CSE 599d - Quantum Computing

The Recursive and Nonrecursive Bernstein-Vazirani Algorithm

Dave Bacon
Department of Computer Science & Engineering, University of Washington

We have seen in the Deutsch-Jozsa problem that a quantum computer could be used to solve a problem in a single
query which required an exponential number of queries on a classical computer in an exact model where no probability
of failure was allowed. However, when we allowed a bounded error in our algorithm, then this advantage disappeared.
After Deutsch and Jozsa introduced this problem, Bernstein and Vazirani took a deep look at quantum computers and
produced a problem which showed a superpolynomial separation between quantum and classical query complexity.
While Deutsch and Jozsa’s problem gave us tantalizing hints that there would be a difference between quantum and
classical query complexity, Bernstein and Vazirani made this hint real and showed, for the first time, that quantum
computers could do things that their classical brethren could not!
The Bernstein-Vazirani paper is also important for many other reasons, among them showing that the notion of
accuracy we used in our discussions of universal quantum computer adds and showing that bounded error quantum
computing is in the complexity class PSPACE. But we will focus on the query complexity results of this important
paper.

I. NONRECURSIVE BERNSTEIN-VAZIRANI ALGORITHM

In the Bernstein-Vazirani problem, we are given a n bit function f : {0, 1}n → {0, 1} which outputs a single
bit. This function is guaranteed to be of the form fs (x) = x · s where s is an unknown n bit string and x · s =
x1 s1 + x2 s2 + · · · + xn sn mod 2. The goal of the Bernstein-Vazirani problem is to find the unknown string s.
What is the classical query complexity of this problem? First suppose we are working in the exact query complexity
model. Then a single query to the function can retrieve at most one bit of information about s (because f outputs
only one bit.) Thus the exact query complexity must be at least n. In fact we can easily see that there is an algorithm
which does in exactly n queries by querying with bitstrings which have the ith 1 and the other digits 0: this reveals
the values of si .
What about if we allow bounded error? Here again we can use the fact that the function only outputs a single bit.
Suppose that we could query this function in a probabilistic fashion and learn all of the bits of s in less that n bits
with some probability of failure that is bounded below 1/2. Then we would be able to use this function to compress an
n bit string into less than n bits and use this to communicate these n bits, with high probability, through a channel.
If we use the rigorous definition of information, we then essentially obtain that a bounded error algorithm will also
need Ω(n) queries. Another way to prove this is to use Yao principle. We’ll talk about this approach later.
What about a quantum algorithm for the Bersntein-Vazirani problem. We implement the function in our traditional
reversible logic way, i.e. we have a quantum oracle which implements the unitary gate
X X
Us = |xihx| ⊗ |y ⊕ (s · x)ihy|. (1)
x∈{0,1}n y∈{0,1}

How do we use this oracle to find s with less than n queries of this gate? First note that using the phase kickback
trick and inputing a superposition over all possible input bit strings (just like we did in the Deutsch-Jozsa algorithm),
we can create the state
1 X 1 X
|ψs i = √ (−1)fs (x) |xi = √ (−1)x·s |xi (2)
2n x∈{0,1}n 2n x∈{0,1}n

What is special about these states? They are all orthogonal! Let’s show this:
1 X X 1 X
hψs |ψt i = (−1)x·s hx| (−1)y·t |yi = (−1)x·s+y·t hx|yi
2n 2n
x∈{0,1}n y∈{0,1}n x,y∈{0,1}n
1 X 1 X
= (−1)x·s+y·t δx,y = (−1)x·s+x·t (3)
2n 2n
x,y∈{0,1}n x∈{0,1}n
 2

Now (−1)x·s+x·t = (−1)x·s+x·t mod 2 and x·s+x·t mod 2 = x1 s1 +· · · xn sn +x1 t1 +· · ·+xn tn mod 2 = x·(s+t) mod 2
where (s + t) is the bitwise addition of the two strings modulo 2. Thus we find that
1 X
hψs |ψt i = (−1)x·(s+t) (4)
2n
x∈{0,1}n

Now consider the sum for fixed k,

X X
(−1)x·k = (−1)x1 k1 (−1)x2 k2 · · · (−1)xn kn
x∈{0,1}n x∈{0,1}n
    
X X X
=  (−1)x1 k1   (−1)x2 k2  · · ·  (−1)xn kn 
x1 ∈{0,1} x2 ∈{0,1} xn ∈{0,1}

= 2δk1 ,0 2δk2 ,0 . . . 2δkn ,0 = 2n δk,0 (5)

This implies that hψs |ψt i = δ(s+t),0 , or, since this addition is done bitwise modulo 2,

hψs |ψt i = δs,t (6)

In other words these states are orthogonal.

