Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical...
Transcript of Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical...
![Page 1: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/1.jpg)
Quantum algorithm for a generalized hidden shift problem
Andrew ChildsCaltech
Wim van DamUC Santa Barbara
![Page 2: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/2.jpg)
What is the power of quantum computers?
• Manin/Feynman, early 1980s: Simulating quantum systems• Deutsch 1985, Deutsch-Jozsa 1992, Bernstein-Vazirani 1993, Simon 1994: Black box problems• Shor 1994: Factoring, discrete logarithm• Many authors, late 1990s–Present: Some nonabelian hidden subgroup problems• Freedman-Kitaev-Larsen 2000: Approximating Jones polynomial• Hallgren 2002: Pell’s equation• van Dam-Hallgren-Ip 2002: Some hidden shift problems (e.g., shifted Legendre symbol)• van Dam-Seroussi 2002: Estimating Gauss/Jacobi sums• Childs, Cleve, Deotto, Farhi, Gutmann, Spielman 2003: Black box graph traversal• van Dam 2004, Kedlaya 2004: Approximately counting solutions of polynomial equations• Hallgren 2005, Schmidt-Vollmer 2005: Finding unit/class groups of number fields
Quantum mechanical computers can efficiently solve problems that classical computers (apparently) cannot.
![Page 3: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/3.jpg)
What is the power of quantum computers?
• Manin/Feynman, early 1980s: Simulating quantum systems• Deutsch 1985, Deutsch-Jozsa 1992, Bernstein-Vazirani 1993, Simon 1994: Black box problems• Shor 1994: Factoring, discrete logarithm• Many authors, late 1990s–Present: Some nonabelian hidden subgroup problems• Freedman-Kitaev-Larsen 2000: Approximating Jones polynomial• Hallgren 2002: Pell’s equation• van Dam-Hallgren-Ip 2002: Some hidden shift problems (e.g., shifted Legendre symbol)• van Dam-Seroussi 2002: Estimating Gauss/Jacobi sums• Childs, Cleve, Deotto, Farhi, Gutmann, Spielman 2003: Black box graph traversal• van Dam 2004, Kedlaya 2004: Approximately counting solutions of polynomial equations• Hallgren 2005, Schmidt-Vollmer 2005: Finding unit/class groups of number fields
Questions:
Quantum mechanical computers can efficiently solve problems that classical computers (apparently) cannot.
![Page 4: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/4.jpg)
What is the power of quantum computers?
• Manin/Feynman, early 1980s: Simulating quantum systems• Deutsch 1985, Deutsch-Jozsa 1992, Bernstein-Vazirani 1993, Simon 1994: Black box problems• Shor 1994: Factoring, discrete logarithm• Many authors, late 1990s–Present: Some nonabelian hidden subgroup problems• Freedman-Kitaev-Larsen 2000: Approximating Jones polynomial• Hallgren 2002: Pell’s equation• van Dam-Hallgren-Ip 2002: Some hidden shift problems (e.g., shifted Legendre symbol)• van Dam-Seroussi 2002: Estimating Gauss/Jacobi sums• Childs, Cleve, Deotto, Farhi, Gutmann, Spielman 2003: Black box graph traversal• van Dam 2004, Kedlaya 2004: Approximately counting solutions of polynomial equations• Hallgren 2005, Schmidt-Vollmer 2005: Finding unit/class groups of number fields
Questions:
• What is the computational power of quantum mechanics?
Quantum mechanical computers can efficiently solve problems that classical computers (apparently) cannot.
![Page 5: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/5.jpg)
What is the power of quantum computers?
