# The dihedral hidden subgroup problem

We give an exposition of the hidden subgroup problem for dihedral groups from the point of view of the standard hidden subgroup quantum algorithm for finite groups. In particular, we recall the obstructions for strong Fourier sampling to succeed, but at the same time, show how the standard algorithm can be modified to establish polynomial quantum query complexity. Finally, we explain a new connection between the dihedral coset problem and cloning of quantum states.

There are no comments yet.

## Authors

• 1 publication
• 5 publications
• ### Deterministic Algorithms for the Hidden Subgroup Problem

In this note, we present deterministic algorithms for the Hidden Subgrou...
04/29/2021 ∙ by Ashwin Nayak, et al. ∙ 0

• ### On the connection between Deutsch-Jozsa algorithm and bent functions

It is presently shown that the Deutsch-Jozsa algorithm is connected to t...
12/03/2019 ∙ by Eraldo Pereira Marinho, et al. ∙ 0

• ### The Hidden Subgroup Problem for Universal Algebras

The Hidden Subgroup Problem (HSP) is a computational problem which inclu...
01/30/2020 ∙ by Matthew Moore, et al. ∙ 0

• ### Improved Low-qubit Hidden Shift Algorithms

Hidden shift problems are relevant to assess the quantum security of var...
01/31/2019 ∙ by Xavier Bonnetain, et al. ∙ 0

• ### A Low Degree Learning Algorithm for Quantum Data via Quantum Fourier

Advances in quantum information processing compel us to explore learning...
02/10/2021 ∙ by Mohsen Heidari, et al. ∙ 0

• ### Very strong evidence in favor of quantum mechanics and against local hidden variables from a Bayesian analysis

The data of four recent experiments --- conducted in Delft, Vienna, Boul...
08/21/2018 ∙ by Yanwu Gu, et al. ∙ 0

• ### Learning With Errors and Extrapolated Dihedral Cosets

The hardness of the learning with errors (LWE) problem is one of the mos...
10/23/2017 ∙ by Zvika Brakerski, et al. ∙ 0

##### This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

## 1. Introduction

Let be a finite group and a hidden subgroup of . A function which is constant on left -cosets and takes distinct values on distinct left -cosets is called a separating function for the subgroup .

The hidden subgroup problem (HSP) is the problem of finding generators for the hidden subgroup , given access to evaluations of a separating function for . This problem can be solved in polynomial time using a quantum computer when is an abelian group and has been extensively studied for many finite groups [5] [3] [4]. The cyclic group case leads to an efficient quantum algorithm to factor integers [5] [9]. A survey of known results about the HSP for dihedral groups can be found in [6] [4], where we note a subexponential quantum algorithm is given in [7].

A polynomial time quantum algorithm for solving the hidden subgroup problem on dihedral groups would imply a polynomial time quantum algorithm to solve certain hard lattice problems which are considered intractable using classical computers [8]. Another example is the HSP on the symmetric group, which can be used to solve the graph isomorphism problem, a well-known NP-complete problem.

In this paper, we review the standard HSP algorithm as it applies to the dihedral groups and detail the obstructions for this algorithm to succeed in this case. On the other hand, we explain how the standard HSP algorithm yields the polynomial query complexity result of [1].

Finally, we prove a number of results which provide a new connection between the dihedral coset problem (DCP) and cloning of quantum states.

## 2. Acknowledgements

We would like to thank P. Høyer for helpful comments and bringing to our attention [7].

## 3. The QFT for finite groups

Let be a finite group and denote a complete set of representatives for the isomorphism classes of irreducible representations of over . For a representation , let be the dimension of

. Recall the Quantum Fourier Transform (QFT) on

is defined as the linear transformation

 (3.1) FG :V→^V FG :=∑g∈G∑ρ∈^Gdρ∑i,j=1√dρ|G|ρ(g)i,j|ρ,i,j⟩⟨g|,

where is the

-vector space generated by

, and is the -vector space generated by , . Picking an isomorphism , it is a unitary operator which can be efficiently approximated using quantum circuits.

Suppose is the dihedral group of order , which can be presented as

 Dn=⟨x,y:xn=e,y2=e,yxy−1=x−1⟩.

If is even, there are four -dimensional representations given by

 (3.2) ϕu,v:x↦(−1)u,y↦(−1)v

where . These are pull backs of the four -dimensional representations of under the quotient homomorphism , where denotes the cyclic group of order .

If

is odd, there are two

-dimensional representations given by where . These are pull backs of the two -dimensional representations of under the quotient homomorphism .

There are irreducible representations of dimension given by

 (3.3) ρk:Dn →GL2(C) x ↦(ωkn00ω−kn) y ↦(0110)

for , where . These are the induction of the representation given by from to .

