# Exponential separation between shallow quantum circuits and unbounded fan-in shallow classical circuits

Recently, Bravyi, Gosset, and König (Science, 2018) exhibited a search problem called the 2D Hidden Linear Function (2D HLF) problem that can be solved exactly by a constant-depth quantum circuit using bounded fan-in gates (or QNC^0 circuits), but cannot be solved by any constant-depth classical circuit using bounded fan-in AND, OR, and NOT gates (or NC^0 circuits). In other words, they exhibited a search problem in QNC^0 that is not in NC^0. We strengthen their result by proving that the 2D HLF problem is not contained in AC^0, the class of classical, polynomial-size, constant-depth circuits over the gate set of unbounded fan-in AND and OR gates, and NOT gates. We also supplement this worst-case lower bound with an average-case result: There exists a simple distribution under which any AC^0 circuit (even of nearly exponential size) has exponentially small correlation with the 2D HLF problem. Our results are shown by constructing a new problem in QNC^0, which we call the Relaxed Parity Halving Problem, which is easier to work with. We prove our AC^0 lower bounds for this problem, and then show that it reduces to the 2D HLF problem. As a step towards even stronger lower bounds, we present a search problem that we call the Parity Bending Problem, which is in QNC^0/qpoly (QNC^0 circuits that are allowed to start with a quantum state of their choice that is independent of the input), but is not even in AC^0[2] (the class AC^0 with unbounded fan-in XOR gates). All the quantum circuits in our paper are simple, and the main difficulty lies in proving the classical lower bounds. For this we employ a host of techniques, including a refinement of Håstad's switching lemmas for multi-output circuits that may be of independent interest, the Razborov-Smolensky AC^0[2] lower bound, Vazirani's XOR lemma, and lower bounds for non-local games.

## Authors

• 3 publications
• 12 publications
• 7 publications
• 11 publications
• ### Bounds on the QAC^0 Complexity of Approximating Parity

QAC circuits are quantum circuits with one-qubit gates and Toffoli gates...
08/17/2020 ∙ by Gregory Rosenthal, et al. ∙ 0

• ### Circuit Depth Reductions

The best known circuit lower bounds against unrestricted circuits remain...
11/12/2018 ∙ by Alexander Golovnev, et al. ∙ 0

• ### Bounds on stabilizer measurement circuits and obstructions to local implementations of quantum LDPC codes

In this work we establish lower bounds on the size of Clifford circuits ...
09/29/2021 ∙ by Nicolas Delfosse, et al. ∙ 0

• ### Reaching the speed limit of classical block ciphers via quantum-like operator spreading

We cast encryption via classical block ciphers in terms of operator spre...
11/12/2020 ∙ by Claudio Chamon, et al. ∙ 0

• ### Average-Case Lower Bounds and Satisfiability Algorithms for Small Threshold Circuits

We show average-case lower bounds for explicit Boolean functions again...
06/16/2018 ∙ by Ruiwen Chen, et al. ∙ 0

• ### Quantum Garbled Circuits

We present a garbling scheme for quantum circuits, thus achieving a deco...
06/01/2020 ∙ by Zvika Brakerski, et al. ∙ 0

• ### Average-Case Quantum Advantage with Shallow Circuits

Recently Bravyi, Gosset and König (Science 2018) proved an unconditional...
10/30/2018 ∙ by François Le Gall, et al. ∙ 0

##### This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

## 1 Introduction

One of the basic goals of quantum computing research is to identify problems that quantum computers can solve more efficiently than classical computers. We now know several such problems, such as the integer factorization problem, which we believe can be solved exponentially faster on a quantum computer [Sho97]. However, running this algorithm requires a large general-purpose quantum computer, which we do not yet have. Hence it is interesting to find examples of quantum speedup using weaker models of quantum computation, such as models with limited space or time, limited gate sets, or limited geometry of interactions.

##### Shallow quantum circuits.

One such model of quantum computation that has been studied for over 20 years is the class of shallow or constant-depth quantum circuits [MN02, Moo99, GHMP02, TD04, FGHZ05, HŠ05, FFG06, TT16]. Such circuits may be viewed as parallel quantum computers with a constant running time bound. Several variations on this theme have been studied (see [BGH07] for a survey of older results), and in recent years there has been a resurgence of interest [TT18, BVHS18, BGK18, CSV18, LG18] in constant-depth quantum circuits, for at least two reasons.

First, shallow quantum circuits are well motivated from a practical perspective, as we might actually be able to implement such circuits on near-term quantum computers! In the current era of Noisy Intermediate-Scale Quantum (NISQ) computers, due to high error rates of quantum gates, we are limited to running quantum algorithms for a short amount of time before errors accumulate and noise overwhelms the signal. Hence we seek interesting problems that can still be implemented by limited quantum hardware.

Second, constant-depth circuits (either classical or quantum) are very interesting to theoretical computer scientists, as it is possible to prove unconditional impossibility results about constant-depth circuits. For example, while we strongly believe that the factoring problem mentioned above requires exponential time on a classical computer, we cannot prove this. On the other hand, many of the early successes of complexity theory involved exhibiting explicit functions that could not be computed by constant-depth classical circuits [Ajt83, FSS84, Yao85, Hås86]. Indeed, constant-depth circuits remain the frontier of circuit lower bounds and an active area of research in classical complexity theory today [Wil14, MW18].

This motivates the search for problems that can be solved by constant-depth quantum circuits, while being hard for constant-depth (or even more powerful) classical circuits.

