\documentclass[a4paper]{article}

\input{temp}

\setcounter{section}{-1}

\begin{document}

\title{Quantum Computation}

\maketitle

\newpage

\tableofcontents

\newpage

\section{Introduction}
asdasd

\newpage

Exercise classes: Sat 3 Nov 11am MR4, Sat 24 Nov 11am MR4, early next term (tba).\\
Thursday 8 November lecture is moved to Saturday 10 November 11am (still MR4).

---Lecture 2---

\section{1}

Recall that we have an oracle $U_f$ for $f:\Z_M \to \Z_\N$ periodic, with period $r$, $A=M/r$. We want to find $r$ in $O(poly(m))$ time where $m=\log M$.

\subsection{The quantum algorithm}
Work on state space $\mathcal{H}_M \otimes \mathcal{N}$ with basis $\{|i\ket |k\ket\}_{i \in \Z_M, k \in \Z_N}$.\\
$\bullet$ Step 1. Make staet $\frac{1}{\sqrt{M}}\sum_{i=0}^{M-1} |i\ket|0\ket$.\\
$\bullet$ Step 2. Apply $U_f$ to get $\frac{1}{\sqrt{M}} \sum_{i=0}^{M-1} |i\ket |f(i)\ket$.\\
$\bullet$ Step 3. Measure the 2nd register to get a result $y$. By Born rule, the first register collapses to all those $i$'s (and only those) with $f(i)$ equal to the seen $y$, i.e. $i=x_0,x_0+r,...,x_0+(A-1)r$, where $0 \leq x_0 < r$ in 1st period has $f(m)=y$.\\
Discard 2nd register to get $|per\ket = \frac{1}{\sqrt{A}} \sum_{j=0}^{A-1}|x_0+jr\ket$.\\
Note: each of the $r$ possible function values $y$ occurs with same probability $1/r$, so $0 \leq x_0 < r$ has been chosen uniformly at random.\\
If we now measure $|per\ket$, we'd get a value $x_0+jr$ for uniformly random $j$, i.e. random element $(x_0^{th})$ of a random period $(j^{th})$, i.e. random element of $\Z_m$, so we could get no information about $r$.\\
$\bullet$ Step 4. Apply quantum Fourier transform mod $M$ (QFT) to  $|per\ket$. Recall the definition of QFT: $QFT: |x\ket \to \sum_{y=0}^{M-1} \omega^{xy} |y\ket$ for all $x \in \Z_M$ where $\omega = e^{2\pi i/M}$ is the $M$th root of unity. The existing result is that QFT mod $M$ can be implemented in $O(M^2)$ time.\\
Then we get
\begin{equation*}
    \begin{aligned}
    QFT |per\ket &= \frac{1}{\sqrt{MA}} \sum_{j=0}^{A-1} \left(\sum_{y=0}^{M-1} \omega^{(x_0+jr)y}|y\ket\right)\\
    &= \frac{1}{\sqrt{MA}} \sum_{y=0}^{M-1} \omega^{x_0y} \left[\sum_{j=0}^{A-1} \omega^{jry}\right] |y\ket \ (*)
    \end{aligned}
\end{equation*}
where we group all the terms with the same $|y\ket$ together. One good thing is that the sum inside the square bracket is a geometric series, with ratio $\alpha = \omega^{ry} = e^{2\pi iry/M} = (e^{2\pi i/A})^y$.\\
Hence term inside bracket $=A$ if $\alpha=1$, i.e. $y=kA = k \frac{M}{r}$, $k=0,1,...,(r-1)$, and equals $0$ otherwise when $\alpha \neq 1$. Now\\
\begin{equation*}
    \begin{aligned}
        QFT |per\ket = \sqrt{\frac{A}{M}} \sum_{k=0}^{r-1} \omega^{x_0 k \frac{M}{r}} |k \frac{M}{r}\ket
    \end{aligned}
\end{equation*}
The random shift $x_0$ now appears only in phase, so measurement probabilities are now independent of $x_0$!

Measuring $QFT |per\ket$ gives a value $c$, where $c = k_0 \frac{M}{r}$ with $0 \leq k_0 \leq r-1$ chosen uniformly at random. Thus $\frac{k_0}{r} = \frac{c}{M}$, note that $c,M$ are known, $r$ is unknown (what we want), and $k_0$ is unknown but uniformly random.

So note that if we are lucky and get a $k_0$ that is coprime to $r$ then we could just simplify $\frac{c}{M}$ to get $r$. Obviously we cannot be always lucky every time, but by theorem in number theory, the number of integers $<r$ coprime to $r$ grows as $O(r/\log\log r)$ for large $r$, so we know probability of $k_0$ coprime to $r$ is $O(\frac{1}{\log\log r})$.

Then by some probability calculation we know that $O(1/p)$ trials are enough to achieve $1-\varepsilon$ probability of success.

So afer Step 4, cancel $c/M$ to the lowest terms $a/b$, giving $r$ as denominator $b$ (if $k_0$ is coprime to $r$). Check $b$ value by computing $f(0)$ and $f(b)$, since $b=r$ iff $f(0) = f(b)$.

Repeating $K=O(\log\log r)$ times gives $r$ with any desired probability.

Further insights into utility of QFT here:\\
Write $R = \{0,r,2r,...,(A-1)r\} \subseteq \Z_M$. $|R\ket = \frac{1}{\sqrt{A}} \sum_{k=0}^{A-1} |kr\ket$, and $|per\ket = |x_0 + R\ket = \frac{1}{\sqrt{A}} \sum_{k=0}^{A-1} |x_0+br \ket$ where $x_0$ is the random shift that caused problem previously.\\
For each $x_0 \in \Z_M$, consider mapping $k \to k+x_0$ (shift by $x_0$) on $\Z_M$, which is a 1-1 invertible map.

So linear map $U(x_0)$ on $\mathcal{H}_M$ defined by $U(x_0): |k\ket \to |k+x_0\ket$ is unitary, and $|x_0+R \ket = U(x_0) |R\ket$.

Since $(\Z_M,+)$ is abelian, $U(x_0)U(x_1) = U(x_0+x_1) =U(x_1)U(x_0)$ i.e. all $U(x_0)$'s commute as operators on $\mathcal{H}_M$.\\
So we have orthonormal basis of common eigenvectors $|\chi_k\ket\}_{k \in \Z_M}$, called \emph{shift invariant states}.

$U(x_0)|\chi_k\ket = \omega(x_0,k)|\chi_k\ket$ for all $x_0,k \in \Z_M$ with $|\omega(x_0,k)| = 1$. Now consider $|R\ket$ written in $|\chi\ket$ basis,\\
$|R\ket = \sum_{k=0}^{M-1} a_k | \chi_k\ket$ where $a_k$'s depending on $r$ (not $x_0$).\\
Then $|per\ket = U(x_0) |R\ket = \sum_{k=0}^{M-1}a_k \omega(x_0,k) |\chi_k\ket$, and measurement in the $\chi$-basis has $prob(k) = |a_k \omega(x_0,k)|^2 = |a_k|^2$ which is independent of $x_0$, i.e. giving information about $r$!

---Lecture 3---

Recall last time we had $\mathcal{H}_M$: shift operations $U(x_0) |y \ket = |y+x_0\ket$ for $x_0,y \in \Z_M$, which all permute, so have a common eigenbasis (shift invariant states) $\{|\chi_k\ket \}_{k \in \Z_M}$, $U(x_0) | x_k\ket = \omega(x_0,k) |\chi_k\ket$.\\
Measurement of $|x_0+R \ket = \frac{1}{\sqrt{A}} \sum_{l=0}^{A-1} |x_0 + l_r \ket = U(x_0) |R\ket$ in $|\chi\ket$ basis has output distribution independent of $x_0$, therefore gives information about $r$.

Introduce QFT as the unitary mapping that rotates $\chi$-basis to standard basis, i.e. define $QFT|\chi_k \ket = |k\ket$. So QFT followed by measurement implements $\chi$-basis measurement.

Explicit form of $|\chi_k\ket$ eigenspaces (!): consider
\begin{equation*}
    \begin{aligned}
        |\chi_k\ket = \frac{1}{\sqrt{M}}\sum_{l=0}^{M-1} e^{-2\pi i kl/M}|l\ket
    \end{aligned}
\end{equation*}
Then
\begin{equation*}
    \begin{aligned}
        U(x_0) |\chi_k \ket &= \frac{1}{\sqrt{M}} \sum_{l=0}^{M-1} e^{-2\pi i kl/M}|l+x_0\ket \\
        &= \frac{1}{\sqrt{M}} \sum_{\tilde{l}=0}^{M-1} e^{-2\pi i k (\tilde{l}-x_0)/M} | \tilde{l} \ket \text { where } \tilde{l} = l+x_0\\
        &= e^{2\pi i k x_0 / M} \cdot |\chi_k\ket
    \end{aligned}
\end{equation*}
i.e. these are the shift invariant staets, eigenvalues $\omega(x_0,k) = e^{2\pi i k x_0/M}$.

Matrix of QFT: So
\begin{equation*}
    \begin{aligned}
        [QFT^{-1}]_{lk} = \frac{1}{\sqrt{M}} e^{-2\pi i lk/M}
    \end{aligned}
\end{equation*}
(componets of $|\chi_k \ket = QFT^{-1} |k\ket$ as $k^{th}$ column). So
\begin{equation*}
    \begin{aligned}
        [QFT]_{kl} = \frac{1}{\sqrt{M}} e^{2\pi i lk / M}
    \end{aligned}
\end{equation*}
as expected.

\newpage

\section{The hidden subgroup problem (HSP)}

Let $G$ be a finite group of size $|G|$. Given (oracle for) function $f:G \to X$ ($X$ is some set), and promise that there is a subgroup $K < G$ such that $f$ is constant on (left) cosets of $K$ in $G$, and $f$ is distinct on distinct cosets.\\
The problem: determine the \emph{hidden subgroup} $K$ (e.g. output a set of generators, or sample uniformly from $K$).\\
We want to solve in time $O(poly(\log |G|))$ (an efficient algorithm) with any constant probability $1-\varepsilon$.

Examples of problems that can be cast(?) as HSPs:\\
(i) periodicity: $f:\Z_M \to X$, periodic with period $r$. Let $G=(\Z_m,+)$, the hidden subgroup is $K=\{0,r,2r,...\} < G$, cosets $x_0+K = \{x_0,x_0+r,x_0+2r,...\}$. The period $r$ is generator of $K$.\\
(ii) discrete logarithm: for prime $p$, $\Z_p^* = \{1,2,...,p-1\}$ with multiplication mod $p$. $g \in \Z_p^*$ is a generator (or primitive root mod $p$). If powers generate all of $\Z_p^*$, $\Z_p^* = \{g^0 = 1,g^1,...,g^{p-2}\}$, then also $g^{p-1} \equiv 1 \pmod p$ (easy number theory).\\
Fact: the generator always exists if $p$ is prime. So any $x \in \Z_p^*$ can be written $x = g^y$ for some $y \in \Z_{p-1}$, write $y=\log_g x$ called the discrete log of $x$ to base $g$.

Discrete log problem: given a generator $g$ and $x \in \Z^*_p$, compute $y=\log_g x$ (classically hard).\\
To express as HSP, consider $f:\Z_{p-1} \times \Z_{p-1} \to \Z_p^*$: $f(a,b) = g^a x^{-b} \ mod \ p = g^{a-yb} \ mod \ p$.\\
Then check: $f(a_1,b_1) = f(a_2,b_2)$ iff $(a_2,b_2) = (a_1,b_1)+\lambda(y,1)$ where $\lambda \in \Z_{p-1}$.

So if $G = \Z_{p-1} \times \Z_{p-1}$, $K=\{\lambda(y,1):\lambda \in \Z_{p-1}\} < G$. Then $f$ is constant and distinct on the cosets of $K$ in $G$, and generator $(y,1)$ gives $y=\log_g x$.\\

(iii) graph problems ($G$ non-abelian now): consider undirected graph $A = \{V,E\}$, $|V| =n$, with at most one edge between any two vertices. Label vertices by $[n] = \{1,2,...,n\}$.\\
Introduce the permutation group $\mathcal{P}_n$ of $[n]$. Define $Aut(A)$ to be the group of automorphisms of $A$, which is a subgroup of $\mathcal{P}_n$, containing exactly the permutations $\pi \in \mathcal{P}_n$ such that for all $i,j \in [n]$, $(i,j) \in E \iff (\pi(i),\pi(j)) \in E$, i.e. the labelled graph $\pi(A)$ obtained by permuting labels of $A$ by $\pi$ is the same \emph{labelled} graph as $A$.

Associated HSP: Take $G = \mathcal{P}_n$. Let $X$ be set of all labelled graphs on $n$ vertices. Given $A$, consider $f_A: \mathcal{P}_n \to X$ by $f_A(\pi) = \pi(A)$, $A$ with labels permuted by $\pi$. The associated hiiden subroup is $Aut(A) = K$.

Application: if we can sample uniformly from this $K$, then we can solve graph isomorphism problem (GI): two labelled graphs $A,B$ are isomorphic if there is 1-1 map $\pi:[n] \to [n]$ such that for all $i,j \in [n]$, $i,j$ is an edge in $A$ iff $\pi(i),\pi(j)$ is an edge in $B$, i.e. $A$ and $B$ are the same graph but just labelled differently.

---Lecture 4---

Let's come back to the graph isomorphism problem.

Problem: given $A,B$, decide if $A \cong B$ or not. This can be expressed as anon-abelian HSP (on example sheet), no known classical polynomial time algorithm. However it is in NP, but it is not believed to be NP-complete.\\
Recent result (2017): a quasi-poly time classical algorithm (L.Babai).

Quantum algorithm for finite \emph{abelian} HSP:\\
Write group $(G,+)$ additively.

Construction of shift invariant states and FT for $G$:\\
Let's introduce some representation theory for abelian group $G$. Consider mapping $\chi:G \to \C^* = (\C \setminus \{0\}, \cdot)$ satisfying $\chi(g_1+g_2) = \chi(g_1)\chi(g_2)$, i.e. $\chi$ is a group homomorphism. Such $\chi$'s are called \emph{irreducible} representations of $G$.\\
We have the following properties (without proof), which we'll call Theorem A later when we refer to it:\\
(i) any value $\chi(g)$ is a $|G|^{th}$ root of unity (so $\chi$: $G \to S^1$ = unit circle in $\C$);\\
(ii) (Schur's lemma, orthogonality): If $\chi_i$ and $\chi_j$ are representations, then $\sum_{g \in G} \chi_i (g) \bar{\chi}_j(g) =\delta_{ij}|G|$;\\
(iii) there are always exactly $|G|$ different representations $\chi$ (well, this is a special case of general representation theory).