The representations and form the complete list of irreducible representations of up to isomorphism.

## 4. The standard HSP algorithm

In the standard algorithm for finding hidden subgroups from a separating function, we perform the following steps:

We form the state

 (4.1) √1|G|∑g∈G|g⟩|f(g)⟩,

where is the given separating function.

This can be achieved by starting with the state , where is the identity element of , then performing the following computations:

 (4.2) |eG⟩|0⟩ ↦√1|G|∑g∈G|g⟩|0⟩Apply the QFT over G↔Z/|G|Z,eG↔0 to first register. (4.3) ↦√1|G|∑g∈G|g⟩|f(g)⟩ Compute f into second register.

Measuring the second register and discarding it, we obtain a state of the form

 (4.4) √1|H|∑h∈H|ch⟩.

We apply the QFT to the above state to obtain

 (4.5) ∑ρ∈^G√dρ|G||H|dρ∑i,j=1∑h∈Hρ(ch)i,j|ρ,i,j⟩.

In the case of being an abelian group, measuring gives sufficient information to determine efficiently after running this process repeatedly and using post processing [5].

In the case of and

, the probability of obtaining

is when , which does not allow one to distinguish the groups .

Explicitly, in the complex basis (3.3):

If , then

 (4.6) ∑h∈Hρ(xαh) =(ωαknω−(a−α)knω(a−α)knω−αkn) (4.7) ∑h∈Hρ(yxαh) =(ω(a−α)knω−αknωαknω−(a−α)kn).

If , then

 (4.8) ∑h∈Hρ(xαh) =(−1)αu+(−1)v+(a−α)u =(−1)αu(−1+(−1)v+au) (4.9) ∑h∈Hρ(yxαh) =(−1)(a−α)u+(−1)v+αu =(−1)(a−α)u(−1+(−1)v+au).

If one changes to the real basis, we get a probability distribution dependent on

, but it is very flat, making it hard to distinguish the subgroups .

More generally, in order for the QFT to be an unitary operator, we require that be unitary for every and for . In particular, for any set of -dimensional irreducible representations , we have that

 P(ρk,i,j) =1n|(ρk(cyxa)+ρk(c))i,j|2 ≤1n(|ρk(cyxa)i,j|+|ρk(c)i,j|)2 ≤4n,

where is the probability of observing the state . Although the choice of basis may result in probability distributions of states which depend on , if is very large, the above inequalities show that the probabilities will always be very flat.

###### Remark 4.10.

In [1], it is shown that the hidden subgroup problem for for a general subgroup is reduced to the case of a single reflection subgroup .

## 5. Dihedral coset sampling

In the standard HSP algorithm, after the first step we are left with random coset samples as in (4.4). In the case of , the dihedral group of order , and , this is explicitly of the form

 (5.1) 1|H|∑h∈H|ch⟩ =1√2(|c⟩+|cyxa⟩) =1√2(|yβxα⟩+|yβxαyxa⟩) =⎧⎨⎩1√2(|xα⟩+|yxa−α⟩) if β=01√2(|xa−α⟩+|yxα⟩)% if β=1

where .

###### Remark 5.2.

The second case is reduced to the first by the transformation if this transformation leaves the distribution of invariant.

Given samples of the form

 (5.3) ψa=ψαa=1√2(|xα⟩+|yxa−α⟩),

the dihedral coset problem (DCP) is the problem of finding generators for the hidden subgroup . The states are called DCP samples for .

For HSP samples produced from the standard algorithm, where

is from the uniform distribution, we may view HSP samples as DCP samples by Remark

5.2.

## 6. Polynomial quantum query complexity

In [1], it is shown that a polynomial number of HSP samples is sufficient to recover using exponential time post processing. A related result in [2] using different methods shows the HSP problem in a general finite group has polynomial quantum query complexity.

Transposing , and applying a Hadamard gate to the state in (4.6), gives the state

 (6.1) 1√2(111−1)(ωαknω(a−α)knω−(a−α)knω−αkn)=1√2(ωαkn(1+ω−akn)ω−αkn(1+ωakn)ωαkn(1−ω−akn)ω−αkn(1−ωakn)).

The probability of observing the first row is

 (6.2) 12n(1+cos(2πak/n))=1ncos2(πak/n).

For the second row, it is

 (6.3) 12n(1−cos(2πak/n))=1nsin2(πak/n).

We are now in the situation of [1] and can apply the post processing algorithm described (which is exponential in time) to determine with high probability, for large .

## 7. Relation to quantum cloning

By copying a state , we mean forming the composite state for a blank initialization state and ancilla state , and applying a quantum algorithm to produce the state .

