Scott Aaronson

BQP und PHA tale of two strong-willed complexity

classes…A 16-year-old quest to find an oracle that

separates them…A solution at last—but only for relational

problems…The beast guarding the inner sanctum

unmasked: the Generalized Linial-Nisan Conjecture…

Where others flee in terror, a Braver Man attacks…

A $200 bounty for slaughtering the wounded beast…

1

Quantum Computing: Where Does It Fit?

PH

PBPP

AM

NPPP

P#P

BQP

2

Factoring, discrete log, etc.:In BQP

Not known to be in BPPBut in NPcoNP

Could there be a problem in BQP\PH?

First question: can we at least find an oracle A such that BQPAPHA?

Essentially the same as finding a problem in quantum logarithmic time, but not AC0

Why? Standard correspondence between relativized PH and AC0: replace ’s by OR gates, ’s by AND gates, and the oracle string by an input of size 2n

Relativization is just the “obvious” way to address the BQP vs. PH question, not some woo-woo thing

People who claim they don’t like oracle results really just don’t understand them

3

BQP vs. PH: A Timeline

Bernstein and Vazirani define BQP

They construct an oracle problem, RECURSIVE FOURIER SAMPLING, that has quantum query complexity n but classical query complexity n(log n) First example where quantum is superpolynomially better!

A simple extension yields RFSMA

Natural conjecture: RFSPH

Alas, we can’t even prove RFSAM!

19901995

20002005

2010

4

Why do we care whether BQP PH?

Does simulating quantum mechanics reduce to search or approximate counting?

What other candidates for exponential quantum speedups are there—besides NP-intermediate problems like factoring?

Could quantum computers provide exponential speedups even if P=NP?

Would a fast quantum algorithm for NP-complete problems collapse the polynomial hierarchy?

5

This Talk

1. We achieve an oracle separation between the relational versions of BQP and PH (FBQP and FBPPPH)

2. We study a new oracle problem—FOURIER CHECKING—that’s in BQP, but not in BPP, MA, BPPpath, SZK...

3. We conjecture that FOURIER CHECKING is not in PH, and prove that this would follow from the Generalized Linial-Nisan ConjectureOriginal Linial-Nisan Conjecture was proved by Braverman 2009, after being open for 20 years

6

Relational ProblemsFBPP: Class of relations, R{0,1}*{0,1}*, for which there exists a BPP machine that, given any x, outputs a y such that

11,Pr oRyx

If we compared FBQP to FPPH, a separation would be trivial! “Output an n-bit string with Kolmogorov complexity n/2”

FBQP: Same but with quantum

We’ll produce separations where the FBQP machine succeeds with probability 1-1/exp(n), while the FBPPPH machine succeeds with probability at most (say) 99%

Note: Amplification not obvious; constant could actually matter!

7

Fourier Sampling ProblemGiven oracle access to a random Boolean function

1,11,0: nf

The Task:

Output strings z1,…,zn, at least 75% of which satisfy

and at least 25% of which satisfy

nx

xz

nxfzf

1,02/

12

1:ˆwhere

1ˆ izf

2ˆ izf

8

FOURIER SAMPLING Is In BQP

Algorithm:

H

H

H

H

H

H

f

|0

|0

|0

Repeat n times; output whatever

you see

Distribution over Fourier coefficients

Distribution over Fourier coefficients output by quantum algorithm

9

FOURIER SAMPLING Is Not In PHKey Idea: Show that, if we had a constant-depth 2poly(n)-size circuit C for FOURIER SAMPLING, then we could violate a known AC0 lower bound, by “sneaking a MAJORITY problem” into the estimation of some random Fourier coefficient

Obvious problem: How do we know C will output the particular s we’re interested in, thereby revealing anything about ?

We don’t! (Indeed, there’s only a ~1/2n chance it will)

But we have a long time to wait, since our reduction can be nondeterministic!

That just adds more layers to the AC0 circuit

sf̂

sf̂

10

Suppose each bit of an N-bit string is 1 with independent probability p. Then any depth-d circuit to decide whether p=½ or p=½+ (with constant bias) must have size

2/1/12 d

If you’re here, you can prove this

Starting Point for Reduction

11

We’ll take a circuit that outputs slightly-larger-than-average Fourier coefficients of f, and get a circuit for detecting bias

Alice: Chooses s{0,1}n and b{0,1} uniformly at random

otherwise12

1

2

1 w.p.1: 2/n

bxs

xf

zf̂

12

The Fourier Guessing Game

For each x{0,1}n, sets

Bob: Must output a z such that

f Sends truth table of f to Bob

Keeps s,b secret

Key Theorem:

e

eesz

nf 12Pr

Regardless of Bob’s strategy,

In other words, if >1.1, Bob outputs the “true” s with

probability noticeably more than 1/2n … even if he tries to avoid it!

