Lov K. Grover
3C404A, Bell Labs
600 Mountain Avenue
Murray Hill NJ 07974
lkgrover@belllabs.com
1
ence, it is natural to ask  how fast can the basic identifi that are needed in the algorithm of this paper. The first is
cation problem be solved without assuming anything the creation of a configuration in which the amplitude of
about the structure of the problem? It is generally the system being in any of the 2n basic states of the sys
assumed that this limit is O ( N ) since there are N items tem is equal; the second is the WalshHadamard trans
to be examined and a classical algorithm will clearly formation operation and the third the selective rotation
take O ( N ) steps. However, quantum mechanical sys of different states.
tems can simultaneously be in multiple Schrodinger cat A basic operation in quantum computing is that
states and carry out multiple tasks at the same time. This of a “fair coin flip” performed on a single bit whose
states are 0 and 1 [Simon94]. This operation is repre
paper presents an O ( N ) step algorithm for the search
1
problem. sented by the following matrix: M =  1 1 . A bit
There is a matching lower bound on how fast 2 1 –1
the desired item can be identified. [BBBV96] show in in the state 0 is transformed into a superposition in the
their paper that in order to identify the desired element,
two states: ,  . Similarly a bit in the state 1 is
1 1
without any information about the structure of the data 2 2
base, a quantum mechanical system will need at least
transformed into , –  , i.e. the magnitude of the
Ω ( N ) steps. Since the number of steps required by 1 1
2 2
the algorithm of this paper is O ( N ) , it is within a con
1
stant factor of the fastest possible quantum mechanical amplitude in each state is  but the phase of the
algorithm. 2
amplitude in the state 1 is inverted. The phase does not
1.2 Quantum Mechanical Algorithms A good have an analog in classical probabilistic algorithms. It
comes about in quantum mechanics since the ampli
starting point to think of quantum mechanical algo
tudes are in general complex. In a system in which the
rithms is probabilistic algorithms [BV93] (e.g. simu
lated annealing). In these algorithms, instead of having states are described by n bits (it has 2n possible states)
the system in a specified state, it is in a distribution over we can perform the transformation M on each bit inde
various states with a certain probability of being in each pendently in sequence thus changing the state of the sys
state. At each step, there is a certain probability of mak tem. The state transition matrix representing this
ing a transition from one state to another. The evolution operation will be of dimension 2n X 2n. In case the ini
of the system is obtained by premultiplying this proba tial configuration was the configuration with all n bits in
bility vector (that describes the distribution of probabili the first state, the resultant configuration will have an
ties over various states) by a state transition matrix. n
– 
Knowing the initial distribution and the state transition 2
identical amplitude of 2 in each of the 2n states. This
matrix, it is possible in principle to calculate the distri
is a way of creating a distribution with the same ampli
bution at any instant in time.
Just like classical probabilistic algorithms, tude in all 2n states.
quantum mechanical algorithms work with a probability Next consider the case when the starting state
distribution over various states. However, unlike classi is another one of the 2n states, i.e. a state described by
cal systems, the probability vector does not completely an n bit binary string with some 0s and some 1s. The
describe the system. In order to completely describe the result of performing the transformation M on each bit
system we need the amplitude in each state which is a will be a superposition of states described by all possi
complex number. The evolution of the system is ble n bit binary strings with amplitude of each state hav
obtained by premultiplying this amplitude vector (that n
– 
describes the distribution of amplitudes over various 2
ing a magnitude equal to 2 and sign either + or . To
states) by a transition matrix, the entries of which are deduce the sign, observe that from the definition of the
complex in general. The probabilities in any state are
given by the square of the absolute values of the ampli 1
matrix M, i.e. M =  1 1 , the phase of the result
tude in that state. It can be shown that in order to con 2 1 –1
serve probabilities, the state transition matrix has to be
ing configuration is changed when a bit that was previ
unitary [BV93].