##### Prior work.

While there has been prior work on establishing the power of shallow quantum circuits assuming complexity theoretic conjectures [TD04, BVHS18], this work is not directly related to our work as we prove unconditional lower bounds.

In this realm the most relevant result is the recent exciting result of Bravyi, Gosset, and König [BGK18], who defined a search or relational problem111A search or relational problem can have many valid outputs for a given input, unlike a function problem that has exactly one valid output. A decision problem is a function problem with a -bit output. called the 2D Hidden Linear Function (2D HLF) problem. (We define this problem in Section 5

.) The 2D HLF problem can be solved by a constant-depth quantum circuit that uses bounded fan-in quantum gates. Indeed, the quantum circuit solving 2D HLF can be implemented on a 2-dimensional grid of qubits with spatially local quantum gates.

Furthermore, Bravyi, Gosset, and König [BGK18]

show that the 2D HLF problem cannot be solved by any constant-depth classical circuit using unbounded fan-out and bounded fan-in gates. Their lower bound even holds when the classical circuit is allowed to sample from an arbitrary probability distribution on polynomially many bits that does not depend on the input. (In complexity theory, this resource is called “randomized advice.”) More formally, the class of classical circuits of polynomial-size, constant-depth, unbounded fan-out, and bounded fan-in gates is called

.222In this paper, we will employ a common abuse of notation and use class names like and to generally talk about a type of circuit, as opposed to decision problems solved by such circuits. Hence, for example, we speak of “decision problems in ” and “search problems in ” although formally would be the class of decision problems solved by such circuits, and would be the class of search problems solved by such circuits. An circuit with the additional ability to sample from any probability distribution on polynomially many bits that is independent of the input, but that can depend on the input size, is called an circuit. The class of polynomial-size, constant-depth quantum circuits with bounded fan-in gates is called . Note that because quantum gates have the same number of inputs and outputs, circuits also have bounded fan-out, unlike classical circuits, which have unbounded fan-out.

With this notation, we can now summarize the Bravyi et al. result as follows [BGK18].

###### Theorem (Bravyi, Gosset, and König).

The 2D HLF problem can be solved exactly by a circuit on a 2D grid, but no circuit can solve the problem with probability greater than on every input.

The fact that the separating problem in [BGK18] is a search problem and not a function (or decision) problem is unavoidable, since any function in has output bits that only depend on a constant number of input bits, due to the bounded fan-in gates, and hence such a function would also be in .

This result was also recently improved by Coudron, Stark, and Vidick [CSV18], and (independently) Le Gall [LG18], who extended the lower bound to an average-case lower bound. As opposed to saying that no circuit can solve the problem on all inputs, an average-case hardness result says that no circuit can solve the problem even on some fraction of the inputs.333Note that [BGK18, Appendix C.3] already shows mild average-case hardness for this problem. These results show that no circuit can solve the problem with input size on an fraction of the inputs for some .

##### Main result.

In this work, we strengthen these results and prove a strong average-case lower bound for the 2D HLF problem against the class . is a natural and well-studied class that generalizes by allowing the circuit to use unbounded fan-in AND and OR gates. Note that because can compute functions that depend on all bits, such as the logical OR of all its inputs, whereas cannot. Our main result is the following.

###### Theorem 1 (2d Hlf).

The 2D HLF problem on bits cannot be solved by an circuit of depth and size at most . Furthermore, there exists an (efficiently sampleable) input distribution on which any circuit (or circuit) of depth and size at most only solves the 2D HLF problem with probability at most for some .

Thus our result proves a separation against a larger complexity class and implies the worst-case lower bound of Bravyi, Gosset, and König [BGK18]. It also implies the average-case lower bounds of Coudron, Stark, and Vidick [CSV18] and Le Gall [LG18].

### 1.1 High-level overview of the main result

We now describe the problems we study en route to proving creftypecap 1 and give a high-level overview of the proof.

creftypecap 1 is proved via a sequence of increasingly stronger results. We first introduce a problem we call the Parity Halving Problem (PHP). PHP is not in , but it can be solved exactly by a circuit, which is a circuit with quantum advice. Similar to randomized advice, a circuit class with quantum advice is allowed to start with any polynomial-size quantum state that is independent of the input, but can depend on the input length. For the Parity Halving Problem (and other problems introduced later), the quantum advice state is a very simple state called the cat state, which we denote by . We denote the subclass of where the advice state is the cat state .

Here’s a bird’s eye view of our proof: Our first result establishes that is in , but any nearly exponential-size circuit only solves the problem with probability exponentially close to . Next we define a new problem called the Relaxed Parity Halving Problem on a grid (), which is indeed in , but any nearly exponential-size circuit only solves the problem with probability exponentially close to . We then define parallel versions of these two problems, which we call and . We show that and , but any nearly exponential-size circuit only solves these problems with exponentially small probability. Finally we show that can be reduced to 2D HLF, and hence our lower bound applies to 2D HLF as well. We now describe these problems and our proof techniques in more detail.

##### Parity Halving Problem.

In the Parity Halving Problem on bits, which we denote by , we are given an input string promised to have even parity: i.e., the Hamming weight of , denoted , satisfies . The goal is to output a string that satisfies

 |y|≡|x|/2(mod2). (1)

In other words, the output string’s Hamming weight (mod 2) is half of that of the input string. Note that is well defined above because is promised to be even. An alternate way of expressing this condition is that if and if .

