In quantum computing, Grover's algorithm, also known as the quantum search algorithm, refers to a quantum algorithm for unstructured search that finds with high probability the unique input to a black box function that produces a particular output value, using just evaluations of the function, where is the size of the function's domain. It was devised by Lov Grover in 1996.
The analogous problem in classical computation cannot be solved in fewer than evaluations (because, on average, one has to check half of the domain to get a 50% chance of finding the right input). At roughly the same time that Grover published his algorithm, Charles H. Bennett, Ethan Bernstein, Gilles Brassard, and Umesh Vazirani proved that any quantum solution to the problem needs to evaluate the function times, so Grover's algorithm is asymptotically optimal. Since researchers generally believe that NP-complete problems are difficult because their search spaces have essentially no structure, the optimality of Grover's algorithm for unstructured search suggests (but does not prove) that quantum computers cannot solve NP-complete problems in polynomial time.
Unlike other quantum algorithms, which may provide exponential speedup over their classical counterparts, Grover's algorithm provides only a quadratic speedup. However, even quadratic speedup is considerable when is large, and Grover's algorithm can be applied to speed up broad classes of algorithms. Grover's algorithm could brute-force a 128-bit symmetric cryptographic key in roughly 264 iterations, or a 256-bit key in roughly 2128 iterations. As a result, it is sometimes suggested that symmetric key lengths be doubled to protect against future quantum attacks.
Applications and limitations
Grover's algorithm, along with variants like amplitude amplification, can be used to speed up a broad range of algorithms. In particular, algorithms for NP-complete problems generally contain exhaustive search as a subroutine, which can be sped up by Grover's algorithm. The current best algorithm for 3SAT is one such example. Generic constraint satisfaction problems also see quadratic speedups with Grover. These algorithms do not require that the input be given in the form of an oracle, since Grover's algorithm is being applied with an explicit function, e.g. the function checking that a set of bits satisfies a 3SAT instance.
Grover's algorithm can also give provable speedups for black-box problems in quantum query complexity, including element distinctness and the collision problem (solved with the Brassard–Høyer–Tapp algorithm). In these types of problems, one treats the oracle function f as a database, and the goal is to use the quantum query to this function as few times as possible.
Grover's algorithm essentially solves the task of function inversion. Roughly speaking, if we have a function that can be evaluated on a quantum computer, Grover's algorithm allows us to calculate when given . Consequently, Grover's algorithm gives broad asymptotic speed-ups to many kinds of brute-force attacks on symmetric-key cryptography, including collision attacks and pre-image attacks. However, this may not necessarily be the most efficient algorithm since, for example, the parallel rho algorithm is able to find a collision in SHA2 more efficiently than Grover's algorithm.
Grover's original paper described the algorithm as a database search algorithm, and this description is still common. The database in this analogy is a table of all of the function's outputs, indexed by the corresponding input. However, this database is not represented explicitly. Instead, an oracle is invoked to evaluate an item by its index. Reading a full data-base item by item and converting it into such a representation may take a lot longer than Grover's search. To account for such effects, Grover's algorithm can be viewed as solving an equation or satisfying a constraint. In such applications, the oracle is a way to check the constraint and is not related to the search algorithm. This separation usually prevents algorithmic optimizations, whereas conventional search algorithms often rely on such optimizations and avoid exhaustive search.
The major barrier to instantiating a speedup from Grover's algorithm is that the quadratic speedup achieved is too modest to overcome the large overhead of near-term quantum computers. However, later generations of fault-tolerant quantum computers with better hardware performance may be able to realize these speedups for practical instances of data.
As input for Grover's algorithm, suppose we have a function . In the "unstructured database" analogy, the domain represent indices to a database, and f(x) = 1 if and only if the data x points to satisfies the search criterion. We additionally assume that only one index satisfies f(x) = 1, and we call this index ω. Our goal is to identify ω.
Grover's algorithm outputs ω with probability at least 1/2 using applications of Uω. This probability can be made arbitrarily small by running Grover's algorithm multiple times. If one runs Grover's algorithm until ω is found, the expected number of applications is still , since it will only be run twice on average.
