Quantum state verification in the quantum linear systems problem

We analyze the complexity of quantum state verification in the context of solving systems of linear equations of the form $A \vec x = \vec b$. We show that any quantum operation that verifies whether a given quantum state is within a constant distance from the solution of the quantum linear systems problem requires $q=\Omega(\kappa)$ uses of a unitary that prepares a quantum state $\left| b \right>$, proportional to $\vec b$, and its inverse in the worst case. Here, $\kappa$ is the condition number of the matrix $A$. For typical instances, we show that $q=\Omega(\sqrt \kappa)$ with high probability. These lower bounds are almost achieved if quantum state verification is performed using known quantum algorithms for the quantum linear systems problem. We also analyze the number of copies of $\left| b \right>$ required by verification procedures of the prepare and measure type. In this case, the lower bounds are quadratically worse, being $\Omega(\kappa^2)$ in the worst case and $\Omega(\kappa)$ in typical instances with high probability. We discuss the implications of our results to known variational and related approaches to this problem, where state preparation, gate, and measurement errors will need to decrease rapidly with $\kappa$ for worst-case and typical instances if error correction is not used, and present some open problems.


I. INTRODUCTION
Quantum computers may solve some problems that appear to be beyond reach of classical computers.Many examples of quantum speedups now exist, from the former result of P. Shor on the factoring problem [1], to optimization [2], the simulation of quantum systems [3], and beyond.As quantum technologies advance [4], so is the field of theoretical quantum computing, fueling the quest for new and fast quantum algorithms.
Along this quest, there has been interest in quantum algorithms for linear algebra, in particular for a problem related to solving systems of linear equations of the form A x = b.This problem, which we refer to as the quantum linear systems problem (QLSP), was introduced in Ref. [5].There, a quantum algorithm was given -the HHL algorithm -and its complexity was shown to be polylogarithmic in N , the dimension of the matrix A, under some assumptions.Due to the potential for an exponential quantum speedup and the relevance of systems of linear equations in science, the results of Ref. [5] sparked further interest for improved versions of the HHL algorithm.For example, Refs.[6][7][8][9] provide quantum algorithms for the QLSP with provable runtimes that are almost linear in κ, the condition number of A. These algorithms run faster than HHL, whose complexity is quadratic in κ, and are almost optimal.
More recently, quantum algorithms for the QLSP inspired by variational and related approximation approaches were given in Refs.[9][10][11][12].In a variational approach, the algorithm is designed via an optimization loop that requires preparing multiple copies of a parametrized quantum state, measuring a cost function, and using the measurement information to update the parameters for the next round of state preparations.This process is repeated until the cost function is minimized.Variational approaches open the possibility of preparing quantum states and solving certain problems with less complexity than the best-known methods, e.g., shorter circuit depths, or less number of qubits (cf.[13][14][15]), making them attractive to near-term applications.Similar arguments may also hold for other quantum algorithms, such as those formulated in the quantum adiabatic model [16].In this case, one may attempt to execute the evolution in less time than known upper bounds, with the potential of solving a problem with improved complexity (cf.[17,18]).
Like all heuristics, the actual runtime of these approaches may be unknown a priori, and the algorithms stop when a particular criterion is satisfied.For the QLSP, this requires verifying that the prepared quantum state is indeed sufficiently close to the desired one.This quantum state verification (QSV) step requires additional resources that need to be accounted for when determining the overall complexity of such approaches.A question then arises: Can QSV be performed with low complexity?
In this paper, we answer this question in the negative.We show that the complexity for QSV in the QLSP is Ω(κ) in the worst case.More precisely, if a quantum state |b that encodes the vector b can only be accessed via its preparation unitary U b , then the number of uses of U b , U −1 b , and their controlled versions cU ±1 b needed for QSV is Ω(κ) in the worst case.For typical instances of the QLSP, these unitaries must be implemented Ω( √ κ) times with high probability.As κ can grow rapidly with the problem size, perhaps scaling with the dimension of A, which is the case for many applications [19], QSV in the QLSP can be expensive.
Our main result is a generic lower bound for the com-plexity of QSV that applies to any instance of the QLSP.We also prove that optimal QSV, in terms of uses of cU ±1 b (or U ±1 b ), can be achieved using a known quantum algorithm for the QLSP, such as the HHL algorithm [5].One can run this algorithm to solve the QLSP and prepare a quantum state |x proportional to x, and then use the well-known swap test to verify if a given quantum state is close to |x [20].Although the HHL algorithm is not optimal [6,7], it turns out that is almost optimal in terms of uses of cU ±1 b .We also analyze a restricted class of QSV procedures of the prepare and measure type.In this case, we are given q ≥ 1 copies of the quantum state |b and arbitrarily many copies of the state to be verified, and the QSV procedure only involves a joint measurement of all quantum systems.We prove that q = Ω(κ 2 ) in the worst case and q = Ω(κ) for typical instances of the QLSP with high probability.These lower bounds are quadratically worse than those for general QSV procedures.
Our results place limitations for approaches to the QLSP that require a QSV step.If QSV is performed via the computation of a simple cost function that does not exploit the structure of U b , such as in known variational approaches, then the number of state preparations and projective measurements must increase rapidly (i.e., polynomially) with κ for worst-case and typical instances.Thus, to avoid error correction, state-preparation, gate, and measurement errors may need to decrease rapidly with κ, which is unrealistic.Nevertheless, our lower bounds on the complexity of QSV, as well as those for solving the QLSP [5], may be bypassed if the structure of U b can be exploited, opening the possibility for faster approaches to the QLSP.
The rest of the paper is organized as follows.In Sec.II we describe the QLSP in detail.In Sec.III we introduce the QSV problem for the QLSP and present our main results, focusing on worst-case and typical instances.In Sec.IV we describe an almost optimal QSV procedure based on the HHL algorithm.In Sec.V we analyze the complexity of QSV procedures of the prepare and measure type.In Sec.VI we give more details on the implications of our results, the limitations of variational approaches to the QLSP, and present some open problems.We provide further conclusions in Sec.VII.Detailed proofs of our main results are in the Appendices.