ously a 1 remains a 1 after the transformation is
The machinery of quantum mechanical algo
rithms is illustrated by discussing the three operations performed. Hence if x be the nbit binary string describ
ing the starting state and y the nbit binary string
2
describing the resulting string, the sign of the amplitude 3. Algorithm
of y is determined by the parity of the bitwise dot prod (i) Initialize the system to the distribution:
x⋅y 
, , …  , i.e. there is the same amplitude
uct of x and y , i.e. ( – 1 ) . This transformation is 1 1 1 1
N N N N
referred to as the WalshHadamard transformation
[DJ92]. This operation (or a closely related operation to be in each of the N states. This distribution can be
called the Fourier Transformation) is one of the things obtained in O ( log N ) steps, as discussed in section 1.2.
that makes quantum mechanical algorithms more pow (ii) Repeat the following unitary operations O ( N )
erful than classical algorithms and forms the basis for
times (the precise number of repetitions is important as
most significant quantum mechanical algorithms.
discussed in [BBHT96]):
The third transformation that we will need is
(a) Let the system be in any state S:
the selective rotation of the phase of the amplitude in
certain states. The transformation describing this for a 4 In case C ( S ) = 1 , rotate the
phase by π radians;
jφ 1
e 0 0 0 In case C ( S ) = 0 , leave the
jφ 2 system unaltered.
state system is of the form: 0 e 0 0 , where (b) Apply the diffusion transform D which
jφ 3
0 0 e 0 is defined by the matrix D as follows:
2 2
0 0 0 e
jφ 4 D ij =  if i ≠ j & D ii = – 1 +  .
N N
j = – 1 and φ 1, φ 2, φ 3, φ 4 are arbitrary real numbers. This diffusion transform, D, can be
implemented as D = WRW , where R the
Note that, unlike the WalshHadamard transformation
and other state transition matrices, the probability in rotation matrix & W the WalshHadamard
each state stays the same since the square of the absolute Transform Matrix are defined as follows:
value of the amplitude in each state stays the same. R ij = 0 if i ≠ j ;
R ii = 1 if i = 0 ; R ii = – 1 if i ≠ 0 .
2. The Abstracted Problem Let a system As discussed in section 1.2:
have N = 2n states which are labelled S1,S2,...SN. These W ij = 2 – n / 2 ( – 1 ) i ⋅ j , where i is the
2n states are represented as n bit strings. Let there be a binary representation of i , and
unique state, say Sν, that satisfies the condition C(Sν) =
i ⋅ j denotes the bitwise dot product
1, whereas for all other states S, C(S) = 0 (assume that
for any state S, the condition C(S) can be evaluated in of the two n bit strings i and j .
unit time). The problem is to identify the state Sν. (iii) Sample the resulting state. In case C ( S ν ) = 1
there is a unique state Sν such that the final state is Sν
1
with a probability of at least  .
2
3
4. Outline of rest of paper 2
are easily verified: first, that P = P & second, that P
The loop in step (ii) above, is the heart of the algorithm. acting on any vector v gives a vector each of whose
Each iteration of this loop increases the amplitude in the
components is equal to the average of all components.
desired state by O  , as a result in O ( N ) repeti
1 2
N Using the fact that P = P , it follows immediately
tions of the loop, the amplitude and hence the probabil 2
from the representation D = – I + 2P that D = I
ity in the desired state reach O ( 1 ) . In order to see that and hence D is unitary.
the amplitude increases by O  in each repetition,
1 In order to see that D is the inversion about aver
N age, consider what happens when D acts on an arbitrary
we first show that the diffusion transform, D, can be vector v . Expressing D as – I + 2P , it follows that:
interpreted as an inversion about average operation. A
Dv = ( – I + 2P )v = – v + 2Pv . By the discussion
simple inversion is a phase rotation operation and by the
discussion in the last paragraph of section 1.2, is unitary. above, each component of the vector Pv is A where A is
In the following discussion we show that the inversion the average of all components of the vector v . Therefore
about average operation (defined more precisely below) the ith component of the vector Dv is given by
is also a unitary operation and is equivalent to the diffu
( – v i + 2 A ) which can be written as ( A + ( A – v i ) )
sion transform D as used in step (ii)(a) of the algorithm..
