 So, the topic of today's lecture is going to be about the quantum recording method, which I already said a few words yesterday about the framework. So this is a very recent method invented by Mark Zandri in 2018. It's quite a beautiful one. It is also particularly interesting for people doing analysis in the quantum random miracle model in cryptography. But here we will focus more on quantum quake complexity, so I won't say much about cryptographic motivation and just try to consider how we can use this method to analyze the quake complexity of some problems of interest. Okay, so this is what I already said yesterday, so this is a focus of the lecture. So just a reminder, the framework is a little bit different, the way we define the input. So it's no longer an n-bit string, now it's something over a larger alphabet. It's a vector of size n as before, but now each coordinate is an integer between 0 and n-1. Okay, I chose n-1, it could be m-1 for some number m, but just for simplicity I took the same parameter for the size of the vector and the size of the alphabet. Okay, and the way you could look at this input is really as a random function. So in cryptography you would look at function h that takes as input an integer i and that gives you a value y that is between 0 and n-1 uniformly at random. So this is how you would represent an ideal hash function. Here instead we use this vector notation but this is completely equivalent. So this y, you should think of it as being x i. I guess it's really important that the input is taken uniformly at random and we only care about average case analysis. So on average for random input you want to succeed with high probability. So let's start by the so-called classical recording method for analyzing this kind of setup. It's very simple and intuitive and then we will move to the quantum one which is a bit more intricate. So classically it may seem completely straightforward what I'm going to say but still it's quite useful and I think it's important to look at it return in a proper way. So classically this recording technique consists of sampling the input x on the fly, meaning that you will sample or coordinate just when it's going to be queried for the very first time. So at the beginning before the algorithm has done any query the input x is represented by a vector of size n where we have this special empty symbol which means that we haven't decided yet what was this part of the input. And now when there is a query, a classical query on an index i there are two cases. So if x i is not equal to this empty symbol then it means that we have already queried this part of the input so we return x i which has been recorded and if x i is empty then we have to decide what is this coordinate equal to so we sample it uniformly at random. We record the value that we just sampled and we return it to the algorithm. So we have to be consistent if the algorithm makes the same query multiple times it will observe the same value at every step. So completely straightforward but let's look at an application just to get a bit more intuition. So this is a search problem which is quite important in cryptography. This is what is called pre-image attack. So here you want to find an index i such as x i is equal to 1. So if you look at the hash function it would be finding a pre-image for some particular value. Here I picked value 1 you can pick any value of your choice. And so we would like to understand how many queries do you need on average to solve this problem. So classically this is how you can use the classical recording technique. So it's an interaction between a randomized algorithm and this recorded input. So you will have a sequence of queries let's say it first queries a second coordinate it obtains some value x 2 then the first etc. At the end you can see that we have queried value x 1 twice and we observe the same value for the two queries. So this is how the recording will evolve under classical queries. And now how can we prove lower bound for such a problem? Well there is this very natural argument which is that intuitively if the algorithm succeeds it has to find a way of forcing us to record a 1 in the input. If there is no 1 in the right hand side then in some sense it can just guess randomly where is the correct pre-image. So this intuition can be formalized mathematically by defining a progress measure which I will denote by delta t. t is the number of queries which has been done so far. And this is the probability that the value 1 that we are looking for is present in the record after t queries. So this progress is quite easy to bound classically. So you have the initial condition at the beginning. This is equal to 0 because the record is completely empty. And now by induction when you move from a certain query to the next one the probability of discovering a new 1 this is the probability of sampling a 1 this is exactly 1 over n. So the progress can increase by at most 1 over n at each classical query. And so it means that at the end if you just solve this very simple relation you obtain that you have to do at least omega n queries if you want the progress to be at least 2 third. So classically this is what we was expecting if you want to find a pre-image well on average there is nothing you can do which is non-trivial you have to kind of query all the coordinates. So what we would like to do is to try to define a similar kind of reasoning but now to handle the case of quantum queries and try to analyze the search problem for instance in a similar way. So is there any question on the classical one? Yes? Yeah, we just simulate yeah you may never have x i equal 1 but under the uniform distribution with high probability there will be a 1 somewhere. So this is also why we care about average case analysis because there are some bad inputs that do not contain anyone but they have a very small probability so it's okay to just take an into account into the average case analysis. Okay so let's move to the quantum recording method which is going to be much less trivial to define. It has different name it is also sometimes called compressed oracle for other reason that