II. THE QLSP
We introduce the QLSP following Refs.[5][6][7][8].We are given an N × N Hermitian and non-singular matrix A, N ≥ 2, a vector b = (b 0 , b 1 , . . ., b N −1 ) T , and a precision parameter > 0. The matrix has spectral norm A = 1 and its condition number, which is the ratio between the absolute largest and smallest eigenvalues of A, is κ < ∞.

We define
which is a unit (pure) quantum state proportional to the solution of the system A x = b, where x = (x 0 , x 1 , . . ., x N −1 ) T is the solution.In general, we write |a for the Euclidean norm of a quantum state |a .If |b is a quantum state proportional to b, The goal in the QLSP is to prepare a (possibly mixed) quantum state ρ that satisfies where X tr = tr( √ XX † ) is the trace norm of X and D ρ,x is the trace distance.
Equation ( 2) implies that no experiment can distinguish ρ from |x with probability greater than in a single shot [21].Additionally, the expectation of an operator in ρ differs from that in |x by an amount that is, at most, proportional to .We assume N = 2 n without loss of generality, so that ρ, |x , and |b are n-qubit states.
Like known algorithms for the QLSP, we need to specify b and A in some way.In particular, we assume access to a unitary U b and its inverse Here, |0 is some simple state of n qubits, such as the allzero state.We further assume access to the controlled versions of these unitaries, cU ±1 b , which are more powerful and implement U ±1 b only when the state of a control qubit is |1 and do nothing otherwise.For the matrix A, we may assume access to a procedure U A that computes the positions and values of the nonzero entries of A. Both, U b and U A are treated as "black boxes", and no assumptions will be made on the inner workings of such unitaries.While the structure of U A is relevant for the design of many quantum algorithms, our results only concern the uses of U ±1 b or, more generally, cU ±1 b .The action of U A is described in detail in Ref. [7].

