Tight Bound for Estimating Expectation Values from a System of Linear Equations

The System of Linear Equations Problem (SLEP) is specified by a complex invertible matrix $A$, the condition number $\kappa$ of $A$, a vector $b$, a Hermitian matrix $M$ and an accuracy $\epsilon$, and the task is to estimate $x^\dagger Mx$, where $x$ is the solution vector to the equation $Ax = b$. We aim to establish a lower bound on the complexity of the end-to-end quantum algorithms for SLEP with respect to $\epsilon$, and devise a quantum algorithm that saturates this bound. To make lower bounds attainable, we consider query complexity in the setting in which a block encoding of $M$ is given, i.e., a unitary black box $U_M$ that contains $M/\alpha$ as a block for some $\alpha \in \mathbb R^+$. We show that the quantum query complexity for SLEP in this setting is $\Theta(\alpha/\epsilon)$. Our lower bound is established by reducing the problem of estimating the mean of a black box function to SLEP. Our $\Theta(\alpha/\epsilon)$ result tightens and proves the common assertion of polynomial accuracy dependence (poly$(1/\epsilon)$) for SLEP, and shows that improvement beyond linear dependence on accuracy is not possible if $M$ is provided via block encoding.

expectation-value estimation obfuscate potential applications of quantum algorithms for SLEP. We now discuss our claims and the setting in which they are developed. We construct our lower bound and quantum algorithm in the block-encoding framework which provides an alternative over the sparse-access model in which matrices are provided by oracles for locating and evaluating their non-zero entries [16][17][18][19][20][21]. A block encoding U H of a Hermitian matrix H is a unitary black box U H that contains H/α H in the upper-left block for some α H ∈ R + [11,22,23]. We consider SLEP in the setting in which M is provided by block encoding U M , a version of SLEP we refer to as B-SLEP. We show that any quantum algorithm for B-SLEP must make Ω(α M /ǫ) queries to U M . We then construct a quantum algorithm that saturates this bound, thereby showing that our lower bound for B-SLEP is tight, meaning that B-SLEP has query complexity Θ(α M /ǫ). En route to deriving our lower bound for B-SLEP, we evaluate the complexity of estimating the expectation value of a block encoded matrix M with respect to some given quantum state. In particular we show that the query complexity of this problem is also in Θ(α M /ǫ). We also derive a query-complexity lower bound for the restriction of SLEP to the case in which A = 1 n and M is provided via sparse-access. This restriction is equivalent to the problem of estimating the expectation value of a matrix M in the sparse-access setting. Our lower bound for this problem is Ω(d M β M /ǫ), where the sparsity d M of M and a bound β M on the max-norm of M are supplied as inputs to the problem. We show that this lower bound is tight by constructing an explicit quantum algorithm.
Methodologically, we utilize the block-encoding framework to limit restrictions on M and to make lower bounds attainable. The key step for deriving our lower bound is reducing the problem of computing the mean of a black-box function to the problem of computing an expectation value of a block-encoded Hermitian matrix (B-EVHM). This lower bound is extended to B-SLEP by showing that B-EVHM reduces to B-SLEP. Our algorithm saturating this lower bound is constructed by combining a known algorithm for B-EVHM [24] with techniques for generating |x .
Our complexity bound for B-SLEP makes rigorous the common assertion of poly(1/ǫ) dependence for SLEP and shows that improvement beyond linear-accuracy dependence is impossible if M is given by oracles. Our end-toend quantum algorithm for solving systems of linear equations allows for a variable M as input, whereas previous algorithms consider a restricted M . Explicit complexities for SLEP are important to assessing if the measurement step is prohibitively resource-expensive for a given application, thereby addressing the limitation raised by Aaronson's fourth caveat for quantum linear-equation solvers [15].
An outline of our work is as follows. In §II we give background relevant to our results including a discussion of matrix encodings, quantum algorithms for linear algebra, and quantum algorithms for estimating expectation values. Next, in §III, we describe our methodology and define B-SLEP rigorously. We present our lower bounds and quantum algorithms in §IV and discuss these results in §V. Finally, we give our conclusions in §VI.

II. BACKGROUND
In this section, we first review the quantum linear systems problem, which is the computational problem of generating the solution state |x given A, b, and κ, in the sparse-access setting. We then review the block-encoding framework of Hermitian matrices and relevant techniques for matrix arithmetic in this framework. Next, we state results relevant for deriving lower bound on accuracy dependence for the system of linear equations problem. Finally, we review known quantum algorithms for computing the expectation value of an unknown state in the context of system of linear equations or otherwise.
We start with some preliminaries. Denote the set of integers and positive integers by Z and Z + respectively, and for N ∈ Z + define Similarly, our convention for indexing rows and columns of a matrix is zero-based. We denote the real and complex fields by R and C respectively, and the set of positive real numbers by R + . A numberz is an ǫ-additive approximation to another number z if |z −z| < ǫ. Although we do not define a specific bit-string representation for real numbers and complex numbers, our results hold for any representation in which a number z has an r-bit representation encoding a number z ′ such that |z − z ′ |/|z| ∈ O(2 −r ), and basic arithmetic operations on representations can be performed to r bits of precision in poly(r) time. These condition holds for standard representations of real and complex numbers [25]. For a vector |ψ ∈ H in a finite-dimensional Hilbert space H , we define |ψ := ψ|ψ , and for operators V : H → H define V to be the corresponding operator norm. For a matrix M ∈ C N ×N , denote M max := max i,j∈ [N ] {|M ij |} as the max norm. For any n ∈ Z + we define 1 n to be the n-qubit identity operator. If n is clear from context, we may omit the subscript.
A. Quantum linear system problem in the sparse-access setting We now explain the sparse-access model for access to Hermitian matrices. Next, we review a formulation of the quantum linear systems problem based on this model.