I'm not going to mention in this talk. So why did it take so much time to kind of generalize this classical method to the quantum setting? Well, at first sight it seems impossible to define a quantum recording. One such I mean one reason for which it seems impossible is because of the following simple example a quantum algorithm by definition can perform query in superposition. So for instance what it could do is it could prepare a superposition over all the possible indices let's say a uniform superposition if it wants and the output of these quantum queries will give you in the second register this superposition over all the possible x i. Okay so in some sense it seems that by doing just one quantum query we can force the recording of all the input bits. Okay if I really want to answer this kind of superposition query what could I do if I don't decide what are all the input bits input numbers. And this is a problem because classically what was really important is this ability of tracking the progress through the number of coordinate that has been sampled but if you sampled everything after just one coordinate how can you define a progress measure? So I'm going to show you how you can kind of solve this issue and I will define a quantum way of recording quantum queries which has some properties which are very close to what we have in classical recording so there will be some subtle differences but overall it will look very similar to the classical case. So there will be three important steps in the construction that I will go over. The first one will be to purify the input distribution so in some sense this uniform input distribution will be turned into a quantum state. The second step will be to define a quantum way of sampling coordinates so we will have a quantum sampling operator it's going to be a unitary operator and finally at the end we will arrive at this last object the most important one which I call the quantum recording operator this is a new way of doing quantum query but that gives you the ability to record information about what the algorithm has learned about the input yes okay the motivation I think mostly comes from cryptography because for analyzing a lot of cryptographic scheme the ability of knowing what information what query has been done is really important to do the security proof so we would like quantumly to have a way of like having a list of record of what queries has been learned by the quantum algorithm so for instance those algorithms have learned a pre-made but I mean does he learn a collision somewhere does he learn some property about the input function so we really want to formalize having learned some property or relation about the input and this is something which seems complicated to do with like polynomial method or adversary method yes so I mean what kind of properties a record has exactly this is this is the main goal of this technique like we want to be able to like quantify what is the probability that the database a record satisfies some probability so this is really the goal like being able to say something more than just the record is of size t or yeah so we want really some flexibility in quantifying if the record of the database as you call it satisfies some some probability or for just the size of the database I'm not sure that will be easier technique like even the size I mean I mean you cannot do much if you just have the size I would say but yeah maybe it's possible to do it in an easier way yeah so it's talking about the size because we will see that this quantum recording in particular satisfies a property which is in some sense in superposition we will only be able to record at most t values after t quantum queries has been made okay so in some sense we cannot force a full recording after just one quantum it will follow by the construction that I will show you okay so let's go over the three steps and before that let's again look at the definition of the standard quantum query operator that we studied again and again so on the left you have the case for binary alphabet this is what we considered so far so it acts on two registers one contain an index I the other context contains a Boolean value and the output of the query is B plus X I in the second register so now because we care about larger alphabets we have to generalize this model a little bit it's quite simple what you can just do is you can just say instead of this addition module 2 I can take an addition module n in order to keep everything being a unitary transformation so still it's not going to be the most convenient definition to use so we will use another one based on the so-called face kickback technique that you show in the first problem session so for binary alphabet those two kind of models are equivalent so instead of having the answer being writing down into the second register you can instead define a quantum query operator that apply a phase of minus one to the B times X I okay so you flip the phase if and only if B is equal to X I is equal to one okay and it's a simple exercise to prove that those two query operators give you exactly the same query complexity now if you move to larger alphabet case which is what we are interested in there is a similar trick instead of minus one you will have to take to to to replace that with the nth root of unity okay so it's really a simple extension of the same ID and the way you can prove that those two models are equivalent is by just using the quantum Fourier transform before and after applying OX for instance okay so let's start by the first step of the construction the purification of the inputs so just a reminder of the model so a quantum query algorithm is alternating between unitary and oracle gates so now the oracle gates are denoted with this plus minus sign because we use this modification of the model and for simplicity I will assume that the output now is contained into the first register instead of the second one because it is just for simplicity you can just apply a swap if you want to move the input from the second to the first register okay and psi xt is the intermediate state of the algorithm after you have applied