Now what does this mean for the possibility of a quantum algorithm? Well an orthonormal set of vectors forms
a basis and we can “measure in this basis.” This amounts to performing a unitary and then measuring in the
computational basis, from which we should be able to extract the string s. What is this transform? Well you’ve
already seen it. It is the n qubit Hadamard transform:
1 X
H ⊗n = √ (−1)x·y |yihx| (7)
2n x,y∈{0,1}n

Notice that we can express this as

X
H ⊗n = |yihψy | (8)
y∈{0,1}n

Lets apply H ⊗n to |ψs i:

X
H ⊗n |ψs i = |yihψy |ψs i (9)
y∈{0,1}n

which is equal to

H ⊗n |ψs i = |si (10)

by using the orthogonality of the |ψs i states.

Thus we have found an algorithm for identifying s using a single quantum query. The circuit to do this is exactly
the same circuit as in the Deutsch-Jozsa problem.

FE
|0i H H (11)

FE
|0i H H
.. Us ..
. .

FE
|0i H H

|1i H

With certainty the outcome of the measurements will be the bits of the string s.
 3

II. RECURSIVE BERNSTEIN-VAZIRANI ALGORITHM

In the Bernstein-Vazirani (nonrecursive version) we have a separation between the bounded error classical model,
which requires Ω(n) queries, and the quantum model which can be solved using only one query (and is exact.) Now this
is nice, but the problem Bernstein and Vazirani consider is classically tractable. By this we mean that the hardness of
the classical problem scales only polynomial in the problem size. What we’d really like to see is a separation between a
problem which is classically intractable, but which can be solved on a quantum computer using polynomial resources.
The interest in the Bernstein-Vazirani algorithm we described above (the nonrecursive version) is that Bernstein and
Vazirani where able to bootstrap it into a new problem, the recursive Bernstein-Vazirani problem where just such a
separation is possible. Here we will discuss this algorithm.
In the nonrecursive Bernstein-Vazirani problem, we were given access to a function fs (x) = s · x and our goal
was to find s. The first thing we do in constructing the recursive Bernstein-Vazirani problem is to modify this
problem slightly. Instead of requiring that we find the unknown s, we instead require that we find some function
g : {0, 1}n → {0, 1} on s, g(s). This function should be easy to compute, but also represent a “hard-core” bit of s.
An example and one which we will use throughout our discussion is gmod3 (x) which is equal to 0 if |x| mod 3 = 0 and
is 1 otherwise and |x| is the Hamming weight of x (the number of ones in the bitstring.) Notice that at this point we
are still querying the function fs (x) = x · s, but we now require that instead of answering s, we answer g(s).
Now let’s show how to perform the first level of recursion for the Bernstein-Vazirani problem. For me it is easiest
to describe the oracle we are querying first (I’m a hands on type of person.) The oracle is now two n strings, lets
call them x ∈ {0, 1}n and y ∈ {0, 1}n . The function we are querying takes this input and outputs sx · y, i.e. the
function is f : {0, 1}n × {0, 1}n → {0, 1} and is given by f (x, y) = sx · y. Now what is sx here? Well the sx are just
2n different bit strings, labelled by x ∈ {0, 1}n . But they have one important property. When we compute g(sx ) then
we require that these 2n bits satisfy g(sx ) = x · s for some unknown s. The two level Bernstein-Vazirani problem is
then to identify g(s).
Lets try to think about why this problem is harder than the nonrecursive Bernstein-Vazirani problem. When we
query f (x, y) we get output sx · y. Now we already know that it will take some work to identify some sx from this
input for a fixed x (because this is the original nonrecursive problem.) But then even when we find sx for some fixed
x, we can use it to calculate g(sx ). But now these g(sx )s themselves for different values of x are part of a nonrecursive
Bernstein-Vazirani problem! So you can see that by recursing this way the problem seems to get harder.
We can recurse the Bernstein-Vazirani problem in this manner k times. It is again useful to have in mind exactly
what the function we are querying computes. At the kth level the function takes as input k n bit strings, xi and
computes f (x1 , x2 , . . . , xk ) = xk · sx1 ,x2 ,...,xk−1 . The important part now is the secret string sx1 ,x2 ,...,xk−1 ∈ {0, 1}n .
This secret string is guaranteed to produce another lower level problem: g(sx1 ,x2 ,...,xk−1 ) = xk−1 · sx1 ,x2 ,...,xk−2 where
sx1 ,x2 ,...,xk−2 ∈ {0, 1}n . This continues all the way down: g(sx1 ,x2 ,...,xj ) = xj · sx1 ,x2 ,...,xj−1 . At the final level, we will
have g(sx1 ) = s · x1 . Our goal is to find g(s).
Now what is the classical query complexity of this problem? Well by querying f (x1 , x2 , . . . , xk ) it will take us n
times to identify sx1 ,x2 ,...,xk−1 . But then we will need to compute g of these secret strings another n times to find
sx1 ,x2 ,...,xk−2 Continuing onward we see that the query complexity classically must be at least Ω(nk ).
How do we solve this problem on a quantum computer? Well lets think about the level two problem. We are given
access to a unitary which computes, in our standard reversible manner, f (x1 , x2 ) = sx1 · x2 . Certainly using the
recursive Bernstein-Vazirani problem we can use this to find sx1 for a fixed sx1 . But the tricky part of the recursive
Bernstein-Vazirani problem is that when we take these sx1 s and apply g to them we get a new Bernstein-Vazirani
problem. Somehow we need to solve this new problem. This implies that we somehow have to use the quantum
Bernstein-Vazirani problem over all x1 s as well.
Let’s take a stab at how we might want to do this. The level two Bernstein-Vazirani oracle is
X X
U= |x1 ihx1 | ⊗ |x2 ihx2 | ⊗ |y ⊕ (sx1 · x2 )ihy| (12)
x1 ,x2 ∈{0,1}n y∈{0,1}