Sparse access to Hermitian matrices
The quantum linear systems problem [6,8] accepts an N × N matrix A and an N -dimensional vector b as inputs.
To devise a quantum algorithm for generating the solution state in polylog(N ) time, A and b must be encoded in such a way that they can be accessed efficiently. Most notably, such an efficiency requirement rules out encoding these inputs into a string containing a list of entries.
The standard formulation of the quantum linear systems problem utilizes unitary black boxes to encode A and b [6,8]. The vector b is given by a black-box U b ∈ U(H ⊗n 2 ) (n-qubit unitary operator) such that U b |0 n = |b , where |b := i b i |i / i b i |i and {|i } are computational basis states. The matrix A is described by sparse-access oracles, i.e., oracles for functions that provide the column index and the value of the non-zero entries of the matrix A in each given row [16]. We next explain in detail the sparse-access setting that we use in this paper.
For any n ∈ Z + , an n-qubit Hermitian matrix H is a 2 n × 2 n Hermitian matrix. An n-qubit Hermitian matrix H is d H -sparse for d H ∈ [2 n ] if each row of H has at most d H non-zero entries. We call d H the sparsity parameter of H. In the sparse-access setting, the matrix values {H jk } are encoded into both standard unitary oracles [21] O H val |j |k |z = |j |k |z ⊕ H jk , where the function H loc maps a row index j and a number l ∈ [d H ] to the column index H loc (j, l) of the l th non-zero element in row j. Observe that the oracle O H loc computes the location of entries in-place, i.e. in the same quantum register as l. The oracle O H val accepts a row j and column k index and returns the value H jk in some binary format. can always be constructed using a procedure independent of the specific circuit for O [26]. In particular, the circuit for c-O is found by replacing each gate G in the circuit for O with c-G. The circuit for O † is found by reversing the circuit for O and replacing each gate G with its inverse G † . Finally, the circuit for c-O † is found by replacing each gate G in the circuit for O † with c-G.

Complexity and limitations of the HHL algorithm
We now state the quantum linear system problem rigorously. Next we review the complexity of the HHL algorithm [6], which solves the quantum linear systems problem. We then discuss limitations and caveats of this quantum algorithm.
Given a system of linear equations define the solution state |x to be the quantum state |x : The following problem statement is adapted from Ref. [8].
Problem II.2 (Sparse-access Quantum Linear System Problem (S-QLSP)). Given n qubits, a κ ≥ 1, sparse access (d A , β A , O A val , O A loc ) to a 2 n × 2 n invertible Hermitian matrix A satisfying A ≤ 1 and A −1 ≤ κ, an accuracy ǫ ∈ (0, 2], and an n-qubit unitary black box U b , generate with probability at least 2/3, and return "failure" otherwise, a state |x such that |x − |x ≤ ǫ where |x is the solution state to the system of linear equations Ax = b and b is the 2 n -dimensional vector with entries b i = i|U b |0 n .
Tables II and III list input and output for the computational problems discussed in this paper.
The crucial step in the HHL algorithm is a call to the phase-estimation algorithm, which in turn makes use of a quantum algorithm for sparse Hamiltonian simulation. The complexity of the HHL algorithm is poly(log N, κ, 1/ǫ), where the poly(1/ǫ) dependence comes from the phase-estimation step. This complexity has been improved to poly(log N, κ, log(1/ǫ)) by replacing phase estimation with quantum-walk techniques for implementing A −1 [8]. These techniques have been generalized to the larger class of block-encoded matrices [22], which we discuss in the next section.
The HHL algorithm has four key limitations on its ability to solve linear equations in practice [15]. First, this algorithm only maintains an exponential speedup over classical techniques for instances of S-QLSP for which κ ∈ O(log(N )). Next, the algorithm only applies to systems of linear equations in which the oracle U b can be efficiently constructed. Similarly, the algorithm is only applicable if A can be encoded by sparse-access oracles, and the speedup is lost if d A / ∈ polylog(N ). Finally, the output of HHL is a quantum state |x encoding the solution x. As a result, the HHL algorithm is only useful for finding quantities that can be efficiently computed using |x . The purpose of our work is to address this final caveat by evaluating the complexity of estimating the quantities of the form x † M x given M .
B. Block-encoding techniques for the quantum linear system problem Quantum-walk techniques for implementing H −1 and Hamiltonian simulation (implementing e iH ) are applicable not only to sparse matrices, but to all matrices that can be encoded efficiently as blocks of larger unitary matrices. This realization has fueled development of quantum algorithms for linear algebra in which input matrices are provided through a block encoding [11,22,23]. We also derive our results in the block-encoding setting. In this section, we review block encoding of Hermitian matrices and describe techniques for matrix arithmetic that we use in the derivation of our results.

Block encoding for Hermitian matrices
Block encoding is a way of specifying a matrix input to a computational problem, and therefore provides an alternative to sparse-access encoding reviewed in §II A 1. Intuitively, a block encoding of a Hermitian matrix H is a unitary matrix U H which contains H as an upper-left block. We now adapt a rigorous definition of block encoding [22]. where As α H , a H and δ H are provided along with U H as inputs to a problem, we use the following convention. If block access (α H , a H , δ H , U H ) to H is given, we assume that U † H , c-U H and c-U † H are also given. If a Hermitian matrix is given by sparse-access oracles, then a previously-developed algorithm can be used to construct a block-encoding for the same Hermitian matrix [22]. We now state a previously-known lemma [22] that gives the query complexity of obtaining a block encoding from a sparse-access encoding. We adapt this lemma to include the complexity in terms of 2-qubit gates.
Lemma II.5. Given a number of qubits n ∈ Z + and sparse access ( with √ • denoting the principal square root [27]. ) be a unitary operator with action which prepares the state |ψ j conditional on the third register being in the state |j . Let be the controlled Householder reflection [28], i.e. a reflection about |ϕ j conditional on the state |j of the third register. Let U swap ∈ U(H 2 ⊗ H ⊗n ) be the operator that swaps the first n + 1 qubits with the remaining n + 1 qubits, respectively. Then a (d H β H , n + 2, ǫ) block encoding of B is given by the unitary operator (Lemma 6, [22]) We next explain how to implement this unitary operator. A procedure for preparing |ϕ j from the |0 state is key to performing T and R T . A reflection about |ϕ j is achieved by performing inverse state preparation, reflecting about |0 , and then performing state preparation. Note that implementing T is equivalent to preparing the state |ϕ j conditional on the third register being in the state |j . Following the procedure given in the proof of Lemma 10 [21], the operator T can be implemented as follows. First, a Hadamard gate is performed on ⌈log d H ⌉ qubits, and then the oracle H loc is applied to obtain the state The final step consists of using the oracle O H val and applying controlled rotation to the ancilla qubit to prepare the desired state. The unitary operators T , T † and W can be implemented up to error at most ǫ in operator norm using O(1) queries to the oracles encoding H and O n + log 2.5 (d H β H /ǫ) additional 2-qubit gates [29]. As U swap requires O(n) 2-qubit gates, the complexities follow readily.
This lemma concludes our discussion of block access to a Hermitian matrix.