III. QSV AND MAIN RESULTS
We seek to certify whether D ρ,x ≤ 1/8 or D ρ,x > 1/2 for a given quantum state ρ.We choose these limits for simplicity, as these suffice for our purposes, but generalization to arbitrary gap between the limits is simple.In the QSV problem, the goal is to construct a quantum operation E, i.e. a completely-positive and trace preserving (CPTP) map, that takes arbitrary many copies of ρ as input, and outputs a random bit r as follows: When r = 1, we claim that ρ "passed the test" or that E "accepted" ρ, implying that ρ is likely to be close to |x .When r = 0, we claim that ρ "failed the test" or that E "rejected" ρ, implying that ρ is likely to be far from |x .One can amplify the probabilities of passing or failing the test from 2/3 to near 1 in either case by repetition and taking the median of the outcomes.
In general, E will contain measurements and unitaries, including U ±1 b and cU ±1 b , and can be described as in Fig. 1 without loss of generality.In this case, E = E q+1 • • • • • E 1 is a composition of q + 1 ≥ 1 quantum operations E j .For j ≤ q, these are where the F j 's are quantum operations that do not use is the quantum operation that implements the unitary cU sj b on part of the register output by F j−1 , and s j = ±1.The input to F 1 (and E) is a state σ 0 composed of m ≥ 1 copies of a quantum state ρ.The output of F q+1 (and E) contains the bit r.Note that, if E initially used unitaries U ±1 b that were not controlled, or if these unitaries were controlled on the state of a classical bit, these can still be thought as cU ±1 b 's with a proper state for the control qubit (e.g., |1 ).We then measure the complexity of a generic QSV procedure by the number of cU ±1 b required for its implementation.
General form of a quantum operation E for QSV in the QLSP.Arrows denote the states σj output by the quantum operations Ej and used as the input to the following Ej+1.The input state σ0 contains m copies of a state ρ.The output state σq+1 contains the bit r.
As defined, q is the maximum number of cU ±1 b needed to implement E. Nevertheless, the actual number of such unitaries implemented on any one execution of E, q A,b , may be random and less than q; only q such unitaries are needed in the worst case.For example, the operation could stop once certain criterion is met, such as a (random) measurement outcome.Our main result places a lower bound on q A,b that must be satisfied with constant probability by any quantum operation for QSV, for any m ≥ 1, and for any instance of the QLSP: Theorem 1.Consider any instance of the QLSP, specified by A and b, and any quantum operation E for QSV that satisfies Eq. (3).Then, for all quantum states ρ that satisfy D ρ,x ≤ 1/8, the number of cU ±1 b 's required with probability, at least, 1/6.
The proof of Thm. 1 is in Appendix A. The basic idea is related to that of Ref. [22] for proving the lower bound on quantum search and works as follows.For any b, it is possible to construct another instance specified by b , where the solutions to the corresponding QLSPs satisfy D x,x := 1 2 |x x| − |x x | tr > 5/8.Thus, D ρ,x > 1/2 and E must accept ρ with large probability (≥ 2/3) while E , which is the QSV operation that uses cU ±1 b , must reject it with large probability (≥ 2/3).Otherwise Eq. ( 3) is not satisfied.Simultaneously, the controlled state-preparation unitaries for these instances are shown to satisfy As E and E differ only in these unitaries (i.e., the operations F j are the same), the only way to distinguish among these two operations, or produce a constant change in Pr(r) on input σ 0 , is if the unitaries are used Ω(κ/ (1/A) |b ) times, with constant probability.
The argument behind Thm. 1 thus provides a relation between the complexity of QSV and the changes in the solution of the QLSP under perturbations to the initial state |b .This susceptibility is indeed quantified by κ/ (1/A) |b as seen from the following examples.

A. Worst-case instances
Corollary 1.There exist instances of the QLSP such that for all quantum states ρ that satisfy D ρ,x ≤ 1/8, the number of cU ±1 b 's required to implement E on input with probability, at least, 1/6.
This result is a direct consequence of Thm b 's needed to implement the QSV procedure on input σ 0 is Ω(κ) with constant probability (≥ 1/6).