We show in Section 2 that can be solved with certainty on every input by a simple depth-2 circuit. A quantum circuit solving is shown in Figure 1. The circuit has one layer of controlled phase gates followed by Hadamard gates on the output qubits, followed by measurement.

Although the problem is easy for constant-depth quantum circuits, we show that even an exponential-size

circuit cannot solve the problem on the uniform distribution (over valid inputs) with probability considerably better than

, which is trivially achieved by the circuit that outputs the all-zeros string on all inputs.

###### Theorem 2 (Php).

The Parity Halving Problem can be solved exactly by a circuit. But on the uniform distribution over all valid inputs (even parity strings), any circuit of depth and size at most only solves the problem with probability for some .

Note that the parameters of the lower bound in this theorem are essentially optimal, since the parity function on bits can be computed by a depth- circuit of size [Hås86, Theorem 2.2]. Once we can compute the parity of the input bits, it is easy to solve .

Since the quantum circuit for is simple, it is clear that the difficult part of creftypecap 2 is the lower bound. One reason for this difficulty is that if we allowed the output string in to be of quadratic size, then there is a simple depth- circuit that solves this problem! The circuit simply computes the AND of every pair of input bits and outputs this string of size . A simple calculation shows that the Hamming weight of this string will be , which satisfies the conditions of the problem. Hence to prove the lower bound, the technique used has to be sensitive to the output size of the problem. However, traditional lower bound techniques were developed for decision problems, and do not explicitly take the output size of the problem into account. Hence we modify some known techniques and establish the this lower bound in three steps.

First, we use Håstad’s switching lemmas [Hås86, Hås14], or more precisely a recent refinement of it due to Rossman [Ros17]. However, directly using the result of Rossman off the shelf gives us a weaker result than creftypecap 2; we are only able to establish the theorem with a quasi-polynomially small correlation instead of the exponentially small correlation in creftypecap 2. To obtain the result we want, we refine Rossman’s result to work better for multi-output functions (creftypecap 14). This result is quite technical, but the conceptual ideas already appear in the works of Håstad [Hås14] and Rossman [Ros17]. Applying this switching lemma reduces the problem of proving an average-case lower bound to that of showing an average-case lower bound for a modified version of the Parity Halving Problem. This modified version of the problem is similar to PHP, except it has inputs and slightly more (say, ) outputs.

Our second step is to use a combinatorial argument to reduce this question to showing an average-case lower bound against circuits with locality (i.e., where each output only depends on a single input) for a further modified version of PHP.

The third and final step is to show that circuits with locality cannot solve this modifed PHP on a random input. We prove this by generalizing known lower bounds in the literature on quantum non-local games. Specifically we generalize lower bounds present in the work of Mermin [Mer90], and Brassard, Broadbent, and Tapp [BBT05].

This proof is presented in Section 2. We first prove the lower bound against circuits of locality 1 in Section 2.2, then show the lower bound against general circuits in Section 2.3, and finally introduce the switching lemma and conclude the proof of creftypecap 2 in Section 2.4. The switching lemma itself is proved in Appendix A.

Now creftypecap 2 is weaker than what we want (creftypecap 1) in two ways. Aside from the fact that the lower bound is for a problem different from the 2D HLF problem, the problem in creftypecap 2 is in and not , and the correlation lower bound is close to instead of being exponentially small. We now tackle the first problem and get rid of the cat state.

##### Relaxed Parity Halving Problem.

Since the cat state cannot be constructed in (proved in creftypecap 16), we have to modify the Parity Halving Problem to get by without a cat state.

Although we cannot create the cat state in , we can construct a state we call a “poor man’s cat state,” which is the state

 1√2(|z⟩+|¯z⟩), (2)

where is a bit string and denotes its complement. When , this is indeed the cat state, but in general this is some entangled state that can be converted to the cat state by applying the gate to some subset of the qubits.

Interestingly, we can create a poor man’s cat state in for a uniformly random . Here is one simple construction. First arrange the qubits on a line and set them all to be in the state. Then in a separate set of qubits, compute the pairwise parities of adjacent qubits. In other words, we store the parity of qubit 1 and 2, 2 and 3, 3 and 4, and so on until qubit and . And then we measure these qubits, and denote the measurement outcomes , which we will call the “difference string.” It is easy to verify that if all the , then the resulting state is indeed the cat state. In general, for any , the resulting state is a poor man’s cat state, and can be determined from the string up to the symmetry between and . Since and are symmetric in the definition of the poor man’s cat state, let us choose the convention that . Now we can determine the remaining from using the fact that , , and so on until . Note that because of this construction, some depend on many bits of . For example, is the parity of all the bits in .

This construction of the poor man’s cat state easily generalizes to graphs other than the 1D line. We could place the qubits on a balanced binary tree and measure the parity of all adjacent qubits, and hence get one for every edge in the tree. If we call the root node , then the value of any will be the parity of all on edges between vertex and the root. In this case each depends on at most bits of . Similarly, we can choose a 2D grid instead of a balanced binary tree, and set the top left qubit to be . Then each will depend on at most bits of . This grid construction is described more formally in Section 3.1.