Let α denote the average amplitude over all states, which is precisely the inversion about average.
i.e. if αi be the amplitude in the ith state, then the aver Next consider what happens when the inversion
about average operation is applied to a vector where
N
each of the components, except one, are equal to a
∑ αi . As a result of the operation D, the
1
age is 

N 1
i=1 value, say C, which is approximately  ; the one com
N
amplitude in each state increases (decreases) so that
after this operation it is as much below (above) α as it ponent that is different is negative. The average A is
was above (below) α before the operation. approximately equal to C. Since each of the ( N – 1 )
components is approximately equal to the average, it
does not change significantly as a result of the inversion
about average. The one component that was negative to
Average (α) start out, now becomes positive and its magnitude
A B C D increases by approximately 2C , which is approximately
2
(before)  .
N
Average
Average (α)
A B C D
(before)
(after)
Figure 1. Inversion about average operation.
4
theorems 2 & 3 that it converges to the desired state.
ponents is initially O  ; one of the components is
1
N As mentioned before (4.0), the diffusion trans
form D is defined by the matrix D as follows:
initially negative.
2 2
(5.0) D ij =  , if i ≠ j & D ii = – 1 +  .
In the loop of step (ii) of section 3, first the amplitude in N N
a selected state is inverted (this is a phase rotation and
hence a valid quantum mechanical operation as dis The way D is presented above, it is not a local transition
cussed in the last paragraph of section 1.2). Then the matrix since there are transitions from each state to all N
inversion about average operation is carried out. This states. Using the WalshHadamard transformation
increases the amplitude in the selected state in each iter matrix as defined in section 3, it can be implemented as
a product of three unitary transformations as
ation by O  (this is formally proved in the next
1
N D = WRW, each of W & R is a local transition matrix. R
section as theorem 3). as defined in theorem 2 is a phase rotation matrix and is
clearly local. W when implemented as in section 1.2 is a
Theorem 3  Let the state vector before step (ii)(a) of local transition matrix on each bit.
the algorithm be as follows  for the one state that satis
fies C ( S ) = 1 , the amplitude is k, for each of the Theorem 1  D can be expressed as D = WRW ,
remaining ( N – 1 ) states the amplitude is l such that where W, the WalshHadamard Transform Matrix and R,
the rotation matrix, are defined as follows
0 < k < 
1
 and l > 0 . The change in k ( ∆k ) after R ij = 0 if i ≠ j ,
2
steps (a) and (b) of the algorithm is lower bounded by R ii = 1 if i = 0 , R ii = – 1 if i ≠ 0 .
1
∆k >  . Also after steps (a) and (b), l > 0 . W ij = 2 – n / 2 ( – 1 ) i ⋅ j .
2 N
Proof  We evaluate WRW and show that it is equal to
Using theorem 3, it immediately follows that there D. As discussed in section 3, W ij = 2 – n / 2 ( – 1 ) i ⋅ j ,
exists a number M less than 2N , such that in M repeti where i is the binary representation of i , and i ⋅ j
1
tions of the loop in step (ii), k will exceed  . Since the denotes the bitwise dot product of the two n bit strings i
2
probability of the system being found in any particular and j . R can be written as R = R 1 + R 2 where
state is proportional to the square of the amplitude, it R 1 = – I , I is the identity matrix and R 2, 00 = 2 ,
follows that the probability of the system being in the
1 1 R 2, ij = 0 if i ≠ 0, j ≠ 0 . By observing that MM = I
desired state when k is  , is k 2 =  . Therefore if the
2 2 where M is the matrix defined in section 1.2, it is easily
system is now sampled, it will be in the desired state proved that WW=I and hence D 1 = W R 1 W = – I . We
1 next evaluate D2 = WR2W. By standard matrix multipli
with a probability greater than  .
