An Efficient Quantum Algorithm for the Hidden Subgroup Problem over Weyl-Heisenberg Groups

An Efficient Quantum Algorithm f or the Hidd en Subgr oup Problem ov er W eyl-Heisenberg Gr oups Hari Krovi and Martin R ¨ otteler NEC Laboratories America 4 Independe nce W ay , Suite 200 Princeton, NJ 08540, U.S.A. { krovi,mroettele r } @nec-labs.com Abstract. Many expo nential speedup s that ha ve been achie ved in qua ntum com- puting are obtained via hidden sub group problems (HSP s). W e show that the HSP o ver W eyl-Heisenberg groups can be solved efficiently on a quantum com- puter . These groups are well-known in physics and play an important role in the theory of quantum error-correcting cod es. Our algorithm is based on non- commutati ve Fourier analysis of coset states which are quantum states that arise from a gi ven black-box fun ction. W e u se Clebsch-Go rdan decomp ositions to combine and reduce tensor products of irreducible representations. Furthermore, we use a ne w technique of changin g labels of irreducible representations to ob- tain lo w-dimensional irreducible represe ntations in the de composition process. A feature of the presented algorithm is that in each it eration of the algorithm the quantum computer operates on two coset states simultaneously . This i s an im- prov ement ov er the previously best known quantum algorithm for these groups which required four coset states. Keywords: q uantum algorith ms, hidden subgro up problem, coset states 1 Intr oduction Expon ential speedu ps in quantum c omputin g hav e h itherto b een sh own for o nly a few classes of pro blems, most notably for pro blems that ask to extract hidden features of cer- tain alg ebraic struc tures. Exam ples for th is are h idden sh ift pr oblems [DHI 03], hidd en non-lin ear structures [CSV07], and h idden subgrou p problems (HSPs). The latter class of h idden subgro up pr oblems has been studied quite extensi vely over the pa st d ecade. There ar e some successes such as the effi cient solution o f the HSP f or any ab elian gro up [Sho97,Kit97,BH97,ME98], including factorin g an d discrete log as well as Pell’ s equa - tion [Hal0 2], and efficient solutions for so me non-ab elian groups [FIM + 03,BCD05]. Furthermo re, there are some par tial successes fo r some non -abelian group s such as the dihedral grou ps [Reg04,K up05] and th e affine g roups [MRRS04]. Fina lly , it has b een established that for some gr oups, includ ing the symmetric gro up which is co nnected to the g raph isomorp hism problem , a straig htforward ap proach requir es a rather ex- pensive quantum pr ocessing in the sen se that entangling o perations o n a large n umber of quantu m system s would b e requ ired [HMR + 06]. What makes matters worse, there 2 Hari Krovi and Martin R ¨ otteler are currently no techniqu es, or e ven promising candidates for techniques, to implement these highly entangling operatio ns. The present p aper deals with th e hidde n subgrou p problem for a class of non -abelian group s that—in a p recise m athematical sense that will be explain ed below—is not too far away from the ab elian case, but at the sam e time has some distinct non-ab elian features that make the HSP over these groups challenging and interesting. The hidden sub group prob lem is defined as follows: we are given a functio n f : G → S from a group G to a set S , with the add itional promise that f takes constan t and distinct values on the left cosets gH , where g ∈ G , of a sub group H ≤ G . The tas k is to find a gen erating system of H . The f unction f is given as a blac k-box , i. e., it ca n only be accessed thr ough queries and in particular who se structure cannot be further studied. The inp ut size to the prob lem is log | G | and for a qu antum algorithm solving the HSP to be efficient means to have a running time that is poly (lo g | G | ) in the nu mber of quantu m operation s as well as in the numb er of class ical oper ations. W e will focu s on a particular ap proach to the HSP which proved to be successful in the past, nam ely the so-called stand ar d method , see [GSVV04]. Here the f unction f is used in a special way , namely it is u sed to gen erate co set states wh ich are states of the for m 1 / p | H | P h ∈ H | g h i f or rando m g ∈ G . The task then beco mes to extract a generating system o f H f rom a polynom ial numb er o f co set states ( for ra ndom values of g ). A basic question abou t coset states is how much in formatio n abou t H th ey inde ed conv ey and how this infor mation can b e extracted from suitable measur ements. 1 A fixed PO VM M oper ates on a fixed nu mber k of coset states at once an d if k ≥ 2 an d M does not decompo se into mea surements of sing le copies, we say that the PO VM is an entangled measurem ent. As in [ HMR + 06], we call the parameter k th e “jointn ess” o f the m easurement. It is k nown that in formation -theore tically for any gro up G jointne ss k = O (log | G | ) is suffi cient [EH K04]. While the true magnitude of the req uired k c an be sign ificantly smaller (abelian gro ups serve as examples fo r wh ich k = 1 ) , ther e are cases for wh ich indeed a hig h order of k = Θ (log | G | ) is sufficient an d necessary . Examples for such g roups are the symm etric g roups [HMR + 06]. Howe ver , on the mor e positive side, it is known that some group s req uire only a small, sometimes even only constant, amount of jointness. Examp les are the Heisenb erg grou ps o f order p 3 for a prime p for which k = 2 is sufficient [BCD05,Bac08a]. In earlier work [ISS0 7], it has been shown th at for the W eyl-Heisen berg g roups o rder p 2 n +1 , k = 4 is sufficient [ISS07]. The go al of this p aper is to show that in the latter case th e join tness can be improved. W e g i ve a quantum algorithm which is efficient in the input size (given b y log p an d n ) and which only require s a jointness of k = 2 . Our results and related work: The family of gro ups we co nsider in the present paper ar e well-kn own in quan tum informatio n p rocessing u nder the name of gener- alized Pauli gr oups or W eyl-Heisenberg g roups [NC00]. Th eir imp ortance in q uan- tum computin g stems f rom the fact th at they are used to define stabilizer codes, the class of codes most widely used for the c onstruction of quantum error-correcting cod es [CRSS97,Got96,CRSS98]. 