Uω is different from the standard quantum oracle for a function f. This standard oracle, denoted here as Uf, uses an ancillary qubit system (like in the quantum circuit depicted below). The operation then represents an inversion (NOT gate) conditioned by the value of f(x) on the main system:
These oracles are typically realized using uncomputation.
If we are given Uf as our oracle, then we can also implement Uω, since Uω is Uf when the ancillary qubit is in the state :
So, Grover's algorithm can be run regardless of which oracle is given. If Uf is given, then we must maintain an additional qubit in the state and apply Uf in place of Uω.
The steps of Grover's algorithm are given as follows:
- Initialize the system to the uniform superposition over all states
- Perform the following "Grover iteration" times:
- Apply the operator .
- Apply the Grover diffusion operator .
- Measure the resulting quantum state in the computational basis.
For the correctly chosen value of , the output will be with probability approaching 1 for N ≫ 1. Analysis shows that this eventual value for satisfies .
Implementing the steps for this algorithm can be done using a number of gates linear in the number of qubits. Thus, the gate complexity of this algorithm is , or per iteration.
Geometric proof of correctness
There is a geometric interpretation of Grover's algorithm, following from the observation that the quantum state of Grover's algorithm stays in a two-dimensional subspace after each step. Consider the plane spanned by and ; equivalently, the plane spanned by and the perpendicular ket .
Grover's algorithm begins with the initial ket , which lies in the subspace. The operator is a reflection at the hyperplane orthogonal to for vectors in the plane spanned by and , i.e. it acts as a reflection across . This can be seen by writing in the form of a Householder reflection:
The operator is a reflection through . Both operators and take states in the plane spanned by and to states in the plane. Therefore, Grover's algorithm stays in this plane for the entire algorithm.
It is straightforward to check that the operator of each Grover iteration step rotates the state vector by an angle of . So, with enough iterations, one can rotate from the initial state to the desired output state . The initial ket is close to the state orthogonal to :
In geometric terms, the angle between and is given by
We need to stop when the state vector passes close to ; after this, subsequent iterations rotate the state vector away from , reducing the probability of obtaining the correct answer. The exact probability of measuring the correct answer is
where r is the (integer) number of Grover iterations. The earliest time that we get a near-optimal measurement is therefore .
Algebraic proof of correctness
To complete the algebraic analysis, we need to find out what happens when we repeatedly apply . A natural way to do this is by eigenvalue analysis of a matrix. Notice that during the entire computation, the state of the algorithm is a linear combination of and . We can write the action of and in the space spanned by as:
So in the basis (which is neither orthogonal nor a basis of the whole space) the action of applying followed by is given by the matrix
This matrix happens to have a very convenient Jordan form. If we define , it is
It follows that r-th power of the matrix (corresponding to r iterations) is
Using this form, we can use trigonometric identities to compute the probability of observing ω after r iterations mentioned in the previous section,
Alternatively, one might reasonably imagine that a near-optimal time to distinguish would be when the angles 2rt and −2rt are as far apart as possible, which corresponds to , or . Then the system is in state
A short calculation now shows that the observation yields the correct answer ω with error .
Extensions and variants
Multiple matching entries
If, instead of 1 matching entry, there are k matching entries, the same algorithm works, but the number of iterations must be instead of .
There are several ways to handle the case if k is unknown. A simple solution performs optimally up to a constant factor: run Grover's algorithm repeatedly for increasingly small values of k, e.g. taking k = N, N/2, N/4, ..., and so on, taking for iteration t until a matching entry is found.
With sufficiently high probability, a marked entry will be found by iteration for some constant c. Thus, the total number of iterations taken is at most
Quantum partial search
A modification of Grover's algorithm called quantum partial search was described by Grover and Radhakrishnan in 2004. In partial search, one is not interested in finding the exact address of the target item, only the first few digits of the address. Equivalently, we can think of "chunking" the search space into blocks, and then asking "in which block is the target item?". In many applications, such a search yields enough information if the target address contains the information wanted. For instance, to use the example given by L. K. Grover, if one has a list of students organized by class rank, we may only be interested in whether a student is in the lower 25%, 25–50%, 50–75% or 75–100% percentile.
