Abstract
There have been several research works on the hidden shift problem, quantum algorithms for the problem, and their applications. However, all the results have focused on discrete groups with discrete oracle functions. In this paper, we define the continuous hidden shift problem on \({\mathbb {R}}^n\) with a continuous oracle function as an extension of the hidden shift problem, and also define the \(\varepsilon \)-random linear disequations which is a generalization of the random linear disequations. By employing the newly defined concepts, we show that there exists a quantum computational algorithm which solves this problem in time polynomial in n.
Similar content being viewed by others
References
Simon, D.R.: On the power of quantum computation. SIAM J. Comput. 26, 1474 (1997)
Shor, P.W.: Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer. SIAM J. Comput. 26(5), 1484 (1997)
Ettinger, M., Høyer, P.: On quantum algorithms for noncommutative hidden subgroups. Adv. Appl. Math. 25(3), 239 (2000)
Ettinger, M., Høyer, P., Knill, E.: The quantum query complexity of the hidden subgroup problem is polynomial. Inf. Process. Lett. 91(1), 43 (2004)
Kuperberg, G.: A subexponential-time quantum algorithm for the dihedral hidden subgroup problem. SIAM J. Comput. 35(1), 170 (2005)
Hallgren, S.: Proceedings of the 37th Annual ACM Symposium on Theory of Computing, STOC’05, pp. 468–474 (2005)
Schmidt, A., Vollmer, U.: Proceedings of the 37th ACM Symposium on Theory of Computing, STOC’05, pp. 475–480 (2005)
Kuperberg, G.: Leibniz International Proceedings in Informatics, LIPIcs’13, vol. 22, pp. 20–34 (2013)
Friedl, K., Ivanyos, G., Magniez, F., Santha, M., Sen, P.: Proceedings of the 35th Annual ACM Symposium on Theory of Computing, STOC’03, pp. 1–9 (2003)
van Dam, W., Hallgren, S., Ip, L.: Quantum algorithms for some hidden shift problems. SIAM J. Comput. 36(3), 763 (2006)
Childs, A.M., van Dam, W.: Proceedings of the 18th Symposium on Discrete Algorithms, SODA’07, pp. 1225–1232 (2007)
Ivanyos, G.: On solving systems of random linear disequations. Quantum Inf. Comput. 8, 579 (2008)
Childs, A.M., Wocjan, P.: On the quantum hardness of solving isomorphism problems as nonabelian hidden shift problems. Quantum Inf. Comput. 7(5–6), 504 (2007)
Decker, T., Draisma, J., Wocjan, P.: Efficient quantum algorithm for identifying hidden polynomials. Quantum Inf. Comput. 9(3), 215 (2009)
Decker, T., Høyer, P., Ivanyos, G., Santha, M.: Polynomial time quantum algorithms for certain bivariate hidden polynomial problems. Quantum Inf. Comput. 14(9–10), 790 (2014)
Decker, T., Ivanyos, G., Santha, M., Wocjan, P.: Hidden symmetry subgroup problems. SIAM J. Comput. 42(5), 1987 (2013)
Kim, J.S., Bae, E., Lee, S.: Quantum computational algorithm for hidden symmetry subgroup problems on semi-direct product of cyclic groups. arXiv:1307.1183
van Dam, W., Seroussi, G.: Efficient quantum algorithms for estimating gauss sums. arXiv:quant-ph/0207131
Regev, O.: Quantum computation and lattice problems. SIAM J. Comput. 33(3), 738 (2002)
Gavinsky, D., Roetteler, M., Roland, J.: Quantum algorithm for the Boolean hidden shift problem. Lect. Notes Comput. Sci. 6842, 158 (2011)
Roetteler, M.: Leibniz International Proceedings in Informatics, LIPIcs’16, vol. 61, pp. 8:1–8:16 (2016)
Roetteler, M.: Proceedings of MFCS, vol. 2009, pp. 663–674 (2009)
Eisenträger, K., Hallgren, S., Kitaev, A., Song, F.: Proceedings of the 46th Annual ACM Symposium on Theory of Computing, STOC’14, pp. 293–302 (2014)
Biasse, J.F., Song, F.: Proceedings of the 27th Annual ACM-SIAM Symposium on Discrete Algorithms, SODA’16 (2016)
Alagic, G., Russell, A.: Advances in Cryptology, EUROCRYPT’17, pp. 65–93 (2017)
Bonnetain, X., Naya-Plasencia, M.: Hidden shift quantum cryptanalysis and implications. Lect. Notes Comput. Sci. 11272, 560 (2018)
Hallgren, S.: Polynomial-time quantum algorithms for Pell’s equation and the principal ideal problem. J. ACM 54(4), 1 (2007)
Acknowledgements
We would like to thank Fang Song for fruitful discussion. This research was supported by the National Research Foundation of Korea grant funded by the Ministry of Science and ICT (MSIT) (Grant No. NRF-2019R1A2C1006337) and (Grant No. NRF-2020M3E4A1079678). E.B. acknowledges support from the National Research Foundation of Korea grant funded by the MSIT (Grant No. NRF-2019K1A3A1A12071493), and S.L. acknowledges support from the MSIT, under the Information Technology Research Center support program (IITP-2021-2018-0-01402) supervised by the Institute for Information & Communications Technology Planning & Evaluation, and the Quantum Information Science and Technologies program of the National Research Foundation of Korea funded by the MSIT (Grant No. NRF-2020M3H3A1105796).