1 Recall that the most general way to extract classical information from quantum states is giv en by means of positiv e operator v alued measures (PO VMs) [NC00]. HSP ov er W eyl-Heisenber g Groups 3 In a mo re group -theoretical context, the W eyl-Heisenb erg groups are kn own as ex- traspecial p - group s (actually , th ey c onstitute o ne o f the two families of extra special p -grou ps [Hup 83]). A polynom ial-time algorith m f or the HSP for the extraspecial p - group s was already given by Ivanyos, Sanselme, and San tha, [ISS0 7]. Our appro ach differs to th is approach in two aspects: first, ou r ap proach is based o n Fourier sam- pling fo r th e no n-abelian g roup G . Secon d, and mo re impor tantly , we show that the jointness k , i. e., the n umber of coset states that the algorithm has to operate jo intly on, can be redu ced from k = 4 to k = 2 . Crucial for our approac h is the fact that in the W eyl-Heisenberg group the labels o f irred ucible represen tations can b e ch anged. This is turn can be u sed to “drive” Clebsch-Gord an decomposition s in such a way that low-dimensional irreducible representatio ns occur in the decomposition. It is perh aps interesting to note that fo r the W eyl-Heisenberg gro ups the states th at arise after the measuremen t in the Fourier sampling approach (also called F ourier coef- ficients) ar e typically o f a very large ran k (i. e., expo nential in the input size). Gen erally , large rank usu ally is a go od indicato r of the intractability of the HSP , such as in case of the symmetric group when H is a full support in volution. Perhaps surprisingly , in the case of the W eyl-Heisenberg gro up it still is p ossible to extract H efficiently even though the Four ier coefficients have large ran k. W e ach iev e this at the price of o perating on two coset states at the same time. Th is leav es o pen the q uestion whether k = 1 is possible, i. e., if the hidden subgroup H ca n be identified from measurements on single coset states. W e cannot resolve this question but belie ve that this will be hard. Our rea- soning is as f ollows. Having Fourier coefficients of large rank imp lies that th e ran dom basis method [RRS 05,Sen 06] cannot be applied. The random basis method is a method to derive algorith ms with k = 1 who se qu antum p art can b e shown to be po lynomial, provided that the rank of th e Fourier co efficients is constant. 2 Based on th is we ther e- fore co njecture th at any efficient quantum algorithm f or th e extraspe cial grou ps will require jointness of k ≥ 2 . Finally , we mention that a similar meth od to c ombine the two registers in each run of the alg orithm has be en used b y Bacon [ Bac08a] to solve the HSP in th e Heisenberg group s of order p 3 . The m ethod uses a Clebsch-Gorda n transform which is a unitary transform that decompo ses the ten sor pro duct of two irredu cible representatio ns [Ser7 7] into its co nstituents. The main d ifference between the Heisenberg group and the W eyl- Heisenberg groups is that th e Fourier coefficients are no longe r pu re states and ar e of possibly high rank. Organization of t he paper: In Section 2 we review the W eyl-Heisenberg gr oup and its sub group structur e. Th e Fourier sampling ap proach and the so- called standar d algorithm are reviewed in Section 3. I n Sectio n 4 we p rovide necessary facts ab out the representatio n th eory that will be req uired in the subsequ ent p arts. The main result o f this pa per is the qu antum algorithm f or the efficient solution o f the HSP in the W eyl- Heisenberg groups presented in Section 5. Finally , we of fer conclusions in Section 6. 2 This can be obtained by combining the random basis method [Sen06] with the derandomiza- tion results of [AE07]. 4 Hari Krovi and Martin R ¨ otteler 2 The W eyl-Heisenberg gr oups W e b egin by recalling some basic g roup- theoretic notions. Recall that the cen ter Z ( G ) of a grou p G is defined as the set of elem ents whic h commute with e very element of the group i.e. , Z ( G ) = { c : [ c, g ] = c g c − 1 g − 1 = e for all g ∈ G } , wh ere e is the identity element o f G . The der iv ed (or commutator) subgr oup G ′ is gen erated by elements of the ty pe [ a , b ] = aba − 1 b − 1 , where a, b ∈ G . T he read er is in vited to recall the definition of sem idirect pro ducts G = N ⋊ H , see for instan ce [Hu p83,Ser77]. I n th e fo llowing we gi ve a defin ition of the W eyl-Heisenb erg groups as a semid irect product and give two alternati ve w ays of working with these groups. Definition 1. Let p b e a prime an d let n be an inte ger . The W eyl-Heisenber g gr oup of or der p 2 n +1 is defined as the semidirect pr oduct Z n +1 p ⋊ φ Z n p , wher e the action φ in the semid ir e ct pr oduct is defined on x = ( x 1 , . . . , x n ) ∈ Z n p as the ( n + 1) × ( n + 1) matrix given by φ ( x ) =        1 . . . 0 0 0 1 . . . 0 . . . . . . 0 . . . 1 0 x 1 x 2 . . . x n 1        . (1) Any group element of Z n +1 p ⋊ φ Z n p can be wr itten as a triple ( x, y , z ) where x an d y are vectors of length n whose entries are elements of Z p and z is in Z p . T o relate this triple to the semidir ect prod uct, one can thin k of ( y , z ) ∈ Z n +1 p and x ∈ Z n p . Then, the produ ct of two elements in this group can be written as ( x, y , z ) · ( x ′ , y ′ , z ′ ) = ( x + x ′ , y + y ′ , z + z ′ + x ′ · y ) , (2) where x · y = P i x i y i is the dot prod uct o f two vectors (d enoted a s xy in the rest of the paper). Fact 1 [Hup83] F or any p prime, and n ≥ 1 , the W e yl-Heisenberg gr o up is a n ex- traspecial p gr o up. Recall that a g r ou p G is extraspecial if Z ( G ) = G ′ , the cen ter is isomorphic to Z p , and G/G ′ is a vector space. Up to isomorphism , extraspecial p -groups are of two typ es: grou ps of exp onent p and gr oups of exponen t p 2 . Th e W eyl-Heisen berg group s are the extraspe cial p -group s of exponent p . It was shown in [ISS07] th at an algor ithm to find hidd en su bgrou ps in the group s of expon ent p can b e used to find hidden subgr oups in gr oups of exponent p 2 . Th erefore, it is enou gh to so lve the HSP in gr oups of expo nent p . I n this paper, we present an efficient algorithm for the HSP over groups of exponent p . Realization via matrices over Z p : Fir st, we recall th at the Heisen berg g roup of o rder p 3 (which is the group of 3 × 3 upper trian gular m atrices with ones on th e ma in d iag- onal and o ther entries in Z p ) is a W eyl-Heisenberg group and ca n b e r egarded as the HSP ov er W eyl-Heisenber g Groups 5 semidirect product Z 2 p ⋊ Z p . An efficient algorithm for the HSP over this group is given in [BCD05]. Elements of this group are of the type   1 y z 0 1 x 0 0 1   . (3) The produ ct of two such elements is   1 y z 0 1 x 0 0 1     1 y ′ z ′ 0 1 x ′ 0 0 1   =   1 y + y ′ z + z ′ + x ′ y 0 1 x + x ′ 0 0 1   (4) Thus, such a matrix can be identified with a trip le ( x, y , z ) in Z 2 p ⋊ Z p . This matrix representatio n of the Heisenb erg group can be g eneralized fo r any n . W e can associate a triple ( x, y , z ) where x, y ∈ Z n p and z ∈ Z p with the ( n + 2) × ( n + 2) matrix        1 y 1 . . . y n z 0 1 . . . 0 x 1 . . . . . . . . . . . . . . . 0 0 . . . 1 x n 0 0 . . . 