t steps of computation so the purification is a very simple transformation this is done as follows the idea is to use an extra quantum register at the top this is represented by the green line and this extra quantum register will contain a superposition that encode the input distribution that we are interested in so if you remember I said that the input was taken uniformly at random so what we do we just take a uniform superposition over all vector x of size n where each coordinate is an integer between 0 and n minus 1 okay and in order to recover the same model as before what we have to do is we can just say now the quantum query will be controlled on this quantum register and at the end we can measure if we want this input it doesn't really matter but let's say we measure this input at the end and we will observe the same behavior for the algorithm as in the previous case okay so mathematically this is how we define this o plus minus this is controlled on the value x contained in the first register and for a particular x it applies o x plus minus on the second register okay so now we have this object psi t this is a quantum state and it generalizes those psi x t this is now the joint state of the algorithm and the input register okay so we take a summation and we have a transfer product between input x and psi x t the state when the input is equal to x okay so in some sense we just put everything in superposition both the state of the algorithm and the inputs to the to the problem and there is really no difference between the standard definition because if you trace out the first register the purification register you will recover exactly the same density matrix so there is really no disturbance at all from the point of view of the algorithm yes and what say again oh no it's not an icon icon maybe it's like a superposition over icon maybe so you see psi x t was defined here so this is for for a given x the state of the algorithm so this is a uniform superposition over many I be and now we take a further superposition over all the inputs okay so this is the first step so second step how to define this quantum sampling operation this unitary transformation that will mimic the way some classically we can sample the input bits so the idea will be again to introduce a special symbol that I will again define and denote by the empty set and we will take as initial input to this purification register the all empty vector so we have n symbols all of them are equal to the empty set okay so if we just do that of course it wouldn't mean anything so what we have to do in some sense we have to correct the input so what we do is we apply this green box which is a unitary transformation and it has to satisfy the following equality we want that when you apply s this sampling operator on each coordinate it prepares uniform superposition over all the integer between 0 and n minus 1 okay and you just have to extend this such that it is in each area and let's say permission for convenience and if you if you use such an operator then there is really no difference with the definition that I gave in the previous slide okay so let's just pick a particular definition for s a particular extension which will be convenient for during the rest of the proof so what's important is that on this particular input you have this equality and on other input you can choose s as follows so this is the definition of s so there that we apply s turns out n times so on each coordinate we have to apply s separately so I'm just giving the definition for a single coordinate but it is the same for all coordinates so if you have something empty intuitively you want to get something uniform this is really what you would do classically in classical recording we just do it in superposition so how can we extend this unitary well we can now say that if we have something which is already uniform then applying the sampling operation on it will go back to the empty state okay and finally if you have a superposition but with some phase so if you have a superposition with a non-zero phase then let's say s will keep it as it is okay so this is for for b between different from zero yes the what no no it's a superposition it's not a transfer product of psi x t you mean this no no x is the full vector okay x i is a single coordinate but x is really the full the full input okay so the way I extended the definition on of s was by using actually the Fourier state so in some sense if you have the zero Fourier state the uniform distribution then s will just permute the empty state and the uniform superposition and if you have something autogon if you have a Fourier state which is not the zero Fourier state then you just keep it as it is so in some sense the way you should think of it is when the state of the input is autogonal to the zero Fourier state the algorithm has learned what is this particular coordinate quantum quantum to me this is a free domain that tells you if you have learned something or not so an equivalent definition which will sometimes be more convenient to use is to say that if you apply s on a value y so I'm just changing the basis looking at standard basis and what you will get is the following thing so you will get y plus 1 over square root m empty minus 1 over n summation over all all z and z is between zero and n minus 1 okay so I just write this in a different way in the standard basis so you can already see that there is some difference with classical sampling classically if you sample the same value twice you just observe the same output twice quantumly because you have to be unitary you cannot just define s of y as being equal to y this may be the most most intuitive definition but if you do that you wouldn't get something which is unitary because you also want the empty record to be sent to the uniform superposition so in some sense you have a small error term which is captured by this extra quantity yes so be here it's not the same be as what like it's any be it's an integer this not what not the big the big containing the in the algorithm register yes it you will get so this is like I'm defining what happened when you apply s on