Author information
Authors and Affiliations
Corresponding author
Additional information
Publisher's Note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Appendix: The sample \({\tilde{y}}\) is mostly orthogonal to \({\tilde{u}}\)
Appendix: The sample \({\tilde{y}}\) is mostly orthogonal to \({\tilde{u}}\)
In this section, we show that the probability that a sample \({\tilde{y}}\) is orthogonal to \({\tilde{u}}\) is small enough when q is a sufficiently large multiple of 4. In order to do that, we consider the case when the number of \({\tilde{y}}\)’s satisfying the equation \(\left\langle {\tilde{u}},{\tilde{y}}\right\rangle =0\) attains a maximum value. Note that we get an approximation value \(\delta {\tilde{u}}\) of u with \(\left\Vert\delta {\tilde{u}}-u \right\Vert\le \delta /2\) by means of our algorithm in Sect. 4.
Proposition 12
Let \(q=4k\) for a positive integer k and let \(\varDelta =\sqrt{2^q}\) such that \(u_i^2 \le \varDelta \) for all i. Then \({\tilde{u}}=({\tilde{u}}_1,{\tilde{u}}_2,\ldots , {\tilde{u}}_n) \in {\mathbb {Z}}_{2^q}^n\) satisfies \({\tilde{u}}_i \le 2^{3k}\) for all i. The number of \({\tilde{y}}\)’s which are orthogonal to \({\tilde{u}}\) in \({\mathbb {Z}}_{2^q}^n\) has the maximum value, \(2^{k(4n-1)}\), when \({\tilde{u}}=(2^{3k},2^{3k},\dots ,2^{3k})\). Moreover, the probability that \({\tilde{y}} \in {\mathbb {Z}}_{2^q}^n\) is orthogonal to \({\tilde{u}}\) is at most \(1/2^{k}\) in our algorithm.
In order to prove Proposition 12, we first show that if \({\tilde{u}}\) has the same coordinates, then the number of \({\tilde{y}}\)’s satisfying the equation \(\left\langle {\tilde{u}},{\tilde{y}}\right\rangle =0\) in \({\mathbb {Z}}_{2^q}^n\) becomes less than or equal to the number in the case that we make one of the same coordinates of \({\tilde{u}}\) twice.
Lemma 13
For any positive integers n and k, let \(q=4k\). The number of \({\tilde{y}}\)’s which are orthogonal to \({\tilde{u}}=({\tilde{u}}_1,\dots ,{\tilde{u}}_n)\) with \({\tilde{u}}_i ={\tilde{u}}_j\) for some \(i \ne j\), is less than or equal to the number of \({\tilde{y}}\)’s which are orthogonal to \({\tilde{u}}'=({\tilde{u}}_1,\dots ,2{\tilde{u}}_i,\dots ,{\tilde{u}}_n)\) or \(({\tilde{u}}_1,\dots ,2{\tilde{u}}_j,\dots ,{\tilde{u}}_n)\).