0 1        . (5) Realization via unita ry r ep r esentation: Finally , there is another useful w ay to r epresent the W eyl-Heisen berg group . The n qu p it Pauli matrices f orm a faithful (irreduc ible) representatio n of the W eyl-Heisenberg p -g roup. For any k 6 = 0 , we can associate with any triple ( x , y , z ) in Z n +1 p ⋊ Z n p , the following matrix: ρ k ( x, y , z ) = ω kz p X x Z y k , (6) where the matrix X = P u ∈ Z n p | u + 1 ih u | is the generalized X operator and the matrix Z k = P u ∈ Z n p ω k p | u ih u | is the generalized Z oper ator, see e. g. [NC00]. Subgr oup structure: In the following we will write G in short for W eyl-Heisenberg group s. Using the notatio n intro duced ab ove the cen ter Z ( G ) (or G ′ ) is the gro up Z ( G ) = { (0 , 0 , z ) | z ∈ Z p } and is isomorph ic to Z p . As mentioned above, the quo tient group G/G ′ is a vector space isomor phic to Z 2 n p . This space can b e regarded as a sym- plectic space with the following inn er product: ( x, y ) · ( x ′ , y ′ ) = ( x · y ′ − y · x ′ ) , where x, y , x ′ , y ′ ∈ Z n p . The q uotient map is just th e restriction of the tr iple ( x, y , z ) ∈ G to the pair ( x, y ) ∈ Z 2 n p . From Eq. (2), it follows that two elements commute if and only if xy ′ − y x ′ = 0 . Denote th e set of ( x, y ) pairs occu rring in H as S H i.e., for each triple ( x, y , z ) ∈ H , we have that ( x, y ) ∈ S H and so | S H | ≤ | H | . It can b e easily verified that S H is a vector space and is in fact, a subspace of Z 2 n p . Indeed, for two elements ( x, y ) , ( x ′ , y ′ ) ∈ S H , pick two elements ( x, y , z ) , ( x ′ , y ′ , z ′ ) ∈ H and so ( x + x ′ , y + y ′ , z + z ′ + x ′ y ) ∈ H . Th erefore , ( x + x ′ , y + y ′ ) ∈ S H . T o show that if ( x, y ) ∈ S H , then ( ax, ay ) ∈ S H for any a ∈ Z p , observe th at if ( x, y , z ) ∈ H , then 6 Hari Krovi and Martin R ¨ otteler ( x, y , z ) a = ( ax, ay , az + a ( a − 1) 2 xy ) ∈ H . Th erefore , ( ax, ay ) ∈ S H (in fact, it can be shown that S H ≃ H G ′ /G ′ , but we d o not nee d this resu lt.) Therefo re, H ≤ G is abelian if and on ly if ∀ ( x, y ) , ( x ′ , y ′ ) ∈ S H , we have that x y ′ − x ′ y = 0 . Such a spa ce where all the elements are ortho gonal to each other is called isotr o pic . Now , we make a fe w remark s about th e conjugacy class of some subgroup H . Con- sider co njugatin g H by some element of G , say g = ( x ′ , y ′ , z ′ ) . For any h = ( x, y , z ) ∈ H , we ob tain g − 1 hg = ( − x ′ , − y ′ , − z ′ + x ′ y ′ )( x, y , z )( x ′ , y ′ , z ′ ) = ( − x ′ , − y ′ , − z ′ + x ′ y ′ )( x + x ′ , y + y ′ , z + z ′ + x ′ y ) = ( x, y , z + x ′ y − xy ′ ) ∈ H g . (7) From this we see that S H g = S H . W e show next that S H actually ch aracterizes the conjuga cy cla ss of H . Before pr oving this result we need to d etermine the stabilizer of H . The stabilizer H S of H is d efined as the set of elements of G which preserve H under conjug ation i.e., H S = { g ∈ G | H g = H } . From Eq. (7) , we can see that g = ( x ′ , y ′ , z ′ ) ∈ H S if and only if x ′ y − xy ′ = 0 for all ( x, y , z ) ∈ H . Thus, the stabilizer is a group such that S H S = S ⊥ H , where S ⊥ H is th e orthog onal space under the symplectic inner prod uct defined above, i.e., H S = { ( x, y , z ) ∈ G | ( x, y ) ∈ S ⊥ H , z ∈ Z p } . In othe r words, it is obtain ed by appen ding the pairs ( x, y ) ∈ S ⊥ H with every po ssible z ∈ Z p . Therefo re, | H S | = | G ′ | · | S ⊥ H | . Now , we can prove the following lemma. Lemma 1. T wo subgr o ups H 1 and H 1 ar e conjugate if and only if S H 1 = S H 2 . Pr oo f. W e ha ve already seen that if H 1 and H 2 are con jugates, then S H 1 = S H 2 . T o show the other directio n, we use a co unting argument ie., we show that th e n umber of subgro ups H ′ of G such that S H ′ = S H is equa l to the number of co njugates of H . First, a ssume th at the dimen sion of the vector space S H 1 is k . Now , the number of conju gates of H 1 is the index of the stabilizer o f H 1 . From the ab ove result, th e stabilizer h as a size | G ′ || S ⊥ H 1 | = p · p 2 n − k . Therefo re, the ind ex or the n umber o f conjuga tes of H 1 are p 2 n +1 /p 2 n − k − 1 = p k . Now , the nu mber of different p ossible subgrou ps H such that S H = S H 1 is p k since ea ch of the k basis vectors of S H 1 are generato rs of the subg roup and they can have any z compo nent in depend ent of each other i.e., there are p possible choices of z fo r each of the k gener ators. The prop erty G ′ = Z ( G ) will be useful in that it will allow us to consider only a certain class of hidden subgroups. W e show next th at it is enough to consider hidden subgrou ps which a re ab elian a nd do n ot co ntain G ′ . Recall that that H is norm al in G (denoted H E G ) if g − 1 hg ∈ H for all g ∈ G and h ∈ H . Lemma 2. If G ′ ≤ H , then H E G . Pr oo f. Since G ′ is th e com mutator subg roup, fo r any g 1 , g 2 ∈ G , ther e exists g ′ ∈ G ′ such that g 1 g 2 = g 2 g 1 g ′ . Now , let h ∈ H and g ∈ G . W e h av e g − 1 hg = h g ′ for some g ′ ∈ G ′ . But since G ′ ≤ H , hg ′ = h ′ , fo r som e h ′ ∈ H . Th erefore, g − 1 hg = h ′ and hence H E G . Lemma 3. If H is non- abelian, then H E G . HSP ov er W eyl-Heisenber g Groups 7 Pr oo f. Let h 1 , h 2 ∈ H such that h 1 h 2 6 = h 2 h 1 . Then h 1 h 2 = h 2 h 1 g ′ for some g ′ ∈ G ′ such that g ′ 6 = e , where e is the identity e lement of G . This mean s that g ′ ∈ H . Since G ′ is cyclic o f prime order, it can be generated by any g ′ 6 = e and hence, we ha ve G ′ ≤ H . Now , Lemma 2 implies that H E G . From these two lemm as, we have o nly two cases to co nsider for the hid den subgrou p H : ( a ) H is a belian and do es n ot contain G ′ and ( b ) H is nor mal in G . It is possible to tell the ca ses apart by querying th e hiding function f twice and checking whether f ( e ) an d f ( g ′ ) a re eq ual f or some g ′ 6 = e and g ′ ∈ G ′ . If they are eq ual th en G ′ ≤ H and H E G , otherw ise H is ab elian. If H is norm al, then on e can use the algorithm of [HR T03], wh ich is efficient if on e can intersect kernels of the irredu cible r epre- sentations (irr eps) efficiently . For th e W eyl-He isenberg g roup, the h igher dimen sional irreps form a faithful represen tation an d hence do not have a kernel. Thu s, when the hidden subgrou p is norm al, only on e dim ensional irr eps o ccur and their kernels can be in tersected efficiently and the h idden su bgrou p can be fo und using the algorithm o f [HR T03]. T herefor e, we can con sider on ly those hidden subgr oups which are abelian and moreover do not contain G ′ . Now , we restrict our attention to the case o f abelian H . Finally , we n eed the follo w- ing two results. Lemma 4. If H is an abelian subgr oup which does not contain G ′ , then | S H | = | H | . Pr oo f. Suppose that for some ( x, y ) ∈ S H there exist two different elements ( x, y , z 1 ) and ( x, y , z 2 ) in H , then by multiplying one with the in verse of the other we get (0 , 0 , z 1 − z 2 ) . Since z 1 − z 2 6 = 0 , this generates G ′ , but b y our assumption on H , G ′  H . Therefore, | S H | = | H | . The following theorem applies to the case when p > 2 . Lemma 5. Let H b e an a belian su bgr oup which does not contain G ′ . Ther e e xists a subgr oup H 0 conjuga te to H , where H 0 = { ( x, y , xy / 2) | ( x, y ) ∈ S H } . Pr oo f. W e can verify that H 0 is a subgr oup b y co nsidering elements ( x, y , xy / 2) and ( x ′ , y ′ , x ′ y ′ / 2) in H 0 . Their produ ct is ( x, y , xy / 2) · ( x ′ , y ′ , x ′ y ′ / 2) = ( x + x ′ , y + y ′ , xy / 2 + x ′ y ′ / 2 + x ′ y ) = ( x + x ′ , y + y ′ , xy / 2 + x ′ y ′ / 2 + ( x ′ y + xy ′ ) / 2) = ( x + x ′ , y + y ′ , ( x + x ′ )( y + y ′ ) / 2) , (8) which is an elemen t of H 0 . Here, we have u sed the fact that H is abelian i.e., xy ′ − x ′ y = 0 , ∀ ( x, y ) , ( x ′ , y ′ ) ∈ S H . Now fo r H 0 , since S H 0 = S H , H 0 is conjug ate to H using Lemma 1. Note th at H 0 can be thought of as a representative of the co njugacy class of H since it can be un iquely d etermined fro m S H . Th e above lemm a do es no t app ly for the case p = 2 . When p = 2 , we hav e th at ( x, y , z ) 2 = (2 x, 2 y , 2 z + xy ) = (0 , 0 , xy ) . But since we assume that G ′  H , when p = 2 we must have that xy = 0 , ∀ ( x, y , z ) ∈ H . 