Matrix arithmetic in the block-encoding setting
We now review the matrix arithmetic techniques that we use for constructing a quantum algorithm for solving B-SLEP and for constructing our lower bound. Quantum algorithms for solving a system of linear equations can be reduced to using a block encoding of a matrix A to construct a block encoding of A −1 . The block encoding of A −1 can be obtained by an algorithm for quantum signal processing [22], which maps a block encoding of a given matrix H to that of P(H) for some given polynomial P of fixed degree and fixed coefficients. We also review a result that provides a polynomial for approximating the inversion function inv : The complexity of quantum signal processing is given in the following theorem.
Theorem II.6 ([11]). Given block access (α A , a A , δ A , U A ) to a Hermitian matrix A of any size, an error σ > 0 and a polynomial P : R → R of degree d satisfying |P(x)| ≤ 1/2 for all x ∈ [−1, 1], then block access (1, a A + 2, 4d δ A /α A + σ, U P(A/αA) ) to P(A/α A ) can be constructed such that U P(A/αA) makes 2d + 1 queries to U A and O(a A d) additional 2-qubit gates.
The original proof of Theorem II.6 constructs a circuit for implementing U P (A/αA) . Circuits for U † P (A/αA) , c-U P (A/αA) and c-U † P (A/αA) can be constructed using the procedure explained in the preliminaries. Note that c-c-U A can be constructed using c-U A and two Toffoli gates.
We use the following corollary about approximation of the function inv(x) with polynomials.

C. Complexity of solving a system of linear equations
We now review the results that describe the hardness of solving restrictions of SLEP with respect to accuracy. We also state a previously known query-complexity lower bound for computing the mean of a black-box function that we later use to derive a new lower bound for SLEP.

Previous results on the accuracy dependence of system of linear equations
It is often asserted that quantum algorithms for solving SLEP must have poly(1/ǫ) accuracy dependence due to the cost of estimating x| M |x [6,7,[10][11][12]. However, this assertion is proven to hold only under certain restrictions. One of the existing results shows that polylog(1/ǫ) dependence of the time complexity is not achievable under complexity-theoretic assumptions. Another previous hardness result shows that any quantum algorithm with polylogN dependence has runtime in O(1/ǫ); however, as this result is derived by bounding queries to oracles for A, it is not applicable if A is fixed. We now review these two results in detail.
We adopt the standard big-O definition for single variables and the following definition for multiple variables [30].
We define multivariate Ω analogously. We now rigorously define F-SLEP, a previously studied problem [6] which we first reviewed in §I.
Problem II.9 (Fixed M and b System of Linear Equations Problem (F-SLEP)). Given N ∈ Z + , a κ ≥ 1, sparse and an accuracy ǫ ∈ (0, 1], return an ǫ-additive approximation of x|M |x with probability at least 2/3, where |x is the unit vector proportional to A −1 |0 and M is the diagonal matrix containing a 1 in the first N/2 diagonal entries and a zero in all other entries.
Two hardness results are known for F-SLEP [6]. The first result establishes a lower bound on the oracle queries to A, and its proof relies on a query-complexity lower bound for computing the parity of a Boolean expression.

Theorem II.10 ([6]). A quantum algorithm can solve F-SLEP using ν queries to oracles for
The original statement of this theorem refers to the time complexity of quantum algorithms for SLEP rather than number of queries [6]. However, the proof given is for a stronger statement in terms of queries to oracles for A that we give in Theorem II. 10.
The next hardness result for F-SLEP is in terms of time complexity and relies on the complexity theoretic assumption BQP = PP.
In fact, the proof of this theorem proves the complexity polylog(N, 1/ǫ) for the restriction A = 1, which is a stronger result. Note that BQP = PP contradicts the widely held conjecture BQP = NP.

Query complexity of approximating the mean of a black-box function
We now review a query-complexity lower bound for computing the approximate mean of a black-box function [31]. We use this lower bound to later derive a lower bound for B-SLEP in §IV A. As is standard, we say an oracle O f encodes [32] a discrete function f : where ⊕ denotes bitwise XOR operation.
We are now ready to state the approximate-mean (AM) problem. Corollary II. 13. The query complexity of the problem AM is Ω(1/ǫ).
This concludes our review of relevant hardness results.

D. A reformulation of amplitude-estimation algorithm
We now review a reformulation [33] of the amplitude-estimation algorithm [34]. This reformulation is used in some quantum algorithms for expectation-value estimation that we review in this subsection. We begin by reviewing the complexity of the standard phase-estimation algorithm [32]. Next, we describe how phase estimation is used to construct the amplitude-estimation algorithm.
Phase estimation is a key subroutine in many quantum algorithms that achieve super-polynomial speedup over classical algorithms. The inputs, output, and complexity of the phase-estimation algorithm are given by the following theorem, which is an adaptation from the standard description of the algorithm [32].
Theorem II.14 (Phase-estimation Algorithm). There exists a quantum algorithm that accepts n-qubits, an accuracy ǫ, and n-qubit unitary black boxes V and W , that, with probability at least 2/3, samples an ǫ-additive approximation to the eigenphase θ of V corresponding to the eigenvector |ψ with probability | ψ|W |0 | 2 . This algorithm makes O (1/ǫ) queries to V , a single query to W , and O log 2 (1/ǫ) additional 2-qubit gates. Now we show how phase estimation is used to perform amplitude estimation. In amplitude estimation [33], the inputs are n qubits, an accuracy ǫ ∈ (0, 1), and two n-qubit unitary black boxes V and W . The output is an ǫ-additive approximation to the amplitude r := 0|W † V W |0 with probability at least 2/3. Define |ψ 0 := W |0 , |ψ 1 := V |ψ , P 0 := 1−2 |0 n 0 n |, and define two reflection operators S 0 := 1−|ψ 0 ψ 0 | = W P 0 W † and S 1 : The composition of these two reflection operators S := S 0 S 1 is a rotation operator in the twodimensional space spanned by |ψ 0 and |ψ 1 that rotates |ψ 0 toward |ψ 1 by angle 2θ := 4 arccos(r). This implies that the eigenvalues of S are e iθ , and the amplitude returned by amplitude estimation is r = |cos(θ/2)|. Therefore, phase estimation can be used to estimate r by estimating an eigenphase of the operator S. Note that this call to phase estimation uses c-S, which can be constructed by replacing each factor of V and W in the definition of S with c-V and c-W .
The complexity of this algorithm is given in the following lemma, which follows readily from the analysis in Ref. [33].
Lemma II.15. Algorithm 1 with input (ǫ, V, W ) makes O 1 ǫ queries to V and W and uses O n ǫ additional 2-qubit gates.
Proof. The complexity for queries to V and W follows directly from the complexities in Theorem II.14. Note that P 0 can be implemented using O(n) 2-qubit gates [32, p. 251] which means the call to the phase-estimation algorithm uses a total of O(n/ǫ) 2-qubit gates for queries to P 0 and log 2 (1/ǫ) 2-qubit gates for other operations.
This lemma concludes our review of amplitude estimation.