Proof
Without loss of generality, we may assume that \({\tilde{u}}_1={\tilde{u}}_2\). We want to show that the number of \({\tilde{y}}\) satisfying \(\left\langle {\tilde{u}},{\tilde{y}} \right\rangle \equiv 0 \pmod {2^q}\) for \({\tilde{u}}=({\tilde{u}}_1,{\tilde{u}}_1,{\tilde{u}}_3,\dots ,{\tilde{u}}_n)\) is less than or equal to the number of \({\tilde{y}}\) satisfying \(\left\langle {\tilde{u}}',{\tilde{y}} \right\rangle \equiv 0 \pmod {2^q}\) for \({\tilde{u}}'=(2{\tilde{u}}_1,{\tilde{u}}_1,{\tilde{u}}_3,\dots ,{\tilde{u}}_n)\). We can establish an injective function from the solutions \({\tilde{y}}=({\tilde{y}}_1,\dots ,{\tilde{y}}_n)\) of the equation \(\left\langle {\tilde{u}},{\tilde{y}} \right\rangle =\sum _{i=1}^n{\tilde{u}}_i{\tilde{y}}_i\equiv 0 \pmod {2^q}\) to the solutions \({\tilde{y}}'=({\tilde{y}}_1',\dots ,{\tilde{y}}_n')\) of the equation \(\left\langle {\tilde{u}}',{\tilde{y}}' \right\rangle \equiv 0 \pmod {2^q}\) as follows.
Then it can be easily shown that \(\left\langle {\tilde{u}},{\tilde{y}}\right\rangle =\left\langle {\tilde{u}}',{\tilde{y}}' \right\rangle \). In fact, if \({\tilde{y}}_1=2m_1\), then
Similarly, if \({\tilde{y}}_1=2m_1-1\), then
\(\square \)
For the next step, we show that if all coordinates of \({\tilde{u}}\) have the form of \(2^t\), the number of \({\tilde{y}}\)’s which are orthogonal to \({\tilde{u}}\) becomes less than or equal to the number in the case that we change the smallest coordinates of \({\tilde{u}}\) to the second smallest one as in the following lemma.
Lemma 14
For any positive integers n and k, let \(q=4k\) and \({\tilde{u}}=(2^{t_1},\dots ,2^{t_n})\) such that \(t_i \le 3k\) for all i and \(t_i\)’s are all distinct, say \(t_{i_1}< \cdots <t_{i_n}\) with \(i_j \in [n]:=\{1, 2, \ldots , n\}\). The number of \({\tilde{y}}\)’s which are orthogonal to \({\tilde{u}}=(2^{t_1},\dots ,2^{t_n})\) in \({\mathbb {Z}}_{2^q}^n\) is less than or equal to the number of \({\tilde{y}}\)’s which are orthogonal to \({\tilde{u}}'=({\tilde{u}}_1',\dots ,{\tilde{u}}_n')\) in \({\mathbb {Z}}_{2^q}^n\) with
Proof
Suppose that \({\tilde{u}}_i'\)’s are all distinct. Without loss of generality, assume that \(t_1< t_2< \cdots < t_n\), where \(t_i \le 3k\) for all i. Then we can construct an injective functions from the solutions \({\tilde{y}}=({\tilde{y}}_1,\dots ,{\tilde{y}}_n)\) of the equation \(\left\langle {\tilde{u}},{\tilde{y}} \right\rangle \equiv 0 \pmod {2^q}\) for \({\tilde{u}}=(2^{t_1},\dots ,2^{t_n})\) to the solutions \({\tilde{y}}'=({\tilde{y}}_1',\dots ,{\tilde{y}}_n')\) of the equation \(\left\langle {\tilde{u}}',{\tilde{y}}' \right\rangle \equiv 0 \pmod {2^q}\) for \({\tilde{u}}'=(2^{t_2},2^{t_2},\dots ,2^{t_n})\) as follows.
Note that \({\tilde{y}}_1\) is a multiple of \(2^{t_2-t_1}\). Indeed, since the condition \(\left\langle {\tilde{u}},{\tilde{y}} \right\rangle =0 \pmod {2^q}\) implies that
for \(l=0,1,\ldots ,\sum _{i=1}^n {\tilde{u}}_i -1\), it is clear that \({\tilde{y}}_1=2^{t_2-t_1}\mu \) for some positive integer \(\mu \). Hence, we can see that \({\tilde{y}}_1'=2^{t_1-t_2}{\tilde{y}}_1\) must be a positive integer.