8 Hari Krovi and Martin R ¨ otteler 3 Four ier sampling approach to HSP W e r ecall som e basic facts about the Fourier sampling approach to the HSP , see also [GSVV04,HMR + 06]. First, we re call some basic no tions of repr esentation th eory of finite g roups [Ser77] that are req uired for this appro ach. Let G be a finite grou p, let C [ G ] to de note its g roup algeb ra, and let ˆ G b e th e set of irred ucible represen tations (irreps) of G . W e will consider two distinguished orthonorm al vector space bases for C [ G ] , nam ely , the basis g iv en by the gr oup elem ents o n the one h and (d enoted by | g i , where g ∈ G ) a nd the basis given by normalized matrix coefficients of the irr educible representatio ns of G o n the oth er h and (deno ted by | ρ, i, j i , whe re ρ ∈ ˆ G , and i, j = 1 , . . . , d ρ for d ρ , where d ρ denotes the d imension of ρ ). Now , th e quantum Fourier transform over G , QFT G is the following li near transfo rmation [Bet87,GSVV04]: | g i 7→ X ρ ∈ ˆ G s d ρ | G | d ρ X i,j =1 ρ ij ( g ) | ρ, i, j i . (9) An e asy co nsequen ce of Schur’ s Lemma is that QFT G is a unitary tr ansformatio n in C | G | , mapping from the basis of | g i to the basis of | ρ, i, j i . For a subgr oup H ≤ G and irrep ρ ∈ ˆ G , define ρ ( H ) := 1 | H | P h ∈ H ρ ( h ) . Again from Sch ur’ s Lemm a we ob tain that ρ ( H ) is an o rthogo nal pro jection to the space of vectors that are po int-wise fixed by ev ery ρ ( h ) , h ∈ H . Define r ρ ( H ) := ran k ( ρ ( H )) ; then r ρ ( H ) = 1 / | H | P h ∈ H χ ρ ( h ) , where χ ρ de- notes th e ch aracter of ρ . For any sub set S ≤ G de fine | S i := 1 / p | S | P s ∈ S | s i to be the uniform superposition over the elements of S . The stand ar d meth od [GSVV04] starts from 1 / p | G | P g ∈ G | g i| 0 i . It the n q ueries f to get the superp osition 1 / p | G | P g ∈ G | g i| f ( g ) i . The state b ecomes a mixed state giv en by the den sity matrix σ G H = 1 | G | P g ∈ G | g H ih g H | if the second register is ig- nored. Applyin g QFT G to σ G H giv es the density matrix | H | | G | M ρ ∈ ˆ G d ρ M i =1 | ρ, i ih ρ, i | ⊗ ρ ∗ ( H ) , where ρ ∗ ( H ) operates on the space of co lumn indices o f ρ . The probability d istribution induced by this base chang e is given by P ( observe ρ ) = d ρ | H | r ρ ( H ) | G | . It is easy to see that measurin g the rows does n ot furn ish any ne w inform ation: indeed, the distribution on the row ind ices is a uniform distribution 1 / d ρ . The redu ced state on the space of col- umn indices on the other han d can contain informatio n about H : af ter having observed an ir rep ρ and a row index i , the state is now collapsed to ρ ∗ ( H ) /r ρ ( H ) . From this st ate we can try to obtain further inform ation about H via subseq uent measurements. Finally , we mention that Fourier samp ling on k ≥ 2 registers can be defin ed in a similar w ay . Here o ne st arts off with k independen t copies of the coset state and applies QFT ⊗ k G to it. In the next section, we describe the representation theory of the W eyl- Heisenberg groups. An ef ficient implementation of QFT G is shown in Appendix A. HSP ov er W eyl-Heisenber g Groups 9 4 The irr educible repr esentations In this section , we d iscuss th e re presentation theo ry of G , where G ∼ = Z n +1 p ⋊ Z n p is a W eyl-Heisenb erg group . Fro m th e proper ties of being an extraspecial group , it is easy to see that G ha s p 2 n one dimensional irreps a nd p − 1 irreps of dimension p n . The one dimensiona l irreps are given by χ a,b ( x, y , z ) = ω ( ax + by ) p , (10) where ω p = e 2 π i/p and a, b ∈ Z n p . Note that χ a,b ( H ) = 1 | H | X ( x,y ,z ) ∈ H ω ax + by p = 1 | S H | X ( x,y ) ∈ S H ω ax + by p . (11) Since S H is a linear space, th is expression is non-ze ro if and only if a, b ∈ S ⊥ H . Suppose we p erform a QFT on a coset state and measure an ir rep label. Furthermo re, sup pose that we obtain a one dimensional irrep (alth ough the probab ility of this is exponentially small as we show in the next section ). Then this would enable u s to sam ple from S ⊥ H . If this event of samplin g o ne dimensio nal irreps would occu r so me O ( n ) time s, we would b e able to com pute a generating set of S ⊥ H with co nstant p robab ility . This g iv es us inf ormation about the c onjugacy class o f H an d fro m knowing this, it is easy to see that generator s for H itself can be inferred by means of s olving a suitable abelian HSP . Thus, o btaining one d imensional irreps would be useful. Of course we cannot as- sume to sample from one dimen sional irreps as the y have low prob ability of occurring. Our strategy will be to “m anufacture” on e dim ensional irre ps fr om com bining h igher- dimensiona l irreps. First, recall that the p n dimensiona l irreps are gi ven by ρ k ( x, y , z ) = X u ∈ Z n p ω k ( z + y u ) p | u + x ih u | , (12) where k ∈ Z p and k 6 = 0 . This representatio n is a faithfu l irrep and its character is g iv en by χ k ( g ) = 0 for g 6 = e and χ k ( e ) = p n . In particular, χ k ( H ) = p n / | H | . The pr obability of a high dimensional irrep occurrin g in Fourie r sampling is very high (we co mpute th is in Sectio n 5 ). W e consider the tensor p rodu ct of two such high dimensiona l irreps. Th is ten sor pro duct can be d ecompo sed into a direct sum of irre ps of the g roup . A u nitary base ch ange which deco mposes such a tensor pr oduct into a direct sum of irreps is called a Clebsch-Gordan transfor m, den oted by U C G . Clebsch- Gordan tran sforms hav e been used implicitly to bound higher m oments of a r andom variable that describes th e p robability distribution of a PO VM on measur ing a Fourier coefficient. They h av e a lso been used i n [Bac08a] to obtain a quantum alg orithm for th e HSP over Heisen berg group s of order p 3 , and in [Bac08 b] for the HSP in the groups D n 4 as well as for Simo n’ s pro blem. Our use o f Clebsch-Gor dan tran sforms will b e somewhat similar . For the W eyl-Heisenberg group G , the irr eps that occ ur in th e Clebsch- Gordan de- composition of th e tenso r product of hig h dimensional irrep s ρ k ( g ) ⊗ ρ l ( g ) dep end on 10 Hari Krovi and Martin R ¨ otteler k a nd l . The Clebsch-Go rdan transform for G is given by U C G : | u, v i → ( P w ∈ Z n p ω l 2 ( u + v ) w p | u − v , w i for k + l = 0 | u − v , ku + lv k + l i for k + l 6 = 0 (13) If k + l 6 = 0 , then only one irrep of G occurs with multiplicity p n , namely ρ k ( g ) ⊗ ρ l ( g ) U C G → I p n ⊗ ρ k + l ( g ) . (14) If k + l = 0 , then all the one dimen sional irreps occur with multip licity one i.e., ρ k ( g ) ⊗ ρ l ( g ) U C G → ⊕ a,b ∈ Z p χ a,b ( g ) . (15) Note, howe ver , that th e state obtained after Fourier s ampling is not 1 | H | P g ∈ H ρ k ( g ) ⊗ ρ l ( g ) , but rathe r ρ k ( H ) ⊗ ρ l ( H ) . When w e apply the Clebsch-Go rdan tr ansform to this state, we ob tain one d imensional irrep s χ a,b ( H ) on th e diag onal. Ap plying this to ρ − l ( H ) ⊗ ρ l ( H ) gives us X ( x,y,z ) , ( x ′ ,y ′ ,z ′ ) ∈ H u,v, w 1 ,w 2 ∈ Z n p ω − l ( y u + z )+ l ( y ′ v + z ′ )+ l 2 (( u + v )( w 1 − w 2 )+ w 1 ( x + x ′ )) × p | u − v + x − x ′ , w 1 ih u − v , w 2 | = X ( x,y,z ) , ( x ′ ,y ′ ,z ′ ) ∈ H u ′ ,w 1 ,w 2 ∈ Z n p ω l 2 ( − ( y + y ′ ) u ′ +2( z ′ − z )+ w 1 ( x + x ′ )) × p X v ′ ω l 2 ( v ′ ( w 1 − w 2 + y ′ − y )) p | u ′ + x − x ′ , w 1 ih u ′ , w 2 | , where u ′ = u − v and v ′ = u + v . Since v ′ does not occur in the quantum state, the sum over v ′ vanishes unless w 2 = w 1 + y ′ − y . There fore, the state is X ( x,y,z ) , ( x ′ ,y ′ ,z ′ ) ∈ H u ′ ,w 1 ∈ Z n p ω l 2 ( − ( y + y ′ ) u ′ +2( z ′ − z )+ w 1 ( x + x ′ )) p | u ′ + x − x ′ , w 1 ih u ′ , w 1 + y ′ − y | . (16) The diag onal entries are obta ined by putting x = x ′ and y = y ′ and since | H | = | S H | , we get z = z ′ . The diago nal entry is then pro portion al to X ( x,y,z ) ∈ H u ′ ,w 1 ∈ Z n p ω l ( − y u ′ + w 1 x ) p . (17) Up to pr oportio nality , th is can be seen to be χ w 1 , − u ′ ( H ) , a o ne dimension al irrep. The bottom line is that, althou gh not d iagonal in the Clebsch-Gord an basis, the resultin g state’ s diago nal entries correspond to one dimensional irreps we are interested in. 5 The quantum algorithm In this section, we present a qu antum a lgorithm that operates on two copies of coset states at a time and sho w that it efficiently solves th e HSP over G = Z n +1 p ⋊ Z n p , where the input is n and log p . The algor ithm is as follows: HSP ov er W eyl-Heisenber g Groups 11 1. Obtain two copies of coset states for G . 2. Perform a quantu m Four ier tran sform o n each of the co set states a nd measure th e irrep lab el an d row ind ex f or each state. Assume that the m easurement ou tcomes are h igh-dim ensional ir reps with labels k an d l . Wit h high p robability the irreps are indee d b oth high dimension al an d k + l 6 = 0 , when p > 2 (see the analysis below). Whe n p = 2 , there is only one high dimension al irrep which o ccurs with probab ility 1 / 2 and k + l = 0 always, since k = l = 1 . W e deal with th is c ase at the end of this section. For no w assume that p > 2 an d k + l 6 = 0 . 3. If − k /l is not a square in Z p , then we discard the pair ( k , l ) and obtain a ne w sam- ple. Otherwise, perfo rm a unitary U α ⊗ I : | u, v i → | αu, v i , whe re α is determ ined by the two irrep labels as α = p − k /l . Th is leads to a “ch ange” in the irrep label 3 of the first state from k to − l . W e can then apply the Clebsch-Gordan transform and obtain one dimension al irreps. 4. Apply a Clebsch-Gor dan transform defined as U C G : | u, v i → X w ∈ Z n p ω l 2 ( u + v ) w p | u − v , w i (18) to these states. 5. Measure the two registers in th e standard basis. W ith the measuremen t ou tcomes, we have to perf orm som e classical post-pro cessing wh ich inv olves find ing the or- thogon al space of a vector space. Now , we present the analysis of the algorith m. 1. In step 1, we prepar ed th e state 1 | G | P g | g i| 0 i a nd apply the b lack box U f to obtain the state 1 | G | P g | g i| f ( g ) i . After discard ing the second register, the resulting state is | H | | G | | g H ih g H | . W e have two such copies. 2. After pe rformin g a QFT over G on two such cop ies, we measur e the irr ep label and a row index. The p robab ility of measuring an irr ep label µ is given by p ( µ ) = d µ χ µ ( H ) | H | / | G | , where χ µ is the character of the irrep. If µ is a on e-dimension al irrep, th en th e ch aracter is either 0 or 1 and so the p robab ility becomes 0 or | H | / | G | accordin gly . The char acter χ µ ( H ) = 0 if an d only if µ = ( a, b ) ∈ S ⊥ H . Th erefore, the total probability of obtaining a one dimensional irrep is | H || S ⊥ H | / | G | . Now , we have th at | H | = | S H | and so | H || S ⊥ H | = p 2 n since S ⊥ H is th e ortho gonal space in Z 2 n p . Ther efore, th e total probab ility of obtain ing a o ne dimen sional irr ep in the mea surement is p 2 n /p 2 n +1 = 1 /p . Th is is expon entially small in th e input size ( log p ). Therefo re, the higher dim ensional irr eps occur with t otal probability of 1 − 1 /p . Since all of th em h av e th e same χ µ ( H ) = p n / | H | , each o f th em o ccurs with the same pr obability of 1 /p . T ake two copies o f coset states and pe rform weak Fourier sampling an d obtain two high d imensional irrep s k and l . The state is then | H | 2 p 2 n ρ k ( H ) ⊗ ρ l ( H ) . In the rest, we o mit the normalization | H | p n of each register . 3 W e r efer to Appendix B for a description of a technique that allows to change the labels of irreps of semidirect products that are more general than the W eyl-Heisenber g group. 12 Hari Krovi and Martin R ¨ otteler Therefo re, the state is propo rtional to ρ k ( H ) ⊗ ρ l ( H ) = X ( x,y ,z ) , ( x ′ ,y ′ ,z ′ ) ∈ H ω k ( z + y u )+ l ( z ′ + y ′ v ) p | u + x, v + y ih u , v | . ( 19) 3. W e can assume that k an d l are such that k + l 6 = 0 since this happens with pro b- ability ( p − 1) /p 2 . Now , ch oose α = q − k l . Since the equatio n l x 2 + k = 0 has at most two solutions fo r any k , l ∈ Z p , for any giv en k , l chosen uniform ly there exist solutions of the equation lx 2 + k = 0 with pr obability 1 / 2 . Perform a unitary U α : | u i → | αu i on the first copy . The first register becomes propor tional to U α ρ k ( H ) U † α = X ( x,y ,z ) ∈ H ω k ( z + y u ) p | α ( u + x ) ih αu | = X ( x,y ,z ) ∈ H ,u 1 ∈ Z n p ω k α 2 ( z 1 + y 1 u 1 ) p | u 1 + x 1 ih u | = ρ k α 2 ( φ α ( H )) , (20) where ( x 1 , y 1 , z 1 ) = φ α ( x, y , z ) = ( αx, αy , α 2 z ) and u 1 = αu . It can be seen easily tha t φ α is an isom orphism of G for α 6 = 0 an d hence φ α ( H ) is subgroup of G . In fact, φ α ( H ) is a con jugate of H sinc e S φ α ( H ) = S H (since if ( x, y ) ∈ S H , then so is every multiple of it i.e ., ( αx, αy ) ∈ S H ). Thu s, we h av e obtain ed an irrep state with a n ew irrep label over a d ifferent subgroup . But this new subg roup is r elated to the old o ne by a k nown transfo rmation. In choosing the value of α as above, we ensure that k /α 2 = − l and hence obtain one dimensional irreps in the Clebsch-Gord an decomposition. 4. W e now co mpute the state after perfo rming a Clebsch-Gordan transform U C G on the two copies of the coset states, i.e., perform the unitary gi ven by the action U C G : | u, v i − → X w ∈ Z n p ω l 2 ( u + v ) w p | u − v , w i . (21) The initial state of the two copies is ρ − l ( φ α ( H )) ⊗ ρ l ( H ) = X ( x 1 ,y 1 ,z 1 ) ∈ φ α ( H ) , ( x ′ ,y ′ ,z ′ ) ∈ H u,v ∈ Z n p ω − l ( z 1 + y 1 u )+ l ( z ′ + y ′ v ) p | u + x 1 , v + x ′ ih u, v | . The resulting state after the transform is X ( x 1 ,y 1 ,z 1 ) ∈ φ α ( H ) , ( x ′ ,y ′ ,z ′ ) ∈ H u,v, w 1 ,w 2 ∈ Z n p ω − l ( z 1 + y 1 u )+ l ( z ′ + y ′ v )+ l 2 ( u + v )( w 1 − w 2 )+( x 1 + x ′ ) w 1 p × | u − v + x 1 − x ′ , w 1 ih u − v , w 2 | = X ( x 1 ,y 1 ,z 1 ) ∈ φ α ( H ) , ( x ′ ,y ′ ,z ′ ) ∈ H u ′ ,v ′ ,w 1 ,w 2 ∈ Z n p ω − l ( z 1 + y 1 u ′ + v ′ 2 )+ l ( z ′ + y ′ v ′ − u ′ 2 )+ l 2 ( v ′ )( w 1 − w 2 )+( x 1 + x ′ ) w 1 p × | u ′ + x 1 − x ′ , w 1 ih u ′ , w 2 | , HSP ov er W eyl-Heisenber g Groups 13 where u ′ = u − v an d v ′ = u + v . Notice that v ′ occurs on ly in the ph ase and n ot in the quantu m s tates. Theref ore, collecting the terms with v ′ we get X v ′ ω l 2 ( y ′ − y 1 + w 1 − w 2 ) p . (22) This ter m is n on-zero o nly when y ′ − y 1 + w 1 − w 2 = 0 . Hence w 2 = w 1 − ( y 1 − y ′ ) . Substituting this back in the equation , we get X ( x 1 ,y 1 ,z 1 ) ∈ φ α ( H ) , ( x ′ ,y ′ ,z ′ ) ∈ H u ′ ,w 1 ∈ Z n p ω l 2 [ ( x 1 + x ′ ) w 1 − ( y 1 + y ′ ) u ′ − 2( z 1 − z ′ ) ] p | u ′ + x 1 − x ′ , w 1 ih u ′ , w 1 − ( y 1 − y ′ ) | . Reusing the labels u and v by putting u = u ′ and