B. Typical instances
The quantity (1/A) |b can take any value in [1, κ] providing a wide range of lower bounds when κ 1.It is important to determine (1/A) |b in typical instances of the QLSP as a lower bound on the complexity of QSV in such instances may differ from those in the worst or best cases.To this end, we consider instances where the eigenvalues of A are sampled from the uniform distribution unif{[−1, −1/κ] ∪ [1/κ, 1]} and the amplitudes in the spectral decomposition of |b are sampled from the so-called Porter-Thomas distribution (and renormalized) [23].This scenario resembles the one where the initial state |b is prepared by a random quantum circuit [24,25].We obtain: Theorem 2. Consider a random instance of the QLSP as described above.Then, there exists a constant c > 0 such that The proof of Thm. 2 is in Appendix B. In the asymptotic limit where N κ, we obtain that (1/A) |b = Θ( √ κ) with overwhelming probability.This implies: Corollary 2. Consider a random instance of the QLSP as described above.Then, there exists a constant c > 0 such that, for all quantum states ρ that satisfy with probability, at least, (1 − 4e −cN/κ )/6.
Corollary 2 is a direct result of Thms. 1 and 2, where we replaced (1/A) |b → 3κ/2 and bounded the joint probability by the product of (1 − 4e −cN/κ ), which is a lower bound on the probability that (1/A) |b ≤ 3κ/2, and 1/6, which is the lower bound on the probability in Thm. 1 that applies to any instance.Thus, for typical instances of the QLSP and N/κ = Ω(1), the complexity of QSV is Ω( √ κ) with constant probability.

IV. OPTIMAL QSV PROCEDURE
According to Thm. 1, any quantum operation for QSV in the QLSP requires Ω(κ/ (1/A) |b ) uses of cU ±1 b in expectation.An optimal QSV procedure is one that achieves this bound.In this Sec., we show that the former HHL algorithm can provide an almost optimal procedure for QSV, despite not being an optimal algorithm for solving the QLSP: the number of calls to the procedure U A is quadratic, rather than linear, in κ and polynomial in the inverse of a precision parameter.Other known quantum algorithms for the QLSP could also be used for optimal QSV and require less U A 's [6,7].
We use the HHL algorithm to prepare a state ρ x that is close to |x .Then, we implement the swap test [20] to gain information about the distance between ρ x and ρ, and thus between |x and ρ.In Appendix C we show that it suffices to satisfy D ρx,x = Ω(1) and to implement the HHL algorithm and the swap test a constant number of times to satisfy Eq. ( 3).
The HHL algorithm prepares ρ x using the unitaries cU ±1 b a number of times that is O(κ/ (1/A) |b ) in expectation.To achieve this, the HHL algorithm first applies an approximation of 1/(κA) to |b using quantum phase estimation and then uses amplitude amplification to amplify the probability of observing |x ∝ 1/(κA) |b .The expected number of amplitude amplification rounds is O(κ/ (1/A) |b ), the inverse of the norm of (1/(κA)) |b , if we follow Ref. [26].

V. PREPARE AND MEASURE (PM) APPROACHES
The results in Sec.III consider QSV procedures that assume access to the unitaries cU ±1 b .In contrast, prepare and measure (PM) approaches to QSV do not make this assumption.In a PM approach we are only allowed to prepare multiple copies of |b , multiple copies of ρ, and perform a joint measurement of all systems that produces the bit r according to Eq. ( 3).The joint measurement only involves operations that do not depend on b.
Without loss of generality, any PM approach to QSV is a quantum operation L that is a sequence of q ≥ 1 operations F j , as in Fig. 2. Each F j takes as input the state output by F j−1 , together with a fresh copy of |b .The input to F 1 is the state σ 0 = ρ ⊗m , m ≥ 1, and a copy of |b .The output of F q (and L) contains the bit r.We measure the complexity of a PM approach to QSV by the number of copies of |b required for its implementation.As defined, q is the maximum number of copies of |b needed to implement L. Nevertheless, the actual number of such states needed in any one execution of L, q A,b , may be random and less than q; only q such state preparations are needed in the worst case.The following result is the analogue of Thm. 1 for a PM approach to QSV.It places a lower bound on q A,b that must be satisfied with constant probability by any quantum operation for QSV of the PM type, for any m ≥ 1, and for any instance of the QLSP: Theorem 3. Consider any instance of the QLSP specified by A and b, and any quantum operation L for a PM approach to QSV that satisfies Eq. (3).Then, for all quantum states ρ that satisfy D ρ,x ≤ 1/8, the number of copies of |b required to implement L on input σ 0 = ρ ⊗m satisfies