E. Quantum algorithms for computation of expectation value
Quantum algorithms for estimating expectation values have been developed both in the context of SLEP [1,6,13] and in a variety of other applications [24,33,[35][36][37]. We now review quantum-algorithmic techniques for estimating expectation values and discuss limitations of these techniques.

Estimating expectation values in restrictions of SLEP
We begin by discussing techniques for estimating expectation values that occur in quantum algorithms for SLEP. We review three techniques. These techniques use single-qubit computational-basis measurements, the swap test, and phase estimation, respectively.
We now discuss the first technique. In F-SLEP (Problem II.9), M is the matrix representation of the operator |0 0| ⊗ 1 n−1 which is the orthogonal projector on the first qubit. As a result, the expectation value of a state |x with respect to M can be estimated by repeatedly preparing |x , measuring the first qubit in the computational basis, and averaging the outcomes [6]. This approach requires O(1/ǫ 2 ) preparations of |x to obtain an estimate of the expectation value up to additive error ǫ [6].
We now discuss the second technique. If M = A −1 , where A defines the system of linear equations (4), then a swap test can be used to estimate x|M |x = x|b , as was demonstrated in an application of the HHL algorithm to least-square fitting [1]. This estimation is achieved by first preparing the state |+ |b |x using an algorithm for QLSP, with |+ := (|0 + |1 )/ √ 2, followed by a controlled-swap operation, with control on the first qubit, to obtain the state (|0 |b |x + |1 |x |b )/ √ 2. Finally, the first (control) qubit is measured in the computational basis. The probability that this measurement returns the outcome 0 is (1 + | x|b | 2 )/2. To obtain an estimate of | x|b | 2 to additive error ǫ, the swap test needs to be carried out O(1/ǫ 2 ) times.
If every entry of M is zero except for a single 1 on its ith diagonal entry, then the expectation value x|M |x = | x|i | 2 can be estimated by a direct application of the amplitude-estimation algorithm [34]. This technique was used for constructing an algorithm for computing the effective resistance in a given electrical network [11,13]. The time complexity of this method scales as O(1/ǫ) with respect to the additive-error ǫ.
The key limitation of all three techniques discussed above is that they each apply only to some limited class of matrices; the first technique applies if M represents the orthogonal projector on the first qubit, the second technique applies if M = A −1 , and the final technique applies if M has entries that are all zero except for a single 1 on the diagonal. Moreover, the first two techniques, which rely on classical sampling, achieve O(1/ǫ 2 ) rather than O(1/ǫ).

Estimating expectation values of simulatable Hermitian matrices
We now discuss techniques for estimating expectation values, all of which are outside of the context of solving SLEP. The four techniques rely on the Hadamard test and algorithms for Hamiltonian simulation, phase estimation and amplitude estimation.
We now review the first technique, which is a quantum algorithm for estimating 0 n |V † U V |0 n , where U and V are given n-qubit unitary black boxes. One common method for this estimation is the Hadamard test and proceeds as follows [38]. First prepare the state |+ |ψ , and then apply the controlled unitary operator c-U (with control on the first qubit) to obtain the state (|0 |ψ + |1 U |ψ )/ √ 2, where |ψ := V |0 . Next, apply a Hadamard gate H on the first qubit and measure this qubit in the computational basis. The expectation value of the output is Re ψ|U |ψ = Re 0 n |V † U V |0 n . To obtain an ǫ-additive approximation of the real part of the expectation value, O(1/ǫ 2 ) runs of the Hadamard test are required. The imaginary part of the expectation value can be estimated similarly by instead starting with the state (|0 − i |1 ) |ψ / √ 2. The second technique for estimating the expectation value of U relies on amplitude estimation [33]. Reduction to amplitude estimation makes use of the relations The terms | +| ψ| c-U |+ |ψ | 2 , +| ψ| (e iσz π/4 ⊗ 1 n )c-U |+ |ψ 2 and | ψ|U |ψ | 2 on the right-hand sides of Eq. (14) can each be estimated by making one call each to the amplitude-estimation algorithm. We review amplitude estimation in §II D. This approach yields an algorithm for computing the expectation value ψ|U |ψ with complexity O(1/ǫ).
Whereas the two techniques above apply only to estimating the expectation value of unitary matrices, they are used as subroutines in other techniques for estimating expectation values of Hermitian matrices. We now review a technique for estimating the expectation value of any simulatable matrix M [33]. A N × N matrix M is simulatable if, for any t ∈ R + and ǫ ∈ (0, 1), the propagator e iMt can be implemented by a poly(log(N ), t, 1/ǫ)-sized circuit [16]. The expectation value ψ|M |ψ is then obtained by using the approximation [33] ψ|e −iMt |ψ − 1 + it ψ|M |ψ ∈ O(t 2 ).
The term ψ|e −iMt |ψ is computed by using one of the techniques for estimating the expectation value of a unitary matrix, which we discussed above. If M is simulatable by a poly(n, t, log(1/ǫ))-sized circuit, then ψ|M |ψ can be computed to additive approximation ǫ in O((1/ǫ) 1+α ) time for arbitrarily small α using an improved version of this technique. Here O is called soft O and indicates suppression of logarithmic factors.
An alternative technique for estimating the expectation value of a Hermitian and simulatable M employs the phaseestimation algorithm applied to the operator e iMt [36]. Suppose M has spectral decomposition M = j λ j |v j v j |, and suppose |ψ has decomposition |ψ = j α j |v j . One application of the phase-estimation circuit results in a state close to |ψ M = j α j |v j |λ j . Measuring the final register in the computational basis yields λ j with probability approximately |α j | 2 for each j. The expectation value ψ|M |ψ = j |α j | 2 λ j can then be estimated by repeating the above procedure O(1/ǫ 2 ) times and averaging the measurement outcomes. Assuming that M is simulatable by a poly(n, t, log(1/ǫ))-sized circuit, the total complexity of this algorithm is evidently O(1/ǫ 3 ), which is not explicitly stated.
In conclusion, the first two techniques are particularly relevant to our work only for building the latter two techniques. These final two techniques for estimating the expectation value outside of the context of SLEP apply to simulatable Hermitian matrices, which include all sparse matrices [16]. The best of these techniques achieves close to linear dependence on 1/ǫ. These techniques have not been combined with the algorithms for QLSP to solve SLEP.

