I Introduction
We consider the following communication scenario. Let an ensemble of quantum states be given. At each round, a referee prepares a state from the ensemble. The task is to guess which state it is, being allowed to query one state at a time until the referee’s answer is on the affirmative, at which point a new round begins. The cost function is represented by the average number of queries needed to correctly guess the state of the ensemble, and is therefore referred to as the quantum guesswork [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14]. Notice that, if multiple states could be queried at a time, the corresponding cost function would instead be the entropy [13] of the ensemble.
The most general strategy consists of measuring the state with a quantum measurement. The outcomes of any quantum measurement are classical labels, in this case represented by tuples of states. One then queries the states in the order they appear in the tuple. In other words, one will first ask the referee if the prepared state is the first appearing in the output tuple. If the answer is on the negative, one will proceed asking about the second state appearing in the output tuple, and so on, with the goal of correctly guessing with the minimum number of queries. Notice, in particular, that a strategy employing sequential uses of quantum instruments, each producing one state to be queried, reduces [13] to the present strategy by considering the composition of the instruments and discarding the final state.
The usual approach to compute the guesswork is based on semidefinite programming and thus leads to numerically approximated results. Here, instead, we are interested in an exact algorithm to compute the guesswork in finite time, where our computational model is a machine capable of storing integer numbers and of performing additions and multiplication in finite time. Even the existence of such an algorithm is not guaranteed a priori, given that the guesswork problem is, by definition, a continuous optimization problem. For the qubit case, however, the equivalence of the guesswork with a finite optimization problem has recently been shown [14]. Building on that result, we derive a factorialtime algorithm that computes in finitely many steps the exact closedform analytical expression of the guesswork of any given ensemble of qubit states.
We show how the symmetries of the ensemble, for whose characterization we provide an exact polynomialtime algorithm in the appendix, can be exploited to achieve a morethanquadratic speedup in the computation of the guesswork. To illustrate our results, we provide an implementations of our symmetriesfinding and guessworkcomputing algorithms in the C programming language, and we use them to exactly compute the guesswork of regular and quasiregular ensembles of up to twentyfour states, geometrically corresponding to Platonic and Archimedean solids in the Bloch sphere.
Ii Formalization
We use standard notation and results from quantum information theory [15]
. Qubit states are in onetoone correspondence with Pauli vectors, that is, threedimensional vectors within the unit sphere. Hence, an ensemble of
qubit states with uniform probability distribution and without repetitions can be represented by a finite set of Pauli vectors, that isFollowing Ref. [16], we denote with the set of tuples on without repetitions, that is if and only if
Any qubit effect can be represented as an affine function from the set of qubit states to . Hence, any valued qubit measurement can be represented as a family of such affine functions indexed by such that , where is the unit effect, that is
For any such qubit ensemble and any valued qubit measurement , the guesswork is the number of queries needed on average to correctly guess the state of when measuring , that is
The minimum guesswork is the minimum of the guesswork over any valued measurement , that is
(1) 
Iii Main result
The optimization problem in Eq. (1) was first solved in Ref. [14] for any given qubit ensemble with uniform probability distribution. The closedform analytical solution is as follows.
Theorem 1 (Dall’Arno, Buscemi, Koshiba).
For any ensemble of Pauli vectors with uniform probability distribution, the minimum guesswork is given by
(2) 
where for any tuple of elements of without repetitions the function is given by
(3) 
Proof.
The statement immediately follows from Theorem 1 and Corollary 1 of Ref. [14]. ∎
This result recasts the guesswork, an optimization problem over a continuous set of quantum measurements, as an optimization problem over a finite set of tuples. The complexity of the exhaustive search is given by the product of the complexity of generating all tuples in and the complexity of computing the function for each tuple. According to Eq. (3), the complexity of computing is . This can be improved if the tuples are generated so that each new tuple is obtained from the previous one by swapping only two elements. This is possible, for example by means of Heap’s or JohnsonTrotter’s algorithm [17, 16]. In this case, does not need be entirely recomputed at each step following Eq. (3): its value can be stored, and after each new tuple is generated, can be updated by only taking into account the contributions of the two states affected by the swapping. From Eq. (3), if tuples and differ by the swap of elements and with , then we have
(4) 
that represents a constanttime update of . Hence, the complexity of the algorithm is . Since this value also corresponds to the cardinality of set , it also represents the optimal complexity for an exhaustive search. By denoting with the function that returns the pair of indexes that need to be swapped to generate the next tuple according to Heap’s or JohnsonTrotter algorithm [17, 16] and if the end of the algorithm has been reached, we arrive at Algorithm 1.