By (iii), we can label $\chi$'s as $\chi_g$ for $g \in G$. For example, $\chi(g) = 1$ for all $g \in G$ is always an irreducible representation (the trivial representation), labelled $\chi_0$;\\
Then by orthogonality (ii) for any $\chi \neq \chi_0$ gives $\sum_{g \in G} \chi(g) = 0$.

Shift invariant states: in space $\mathcal{H}_{|G|}$ with basis $\{|g\ket\}_{g \in G}$, introduce \emph{shift operators} $U(k)$ for $k \in G$ defined by $U(k): |g\ket \to |g+k\ket$. Clearly these all commute, so there is simultaneous eigenbasis:\\
For each $\chi_k$, $k\in G$, consider state $|\chi_k \ket = \frac{1}{\sqrt{|G|}} \sum_{g \in G} \bar{\chi}_k (g)|g\ket$. Then theorem A(ii) implies these form orthonormal basis, and $U(g) |\chi_k\ket = \chi_k(g)|\chi_k\ket$.
\begin{proof}
    \begin{equation*}
        \begin{aligned}
            U(g)|\chi_k\ket &= \frac{1}{\sqrt{|G|}} \sum_{h \in G} \bar {\chi_k(h)} |h+g\ket\\
            &\stackrel{h'=h+g}{=} \frac{1}{\sqrt{|G}} \sum_{h' \in G} \bar{\chi_k(h'-g)} |h' \ket
        \end{aligned}
    \end{equation*}
    This implies that
    \begin{equation*}
        \begin{aligned}
            \chi_k*-g) = (\chi_k(g))^{-1} = \bar{\chi_k(g)},\\
            \bar{\chi_k(h'-g)} = \bar{\chi_k(h')}\bar{\chi_k(-g)} = \chi_k(h')\chi_k(g)
        \end{aligned}
    \end{equation*}
    So
    \begin{equation*}
        \begin{aligned}
            U(g) | \chi_k \ket = \frac{1}{\sqrt{|G|}} = \sum_{h' \in G} \chi_k(g) \bar{\chi}_k (h') | h' \ket = \chi_k (g) | \chi_k \ket
        \end{aligned}
    \end{equation*}
\end{proof}

So $|\chi_k \ket$'s are common eigenspaces, called \emph{shift-invariant states}.\\
    Introduce (define) Fourier transform QFT for group $G$ as the unitary that $QFT|\chi_g\ket = |g\ket$ for all $g \in G$.\\
    In $|g\ket-$basis matrices, $k^{th}$ column of $(QFT^{-1}) = $components of $|\chi_k\ket$, i.e. $\frac{1}{\sqrt{|G|}} \bar{\chi_k}(g) = [QFT^{-1}]_{gk}$.\\
    So $[QFT]_{kg}^\dagger = \frac{1}{\sqrt{|G|}}\chi_k(g)$, and so $QFT|g\ket = \frac{1}{\sqrt{|G|}} \sum_{k \in G} \chi_k (g) |k\ket$.

\begin{eg}
    $G=\Z_M$. Check $\chi_a(b) = e^{2\pi iab/M}$, $a,b \in \Z_M$ is a representation.\\
    Similarly, for $G=\Z_{M_1} \times ... \times \Z_{M_r}$, $(a_1,...,a_r) = g_1, (b_1,...,b_r) = g_2$ where $g_1,g_2 \in G$, $$\chi_{g_1}(g_2) \stackrel{def}{=} e^{2\pi i \left(\frac{a_1b_1}{M_1} + ... + \frac{a_rb_r}{M_r}\right)}$$ is a representation of $G$. And we get $$QFT_G =QFT_{M_1} \otimes ... \otimes QFT_{M_r}$$ on $\mathcal{H}_{|G|} = \mathcal{H}_{M_1} \otimes ... \otimes \mathcal{H}_{M_r}$.\\
    This is exhaustive, since by classification theorem, every finite abelian group $G$ is isomorphic to a direct product of the form $G \cong \Z_{M_1} \times ... \times \Z_{M_r}$. Furthermore, we can insist that $M_i$ are prime powers $p_i^{s_i}$, where $p_i$ are not necessarily distinct.
\end{eg}

Quantum algorithm for finite abelian HSP:\\
Let $f:G \to X$, hidden subgroup $K<G$. We have cosets $K=0+K,g_2+K,...,g_m+K$, where $m=|G|/|K|$. State space as usual, with basis $\{|g\ket, |x\ket \}_{g \in G, x \in X}$.\\
$\bullet$ make the state $\frac{1}{\sqrt{|G|}} \sum_{g \in G} |g\ket |0\ket$;\\
$\bullet$ Apply oracle $U_f$, get $\frac{1}{\sqrt{|G|}} \sum_{g \in G} |g\ket |f(g)\ket$;\\
measure second register to see a value $f(g_0)$.\\
Then first register gives coset state (remember the function is constant on each coset). $|g_0+K \ket = \frac{1}{\sqrt{|K|}} \sum_{k \in K} |g_0 + K \ket = U(g_0) |K\ket$.\\
Apply QFT and measure to obtain result $g \in G$.

---Lecture 5---

Last time we disccused how to solve the abelian HSP problem. Now how does the output $g$ related to $K$?\\
$\bullet$ the output distribution of $g$ is independent of $g_0$, so same as that obtained from $QFT|K \ket$ (i.e. $g_0 = 0$) since:\\
write $|K \ket $ in shift invariant basis $|\chi_g \ket$'s, $|K\ket = \sum_{g} a_g | \chi_g \ket$, then $|g_0+K \ket = U(g_0) |K\ket = \sum a_g \underbrace{\chi_g(g_0) | \chi_g \ket}_{ = U(g_0) | \chi_g \ket}$; but $QFT|\chi_g \ket = |g\ket$, so $Prob(g) = |a_g \chi_g (g_0)|^2 = |a_g|^2$ as $\chi_g(g_0)| = 1$.

Thus look at $QFT|K \ket$. Recall $QFT|k \ket = \frac{1}{\sqrt{|G|}} \sum_{l \in G} \chi_l(k) |l\ket$, so $QFT |K\ket = \frac{1}{\sqrt{|G|}} \frac{1}{\sqrt{|K|}} \sum_{l \in G} \left[\sum_{k \in K} \chi_l(k) \right] |l\ket$.\\
The terms in $[...]$ involves irreducible representation $\chi_l$ of $G$ restricted to subgroup $K < G$, which is an irreducible representation of $K$. Hence
\begin{equation*}
    \begin{aligned}
        \sum_{k \in K} \chi_l(k) = \left\{
            \begin{array}{ll}
                |K| & \chi_l \text{ restricts to trivial irreducible representation on } K\\
                0 & \text{ otherwise}
            \end{array}
        \right.
    \end{aligned}
\end{equation*}
and
$$QFT|K\ket = \sqrt{\frac{|K|}{|G|}} \sum_{l \in G \text{ with }\chi_l\text{ reducing to trivial irreducible representation of }K} |l\ket$$
So measurement gives a uniformly random choice of $l$ such that $\chi_l(k) = 1$  for all $k \in K$.\\
e.g. If $K$ has generators $k_1,k_2,...,k_M$, $M=O(\log |K|) = O(\log |G|)$, then output has $\chi_l(k_i) = 1$ for all $i$.

It can be shown that if $O(\log|G|)$ such $l$'s are chosen uniformly at random, then with probability $>2/3$ they suffice to determine a generating set for $K$ via equations $\chi_l(k) = 1$.\\
(see example sheet 1 for particular examples).

\begin{eg}
    If $G = \Z_{M_1} \times ... \times \Z_{M_q}$.\\
    We had for $l=(l_1,...,l_q)$, $g \in (b_1,...,b_q) \in G$,
    $$\chi_l(g) = e^{2\pi i (\frac{l_1k_1}{M_1} + ... + \frac{l_qb_q}{M_q})}$$
    So for $k=(k_1,...,k_q)$, $\chi_l(k) = 1$ becomes
    $$\frac{l_1k_1}{M_1} + ... + \frac{l_qk_q}{M_q} \equiv 0 \pmod 1$$
    (i.e. is an integer), a homogeneous linear equation on $K$, and $O(\log |K|)$ is independent such that equations determine $K$ as null space.
\end{eg}

Some remarks on HSP for non-abelian groups $G$ (write multiplicatively):\\
As before, can easily generate coset states
$$ |g_0 K \ket = \frac{1}{\sqrt{|K|}} \sum_{k \in K} |g_0 K\ket$$
where $g_0$'s are randomly chosen. But problems arise with QFT construction, because now there's no basis of shift-invariant states exists! (this is since $U(g_0)$'s don't commute anymore, so no common full eigenbasis).

Construction of non-abelian Fourier Transform (some more representation theory):\\
$\bullet$ $d$-dimensional representation of $G$ is a group homomorphism $\chi: G \to U(d)$ where $U(d)$ is the space of $d \times d$ unitary matrices acting on $\C^d$, by $\chi(g_1 g_2) \chi(g_1)\chi(g_2)$. (see part II representation theory for the general form)\\
$\bullet$ $\chi$ is irreducible representation if no subspace of $\C^d$ is left invariant under $\chi(g)$ for all $g \in G$ (i.e. cannot simultaneously block diagonalise all $\chi(g)$'s by a basis change).\\
$\bullet$ a complete set of irreducible representation: set $\chi_1,...,\chi_m$ such that any irreducible representation is unitarily equivalent to one of them (equivalence $\chi \to \chi' = V\chi V^T$).

\begin{thm} (non-abelian version of theorem A -- properties of representations)\\
    If $d_1,...,d_m$ are dimensions of a complete set of irreducible representations $\chi_1,...,\chi_m$, then:\\
    (i) $d_1^2+...+d_m^2 = |G|$;\\
    (ii) Write $\chi_i(g)_{jk}$ for the $(j,k)^{th}$ entry of matrix $\chi_i(g)$, where $j,k = 1,...,d_i$. Then (Schur orthogonality):
    $$\sum_g \chi_i(g)_{jk} \bar{\chi}_{i'}(g)_{j'k'} = |G| \delta_{ii'} \delta{jj'}\delta{kk'}$$
    Hence states
    $$|\chi_{i,jk} \ket \equiv \frac{1}{\sqrt{|G|}} \sum_{g \in G} \bar{\chi}_i(g)_{jk} |g\ket$$
    is an orthonomal basis.
\end{thm}

$\bullet$ QFT on $G$ \emph{defined} to be the unitary that rotates $\{|\chi_{ijk}\ket\}$ basis into standard basis $\{|g\ket\}$. However, $|\chi_{ijk}\ket$ are \emph{not} shift invariant for all $U(g_0)$'s, and consequently measurement of coset state $|g_0 K\ket$ in $|\chi \ket$-basis gives an output distribution \emph{not} independent of $g_0$.

However, \emph{partial} shift invariance survives: Consider the incomplete measurement $M_{rep}$ on $|g_0 K\ket$ that distinguishes only the irreducible representations (i.e. $i$ values) and not all $(i,j,k)$'s.\\
i.e. with measurement outcome $i$ associated to $d_i^2$-dimensional orthogonal subspaces spanned by $\{|\chi_{(i),jk}\ket\}_{j,k = 1,...,d_i}$.\\
Then $\chi_i(g_1,g_2) = \chi_i(g_1) \chi_i(g_2)$ implies output distribution of $i$ values is independent of $g_0$, giving direct, albeit imcomplete, information about $K$.\\
E.g. conjugate subgroups $K$ and $ = g_0 K g_0^{-1}$ for some $g_0 \in G$ give \emph{same} output distribution.

---Lecture 6---\\
Non-abelian HSP/FT remarks:\\
For efficient HSP algorithm, we also need QFT to be efficiently implementable, i.e. $poly(\log|G|)$-time.\\
This is true for any abelian $G$ and some non-ablien $G$'s (such as $\mathcal{P}_n$), but even in latter case there's no known efficient HSP algorithm.

Some known result:\\
for normal subgroups, i.e. $gK= Kg$ for all $g \in G$:
\begin{thm} (Hallgrer, Russell, Tashma, SIAM J.Comp 32 p916-934 (2003))\\
    Suppose $G$ has efficient QFT. Then if hidden subgroup $K$ is normal, then there is an efficient HSP quantum algorithm.\\
    (Construct coset state $|g_0 K\ket$, perform $M_{rep}$ on it.)\\
    Repeat $O(\log|G|)$ times. Then $K$ normal implies outputs suffice to determine $K$.
\end{thm}

\begin{thm} (Ettinger, Hoyer, Knill)\\
    For general non-abelian HSP, $M=O(poly(\log|G|))$ random coset states $|g_1K\ket$,...,$g_M K\ket$ suffice to determine $K$ from $M$ coset states, but it's not efficient.\\
    See example sheet for a proof -- construct a measurement procedure on $|g_1K\ket \otimes ... \otimes g_MK\ket$ to determine $K$, but it takes exponential time in $\log|G|$.
\end{thm}

The phase estimation algorithm:\\
$\bullet$ a unifying principle for quantum algorithms, uses $QFT_{2^n}$ again.\\
$\bullet$ many applications, e.g. an alternative efficient factoring algorithm (A.Kitaev).

Given unitary operator $\mathcal{U}$ and eigenstate $|v_\phi \ket \cdot \mathcal{U} | v_{\phi}\ket = e^{2\pi i\phi} | v_\phi\ket$, we want to estimate phase $\phi$, where $0 \leq \phi < 1$ (to some precision, say to $n$ binary digits).