v = w 1 − ( y 1 − y ′ ) , we obtain X ( x 1 ,y 1 ,z 1 ) ∈ φ α ( H ) , ( x ′ ,y ′ ,z ′ ) ∈ H u,v ∈ Z n p ω l 2 [ ( x 1 + x ′ )( v +( y 1 − y ′ )) − ( y 1 + y ′ ) u − 2( z 1 − z ′ ) ] p | u + x 1 − x ′ , v + y 1 − y ′ ih u, v | . This can be written as X ( x 1 ,y 1 ,z 1 ) ∈ φ α ( H ) , ( x ′ ,y ′ ,z ′ ) ∈ H u,v ∈ Z n p ω l 2 h ( x 1 + x ′ ) v − ( y 1 + y ′ ) u − 2( z 1 − x 1 y 1 2 )+2( z ′ − x ′ y ′ 2 ) i p | u + x 1 − x ′ , v + y 1 − y ′ ih u, v | . Since H is abelian, x 1 y ′ − x ′ y 1 = 0 . No w consider the subgrou p H 0 defined in the previous section . Let g = ( ˆ x, ˆ y, ˆ z ) b e an element such tha t H g = H 0 . As discu ssed in Sec. 2, ( ˆ x, ˆ y ) are uniqu e u p to an element of S ⊥ H and ˆ z is any element in Z p . Now , wh en ( x ′ , y ′ , z ′ ) ∈ H is conjug ated with g , it gi ves ( x ′ , y ′ , z ′ + ˆ xy ′ − ˆ y x ′ ) = ( x ′ , y ′ , x ′ y ′ / 2) ∈ H 0 . The refore, z ′ − x ′ y ′ / 2 = x ′ ˆ y − ˆ xy ′ . In ord er to o btain H 0 from φ α ( H ) we need to conjugate by φ α ( ˆ x, ˆ y, ˆ z ) . Ther efore, z 1 − x 1 y 1 2 = α ( ˆ y x 1 − ˆ xy 1 ) . Incor porating this into the above e xpression, we get X ( x 1 ,y 1 ) , ( x ′ ,y ′ ) ∈ S H u,v ∈ Z n p ω l 2 [ ( x 1 + x ′ ) v − ( y 1 + y ′ ) u − 2( α ( ˆ y x 1 − ˆ xy 1 ))+2( x ′ ˆ y − ˆ xy ′ ) ] p | u + x 1 − x ′ , v + y 1 − y ′ ih u, v | . Now since S H is a linea r spa ce, we have that if ( x, y ) , ( x ′ , y ′ ) ∈ S H , th en ( x − x ′ , y − y ′ ) ∈ S H . Hence, substituting x = x 1 − x ′ , y = y 1 − y ′ , we get X ( x,y ) , ( x ′ ,y ′ ) ∈ S H u,v ∈ Z n p ω l 2 [ ( x +2 x ′ ) v − ( y +2 y ′ ) u − 2( α ( ˆ y ( x + x ′ ) − ˆ x ( y + y ′ )))+2( x ′ ˆ y − ˆ xy ′ ) ] p | u + x, v + y ih u, v | . Separating the sums over ( x, y ) and ( x ′ y ′ ) we get X ( x,y ) ∈ S H ,u,v ∈ Z n p   X ( x ′ ,y ′ ) ∈ S H ω l [ x ′ ( v +(1 − α ) ˆ y ) − y ′ ( u +(1 − α ) ˆ x ) ] p   ω l 2 [ x ( v − 2 α ˆ y ) − y ( u − 2 α ˆ x )] p | u + x, v + y ih u, v | . 14 Hari Krovi and Martin R ¨ otteler Note that the term i n the squar ed bra ckets is non-zero only when ( v + (1 − α ) ˆ y , u + (1 − α ) ˆ x ) lies in S ⊥ H . This means that if we m easure the above state we obtain pairs ( u, v ) such that ( u + (1 − α ) ˆ x, v + (1 − α ) ˆ y ) ∈ S ⊥ H . This can be used to determin e both S ⊥ H (and h ence S H ) an d ( ˆ x, ˆ y ) . Rep eat this O ( n ) times and obtain values fo r u and v by measu rement. 5. From the above, say we obtain n + 1 v alues ( u 1 , v 1 ) , . . . , ( u n +1 , v n +1 ) . Therefore, we have th e following v ectors in S ⊥ H . ( u 1 + (1 − α 1 ) ˆ x, v 1 + (1 − α 1 ) ˆ y ) , ( u 2 + (1 − α 2 ) ˆ x, v 2 + (1 − α 2 ) ˆ y ) , . . . . . . ( u n +1 + (1 − α n +1 ) ˆ x, v n +1 + (1 − α n +1 ) ˆ y ) . The affine translation can be removed by first dividing by (1 − α i ) and then taking the d ifferences since S ⊥ H is a linear space. Therefore, the following vectors lie in S ⊥ H : ( u ′ 1 , v ′ 1 ) = ( u 1 (1 − α 1 ) − u n +1 (1 − α n +1 ) , v 1 (1 − α 1 ) − v n +1 (1 − α n +1 ) ) , ( u ′ 2 , v ′ 2 ) = ( u 2 (1 − α 2 ) − u n +1 (1 − α n +1 ) , v 2 (1 − α 2 ) − v n +1 (1 − α n +1 ) ) , . . . . . . ( u ′ n , v ′ n ) = ( u n (1 − α n ) − u n +1 (1 − α n +1 ) , v n (1 − α n ) − v n +1 (1 − α n +1 ) ) . W ith high p robab ility , these vector s form a ba sis for S ⊥ H and hen ce we can de- termine S H efficiently . This implies th at the conjuga cy class and hence th e sub- group H 0 is known. It remains o nly to determine ( ˆ x , ˆ y ) . W e can set ( ˆ x, ˆ y ) = (1 − α 1 ) − 1 ( u 1 − u ′ 1 , v 1 − v ′ 1 ) since th e conjugating element can be deter mined up to ad dition by a n element o f S ⊥ H . H can b e ob tained with the k nowledge of H 0 and ( ˆ x, ˆ y ) . Finally , for completeness we con sider th e case p = 2 . Assume that after Fourier sam- pling we have two high dimensional irreps with states gi ven by ρ 1 ( H ) ⊗ ρ 1 ( H ) = X ( x,y ,z ) , ( x ′ ,y ′ ,z ′ ) ∈ H,u,v ∈ Z n 2 ( − 1) z + z ′ + y u + y ′ v | u + x, v + x ′ ih u, v | . (23) The Clebsch-Gord an transform is giv en by the base change: | u, v i → X w ∈ Z n 2 ( − 1) wv | u + v , w i . (24) Applying this to the two states, we obtain (in a similar manner as above) X ( x,y ,z ) ∈ H ,u,v ∈ Z n 2 ( − 1) z + vx   X ( x ′ ,y ′ ,z ′ ) ∈ H ( − 1) uy ′ + vx ′   | u + x, v + y ih u, v | . (25) HSP ov er W eyl-Heisenber g Groups 15 The inne r sum is non-zero if and only if ( u , v ) ∈ S ⊥ H . Th us, measurin g this state gi ves us S ⊥ H from w hich we can find S H . W e cannot de termine H directly f rom h ere as in the case p > 2 . But since we know S H , we know th e conjugacy c lass of H and we can determ ine the abe lian g roup H G ′ which contains H . T his group is ob tained by append ing the elements of S H with every element of G ′ = Z 2 i.e., for ( x, y ) ∈ S H we can say that ( x, y , 0) and ( x, y , 1) are in H G ′ . Once we kno w H G ′ , we n ow restrict the hiding fun ction f to the abelian sub group H G ′ of G and ru n the abelian version of the standard algorithm to find H . In summ ary , we hav e sho wn the following result: Theorem 1. F o r n ≥ 1 , a nd p ≥ 2 p rime, the hidden subg r ou p pr oblem for the W eyl- Heisenber g gr oup G of or der p 2 n +1 can be solved on a qua ntum com puter with O ( n ) queries. The time complexity of the quantum algorithm can be bound ed by O ( n 3 log p ) operations 4 and the algorithm uses at most k = 2 c oset states at the same time. Sketch o f pr oof. From the ab ove discussion follows that O ( n ) iteration s of Steps 1.–4. in the algor ithm will lead to sy stem of equations in Step 5. that with con stant probab ility h as a unique solutio n. The number of qu eries in each iteration is constan t and the compu tational com plexity of ea ch o f th ese steps can be u pper b ounded as fol- lows: O ( n log p log log p ) operations f or each compu tation of QFT over G as described in Ap pendix A. The tr ansform U α and the Clebsch-Go rdan transform U C G can eas- ily b e impleme nted using a rithmetic mo dulo p and QFTs over Z p , b oth of which can be d one in O (lo g p log lo g p ) elementary qu antum ope rations. Hence the running time of the qua ntum part of th e algorithm can be u pper bou nded by O ( n 2 log p log lo g p ) operation s and the numb er of qu eries by O ( n ) . Th e overall runnin g time is do mi- nated by the co st f or classical post-p rocessing wh ich co nsists in com puting the ker- nel of an n × n matr ix over Z p . T his c an be up per b ound ed by O ( n 3 ) arith metic operation s over Z p for the Gaussian elimination, leadin g to a total bit complexity of O ( n 3 log p lo g lo g p 2 O (log ∗ log p ) ) operation s when usin g th e cur rently fastest k nown algorithm for integer multiplication [F ¨ ur07].  6 Conclusions Using the fr amework of coset states and n on-abe lian F ourier samplin g we showed that the hidden subgroup problem for the W eyl-Heisenbe rg group s can be solved effi ciently . In each iteration of the algorith m the quantum computer operates on k = 2 coset states simultaneou sly which is an im provement over th e previously be st known qu antum al- gorithm which r equired k = 4 coset states. W e believe that the metho d of chan ging irrep labe ls an d th e tech nique o f u sing Clebsch -Gordan tra nsforms to devise multireg- ister exper iments has some m ore p otential for th e so lution of HSP over other gro ups. Finally , th is g roup has importan ce in error cor rection. In fact, the state we obtain af ter Fourier sampling and measuremen t of an irrep is a projector onto the c ode space whose stabilizer generato rs are given by th e generators of H . In vie w of this fact, it will be interesting to stud y th e implica tions o f the quan tum algo rithm der iv ed in this paper to the design or decod ing of quantum error-correctin g co des. 4 Ignoring factors gro wi ng as log log p or weaker . 