Now there’s an obvious strategy to try: Simply use a poor man’s cat in our quantum circuit for instead of using an actual cat state, and redefine the problem to match the output of this quantum circuit! So we simply run the circuit in Figure 1 on a poor man’s cat state and see what the quantum circuit outputs. Unfortunately the output depends on , but the poor man’s cat state has been destroyed by the circuit and we do not have a copy of around. But we do still have the string from which it is possible to recover , although this may not be computationally easy since a single bit of may depend on a large number of bits of . More subtly, a single bit of may be involved in specifying many bits of , which is also a problem for circuits without fan-out, such as circuits. Instead of trying to recover , we can just modify the problem to include as an output. The problem will now have two outputs, one original output , and a second output string , which is the difference string of the in the poor man’s cat state. This is the Relaxed Parity Halving Problem, which is more formally defined in Section 3.2.

More precisely, the Relaxed Parity Halving Problem, or , depends on the choice of the underlying graph, and is well defined for any graph. We choose the 2D grid to get a problem that reduces to 2D HLF.444Picking the balanced binary tree would give better parameters, but qualitatively similar results. We choose the 2D grid so that our problem can be solved by a constant-depth quantum circuit acting on qubits laid out in 2D. We call this problem .

We show in Section 3.2 that can be solved by the 2D circuit we described, but even a nearly exponentially large circuit cannot solve the problem with probability significantly larger than on the uniform distribution over valid inputs.

###### Theorem 3 (Grid−RPHP).

can be solved exactly by a circuit on a 2D grid. But on the uniform distribution over all valid inputs (even parity strings), any circuit (or circuit) of depth and size at most can solve the problem with probability at most for some .

Note that just like creftypecap 2, the lower bound here is essentially optimal, since the parity function itself can be computed by a depth- circuit of size [Hås86, Theorem 2.2]. Our separation essentially works for any graph with sublinear diameter, such as the grid or the balanced binary tree, but not the 1D line. In fact, when the underlying graph is the 1D line, becomes easy to solve, even for circuits.555One can output and for all to solve the Relaxed Parity Halving Problem on the 1D line.

We prove creftypecap 3 by showing a reduction from the Parity Halving Problem with input size and output size to . This version of PHP is indeed hard for circuits and this result follows from the work done in Section 2. This reduction and theorem are proved formally in Section 3.2.

Now creftypecap 3 is still weaker than what we want (creftypecap 1). The correlation lower bound is still close to and not exponentially small. We now fix this issue using a simple idea.

##### Parallel Grid-RPHP.

Let be the problem where we are given many instances of in parallel and are required to solve all of them correctly. For this problem the quantum circuit is obvious: Simply use the quantum circuit for for each instance of the problem. Clearly if the quantum circuit solves each instance correctly, it solves all of them correctly. But since a classical circuit only solves an instance with some probability close to , we expect that solving many copies of the problem gets much harder.

###### Theorem 4 (Parallel Grid−RPHP).

can be solved exactly by a circuit on a 2D grid. But on the uniform distribution over all valid inputs (even parity strings for each instance of ), any circuit (or circuit) of depth and size at most can solve the problem with probability at most for some .

As before, the difficult part of creftypecap 4 is proving the classical lower bound. While it seems intuitive that repeating the problem (in parallel) several times reduces the success probability, similarly intuitive statements can be false or difficult to prove [Raz98]. More precisely, what we need is a direct product theorem, which also may not hold in some models of computation [Sha04].

We consider the parallel version of the standard , denoted , and reduce to as above. We then establish a lower bound for by using Vazirani’s XOR lemma [Vaz86]. Vazirani’s XOR lemma is an intuitive statement about how a probability distribution that is “balanced” in a certain sense must be close to the uniform distribution. The implication for our problem is the following: To understand the probability that a circuit solves all the instances of in , or equivalently that it fails to solve instances, it is enough to understand the probability that it fails to solve an even number of instances. This task turns out to be similar to the original with larger input and output size, but with some additional constraints on the input. The techniques we have developed allow us to upper bound this probability, and hence (using the XOR lemma) upper bound the probability that a circuit solves all instances correctly.

Now we are almost done, since creftypecap 4 looks very similar to creftypecap 1, except that the hardness is shown for and not the 2D HLF problem.

##### Reduction to the Hidden Linear Function problem.

The final step of our program is carried out in Section 5. First we show via a simple reduction in creftypecap 27 that the Relaxed Parity Halving Problem (for any graph ) can be reduced to the Hidden Linear Function problem (not necessarily the 2D HLF). In particular, our reduction reduces reduces to the 2D HLF problem, as we describe in creftypecap 30. So far this shows that one instance of reduces to the 2D HLF problem. We then show, in creftypecap 29, that we can embed multiple instances of 2D HLF in parallel into one instance of 2D HLF. Hence reduces to 2D HLF as well, and hence creftypecap 4 implies creftypecap 1.

We also consider the question of showing a separation between and , where is with unbounded fan-in XOR gates. We implement the first two steps of the strategy above, where we come up with a problem in that cannot be solved by an circuit, even on a fraction of the inputs. But we do not know how to remove the reliance on the cat state in this setting.

##### Parity Bending Problem.

In the Parity Bending Problem, which we denote , we are given a string , and our goal is to output a string such that if then , and if then . Our main result is creftypecap 5, which says that can be solved with high probability by a circuit, but needs exponential-size circuits to solve with probability significantly greater than half.

###### Theorem 5 (Pbp).

There exists a circuit that solves the Parity Bending Problem on any input with probability . But there exists an input distribution on which any of depth and size at most only solves the problem with probability .

