Phys. Rev. Lett. 70 (1993) 1895–1899.
[12] C.H. Bennett, P.W. Shor, Quantum information theory, IEEE Trans. Inform. Theory 44 (6) (1998)
2724–2742.
[13] C. Bennett, S. Wiesner, Communication via one- and two-particle operators on Einstein–Podolsky–Rosen
states, Phys. Rev. Lett. 69 (1992) 2881–2884.
[14] E. Bernstein, U. Vazirani, Quantum complexity theory, SIAM J. Comput. 26 (5) (1997) 1411–1473
(earlier version in STOC’93).
[15] M. Boyer, G. Brassard, P. HHyer, A. Tapp, Tight bounds on quantum searching, Fortschr. Phys.
46 (4 –5) (1998) 493–505 (earlier version in Physcomp’96, quant-ph=9605034).
[16] G. Brassard, Quantum communication complexity (a survey), 1 January 2001, quant-ph=0101005.
[17] G. Brassard, R. Cleve, A. Tapp, The cost of exactly simulating quantum entanglement with classical
communication, Phys. Rev. Lett. 83 (9) (1999) 1874–1877 quant-ph=9901035.
[18] H. Buhrman, Quantum computing and communication complexity, EATCS Bull. 70 (2000) 131–141.
[19] H. Buhrman, R. Cleve, W. van Dam, Quantum entanglement and communication complexity, SIAM
J. Comput. 30 (8) (2001) 1829–1841 quant-ph=9705033.
[20] H. Buhrman, R. Cleve, J. Watrous, R. de Wolf, Quantum -ngerprinting, Phys. Rev. Lett. 87(16) (2001),
quant-ph=0102001, article 167902.
[21] H. Buhrman, R. Cleve, A. Wigderson, Quantum vs. classical communication and computation, in: Proc.
30th ACM STOC, 1998, pp. 63– 68, quant-ph=9802040, article 052305.
[22] H. Buhrman, R. Cleve, R. de Wolf, Ch. Zalka, Bounds for small-error and zero-error quantum
algorithms, in: Proc. 40th IEEE FOCS, 1999, pp. 358–368, cs.CC=9904019.
[23] H. Buhrman, W. van Dam, P. HHyer, A. Tapp, Multiparty quantum communication complexity, Phys.
Rev. A 60 (4) (1999) 2737–2741 quant-ph=9710054.
[24] H. Buhrman, R. de Wolf, Communication complexity lower bounds by polynomials, in: Proc. 16th
IEEE Conf. on Computational Complexity, 2001, pp. 120 –130, cs.CC=9910010.
[25] R. Cleve, H. Buhrman, Substituting quantum entanglement for communication, Phys. Rev. A 56 (2)
(1997) 1201–1204 quant-ph=9704026.
[26] R. Cleve, A. Ekert, C. Macchiavello, M. Mosca, Quantum algorithms revisited, in: Proc. Roy. Soc.
London, A 454 (1998) 339 –354, quant-ph=9708016.
[27] R. Cleve, W. van Dam, M. Nielsen, A. Tapp, Quantum entanglement and the communication complexity
of the inner product function, in: C.P. Williams (Ed.), Proc. 1st NASA QCQC Conf., Lecture Notes in
Computer Science, Vol. 1509, Springer, Berlin, 1998, pp. 61–74, quant-ph=9708019.
352 R. de Wolf / Theoretical Computer Science 287 (2002) 337 – 353

[28] D. Deutsch, Quantum theory, the Church-Turing principle, and the universal quantum Turing machine,
in: Proc. Roy. Soc. London, A 400 (1985) 97–117.
[29] D. Deutsch, Quantum computational networks, in: Proc. Roy. Soc. London, A 425 (1989) 73–90.
[30] D. Deutsch, R. Jozsa, Rapid solution of problems by quantum computation, in: Proc. Roy. Soc. London,
A 439 (1992) 553–558.
[31] A. Einstein, B. Podolsky, N. Rosen, Can quantum-mechanical description of physical reality be
considered complete? Phys. Rev. 47 (1935) 777–780.
[32] E. Farhi, J. Goldstone, S. Gutmann, M. Sipser, A limit on the speed of quantum computation in
determining parity, Phys. Rev. Lett. 81 (1998) 5442–5444 quant-ph=9802045.
[33] P. Frankl, V. RUodl, Forbidden intersections, Trans. Amer. Math. Soc. 300 (1) (1987) 259–286.
[34] M. de Graaf, R. de Wolf, On quantum versions of the Yao principle, in: H. Alt, A. Ferreira (Eds.),
Proc. 19th STACS, Lecture Notes in Computer Science, Vol. 2285, Springer, Berlin, 2002, pp. 347–358,
quant-ph=0109070.
[35] L.K. Grover, A fast quantum mechanical algorithm for database search, in: Proc. 28th ACM STOC,
1996, pp. 212–219, quant-ph=9605043.
[36] A.S. Holevo, Bounds for the quantity of information transmitted by a quantum communication channel,
Problemy Peredachi Informatsii, 9(3) (1973) 3–11 (english translation in Problems Inform. Transmission
9 (1973) 177–183).