16 Hari Krovi and Martin R ¨ otteler Acknowledgmen ts W e th ank Sean Hallgren and Pranab Sen for useful comments and discussions. Refer ences [AE07] A. Ambainis and J. Emerson. Quantum t -designs: t -wise independence in the quan- tum world. In Pr oceedings of the 22nd Annual IEEE Confer ence on Computational Complexity , pa ges 129–140, 2007. Also arxiv prep rint quant-ph/07011 26. [Bac08a] D. Bacon. How a Clebsch-Gordan transform helps to solve the Heisenberg hidden subgroup problem. Quantum Information and Computation , 8(5):438 –467, 2008. [Bac08b] D. Bacon. Simon’ s algorithm, Clebsch-Gordan siev es, and hidden symmetries of multiple squares. Ar xi v preprint quant-ph/0808.017 4, 2008. [BCD05] D. Bacon, A. Childs, and W . v an Dam. F rom optimal m easurement to ef ficient quan - tum algorithms for the hidden subgroup problem ov er semidirect product groups. In Pr oceedings of the 46th A nnual IEEE Symposium on F oundation s of C omputer Sci- ence , pages 469–47 8, 2005. A lso arxi v preprint quant-ph/050 4083. [Bet87] Th. Beth. On th e comp utational comple xity o f the general discrete F ourier transform. Theor eti cal Computer Science , 51:331–3 39, 1987. [BH97] G. Brassard and P . Høyer. An exa ct p olynomial–time algorithm for Simon’ s problem. In Proc eedings of Fifth Israeli Symposium on Theory of Computing and Systems , pages 12–33. ISTCS , IEEE Computer Society Press, 1997. Also arxiv preprint qu ant– ph/97040 27. [CRSS97] A. R. Calderbank, E. M. Rains, P . W . Shor, and N. J. A. Sloane. Quantum error cor- rection and orthogonal geometry . Physical Review Letters , 78(3):405 –408, January 1997. Also arxi v preprint quant-ph/9 605005. [CRSS98] A. R. Calderbank, E. M. Rains, P . W . Shor , and N. J. A. Sloane. Quan tum error correc- tion via codes over GF(4). IEEE T ransaction s on I nformation Theory , 44(4):1369– 1387, July 1998. Also arxi v preprint quant-ph/9 608006. [CSV07] A. Childs, L . J. Schulman, and U. V azirani. Quantum algorithms for hid den n onlinear structures. In Pro ceedings of the 48th Annual IEEE Symposium on F oundations of Computer Science , pages 395–40 4, 2007. Also preprint arxi v:0705.2 784. [DHI03] W . v an Dam, S. Hallgren, and L. Ip. Quantum algorithms for some hidden shift problems. I n P r oceedings of the Symposium on Discrete Algorithms (SOD A) , pages 489–49 8, 2003. Also arxi v preprint quant–p h/0211140 . [EHK04] M. Ettinger, P . Høyer, and E. Knill. T he quantum query complex ity of t he hidden subgroup problem is polynomial. Information Pr ocessing Letters , 91(1):43– 48, 20 04. Also arxiv p reprint quant–ph/04 01083. [FIM + 03] K. Friedl, G. Ivan yos, F . Magniez, M. Santha, and P . Sen. Hidden translation and orbit coset in quantum comp uting. In Pr oceedings of the 35th Annua l ACM Symposium on Theory of Computing , pages 1–9, 2003. Also arxi v preprint quant–ph /0211091. [F ¨ ur07] M. F ¨ urer . Faster integer multiplication. In Proceed ings of the 39th A nnual A CM Symposium on Theory of Computing , pages 57–66, 2007. [Got96] D. Gottesman. A class of quantum error-correcting codes saturating the quantum Hamming bo und. Physical Revie w A , 54(3):186 2–1868, September 1996. Also arxi v preprint quant-ph/96 04038. [GSVV04] M. Grigni, L. Schulman, M. V azirani, and U. V azirani. Quantum mechanical algo- rithms for the nonabelian hidden subgroup p roblem. Combinatorica , pages 137 –154, 2004. HSP ov er W eyl-Heisenber g Groups 17 [Hal02] S. Hallgren. Polynomial-time quantum algorithms for Pell’s equation and the princi- pal ideal problem. In P r oceedings of the 34th Annua l A CM Symposium on Theory of computing , pages 653–658 , 2002 . [HH00] L. Hales and S . Hallgren. An improved quantum Fourier transform algorithm and applications. In Proc. of the 41st Annual Symposium on F ounda tions of C omputer Science (FOCS’00) , pages 515–52 5. IEEE Computer Society , 2000. [HMR + 06] S. Hallgren, C. Moore, M. R ¨ otteler , A. Russell, and P . Sen. Limitati ons of quan- tum coset states for graph i somorphism. In Pr oceedings of the 38th A nnual ACM Symposium on Theory of Computing , pages 604–617 , 2006. [Høy97] P . Høyer . Efficient Quantum T ransforms. Arxi v preprint quant-ph/9 702028, February 1997. [HR T 03] S. Hallgren, A. Ru ssell, an d A. T a-Shma. The hidd en sub group problem and quantum computation using group representations. SIAM Jou rnal on Computing , 32(4):916– 934, 2003. [Hup83] B. Huppert. Endliche Gru ppen , volume 1. Springer, 198 3. [ISS07] G. Iv anyo s, L. Sanselme, and M. Santh a. An e fficient algo rithm for hidde n subgroup problem in extraspecial groups. In P r oceeding s of the 24nd Annual Symposium on Theor eti cal Aspects of Computer Science (ST ACS’07) , Lecture Notes in Computer Science, vol. 4393, pag es 586–597 . Springer-V erlag, 2007. Also arx iv preprint qu ant- ph/07012 35. [Kit97] A. Y u. Kitaev . Q uantum computations: algorithms and error correction. Russian Math. Surve ys , 52(6):1191 –1249, 1997. [Kup05 ] G. Kuperb erg. A subexpone ntial-time quantum algorithm for the dihedral hidden subgroup problem. SIAM Journ al on Computing , 35(1):170– 188, 2005. Also arxiv preprint quant–ph /0302112. [ME98] M. Mosca and A. Ekert. The hidden subgroup problem and eigen value estimation on a quantum computer . In Quantum Computing and Quantum Communications , volum e 1509 of Lectur e Notes in Computer Science , pages 174–188 . Springer-V erlag, 199 8. [MRRS04] C. Moore, D. Rockmore, A. Russell, an d L. Schulman. The po wer of basis selection in Fourier sampling: hidden subgroup problems i n af fine groups. In Proce edings of the 15th Annual ACM -SIAM Symposium on Discr ete A lgorithms , pages 1113 –1122, 2004. Also arxi v preprint quant-ph/0 503095. [MZ04] M. Mosca and Ch. Zalka. E xact quantum Fourier transforms and discrete logarithm algorithms. International J ournal of Quantum Information , 2(1):91–100 , 2004. Also arxi v preprint quant–ph/03 01093. [NC00] M. Nielsen and I. Chuang. Quantum Computation and Quantum I nformation . Cam- bridge Uni versity Press, 2000. [Reg04] R. Re gev . Quantum co mputation and lattice problems. SIAM Jou rnal on Computing , 33(3):738–7 60, 2004 . [RRS05] J. Radhakrishnan, M. R ¨ otteler , and P . Sen. On the po wer of random bases in Fourier sampling: hidden subgroup problem in the Heisenberg group. In P r oceedings of the 3 2nd International Colloqu ium on Automata, Langua ges an d Pr ogramming , Lec- ture Notes in Computer Science, v ol. 3580, pages 1399–14 11. Springer-V erlag, 2005 . Also arxiv p reprint quant-ph/0503 114. [Sen06] P . Sen. Random measurement bases, quan tum state distinction and applications to the hidden subgroup problem. In P r oceeding s of the 21st Annual IEEE Confer ence on Computational Complexity , pages 274–287, 2006. Also arxi v preprint quant- ph/05120 85. [Ser77] J. P . Serre. Linear Repr esentations of F inite Gro ups . Springer , 1977. [Sho97] P . Shor . Polynomial-time algorithms for prime factorization and discrete l ogarithms on a quantum computer . SIAM Jou rnal on Computing , 26(5):1484–150 9, 1997. 