Estimating expectation values of block-encoded Hermitian matrices
In this section, we review an algorithm for estimating the expectation value of a block-encoded Hermitian matrix with respect to a quantum state given by a unitary black box [24]. The algorithms developed for estimating the expectation value of simulatable Hermitian matrices can also be used for estimating the expectation values of blockencoded matrices. However, there is an elegant and more efficient way to estimate the expectation value of block encoded matrices.
We first adapt the following problem from Lemma 5 in Ref. [24]. We now review an algorithm for B-EVHM given in Ref. [24] that achieves linear dependence on 1/ǫ. We include a full analysis of the complexity of this algorithm by counting queries to V and U M , and additional two-qubit gates separately. To simplify this analysis, we employ the standard amplitude-estimation algorithm, as opposed to the more recent amplitude-estimation algorithms which do not require the quantum Fourier transform [39]. This change in amplitude-estimation algorithm has no effect on complexity.
As the expectation value of M is not always positive, it cannot be computed by a direct application of amplitude estimation. The problem is first reduced to one solvable by amplitude estimation in the following lemma, using a technique that employs a controlled block encoding [33].
Proof. The matrix M is Hermitian; therefore, ψ|M |ψ ∈ R for any |ψ ∈ H ⊗n 2 . As M/Λ ≤ 1, we have | ψ|M/Λ|ψ | ≤ 1 and ψ|M/Λ|ψ From the definition of block encoding (Def. II.3) it is evident that M ≤ α M for any block encoding. For our application of Lemma II.17, α M , which is included in block access to M , is used as the bound Λ on the norm of M . The next lemma, which is a special case of Lemma 52 in Ref. [11], shows that block access to c-(M/α M ) can be implemented if block access to M is given. Proof. The operator U M is an (n + a M )-qubit unitary. The desired circuit for U M ′ acts on a M + 1 + n qubits and comprises only a single query to c-U M in which the (a M + 1)th qubit is the control qubit, and the U M operation controlled by this qubit operates on the first a M qubits and the last n qubits. We now show that the operator U M ′ implemented by this circuit is indeed a (1, a M , 0) block encoding of c-(M/α M ). Let s 1 and s 2 be arbitrary n-bit strings. Then as the control qubit is set to |0 , so U M is not applied. Furthermore, by definition of block encoding. Finally, 0 aM , 0, s 1 | U M ′ |0 aM , 1, s 2 = 0. By equations (18) and (19), where 0 is a 2 n × 2 n zero matrix. As Eq. (20) gives the matrix representation of c-(M/α), the operator U M ′ is the desired block encoding.
The following theorem states the complexity of solving B-EVHM. Proof. We prove this theorem by constructing Algorithm 2, and now proceed to prove its correctness and complexity. Correctness: Define r := +| 0| V † M ′ V |+ |0 . Thenr is an (ǫ/2α M )-additive approximation to r with probability at least 2/3. By Lemma II.17, using α M as an upper bound on M , we have u = α M (2r − 1). Therefore,ũ is an ǫ-additive approximation to u with probability at least 2/3. Complexity: As the algorithm makes only a single call to amplitude-estimation, the complexities follow directly from Lemma II.15 and Lemma II.17.

Algorithm 2 Algorithm for Block-access Expectation Value of an Hermitian Matrix
Algorithm 2 concludes our review of algorithms for estimating expectation values of block-encoded matrices.

III. APPROACH
In this section, we describe our formulation of SLEP in the block encoding setting, our methods for establishing query-complexity lower bounds for this computational problem, and the techniques we use in constructing a quantum algorithm that saturates this bound. The detailed derivation of our results is presented in §IV.