As with the Parity Halving Problem, the quantum circuit that solves this problem with bounded error is very simple as shown in Section 6. For this problem, the classical lower bound is easier to show than before, and follows from the work of Razborov and Smolensky [Raz87, Smo87], which shows that circuits correlate poorly with the Mod 3 function.

As before, we can strengthen the separation to make the quantum circuit’s success probability arbitrarily close to and the classical circuit’s success probability arbitrarily close to by defining a new version of the Parity Bending Problem that we call the Parallel Parity Bending Problem. In this problem, we are given many instances of the Parity Bending Problem, and required to solve at least of them. Since can solve this problem with probability , it can solve more than of the instances with high probability.

###### Theorem 6 (Parallel PBP).

The Parallel Parity Bending Problem can be solved with probability by a circuit, but any circuit can only solve the problem with probability .

At a high level this lower bound proceeds similar to creftypecap 4, again employing Vazirani’s XOR lemma [Vaz86], but there are technical difficulties caused by the fact that the Boolean version of the Mod 3 function is unbalanced and easy to compute on a fraction of the inputs.

### 1.3 Discussion and open problems

Our main results show that there is a search problem (either the 2D HLF problem or the ) in that is not in , and that there is a search problem () in that is not in . One open problem is to generalize both separations and show that there is a search problem in that is not in , or more generally for any prime . This is essentially the frontier of circuit lower bounds, and it will be difficult to go further without radically new techniques.

One could try to achieve a quantum advantage using even weaker classes than or classes incomparable to . The recent result of Raz and Tal [RT19] exhibits a decision problem in (bounded-error quantum logarithmic time) that is not in . Note that as classes of search problems, and are incomparable, since both can solve search problems the other cannot.

## 2 Parity Halving Problem

Recall the Parity Halving Problem from the introduction. We now define a more general version of the problem with input bits and output bits.

###### Problem 1 (Parity Halving Problem, PHPn,m).

Given an input of even parity, output a string such that

 |y|≡12|x|(mod2). (3)

Alternately, must have even parity if

and odd parity if

. We also define to be .

The main result of this section is to show this problem is in , but not . We now restate this result (creftypecap 2) more formally:

###### Theorem 2 (formal).

The Parity Halving Problem can be solved exactly by a depth-, linear-size quantum circuit starting with the state. But on the uniform distribution over all valid inputs (even parity strings), any circuit of depth and size only solves the problem with probability .

We prove this theorem in several parts. First we prove the quantum upper bound in Section 2.1 (creftypecap 7). The lower bound on circuits via a sequence of incrementally stronger lower bounds, culminating in the claimed lower bound. We start in Section 2.2 by showing a lower bound (creftypecap 8) for a very simple class of circuits, circuits of locality , i.e., circuits where every output is an arbitrary function of exactly one input bit. We then extend the lower bound to arbitrary circuits in Section 2.3 (creftypecap 10), and to circuits in Section 2.4 culminating in the lower bound for in creftypecap 15, from which the lower bound in creftypecap 2 follows straightforwardly by setting .

### 2.1 Quantum upper bound

Before we get into the details of the proof, let us motivate the problem. Observe that the problem naturally defines an interesting -player cooperative non-local game, which we call the Parity Halving Game. In this game, there are players, and each player gets one of the input bits and outputs a single bit, with no communication with the other players. The input and output conditions are the same as in : The input is promised to be of even Hamming weight, and the players win the game if their output’s parity satisfies the condition in creftypecap 1.

Because the players are not allowed to communicate, the strategies permitted in the non-local game are far more restricted than an circuit or even an circuit for since each output bit is only allowed to depend on one input bit. We will call this model with locality .

Now that we have defined a game, we can study the probability of success for classical players versus the probability of success for quantum players who share entanglement before the game begins. In fact, when , the Parity Halving Game coincides with the well-known Greenberger–Horne–Zeilinger (GHZ) game [GHZ89]. It is known that quantum players sharing entanglement, and specifically the state , can always win the GHZ game with certainty, but classical players can win the GHZ game with probability at most .

This -player generalization of the GHZ game is very natural and quantum players can win the Parity Halving Game exactly using a state. This game has been studied before, and we are aware of two other works that analyze this game: the first by Mermin [Mer90], and the second by Brassard, Broadbent, and Tapp [BBT05]. Both papers exhibit the quantum strategy that wins perfectly and argue that classical strategies fail (as we do in the next section).

The strategy for winning the -player GHZ game generalizes to yield a perfect strategy for winning the -player game as well, which yields a depth- linear-size quantum circuit for . We now describe the quantum strategy and the corresponding constant-depth quantum circuit.

###### Theorem 7 (Quantum circuit for PHPn).

The Parity Halving Problem can be solved exactly by a depth-, linear-size quantum circuit starting with the state.

###### Proof.

We describe this circuit in the language of the -player Parity Halving Game described above. The circuit is depicted in Figure 1 (on page 1). Let the input to the player in the Parity Halving Game be called , and their output be called . In our protocol, the players will share an -qubit cat state , and each player receives one qubit of the cat state at the beginning.

Each player starts by applying a phase gate, , to their qubit of the cat state if their input bit is . If their input bit is , they do nothing. In other words, the player applies a control- gate with as the source and their qubit of the cat state as the target. After this step, the cat state has been transformed to

 1√2(|0n⟩+i|x||1n⟩). (4)

But since has even parity, this state is either or the “minus cat state” . We will denote this state by since this is the state one obtains by applying the gate to any one qubit of the cat state. When , this state will be and when , this will be . Note that and are orthogonal states.