2
Section 6 quotes the argument from [BBBV96] cation: D 2, ad = ∑
bc
W ab R 2, bc W cd . Using the defini
that it is not possible to identify the desired record in
n
less than Ω ( N ) steps. tion of R2 and the fact N = 2 , it follows that
2 2
D 2, ad = 2W a0 W 0d = n ( – 1 ) a ⋅ 0 + 0 ⋅ d =  . Thus
5. Proofs 2 N
The following section proves that the system discussed 2
all elements of the matrix D2 equal  , the sum of the
in section 3 is indeed a valid quantum mechanical sys N
tem and that it converges to the desired state with a two matrices D1 and D2 gives D.
probability Ω ( 1 ) . It was proved in the previous section
that D is unitary, theorem 1 proves that it can be imple
mented as a sequence of three local quantum mechani
cal state transition matrices. Next it is proved in
5
Theorem 2  Let the state vector be as follows  for Corollary 2.2  Let the state vector be as follows 
any one state the amplitude is k1, for each of the remain for the state that satisfies C ( S ) = 1 , the amplitude is k,
ing (N1) states the amplitude is l1. Then after applying for each of the remaining ( N – 1 ) states the amplitude
the diffusion transform D, the amplitude in the one state is l. Then if after applying the diffusion transformation
(N – 1)
is k 2 =  – 1 k 1 + 2  l 1 and the amplitude in
2 D, the new amplitudes are respectively k 1 and l 1 as
N N
derived in theorem 2, then
each of the remaining (N1) states is
2 2 2
2 (N – 2) k 1 + ( N – 1 )l 12 = k + ( N – 1 )l .
l 2 =  k 1 +  l 1 .
N N Proof  Using theorem 2 it follows that
Proof Using the definition of the diffusion transform
(5.0) (at the beginning of this section), it follows that 2 ( N – 2 )2 2 ( N – 1 )2
(N – 1)  k + 4  l 2
k 1 = 
k 2 =  – 1 k 1 + 2  l 1
2 N 2 N2
N N
4( N – 2)( N – 1)
2( N – 2) – 
 kl
l 2 =  – 1 l 1 +  k 1 + l 1
2 2
N2
N N N
Similarly
Therefore:
4( N – 1 )2 2
2 (N – 2) ( N – 1 )l 12 = 
k
l 2 =  k 1 +  l 1 N2
N N
( N – 2 )2 4( N – 2)( N – 1)
+  ( N – 1 )l 2 + 
 kl .
As is well known, in a unitary transformation the total N 2 N2
probability is conserved  this is proved for the particu Adding the previous two equations the corollary fol
lar case of the diffusion transformation by using theo lows.
rem 2.
Theorem 3  Let the state vector before step (a) of the
Corollary 2.1  Let the state vector be as follows  algorithm be as follows  for the one state that satisfies
for any one state the amplitude is k, for each of the C ( S ) = 1 , the amplitude is k, for each of the remain
remaining ( N – 1 ) states the amplitude is l. Let k and l
ing ( N – 1 ) states the amplitude is l such that
be real numbers (in general the amplitudes can be com
0 < k < 
1
 and l > 0 . The change in k ( ∆k ) after
plex). Let k be negative and l be positive and k < N . 2
l
Then after applying the diffusion transform both k1 and steps (a) and (b) of the algorithm is lower bounded by
1
l1 are positive numbers. ∆k >  . Also after steps (a) and (b), l > 0 .