[37] P. HHyer, R. de Wolf, Improved quantum communication complexity bounds for disjointness and
equality, in: H. Alt, A. Ferreira (Eds.), Proc. 19th STACS, Lecture Notes in Computer Science, Vol.
2285, Springer, Berlin, 2002, pp. 299 –310, quant-ph=0109068.
[38] J. HromkoviYc, Communication Complexity and Parallel Computing, Springer, Berlin, 1997.
[39] B. Kalyanasundaram, G. Schnitger, The probabilistic communication complexity of set intersection,
SIAM J. Discrete Math. 5 (4) (1992) 545–557 (earlier version in Structures’87).
[40] H. Klauck, On quantum and probabilistic communication: Las Vegas and one-way protocols, in: Proc.
32nd ACM STOC, 2000, pp. 644 – 651.
[41] H. Klauck, Quantum communication complexity, in: Proc. Workshop on Boolean Functions and
Applications at 27th ICALP, 2000, pp. 241–252, quant-ph=0005032.
[42] H. Klauck, Lower bounds for quantum communication complexity, in: Proc. 42nd IEEE FOCS, 2001,
pp. 288–297, quant-ph=0106160.
[43] H. Klauck, A. Nayak, A. Ta-Shma, D. Zuckerman, Interaction in quantum communication and the
complexity of set disjointness, in: Proc. 33rd ACM STOC, 2001, pp. 124 –133.
[44] I. Kremer, Quantum communication, Master’s Thesis, Computer Science Department, Hebrew
University, 1995.
[45] E. Kushilevitz, N. Nisan, Communication Complexity, Cambridge University Press, Cambridge, 1997.
[46] S. Massar, D. Bacon, N. Cerf, R. Cleve, Classical simulation of quantum entanglement without local
hidden variables, Phys. Rev. A 63 (5) (2001) quant-ph=0009088.
[47] K. Mehlhorn, E. Schmidt, Las Vegas is better than determinism in VLSI and distributed computing, in:
Proc. 14th ACM STOC, 1982, pp. 330 –337.
[48] A. Nayak, Optimal lower bounds for quantum automata and random access codes, in: Proc. 40th IEEE
FOCS, 1999, pp. 369 –376, quant-ph=9904093.
[49] A. Nayak, J. Salzman, On communication over an entanglement-assisted quantum channel, in: Proc.
34th ACM STOC, 2002.
[50] I. Newman, Private vs. common random bits in communication complexity, Inform. Process. Lett.
39 (2) (1991) 67–71.
[51] I. Newman, M. Szegedy, Public vs. private coin Lips in one round communication games, in: Proc.
28th ACM STOC, 1996, pp. 561–570.
[52] M.A. Nielsen, Quantum information theory, Ph.D. Thesis, University of New Mexico, Albuquerque,
1998, quant-ph=0011036.
[53] M.A. Nielsen, I.L. Chuang, Quantum Computation and Quantum Information, Cambridge University
Press, Cambridge, 2000.
[54] R. Raz, Fourier analysis for probabilistic communication complexity, Computational Complexity 5 (3=4)
(1995) 205–221.
 R. de Wolf / Theoretical Computer Science 287 (2002) 337 – 353 353

[55] R. Raz, Exponential separation of quantum and classical communication complexity, in: Proc. 31st ACM
STOC, 1999, pp. 358–367.
[56] A. Razborov, On the distributional complexity of disjointness, Theoret. Comput. Sci. 106 (2) (1992)
385–390.
[57] A. Razborov, Quantum communication complexity of symmetric predicates, 4 April 2002,
quant-ph=0204025.
[58] P. Sen, S. Venkatesh, Lower bounds in the quantum cell probe model, in: F. Orejas, P.G. Spirakis,
J. van Leeuwen (Eds.), Proc. 28th ICALP, Lecture Notes in Computer Science, Vol. 2076, Springer,
Berlin, 2001, pp. 358–369 (more extensive version at quant-ph=0104100).
[59] A. Steane, W. van Dam, Physicists triumph at Guess my Number, Phys. Today 59 (2000) 35 –39.
[60] A. Ta-Shma, Classical versus quantum communication complexity, ACM SIGACT News 30
(Complexity Column 23) (1999) 25 –34.
[61] R. de Wolf, Characterization of non-deterministic quantum query and quantum communication
complexity, in: Proc. 15th IEEE Conf. on Computational Complexity, 2000, pp. 271–278,
cs.CC=0001014.
[62] W.K. Wootters, W.H. Zurek, A single quantum cannot be copied, Nature 299 (1982) 802–803.
[63] A.C.-C. Yao, Probabilistic computations: toward a uni-ed measure of complexity, in: Proc. 18th IEEE
FOCS, 1977, pp. 222–227.
[64] A.C.-C. Yao, Some complexity questions related to distributive computing, in: Proc. 11th ACM STOC,
1979, pp. 209 –213.
[65] A.C.-C. Yao, Quantum circuit complexity, in: Proc. 34th IEEE FOCS, 1993, pp. 352–360.
[66] Ch. Zalka, Grover’s quantum searching algorithm is optimal, Phys. Rev. A 60 (1999) 2746–2751
quant-ph=9711070.