We'll need \emph{controlled-$U^k$} for integers $k$, writte $C-U^k$, which satisfies $c-U^k |0\ket |\xi\ket = |0\ket |\xi\ket$, $C-U^k |1\ket |\xi\ket = |1\ket U^k|\xi\ket$, where $|\xi\ket$ in general has dimension $d$.\\
Note $U^k |v_\phi\ket = e^{2\pi ik\phi} | v_\phi\ket$, $C-(U^k) = (C-U)^k$.

\begin{rem}
    Given $U$ as a formula or (arant?) description, we can readily implement $C-U$, e.g. just control each gate of $U$'s circuit.\\
    However, if $U$ is given as a \emph{black box}, we need further info:\\
    $\bullet$ it suffices to have an eigenstate $|\alpha\ket$ with known eigenvalue $U|\alpha\ket = e^{i\alpha} |\alpha\ket$:\\
    We can consider

    \includegraphics[scale=0.5]{image/QC_01.png}
    Where we get $CU|a\ket |\xi\ket$ at the first two row and the third row $|\alpha\ket$ is always unchanged.\\
    To see how it works, just check circuit action. (...)
\end{rem}

We'll actually want \emph{generalised controlled-$U$} with $|x\ket |\xi\ket \to |x\ket U^x |\xi\ket$, where $|x\ket$ has $n$ qubits, i.e. $x \in \Z_{2^n}$.\\
We can make this thing from $C-(U^k)$ as follows:

\includegraphics[scale=0.5]{image/QC_02.png}

We get $|x\ket U^x |\xi\ket$, where $x=x_{n-1}...x_1x_0$ binary, $U^x = U^{2^{x_{n-1}}} ... U^{2^{x_1}}U^{2^{x_0}}$.\\
Note: if input $|\xi\ket = |v_\phi\ket$, then get $e^{2\pi i \phi x}|v_\phi\ket$.

Now suppose over all $x=0,1,...,2^{n-1}$ and use $|\xi\ket = |v_\phi\ket$,

\includegraphics[scale=0.5]{image/QC_03.png}

Where the output is $\frac{1}{\sqrt{2^n}} \sum_x e^{2\pi i\phi x} |x\ket$, we call this state $|A\ket$.

Finally apply $QFT_{2^n}^{-1}$ to $|A\ket$ and measure to see $y_0,...,y_{n-1}$ on lines $0,1,...,n-1$. Then output $0.y_0...y_{n-1} = \frac{y_0}{2}+...+\frac{y_{n-1}}{2^{n-1}}$, as the estimate of $\phi$.\\
That's the phase estimation algorithm (for given $U$ and $V_\phi\ket$).

Suppose $\phi$ actually had only $n$ binary digits, i.e. $\phi$ exactly equals $0.z_0z_1...z_{n-1}$ for some $z_k=0,1$ for all $k$.

Then $\phi = \frac{z_0...z_{n-1}}{2^n} = \frac{z}{2^n}$ where $z$ is $n$-bit integer in $\Z_{2^n}$, and
$$ |A\ket = \frac{1}{\sqrt{2^n}} \sum_x e^{2\pi ixz/2^n} |x\ket$$
\emph{is} $QFT_{2^n}$ of $|z\ket$.\\
So $QFT^{-1} |A\ket = |z\ket$ and get $\phi$ exactly, with certainty.\\
In this case the algorithm up to (not including) final measurements is a unitary operation, mapping $|0\ket ... |0\ket |v_\phi \ket \to |z_0 \ket ... |z_{n-1} \ket |v_\phi\ket$.

---Lecture 7---
Phase Estimation (continued):\\

$U$ is a $d \times d$ unitary operation/matrix with eigenstate $U|v_\phi \ket = 2^{2\pi i\phi} | v_\phi \ket$, and we want to estimate $\phi$.\\
$U$ as a quantum physical operation is equivalent to $\tilde{U} = e^{i \alpha} U$ for any $\alpha$ and $\tilde{U}$ has $\phi \to \phi+\alpha/2\pi$.\\
So if $U$ given as quantum physical operation alone, we cannot determine $\phi$.\\
But controlled versions different: $C-U$ and $C-\tilde{U}$ are different as physical operations (set $\{e^{i\alpha} C-U\}_\alpha \neq \{e^{i\alpha} C-\tilde{U}\}_\alpha$), and $C-U/\tilde{U}$ \emph{does} fix $\phi$ associatied to choice of phase $\alpha$.\\
So quantum phase estimation algorithm use $C-U$ ($C-U^{2^k}$) physical operations (not just $U$'s).

We had $\underbrace{|0\ket...|0\ket}_{n} |v_\phi\ket \stackrel[C-U's]{\text{unitary}}{\rightarrow} |A\ket = \frac{1}{\sqrt{2^n}} \sum_{x=0}^{2^n-1} e^{2\pi i\phi x} |x\ket$ ($n$ qubits).\\
Apply $QFT^{-1}$ we get $QFT^{-1}|A\ket$, measure to see $y_0,...,y_{n-1}$; output $\phi = \frac{(y_0y_1...y_{n-1})}{2^n}$, $0 \leq y < 2^{n-1}$, where the numerator is a $n$-bit integer.\\
If $\phi = \frac{z}{2^n}$ for integer $0 \leq z < 2^n$, i.e. $\phi$ has exactly $n$ binary digits, then $|A\ket = QFT|z\ket$, so we get $z$ with certainty in the measurement.

Now suppose $\phi$ has \emph{more} than $n$ bits, say $\phi = 0.z_0z_1z_2...z_{n-1} | z_nz_{n+1}...$. Then we have:

\begin{thm} (PE)
    If measurement in above algorithm give $y_0,...y_{n-1}$ (so output is $\theta = 0.y_0...y_{n-1}$), then\\
    (a) $\P(\theta$ is closet $n$ binary digit approximate to $\phi) \geq {4}{\pi^2}$;\\
    (b) $\P(|\theta-\phi| \geq \varepsilon)$ is at most $P(\frac{1}{2^n \varepsilon})$ (we'll show it's at most $\frac{1}{2^{n+1} \varepsilon}$).

    \begin{rem}
        In (a), we have probability $\frac{4}{\pi^2}$ that all $n$ lines of $n$-line QPE process are \emph{good}.\\
        But, if we want $\phi$ accurate to $m$ bits with probability $1-\eta$, then we use theorem (PE) (b) with $\varepsilon = 1/2^m$. Then we'll use $n>m$ lines with
        $$\frac{1}{2^{n+1}} \varepsilon = \eta, \varepsilon = \frac{1}{2^m}$$
        i.e. $n=m+\log(1/\eta)+1$. In words, number of lines needed is only number of bits wanted with good probability $1-\eta$ plus a modest polynomial increase for exponetial reduction in $\eta$.
    \end{rem}

    \begin{proof}
        We have
        \begin{equation*}
            \begin{aligned}
                QFT^{-1}|x\ket = \frac{1}{\sqrt{2^n}} \sum_{y=0}^{2^n-1} e^{-2\pi i yx / 2^n} |y\ket
            \end{aligned}
        \end{equation*}
        So
        \begin{equation*}
            \begin{aligned}
                QFT^{-1} |A\ket =\frac{1}{2^n} \sum_y \left[\sum_x e^{2\pi i(\phi - y/2^n)x}\right] |y\ket
            \end{aligned}
        \end{equation*}
        So for measurement,
        \begin{equation*}
            \begin{aligned}
                \P(\text{see } n- \text{ bit integer } y=y_0y_1...y_{n-1}) = \frac{1}{2^{2n}} \left|\sum_{x=0}^{2^n-1} e^{2\pi i \underbrace{(\phi-\frac{y}{2^n})}_{:=\delta(y)} x}\right|^2
            \end{aligned}
        \end{equation*}
        Note that this is a geometric series $e^{2\pi i \delta(y)}$, so
        \begin{equation*}
            \begin{aligned}
                \P(\text{see } y) = \frac{1}{2^{2n}} \left|\frac{1-e^{2^n 2\pi i \delta(y)}}{1-e^{2\pi i\delta(y)}} \right|^2
            \end{aligned}
        \end{equation*}
        Let's call this equation (P) (maybe for \emph{phase}).\\
        We want to bound/estimate this expression.\\
        For (a): Let $y=a=a_0a_1...a_{n-1}$ give \emph{closest} $n$-bit approximation to $\phi$, i.e. $|\phi-\frac{a}{2^n}| \leq \frac{1}{2^{n+1}}$, i.e. $\delta(a) \leq \frac{1}{2^{n+1}}$.\\
        Now we bounds:\\
        (i) $|1-e^{i\alpha}| = |2\sin \frac{\alpha}{2}| \geq \frac{2}{\pi} |\alpha|$ if $|\alpha| < \pi$;\\
        (ii) $|1 - e^{2\pi i \beta}| \leq 2\pi \beta$.

        In equation (P), use (i) with $\alpha =2^n \cdot 2\pi \delta(a) \leq 2^n 2\pi \frac{1}{2^{n+1}} \leq \pi$ to lower bound top line, and (ii) with $\beta = \delta(a)$ to upper bound bottom line, get
        \begin{equation*}
            \begin{aligned}
                \P(\text{see } a) \geq \frac{1}{2^{2n}} \left(\frac{2^{n+1}\delta(a)}{2\pi \delta(a)}\right)^2 = \frac{4}{\pi^2}
            \end{aligned}
        \end{equation*}
        For (b), we want to upper bound equaiton (P): for top line, $|1-e^{i\alpha}| \leq 2$ for any $\alpha$; for bottom, use (i) get $|1-e^{2\pi i\delta(y)} | \geq 4\delta(y)$. So
        \begin{equation*}
            \begin{aligned}
                \P(y) \leq \frac{1}{2^{2n}} \left(\frac{2}{4\delta(y)}\right)^2 = \frac{1}{2^{2n+2}} \delta(y)^2
            \end{aligned}
        \end{equation*}
        Now sum this for all $|\delta(y)| > \varepsilon$, $\delta(y)$ values spaced by $1/2^n$'s. Let $\delta_+$ be first $\delta(y)$ (jumps?) with $\delta(y) \geq \varepsilon$, $\delta_-$ be that with $\delta(y) \leq -\varepsilon$. So $|\delta_+|,|\delta_-| \geq \varepsilon$.\\
        Then if $|\delta(y)| \geq \varepsilon$, we have $\delta(y) = \delta_+ + \frac{k}{2^n}$, $k=0,1,...$, or $=\delta_- - \frac{k}{2^n}$, $k=0,1,...$.\\
        So $|\delta(y)| \geq \varepsilon + \frac{k}{2^n}$ with $k=0,1,2,...$ in each case.\\
        So
        \begin{equation*}
            \begin{aligned}
                \P(|\delta(y)| > \varepsilon) &\leq 2 \sum_{k=0}^\infty \frac{1}{2^{2n+2}} \frac{1}{(\varepsilon+\frac{k}{2^n})^2}\\
                &\leq \frac{1}{2} \int_0^\infty \frac{1}{(2^n \varepsilon+k)^2} dk\\
                &= \int_{2^n \varepsilon}^\infty \frac{dk}{k^2}\\
                &= \frac{1}{2^{n+1} \varepsilon}
            \end{aligned}
        \end{equation*}
    \end{proof}
\end{thm}

Further remarks on QPE algorithm:\\
(1) If $C-U^{2^k}$ is implemented as $(C-U)^{2^k}$, the QPE algorithm needs exponential time in $n$ as we have $1+2+...+2^{n-1} = 2^n-1$ $(C-U)$ gates.\\
However, for some special $U$'s, $C-U^{2^k}$ can be implemented in $poly(k)$ time, so we get a poly time QPE algorithm.\\
It can be used to provide alternative facoring (order finding) algorithm (due to A. Kitaev) using PE.

---Lecture 8---

First exercise class: Saturday 3 Nov 11am MR4.

(2) If instead of $|v_\phi\ket$, use general input state $|\xi\ket$:
$$|\xi \ket = \sum_j c_j | v_{\phi_j}\ket$$
$$U|v_{\phi_j} \ket = e^{2\pi i \phi_j} | v_{\phi_j} \ket$$
Then we get in QPE (before final measurement) a unitary process $U_{PE}$ with (lecturer had \emph{that}) effect
$$|0...0\ket | \xi\ket \xrightarrow{U_{PE}} \sum_j c_j | \phi_j\ket |v_{\phi_j}\ket$$
and final measurement will give a choice of $\phi_j$'s (or approximation) chosen with probabilities $|c_j|^2$.

\begin{eg}
    Implement $QFT_{\mathcal{Q}}$ for $\mathcal{Q}$ not a power of $2$, with a quantum curcuit of $1-$ and $2-$ qubit gates of circuit size $O(poly(\log \mathcal{Q}))$ (Kitaev's method).
\end{eg}

\begin{rem}
    For $\mathcal{Q}=2^m$, we have explicit known circuit of $O(m^2)$. $H$ and $C$-phase gate to implement $QFT_{2^m}$ exactly (cf part II QIC Notes).
\end{rem}

For $QFT_{\mathcal{Q}}$: Introduce
$$|\eta_a \ket = QFT_{\mathcal{Q}} |a\ket = \frac{1}{\sqrt{\mathcal{Q}}} \sum_{b=0}^{\mathcal{Q}-1} \omega^{ab} |b\ket, a \in \Z_{\mathcal{Q}}, \omega = e^{2\pi i/\mathcal{Q}}$$
It suffices to make circuit hat does $|a \ket \to |\eta_a\ket$ (*).\\
Let $2^{m-1} < \mathcal{Q} < 2^m$, and set $M=2^m$, view $\mathcal{H}_{\mathcal{Q}}$ as subspace of $m$ qubits (spanned by $|a\ket: 0 \leq a < \mathcal{Q}-1 < 2^m$).\\
To achieve (*), consider instead on $\mathcal{H}_{\mathcal{Q}} \otimes \mathcal{H}_{\mathcal{Q}}$
$$|a\ket |0\ket \xrightarrow{(1)} |a\ket |\eta_a\ket \xrightarrow{(2)} |0\ket |\eta_a\ket$$
(1): get $\eta_a\ket$ from $|a\ket$ while \emph{remembering} $|a \ket$;\\
(2): \emph{erase/forget} $|a\ket$.\\
For (1), first do $|0\ket \to |\xi\ket = \frac{1}{\sqrt{\mathcal{Q}}} \sum_{b=0}^{\mathcal{Q}-1} |b\ket$ as follows:\\
on $m$ qubits $\mathcal{H}^{\otimes m}$ gives $\frac{1}{\sqrt{M}} \sum_{x=0}^{2^m-1} |x\ket$. Then consider the step function $f(x) = 0$ if $x<\mathcal{Q}$ and 1 if $x \geq \mathcal{Q}$. It's classically efficiently computable, so can efficiently implement $U_f$ on $(m+1)$ qubits.\\
So applying $U_\rho$ to $(H^{\otimes m} |0\ket) |0\ket$ and measure output $(m+1^{st})$ qubit to get $|\xi\ket$ on first $n$ qubits if measurement result is 0.\\
Note that $prob(0) > 1/2$ as $\mathcal{Q} > 2^{m-1} = 2^m / 2$, so we can use multiple trials to give $|\xi\ket$.\\
We can do offline: failures/re-tries do not affect state to which we want to apply $QFT_{\mathcal{Q}}$. So now we have $|\tilde{\xi} = |a\ket \left(\frac{1}{\sqrt{\mathcal{Q}}} \sum_{b=0}^{\mathcal{Q}-1} |b\ket\right)$.\\
Next consider $V |a\ket |b\ket = \omega^{ab} |a\ket |b\ket$.\\
Then $V|\tilde{\xi} \ket = |a\ket |\eta_a\ket$ as we want for (1).