a t e x i t s h a 1 _ b a s e 6 4 = " O h L i m q d w g / F s J T S d c z u Z J K u V 3 c 4 = " > A A A B + 3 i c b V D L S g N B E O y N r x h f U Y 9 e B o P g K e y G g H o L e P G Y g H l A s o T Z S S c Z
with probability, at least, 1/6.
The detailed proof is contained in Appendix D and the basic idea is similar to that of Thm. 1, in that we consider two instances of the QLSP.In this case, the quantum operation L is fixed but it is the input state what changes when we replace |b → |b .The number of copies of this state needs to be sufficiently large to produce a constant change in Pr(r), according to Eq. ( 3), setting the lower bound in Thm. 3. The scaling in Eq. ( 9) is quadratically worse than that obtained when one has direct access to both unitaries cU ±1 b .This is because the trace distance between q copies of |b and q copies of |b scales as √ q rather than linear in q.Following Secs.III A and III B, Ω(κ 2 ) copies of |b will be needed for the PM approach in the worst case and Ω(κ) in the typical case, with constant probability.

VI. IMPLICATIONS AND OPEN PROBLEMS
We analyze some implications of Thms. 1 and 3 in more detail and provide some open problems, which aim at bypassing our lower bounds.First, we note that the lower bounds are independent of m.Even if we had access to a full classical description of ρ, which could be obtained via quantum state tomography using m 1 copies, the QSV procedures would still need Ω(κ/ (1/A) |b ) uses of cU ±1 b or Ω((κ/ (1/A) |b ) 2 ) copies of |b with constant probability, respectively.Our results also suggest that we must know (or compute) κ beforehand, to be confident that a given QSV procedure works.For example, if κ 1 but a given QSV procedure involves a few ( κ) unitaries cU ±1 b or a few copies of |b , then Thms. 1 and 3 imply that such a procedure cannot produce the bit r that satisfies Eq. (3).
Additionally, known variational and related approximation algorithms for the QLSP also require a form of QSV [9][10][11][12].To this end, these algorithms evaluate a cost function such as C = H , which is the expectation of an observable H ≥ 0. In general, C ≥ 0, and only C = 0 when the state is the solution to the QLSP.The cost function can then be used to identify those states that are close to |x .For example, one can set a threshold C min > 0 such that, if C ≤ C min then D ρ,x ≤ 1/8.As C is estimated within given confidence, we can set this to be, at least, 2/3.
The only mild difference between this (modified) definition for QSV and the one of Sec.III is that some states with D ρ,x ≤ 1/8 can have C > C min and be rejected with probability greater than 1/3.This might happen, for example, when ρ is a superposition of eigenstates of H of smallest (0) and largest eigenvalues.This in itself can be an issue for variational approaches as they will be rejecting many useful states in the optimization loop.Nevertheless, the proofs of Thms. 1 and 3 provide similar results for these type of modified QSV procedures.Rather than having the lower bounds on q A,b apply to all states ρ such that D ρ,x ≤ 1/8, they apply to those states that satisfy C ≤ C min .
Therefore, the complexity of known variational approaches to the QLSP, as measured by the number of uses of cU ±1 b or number of copies of |b required for their implementation, will be large in worst-case and typical instances, scaling polynomially in κ.For example, one can use the expectation value of as the cost function, where P ⊥ 0 = 1l − |0 0| is the projector orthogonal to |0 .This Hamiltonian is positive semi-definite and |x is its unique ground state with zero eigenvalue [8].In Appendix E we show that the spectral gap of H is O(1/κ 2 ) if the eigenvalue of A with the second smallest magnitude is O(1/κ), which will be the case in most instances when N κ.Determining if D ρ,x ≤ 1/8 for these cases then requires measuring C within additive accuracy that is also O(1/κ 2 ); that is, C min = O(1/κ 2 ).Due to sampling noise, the overall number of state preparations, projective measurements, and uses of cU ±1 b (or U ±1 b ) needed is Ω(κ 4 ) to obtain the desired accuracy.Other cost functions may suffer from similar complications, requiring polynomially many uses of cU ±1 b [9][10][11].We note, however, that our lower bounds can be bypassed if the structure of U b (or |b ) can be exploited, opening the possibility to novel quantum approaches for the QLSP that work in this scenario.Additionally, the lower bounds are polynomial in κ for worstcase and typical instances but, for instances where, e.g., (1/A) |b = Ω(κ), the number of uses of cU ±1 b or copies of |b for QSV is constant.In this best-case scenario, the number of uses of cU ±1 b needed by the quantum algorithms for the QLSP in Refs.[5][6][7] is also a constant but the query complexity (uses of U A ) is still polynomial in κ, while the complexity of variational approaches remains unknown in general.
Relaxations of the QLSP for which the goal is to prepare a quantum state that reproduces limited properties of |x , such as certain expectation values, may also be of interest.Our lower bounds do not apply to such relaxations and faster quantum algorithms for these problems are also unknown.