In addition, we have
\(\square \)
On the other hand, we can also consider the case that \({\tilde{u}}\) has at least one coordinate which cannot be written as the form of \(2^t\). In this case, we have the following lemma.
Lemma 15
For any positive integers n and k, let \(q=4k\) and \({\tilde{u}} \in {\mathbb {Z}}_{2^q}^n\). If there is \(j\in [n]\) such that \({\tilde{u}}_j=v 2^t\) with \(\mathrm {gcd}(v,2)=1\) and \(t \ge 0\), the number of \({\tilde{y}}\) orthogonal to \({\tilde{u}}\) in \({\mathbb {Z}}_{2^q}^n\) is exactly the same as the number of \({\tilde{y}}\)’s which are orthogonal to \({\tilde{u}}'=({\tilde{u}}_1',\dots ,{\tilde{u}}_n')\) in \({\mathbb {Z}}_{2^q}^n\) with
Proof
Without loss of generality, we may assume that \({\tilde{u}}_1=v2^t\) for some v coprime with 2 and nonnegative integer t. Then we can construct a one-to-one correspondence between the solutions \({\tilde{y}}=({\tilde{y}}_1,\dots ,{\tilde{y}}_n)\) of the equation \(\left\langle {\tilde{u}},{\tilde{y}} \right\rangle \equiv 0 \pmod {2^q}\) for \({\tilde{u}}=(v2^t,{\tilde{u}}_2,\dots ,{\tilde{u}}_n)\) to the solutions \({\tilde{y}}'=({\tilde{y}}_1',\dots ,{\tilde{y}}_n')\) of the equation \(\left\langle {\tilde{u}}',{\tilde{y}}' \right\rangle \equiv 0 \pmod {2^q}\) for \({\tilde{u}}'=(2^t,{\tilde{u}}_2,\dots ,{\tilde{u}}_n)\) as follows.
Since v is invertible in \({\mathbb {Z}}_{2^q}^n\), the above map is a bijection. In addition, we clearly have
This completes the proof. \(\square \)
Combining the above lemmas, we finally prove that the number of \({\tilde{y}}\)’s orthogonal to \({\tilde{u}}\) attains a maximum value when all coordinates of \({\tilde{u}}\) are \(2^{3k}\), which is the maximum of its each coordinate. Thus we can get an upper bound on the probability that \({\tilde{y}}\) is orthogonal to \({\tilde{u}}\).
1.1 Proof of Proposition 12
We first note that for any \({\tilde{u}}=({\tilde{u}}_1,{\tilde{u}}_2,\ldots ,{\tilde{u}}_n)\in {\mathbb {Z}}_{2^q}^n\), each coordinate \({\tilde{u}}_j\) can be expressed as \(v_j2^{t_j}\) for some \(v_j\) coprime to 2 and nonnegative integer \(t_j\). Thus by repeatedly using Lemma 15, we can know that the number of solutions \({\tilde{y}}\) of the equation \(\left\langle {\tilde{u}},{\tilde{y}} \right\rangle \equiv 0 \pmod {2^q}\) is the same as the number in the case that \({\tilde{u}}=(2^{t_1},2^{t_2},\ldots ,2^{t_n})\). Furthermore, \(u_i\le 2^k\) for all \(i\in [n]\) by the assumption, and
since \(\delta =1/2^{2k}\) and \(\delta {\tilde{u}}\) is a \(\frac{\delta }{2}\)-approximation of u. Thus it is clear that \({\tilde{u}}_i\le 2^{3k}\) for all \(i\in [n]\).
Now, let us consider the case that \({\tilde{u}}=(2^{t_1},2^{t_2},\ldots ,2^{t_n})\) with \(t_i \le 3k\) for all i. Without loss of generality, we may assume that \(t_1 \le \cdots \le t_n\). If \(t_i\)’s are all distinct, it follows from Lemma 14 that the number of the solutions \({\tilde{y}}\) of the equation \(\left\langle {\tilde{u}},{\tilde{y}} \right\rangle \equiv 0 \pmod {2^q}\) is less than or equal to the number of the solutions in the case that \({\tilde{u}}=(2^{t_2},2^{t_2},2^{t_3}\ldots ,2^{t_n})\). Therefore, by exploiting Lemma 13 and 14 repeatedly, it can be shown that the number of \({\tilde{y}}\)’s which are orthogonal to \({\tilde{u}}\) in \({\mathbb {Z}}_{2^q}^n\) has the maximum value when \({\tilde{u}}=(2^{3k},\dots ,2^{3k})\).