To implement $V$, consider
$$U:|b\ket \to \omega^b |b\ket$$
If $|b\ket$ in $m$ qubits given by $|b_{m-1} \ket ... |b_0\ket$, i.e. $b = b_{m-1} ... b_0$ in binary, then $\omega^b = \omega^{b_{m-1} 2^{m-1}}...\omega^{b_02^0}$. So $U$ is product of $1$-qubit phase gates
$$P(\omega^{2^{m-1}}) \otimes ... \otimes \P(\omega^{2^0})$$
where $P(\xi) = Diag(1,\xi)$, $|\xi|=1$ is a phase gate.

Similarly, for $C-U^{2^k}$ (starting with $U \to U^{2^k}$ i.e. $\omega^b \to \omega^{2^kb}$), and $V$ = \emph{generalised $C-U$}:
$$|a\ket |b\ket \xrightarrow{V} |a\ket U^a |b\ket$$
which is constructed as before, from $C-U^{2^k}$'s.\\
So now we have $|a\ket |0\ket \xrightarrow{(1)} |a\ket |\eta_a\ket$.

For (2), i.e. $|a\ket |\eta_a\ket \xrightarrow{(2)} |0\ket |\eta_a\ket$, \emph{if} we had $U$ with eigenstates $|\eta_a\ket$, eigenvalues $\omega^a = e^{2\pi i a/\mathcal{Q}}$, then $U_{PE}$ would give
$$|0\ket |\eta_a\ket \xrightarrow{U_{PE}} |a\ket |\eta_a\ket$$
(we are a bit loose on how information is presented -- writing eigenvalue output as $a$, and note we are assuming that PE works exactly)\\
Hence $U^{-1}_{PE}$ (\emph{inverse gates taken in reverse order}) would give desired (2)!

Consider $U:|x\ket \to |x-1\ mod\ \mathcal{Q}\ket$, and check that $U |\eta_a\ket = \omega^a |\eta_a\ket$ as wanted.\\
Now note $x \to x-k\ mod\ \mathcal{Q}$ for $k \in \Z_{\mathcal{Q}}$ is classically computable in $poly(\log\mathcal{Q})$-time, thus we also have $U^k: |x\ket \to |x-k\ mod\ \mathcal{Q}\ket$, and PE algotirhm with $m=O(\log(Q))$ lines.\\
Then implementing (1) then (2) gives $poly(\log\mathcal{Q})$ sized circuit for $QFT_{\mathcal{Q}}$.

But PE is not exact. However, using more qubit lines ($O(\log 1/\varepsilon)$ lines), we can achieve (by theorem PE(b))
$$|0\ket |\eta_a \ket \xrightarrow{U_{PE}} (\sqrt{1-\varepsilon} |a\ket + \sqrt{\varepsilon} |a^\perp \ket) |\eta_a\ket$$
(where $a^\perp$ is a state orthogonal to $|a\ket$) for any (small) deserved $\varepsilon$. Then
$$||\ |a\ket - \sqrt{1-\varepsilon} |a\ket + \sqrt{\varepsilon} | a^\perp \ket\ || = O(\sqrt{\varepsilon})$$
So
$$||\ U_{PE}^{-1} |a\ket |\eta_a\ket - |0\ket |\eta_a\ket\ || = O(\sqrt{\varepsilon})$$
(as unitaries preserve lengths). So we can approximate $QFT_{\mathcal{Q}}$ to any desired precision (omit details).

\newpage

\section{Amplitude Amplification}
Note that this is a very good name -- a fifth order literation (both starting with \emph{Ampli}).\\
Apothesis of technique in Grover's algorithm.

Some background:\\
We'll make much use of \emph{reflection operators}.

---Lecture 9---\\
A reminder that we don't have lecture next thursday.

Reflection operators:\\
$\bullet$ State $|\alpha\ket$ in $\mathcal{H}_d$ $\to$ 1-dimensional subspace $L_\alpha$ and $(d-1)$-dimensional orthogonal complement $L_\alpha^\perp$
$$I_{|\alpha\ket} \stackrel{def}{=} I-2|\alpha \times \alpha|$$
has $I_{|\alpha\ket} |\alpha\ket = -|\alpha\ket$, $I_{|\alpha\ket} |\beta\ket = |\beta\ket$ for any $|\beta \ket \perp |\alpha\ket$.\\
So $I_{|\alpha\ket}$ is reflection in $(d-1)$-dimensional subspace $L_{\alpha}^\perp$.

Note that for any unitary $U$, $U I_{|\alpha\ket} U^\dagger = I_{U|\alpha\ket}$, since $U|\alpha \times \alpha|Y^\dagger = |\xi \times \xi|$ ofr $\xi = U|\alpha\ket$ (basically a change of basis).

$\bullet$ Take $k$-dimensional subspace $A \subseteq \mathcal{H}_d$, and any orthonormal basis $|a_1\ket,...,|a_k\ket$. Then $P_A = \sum_{i=1}^k |a_i \times a_i|$ is projection operator into $A$.\\
Define $I_A = I-2P_A$. Then we have $I_A |\xi\ket = |\xi\ket$ if $|\xi\ket \in A^\perp$, and $I_A|\xi\ket = -|\xi\ket$ if $|\xi\ket \in A$.\\
So $I_A$ is reflection in $(d-k)$ dimensional mirror $A^\perp$.

Recap of Grover's algorithm (part II notes page 68-73):\\
$\bullet$ search for unique \emph{good} item in unstructured database of $N=2^n$ items formalised as: (write $B_n$ to be the set of all $n$-bit strings, $N=2^n$):
Given oracle for $f:B_n \to B$, promised that there is unique $x_0 \in B_n$ with $f(x_0) = 1$, and we wish to find $x_0$.\\
This is closely related to class NP and Boolean satisfiability problem (see part II notes p 67-68).\\
Using one query to $(n+1)$-qubit $\mathcal{U}_f$, we can implement reflection operator $I_{|x_0\ket} : |x\ket \to |x\ket$ if $x \neq x_0$, and to $-|x\ket$ if $x=x_0$.\\
(viz. apply $\mathcal{U}_f$ to $|x\ket (\frac{|0\ket - |1\ket}{\sqrt{2}})$ and discard the last qubit.)\\
Then consider \emph{Grover iteration operator} on $n$ qubits:\\
$$Q \stackrel{def}{=} -H_n I_{|0...0\ket} H_n I_{|x_0\ket} = -I_{|\psi_0\ket} I_{|x_0\ket}$$
here $H_n = H\otimes H \otimes ... \otimes H = H_n^{\dagger}$, and $|\psi_0\ket = H^n |0...0\ket = \frac{1}{\sqrt{2^n}} \sum_{x \in B_n} |x\ket$.\\
So one application of $Q$ uses 1 query to $\mathcal{U}_f$.

\begin{thm} (Grover, 1996)\\
    In 2-dimensional span of $|\psi_0\ket$ and (unknown) $|x_0\ket$, the action of $Q$ is rotation by angle $2\alpha$ where $\sin\alpha = \frac{1}{\sqrt{N}}$.\\
\end{thm}

Hence (Grover's algorithm) to find $x_0$ given $U_f$:\\
1. Make $|\psi_0\ket$;\\
2. Apply $Q$ $m$ times where $m = \frac{\arccos(\frac{1}{\sqrt{N}})}{2\arctan(frac{1}{\sqrt{N}})}$ to rotate $|\psi_0\ket$ very close to $|x_0\ket$.\\
3. Measure to see $x_0$ with high probability $\sim 1-\frac{1}{N}$.

For large $N$, $\arccos(\frac{1}{\sqrt{N}}) \approx \pi/2$, $\arcsin(\frac{1}{\sqrt{N}}) \approx \frac{1}{\sqrt{N}}$ so $m = \frac{\pi}{4} \sqrt{N}$ iterations/queries to $U_f$ suffice.\\
Classically we need $O(N)$ queries to see $x_0$ with any \emph{constant} probability (independent of $N$), so get \emph{square-root} speed up quantumly.

Amplitude Amplification:\\
Let $G$ be any subspace (\emph{good subspace}) of state space $\mathcal{H}$, and $G^\perp$ is orthogonal complement (\emph{bad subspace}) $\mathcal{J} = G \oplus G^\perp$.\\
Given any $|\psi \ket \in \mathcal{H}$, we have unique decompoisiton with \emph{real positive} coefficients
$$|\psi\ket = \sin\theta |g\ket + \cos\theta |b\ket$$
where $|g\ket \in G$, $|b\ket \in G^\perp$ normalised. Introduce reflections: flip $|\psi\ket $ and good vectors: $I_{|\psi\ket} = I-2|\psi \times \psi|$, $I_G = I-2P_G$ (projection into $G$), so $\sin\theta = ||P_G |\psi\ket||$ is the length of good projection.\\
Introduce $Q \stackrel{def}{=} -I_{|\psi\ket} I_G$.

\begin{thm} (Amplitude Amplification)\\
In the 2-dimensional subspace spanned by $|g\ket$ and $|\psi\ket$ (or equivalently by orthonormal vectors $|g\ket$ and $|b\ket$), $Q$ is rotation by $2\theta$ where $\sin\theta$ is the length of good projection of $|\psi\ket$.
    \begin{proof}
        We have $I_G|g\ket = -|g\ket$, $I_G|b\ket = |b\ket$. So $Q|g\ket = +I_{|\psi\ket} |g\ket$, $Q|b\ket = -I_{|\psi\ket} |b\ket$.\\
        Now
        \begin{equation*}
            \begin{aligned}
                I_{|\psi\ket} &= I-2(\sin\theta|g\ket + \cos\theta|b\ket)(\sin\theta\bra g| + \cos\theta\bra b|)\\
                &= I-2[\sin^2\theta |g\times g| + \sin\theta\cos\theta |g\times b| + \sin\theta\cos\theta|b \times g| + \cos^2\theta |b\times b|] |b\ket
            \end{aligned}
        \end{equation*}
        And direct calculation (using $\bra g| b\ket =0$, $\bra g|g\ket = \bra b|b\ket = 1$) gives
        \begin{equation*}
            \begin{aligned}
                Q|b\ket &= I_{|\psi\ket} |b\ket\\
                &=2\sin\theta\cos\theta |g\ket - (1-2\cos^2\theta) |b\ket\\
                &= \cos 2\theta |b\ket + \sin 2\theta|g\ket
            \end{aligned}
        \end{equation*}
        and $Q|g\ket = +I_{|\psi\ket} |g\ket = -\sin 2\theta |b\ket + \cos 2\theta |g\ket$.\\
        So in $\{|b\ket,|g\ket\}$ basis, matrix of $Q$ is exactly the matrix of rotation by $2\theta$.
    \end{proof}
\end{thm}

---Lecture 10---

Let's continue on Amplitude Amplification.

Last time we showed that $Q=-I_{|\psi\ket} I_g$ is the rotation through $2\theta$ in the plane of $|\psi\ket$ and $|g\ket$, i.e. in $|b\ket$ and $|g\ket$ (orthonormal).\\
So $Q^n|\psi\ket = \sin(2n+1)\theta |g\ket + \cos(2n+1)\theta |b\ket$, and if we measure $Q^n |\psi\ket$ for good vs bad, we get $prob(good) = \sin^2(2n+1)\theta$.\\
We want to maximize this: it is maximised when $(2n+1)\theta = \pi/2$, i.e. $n=\frac{\pi^2}{4\theta} - \frac{1}{2}$.

\begin{eg}
    \emph{If} we had $\theta =4/6$, then $n=\frac{\pi}{4\theta} - \frac{1}{2} = 1$ is an exact integer. So $Q^1$ rotates $|\psi\ket$ \emph{exactly} onto $|g\ket$, so we see good result with certainty!
\end{eg}

Generally, for given $\theta$, $n$ is not an integer. So we use $n$ to be the nearest integer to $(\frac{\pi}{4\theta} - \frac{1}{2}) \approx \frac{\pi}{4\theta}$ (for small $\theta$), which equals $O(\frac{1}{\theta} = O(\frac{1}{\sin\theta}) = O(\frac{1}{||good\ proj\ of\ |\psi||})$), and $Q^n|\psi\ket$ will be within angle $\pm \theta$ of $|g\ket$, so probability of good result is at least $\cos^2\theta \approx 1-O(\theta^2)$.

All this can be implemented oif $I_{|\psi\ket}$ and $I_G$ can be implemented. See example sheet -- for $I_G$, suffices for $G$ to be spanned by computational basis states $|x\ket$'s, and indicator function $f(x)=1$ for $x$ good and $0$ for $x$ bad efficiently computable.\\
For $I_{|\psi\ket}$, usally have $|\psi\ket =H_n|00...0\ket$ ($H$ is the Hadamard gate). Then $I_{|\psi\ket}$ can be implemented in linear $O(n)$ time.

Notes:\\
(1) In AA process, relative amplitudes of good labels in $|g\ket$ stay \emph{same} as they were in $|\psi\ket = \sin\theta|g\ket + \cos\theta |b\ket$.\\
(2) Final state is generally not exactly $|g\ket$, but \emph{if} $\sin\theta$ is \emph{known}, then we can modify AA process to make it exact, i.e. giving $|g\ket$ state exactly (see example sheet).