• Manin/Feynman, early 1980s: Simulating quantum systems• Deutsch 1985, Deutsch-Jozsa 1992, Bernstein-Vazirani 1993, Simon 1994: Black box problems• Shor 1994: Factoring, discrete logarithm• Many authors, late 1990s–Present: Some nonabelian hidden subgroup problems• Freedman-Kitaev-Larsen 2000: Approximating Jones polynomial• Hallgren 2002: Pell’s equation• van Dam-Hallgren-Ip 2002: Some hidden shift problems (e.g., shifted Legendre symbol)• van Dam-Seroussi 2002: Estimating Gauss/Jacobi sums• Childs, Cleve, Deotto, Farhi, Gutmann, Spielman 2003: Black box graph traversal• van Dam 2004, Kedlaya 2004: Approximately counting solutions of polynomial equations• Hallgren 2005, Schmidt-Vollmer 2005: Finding unit/class groups of number fields
Questions:
• What is the computational power of quantum mechanics?
• Is public-key cryptography possible in a quantum world?Shor’s algorithm breaks RSA, elliptic curve cryptosystems, Diffie-Hellman key exchange, etc.What about, e.g., lattice cryptosystems?
Quantum mechanical computers can efficiently solve problems that classical computers (apparently) cannot.
![Page 6: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/6.jpg)
Generalized hidden shift problem
Example. N = 7, M = 3, s = 2x=0 1 2 3 4 5 6
b=0
1
2
Given:
Satisfying:
f(b, x) : {0, 1, . . . ,M ! 1}" ZN # S
injective
Find: s (the hidden shift)
f(b + 1, x + s) = f(b, x)f(0, x)
M = 2 (hardest), ... , N (easiest)
![Page 7: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/7.jpg)
Classical complexity
Claim. To determine s, a classical, randomized algorithm must make exponentially many queries (in log N) to f.
![Page 8: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/8.jpg)
Classical complexity
Claim. To determine s, a classical, randomized algorithm must make exponentially many queries (in log N) to f.
Proof idea:• Since the function values are arbitrary, they are not
informative until we find two inputs that give the same output.
• The probability of seeing such a collision is very small unless (birthday problem). Hence queries are needed.
!(!
N)# queries !!
N
![Page 9: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/9.jpg)
Classical complexity
Note: This holds independent of how big M is.
Claim. To determine s, a classical, randomized algorithm must make exponentially many queries (in log N) to f.
Proof idea:• Since the function values are arbitrary, they are not
informative until we find two inputs that give the same output.
• The probability of seeing such a collision is very small unless (birthday problem). Hence queries are needed.
!(!
N)# queries !!
N
![Page 10: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/10.jpg)
Quantum query complexity
![Page 11: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/11.jpg)
Quantum query complexity
Query f in superposition:
![Page 12: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/12.jpg)
Quantum query complexity
Query f in superposition:
Measure function value: obtain (with equal probability)
or or or. . .
![Page 13: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/13.jpg)
Quantum query complexity
Query f in superposition:
The quantum states for different values of s are far apart, so they can be distinguished using only a few copies (k ≤ poly(log N), again independent of M).
Measure function value: obtain (with equal probability)
or or or. . .
![Page 14: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/14.jpg)
Main question: Can we do it in poly(log N) time?
Quantum query complexity
Query f in superposition:
The quantum states for different values of s are far apart, so they can be distinguished using only a few copies (k ≤ poly(log N), again independent of M).
Measure function value: obtain (with equal probability)
or or or. . .
![Page 15: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/15.jpg)
M=N: An abelian hidden subgroup problem
Easiest hidden shift problem:
![Page 16: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/16.jpg)
M=N: An abelian hidden subgroup problem
This is an instance of the hidden subgroup problem in the abelian group . Shor’s algorithm (“Fourier transform and measure”) finds s efficiently.
G = ZN ! ZN
Easiest hidden shift problem:
![Page 17: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/17.jpg)
M=N: An abelian hidden subgroup problem
The same approach works for any M ≥ N/poly(log N), but not smaller!
This is an instance of the hidden subgroup problem in the abelian group . Shor’s algorithm (“Fourier transform and measure”) finds s efficiently.
G = ZN ! ZN
Easiest hidden shift problem:
![Page 18: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/18.jpg)
M=2: The dihedral hidden subgroup problemHardest hidden shift problem:
![Page 19: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/19.jpg)
M=2: The dihedral hidden subgroup problemHardest hidden shift problem:
G = Z2 ! ZN
This is also a hidden subgroup problem, but now in a nonabelian group, the dihedral group .