any of those three states so if you apply it on this state you get the same state this is identity was the intuition for that yes as I said in some sense the fact that the state is orthogonal to the uniform superposition it means that the algorithm has fully learned this input coordinate so you don't want to sample it again you don't want to touch it again you don't want to modify this coordinate you see classically if you some if so if you have the same query twice the second time you don't change the value of the coordinate want to be this is kind of the same but in the free basis so if in the free basis you have something non-zero then you don't modify it yeah yeah so for empty sets you just keep this clip that so this is like this equation plus that equation so you can say that this is indeed like equivalent to having those two here it's it's one over n so this is like your unit vector you can check it is a unit vector so s is unitary it's Hermitian and the yeah so this will be convenient to have that s as is Hermitian it was simplified some some part of the proof okay so let's move to the third step on the last step of the construction which was about defining the quantum recording operator so this is also going to be quite simple what we what we'll do is we kind of split the identity after each query so what I mean by that is because s is Hermitian if you apply s twice or if you apply s or time if you apply s twice then you just get the identity so if I just inject s and s again in the top green line then it just does nothing from the point of view I mean it just doesn't modify the output state of of the algorithm but I can just do that again and again so in between two quantum queries I am writing down s twice so once you've done that you can you can group the unitary in a different way so this is how we do that you have this notation here this is what I what I will what I will call the quantum recording operator and it consists of applying the quantum sampling operator followed by a quantum query and then again the quantum sampling operator okay and at the very end you have to apply the sampling one more time if you just want to not disturb the computation okay so mathematically in the bottom right you have the definition of the quantum recording operator it's very similar to the quantum query operator but you have this conjugation by s before and after doing the the query okay so let me maybe write down this quantum recording operator one more time so this quantum recording operator r is obtained by applying n times the sampling operation on each input okay then applying a query and then applying again s times the sampling operator okay so if we if we draw a picture of what happens when we apply that on a basic state this could be represented as follows okay so I'm just writing down a picture of what this quantum recording operator is is doing in this quantum circuit model so um so this box okay so this box this is the definition of the quantum recording okay so this is what I call r so what does it take as input as input you have the input to the problem so it's a vector of size n instead of having a single line now I'm using n different registers x1 up to xn each of them contain a value between zero one n minus one or the empty set and you have i b and the recording operator what it is doing is applying first a sampling on each input register followed by a control quantum query and then again the sampling operation okay so it looks quite similar to what we do classically in some sense before doing the query we kind of sample and after doing the query we sample again because in some sense we want to erase um the the the information which has not been used by uh by the quantum query okay so this is the end of of the construction so just to summarize we have now a new model for doing for analyzing quantum query so on the top you have the standard quantum query model in which um you apply the usual quantum query operator on with like a purification of the uniform distribution and on the bottom you have this new model in which now the input is always the empty the empty vector of size n and now you apply this quantum recording operator that contains information about the input um and at the end you have to sample one more time and the main claim that we showed this is by construction um if you look at the state obtaining the first model the state psi t and the state obtaining the second model then you have this very simple equality which tells you that they are the same up to an application of this sampling operation okay and what's really important is that this sampling operation is only acting on the input register not on the state of the algorithm so if you trace out uh this this part of the state then from the point of view of the algorithm the two states psi t and psi t wreck they're exactly the same because there is really no disturbance at all uh introduced by by the construction okay so you may ask what why did we do all this uh stuff i mean what what is the point so what did we gain from such a construction so what what what we gain is the following thing this quantum recording operator as we will see behaves very closely to what a classical recording um um query is is is doing so we have the following proposition which i will approve in a in a moment which tells you what is the output of the quantum recording operator when you apply it on any basis state so there are two cases to to consider first what if we apply a quantum recording query uh with index i uh with phase b not equal to zero when the highest input is equal to the empty symbol okay so in some sense this is a situation in which we expect the algorithm to not has learned what is the value of xi and the second scenario that we'll try to analyze is what if we apply this quantum recording query operator but now on a basis state in which in some sense the value of xi is fixed to be equal to some value y so let's start with the first case this is a simplest one it will turn out that the output is the following thing so all the register will be the same except the highest input where what what you will get is a superposition or