Applications of AA:\\
(1) \emph{Grover Search} with one or \emph{more} ($k$) good items in $N$:\\
\begin{equation*}
    \begin{aligned}
        |\psi\ket &= |\psi_0\ket = \frac{1}{\sqrt{2^n}} \sum_{x \in B_n} |x\ket\\
        &= \sqrt{\frac{k}{N}} \left(\frac{1}{\sqrt{k}} \sum_{good\ |g\ket} |x\ket\right) + \sqrt{\frac{N-k}{N}} \left(\frac{1}{\sqrt{N-k}} \sum_{x\ bad}|x\ket\right)
    \end{aligned}
\end{equation*}
$G$ spanned by good $x$'s, $\sin\theta = \frac{k}{n}$ so $Q$ is rotation through $2\theta$, $\theta=\arcsin\sqrt{k/N} \approx \sqrt{k/N}$, where $k\ll N$; and we only need $O(\sqrt{N/k})$ queries.

Note: for $2$-bit case, $N=4$ with $k=1$ good item; we have $\theta = \arcsin(1/2) = \pi/6$, so one application of $Q$ rotates $|\psi_0\ket$ exactly onto $|x_{good}\ket$, i.e. a \emph{single} query suffices to find a unique good item in four, \emph{with certainty}!

(2) Square-root sppedup of general quantum algorithms:\\
Let $A$ be a quantum algorithm/circuit (sequence of unitary gates). on input, say $|0...0\ket$. So final state is $A|0...0\ket$.\\
Good labels = desired computational outcomes
$$A|0.000\ket = \alpha|a\ket + \beta|b\ket, \alpha=\sin\theta$$
where $|a\ket$ is normalised, genrally unequal superposition $\sum_{good\ x} c_x|x\ket$.\\
So $Prob(\text{success in 1 run}) = |\alpha|^2$, so $O(\frac{1}{|\alpha|^2})$ repetitions of $A$ needed to succeed with any \emph{constant} high probability $1-\varepsilon$.

Instead use AA: assumed we can check if answer is good or bad (e.g. factoring).\\
So we can then implement $I_G:|x\ket \to -|x\ket$ if $x$ is good, and $\to |x\ket$ if $x$ is bad.\\
Consider $|\psi\ket = A|0...0\ket$ and $Q=-I_{A|0...0\ket} I_G = -(AI_{|0...0\ket} A^\dagger) I_G$. All parts are implementable ($A$ is the algorithm, $A^\dagger$ is inverse gate in reverse order, and $I_{|0...0\ket}$ see example sheet).\\
By AA theorem, $Q$ is rotation through $2\theta$, where $\sin\theta=|\alpha|$. So after $n\approx \frac{\pi}{4\theta} = O(\frac{1}{\theta}) = O(\frac{1}{\sin\theta}) = O(\frac{1}{|\alpha|})$ (for small $|\alpha|$).\\
Repetitions $A|0...0\ket$ will be rotate very near to $|g\ket$, and final measurement will succeed with high probability.\\
Each application of $\mathcal{Q}$ needs one $A$ and one $A^\dagger$; $A^\dagger$ is the \emph{inverse gate in reverse order}, i.e. the time complexity is the same, i.e. $O(\frac{1}{|\alpha|})$ repetition of $Q$ gives square root time speed up over direct method.

Also, if success probability of $A$ (i.e. $|\alpha|^2$) is known, then \emph{improved} modification of the AA process that is \emph{exact} can be applied; we convert probabilistic algorithm $A$ into \emph{deterministic} one, giving a good outcome with certainty.

\newpage

\section{Quantum Counting}

Given $f:B_n \to B$ a boolean function with an unknown number $k$ good $x$'s, we want ot \emph{estimate} $k$ (rather than just find some good $x$).

Recall that Grover operator $Q_G$ for $f$ is rotaion through $2\theta$ in 2-dimensional space of $|\psi_0 = \frac{1}{\sqrt{2^n}} \sum_{x \in B_n} |x\ket$ and its good projection $|g\ket = \frac{1}{\sqrt{k}} \sum_{good\ x} |x\ket$, with $\sin\theta = \sqrt{k/N} \approx \theta$ for $k \ll N$.

---Lecture 11---

(Did I miss a lecture?)

\subsection{Hamiltonian Simulation}

$k$-local Halmiltonians:

$H$ on $n$ qubits is a $2^n \times 2^n$ Hermitian matrix. We'll want to simulate $U=e^{-iHt}$ with a circuit of $poly(n,t)$ basic unitary gates, i.e. efficient simulation.\\
Not all $H$'s can be efficently simulated, but some physically important classes can --

\begin{defi}
    $H$ is $k$-local ($k$ is a fixed constant) on $n$ qubits if $H=\sum_{j=1}^m H_j$ where each $H_j$ is a Hermitian matrix acting on at most $k$ qubits (not necessarily contiguous).\\
    i.e. each $H_j = \tilde{H}_j \otimes I$ (on some $k$ qubits, and identity on rest of qubits).

    So $m \leq {n \choose i} =O(n^k) = poly(n)$ terms in $H$.
\end{defi}

\begin{eg}
    (1) $H=X \otimes I \otimes I - 5 Z \otimes I \otimes Y$ is $2$-local on 3 qubits.\\
    (2) Write $M_{(j)}$ to denote operator $M$ acting on $j^{th}$ qubit (and $I$ on all others). Physically important spin-spin interactions:\\
    Ising model on $n\times n$ square lattice of qubits, $H=J \sum_{i,j=1}^{n-1} Z_{(i,j)} Z_{(i,j+1)} + Z_{(i,j)}Z_{(i+1,j)}$, i.e. all nearest neighbours on square.\\
    Heisenberg model on a line: $H=\sum_{i=1}^{n-1} J_x X_{(i)} X_{(i+1)} + J_y Y_{(i)} Y_{(i+1)} + J_z Z_{(i)} Z_{(i+1)}$ (where $J,J_x,J_y,J_z$ are all real constants). This is very relevatn on chemistry (in studying covalence bonds?)
\end{eg}

Note: in general, $e^{-i\sum_{j} H_j t} \neq \prod_j (e^{-i H_j t})$ -- if the $H_j$'s don't commute.

But $e^{-iH_j t}$'s \emph{are} local unitary gates (acting on $k$ qubits each), and we'll simulate $U(t_0) = e^{-i \sum_j H_i t_0}$ in terms of these (for suitable $t$'s), and we'll have a $poly(n,t_0)$-sized circuit too.

If we want to use some standard universal gate set (to further express the above gates), then use: \emph{Solovay-Kitaev theorem}: Let $U$ be a unitary operator on $k$ (const) qubits, and $S$ any universal set of quantum gates ($S$ is the set that have property that if we look at all circuit and all finite sets, then it's dense in all circuits?? Lecturer didn't write down).\\
Then $U$ can be approximated to within $\varepsilon$ using $O(\log^c(1/\varepsilon))$ gates from $S$ with $c < 4$ (it's actually exponential in $k$, but here we consider $k$ constant).\\
So all $S$-products of length $O(\log^c(1/\varepsilon))$ get within $\varepsilon$ of any element of $U(k)$.

We'll also need a lemma about accumulation of errors (c.f. Example sheet).\\
We call this lemmma A: let $\{u_i\}, \{v_i\}$ be sets of $m$ unitary operators, with $||u_i - v_i|| < \varepsilon$ for all $i=1,2,...,m$, then
$$||u_m...u_1 - v_m...v_1|| \leq m\varepsilon$$
i.e. errors accumulate linearly.\\
Proof is an easy exercise -- induction on $m$.

Warm up: the (easy) commuting case.
\begin{prop} ($k$-local Hamiltonioans with commuting terms)\\
    $H=\sum_{j=1}^m H_j$ with $H_j$ commuting -- any local Hamiltonian with commuting terms.\\
    Then for any $t$, $e^{-iHt}$ can be approximated to within $\varepsilon$ by a circuit of $O(m\ poly(\log \frac{m}{\varepsilon}))$ gates from any given universal set.\\
    Note, as $m=O(n^k)$ this is $poly(n,\log\frac{1}{\varepsilon})$ too. Also, $\log(\frac{1}{\varepsilon})$ is the number of digits of precision in the approximation.
    \begin{proof}
        $H_j$'s commute implies that $e^{-i \sum_j H_j t} = \prod_{j=1}^m (e^{-i H_j t})$. Then SK theorem implies, for each $e^{-iH_j t}$ can be approximated to within $\varepsilon/m$ within $O(poly(\log\frac{m}{\varepsilon}))$ gates, so lemma $A$ then implies that the full product $\prod_{j=1}^m$ is then approximated to within $m(\varepsilon/m) = \varepsilon$, with a total of $O(m\ poly(\log \frac{m}{\varepsilon}))$ gates (from the universal set).
    \end{proof}
\end{prop}

Now let's look at the full non-commuting case: for any matrix $X$, write $X+O(\varepsilon)$ for $X+E$ where $||E|| = O(\varepsilon)$.

\begin{lemma} (B, Lie-Trotter product formula)\\
    Let $A,B$ be matrices with $||A|| \leq K$, $||B|| \leq k$ and $k<1$ (small).\\
    Then $e^{-iA} e^{-iB} = e^{-i(A+B)} + O(k^2)$.
    \begin{proof}
        \begin{equation*}
            \begin{aligned}
                e^{-iA} &= I-iA + \sum_{k=2}^\infty \frac{(-iA)^k}{k!}\\
                &= I-iA + (iA)^2 \sum_{k=0}^\infty \frac{(-iA)^k}{(k+2)!}\\
                &= I-iA + O(k^2)
            \end{aligned}
        \end{equation*}
        since $||(iA)^2|| < k^2$, and the remainder term is at most $1$. So
        \begin{equation*}
            \begin{aligned}
                e^{-iA} e^{-iB} &= (I-iA + O(k^2)) (I-iB + O(k^2))\\
                &= I-i(A+B) + O(k^2)\\
                &= e^{-i(A+B)} + O(k^2)
            \end{aligned}
        \end{equation*}
        by applying the inverse of above
    \end{proof}
\end{lemma}
Now apply this repeatedly to accumulate sums of $H_1,...,H_m$ in exponent. Note thta if each $||H_i|| < k$, then $||H_1+...+H_l|| < lk$, we want this to be $<1$ for all $l\leq m$.\\
So \emph{for now}, we'll assume $||H_i|| < \frac{1}{m}$ to have Lie-Trotter for all stages. Also take $t=1$ \emph{for now}.\\
Then consider
\begin{equation*}
    \begin{aligned}
        e^{-iH_1} e^{-iH_2}...e^{-iH_m} &= \left[e^{-i(H_1+H_2)}+O(k^2)\right] e^{-iH^3} ... e^{-iH_m}\\
        &= e^{-i(H_1+H_2)} e^{-iH_3} ... e^{-iH_m} + O(k^2)\\
        &= ...\\
        &= e^{-i(H_1+H_2+...+H_m)} +O(k^2)+O((2k)^2)+...+O(((m-1)k)^2)\\
        &= e^{-i(H_1+H_2+...+H_m)} + O(m^3k^2)\ (1)
    \end{aligned}
\end{equation*}
where in the second equality we used that $||AU|| = ||A||$ for any unitary $U$, and note that the sum of squares up to $m$ is of order $m^3$.

---Lecture 12---

For general finite $||H_j||$'s and $t$ values, $||H_j t|| < kt$ can be large, so interoduce $N$ (large-ish, fix later), and note
$$\frac{H_j t}{N} \text{ has } \tilde{K} = ||\frac{H_j t}{N}|| < \frac{kt}{N}\ (*)$$
can be suitably small, i.e. divide $t$ into (small) $\frac{1}{N}$ intervals,
$$U=e^{i(H_1+...+H_m)t} = [e^{i(\frac{H_1t}{N} + ... + \frac{H_mt}{N})}]^N$$
We want final error for $U$ to be $<\varepsilon$, so by lemma $A$, we want error for $[...]$ to be $<\frac{\varepsilon}{N}$.\\
So by (1) and (*), $Cm^3 \tilde{k}^2 < \frac{\varepsilon}{N}$, i.e. $Cm^3 \frac{K^2t^2}{N^2} < \frac{\varepsilon}{N}$, i.e. $N>\frac{Cm^3K^2t^2}{\varepsilon}$ (2).\\
Then
$$||e^{-iH_1t/N} e^{-iH_2t/N}...e^{-iH_mt/N} - e^{-i\frac{(H_1+...+H_m)t}{N}}|| < \frac{\varepsilon}{N}$$
so by lemma $A$ again,
$$||(e^{-iH_1t/N}...e^{-iH_mt/N})^N - e^{-i(H_1+...+H_m)t}||< \varepsilon$$
(this is $Nm$ gates if form $e^{-iH_jt/N}$, and $N$ given by (2)). So circuit size is $O(\frac{m^4(Kt)^2}{\varepsilon})$.\\
Recall for $n$ qubits and $k$-local Hamiltonians, $m=O(n^k)$, so circuit size is $O(n^{4k} \frac{(Kt)^2}{\varepsilon}) = O(n^{4k},t^2,\frac{1}{\varepsilon})$.

We have circuit $\mathcal{C}$ of size $|\mathcal{C}| = O(m^4 \frac{(Kt)^2}{\varepsilon})$ gates of form $e^{-i\tilde{H}_j/N}$ approximate to $O(t)$.\\
If we want to use standard universal set, lemma A gives each of these gates needs to be approximate to $O(\varepsilon/|\mathcal{C}|)$ to maintain an overall $O(\varepsilon)$ level approximation to $U$.\\
So by SK theorem, need $O(\log^c(|\mathcal{C}|/\varepsilon))$ gates from the universal set for each, i.e. get (modest) multiplicative factor of $O(\log^c \frac{m^4(Kt)^2}{\varepsilon^2})$ in $|\mathcal{C}|$.\\

For fixed $n,\varepsilon$, and variable $t$, the quantum process $e^{iHt}$ runs for time $t$; but our circuit simulation runs for time $O(t^2)$. By refining/improving Lie-Trotter formula, it can be shown that this can be improved to $O(t^{1+\delta})$ for any $\delta>0$ (See example sheet 2 for an example).

Harrow-Hassidim-Lloyd (HHL) quantum algorithm for linear systems of equations:\\
We'll want to solve a linear system of equations $A \mathbf{x} = \mathbf{b}$, where $\mathbf{b},\mathbf{x} \in \C^N$, and dimension $N$ is potentially \emph{very} large (we could set $N=2^n$, where $2^n$ is the least power of 2 that is greater than $N$).\\
Rather than outputting the full solution $\mathbf{x}$ itself, which would take $O(N)$ time, we instead want to compute (suitable approximates to) the value of properties of the solution, such as quadratic expressions $\mathbf{x}^T M \mathbf{x}$ e.g. total weight of some subset of components.