![Page 20: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/20.jpg)
M=2: The dihedral hidden subgroup problemHardest hidden shift problem:
G = Z2 ! ZN
This is also a hidden subgroup problem, but now in a nonabelian group, the dihedral group .
Regev 2002: Solution to the DHSP can be used to find short vectors in lattices ( -unique-SVP), which would break, e.g., the Ajtai-Dwork cryptosystem.
!n
![Page 21: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/21.jpg)
M=2: The dihedral hidden subgroup problemHardest hidden shift problem:
G = Z2 ! ZN
This is also a hidden subgroup problem, but now in a nonabelian group, the dihedral group .
Kuperberg 2003: Algorithm with run time .2O(!
log N)
Regev 2002: Solution to the DHSP can be used to find short vectors in lattices ( -unique-SVP), which would break, e.g., the Ajtai-Dwork cryptosystem.
!n
![Page 22: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/22.jpg)
M=2: The dihedral hidden subgroup problemHardest hidden shift problem:
G = Z2 ! ZN
This is also a hidden subgroup problem, but now in a nonabelian group, the dihedral group .
Regev’s reduction also works for larger M. Is this any easier?
Kuperberg 2003: Algorithm with run time .2O(!
log N)
Regev 2002: Solution to the DHSP can be used to find short vectors in lattices ( -unique-SVP), which would break, e.g., the Ajtai-Dwork cryptosystem.
!n
![Page 23: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/23.jpg)
Main result
Theorem. Let for any fixed . Then there is an efficient (i.e., run time poly(log N)) quantum algorithm for the generalized hidden shift problem, using entangled measurements on registers.
M = N ! ! > 0
k = max{3, log 1! }
![Page 24: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/24.jpg)
Main result
Theorem. Let for any fixed . Then there is an efficient (i.e., run time poly(log N)) quantum algorithm for the generalized hidden shift problem, using entangled measurements on registers.
M = N ! ! > 0
Note: Unfortunately, this is not good enough to get better-than-classical algorithms for lattice problems. (That seems to require M = poly(log N).)
k = max{3, log 1! }
![Page 25: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/25.jpg)
Main result
Theorem. Let for any fixed . Then there is an efficient (i.e., run time poly(log N)) quantum algorithm for the generalized hidden shift problem, using entangled measurements on registers.
M = N ! ! > 0
Note: Unfortunately, this is not good enough to get better-than-classical algorithms for lattice problems. (That seems to require M = poly(log N).)
Tools:• “Pretty good measurement” on hidden shift states, à la
Bacon, Childs, van Dam 2005.• Integer programming in constant dimensions (Lenstra 1983).
k = max{3, log 1! }
![Page 26: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/26.jpg)
Pretty good measurement
PGM: A particularly nice, and often optimal, measurement for distinguishing members of an ensemble of quantum states.
![Page 27: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/27.jpg)
Pretty good measurement
PGM: A particularly nice, and often optimal, measurement for distinguishing members of an ensemble of quantum states.
For certain semidirect HSPs (BCD 05) and hidden shift problems (this talk):
PGMstate
distinguishability problem
average case algebraic problem
![Page 28: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/28.jpg)
Pretty good measurement
PGM: A particularly nice, and often optimal, measurement for distinguishing members of an ensemble of quantum states.
For certain semidirect HSPs (BCD 05) and hidden shift problems (this talk):
PGMstate
distinguishability problem
average case algebraic problem
measurement succeeds
typical instanceshave solutions
![Page 29: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/29.jpg)
Pretty good measurement
PGM: A particularly nice, and often optimal, measurement for distinguishing members of an ensemble of quantum states.
For certain semidirect HSPs (BCD 05) and hidden shift problems (this talk):
PGMstate
distinguishability problem
average case algebraic problem
measurement succeeds
typical instanceshave solutions
implementing the measurement
solving typical instances
![Page 30: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/30.jpg)
Pretty good measurement
PGM: A particularly nice, and often optimal, measurement for distinguishing members of an ensemble of quantum states.