Finally, each player applies the Hadamard gate to their qubit of the cat state, measures the qubit, and outputs that as . The operator maps the cat state to a uniform superposition over even parity strings, and maps to a uniform superposition over odd parity strings. This follows from the following equations:

 H⊗n|0n⟩=1√2n∑x∈{0,1}n|x⟩,andH⊗n|1n⟩=1√2n∑x∈{0,1}n(−1)|x||x⟩. (5)

Thus, when the players measure their qubits, they will get either a random even parity string when or a random odd parity string when , as desired. ∎

Note that the idea of inducing a relative phase proportional to the Hamming weight of a string is studied more generally and called “rotation by Hamming weight” in [HŠ05].

### 2.2 Lower bound for \Nc0 circuits of locality 1

We now discuss the success probability of classical strategies for the Parity Halving Game. This was already studied by Mermin [Mer90], and Brassard, Broadbent, and Tapp [BBT05]. Both papers argue that classical strategies only succeed with probability exponentially close to on the uniform distribution over even-parity inputs.

We reprove these lower bounds on the Parity Halving Game and also prove lower bounds for a restricted version of the game. In the restricted version of the game we only consider inputs consistent with some restriction of the input bits, i.e., where the values of some input bits have been fixed and are known to all the players, and we only consider all even-parity inputs consistent with this fixing of input bits. We need this generalization later on in the proof since some input bits will be fixed by a random restriction in the lower bound argument.

###### Theorem 8 (Classical lower bound for Parity Halving Game).

On the uniform distribution over even-parity strings, the success probability of any classical strategy for the Parity Halving Game with players is at most .

Now consider the restricted Parity Halving Game with players, where of the input bits have fixed values known to all players. On the uniform distribution over even-parity strings consistent with the fixed input bits, the success probability of any classical strategy is at most .

###### Proof.

We start with the lower bound for the unrestricted Parity Halving Game. Since we consider classical strategies against a fixed input distribution, we can without loss of generality only consider deterministic strategies. This is because a randomized strategy is simply a probability distribution over deterministic strategies, and we can pick the strategy that does the best against the chosen input distribution. (This is the easy direction of Yao’s minimax principle.)

Since each player only has one input bit , and one output bit , there are only four deterministic strategies: output , , , or . In any case, each is a degree- polynomial (over ) in . It follows that the parity of the outputs, , can be expressed as multivariate linear polynomial in , say for some and . We want to upper bound the success probability of any such strategy.

Now consider the function . We have

 f(x)=⎧⎨⎩1if |x|≡0(mod4)−1if |x|≡2(mod4)0otherwise. (6)

The function matches the parity of the output bits (as ) of the function on an input . More precisely, gives the correct parity (as ) when satisfies the promise of , and evaluates to for inputs outside the promise.

It follows that the product is if the strategy corresponding to is correct, if it is incorrect, and on inputs that are outside the promise. We define the correlation of a classical strategy as the absolute value of the fraction of valid inputs on which it is correct minus the fraction of valid inputs on which it is incorrect. We can compute this quantity as follows:

 χ =∣∣∣Ex∈Fn2:∑ixi=0[(−1)a+b⋅xf(x)]∣∣∣ (7) =∣∣ ∣∣12n−1∑x∈Fn2(−1)a+b⋅xR(i|x|)∣∣ ∣∣ (8) ≤12n−1∣∣ ∣∣R⎛⎜⎝∑x∈Fn2(−1)b1x1+⋯+bnxn⋅ix1+⋯+xn⎞⎟⎠∣∣ ∣∣ (9) =12n−1∣∣ ∣∣R⎛⎝∑x1∈F2(−1)b1x1ix1⋯∑xn∈F2(−1)bnxnixn⎞⎠∣∣ ∣∣ (10) =12n−1∣∣R((1+i1+2b1)⋯(1+i1+2bn))∣∣. (11)

That is, we want to know the real part of a product of terms, each of which is . Since is times a primitive eighth root of unity, the product is times an eighth root of unity. After factoring out the from each term, we have to determine the possible values of the product of numbers of the form . When is even, their product must lie in the set , and when is odd it must lie in the set . In both cases, we see that the real part of the product is either or , so the correlation is or . Since the success probability is , this proves the first part of the theorem.

Now let us move on the to restricted version of the game and fix some of the inputs. If some individual bit is restricted, then the term in the analysis above becomes either or . This term is a fourth root of unity, so it does not contribute to the magnitude of the product, since the fourth roots of unity have magnitude 1. Furthermore, it does not change the set of potential phases, since both the sets above are invariant under multiplication by a fourth root of unity. Since the constraint also halves the number of possible inputs, the effect on the correlation is the same as just removing that bit. In other words, is at most . It follows that the success probability of a classical strategy is

 1+χ2=12+2−⌈(n−d)/2⌉.\qed (12)

It is interesting to note that for the unrestricted game, Brassard, Broadbent, and Tapp [BBT05] show that there are strategies matching this upper bound.

### 2.3 From \Nc0 circuits of locality 1 to general \Nc0 circuits

We can view circuits as a more powerful model of computation than the game considered in the previous section. Now each player is allowed to look at the input bits of a constant number of other players before deciding what to output. For example, the players could band together into constant-sized groups and look at all the other bits in the group to make a slightly more informed choice. However, intuitively it seems that the players cannot do much better than before. We will show this formally by proving that circuits cannot solve .