Very large lineary systems are important in applications: data mining/machine learning on data sets of increasingly large size to discover pattern properties in data; in science/engineering , we have numerical solutions of PDEs, where discretisation techniques (finite element methods) lead to linear systems far larger than original problem description.

The best known classical techniques take $poly(N)$ time to solve such problems.

Important parameters (for both classical and quantum algorithms):\\
$\bullet$ the system size $N$;\\
$\bullet$ the desired approximate tolerance $\varepsilon$;\\
$\bullet$ the \emph{condition number} $\kappa$ of matrix $A$, defined as ratio of largest to smallest eigenvalue size $\kappa = |\frac{\lambda_{max}}{\lambda_{min}}|$;\\
It provides intrinsic scale of the linear transformation $A$, and is a measure of how close $A$ is to being non-invertible.\\
If renormalize $A$ to have $\lambda_{max} = 1$, then $|\lambda_{min}| = 1/\kappa$, and numerical computation of $A^{-1}$ becomes less stable with increasing $\kappa$, needing more significant digits and correspondingly longer runtime.

Preliminary requirements for the HHL algorithm:\\
Aim: to compute $\varepsilon$-approximate to properties of the solution of an $N$-dimensional system $A\mathbf{x} = \mathbf{b}$ in time $poly(\log N) = poly(n)$. We'll take the property to be a quadratic expression $\mu = \mathbf{x}^T M \mathbf{x}$.

Immediate issue is how the defining ingredients viz $A$ and $\mathbf{b}$ are actually given (as reading them componently would already have taken $O(poly(N))$ time). Thus we'll need a different presentation of the problem (cf below) that is still available in applications.

The $poly(\log N)$ run time will be achieved by using only $O(\log N)$ qubits and it will never be required to write down all of $A$ or $\mathbf{b}$ or $\mathbf{x}$ in the course of the algorithm (as that would be impossible given the complexity constraints).

\newpage

\section{Example Class 1}

\subsection{Question 1}
Basic representation theory exercises.\\
For details see Part II Representation Theory.

\subsection{Question 2}
Let $G=(\Z_2^n, \oplus)$ where $\oplus$ is componentwise-addition. Subgroup $K$ generated by $a_1...a_k$, $K=\{b_1a_1 \oplus ... \oplus b_ka_k:b_1,...,b_k \in \Z_2\}$. Note that $K$ has size $2^k$ if $a_i$'s are LI, and so does any coset of $K$.\\
Then $f(x) = f(x \oplus a_i)$ for all $a_i$'s $\equiv$ $f$ constant on cosets of $K$. $f$ is $2^k$-to-$1$: $a_k$'s all linearly independent and $f$ different on different cosets.

Shift invariant states: For $\Z_2$ irreps are $\chi_a(x) = (-1)^{ax)}$, $a,x \in \Z_2$ ($-1$ is the 2nd root of unity). So irreps on $(\Z_2)^n$ are $\chi_a(x) =(-1)^{a_1x_1} ... (-1)^{a_nx_n}$ where $a=a_1...a_n$, $x=x_1...x_n$ are in $\Z_2^n$.\\
We also introduce a dot product $a \cdot x = a_1x_1 \oplus ... \oplus a_n x_n \in \Z_2$ where $\oplus$ here is $+$ modulo 2.\\
So shift invariant states
$$|\chi\ket = \frac{1}{\sqrt{|G|}} \sum_g \overline{\chi(g)} |g\ket$$
So
$$|\chi_a\ket = \frac{1}{\sqrt{2^n}} \sum_{b \in \Z_2^n} (-1)^{a\cdot b} |b\ket$$
in $n$ qubits. So
$$(QFT)_{alr(?)} = \frac{1}{\sqrt{2^n}} (-1)^{a \cdot b} = \frac{1}{\sqrt{2^n}} (-1)^{a_1b_1}...(-1)^{a_nb_n}$$
so $QFT = H \otimes H \otimes ... \otimes H$ where $H$ is the Hadamard gate.\\
For second part, it's just calculation:\\
Probability that first string is LI is $1-2^{-m}$ (just exclude $0...0$);\\
Probability that first 2 strings are LI given the first is is $1-2/2^m$ (i.e. as 1st string $x_1$ spans 2 strings, namely $0...0$ and $x_1$).\\
...Probability that first $j$ strings are LI given the first $j-1$ are is $1-2^{j-1}/2^m$.\\
So by Bayes rule, probability that all of them are LI is $(1-1/2^m)...(1-2^{m-2}/2^m)(1-2^{m-1}/2^m)$. Use the hint given we get that is at least $\frac{1}{2}(1-1/2) =1/4$.

Stanrdard HSP algorithm:\\
1. query to $f$, get random coset state $|y \oplus K \ket = \frac{1}{\sqrt{2^n}} \sum_{x \in K} | y \oplus x\ket, y \in \Z_2^n$.\\
Apply $QFT=H^{\otimes n}$ and measure; our theory assures that output is then uniformly random $c\in(\Z_2)^n$ s.t. irrep $\chi_c$ of $G$ restricted to $K$ is \emph{trivial irrep} of $K$, i.e .$\chi_c(a) = 1$ for all $a \in K$.\\
So $(-1)^{a \cdot c} = 1$ for all $a \in K$, i.e. $c \cdot a = 0 \pmod 2$ for all $a=K$, i.e. $c_1a_1\oplus ... \oplus c_na_n=0$ for $a=a_1...a_n$.\\
We know $K$ viewed as subspace of $(\Z_2)^n$ ($n$ dimensional vector space over field $\Z_2$) has dimension $k$. So $(n-k)$ LI $c_i$'s with $c_1 \cdot a=0$ suffice to determine $K$ as null spaceof linear system of $(n-k)$ equations.\\
So run HSP algorithm $(n-k)$ times: by (b) we'll get $(n-k)$ LI $c's$ with probability at least 1/4, and we can solve for elements of $K$.

\end{document}


\documentclass[]{llncs}

\def\shownotes{1}
\def\notesinmargins{0}

\usepackage{fullpage}

\usepackage{amsmath,color,xcolor,hyperref,graphicx,wrapfig,listings}

\ifnum\shownotes=1
\ifnum\notesinmargins=1
\newcommand{\authnote}[2]{\marginpar{\parbox{\marginparwidth}{\tiny %
  \textsf{#1 {\textcolor{blue}{notes: #2}}}}}%
  \textcolor{blue}{\textbf{\dag}}}
\else
\newcommand{\authnote}[2]{
  \textsf{#1 \textcolor{blue}{: #2}}}
\fi
\else
\newcommand{\authnote}[2]{}
\fi

\newcommand{\lnote}[1]{{\authnote{\textcolor{orange}{Leo notes}}{#1}}}
\newcommand{\knote}[1]{{\authnote{\textcolor{green}{kushti notes}}{#1}}}
\newcommand{\mnote}[1]{{\authnote{\textcolor{blue}{morphic notes}}{#1}}}

\newcommand{\ret}{\mathsf{ret}}
\newcommand{\new}{\mathsf{new}}
\newcommand{\hnew}{h_\mathsf{new}}
\newcommand{\old}{\mathsf{old}}
\newcommand{\op}{\mathsf{op}}
\newcommand{\verifier}{\mathcal{V}}
\newcommand{\prover}{\mathcal{P}}
\newcommand{\key}{\mathsf{key}}
\newcommand{\nextkey}{\mathsf{nextKey}}
\newcommand{\node}{\mathsf{t}}
\newcommand{\parent}{\mathsf{p}}
\newcommand{\leaf}{\mathsf{f}}
\newcommand{\vl}{\mathsf{value}}
\newcommand{\balance}{\mathsf{balance}}
\newcommand{\lft}{\mathsf{left}}
\newcommand{\rgt}{\mathsf{right}}
\newcommand{\lbl}{\mathsf{label}}
\newcommand{\direction}{\mathsf{d}}
\newcommand{\oppositedirection}{\bar{\mathsf{d}}}
\newcommand{\found}{\mathsf{found}}
\newcommand{\mypar}[1]{\smallskip\noindent\textbf{#1.}\ \ \ }
\newcommand{\ignore}[1]{}

\newcommand{\langname}{$\Sigma$-State}
\newcommand{\lst}[1]{\text{\lstinline[basicstyle={\ttfamily}]$#1$}}

\begin{document}

\title{\langname, an Alternative to Bitcoin Script}

%\author{Leonid Reyzin\inst{1,3}, Dmitry Meshkov\inst{2}, Alexander Chepurnoy\inst{2}}

%\institute{Boston University \\\email{reyzin@bu.edu} \and
%IOHK Research \\\email{\{dmitry.meshkov,alex.chepurnoy\}@iohk.io} \and

\maketitle

\begin{abstract}
We report on design and implementation of \langname, a more powerful, protocol-friendly and at the same more secure language than the  Script language used in Bitcoin. We provide some examples of scripts in the language.
\end{abstract}

\section{Introduction}

Since very early days, Bitcoin~\cite{Nak08} is not just about simple money transfers: it has a scripting language named Bitcoin Script. The language is a primitive stack-based language without loops. A program in this language is protecting a transaction output~(usually, from a party who does not know some secret information). To spend the output, a spending transaction must provide a script in the same language, such as concatenation of both scripts is to be interpreted in {\em true} value on top of the stack. Combined with a maximum size of a 10 kilobytes, the absence of loops provides a guarantee of strictly finite validation time. However, some denial-of-service attacks were found against script validation time. \knote{links}

Smart contracts platform Ethereum is allowing arbitrary program to be run on top of blockchain. \knote{continue}

Our paper is introducing a new language, which is more powerful than Bitcoin Script, and more friendly to cryptographic protocols and applications. It is also providing better guarantees for validation to be finished within target timeout. \knote{continue}

The idea behind the language is that a subset of zero-knowledge protocols known as $\Sigma$-protocols (sigma protocols) could be combined via $\land$ and $\lor$ connectives forming complex statements like ``prove me a knowledge of discrete logarithm of (publicly known) $x_1$ or knowledge of Pedersen commitment $x_2$ preimage''. We make an observation that sigma protocol statements and theit conjectures are isomorphic to boolean values, and we can add arbitrary boolean predicates to a statement provable via a $\Sigma$-protocol, if both prover and verifier are able to evaluate the predicates in exactly the same way. This is the case if predicates are evaluated deterministically in the same way by both the prover and the verifier, and inputs for the predicates are the same on both sides. We use predicates over state of blockchain system during script validation~(which happens when a transaction tries to spend an output protected by the script). To avoid inefficient processing and impossibility for a light client to validate a transaction, this state is very lean but nevertheless it is richer than in Bitcoin. Like in Bitcoin, we use current height of the blockchain, but also a spending transaction with outputs it creates and outputs it tries to spend. Unlike Bitcoin, we allow outputs to contain more fields than amount and protecting script, in form of additional registers an outut can have. In addition to $\land$ and $\lor$ connectives, we have different operations over typed arguments. We filter out trivially wrong expressions, like $2 + 2 > true$, thanks to a type system used.

In blockchain systems, there is a strict need to tackle the problem of denial-of-service attack carrying by crafting scripts which are too costly to validate. For example, if it is needed for more time to validate a script than average delay between blocks on commodity hardware, network could be obviously attacked, with nodes stuck in processing, and also increased number of forks as result.

\subsection{Organization of the Paper}

\section{Related Work}

\knote{A good survey is available at https://arxiv.org/pdf/1801.00687.pdf, pg. 11}

\begin{itemize}
    \item{Simplicity}
    \item{Plutus}
    \item{TypeCoin}
    \item{Rholang}
\end{itemize}

\section{Language Design}

We assume that a {\em prover} and a {verifier} have a shared context. As we are designing a language for cryptocurrencies, this context is about current state of the blockchain (such as height $h$ of a best block in the blockchain, a spending transaction with outputs it spends and newly created outputs, etc). Please note that the language can be repurposed for other areas where shared context is possible, but this is out of scope of the paper.

\subsection{Notation}

We use $dlog(x)$ to denote a statement ``prove a knowledge of such $w$ that $x = g^w$''. Proving is to be done in zero knowledge~(with no presenting the secret $w$). Statement $dlog(x_1) \land dlog(x_2)$ means ``prove a knowledge of both $w_1$ and $w_2$, such as $x_1 = g^{w_1}, x_2 = g^{w_2}$'', similarly, $dlog(x_1) \lor dlog(x_2)$ is about a proof knowledge of whether $w_1$ or $w_2$.

\subsection{UTXO model}

We assume a transactional model close to Bitcoin's. That is, a transaction spends unspent outputs from previous transaction written into the blockchain, and creates new outputs. An output is associated with arbitrary amount of money, and also a protecting script. In Bitcoin, there is a special kind of transaction, so-called {\em coinbase transaction}, which can create some amount of money out of thin air~(to reward a block generator). In Bitcoin transaction fees money flow is not captured in outputs, a transaction fee is just a difference of amounts of outputs being spent and outputs being created. In Appendix~\ref{apx:unified} we provide a way to avoid coinbase transactions, and also express fees explicitly as outputs. In Appendix~\ref{apx:account} we discuss how to make a language for a cryptocurrency with account-based transactions~(such as Waves).