For the next step, we want to calculate the exact number of \({\tilde{y}}\)’s satisfying \(\left\langle {\tilde{u}},{\tilde{y}} \right\rangle \equiv 0\pmod {2^q}\) when \({\tilde{u}}=(2^{3k},\dots ,2^{3k})\). As a matter of fact, we can prove that the number of integer solutions \({\tilde{y}}\) of the equation \(2^{3k}{\tilde{y}}_1+\cdots + 2^{3k}{\tilde{y}}_n\equiv 0 \pmod {2^q}\) is equal to
for any i by induction on \(n \ge 1\). To do this, we need to show the following two claims.
Claim 1
Let \(n \ge 0\), L, and l any fixed positive integers. Then
Proof of Claim 1
We use the induction on n. If \(n=0\), the statement is obviously true. Now we suppose that Eq. (14) holds for a certain \(n\ge 0\). From the Pascal’s relation, we observe that
and hence Eq. (14) holds for \(n+1\) as well. Here, the last equality holds since
by employing the induction hypothesis l times. \(\square \)
This claim implies that for any fixed positive integers, \(n \ge 0\), L, \(L'\), and l,
By Claim 1, we can prove the following claim, which can be directly used to prove the Eq. (13).
Claim 2
For each \(i\in \{0,1,\ldots , 2^{3k}-1\}\) and \(n \ge 1\),
Proof of Claim 2
We prove this claim by induction on \(n \ge 1\). It is easy to check that the statement is true for \(n=1\). Now, suppose that it is true for a fixed \(n\ge 1\). It follows from the Pascal’s relation that
Applying the Pascal’s relation to the second binomial coefficient term in the first summation, we obtain from tedious but straightforward calculations that
where the second and the last equalities come from the induction hypothesis and Claim 1. Continuing this procedure \(2^{4k}\) times, we can show that
which completes the proof. \(\square \)
Now, we show that the number of \({\tilde{y}}\)’s satisfying \(2^{3k}{\tilde{y}}_1+\cdots + 2^{3k}{\tilde{y}}_n\equiv 0 \pmod {2^{4k}}\) is
which equals \(2^{3k}2^{4k(n-1)}\), or equivalently, \(2^{k(4n-1)}\) by Claim 2.
Let us choose a sufficiently large number \(q=4k\) such that \(n < 2^k\), let
for each \(l \in [n \cdot 2^{3k}-1]\cup \{0\}\), and let
for each \(i=1,\dots ,n\). Then the number of integer solutions \({\tilde{y}} \in {\mathbb {Z}}_{2^{4k}}^n\) of the equation \(2^{3k}{\tilde{y}}_1+\cdots + 2^{3k}{\tilde{y}}_n\equiv 0 \pmod {2^{4k}}\) is
which can be exactly calculated as follows.
For each \(t\cdot 2^{3k}\le l\le (t+1)\cdot 2^{3k}-1\) (\(t=0,1,\ldots ,n-1\)), by the inclusion-exclusion principle, we have
where the last inequality is due to the fact that for \(l<j2^{3k}\),
Let
We now show that
where the second equality is due to Claim 2.
Observe that
where the second equality comes from the Pascal’s relation. It follows from Claim 1 (or Eq. (15)) and Claim 2 that
Since the number of all possible \({\tilde{y}}\) is \(2^{4kn}\), the probability that \({\tilde{y}} \in {\mathbb {Z}}_{2^{4k}}^n\) is orthogonal to \({\tilde{u}}\) is at most \(2^{k(4n-1)}/2^{4kn}\) which is equal to \(1/2^{k}\).
Rights and permissions
About this article
Cite this article
Bae, E., Lee, S. Quantum algorithm based on the \(\varepsilon \)-random linear disequations for the continuous hidden shift problem. Quantum Inf Process 20, 347 (2021). https://doi.org/10.1007/s11128-021-03290-y
Received:
Accepted:
Published:
DOI: https://doi.org/10.1007/s11128-021-03290-y