VII. CONCLUSIONS
We studied the complexity of QSV in the context of solving systems of linear equations.We showed that, for worst-case and typical instances of the QLSP, QSV requires a number of state preparation unitaries, and their inverses, that is polynomial in κ.This complexity is large for many applications [19] and the result is not trivial: the solution to many computational problems can be verified in significantly less time than producing the solution itself, such as for NP-complete problems [27].This is not the case for worst-case and typical instances of the QLSP.
Our results place limitations for approaches to the QLSP that require a verification step (e.g., known variational approaches), where state preparation, gate, or measurement errors will need to decrease fast with κ for these instances, if no quantum error correction is used.We note, however, that our results assume no knowledge on the inner workings of the state preparation unitaries (they apply to the query model).If such knowledge is provided, it may be exploited for more efficient QSV and for solving the QLSP faster.
Our formulation of the QSV problem is fairly generic and concerns the non-adversarial scenario in the sense of Ref. [28].Nevertheless, extensions of our results to the adversarial case, in which the input is not promised to be m ≥ 1 copies of a state ρ, would be interesting.Many quantum operations can be used for QSV, including those that solve the QLSP or provide estimates of various distance measures between quantum states, such as the fidelity.As an example, we provided an optimal QSV procedure based on the HHL algorithm.
We also discussed a number of open problems that aim at bypassing our lower bounds.These include analyzing the complexity of QSV and algorithms for the QLSP in best-case instances, and relaxations of the QLSP where only certain properties of the quantum state need to be reproduced.Our lower bounds for worst-case and typical instances do not apply to these cases, opening the possibility to faster quantum algorithms.
Therefore, using the operational meaning of the trace distance, E would accept σ 0 using q A,b ≤ q 0 unitaries cU ±1 b , with probability larger than 1/2 − 1/6 = 1/3.But this contradicts Eq. ( 3), which states that the probability of r = 1 should be, at most, 1/3 when using E in this input.It follows that the probability that E uses q A,b ≤ q 0 unitaries cU ±1 b satisfies P ≤ 5/6.Equivalently, the probability that E uses more than q 0 such unitaries in this input is, at least, 1/6.

a. Pairs of instances
For every instance of the QLSP specified by an A and b, we construct another one that satisfies the assumptions of the previous analysis and will provide the lower bound in Thm 1.We assume that A has an eigenvalue 1/κ but, if A has an eigenvalue −1/κ instead, a simple modification in the following proof (a redefinition of | b below) provides the same result.We write where the unit state which is also a unit state orthogonal to |(1/κ) .Then, and we note that The other instance is defined such that unif Again, we can perform the minimization in t but it suffices to pick a suitable t that provides useful, exponentially decaying bounds.In particular, for t = 1/(8κ 2 ), and and if D ρ,x ≤ 1/8 or D ρ,x > 1/2, we obtain Pr(r = 1) ≥ 0.79 > 2/3 or Pr(r = 1) < .18< 1/3, respectively.As the swap test is used a constant number of times, the above QSV procedure can be implemented using the HHL algorithm a constant number of times or, equivalently, using the unitaries cU ±1 b , O(κ/ (1/A) |b ) times in expectation.