In the appendix we present a polynomialtime algorithm that exactly computes the symmetries of . In the presence of symmetries, specifically if set is centrally symmetric or vertex transitive, the complexity of Algorithm 1 can be reduced, as shown in the following.
For any tuple , let us define the reversed tuple and the opposite tuple , and let denote the set of tuples in which each pair of centrally symmetric vectors appear in symmetric positions within the tuple, that is
Moreover, for any let denote the set of tuples with fixed point , that is
The following result holds.
Lemma 1 (Symmetries).
Proof.
Let us consider the centrally symmetric case. By specializing Lemma 4 of Ref. [14] to the case of qubit ensemble with uniform probability distribution, one has
that proves the statement.
Let us consider the vertex transitive case. By definition of vertex transitivity, one has that the range of the squared norm is unchanged if the range is restricted from to , that is
that proves the statement.
Let us consider the centrally symmetric and vertex transitive case. Due to central symmetry, there exists tuple attaining the maximum in Eq. (2) such that . Due to vertex transitivity, every tuple is unitarily equivalent to a tuple in . Hence the statement is proved. ∎
The set can be generated as follows. Let set be any subset of containing one element for each pair of centrally symmetric elements, that is, for each either or is in , but not both. Let also set be the complement of set , that is or equivalently . First, we show that sets and are in onetoone correspondence. For any tuple in , one has that tuples and given by
and
are in and , respectively. Viceversa, for any tuple and any tuple one has that tuple
(5) 
is in , where and denote the Hadamard (that is, elementwise) product and the direct sum (that is, concatenation) of tuples, respectively. Moreover, due to Eq. (5) any element of set can be generated from the corresponding element of set in constant time. The complexities [17, 16] of generating the elements of set and of set are and , respectively. Moreover, through a Gray code [16] it is possible to iteratively generate all tuples in such that each new tuple differs from the previous tuple by a single sign flip. If the sign flip occurs in the th position, from Eq. (3) it immediately follows that function is updated as follows
(6) 
that represents a constanttime update. Since for even one has , central symmetry can be exploited to reduce the complexity of Algorithm 1 by a factor of .
The set can be generated as follows. First, notice that sets and are in onetoone correspondence. For any tuple in , one has that its restriction is in . Viceversa, for any tuple in , one has that its extension
(7) 
is in . Moreover, due to Eq. (7), any element of set can be generated from the corresponding element of in constant time. Since all the elements of can be generated in steps [17, 16], vertex transitivity can be exploited to reduce the complexity of Algorithm 1 by a factor of .
The set can be generated by concatenating the two previous methods. Assuming is centrally symmetric and vertex transitive, for any , let be such that for any one has . Then, sets and are in onetoone correspondence. The correspondence can be explicitly built as before. Moreover, any element of can be generated from the corresponding element of in constant time. Since the complexities [17, 16] of generating the elements of sets and are and , respectively, central symmetry and vertex transitivity can be exploited to reduce the complexity of Algorithm 1 by a factor of , that represents a morethanquadratic speedup. By denoting with the function that returns the index that needs to be flipped to generate the next tuple according to the Gray code [16] and if the end of the code has been reached, we arrive at Algorithm 2.
Iv Explicit examples
In this section we apply Algorithms 2 and 4 to compute the exact closedform analytical expression for the minimum guesswork of regular and quasiregular qubit ensembles up to twentyfour vertices. We also provide [18] a C language implementation of such algorithms.
First, let us discuss ensembles of Pauli vectors whose coordinates can be represented (up to a scaling) by the ring of integers. These are the tetrahedron, octahedron, cube, truncated tetrahedron, cuboctahedron, and truncated octahedron. The values of the guesswork for tuples of Pauli vectors on the ring of integers are reported in Table I.
Tetrahedron  

Octahedron  
Cube  
Truncated tetrahedron  
Cuboctahedron  
Truncated octahedron 
Second, let us discuss ensembles of Pauli vectors whose coordinates can be represented (up to a scaling) by the ring
where and is a positive non square integer constant that only depends on the ensemble. These are the icosahedron, dodecahedron, truncated cube, and rhombicuboctaedron. To apply Algorithm 4 on a machine that implements integer arithmetic, we need to derive integer formulae for the arithmetic operations of sum, difference, multiplication by an integer, and square. They are clearly given by
and
We also need an integer formula to compare numbers. By direct inspection one has if and only if
The values of the guesswork for tuples of Pauli vectors on this ring are reported in Table II.