18 Hari Krovi and Martin R ¨ otteler A QFT for t he W eyl-Heisenberg gr oups W e b riefly sketch how th e quantum Fourier tran sform (QFT ) can b e computed fo r the W eyl-Heisenb erg groups G n = Z n +1 p ⋊ Z n p . An im plementation o f th e QFT for the case where p = 2 was given in [H øy97]. This can be e xtended straightforwardly to p > 2 as follows. Using Eq. (9), we obtain that the QFT for G n is given b y the unitary operator QFT G n = X a,b,x,y ∈ Z n p ,z ∈ Z p r 1 p 2 n +1 ω ax + by p | 0 , a, b ih z , x, y | + X a,b,x,y ∈ Z n p k ∈ Z ∗ p ,z ∈ Z p r p n p 2 n +1 ω k ( z + by ) p δ x,a − b | k , a, b ih z , x, y | = X a ′ ,b ′ ,x ′ ,y ′ ∈ Z n − 1 p a n ,b n ,x n ,y n ,z ∈ Z p r 1 p 2 n − 1 1 p ω a ′ x ′ + b ′ y ′ p ω a n x n + b n y n p | 0 , a ′ a n , b ′ b n ih z , x ′ x n , y ′ y n | + X k ∈ Z ∗ p ,a ′ ,b ′ ,x ′ ,y ′ ∈ Z n − 1 p z ,a n ,b n ,x n ,y n ∈ Z p s p n − 1 p 2 n − 1 1 √ p ω k ( z + b ′ y ′ ) p ω ky n b n p δ x ′ ,a ′ − b ′ δ x n ,a n − b n | k , a ′ a n , b ′ b n ih z , x ′ x n , y ′ y n | = U · QFT G n − 1 . (26) The matrix U is given b y U = X x n ,y n ,a n ,b n ∈ Z p 1 p ω a n x n + b n y n p | 0 ih 0 | ⊗ | a n , b n ih x n , y n | + X x n ,y n ,a n ,b n ∈ Z p ,k ∈ Z ∗ p 1 √ p ω b n y n p δ x n ,a n − b n | k ih k | ⊗ | a n , b n ih x n , y n | = | 0 ih 0 | ⊗ QFT Z p ⊗ QFT Z p + X k ∈ Z ∗ p V · ( I p ⊗ QFT ( k ) Z p ) , (27) where I p is the p dimensional identity matrix, V = X u,v ∈ Z p | u + v , v ih u, v | , (28) and QFT ( k ) Z p = 1 √ p X u,v ∈ Z p ω kuv p | u ih v | . (29) From Eq. (2 7) and recursi ve a pplication of Eq. (26) we o btain the efficient quantum circuit implementin g QFT G n shown in Figure 1. HSP ov er W eyl-Heisenber g Groups 19 y 1 x 1 . . . y n x n z QFT QFT . . . ❝ P s QFT · · · · · · · · · · · · · · · . . . QFT ❝ P s QFT . . . ❣ s s · · · · · · · · · · · · · · · . . . ❣ s s Fig. 1. QFT for the W eyl-Heisenberg group. The QFT gates sho wn in t he circuit are QFTs for the cyclic groups Z p . Each of these QF Ts can be implemented approximately [Ki t97,HH00] or e xactly [MZ04], in both cases with a complexity bounde d by O (log p log log p ) . It should be noted that the wires in this circuit are actually p -dimensional systems. The meaning of t he controlled gates where the control wire is an open circle is that t he operation is applied to the target w ire if and only if the control wire i s in the stat e | 0 i . The meaning of the controlled P gates where the control wire is a closed circle here means that the gate P k is applied i n case the control wire is in state | k i with k 6 = 0 , and P 0 = I p . Here P k is the permutation ma- trix for which QFT ( k ) = P k QFT holds. T he comple xity of this circuit can be bounded by O ( n log p log log p ) . B Changing labels of irredu cible repr esentations In this section, we describe the tech nique of changing labels of irred ucible represen ta- tions (irre ps) in a mo re abstract, repre sentation theoretic, fashion. W e consider a situ- ation slightly m ore genera l than the W eyl-Heisenberg g roups con sidered in the paper, namely for semidirect pro ducts of the form G = A ⋊ φ B , where A is an Abelian group , B is an arbitrar y finite gr oup, and φ : B → Aut(A) . W e make some further assump- tions r egarding th e irr eps of G tha t arise d uring Fourier sampling . First, note that in general there might be some irreps o f G that arise as indu ctions [Ser77,Hup83] of ir - reps of A to G . Suppose that, with high prob ability , we sample only such irreps, so that we can restrict our attention to this case. This happens for the W eyl-Heisenb erg groups discussed in this pap er . Othe r examp les are th e gr oups isomorp hic to Z n p ⋊ Z p studied in [BCD05] and the affine groups [MRRS04] which are isomorp hic to Z p ⋊ Z p − 1 . After F ourier sampling and m easuremen t of an irrep label we h av e the state ρ k ( H ) , where ρ k is an irrep of G and k is its label. W e want to apply an operator U B to this state in ord er to ch ange it to a state ρ k ′ ( H ′ ) correspo nding to an irrep with label k ′ , possibly with respect to a different subgro up H ′ . In the following we show how this can be done if ρ k ( H ) = ( χ k ↑ G )( H ) , i. e., if ρ k is an induction of an irrep χ k of A to G . The possible labels k ′ that can be obtained depend on the automorphism g roup of B , nam ely on those automorph isms of B th at can be extended to automorphisms of G . 20 Hari Krovi and Martin R ¨ otteler First, recall tha t for χ k ∈ ˆ A , the imag e o f an e lement ( a, b ) ∈ G und er the induction of χ k to G is gi ven by ( χ k ↑ G )( a, b ) = X t ∈ B χ k ( φ t − 1 ( a )) | tb − 1 ih t | , (30) where φ t − 1 = ( a 7→ φ − 1 ( t )( a )) ∈ Aut(A) . Now consider an auto morph ism of B , say β ∈ Aut( B ) . Let U B be the unitary matrix acting on C [ B ] correspo nding to this automor phism. Applying U B to Eq. (30), we get X t ∈ B χ k ( φ t − 1 ( a )) | β ( t ) β ( b − 1 ) ih β ( t ) | = X t ∈ B χ k ( φ β ( t ) ( a )) | tβ ( b − 1 ) ih t | . (31) In order to furthe r simplify th is expression , we n ow suppose that we ca n extend th e automor phism β to an au tomorp hism of the who le grou p in the form γ = ( α, β ) ∈ Aut( G ) , wher e α ∈ Aut (A) . W e der iv e some co nditions that α has to satisfy in order for this extension to be possible. First, we ha ve that γ (( a 1 , b 1 )( a 2 , b 2 )) = γ ( a 1 , b 1 ) γ ( a 2 , b 2 ) . (32) This condition becomes (( αφ b 2 )( a 1 ) + α ( a 2 ) , b 1 b 2 ) = (( φ β ( b 2 ) α )( a 1 ) + α ( a 2 ) , β ( b 1 b 2 )) . (33) Note th at in the ab ove equ ation, since α and φ t are elements of Aut(A) for all t , we write their produc t acting on a ∈ A as ( αφ t )( a ) . From Eq. (33) we obtain that φ β ( b ) = αφ b α − 1 (34) for all b ∈ B . Th is mean s that α ∈ N Aut(A) (Im( φ )) i.e., α lies in the normalize r of Im( φ ) , the imag e of φ in Aut(A) . Therefore , we need to pick the pair ( α, β ) such that the condition in Eq. ( 34) h olds. I t is clear that giv en α th ere always exists β such that Eq. (34) holds but not necessarily the other w ay aroun d. Thus, using th e assump tion that th e automo rphism can b e extend ed to all o f G , we can rewrite Eq. (31) as follo ws: X t ∈ B χ k ( φ β ( t ) ( a )) | tβ ( b − 1 ) ih t | = X t ∈ B χ k (( α − 1 φ t − 1 α )( a )) | tβ ( b − 1 ) ih t | . (35) Now , the inner produ ct χ k (( α − 1 φ t − 1 α )( a )) can b e written as χ ˆ α − 1 k (( φ t − 1 α )( a )) . Therefo re, the state is given b y X t ∈ B χ ˆ α − 1 k ( φ t − 1 ( α ( a )) | tβ ( b ) − 1 ih t | = ( χ k ′ ↑ G )( γ ( a, b )) , (36) where k ′ = ˆ α − 1 ( k ) . Here, ˆ α is an auto morph ism of the du al group ˆ A correspondin g to α such that the character remains in v ariant. Overall, we ha ve s hown the follo wing: Theorem 2. Let G = A ⋊ φ B and ρ k = ( χ k ↑ G ) ∈ ˆ G , where χ k ∈ ˆ A . Let U B ∈ C [ B ] be the unita ry matrix corresponding to an automorp hism β ∈ Aut( B ) th at can be extended to γ = ( α, β ) ∈ Aut( G ) . Th en by a pplying U B to the hidden su bgr oup state ρ k , we can change it to: U B ρ k ( H ) U † B = ρ k ′ ( γ ( H )) , (37) wher e k ′ = ˆ α − 1 ( k ) .