The no cloning theorem asserts that there is no unitary operation which can copy a general unknown quantum state. However, if the states are chosen from a known set of mutually orthogonal states, cloning is possible as the following proposition shows.

###### Proposition 7.1.

Let be a set of mutually orthogonal states which depend on a parameter . Suppose for some index (which is unknown).

If the value of is known, then there is a unitary operation which copies .

###### Proof.

First note that we can copy any state of the computational basis. Start with

 (7.2) |i⟩|0⟩=|in⟩…|i0⟩|0⟩…|0⟩,

where we have encoded the last two registers into qubits, for large enough.

Applying a CNOT gate to the th and th qubits produces for every . Hence, we can produce the state

 (7.3) |in⟩…|i0⟩|in⟩…|i0⟩=|i⟩|i⟩.

Now, encode a unitary operator which has the effect

 Ua|ψia⟩=|i⟩.

Starting with

 (7.4) |ψia⟩|0⟩,

apply to the first register to obtain

 (7.5) |i⟩|0⟩.

Copy the state to obtain

 (7.6) |i⟩|i⟩.

Applying to both registers gives

 (7.7) |ψia⟩|ψia⟩.

For the proof of Theorem 7.25, we need a slightly stronger version of Proposition 7.1.

###### Proposition 7.8.

Let be a set of mutually orthogonal states which depend on a parameter . Suppose for some index (which is unknown).

Suppose we can encode a unitary operator such that .

If we have the value of in a register, then there is a unitary operation which copies .

###### Proof.

Starting with

 (7.9) |a⟩|ψia⟩|0⟩|0⟩,

apply to obtain

 (7.10) |a⟩|i⟩|0⟩|0⟩.

Copy the states and to obtain

 (7.11) |a⟩|i⟩|a⟩|i⟩.

Applying to both pairs of registers gives

 (7.12) |a⟩|ψia⟩|a⟩|ψia⟩.

which we can permute to obtain

 (7.13) |a⟩|ψia⟩|ψia⟩|a⟩.

###### Proposition 7.14.

If we can copy any given DCP sample

 (7.15) 1√2(|xα⟩+|yxa−α⟩),

to produce a state of the form

 (7.16) 1√2(|xα⟩+|yxa−α⟩)⊗1√2(|xα⟩+|yxa−α⟩),

then we can determine the value of from DCP samples for .

If is known, then we can copy any given DCP sample for using a unitary operation.

###### Proof.

Given samples of the form (7.16), we measure both registers, and with probability we obtain

 (7.17) |xα⟩|yxa−α⟩ or |yxa−α⟩|xα⟩.

The sum of the observed exponents of the two registers gives .

If is known, then DCP samples for ,

 1√2(|xα⟩+|yxa−α⟩),

are chosen from a set of mutually orthogonal states depending on the parameter . By Proposition 7.1, for each sample of the form (7.15) we can copy it to produce a sample of the form (7.16). ∎

###### Remark 7.18.

In [7], it is shown that the HSP for reduces to determining the parity of . Copying a DCP sample up to parity would allow one to determine the parity of .

###### Theorem 7.19.

If is unknown, there is no unitary operation, which from a list of DCP samples for , copies an additional DCP sample for the same , while leaving the list of DCP samples alone.

###### Proof.

Suppose there is a unitary operator which transforms

 (7.20) U|ψ1a⟩⋯|ψNa⟩|ψa⟩|s⟩|M⟩=|ψ1a⟩⋯|ψNa⟩|ψa⟩|ψa⟩|Ma⟩,

where is a DCP sample for fixed, and randomly chosen for each such state (the quantity is suppressed in the notation ). Here is a blank initialization state and is an ancilla state.

We are supposing performs the above operation for any (unknown) . Thus, we also have that

 (7.21) U|ψ1b⟩⋯|ψNb⟩|ψb⟩|s⟩|M⟩=|ψ1b⟩⋯|ψNb⟩|ψb⟩|ψb⟩|Mb⟩.

for any other .

Taking the inner product of both sides of (7.20) and (7.21) we deduce

 (7.22) ⟨ψ1a|ψ1b⟩⋯⟨ψNa|ψNb⟩⟨ψa|ψb⟩=⟨ψ1a|ψ1b⟩⋯⟨ψNa|ψNb⟩⟨ψa|ψb⟩2⟨Ma|Mb⟩.

However, there are choices of for , and which do not satisfy (7.22).

To see this, recall the states

 ψa=1√2(|xα⟩+|yxa−α⟩), ψb=1√2(|xβ⟩+|yxb−β⟩),

have possible inner product , and there are choices of and such that , for instance, if and .

We may thus suppose without loss of generality that for all , and hence (7.22) becomes

 ⟨ψa|ψb⟩=⟨ψa|ψb⟩2⟨Ma|Mb⟩.