A. Query-complexity lower bound for B-EVHM
We begin by presenting our computational problem statements, starting with B-SLEP, which is a formulation of SLEP in the block-encoding setting. We then discuss two expectation-value-estimation problems. We close by describing the reductions we use to derive our lower bounds for B-SLEP.
In contrast to QLSP (Problem II.2), the output of SLEP is a number, not a quantum state. We formulate SLEP in the block-encoding setting.
Problem III.1 (Block-access System of Linear Equations Problem (B-SLEP)). Given n qubits, a κ ≥ 1, block access (α A , a A , 0, U A ) to a 2 n × 2 n invertible Hermitian matrix A such that A −1 α A ≤ κ, block access (α M , a M , 0, U M ) to a 2 n × 2 n Hermitian matrix M , an accuracy ǫ ∈ [α M /2 n , α M ], and an n-qubit unitary black box U b , return with probability at least 2/3 an ǫ-additive approximation to x † M x, where x := A −1 b and b is the 2 n -dimensional complex vector with entries b i = i|U b |0 n .
We require that ǫ ≤ α M as otherwise the problem is trivial with 0 a valid answer. We restrict to instances with ǫ ≥ α M /2 n , as our query-complexity lower bound only applies to these instances. Additionally, by Theorem II.11, any quantum algorithm solving B-SLEP for instances with ǫ ≤ α M /2 n must have complexity super-polynomial in n across these instances, under complexity-theoretic assumptions. As a result, the requirement ǫ ≥ α M /2 n restricts only to instances for which a quantum algorithm could have complexity in poly(n). Note that α A and α M bound the norm of A and M , as blocks of U A and U M do not have norm greater than 1.
It follows from the Chernoff bound [32, p. 154] that a constant number of repetitions of an algorithm solving Problem III.1 is sufficient to boost the success probability to a constant s ∈ [2/3, 1) using a number of repetitions that is logarithmic in 1/(1 − s). Therefore, if the bound 2/3 on the success probability is replaced by any constant in the interval [2/3, 1) no changes in complexity occur. In any problem where the output is an ǫ-additive approximation, we require that the output of the algorithm in the failed attempts is a complex number but not necessarily an ǫ-additive approximation. Although A is assumed to be Hermitian in B-SLEP, our results also apply to non-Hermitian matrices, as they can be encoded into Hermitian matrices [6].
We aim to establish a lower bound on the number of queries to U M that any quantum algorithm for B-SLEP must make. As the solution state |x can be generated using algorithms for QLSP without making any queries to U M , we focus on the measurement step where queries to U M are required. The measurement step is in fact formalized by the problem B-EVHM discussed in §II E 3. This problem is equivalent to B-SLEP restricted to the case A = 1. Therefore, a lower bound for B-EVHM gives a lower bound for B-SLEP.
Our lower bound for B-EVHM is found by first proving a lower bound on the analog of B-EVHM in the sparse-access setting, which we state below. To establish our query-complexity lower bound on S-EVHM, we reduce the problem of calculating the approximate mean of a black-box function (Problem II.12) to S-EVHM. This reduction allows us to use the known bounds for AM [31], given in Corollary II.13, to derive bounds for S-EVHM. Furthermore, as S-EVHM is reducible to B-EVHM, and since B-SLEP is reducible to B-EVHM, we can extend these lower bounds to both B-EVHM and B-SLEP. The reduction of AM to S-EVHM relies on the observation that the expectation value of a Hermitian matrix M with respect to the uniform superposition state |+ n := 1/ √ N j∈[N ] |j equals the mean of the entries of M , i.e.
Given oracle access to a function f : [N ] → {0, 1}, we construct sparse access to a matrix M that encodes the function f in its entries. The mean of f can then be calculated by one call to S-EVHM with U = H ⊗n , which completes the reduction. A function f can be encoded in the entries of a Hermitian matrix in many different ways, with one way being encoding the function values along the diagonal entries of the matrix. Whereas such an encoding would be sufficient to derive a lower bound for S-EVHM with respect to ǫ and the max-norm β M , we employ a different reduction to achieve a lower bound with respect to ǫ, d M and β M . We encode a function on domain [d M 2 n−1 ] in the entries of a Hermitian matrix of sparsity d M . We use this encoding to prove that the query complexity of S-EVHM is Ω(d M β M /ǫ). Our query-complexity lower bound for B-EVHM is derived by a reduction leveraging known methods for constructing block encodings from sparse-access encodings given in Lemma II.5. For B-EVHM, S-EVHM and B-SLEP, the query-complexity lower bound yields Ω(1/ǫ) dependence on precision, which rules out the possibility of any algorithm solving any of these problems in super-logarithmic time.
We note that a lower bound on B-EVHM could be established directly from the lower bound for AM. However, we opt to first prove a lower bound on S-EVHM and then derive our lower bound on B-EVHM. Our motivation for this choice is that the lower bound for S-EVHM is important beyond its application to deriving a lower bound for B-SLEP, as estimation of expectation value of a sparse Hermitian matrix is a standard subroutine in several algorithms [24,33,[35][36][37].

B. Tightness of the lower bound
Our approach for proving the tightness of our query-complexity lower bounds for B-EVHM, B-SLEP and S-EVHM is to give quantum algorithms that achieve these bounds. The algorithm for B-EVHM discussed in §II E 3 saturates our bound for B-EVHM. We now describe how we design our quantum algorithms for B-SLEP and S-EVHM. The detailed construction of these algorithms, along with their complexities, is given in §IV B and §B.
We start by describing a reduction of B-SLEP to B-EVHM, and then describe our quantum algorithm for B-EVHM. This reduction employs a block-encoding of A −1 , which is known to be implementable with polylog(1/ǫ) queries to U A using techniques reviewed in §II B 1. Let U A −1 be an (α, a, 0) block encoding of A −1 . Observe that A block encoding of |0 a 0 a | ⊗ M is implementable by a simple circuit that queries the block encoding of M . The left-hand side of Eq. (22) is the expectation value of |0 a 0 a | ⊗ M with respect to U A −1 |0 a |b , and therefore can be estimated by one call to an algorithm for B-EVHM. This completes the reduction of B-SLEP to B-EVHM.
To design our algorithm for solving S-EVHM, we use a known procedure for generating a block encoding of M using the sparse-access oracles for M (Lemma II.5). This block encoding of M is used as an input to our algorithm for B-EVHM, which completes the design of our algorithm for S-EVHM. This concludes the discussion of our approach.

IV. RESULTS
In this section we prove the query complexity of B-SLEP is Θ(α M /ǫ). In §IV A we give a lower bound for B-SLEP. Next, in §IV B we describe a quantum algorithm that saturates this bound.

A. Lower bound for B-SLEP
In this section, we derive query-complexity lower bounds for B-EVHM, S-EVHM and B-SLEP. We first derive a lower bound on queries to U M for S-EVHM, which utilizes existing query-complexity lower bound for AM [31]. Next, we use Lemma II.5 to reduce S-EVHM to B-EVHM and prove a lower bound for B-EVHM. We extend this lower bound to B-SLEP by reducing B-EVHM to instances of B-SLEP with A = 1.
We now derive a lower bound for S-EVHM by a reduction of AM to S-EVHM. En route to this reduction, we define a scaled version of AM and obtain the dependence of its query complexity on the scaling factor and the accuracy.
Proof. Using queries to Q, we design a algorithm R to solve the AM instance given by the input in the lemma statement. Using the input oracle O f , construct a new oracle O g encoding the function g : The algorithm R first obtains a numberμ g by running the algorithm Q with input (N ′ , 1/ǫ ′ , β ′ , O g ), and then returns The numberμ g satisfies |μ g − µ g | < ǫ ′ with probability at least 2/3, where µ g is the mean of g as defined in Problem IV.1. Therefore, with probability at least 2/3,μ f satisfies |μ f − µ f | < ǫ ′ /β ′ as required. Furthermore, each call to O g can be implemented with one call to O f , therefore R makes K queries to O f . We prove the complexity of AM implies a lower bound for SAM.
To prove the lower bound on the query complexity of S-EVHM, we make use of an encoding of a function into a sparse Hermitian matrix. We first define a function ind that maps each pair of a row and a column index of a 2 n × 2 n Hermitian matrix M to an integer in [2 2n ].
Definition IV.4. For n ∈ Z + , we define the index function ind : [2 n Here mod2 n : Z → [2 n ] is the modulo operation. For example, for n = 2, the 2 n × 2 n matrix B defined by We prove another lemma before explaining our encoding.
Proof. We prove the two statements separately.

