Bernstein–Vazirani algorithm

Given an oracle that implements a function ${\displaystyle f\colon \{0,1\}^{n}\rightarrow \{0,1\}}$ in which ${\displaystyle f(x)}$ is promised to be the dot product between ${\displaystyle x}$ and a secret string ${\displaystyle s\in \{0,1\}^{n}}$ modulo 2, ${\displaystyle f(x)=x\cdot s=x_{1}s_{1}+x_{2}s_{2}+\cdots +x_{n}s_{n}}$, find ${\displaystyle s}$.

Classically, the most efficient method to find the secret string is by evaluating the function ${\displaystyle n}$ times with the input values ${\displaystyle x=2^{i}}$ for all ${\displaystyle i\in \{0,1,...,n-1\}}$:[2]

${\displaystyle {\begin{aligned}f(1000\cdots 0_{n})&=s_{1}\\f(0100\cdots 0_{n})&=s_{2}\\f(0010\cdots 0_{n})&=s_{3}\\&\,\,\,\vdots \\f(0000\cdots 1_{n})&=s_{n}\\\end{aligned}}}$

In contrast to the classical solution which needs at least ${\displaystyle n}$ queries of the function to find ${\displaystyle s}$, only one query is needed using quantum computing. The quantum algorithm is as follows: [2]

Apply a Hadamard transform to the ${\displaystyle n}$ qubit state ${\displaystyle |0\rangle ^{\otimes n}}$ to get

${\displaystyle {\frac {1}{\sqrt {2^{n}}}}\sum _{x=0}^{2^{n}-1}|x\rangle .}$

Next, apply the oracle ${\displaystyle U_{f}}$ which transforms ${\displaystyle |x\rangle \to (-1)^{f(x)}|x\rangle }$. This can be simulated through the standard oracle that transforms ${\displaystyle |b\rangle |x\rangle \to |b\oplus f(x)\rangle |x\rangle }$ by applying this oracle to ${\displaystyle {\frac {|0\rangle -|1\rangle }{\sqrt {2}}}|x\rangle }$. (${\displaystyle \oplus }$ denotes addition mod two.) This transforms the superposition into

${\displaystyle {\frac {1}{\sqrt {2^{n}}}}\sum _{x=0}^{2^{n}-1}(-1)^{f(x)}|x\rangle .}$

Another Hadamard transform is applied to each qubit which makes it so that for qubits where ${\displaystyle s_{i}=1}$, its state is converted from ${\displaystyle |-\rangle }$ to ${\displaystyle |1\rangle }$ and for qubits where ${\displaystyle s_{i}=0}$, its state is converted from ${\displaystyle |+\rangle }$ to ${\displaystyle |0\rangle }$. To obtain ${\displaystyle s}$, a measurement in the standard basis (${\displaystyle \{|0\rangle ,|1\rangle \}}$) is performed on the qubits.

Graphically, the algorithm may be represented by the following diagram, where ${\displaystyle H^{\otimes n}}$ denotes the Hadamard transform on ${\displaystyle n}$ qubits:

${\displaystyle |0\rangle ^{n}\xrightarrow {H^{\otimes n}} {\frac {1}{\sqrt {2^{n}}}}\sum _{x\in \{0,1\}^{n}}|x\rangle \xrightarrow {U_{f}} {\frac {1}{\sqrt {2^{n}}}}\sum _{x\in \{0,1\}^{n}}(-1)^{f(x)}|x\rangle \xrightarrow {H^{\otimes n}} {\frac {1}{2^{n}}}\sum _{x,y\in \{0,1\}^{n}}(-1)^{f(x)+x\cdot y}|y\rangle =|s\rangle }$

The reason that the last state is ${\displaystyle |s\rangle }$ is because, for a particular ${\displaystyle y}$,

${\displaystyle {\frac {1}{2^{n}}}\sum _{x\in \{0,1\}^{n}}(-1)^{f(x)+x\cdot y}={\frac {1}{2^{n}}}\sum _{x\in \{0,1\}^{n}}(-1)^{x\cdot s+x\cdot y}={\frac {1}{2^{n}}}\sum _{x\in \{0,1\}^{n}}(-1)^{x\cdot (s\oplus y)}=1{\text{ if }}s\oplus y={\vec {0}},\,0{\text{ otherwise}}.}$

Since ${\displaystyle s\oplus y={\vec {0}}}$ is only true when ${\displaystyle s=y}$, this means that the only non-zero amplitude is on ${\displaystyle |s\rangle }$. So, measuring the output of the circuit in the computational basis yields the secret string ${\displaystyle s}$.

• Hidden Linear Function problem