We obtain a contradiction again by choosing and so that as then

 (7.23) |⟨ψa|ψb⟩|=12, (7.24) |⟨ψa|ψb⟩2⟨Ma|Mb⟩|≤14.

###### Theorem 7.25.

There is no unitary operation to compute the value of into a register from a list of DCP samples for .

###### Proof.

Suppose there is a unitary operator which has the effect

 (7.26) U|ψ1a⟩⋯|ψNa⟩|s⟩|M⟩=|ϕ(ψ1a,…,ψNa)⟩|a⟩|Ma⟩.

That is, takes takes a list of DCP samples for fixed but unknown , a blank initialization state , and an ancilla state , and then computes into the blank register.

Using an additional blank register and copying , there is a unitary operator with the effect

 (7.27) U′|ψ1a⟩⋯|ψNa⟩|s⟩|t⟩|M⟩=|ϕ(ψ1a,…,ψNa)⟩|a⟩|a⟩|Ma⟩.

Use and permute and to obtain

 (7.28) |ψ1a⟩⋯|ψNa⟩|a⟩|s⟩|M⟩.

Thus, without loss of generality, we may assume the unitary operator has the effect

 U|ψ1a⟩⋯|ψNa⟩|s⟩|M⟩=|ψ1a⟩⋯|ψNa⟩|a⟩|Ma⟩.

That is, takes takes a list of DCP samples for fixed but unknown , a blank initialization state , and an ancilla state , and then computes into the blank register, while leaving the list of DCP samples alone.

Now, note that DCP samples can be encoded using two registers as

 1√2(|0⟩|α⟩+|1⟩|a−α⟩).

The unitary operator which sends

 V|a⟩|0⟩|α⟩ =|a⟩|0⟩|α⟩, V|a⟩|1⟩|α⟩ =|a⟩|1⟩|a−α⟩,

will have the effect

 V|a⟩|ψαa⟩=|a⟩1√2(|0⟩+|1⟩)|α⟩.

Using a Hadamard gate, we can encode a unitary operator such that

 U01√2(|0⟩+|1⟩)|α⟩=|0⟩|α⟩ U01√2(|0⟩−|1⟩)|α⟩=|1⟩|α⟩

Then the unitary operator has the effect

 (I⊗U0)V|a⟩|ψαa⟩=|a⟩|0⟩|α⟩.

We can thus apply Proposition 7.8 to copy an additional DCP sample for the same using a unitary operation, while leaving the list of DCP samples alone. This contradicts Theorem 7.25. ∎

The proof of Theorems 7.19 and 7.25 are based on the no cloning theorem [10], which preclude unitary operations, but not more general quantum algorithms, which may allow for approximate outputs, probabilistic processes, or post-processing. Indeed, computing the exact value of into a register is rather strong: even in the finite cyclic group case, the standard algorithm only determines a generator for the hidden subgroup using a probabilistic process.

On the other hand, Proposition 7.14 has the consequence that advances in quantum cloning algorithms would have implications for the DCP problem.

## References

• [1] M. Ettinger and P. Høyer, On quantum algorithms for noncommutative hidden subgroups, Advances in Applied Mathematics 25 (2000), 239–251.
• [2] M. Ettinger and P. Høyer, The quantum query complexity of the hidden subgroup problem is polynomial, Information Processing Letters 91 (2004), no. 1, 43–48.
• [3] M. Grigni, L. Schulman, M. Vazirani, and U. Vazirani, Quantum mechanical algorithms for the nonabelian hidden subgroup problem, Combinatorica, 24 (1) (2004), 137–154.
• [4] S. Hallgren, A. Russell, and A. Ta-Shma, The hidden subgroup problem and quantum computation using group representations, SIAM J. Comput., 32 (4) (2003), 916–834.
• [5] A. Kitaev, Quantum computations: Algorithms and error correction, Russian Math. Surveys, 52 (1997), 1191–1249.
• [6] H. Kobayashi and F. Le Gall, Dihedral hidden subgroup problem: a survey, IPSJ Journal, 46 (10) (2005), 2409–2416.
• [7] G. Kuperberg, A subexponential-time quantum algorithm for the dihedral hidden subgroup problem, SIAM J. Computing, 35 (1) (2005), 170–188.
• [8] O. Regev. Quantum computation and lattice problems. SIAM Journal on Computing, 33 (3) (2004), 738–760.
• [9] P. Shor. Algorithms for quantum computation: discrete logarithms and factoring, Proceedings of the 35th Annual Symposium on Fundamentals of Comp. Science (FOCS), 1994, 124–134.
• [10] W.K. Wootters and W.H. Zurek. A single quantum cannot be cloned. Nature 299 (1982), 802–803.