The function ind is invertible if ind
Comparing the left-and right-hand sides of this equation together with the constraint |k − i| ≤ 2 n readily yields i = k and j = l 2. By definition of the ind function, The result follows readily from the observation ((j − i) mod 2 n + (i − j) mod 2 n = 2 n for i = j.
We are now ready to state the encoding of a function into a matrix that we use for our reduction.
Definition IV.6. For n ∈ Z + , d M ∈ [2 n ], β ∈ R + and a function g : d M 2 n−1 → [0, β], the (n, d M )-matrix encoding of g is the 2 n × 2 n matrix M with entries Lemma IV.5 implies that for any i = j, both ind(i, j) and ind(j, i) cannot simultaneously belong to d M 2 n−1 , so each entry of M is unique. We now derive relevant properties of this matrix encoding.
Proof. We provide a separate proof for each of the three statements.
1. First we prove that M is Hermitian. As all entries of M are real, we only need to prove that M ij = M ji for i = j. Suppose i, j are such that ind(i, j) ∈ d M 2 n−1 . Then ind(j, i) / ∈ d M 2 n−1 by Lemma IV.5. Therefore by Eq. Proof. The oracle for M val can be constructed using the explicit formula (28) for the entries of M . This construction requires first computing ind(i, j), then computing g(ind(i, j)) by making one query to O g , and finally uncomputing ind(i, j). The function ind(i, j) can be computed using the explicit formula (23) and requires no queries to O g . To construct an oracle for M loc , it suffices to provide an explicit formula for computing M loc . Recall that where M loc (i, l) is the lth non-zero entry in the ith row of M . From the proof of the second statement of Lemma IV.7, we deduce that M loc is given by M loc (j, l) = i + l − ⌊d M /2⌋ mod 2 n .
The function to matrix encoding in Def. IV.6 ensures that the mean of a function g can be inferred from the expectation value of the (n, d M )-matrix encoding of g with respect to the equal superposition state, as stated in the following lemma.
Theorem IV.13 establishes a query complexity lower bound for the problem B-EVHM, in which the matrix M is given via block encoding, and the state is generated by a unitary black box V . In Appendix A, we show that the lower bound in Theorem IV.13 also applies for the problem of estimating the expectation value even if V is any fixed unitary operator and not a black box. In particular for the restriction V = 1 n , the output of this problem is an estimate of 0 n |M |0 n . Interestingly, the restriction of S-EVHM to V = 1 n can be solved by making just one query to the sparse oracles for M .
As B-EVHM is a restriction of B-SLEP to A = 1 n , the lower bound in Theorem IV.13 immediately yields a lower bound for B-SLEP.
Theorem IV.14. Any quantum algorithm that solves B-SLEP must make Ω(α M /ǫ) queries to U M . This theorem concludes our derivation of lower bound for B-SLEP.

B. Tightness of bound
In this section, we construct quantum algorithms for solving B-SLEP that achieves the query-complexity lower bounds derived in the previous section. Our algorithm for B-SLEP follows the approach outlined in §III B. We use the algorithm for B-EVHM discussed in §II E 3 as a subroutine to design an algorithm for B-SLEP in §IV B. We first show how to construct a block encoding of A −1 using techniques discussed in §II C 1. Our algorithm for B-SLEP makes one query to our algorithm for B-EVHM (Algorithm 2) and queries the block encoding of A −1 as an input to this single query.
First we combine Theorem II.6 and Corollary II.7 to show how block access to A −1 can be constructed using block access to A. A more general result in this direction is given in Ref. [23]. We provide a different derivation in our setting and report complexities for queries to block encoding of A and 2-qubit gates separately.
We next prove that block access to M can be used to construct is true. Furthermore, for any states |0 aM +1 , s 1 , r 1 and |0 aM +1 , s 2 , r 2 , where r 1 and r 2 are m-bit strings such that at least one of r 1 and r 2 is not equal to 0 m , 0 aM +1 , s 1 , r 1 | U M (m) |0 aM +1 , s 2 , r 2 = 0.
Equations (44) and (45) together imply as required. The required number of 2-qubit gates scales as O(m 2 ), which follows from the fact that the 0 m -CNOT gate can be implemented using O(m) 2-qubit gates and the Toffoli gate [32].
Theorem IV.17. A quantum algorithm can be constructed that takes n qubits, a κ ≥ 1, block access (α A , a A , 0, U A ) to a 2 n × 2 n invertible Hermitian matrix A such that A −1 α A ≤ κ, block access (α M , a M , 0, U M ) to a 2 n × 2 n Hermitian matrix M , an accuracy ǫ ∈ [α M /2 n , α M ], and an n-qubit unitary black box U b , and returns with probability at least 2/3 an ǫ-additive approximation to additional 2-qubit gates.
Proof. We describe an algorithm (Alg. 3) for B-SLEP, and prove the correctness of this algorithm. This algorithm makes reference to subroutines described in other work. We end the proof by analyzing the algorithm's complexity. The algorithm is as follows.
queries to U A −1 (1 aA+2 ⊗ U b ) and U M (a A +2) . Therefore, using the complexity of U A −1 given by Corollary IV.15, the algorithm makes O(α M κ 2 /ǫ) queries to each of U b , U M and U A −1 . Each query to U A −1 comprises queries to U A . Thus, our algorithm makes O α M κ 3 log α M κ 2 /ǫ /ǫ queries to U A . Now we count the additional 2-qubit gates used by our algorithm. We separately count 2-qubit gates used directly by Algorithm 2, 2-qubit gates used by queries to U A −1 (1 aA+2 ⊗ U b )), and 2-qubit gates used by queries to U M (a A +2) . We then combine these three contributions to yield the total number of 2-qubit gates used. First, the number of 2-qubit gates used directly by Algorithm 2 is Next, In comparison with algorithms for QLSP [8], which have linear dependence on κ, our algorithm has cubic dependence on κ. This additional dependence on κ comes from the added challenge of solving B-SLEP over QLSP. In particular, the proportionality in the encoding of x into the quantum state |x is linearly dependent on κ. Thus, the proportionality of x| M |x is quadratically dependent on κ, which increases the accuracy to which |x must be computed. We end this section by noting that the complexity of Algorithm 3 has no dependence on α A . This is merely a consequence of the inequality κ ≥ α A A −1 . Therefore, a block encoding of A with large α A in the input is always accompanied by a proportionally large value of κ, thereby indirectly increasing the query-and 2-qubit gate cost of our algorithm.