Proof  From theorem 2, 2 N
(N – 1) Proof  Denote the initial amplitudes by k and l, the
k 1 =  – 1 k + 2  l . Assuming N > 2 , it fol
2
N N amplitudes after the phase inversion (step (a)) by k1 and
l1 and after the diffusion transform (step (b)) by k2 and
lows that  – 1 is negative; by assumption k is nega
2
N l2. Using theorem 2, it follows that:
6
1 Fourier transform”.
assuming nontrivial N , it follows that ∆k >  . (iii) The conditional phase shift would be much eas
2 N
ier to implement if the algorithm was used in the mode
In order to prove l 2 > 0 , observe that after the phase where the function at each point was computed rather
inversion (step (a)), k 1 < 0 & l 1 > 0 . Furthermore it fol than retrieved form memory. This would eliminate the
storage requirements in quantum memory.
lows from the facts 0 < k <  & l >  (dis
1 1 (iv) In case the elements had to be retrieved from a
2 2N table (instead of being computed as discussed in (iii)), in
k1 principle it should be possible to store the data in classi
cussed in the previous paragraph) that  < N . cal memory and only the sampling system need be
l1
quantum mechanical. This is because only the system
Therefore by corollary 2.1, l2 is positive. under consideration needs to undergo quantum mechan
ical interference, not the bits in the memory. What is
6. How fast is it possible to find the needed, is a mechanism for the system to be able to feel
the values at the various datapoints something like what
desired element? There is a matching lower happens in interactionfree measurements as discussed
bound from the paper [BBBV96] that suggests that it is in more detail in the first paragraph of the following sec
not possible to identify the desired element in fewer than tion. Note that, in any variation, the algorithm must be
Ω ( N ) steps. This result states that any quantum arranged so as not to leave any trace of the path fol
lowed in the classical system or else the system would
mechanical algorithm running for T steps is only sensi
not undergo quantum mechanical interference.
tive to O ( T 2 ) queries (i.e. if there are more possible
queries, then the answer to at least one can be flipped 8. Other observations
without affecting the behavior of the algorithm). So in 1. It is possible for quantum mechanical systems to
order to correctly decide the answer which is sensitive to make interactionfree measurements by using the dual
N queries will take a running time of T = Ω ( N ) . To ity properties of photons [EV93] [KWZ96]. In these the
presence (or absence) of an object can be deduced by
see this assume that C ( S ) = 0 for all states and the allowing for a very small probability of a photon inter
algorithm returns the right result, i.e. that no state satis acting with the object. Therefore most probably the pho
fies the desired condition. Then, by [BBBV96] if ton will not interact, however, just allowing a small
T < Ω ( N ) , the answer to at least one of the queries probability of interaction is enough to make the mea
surement. This suggests that in the search problem also,
about C ( S ) for some S can be flipped without affecting it might be possible to find the object without examining
the result, thus giving an incorrect result for the case in all the objects but just by allowing a certain probability
which the answer to the query was flipped. of examining the desired object which is something like
[BBHT96] gives a direct proof of this result along what happens in the algorithm in this paper.
with tight bounds showing the algorithm of this paper is
within a few percent of the fastest possible quantum 2. As mentioned in the introduction, the search algo
mechanical algorithm. rithm of this paper does not use any knowledge about
the problem. There exist fast quantum mechanical algo
rithms that make use of the structure of the problem at
7. Implementation considerations This hand, e.g. Shor’s factorization algorithm [Shor94]. It
algorithm is likely to be simpler to implement as com might be possible to combine the search scheme of this
pared to other quantum mechanical algorithms for the paper with [Shor94] and other quantum mechanical
following reasons: algorithms to design faster algorithms. Alternatively, it
(i) The only operations required are, first, the might be possible to combine it with efficient database
WalshHadamard transform, and second, the conditional search algorithms that make use of specific properties of
phase shift operation both of which are relatively easy as the database. [DH96] is an example of such a recent
compared to operations required for other quantum application. [Median96] applies phase shifting tech
mechanical algorithms [BCDP96]. niques, similar to this paper, to develop a fast algorithm
(ii) Quantum mechanical algorithms based on the for the median estimation problem.