To describe partial search, we consider a database separated into blocks, each of size . The partial search problem is easier. Consider the approach we would take classically – we pick one block at random, and then perform a normal search through the rest of the blocks (in set theory language, the complement). If we don't find the target, then we know it's in the block we didn't search. The average number of iterations drops from to .
Grover's algorithm requires iterations. Partial search will be faster by a numerical factor that depends on the number of blocks . Partial search uses global iterations and local iterations. The global Grover operator is designated and the local Grover operator is designated .
The global Grover operator acts on the blocks. Essentially, it is given as follows:
- Perform standard Grover iterations on the entire database.
- Perform local Grover iterations. A local Grover iteration is a direct sum of Grover iterations over each block.
- Perform one standard Grover iteration.
The optimal values of and are discussed in the paper by Grover and Radhakrishnan. One might also wonder what happens if one applies successive partial searches at different levels of "resolution". This idea was studied in detail by Vladimir Korepin and Xu, who called it binary quantum search. They proved that it is not in fact any faster than performing a single partial search.
Grover's algorithm is optimal up to sub-constant factors. That is, any algorithm that accesses the database only by using the operator Uω must apply Uω at least a fraction as many times as Grover's algorithm. The extension of Grover's algorithm to k matching entries, π(N/k)1/2/4, is also optimal. This result is important in understanding the limits of quantum computation.
If the Grover's search problem was solvable with logc N applications of Uω, that would imply that NP is contained in BQP, by transforming problems in NP into Grover-type search problems. The optimality of Grover's algorithm suggests that quantum computers cannot solve NP-Complete problems in polynomial time, and thus NP is not contained in BQP.
It has been shown that a class of non-local hidden variable quantum computers could implement a search of an -item database in at most steps. This is faster than the steps taken by Grover's algorithm.
- Amplitude amplification
- Shor's algorithm (for factorization)
- Brassard–Høyer–Tapp algorithm (for solving the collision problem)
- Grover, Lov K. (1996-07-01). "A fast quantum mechanical algorithm for database search". Proceedings of the twenty-eighth annual ACM symposium on Theory of Computing. STOC '96. Philadelphia, Pennsylvania, USA: Association for Computing Machinery: 212–219. doi:10.1145/237814.237866. ISBN 978-0-89791-785-8.
- Bennett C.H.; Bernstein E.; Brassard G.; Vazirani U. (1997). "The strengths and weaknesses of quantum computation". SIAM Journal on Computing. 26 (5): 1510–1523. arXiv:quant-ph/9701001. doi:10.1137/s0097539796300933. S2CID 13403194.
- Nielsen, Michael A. (2010). Quantum computation and quantum information. Isaac L. Chuang. Cambridge: Cambridge University Press. pp. 276–305. ISBN 978-1-107-00217-3. OCLC 665137861.
- Daniel J. Bernstein (2010-03-03). "Grover vs. McEliece" (PDF). Cite journal requires
- Grover, Lov K. (1997). "A framework for fast quantum mechanical algorithms". arXiv:quant-ph/9711043.
- Ambainis, A. (2004-06-01). "Quantum search algorithms". ACM SIGACT News. 35 (2): 22–35. doi:10.1145/992287.992296. ISSN 0163-5700.
- Jordan, Stephen. "Quantum Algorithm Zoo". quantumalgorithmzoo.org. Retrieved 2021-04-21.
- Cerf, Nicolas J.; Grover, Lov K.; Williams, Colin P. (2000-05-01). "Nested Quantum Search and NP-Hard Problems". Applicable Algebra in Engineering, Communication and Computing. 10 (4): 311–338. doi:10.1007/s002000050134. ISSN 1432-0622.
- Ambainis, Andris (2007-01-01). "Quantum Walk Algorithm for Element Distinctness". SIAM Journal on Computing. 37 (1): 210–239. doi:10.1137/S0097539705447311. ISSN 0097-5397.