\subsection{General Idea}

By using a $\Sigma$-protocol, a prover can prove a knowledge of secret information corresponding to publicly known values, in zero-knowledge, for some relations between secret and public values. Unlike generic proof systems, $\Sigma$-protocols are efficient~(for both the prover and the verifier). For a cryptocurrency setting, the pros of this class of protocols are generic transformation from an interactive protocol to non-interactive one~(by using Fiat-Shamir transformation), and also composability: we can combine statements provable with $\Sigma$-protocols via $\land$, $\lor$ and k-out-of-N conjectures, and the compound statement is also provable via a $\Sigma$-protocol. An observation which is lying in the foundation of our work is that we can view a (potentially complex) statement provable via a $\Sigma$-protocol as a logic formula. For example, the statement $dlog(x_1) \lor dlog(x_2)$ could be viewed as a logic formula consisting of two boolean values. Then we can enrich the language of $\Sigma$-protocols (which describes relations between prover's secrets and their publicly known images) with deterministic predicates over a context shared between the prover and the verifier. Still, we are using only $\land$, $\lor$ and k-out-of-N conjectures. By evaluating predicates over the context into concrete boolean values and then eliminating them, both (honest) the prover and verifier do agree on the same reduction procedure output, which could be one of the following: boolean value (true or false) or a statement provable via a $\Sigma$-protocol. However, in the light of denial-of-service attacks found against scripting capabilities of Bitcoin and Ethereum \knote{todo: links}, we need to limit possible complexity of the reduction procedure. For that, we have two measures against possible overload issues. In the first place, we have to use only context which is efficiently computable. For example, we can not have predicates over transactional history, as it is linearly growing with time, and also could not be hold by a light client. In opposite, we can use height of a block which contains the transaction spending the output of interest, access to this information is constant-time and available to light clients. If a validation state~(which is similar to UTXO set in Bitcoin for Bitcoin-like cryptocurrencies) is authenticated~(like proposed in the paper \knote{cite AVL paper}), we can construct a predicate for existence of an unspent output (with some conditions to be met), then the prover is providing a Merkle proof for an output satisfying the predicate, and even a light client can validate the predicate efficiently. In the second place, we put a limit on size of an initial logic formula which protects an output, and also we take care that the formula will not become too big due rewritings (as some transformations in our proposal could actually increase a size of the formula) and number of transformations is below an upper limit.

\subsection{Model}

An output to spend is protected by a logical expression, which we are also calling a {\em guarding expression}. An expression is a mix of predicates over publicly known context, and statements provable via sigma protocols. As a simplest example, consider the following statement:

\begin{equation}
\label{eq:example1}
dlog(x_1) \lor ((h > 5) \land dlog(x_2))
\end{equation}

which is to be read as ``proof of knowledge of a secret with public image $x_1$ is always enough, also, if height of a block containing spending transaction is more than 5, knowledge of a secret with public image $x_2$ is also enough''.

Both the prover and the verifier are first reducing the statement by substituting shared context variables and evaluating parts of the expression which are possible to evaluate. Four outcomes of the reduction process are possible: {\em true}, {\em false}, failure to reduce~(if statement is invalid, or transformations of it are taking too much time or result in unreasonably big statement), which is equivalent to {\em false}; or statement which contains only cryptographic statements. For the example, if $h = 10$, the reduced statement is $dlog(x_1) \lor dlog(x_2)$. In this case, the prover is generating a proof, and verifier is checking validity of the proof, accepting or rejecting it. We use cryptographic statements which are provable via {\em sigma protocols}~(\knote{links}). These protocols are efficient zero-knowledge \knote{special honest verifier ZK actually} proof-of-knowledge protocols which are composable via $\land$, $\lor$ and k-out-of-N conjectures, also any sigma protocol has a standard way to be converted into a signature by using the Fiat-Shamir transformation.

In addition to secret information, which knowledge is to be proven in zero-knowledge, we allow prover to enhance context with custom variables. For example, for the statement:

$$dlog(x) \land (blake2b256(c) = C)$$

where $C$ is some constant~\footnote{we avoid provide a value for the constant due to column size limit}, and $blake2b256$ is operation which calculates hash value for function Blake2b256~(\knote{link}). The prover then needs to prove knowledge of discrete logarithm of $x$ and also to present value $c$ such as Blake2b256 on $c$ evaluates to $C$. Even if verifier does not know $c$ before being presented a proof, we can not count $c$ as secret, as it could be replayed by an eavesdropper.

\subsection{Language Details}
\label{sec:lang-details}

Here we provide details on building blocks of the language.
Both the prover and the verifier are doing the same first few steps, and they both are using the same deterministic interpreter. In the first place, the interpreter is parsing incoming expression~(in typical case of validating a transaction within a block, it is encoded in a binary form), building a tree from the expression, and checking that the expression is well-formed according to typing rules. We describe types and typing rules in Section~\ref{sec:types}. The interpreter then is reducing the expression by applying rewriting rules to the tree as described in the Section~\ref{sec:rewriting}. The possible result of the reduction is whether an abort, or a successfully reduced expression, which could be whether a boolean value or a statement provable via a $\Sigma$-protocol. For the latter case, the prover and the verifier are doing different jobs: the prover is proving knowledge of secrets associated with the statement, as described in Section~\ref{sec:proving}; the verifier is checking a proof generated by the prover against the statement, as described in the Section~\ref{sec:verifying}.

The interpreter is also checking that the expression is not exceeding by number of sub-expressions and their cumulative complexity some predefined limit~(which is the same for the prover and the verifier, e.g a constant of a blockchain system, or changed by miners in predictable and controllable fashion, like gas limit per block in Ethereum). As complexity is going beyond the limit, the interpreter aborts immediately.

\subsection{Types}
\label{sec:types}

All the operations as well as operands have types. For example, addition operation ``+'' takes two integers and returns an integer. Comparison operation ``$>$'' takes two integers and returns a boolean value. We consider statements provable via $\Sigma$-protocols, like $dlog(x)$ as instances of the boolean type. The interpreter checks that all the nodes in the tree have children of appropriate types, and the whole guarding expression~(the root node of the tree) has a boolean type and rejects the expression if the conditions are not met.

We have following types in the language:

\begin{itemize}
    \item{signed 64-bits integer}
    \item{boolean}
    \item{byte array}
    \item{collection}
    \item{avl+ tree verification data}
    \item{group element}
    \item{box}
\end{itemize}

\knote{todo: improve description, also, add unsigned integer?}

\ignore{
\begin{center}
    \begin{tabular}{| l | l | l | l | l |}
    \hline
    Operation & bytes & ints & prop & bool \\ \hline
    $=$ & + & + & + & + \\
	$\neq$ & + & + & + & +\\
	$+$ & + & + & - & - \\
	$-$ & - & + & - & - \\
	$>$ & - & + & - & - \\
	$\ge$ & - & + & - & -\\
	$<$ & - & + & - & -\\
	$\le$ & - & + & - & -\\
	$\oplus$ & + & - & - & + \\
	$\lor$ & - & - & - & + \\
	$\land$ & - & - & - & + \\
	$blake2b256$ & + & - & - & -\\
	$dlog$ & - & - & - & -\\
	$dh$ & - & - & - & -\\
    \hline
    \end{tabular}
\end{center}
}

\subsection{Rewriting a Tree}
\label{sec:rewriting}

By parsing a statement, interpreter first builds a tree from a formula. For the example~\ref{eq:example1} the tree would be as following:

\knote{draw the tree}.

If the tree is well-formed according to the typing rules, and also has complexity no more than an allowed limit, interpreter is going to rewrite it, in potentially many steps. For every step, the interpreter tries, going from bottom to top of the tree, to replace nodes which are ready to be transformed~(operands are in place, and the transformation itself is known). The next step is about the same transformations in the same bottom-top order to be done. The process finishes in one of the following cases:

\begin{itemize}
    \item{abort: } happens if transformation process by its complexity exceeds an upper bound. The complexity estimation works as follows. The interpreter remembers initial cumulative complexity $C_0$, and for each replacement in the tree it calculates cumulative complexity of a subtree to be inserted instead of a subtree to be removed $\Delta C$, and adds $\Delta C$ to current cumulative complexity $C$, where $C = C_0$ initially.
    \item{success: } we finish with this status if during last step there are no any transformations done.
\end{itemize}

If the transformations are finishing with abortion, the result is considered as $false$ (we recall that the interpreter is giving a single boolean result finally, whether an output could be spent or not). Otherwise, if the tree could not be transformed anymore the interpreter is looking into it. If the tree is about just a single node which contains boolean constant value~($true$ or $false$), the value is the result of the interpretation. If the tree contains statements not provable via $\Sigma$-protocols, the interpreter finishes with $false$. Otherwise, if the tree contains only statements provable via $\Sigma$-protocols, the interpreter is continuing to work, and here execution is different for the prover and the verifier. The prover is generating a proof for the statement by using its secrets, as described in Section~\ref{sec:proving}, and the verifier checks the statement against the proof~(provided in a spending transaction), as described in Section~\ref{sec:verifying}. The verifier outputs $true$ if the proof is valid for the statement, $false$ otherwise. We are skipping for now the question how Fiat-Shamir transformation works in our setting, and how a message, which is used in a non-interactive protocol is formed; details are given further in Appendix~\ref{apx:tx-format}.

\subsection{Proving}
\label{sec:proving}

\knote{Raw text from Leo's email, rewrite}

Prover steps:

    1. bottom-up: mark every node real or simulated, according to the following rule. DLogNode -- if you know the secret,
     then real, else simulated. $\lor$: if at least one child real, then real; else simulated. $\land$: if at least one child
     simulated, then simulated; else real. Note that all descendants of a simulated node will be later simulated, even
     if they were marked as real. This is what the next step will do.

     Root should end up real according to this rule -- else you won't be able to carry out the proof in the end.

    2. top-down: mark every child of a simulated node "simulated." If two or more more children of a real $\lor$ are real,
     mark all but one simulated.

    3. top-down: compute a challenge for every simulated child of every $\lor$ and $\land$, according to the following rules.
     If $\lor$, then every simulated child gets a fresh random challenge. If $\land$ (which means $\land$ itself is simulated, and
     all its children are), then every child gets the same challenge as the $\land$.

    4. bottom-up: For every simulated leaf, simulate a response and a commitment (i.e., second and first prover message)
     according to the Schnorr simulator. For every real leaf, compute the commitment (i.e., first prover message) according
     to the Schnorr protocol. For every $\lor$/$\land$ node, let the commitment be the union (as a set) of commitments below it.

    5. Compute the Schnorr challenge as the hash of the commitment of the root (plus other inputs -- probably the tree
     being proven and the message).

    6. top-down: compute the challenge for every real child of every real $\lor$ and $\land$, as follows. If $\lor$, then the
     challenge for the one real child of $\lor$ is equal to the XOR of the challenge of $\lor$ and the challenges for all the
     simulated children of $\lor$. If $\land$, then the challenge for every real child of $\land$ is equal to the the challenge of
     the $\land$. Note that simulated $\land$ and $\lor$ have only simulated descendants, so no need to recurse down from them.

\subsection{Verifying}
\label{sec:verifying}

Verifier steps:
    1. Place received challenges "e" and responses "z" into every leaf.

    2. Bottom-up: compute commitments at every leaf according to $a = g^z/h^e$. At every $\lor$ and $\land$ node, compute
      the commitment as the union of the children's commitments. At every $\lor$ node, compute the challenge as the XOR of
      the children's challenges. At every $\land$ node, verify that the children's challenges are all equal. (Note that
      there is an opportunity for small savings here, because we don't need to send all the challenges for a $\land$ --
      but let's save that optimization for later).

    3. Check that the root challenge is equal to the hash of the root commitment and other inputs.

\subsection{Threshold Signatures}

\subsection{Context}

Shared context of a blockchain system could be expressed in different ways, based on desired expressiveness, efficiency, planned use cases and so on. In this paper we focus on context for Ergo blockchain. The main priority for this blockchain is maximum efficiency of transaction validation process, safety, and friendliness to light clients. Considering this, we require that context should contain only spending transaction along with outputs it spends, and limited number of last block headers. Thus even a client which does not have all the headers of the blockchain~(for example, the client could be working in a light-SPV mode, where the client is holding only sublinear part of the headers-chain) is able to validate a transaction, by being shown it~(as well as outputs the transaction spends along with Merkle proofs for them).

\knote{brief context description, link to an appendix with details}

\section{Examples}

In this section we provide some examples of useful guarding scripts. We focus on examples which are impossible or much harder to express in Bitcoin Script.

\subsection{Crowdfunding}
\label{sec:crowdfunding}

We provide simple solution to crowdfunding here. In the example, a crowdfunding project associated with public key $x_P$ is considered successful if it can collect unspent outputs with total value not less than $to\_raise$ before height $timeout$. A project backer creates an output protected by the following statement:

\begin{equation*}
\begin{split}
(height \ge timeout \land dlog(x_B)) \lor \\
(height & < timeout \land dlog(x_P)\\
& \land Exists(Outputs, 20,\\
& \quad \quad \quad \quad ExtractAmount(TaggedBox(20)) \ge to\_raise \land \\
& \quad \quad \quad \quad ExtractScriptBytes(TaggedBox(20)) = ToBytes(dlog(x_P))))
\end{split}
\end{equation*}

Then the project can collect biggest outputs with total value not less than $to\_raise$ with a single transaction~(it is possible to collect up to ~22,000 outputs in Bitcoin, which is enough even for a big crowdfunding campaign). For remaining small outputs over $to\_raise$, it is possible to construct follow-up transactions.

Please note why such a guarding expression is not possible in Bitcoin: we use the condition on a spending transaction, namely, we require the transaction to have an output with value not less than required, and also with a particular statement protecting the output.

\subsection{Money With Scheduled Maintenance Payments}

\knote{description}

\begin{equation*}
\begin{split}
user\_statement \lor \\
(height & \ge (ExtractHeight(self) + period) \land \\
    & Exists(Outputs, 20, \\
    & \quad \quad \quad \quad ExtractAmount(TaggedBox(20)) \ge (ExtractAmount(self) - cost) \land \\
    & \quad \quad \quad \quad ExtractScriptBytes(TaggedBox(20)) = ExtractScriptBytes(self)))
\end{split}
\end{equation*}

We highlight impossibility of such a statement in the Bitcoin Script: similarly to the statement in the previous section~\ref{sec:crowdfunding}, we use a condition on a spending transaction. Another feature missed in the Bitcoin Script is that we also use an output to spend in the execution context. In particular, in the example above we require a spending transaction to have an output which has the same statement as an output it spends.

\subsection{Ring Signature}
\label{sec:ring}

Linear-sized ring signature is very straightforward in the language. Assume a ring consists of $m$ public keys $x_1, \dots, x_m$. If one wants an output to be spent by a ring signature associated with the ring, the output is to be protected by the following statement:

$$dlog(x_1) \lor \dots \lor dlog(x_m)$$

Please note that proving of the statement is to be done in zero-knowledge, so it is not possible to know which key signed, the only fact to conclude is that some key from the ring signed output spending.