uniform superposition with those phases omega to the b y which encodes the same thing as a quantum uh as a standard quantum query operator okay so it's really like exactly what we would expect if we define in a very simple way what quantum recording would mean in some sense we have replaced the absence of knowledge by a superposition in which we have learned the value y with probability one over n for each possible way okay so let's look at the proof of this first result so we just have to compute what error is doing when you apply it on such a state okay so what we want to understand is if I go back to this picture now what I have is I'm looking at this state when the is when xi is equal to empty okay so here we'll have s s okay so on the left I have the input basis state on the right I want to understand what is output uh output state so first it's quite simple to see that this oh this quantum query o x will only depend on i b and the value containing the highest input register okay what the value containing the other register has no uh impact on the output of of the unitary okay so you always have that the output will be x 1 x n I mean that will all be the same except xi which can change okay and the other one will not change also so we'll have i b okay so in some sense we only have to understand what's going to happen on the highest input register okay so let's compute what's going to happen on this register so um so we start with xi being empty so the first step is to apply s the sampling operation okay so by definition what we get is a uniform superposition okay the second step is to apply the quantum query o x and this quantum query by definition will introduce phases which will be omega to the b y okay and finally last step is to apply s again and because b by assumption is not equal to zero and by definition of s this is exactly the same state so this is unchanged okay so now second case what if xi is not undefined but what if it is already equal to some value y what we may expect in the first start in the first time would be the following thing so if we really want to get something very close to classical recording then we may hope that what will happen is the following thing because y is already fixed we don't want to touch it we just want to introduce a phase corresponding at what we would get if we apply the quantum query okay so we would obtain omega to the b y and then y is unchanged um however there is an issue with such a thing um can anyone see what is why it is impossible to satisfy such an equation it's not unitary okay it's impossible to have that otherwise the transformation error wouldn't be unitary so instead what we can prove is the following thing we get this up to some error term um which is displayed on on the bottom right and this error term um it will introduce some um difficulty in applying this quantum recording technique but still in most application the norm that is introduced by this error is sufficiently small so that we can carry out the proof um in a way that makes it uh working so let's let's prove this equation it's very similar to the other case we just have to decompose the quantum um recording operation okay so the first observation is as before the only register that will matter is the register containing x i okay again you can prove that because s is her mission uh and o x only depends on i b for the other register nothing will happen yes no no b can be anything b is is chosen by the algorithm so b if you remember when i defined the quantum query operator the first definition was to say that what you get is like i b um yeah you get i b and then this is mapped to i b plus um x i modulo m no you cannot always i mean it will depend on the algorithm it it may not always be zero sometimes it makes sense to use other value than than zero it yeah yeah and you cannot just say b is always zero i mean you have to define something unitary so you really have to define the behavior for any value of b and it is part of the algorithm workspace the algorithm will decide which value b it has to use but it may not always be zero i mean there are a lot of example in which you you want to prepare some superposition over different value of b etc yes like what it is kind of a control yeah control on b yeah yeah okay so here i just took b being non-zero because if b is equal to zero it's easy to show that nothing will happen like if you apply the recording operator with b equals zero nothing happens it's just identity so we just care about b being non-zero otherwise it's very simple to to compute what's going to happen okay so x i equal to y um so first we apply s so we use the alternative definition that i gave in the first blackboard so it's going to be this so y one over square root n mt minus one over n summation over all z then we do a query so for the first register we'll get a phase okay for the second case what happened if we do if we do a query with an empty input well we can just take the convention that it behaves the same as the value zero so let's say there is no relative phase in that case and finally for z we will have a bunch of relative phase depending on hz okay and then we apply s again um okay i'm not going to detail the the computation if you do it what you will get is exactly what was written in the on the slide so now that we understand the quantum query model recording model we can try to apply it i mean the question yes which what what is not normalized it should be normalized uh except if i did a mistake but i think so the error the blue term is not normalized because but the summation of the red and the blue term should be of norm one you know they are not orthogonal so there is like the y value also appears on the term in the bottom right okay so let's conclude hopefully i will have time to show you um one application so we have defined this quantum recording framework and now we would like to apply it to uh the search problem okay as an example so recall that the search problem that we already look at the beginning of of the lecture was to find an index i such as xi is equal to one and recall that the way we could prove such a result was by defining