Icosahedron  

Dodecahedron  
Truncated cube  
Rhombicuboctahedron 
V Appendix
In this appendix we present an algorithm that, upon the input of any arbitrarydimensional complex point set, after finitely manysteps outputs its exact symmetries. The complexity of our algorithm is polynomial in the number of points.
Previous works [19, 20, 21, 22] approached the problem of finding the symmetries of any given point set (and the related problem of testing the congruence of two sets) from the geometric viewpoint, that is, by looking for unitary transformations that act as permutations of the set. As a consequence, previous symmetriesfinding algorithms depend on the full field structure (in particular, they depend on the arithmetic operation of division). To this aim, they assume the real computational model, that is, an unphysical machine that can exactly store any real number and can exactly perform arithmetic, trigonometric, and other functions over reals in finite time.
We instead approach the symmetriesfinding problem from the viewpoint of combinatorics, that is, by looking for permutations of the set that act as unitary transformations. In fact, by using wellknown results on Gram matrices, we avoid explicitly dealing with unitary transformations altogether. This way, we present a symmetriesfinding algorithm (that can also be trivially adapted to congruencetesting) that only depends on the weaker ring structure (that is, division is not assumed). Ours is therefore an integer computational model that solely assumes the ability to store integer numbers and to perform additions and multiplication in finite time, thus allowing us to achieve closedform analytical results on physical machines.
The factorial growth of the number of permutations in the cardinality of the set dooms to factorial complexity any algorithm based on a naive exhaustive search. However, by exploiting a wellknown rigidity property of simplices, we show that without loss of generality it suffices to search over a polynomialsized subset of permutations. The complexity of our symmetriesfinding algorithm is therefore , where denotes the dimension of the complex space.
For any given arbitrarydimensional spanning set of complex vectors, we denote with the group of permutations of . A permutation in is called a geometric symmetry (in the following, symmetry for short) of if and only there exists unitary transformation such that
(8) 
where denotes an tuple on without repetitions. We denote the group of all symmetries of with . Notice that the fact that is a spanning set guarantees that the mapping between and satisfying Eq. (8) is bijective.
Since the computation of the unitary transformation in Eq. (8) requires divisions in general (take for example to be the vertices of a square and to correspond with a rotation), we need an approach where remains implicit. It is a wellknown fact that two tuples of vectors are unitarily related if and only if their Gram matrices coincide, where the Gram matrix of an tuple of vectors is the matrix whose th entry is given by the inner product , that is
(9) 
Hence, tuples and satisfy Eq. (8) if and only if
(10) 
Since Eq. (9) can be clearly computed without divisions, this observation immediately leads to a divisionfree exact symmetriesfinding algorithm through an exhaustive search over the set of permutations. The complexity of the exhaustive search is given by the product of the complexity of generating all permutations and the complexity of computing and comparing the corresponding Gram matrices. According to Eq. (9), the latter complexity is . Hence, the complexity of the algorithm is . By denoting with the function that returns the pair of indexes that need to be swapped to generate the next tuple according to Heap’s or JohnsonTrotter’s algorithm [16] and if the end of the algorithm has been reached, we arrive at Algorithm 3.
We proceed now to improve the complexity of Algorithm 3 from factorial to polynomial. Let tuple on without repetitions be a basis, that is, the determinant of its Gram matrix is non null. Divisionfree algorithms for the computation of the determinant are known; for a particularly simple one, see Ref. [23]. Due to Eq. (10), a necessary condition for any permutation of to be a symmetry is that
(11) 
For any tuple satisfying , the permutation such that Eq. (10) holds, if it exists, is unique and can be explicitly derived as follows.
For some basis and any vectors we say if and only if
where is the minimum over such that is not null, and we call order the order induced by . Since is a basis, order is total. Let be the ordered tuple on without repetitions. Due to Eq. (8), for any in and any in , the inner product equals the inner product . Hence, tuple is the ordered tuple of all the elements of without repetitions. This explicitly and uniquely identifies permutation .
The complexity of the algorithm is given by the product of the complexity of generating all tuples in and the complexity of processing each tuple. Since the combinations of elements out of are , and for each combination there are differently ordered tuples, the complexity [17, 16] of generating the tuples is , that is, a polynomial of degree in . The complexity of processing each tuple is the sum of the complexity of generating ordered tuple , computing the Gram matrix , and comparing it with , hence it is . Hence, the complexity of the algorithm is . By denoting with the function that returns the pair of indexes that need to be swapped to generate the next combination according to the Chase’s sequence [16] and if the end of the algorithm has been reached, we arrive at Algorithm 4.