Suppose that we use the phase kickback trick on the y register and input a superposition over all possible bitstrings
on the x1 and x2 registers. Then this produces that state
1 X
(−1)sx1 ·x2 |x1 i ⊗ |x2 i ⊗ |−i (13)
2n n
x1 ,x2 ∈{0,1}

Now if we perform the n qubit Hadamard on the second register, we see that it will transform this state to
1 X
√ |x1 i ⊗ |sx1 i ⊗ |−i. (14)
n
2 x ∈{0,1}n
1
 4

But this is rather problematic. We know that applying g to sx1 makes a new Bernstein-Vazirani problem. It is always
possible to implement g in the reversible manner we’ve described previously. This means that we have access to a
circuit which corresponds to the unitary
X X
G= |xihx| ⊗ |g(x)i ⊕ yihy| (15)
x∈{0,1}n y∈{0,1}

If we attach an extra ancilla qubit in the state |0i, this means that we could use this unitary to turn our state into
1 X
√ |x1 i ⊗ |sx1 i ⊗ |−i ⊗ |g(sx1 )i. (16)
n
2 x ∈{0,1}n
1

But now look what’s happened. We know that g(sx1 ) is a new Bernstein-Vazirani problem. But certainly if we are
going to solve this new problem quantum mechanically needed to use the phase kickback trick, i.e. input |−i into the
ancilla instead of |0i. If we do this, then the state is
1 X
√ (−1)g(x1 ) |x1 i ⊗ |sx1 i ⊗ |−i ⊗ |−i. (17)
2n x ∈{0,1}n
1

But now something goes horribly wrong. We’d like to apply the n qubit Hadamard to this state to find the hidden
string s (because g(x1 ) = s · x1 ). But this doesn’t work! Why? Because of the |sx1 i terms. These terms make it so
that the different terms in the first register can’t interfere properly to extract out s! Doh!
So what do we do? Well we get tricky, of course. What we do is we apply the n qubit Hadamard to the second
register and then we apply our oracle U again. What does this do? Well H ⊗n turns our state into
1 X
(−1)g(x1 ) (−1)sx1 ·x2 |x1 i ⊗ |x2 i ⊗ |−i ⊗ |−i. (18)
2n n
x1 ,x2 ∈{0,1}

But then applying U does another phase kickback and results in

1 X 1 X
n
(−1)g(x1 ) (−1)sx1 ·x2 (−1)sx1 ·x2 |x1 i ⊗ |x2 i ⊗ |−i ⊗ |−i = n (−1)g(x1 ) |x1 i ⊗ |ψi ⊗ |−i ⊗ |−i. (19)
2 n
2 x
x1 ,x2 ∈{0,1} 1

where |ψi = √12n x2 ∈{0,1}n |x2 i. Thus we see that we have uncomputed the register sx1 which was causing us trouble.
P

Now if we apply the n qubit Hadamard to the first register, and measure in the computational basis, we will obtain s!
Here is the circuit for the two level Bernstein-Vazirani problem:

FE
|0i H ⊗n H ⊗n (20)

|0i H ⊗n U H ⊗n H ⊗n U

|1i H G

|1i H
Note that the first two wires on n qubit quantum wires and the G gate acts between the second wire and the fourth
wire.
So we’ve seen how to solve the level two Bernstein-Vazirani problem. The same tricks we played to do this can be
used to solve the k level Bernstein-Vazirani problem. How many uses of U will this require? Well for each level of
recursion we will need two uses of the gadget which solves the lower level problem. This means that if we are trying
to solve the k level problem, then we can solve the problem use O(2k ) queries quantum mechanically.
So now we see how Bernstein and Vazirani showed a superpolynomial separation. If we set k = log(n) (we will take
logarithms in this course in base 2), then our quantum algorithm takes only O(n) queries, while the classical problem
requires Ω(nlog n ) queries. But nlog n grows faster than any polynomial. Thus there is a superpolynomial separation
between the quantum and classical query complexities!
Oftentimes the recursive Bernstein-Vazirani problem is just passed over in a history of quantum computings and
never discussed in much detail. This is a shame because it is a beautiful result and was the first really solid evidence
that quantum computers might challenge the classical complexity of algorithms. There are also some interesting
properties of this problem which make it not fit in with the other problems we will encounter later on. For those of
you in the know, one interesting point about the Bernstein-Vazirani problem is that it is not known to be in NP!
 5

Acknowledgments

The diagrams in these notes were typeset using Q-circuit a latex utility written by graduate student extraordinaires
Steve Flammia and Bryan Eastin.