First, we define some terms. Fix a circuit and define the interaction graph of the circuit to be a bipartite graph on the input bits and output bits where there is an edge from an input bit to an output bit if there is a path from to in the circuit (i.e., if can affect in ). The neighborhood of a vertex in this graph is sometimes called its light cone. That is, the light cone of an output bit, , is the set of input bits which can affect it, and the light cone of an input bit, is the set of output bits which it can affect. For example, if all gates have fan-in , then the light cone of any output bit in a circuit of depth is of size at most . In general, we say that a circuit has locality if the light cone of any output bit is of size at most .

Note that while the fan-in of gates sets an upper bound on the light cone of an output bit, the fan-out sets an upper bound for the light cone of input bits. In all the classical circuit classes we study in this paper, fan-out is unbounded, hence even in a constant-depth circuit one input bit can affect all output bits.

###### Proposition 9.

Let be a circuit with inputs, outputs, and locality . There exists a subset of inputs bits of size such that each output bit depends on at most one bit from .

###### Proof.

Since each output bit has a light cone of size at most , the interaction graph has at most edges. This implies that, on average, an input bit has a light cone of size . Our goal is to find a set of input bits such that their light cones are pairwise disjoint, since then the light cone of any output contains at most one element of .

Consider the intersection graph between input variables. That is, we consider the graph on , where is connected to if their light cones intersect. A variable that had degree in the original graph has degree at most in the intersection graph, since each output vertex has locality . Hence the average degree in the intersection graph, denoted by , is at most . By Turán’s theorem, in any graph on vertices with average degree at most there exists an independent set of size at least . Thus, we get a set of size such that the light cones of every pair of input bits in do not intersect. ∎

We are now ready to prove a lower bound on circuits of locality solving .

###### Theorem 10 (PHP is not in \Nc0).

Let be an circuit with inputs, outputs, and locality . Then solves on a random even-parity input with probability at most .

###### Proof.

Let the circuit solve on a random even-parity input with probability . By the previous theorem, there is a set of input bits with disjoint light cones, , and . For the remainder of this proof fix any such .

Now consider choosing an arbitrary assignment for the bits outside and running the circuit on the distribution of random even-parity strings consistent with this arbitrary assignment. The probability of success of circuit may depend on the arbitrary assignment chosen, but since the success probability for a random choice is , there exists one assignment for which the success probability is at least . Let us fix this assignment of bits outside . Now we have an assignment for bits outside such that is correct with probability at least on a random even-parity input consistent with this assignment.

We will now argue that the circuit gives a strategy for the restricted Parity Halving Game on players with restricted bits with probability of success at least . To do so, we assign a player for every input bit. Only the players assigned to bits in will have unrestricted inputs. Since the light cones of bits in do not intersect, a player with input bit in can compute the values of all outputs in its light cone (since all the bits outside are fixed and known to everyone). This player can now output the parity of all these output bits. Some output bits may not appear in any input light cone; we add the parity of these bits to an arbitrary player’s output. Now the the parity of the players’ outputs is the same as the parity of the circuit’s output. This gives a classical strategy for the restricted Parity Halving Game with players and restricted bits with success probability at least . Finally, from creftypecap 8 we get that . ∎

Note that this theorem is essentially tight. It says that to achieve a high probability of success, we need . We can indeed achieve success probability 1 at both extremes: when and , or when and . For the first setting of parameters, as noted in the introduction, there is a simple depth- circuit of locality 2 that solves the problem when . The second parameter regime is even simpler, since any Boolean function can be computed by an circuit of locality .

### 2.4 From \Nc0 circuits to \Ac0 circuits

In this section we finally extend our lower bound to circuits as stated in creftypecap 2.

To do this, we use a technical tool known as a switching lemma [FSS84, Ajt83, Yao85, Hås86]. Informally, a switching lemma says that with high probability randomly restricting a large fraction of the input bits to an circuit produces a circuit with small locality.

Average-case reductions from to have previously appeared in the literature (cf. [Vio14]), based on the original switching lemma [Hås86]. In this paper, we will use multi-switching lemmas, which handle multiple output circuits much better, and were recently proved by Håstad [Hås14] and Rossman [Ros17]. Using the multi-switching lemmas instead of Håstad’s original switching lemma [Hås86] allows us to improve the parameters dramatically.666 Based on the original switching lemma, we can show that is hard to compute by circuits on more than of the inputs. On the other hand, based on the multi-switching lemmas, we will show that is, in fact, hard to compute on more than of the inputs.

#### 2.4.1 Preliminaries

We start with some definitions. In the following, we consider restrictions and random restrictions. A restriction defines a partial assignment to the inputs of a Boolean string of length . For , when we say that the restriction fixes the value of the -th coordinate, and when we say that the restriction keeps the -th coordinate alive.

A -random restriction is a restriction sampled according to the following process: for each independently, sample with probability , with probability and with probability . We denote by the distribution of -random restrictions.

For a Boolean function we denote by the restricted function defined by

 f|ρ(x)=f(y)whereyi={xiρi=∗ andρiotherwise. (13)

Next, we give the standard definition of a decision tree. For an excellent survey on this topic, please see

[BdW02].