Finishing the ProofLet A be a random oracle

View A as encoding a random Boolean function fn:{0,1}n{-1,1} for each n

Let R be the relational problem where, on input 0n, you’re asked to output z1,…,zn, at least 75% of which satisfyand at least 25% of which satisfy

Clearly 1FBQPPr A

AR

13

1ˆ in zf 2ˆ in zf

0FBPPPr PH A

RA

On the other hand, standard diagonalization tricks imply

Decision Version: FOURIER CHECKINGGiven oracle access to two Boolean functions

1,11,0:, ngf

Decide whether

if,g are drawn from the uniform distribution U, or

iif,g are drawn from the following “forrelated” distribution F: pick a random unit vector ,2nv

then let

xx vxgvxf ˆsgn:,sgn:

14

FOURIER CHECKING Is In BQP

H

H

H

H

H

H

f

|0

|0

|0

g

H

H

H

Probability of observing |0n:

forrelated are if1

random are if21

2

12

1,0,3 f,g

f,gygxf

n

yx

yx

nn

15

Intuition: FOURIER CHECKING Shouldn’t Be In PH

Why?

• For any individual s, computing the Fourier coefficient is a #P-complete problem

• f and g being forrelated is an extremely “global” property: conditioning on a polynomial number of f(x) and g(y) values should reveal almost nothing about it

But how to formalize and prove that?

16

sf̂

1

Pr

Pr1

C

C

U

D

Crucial Definition: A distribution D is -almost k-wise independent if for all k-terms C,

Theorem: For all k, the forrelated distribution F is O(k2/2n/2)-almost k-wise independent

Proof: A few pages of Gaussian integrals, then a discretization step

A k-term is a product of k literals of the form xi or 1-xi

A distribution D over {0,1}N is k-wise independent if for all k-terms C,

kUD CC2

1PrPr

17

Approximation is multiplicative, not additive

… that’s important!

Bazzi’07 proved the depth-2 case

18

Linial-Nisan Conjecture (1990) with weaker parameters that suffice for us:

Let f:{0,1}n{0,1} be computed by a circuit of size and depth O(1). Then for all n(1)-wise independent distributions D,

.1PrPr1,0~

oxfxfnxDx

1

2on

“Generalized Linial-Nisan Conjecture”: Let f be computed by a circuit of size and depth O(1). Then for all 1/n(1)-almost n(1)-wise independent distributions D,

.1PrPr1,0~

oxfxfnxDx

1

2on

Razborov’08 dramatically simplified Bazzi’s proofFinally, Braverman’09 proved the whole thingAlas, we need the…

“Low-Fat Sandwich Conjecture”: Let f:{0,1}n{0,1} be computed by a circuit of size and depth O(1). Then there exist polynomials pl,pu:RnR, of degree no(1), such that

19

xxpxfxp u

1E

1,0oxpxpu

x n

CCu

CC xCxpxCxp

Terms Terms

,

C

oCC

C

oCC nn 11 2,2

Theorem (Bazzi): Low-Fat Sandwich Conjecture Generalized Linial-Nisan Conjecture

(Without the low-fat condition, Sandwich Conjecture Linial-Nisan Conjecture)

1

2on

(i) Sandwiching.

(ii) Approximation.

(iii) Low-Fat. pl,pu can be written as

where

We know how to prove constant-depth lower bounds! So why is BQPAPHA so much harder than (say) PPAPHA?

Because known techniques for showing a function f has no small constant-depth circuits, also involve (directly or indirectly) showing that f isn’t approximated by a low-degree polynomial

And this is a problem because…Lemma (Beals et al. 1998): Every Boolean function f that has a T-query quantum algorithm, also has a degree-2T real polynomial p such that |p(x)-f(x)| for all x{0,1}n

Example: The following degree-4 polynomial distinguishes the uniform distribution over f,g from the forrelated one:

2

1,0,3

12

1,

nyx

yx

nygxfgfp

20

But this polynomial solves FOURIER CHECKING only by exploiting “massive cancellations” between positive and negative terms

(Not coincidentally, the central feature of quantum algorithms!)

You might conjecture that if fAC0, then f is approximated not merely by a low-degree polynomial, but by a “reasonable,” “classical-looking” one—with some bound on the coefficients that prevents massive cancellations

And that’s exactly what the Low-Fat Sandwich Conjecture says!

Such a “low-fat” approximation of AC0 circuits would be useful for independent reasons in learning theory

2

1,0,3

12

1,

nyx

yx

nygxfgfp

21

Open ProblemsProve the Generalized Linial-Nisan Conjecture!Yields an oracle A such that BQPAPHA

Prove Generalized L-N even for the special case of DNFs.Yields an oracle A such that BQPAAMA

Is there a Boolean function f:{0,1}n{-1,1} that’s well-approximated in L2-norm by a low-degree real polynomial, but not by a low-degree low-fat polynomial?

Can we “instantiate” FOURIER CHECKING by an explicit (unrelativized) problem?

More generally, evidence for/against BQPPH in the real world?

22

$100

$200