a. Effects of errors
The previous analysis would suffice to prove that the HHL algorithm is optimal for QSV if U could be implemented exactly.However, due to imprecise quantum phase estimation, the HHL algorithm implements a unitary Ũ that approximates the transformation in Eq. (C2).Once the ancillary qubits are discarded, the quantum state prepared by HHL is ρ x and satisfies for arbitrary > 0. While the actual value of may not affect the number of cU ±1 b 's needed to implement the QSV procedure, we will show that a constant suffices.
Let ≤ 1/100.Then, when the input to the swap test is one copy of ρ and one copy of ρ x , the test produces a bit r satisfying Pr(r = 1) ≥ 15/16 − 1/100 if D ρ,x ≤ 1/8 and Pr(r = 1) < 7/8 + 1/100 if D ρ,x > 1/2.That is, the probabilities of the exact case analysis can only be modified by, at most, .This is due to a property of the trace distance being non increasing under quantum operations (CPTP maps).As before, we can produce the bit r that satisfies Eq. (3) by sampling r , say, 64 times.Let r = 1 when the Hamming weight of the string is 59 or more, and r = 0 otherwise.If we compute Eq. (C5) for this case, we obtain Pr(r = 1) ≥ 0.68 > 2/3 if D ρ,x ≤ 1/8 and Pr(r = 1) < .25 < 1/3 if D ρ,x > 1/2.In Ref. [5] it was shown that the probability of success in the preparation of ρ x , psuccess , satisfies . 1, obtained by replacing (1/A) |b → 1, which occurs when |b is supported on eigenstates of A of eigenvalue ±1 only.(Note that, in general, (1/A) |b ≥ 1.)For these instances, the susceptibility is large: a small change in |b can result in a big change in |x .For example, if |b = |x = |1 and we replace |b → |b ∝ |b + (1/κ) |(1/κ) , where |1 and |(1/κ) are eigenstates of A of eigenvalue 1 and 1/κ, respectively, the solution to the new QLSP is |x = (|1 + |(1/κ) )/ √ 2. These states satisfy D x,x = 1/2 > 1/2.At the same time, the states |b and |b can be prepared with two unitaries U b and U b that satisfy U ±1 b − U ±1 b = cU ±1 b − cU ±1 b = O(1/κ).Following Thm. 1, the number of cU ±1 r 5 R O m G E e T 0 N I W T z G T T J 6 L s 5 r C O u n U a 0 6 j d v v Q q D b r R U I l c k 4 u y B V x y D V p k n v S I m 3 C S U B e y C t 5 s 5 6 t d + v D + l y 0 b l j F z B l Z g v X 1 C 1 S Q m A 4 = < / l a t e x i t > ... ... j < l a t e x i t s h a 1 _ b a s e 6 4 = " U q p d y d b c / m 3 I n W 4 2 9 j u Z D 8 S 5 a X E = " > A A A C A n i c b V D L S g N B E J y N r x h f U Y 9 e F o P g K e y G g H o L e P E Y w T w g W U L v Z J K M m Z l d Z n q F s O T m F 3 j V L / A m X v 0 R P 8 D / c J L s w S Q W N B R V 3 X R 3 h b H g B j 3 v 2 8 l t b G 5 t 7 + R 3 C 3 v 7 B 4 d H x e O T p o k S T V m D R i L S 7 R A M E 1 y x B n I U r B 1 r B j I U r B W O b 2 d + 6 4 l p w y P 1 g J n a T g k 4 M q v e T P z P 6 y Q 4 u A 5 S r u I E m a K L R Y N E u B i 5 s + f d P t e M o p h Y A l R z e 6 t L R 6 C B o o 1 o a U u o Y c x w a n P x V 1 N Y J 8 1 K 2 a + W b + 6 r p V o l S y h P z s g 5 u S Q + u S I 1 c k f q p E E o E e S F v J I 3 5 9 l 5 d z 6 c z 0 V r z s l m T s k S n K 9 f 2 7 e Y V A = = < / l a t e x i t > r < l n c 9 6 c d + d j 1 V p w 8 p l z + A P n 8 w d n n p V K < / l a t e x i t > q < l a t e x i t s h a 1 _ b a s e 6 4 = " K D v U 0 Y S 6 4 W 7 Z I FIG.2.General form of a quantum operation L for the PM approach to QSV in the QLSP.Arrows denote the states σj output by the quantum operations Fj and used as the input to the following Fj+1, together with a fresh copy of |b .The input state σ0 contains m copies of ρ and a copy of |b .The output contains the bit r.

FIG. 3 .
FIG. 3. Geometric representation of three pairs of instances used to prove Thm. 1, assuming that A has an eigenvalue 1/κ.