Vi Conclusion
While previous approaches based on semidefinite programming lead to approximate results, we presented a factorialtime divisionfree algorithm for the exact analytical computation of the guesswork of any given ensemble of qubit states with uniform probability distribution, with a morethanquadratic speedup in the presence of symmetries. As examples, we computed the exact expression for the guesswork of regular and quasiregular ensembles of qubit states.
Vii Acknowledgments
M. D. acknowledges support from MEXT Quantum Leap Flagship Program (MEXT QLEAP) Grant No. JPMXS0118067285, JSPS KAKENHI Grant Number JP20K03774, and the International Research Unit of Quantum Information, Kyoto University. F. B. acknowledges support from MEXT Quantum Leap Flagship Program (MEXT QLEAP) Grant No. JPMXS0120319794 and JSPS KAKENHI Grants Number 19H04066 and 20K03746. T. K. acknowledges support from MEXT Quantum Leap Flagship Program (MEXT QLEAP) Grant No. JPMXS0118067285 and No. JPMXS0120319794 and JSPS KAKENHI Grant Numbers 160H1705, 17H01695, 19K22849 and 21H0847.
References
 [1] J. Massey, Guessing and entropy, Proceedings of 1994 IEEE International Symposium on Information Theory, 204 (1994).
 [2] E. Arikan, An inequality on guessing and its application to sequential decoding, IEEE Trans. Inform. Theory 42, 99 (1996).
 [3] E. Arikan and N. Merhav, Guessing subject to distortion, IEEE Trans. Inform. Theory 44, 1041 (1998).
 [4] E. Arikan and N. Merhav, Joint sourcechannel coding and guessing with application to sequential decoding, IEEE Trans. Inform. Theory 44, 1756 (1998).
 [5] J. Pliam, The Disparity between Work and Entropy in Cryptology, Cryptology ePrint Archive 1998/024 (1998).
 [6] D. Malone and W. Sullivan, Guesswork and Entropy, IEEE Trans. Inform. Theory 50, 525 (2004).
 [7] R. Sundaresan, Guessing Under Source Uncertainty, IEEE Trans. Inform. Theory 53, 269 (2007).
 [8] M. K. Hanawal and R. Sundaresan, Guessing Revisited: A Large Deviations Approach, IEEE Trans. Inform. Theory 57, 70 (2011).
 [9] M. M. Christiansen and K. R. Duffy, Guesswork, Large Deviations, and Shannon Entropy, IEEE Trans. Inform. Theory 59, 796 (2013).

[10]
I. Sason and S. Verdú,
Improved Bounds on Lossless Source Coding and Guessing Moments via Rényi Measures
, IEEE Trans. Inform. Theory 64, 4323 (2018).  [11] I. Sason, Tight Bounds on the Rényi Entropy via Majorization with Applications to Guessing and Compression, Entropy 20, 896 (2018).
 [12] W. Chen, Y. Cao, H. Wang, Y. Feng, Minimum guesswork discrimination between quantum states, Quantum Information & Computation 15, 0737 (2015).
 [13] E. P. Hanson, V. Katariya, N. Datta, and M. M. Wilde, Guesswork with Quantum Side Information, arXiv:2001.03598.
 [14] M. Dall’Arno, F. Buscemi, and T. Koshiba, Guesswork of a quantum ensemble, arXiv:2012.09350.
 [15] M. M. Wilde, Quantum Information Theory, (Cambridge University Press, 2017).
 [16] D. E. Knuth, The art of computer programming, Volume 4A, Pearson Education (2011).
 [17] R. Sedgewick, Permutation generation methods, Computing Surveys 9, 137 (1977). Notice that in Algorithm 3a therein, the third line from the last should read “c[i] := 1; d[i] := not d[i]; i := i + 1;”.
 [18] https://codeberg.org/mda/libgw
 [19] P. T. Highnam, Optimal Algorithms for Finding the Symmetries of a Planar Point Set, CarnegieMellon University (1985).
 [20] Jan D. Wolter, Tony C. Woo, and Richard A. Volz, Optimal algorithms for symmetry detection in two and three dimensions, The Visual Computer 1, 37 (1985).
 [21] P. Brass and C. Knauer, Testing the congruence of ddimensional point sets, International Journal of Computational Geometry and Applications 12, 115 (2002).
 [22] H. Kim and G. Rote, Congruence Testing of Point Sets in 4Space, Proc. 32nd International Symposium on Computational Geometry (SoCG 2016), 48:148:16, Leibniz International Proceedings in Informatics (LIPIcs) 51.
 [23] R. S. Bird, A simple divisionfree algorithm for computing determinants, Information Processing Letters 111, 1072 (2011).