WalshHadamard transform are likely to be much sim
pler to implement than those based on the “large scale
7
3. The algorithm as discussed here assumes a unique [BV93] E. Bernstein and U. Vazirani, Quantum
state that satisfies the desired condition. It can be easily Complexity Theory, Proceedings 25th
modified to take care of the case when there are multiple ACM Symposium on Theory of Com
states satisfying the condition C ( S ) = 1 and it is puting, 1993, pp. 1120.
required to find one of these. Two ways of achieving this [Deutsch85] D. Deutsch, Quantum Theory, the
are: ChurchTuring principle and the univer
(i) The first possibility would be to repeat the experi sal quantum computer, Proc. Royal
ment so that it checks for a range of degeneracy, i.e. Society London Ser. A, 400, 1985,
redesign the experiment so that it checks for the degen pp. 96117.
eracy of the solution being in the range [DH96] C. Durr & P. Hoyer, A quantum algo
( k, k + 1, …2k ) for various k. Then within log N repe rithm for finding the minimum,
lanl preprint, quantph/9602016.
titions of this procedure, one can ascertain whether or
[DJ92] D. Deutsch and R. Jozsa, Rapid solution
not there exists at least one out of the N states that satis
of problems by quantum computation,
fies the condition. [BBHT96] discusses this in detail.
Proceedings Royal Society of London,
(ii) The other possibility is to slightly perturb the prob
A400, 1992, pp. 7390.
lem in a random fashion as discussed in [MVV87] so
[EV93] A. Elitzur & L. Vaidman, Quantum
that with a high probability the degeneracy is removed.
mechanical interaction free measure
There is also a scheme discussed in [VV86] by which it
ments, Foundations of Physics 23, 1993,
is possible to modify any algorithm that solves an NP
pp. 987997.
search problem with a unique solution and use it to
[KWZ96] P. Kwiat, H. Weinfurter & A. Zeilinger,
solve an NPsearch problem in general.
Quantum seeing in the dark, Scientific
American, Nov. 1996, pp. 7278.
9. Acknowledgments Peter Shor introduced [Median96] L.K. Grover, A fast quantum mechanical
me to the field of quantum computing, Ethan Bernstein algorithm for estimating the median,
provided the lower bound argument stated in section 6, lanl eprint quantph/9607024.
Gilles Brassard made several constructive comments [MVV87] K. Mulmuley, U. Vazirani & V. Vazirani,
that helped to update the STOC paper. Matching is as easy as matrix inversion,
Combinatorica, 7, 1987, pp. 105131.
10. References [Shor94] P. W. Shor, Algorithms for quantum
[BB94] A. Berthiaume and G. Brassard, Oracle computation: discrete logarithms and
quantum computing, Journal of Modern factoring, Proceedings, 35th Annual
Optics, Vol.41, no. 12, December 1994, Symposium on Fundamentals of Comp.
pp. 25212535. Science (FOCS), 1994, pp. 124134.
[BBBV96] C.H. Bennett, E. Bernstein, G. Brassard [Simon94] D. Simon, On the power of quantum
& U.Vazirani, Strengths and weaknesses computation, Proceedings, 35th Annual
of quantum computing, to be published Symposium on Fundamentals of Comp.
in the SIAM Journal on Computing. Science (FOCS), 1994, pp.116123.
[BBHT96] M. Boyer, G. Brassard, P. Hoyer & A. [VV86] L. G. Valiant & V. Vazirani, NP is as
Tapp, Tight bounds on quantum search easy as detecting unique solutions,
ing, Proceedings, PhysComp 1996 Theor. Comp. Sc. 47, 1986, pp. 8593.
(lanl eprint quantph/9605034). [Yao93] A. Yao, Quantum circuit complexity,
[BCDP96] D. Beckman, A.N. Chari, S. Devabhak Proceedings 34th Annual Symposium
tuni & John Preskill, Efficient networks on Foundations of Computer Science
for quantum factoring, Phys. Rev. A (FOCS), 1993, pp. 352361.
54(1996), 10341063 (lanl preprint,
quantph/9602016).
[Benioff80] P. Benioff, The computer as a physical
system: A microscopic quantum
mechanical Hamiltonian model of com
puters as represented by Turing
machines, Journal of Statistical Physics,
22, 1980, pp. 563591.