a classical progress measure denoted by delta t which was a probability that we have recorded a one in the database after t queries so quantum is a very natural way of extending this definition uh by using a projector so what we do is we define the following projector pie it acts on both the inputs and the state of the algorithm and what we want to do is we just want to project over all basis state for which there is a one uh somewhere in in the record because exactly the same as before we just do it in in superposition and the progress measure delta t quantum is going to be the same except that we look at the squared norm of this projection apply on the state produced by the quantum recording model and now the two important uh lemma uh the following one so this is to bound how the progress evolves so first at the beginning of the computation before any query has been made the progress is equal to zero as was the case classically and secondly when you make one more quantum query then the square root of the progress is going to increase by something which is about uh one over square root n okay so this is really where there is a difference with classical recording because classically delta t was increasing by one over n but now this is the square root which is increasing by one over uh by one over one over n okay and because of that it means that you can progress much quickly toward large value okay you just need square root n steps to be larger than two-third and this is why quantumly i mean you can just prove square root n uh which correspond to what you would get if you apply Grover's algorithm for instance okay so let's uh prove those two uh lemma and then it will conclude the the lecture okay so the first lemma is very simple to to see so the first lemma is the progress is initially equal to zero okay so why is it the case where well we just have to write down what is the initial quantum recording state so this psi rec at time zero um by definition this is just all empty transferred with zero zero okay and because we project on two states that contain a one here in this register there is no one so the progress is just equal to zero okay the lemma two is more interesting so the second lemma is about upper bounding the the the progress um so okay let's do it step by step um so we want to upper bound the square root of delta t plus one okay so by definition this is the norm of the projection of uh psi rec t plus one so the state after t query okay and if we expand the definition something that we already did in previous lecture this is going to be u t plus one then a recording quantum query and then the state the state at the previous step okay so a first simplification on that is pi the projection uh that is defined by pi is only defined with respect to what is contained into the first into the input register and on the other hand the unitary they are applied on the algorithm register so those two operations are commuting and because of that we can just remove u t plus one without changing the norm so this is equal to the projection followed by the recording query and followed by the state at 90 okay next step is to use the triangle inequality so okay i'm continuing continuing the sequence of of inequality so now starting from here this is at most so what i what i can do is i can inject in between the recording query on the state i can inject pi and identity minus pi and apply triangle inequality so this is at most pi recording pi on the state plus pi recording identity minus pi on the state okay so we can already observe that the first quantity this is what will give us delta t uh because pi times r this this is like a contraction so we can remove that and this is at most the norm of pi apply on sirac plus the other quantity okay and this first term this is a square root of delta t okay so to say it again what we show is the square root of delta t plus one the progress at times t plus one is at most the progress of at time t plus a certain quantity which is we want to look at the norm of identity minus pi so this is a state for which there is no progress at all and on that state we apply one quantum recording query and we look at what progress has been introduced by this single quantum query okay so we want to look at the evolution in norm when we move from identity minus pi to uh to pi okay so now the goal will be to bomb this quantity so the claim that concludes the proof the claim is that this is at most um this is at most uh square root 10 over n okay since it's almost noon maybe i will not start the proof of the last claim um because it would it will take i think 10 minutes maybe so i will do i will do that tomorrow we start with the proof of this last claim um yeah and maybe we can stop here if you have any question um it's a good time to ask yes so yeah we can do a few other distributions so we know how to do uh product distribution meaning that you take a different distribution for each uh xi um but this is mostly mostly all all all we know how to do so like one open question is uh how to adapt this framework to like uniform distribution over permutation for instance this is like many people tried to generalize them to adapt the framework and right now there are some issues with with that but uh yeah the uniform distribution seems quite important in making everything work or marginally uniform i i don't think uh i don't even think you can do that like you really need a either full uniform or like really a product of independent distribution on each coordinate so okay tomorrow i will start by proving the claim quickly um you can try to do it as an exercise i mean you have all the ingredients that you that you need and in the problem session there will also be i think what is a nice application of this technique for the collision finding problem so like collision finding has been an important problem in the study of quantum query complexity uh i mean it has been analyzed by using some complicated application of polynomial method for instance and with quantum recording you can do the analysis in a very intuitive and very simple way so you will see that in the problem session tomorrow also