For certain semidirect HSPs (BCD 05) and hidden shift problems (this talk):
PGMstate
distinguishability problem
average case algebraic problem
(“quantum sampling”)
measurement succeeds
typical instanceshave solutions
implementing the measurement
solving typical instances
![Page 31: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/31.jpg)
The algebraic problem
Given:
Find:
random x ! ZkN
w ! ZNrandom
b ! {0, 1, . . . ,M " 1}k
such that b · x = w mod N
![Page 32: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/32.jpg)
The algebraic problem
Given:
Find:
random x ! ZkN
w ! ZNrandom
b ! {0, 1, . . . ,M " 1}k
such that b · x = w mod N
Key observation: This is a k-dimensional integer program.• Solutions of over form a shifted integer lattice• “mod N” can be enforced by adding a component• is a pair of linear constraints
b · x = w Z
0 ! bj !M " 1
![Page 33: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/33.jpg)
The algebraic problem
Given:
Find:
random x ! ZkN
w ! ZNrandom
b ! {0, 1, . . . ,M " 1}k
such that b · x = w mod N
Key observation: This is a k-dimensional integer program.• Solutions of over form a shifted integer lattice• “mod N” can be enforced by adding a component• is a pair of linear constraints
b · x = w Z
0 ! bj !M " 1
Lenstra 1983: time algorithm for integer programming in k dimensions (using LLL lattice basis reduction)
2O(k3)
![Page 34: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/34.jpg)
Analysis of typical number of solutions
b · x = w mod N
![Page 35: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/35.jpg)
Analysis of typical number of solutions
Expected number of solutions:Mk
N
# of b’s
# of values of w
b · x = w mod N
![Page 36: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/36.jpg)
Analysis of typical number of solutions
Expected number of solutions:Mk
N
# of b’s
# of values of w
So we expect to need copies.k ! log N
log M(M = N ! ! k = 1
! )
b · x = w mod N
![Page 37: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/37.jpg)
Analysis of typical number of solutions
Proof idea: Second moment method.
Expected number of solutions:Mk
N
# of b’s
# of values of w
So we expect to need copies.k ! log N
log M(M = N ! ! k = 1
! )
b · x = w mod N
![Page 38: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/38.jpg)
Analysis of typical number of solutions
Proof idea: Second moment method.
Lemma. (used to bound variance) For any fixed b, the number of solutions to the equation is .
x ! ZkN
b · x = 0 mod N Nk!1 gcd(b1, . . . , bk, N)
Expected number of solutions:Mk
N
# of b’s
# of values of w
So we expect to need copies.k ! log N
log M(M = N ! ! k = 1
! )
b · x = w mod N
![Page 39: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/39.jpg)
Analysis of typical number of solutions
Proof idea: Second moment method.
Lemma. (used to bound variance) For any fixed b, the number of solutions to the equation is .
x ! ZkN
b · x = 0 mod N Nk!1 gcd(b1, . . . , bk, N)
Expected number of solutions:Mk
N
# of b’s
# of values of w
So we expect to need copies.k ! log N
log M(M = N ! ! k = 1
! )
b · x = w mod N
![Page 40: Quantum algorithm for a generalized hidden shift problemamchilds/talks/soda07.pdfQuantum mechanical computers can efficiently solve problems that ... The same approach works for any](https://reader034.fdocuments.in/reader034/viewer/2022042413/5f2d34bb9d015958f65c39c2/html5/thumbnails/40.jpg)
Questions
• Is the quantum solvability of the generalized hidden shift problem with useful for any problems going beyond factoring/discrete log?
• Can we solve the problem efficiently for smaller M?Can we at least interpolate with Kuperberg’s algorithm?
• What if we replace by a nonabelian group?(Then even M = 2 is not a hidden subgroup problem.)Can we solve this even for very large M?
M = !(N !)
ZN