- Brassard, Gilles; Hoyer, Peter; Tapp, Alain (1997). "Quantum Algorithm for the Collision Problem". Lecture Notes in Computer Science: 163–169. arXiv:quant-ph/9705002. doi:10.1007/BFb0054319.
- Post-quantum cryptography. Daniel J. Bernstein, Johannes Buchmann, Erik, Dipl.-Math Dahmén. Berlin: Springer. 2009. ISBN 978-3-540-88702-7. OCLC 318545517.CS1 maint: others (link)
- Bernstein, Daniel J. (2021-04-21). "Cost analysis of hash collisions: Will quantum computers make SHARCS obsolete?" (PDF). Conference proceedings for Special-purpose Hardware for Attacking Cryptographic Systems (SHARCS '09). 09: 105–117.
- Viamontes G.F.; Markov I.L.; Hayes J.P. (2005), "Is Quantum Search Practical?" (PDF), Computing in Science and Engineering, 7 (3): 62–70, arXiv:quant-ph/0405001, Bibcode:2005CSE.....7c..62V, doi:10.1109/mcse.2005.53, S2CID 8929938
- Babbush, Ryan; McClean, Jarrod R.; Newman, Michael; Gidney, Craig; Boixo, Sergio; Neven, Hartmut (2021-03-29). "Focus beyond Quadratic Speedups for Error-Corrected Quantum Advantage". PRX Quantum. 2 (1): 010103. doi:10.1103/PRXQuantum.2.010103.
- Aaronson, Scott (April 19, 2021). "Introduction to Quantum Information Science Lecture Notes" (PDF).
- Michel Boyer; Gilles Brassard; Peter Høyer; Alain Tapp (1998), "Tight Bounds on Quantum Searching", Fortsch. Phys., 46: 493–506, arXiv:quant-ph/9605034, Bibcode:1998ForPh..46..493B, doi:10.1002/3527603093.ch10, ISBN 9783527603091
- Andris Ambainis (2004), "Quantum search algorithms", SIGACT News, 35 (2): 22–35, arXiv:quant-ph/0504012, Bibcode:2005quant.ph..4012A, doi:10.1145/992287.992296, S2CID 11326499
- L.K. Grover; J. Radhakrishnan (2005-02-07). "Is partial quantum search of a database any easier?". arXiv:quant-ph/0407122v4.
- Zalka, Christof (1999-10-01). "Grover's quantum searching algorithm is optimal". Physical Review A. 60 (4): 2746–2751. arXiv:quant-ph/9711070. doi:10.1103/PhysRevA.60.2746.
- Aaronson, Scott. "Quantum Computing and Hidden Variables" (PDF).
- Grover L.K.: A fast quantum mechanical algorithm for database search, Proceedings, 28th Annual ACM Symposium on the Theory of Computing, (May 1996) p. 212
- Grover L.K.: From Schrödinger's equation to quantum search algorithm, American Journal of Physics, 69(7): 769–777, 2001. Pedagogical review of the algorithm and its history.
- Grover L.K.: QUANTUM COMPUTING: How the weird logic of the subatomic world could make it possible for machines to calculate millions of times faster than they do today The Sciences, July/August 1999, pp. 24–30.
- Nielsen, M.A. and Chuang, I.L. Quantum computation and quantum information. Cambridge University Press, 2000. Chapter 6.
- What's a Quantum Phone Book?, Lov Grover, Lucent Technologies
|Wikiquote has quotations related to: Grover's algorithm|
- Davy Wybiral. "Quantum Circuit Simulator". Archived from the original on 2017-01-16. Retrieved 2017-01-13.
- Craig Gidney (2013-03-05). "Grover's Quantum Search Algorithm".
- François Schwarzentruber (2013-05-18). "Grover's algorithm".
- Alexander Prokopenya. "Quantum Circuit Implementing Grover's Search Algorithm". Wolfram Alpha.
- "Quantum computation, theory of", Encyclopedia of Mathematics, EMS Press, 2001 
- Roberto Maestre (2018-05-11). "Grover's Algorithm implemented in R and C".