\subsection{Complex Signature Schemes}

We can build more complex signature schemes than possible in Bitcoin. One particular example was provided in the previous Section~\ref{sec:ring}. Another example is a scheme where at least one out of (Alice, Bob), and at least one out of (Charles, Diana) are needed to sign, and it is not to be known who signed an output spending. The corresponding statement involving public keys $x_A, x_B, x_C, x_D$ of Alice, Bob, Charles and Diana respectively would be following:

$$(dlog(x_A) \lor dlog(x_B)) \land (dlog(x_C) \lor dlog(x_D))$$

\subsection{Simple Tumbler}
\label{sec:tumbler}

\knote{does the example makes sense? check other tumbler papers. also, update the scripts, now approach is more generic than using tx.outbytes}

Privacy is a tough problem for cryptocurrency users. Bitcoin is a pseudonymous cryptocurrency, so no real identities attached to a transaction. However, it is possible to reconstruct transactional graph for all the transactions ever entered into the Bitcoin blockchain, and often restore real identities by using auxiliary databases. \knote{link} To improve privacy, tumblers are being used. A tumbler is a scheme which us getting some money transfers as inputs, produces output money transfers, and has a property of unlinkability: it is not possible to draw a link from an input to an output. Thus a tumbler user is hiding herself amongst a ring of users sending inputs to the scheme. Privacy then depends on a ring size. For maximum privacy, there exists a cryptocurrency ZCash with inbuilt tumbler based on zkSnarks\knote{links}, where a user is hiding among all the users in the system. However, ZCash requires trusted setup, and transaction validation is relatively slow~(10 ms). In other cryptocurrencies users are usually using external services varying in security and efficiency.

Here we are describing simple tumbler service. It is very efficient and requires no trusted dealer. Its disadvantage is that from observing blockchain transactions it is possible to conclude that users are using a tumbler.

Assume Alice with public key $x_A$ and Bob with public key $x_B$ want to relocate funds to keys $y_1$ and $y_2$ respectively, with a property than external observer looking into blockchain is not capable to know beyond the fact that money flows from $x_A$ to whether $y_1$ or $y_2$~(and the same for $x_B$).

First, Alice and Bob communicate off-chain to construct collectively outputs of the final transaction~(payments to $y_1$ and $y_2$). Each of them then is calculating a hash value from outputs bytes $h$~(we assume that Blake2b-256 hash function is used). Then each of them is creating an output to spend~(possibly, in a dedicated transaction) with such a condition for Alice and Bob, respectively:

$blake2b256(tx.outbytes) = h \lor dlog(x_A)$

$blake2b256(tx.outbytes) = h \lor dlog(x_B)$

Then it is possible to make a refund at any moment of time~(right condition in the $\lor$ conjectures), and before a refund any of the them can construct a transaction which is spending the outputs, and it is impossible to construct an alternative transaction, for which hash of the output bytes is $h$, but bytes are different~(if chosen hash function is collision-resistant).

\subsection{Oracle Example}

\knote{Text below is just copied from code comments, polish it}

A trusted weather station is publishing temperature data on blockchain. Alice and Bob are making a contract based on the data:
they have locked coins in such way that if output from the station shows that temperature announced by the oracle is > 15 degrees, money are going to Alice, otherwise to Bob.

We consider that for validating transaction only limited number of last headers and the spending transaction should be enough, in addition to outputs being spent by the transaction. Thus there is no need for knowledge of an arbitrary output. To show the coin of the weather service in the spending transaction, outputs from Alice and Bob are referencing to the coin by using Merkle proofs against UTXO set root hash of the latest known block.

A tricky moment is how Alice and Bob can be sure that a coin is indeed created by the service, having just the coin (and also service's public key x = $g^w$, where service's secret w is not known.

For that, we consider that the service creates a coin with registers of following semantics (R0 and R1 are standard):

R1 - coin amount
R2 - protecting script, which is the pubkey of the service, $x = g^w$
R3 - temperature data, number
R4 - $a = g^r$, where r is secret random nonce
R5 - $z = r + ew mod q$
R6 - timestamp

Then Alice and Bob are requiring from the coin that the following equation holds: $g^z = a * x^e$, where $e = hash(R3 ++ R6)$

Thus Alice, for example, is created a coin with the following statement (we skip timeouts for simplicity):
"the coin is spendable by presenting a proof of Alice's private key knowledge if against UTXO set root hash for
the last known block there is a coin along with a Merkle proof, for which following requirements hold:
$R2 = dlog(x) /\ g^(R5) = R4 * x^(hash(R3 ++ R6)) /\ (R3) > 15$. Similarly, the coin is spendable by a proof of
knowledge of the Bob's private key if all the same conditions are met but $(R3) <= 15$.".

The Bob can create a box with the same guarding conditions. However, if Alice's box is already in the state, then Bob can stick to it by using the trick from the "along with a brother" test.

\section{Safety Guarantees}
\label{sec:safety}

We need to be sure that an adversary can not produce such a statement for which the Verifier spends more time than it is safe to spend.
\knote{links to verifier dilemma, orphan rates etc}

\subsection{Cost Model}
\label{sec:cost-model}

\subsection{Denial-of-Service Attacks}

\section{Extensibility}

It is hard to predict which functions would be useful for blockchain applications.

\section{Implementation and Evaluation}

\section{Further Work}

\section{Conclusion}

We show in this paper...

\bibliographystyle{splncs03}
\bibliography{sigma.bib}

\appendix

\section{Types}

\[\begin{tabular}{@{}l c l l}

      $\mathcal{T} \ni \tau$			& ::= 	    &\
         \lst{Unit} $\mid$
         \lst{Int} $\mid$ \lst{BigInt} $\mid$ \lst{Boolean} $\mid$ \lst{ByteArray} & base types     \\
      &	$\mid$	& \lst{GroupElement} 				& element of the Group  \\
      &	$\mid$	& \lst{Box} 				    & value in a box protected by proposition  \\
      &	$\mid$	& \lst{AvlTree} 				&  \mnote{give description} \\
      &	$\mid$	& $(\tau_1 \times \tau_2) $		& binary product type  \\
      & $\mid$  & $\text{\lst{Collection}}[\tau]$	    & collection type       \\
%      &   $\mid$  & $(\tau_1 + \tau_2) $					& sum type       \\
%      &   $\mid$  & $(\tau_1 \to \tau_2) $				& function type       \\
      %				& 	     	&										&				\\
%      $Term \ni e$	& ::= 		&   $l \mid x : \tau $							& integer literals and vars     \\
%      & 	$\mid$ 	& 	$\TyLam{x}{\tau}{e} \mid e_1 e_2$ 	& functions  \\
%      & 	$\mid$ 	& 	$k~\Ov{e}$ 							& constructors  \\
%      & 	$\mid$ 	& 	$\delta~\Ov{e}$ 					& primitives  \\
%      & 	$\mid$ 	& 	\lst{case} $e$ \lst{of} \{ $p_i$ $\rightarrow$ $e_i$  \}  & case analysis \\
      %				& 	$\mid$ 	& 	\lst{let} $x = e$ \lst{in} $e'$  	& let binding \\
      %				& 	     	&										&				\\
%      $k$				& ::= 		&   $\Tup{} \mid \Tup{\_, \_}$ 			& unit and pair     	\\
%      & 	$\mid$ 	&	$\Left{\tau_1}{\tau_2}{\text{\lst{\_}}} \mid \Right{\tau_1}{\tau_2}{\text{\lst{\_}}}$			& injections		\\
      %				& 	     	&										&				\\
%      $\delta$		& ::= 		&   \Fst{\_} $\mid$ \Snd{\_}			& projections     	\\
%      & 	$\mid$ 	&	$\_ \oplus \_$						& binary operations	\\
      %				& 	     	&										&				\\
%      $p$				& ::= 		&   $l \mid k~\Ov{x}$ 			& patterns     	\\
      %				& 	     	&										&				\\
%      $v$				& ::= 		&   $l \mid k~\Ov{v} \mid \TyLam{x}{\tau}{e}$ 		& values     	\\
%      & & & \\
\end{tabular}\]

\section{Tree Nodes and Transformation Rules}

\section{Cost Table}

\section{Roadmap}

\section{Outputs vs Accounts}

\section{Unified Transactions}
\label{apx:unified}

\section{An Example of a Concrete Transaction Format}
\label{apx:tx-format}

\knote{Describe Ergo transaction format here. Malleability problems to be discussed here.}

\section{A Language For An Account-Based Cryptocurrency}
\label{apx:account}

\end{document}


\documentclass[../psets.tex]{subfiles}

\pagestyle{main}
\renewcommand{\leftmark}{Problem Set \thesection}
\setcounter{section}{4}

\begin{document}

\section{Thermodynamics}
\begin{enumerate}[label={\arabic*)}]
    \item \marginnote{8/23:}\textcite{bib:YoungFreedman}: Problem 36.21.\par
    An interference pattern is produced by light of wavelength $\SI{580}{\nano\meter}$ from a distant source incident on two identical parallel slits separated by a distance (between centers) of $\SI{0.530}{\milli\meter}$.
    \begin{enumerate}
        \item If the slits are very narrow, what would be the angular positions of the first-order and second-order, two-slit interference maxima?
        \item Let the slits have width $\SI{0.320}{\milli\meter}$. In terms of the intensity $I_0$ at the center of the central maximum, what is the intensity at each of the angular positions in part (a)?
    \end{enumerate}
    \item \textcite{bib:YoungFreedman}: Problem 36.44.\par
    \textbf{Observing Jupiter.} You are asked to design a space telescope for Earth orbit. When Jupiter is $\SI{5.93e8}{\kilo\meter}$ away (its closest approach to Earth), the telescope is to resolve, by Rayleigh's criterion, features on Jupiter that are $\SI{250}{\kilo\meter}$ apart. What minimum-diameter mirror is required? Assume a wavelength of $\SI{500}{\nano\meter}$.
    \item \textcite{bib:YoungFreedman}: Problem 18.6.\par
    You have several identical balloons. You experimentally determine that a balloon will break if its volume exceeds $\SI{0.900}{\liter}$. The pressure of the gas inside the balloon equals air pressure ($\SI{1.00}{\atmosphere}$).
    \begin{enumerate}
        \item If the air inside the balloon is at a constant $\SI{22.0}{\celsius}$ and behaves as an ideal gas, what mass of air can you blow into one of the balloons before it bursts?
        \item Repeat part (a) if the gas is helium rather than air.
    \end{enumerate}
    \item \textcite{bib:YoungFreedman}: Problem 18.21.\par
    Modern vacuum pumps make it easy to attain pressures of the order of $\SI{e-13}{\atmosphere}$ in the laboratory. Consider a volume of air and treat the air as an ideal gas.
    \begin{enumerate}
        \item At a pressure of $\SI{9.00e-14}{\atmosphere}$ and an ordinary temperature of $\SI{300.0}{\kelvin}$, how many molecules are present in a volume of $\SI{1.00}{\cubic\centi\meter}$?
        \item How many molecules would be present at the same temperature but at $\SI{1.00}{\atmosphere}$ instead?
    \end{enumerate}
    \item \textcite{bib:YoungFreedman}: Problem 18.38.\par
    Perfectly rigid containers each hold $n$ moles of an ideal gas, one being hydrogen (\ce{H2}) and the other being neon (\ce{Ne}). If it takes $\SI{300}{\joule}$ of heat to increase the temperature of the hydrogen by $\SI{2.50}{\celsius}$, by how many degrees will the same amount of heat raise the temperature of the neon?
    \item \textcite{bib:YoungFreedman}: Problem 19.10.\par
    Five moles of an ideal monatomic gas with an initial temperature of $\SI{127}{\celsius}$ expand and, in the process, absorb $\SI{1500}{\joule}$ of heat and do $\SI{2100}{\joule}$ of work. What is the final temperature of the gas?
    \item \textcite{bib:YoungFreedman}: Problem 19.43.\par
    The following figure shows a $pV$-diagram for $\SI{0.0040}{\mole}$ of \emph{ideal} \ce{H2} gas. The temperature of the gas does not change during segment $bc$.
    \begin{center}
        \begin{tikzpicture}[
            xscale=2.5,
            pics/point/.style args={#1:#2}{code={
                \node [circle,fill,inner sep=1.5pt,label={#1:$#2$}] {};
            }}
        ]
            \footnotesize
            \draw (-0.2,0) -- (1,0) node[right,label={[xshift=-4pt]right:$(\si{\liter})$}]{$V$};
            \draw (0,-0.3) -- (0,2.5) node[above,label={[xshift=-4pt]right:$(\si{\atmosphere})$}]{$p$};
            \node [below left] {$O$};

            \coordinate (a) at (0.2,0.5);
            \coordinate (b) at (0.2,2);
            \coordinate (c) at (0.8,0.5);

            \draw [very thin,dashed] (a) -- (a |- 0,0) node[below]{$0.20$};
            \draw [very thin,dashed] (a) -- (a -| 0,0) node[left]{$0.50$};
            \draw [very thin,dashed] (b) -- (b -| 0,0) node[left]{$2.0$};

            \draw [blx,very thick,line join={bevel},postaction={decorate},decoration={
                markings,
                mark=at position 0.15 with \arrow{latex},
                mark=at position 0.53 with \arrow{latex},
                mark=at position 0.9 with \arrow{latex}
            }] (a) -- plot[domain=0.2:0.8] (\x,{0.4/\x}) -- cycle;

            \pic at (a) {point={[xshift=1pt,yshift=1pt]below left:a}};
            \pic at (b) {point=above:b};
            \pic at (c) {point={[xshift=-1pt,yshift=1pt]below right:c}};
        \end{tikzpicture}
    \end{center}
    \begin{enumerate}
        \item What volume does this gas occupy at point $c$?
        \item Find the temperature of the gas at points $a$, $b$, and $c$.
        \item How much heat went into or out of the gas during segments $ab$, $ca$, and $bc$? Indicate whether the heat has gone into or out of the gas.
        \item Find the change in the internal energy of this hydrogen during segments $ab$, $bc$, and $ca$. Indicate whether the internal energy increased or decreased during each segment.
    \end{enumerate}
    \item You hear the weather report on the radio. However, the announcer forgets to say what scale is being used: Celsius or Fahrenheit. If it doesn't matter, how cold is it outside?
    \item A pinhole camera can produce a surprisingly sharp image. The key is using a small hole so only a narrow bundle of rays is allowed through. However, if the pinhole is too small, then diffraction will limit the sharpness of the image. The optimum pinhole size is one that makes the fuzziness due to bundle size comparable to the fuzziness due to diffraction. Assume the distance from pinhole to screen is 1 foot, and the wavelength of the light is $\SI{5500}{\angstrom}$. What is the optimum size of the pinhole?
\end{enumerate}

\end{document}