###### Definition 11 (Decision Tree).

A decision tree is a rooted ordered binary tree , where each internal node of is labeled with a variable and each leaf is labeled with a value 0 or 1. Given an input , the tree is evaluated as follows. Start at the root. If this is a leaf then stop. Otherwise, query the variable that labels the root. If , then recursively evaluate the left subtree, if then recursively evaluate the right subtree. The output of the tree is the value (0 or 1) of the leaf that is reached eventually. Note that an input deterministically determines the leaf reached at the end, and thus the output. We say a decision tree computes if its output equals , for all . The complexity of such a tree is its depth, i.e., the number of queries made on the worst-case input. We denote by the class of functions computed by decision trees of depth at most .

Note that the decision tree complexity of a function is also called the deterministic query complexity of .

###### Definition 12 (F-Decision Tree).

Suppose is a class of functions mapping to . An -partial decision tree is a standard decision tree, except that the leaves are marked with functions in (instead of constants). Given an input , the -Decision Tree is evaluated as follows. Starting from the tree’s root, we go along the path defined by the input until we reach a leaf. Then, we evaluate the function that labels the leaf on the input , and output its value, . We denote by the class of functions computed by -decision trees of depth at most .

Note that -decision trees compute functions from where and are the input and output lengths for the functions in , respectively.

###### Definition 13 (Tuples of functions classes).

Suppose is a class of functions mapping to . We denote by the class of functions of the form , where each . That is, is the class of -tuples of functions in .

#### 2.4.2 The multi-switching lemma

The main lemma that we are going to use is a slight adaption of Rossman’s lemma [Ros17], which combines both switching lemmas of Håstad [Hås86, Hås14]. The lemma claims that a multi-output circuit mapping would reduce under a random restriction, with high probability, to a function in the class (for some parameters and ).

Let us pause for a second to spell out what is the class . This is the class of depth- decision trees, whose leaves are labeled by -tuples of depth- decision trees, one per output bit. In other words, these are functions mapping to that can be evaluated by adaptively querying at most coordinates globally, after which each of the output bits can be evaluated by making at most additional adaptive queries. Note that while the first queries are global, the last queries could differ from one output bit to another. We would typically set the parameters so that is much larger than (for example, and ).

###### Lemma 14 (Multi-switching lemma).

Let be an circuit of size , depth . Let be a parameter, and set . Then

 ∀t:Prρ∼Rp[f|ρ∉DT(2t)∘DT(q)m]≤s⋅2−t. (14)

We defer the proof of creftypecap 14 to Appendix A as this is an adaptation of Rossman’s lemma [Ros17].

We would use the lemma as follows. First, we apply a -random restriction that reduces the circuit to a function with high probability. Then, we further query at most coordinates, and fix their values, by following a path in the common partial decision tree. After which, the restricted function would be an -tuple of depth- decision trees. Then, using the simple fact that a depth- decision tree is a function with locality at most , we reduced an circuit to an circuit with locality at most with high probability.

##### On the choice of parameters.

We have the freedom to choose and when applying creftypecap 14 in creftypecap 15. First, we discuss the choice of . We would like the lemma to yield on one hand an circuit with small locality, and on the other hand to keep many input variables alive. To get small locality, should be small, say . To keep many variables alive, should be large, and since , we would like to be large, say . Balancing these two requirements leads to the choice .

Once is set, we would like to make as large as possible, as it controls the failure probability in creftypecap 14, but on the same time we want the number of alive variables after the two-step restriction process above to remain high. Since this number is roughly we would choose to be a small constant fraction of (which is ). With these choices, we would be left with at least variables alive and locality at most with extremely high probability.

#### 2.4.3 \Ac0 lower bound

###### Theorem 15 (PHP is not in \Ac0).

Let . Any circuit of depth and size solves on the uniform distribution over valid inputs (even parity strings) with probability at most .

###### Proof.

Since we have a fixed input distribution, we can without loss of generality prove the lower bound against an circuit (instead of an circuit), since an circuit defines a distribution over circuits and we can simply pick the one that does the best against our input distribution.

Suppose that solves the Parity Halving Problem on a random even-parity input with probability . We shall show that .

We defer the choice of for later, to optimize the parameters. However, we will use the fact that and that . We set

 p=1/(m1/q⋅O(logs)d−1),t=pn/8. (15)

Note that under this choice of parameters , by the following calculation: using the assumption that twice, we have

 2t/2=exp(Ω(pn))=exp(Ω(m−o(1)⋅n(d+1)/2d))≫exp(n1/2d)>s. (16)

Let be a -random restriction. Denote by the event that:

1. .

2. keeps alive at least variables.

Using creftypecap 14 and Eq. (16), Item 1 holds with probability at least . Item 2 holds with probability at least by Chernoff’s bound. Thus, by a simple union bound

 Pr[E]≥1−exp(−Ω(pn)). (17)

If , then we are done as Eq. (17) implies . Going forward, we may assume that . In such a case, we claim that there exists a fixed restriction that satisfies , under which solves the Parity Halving Problem on at least fraction of the even-parity inputs consistent with . Assume by contradiction otherwise. Under our assumption:

• For restrictions satisfying , the success probability of on the even-parity inputs consistent with is at most .

• For other restrictions, the success probability of on the even-parity inputs consistent with is at most .

The key idea is that sampling a -random restriction, and then sampling an input with even parity consistent with this restriction (if such an input exists), gives the uniform distribution over even-parity inputs. Thus, under the above assumption, the probability that solves the Parity Halving Problem on a uniform input with even parity, is at most

 Pr[E]⋅(1/2+ε/2)+Pr[¬E]⋅1<1⋅(1/2+ε/2)