V. DISCUSSION
We proved two main results in this paper. First, for the formulation of SLEP in which M is provided via block access, namely B-SLEP, we established a lower bound on queries to M . Second, we constructed a quantum algorithm for solving B-SLEP that saturates this lower bound, thereby proving that the lower bound is tight. We now discuss the implications of these two results.
We begin by comparing our lower bound with two previously known hardness results for restrictions of SLEP, as discussed in §II C 1. The first of these results, presented in Theorem II.11 [6], rules out the existence of a quantum algorithm solving SLEP with polylog(N, 1/ǫ) scaling of the total run-time. This result relies on no assumptions about how the input M is given, but instead requires the complexity-theoretic conjecture BQP = PP. Our derivation of the lower bound does not make any complexity-theoretic assumption, but instead relies on the assumption that block access to M is given. Furthermore, our lower bound establishes a more stringent constraint Ω(1/ǫ) on the scaling in ǫ of queries to M , thereby ruling out a sub-linear scaling in ǫ. As state-of-the-art algorithms for generation of |x run in polylog(N, 1/ǫ) time, our result shows that the expectation-value-estimation step is exponentially harder with respect to scaling in ǫ than the |x -generation step.
The second previously known hardness result, namely Theorem II.10, states that if A is given by oracles, then no quantum algorithm for SLEP with poly(log N, κ) dependence can have query complexity in O(1/ǫ). This result only applies to those cases in which A is given by oracles, and does not apply, for instance, if A is fixed or if A is given by a description of a quantum circuit. In contrast, we establish our lower bound for B-SLEP by first deriving a lower bound for the case in which A = 1 n is fixed. Therefore, our result shows that linear scaling on 1/ǫ is optimal if either of the inputs A and M is given by oracles. SLEP for fixed A arises, for instance, in solving Poisson equation using the finite-element method with a fixed choice of basis function [40].
En route to deriving our lower bound for queries to B-SLEP, we derive a lower bound for S-EVHM (Problem III.2), which is the problem of estimating the expectation value of a sparse-access Hermitian matrix M with respect to the state generated by a given unitary black box. Our lower bound for S-EVHM is Ω(d M β M /ǫ), where d M is the sparsity of M and β M is an upper bound on the max-norm of M . As S-EVHM is equivalent to the restriction of SLEP to the case in which A = 1 n is fixed and access to M is given by sparse-access oracles, the lower bound for S-EVHM also applies to SLEP in the sparse-access setting. We also derive a lower bound for B-EVHM (Problem II.16), which is the problem of estimating the expectation value of a Hermitian matrix M provided by block access with respect to the state generated by a given unitary black box. Our lower bound for B-EVHM is Ω(α M /ǫ), where α M is the scaling factor for the block encoding of M . As d M β M ≥ M and α M ≥ M , a common Ω( M /ǫ) lower bound holds for estimating the expectation value of a black-box Hermitian matrix M irrespective of the oracle encoding of M . Our lower bound complements the lower bound on queries to V given by Corollary 4 in Ref. [35]. Interestingly, whereas our lower bound for B-EVHM holds under the restriction V = 1 n , our lower bound for S-EVHM is violated under the same restriction. As previous works did not consider the formulation of SLEP in which block-access to M is given, the optimal scaling with respect to α M was not known. Our lower bound for B-SLEP, which follows from our lower bound for B-EVHM, establishes a linear scaling in α M .
To close, we discuss the implications of our algorithm for B-SLEP. Most importantly, the query complexity of our algorithm proves that our lower bound for queries to M for B-SLEP is tight up to a constant prefactor. Our algorithm for B-SLEP builds on the algorithm for B-EVHM in Ref. [24]. Our algorithm for B-SLEP also achieves linear scaling with respect to α M for queries to M , which is optimal, and saturates the constraint on queries to A given by Theorem II.10 up to logarithmic factors. Our algorithm for B-SLEP can be used to compute the expectation value of a smooth function of a Hermitian matrix with respect to the solution vector x by combining our algorithm with existing quantum algorithms for matrix arithmetic [22,23,41]. Finally, our algorithm for S-EVHM shows that our lower bound for the same problem is tight. This algorithm can be used as a subroutine along with Lemma II.5 to construct an algorithm for SLEP in the sparse-access setting with optimal queries to M , although we do not detail this algorithm in our paper.

VI. CONCLUSION
Systems of linear equations arise in nearly all areas of science and engineering. The HHL algorithm and its improvements generate a quantum encoding of the solution vector x to a system of N linear equations Ax = b in cost polylog(N ) [6]. This logarithmic dependence on N can be translated into efficient solutions for practical problems if the value x † M x can be estimated for a given M in cost polylog(N ). However, the cost of this estimation can be prohibitively expensive [15]. To address this caveat, we determine the complexity of the System of Linear Equations Problem (SLEP), in which the task is to estimate x † M x to an additive accuracy ǫ given A, M , and b. We consider the setting in which M is given as a block encoding [11]. Block encoding is a common method of specifying matrix input to computational problems, and it also allows derivation of lower bounds on the query cost.
We analyze the cost of solving SLEP in terms of queries to the block encoding of M . Our main result is that any quantum algorithm for solving SLEP has a cost that is of order α M /ǫ if M is provided as a block encoding, where α M is the proportionality factor of the block encoding. As log(α M /ǫ) + 1 digits are sufficient to provide an estimate to additive accuracy ǫ, our results imply that the cost of solving SLEP scales exponentially with the number of digits to which x † M x is estimated. We also prove that our bound on the cost is tight with respect to ǫ by constructing a quantum algorithm that saturates our bound. This bound for SLEP can be used in conjuction with previous hardness results, which bound the queries to the encoding of A with respect to ǫ [6]. To prove our lower bound for SLEP, we first prove a lower bound for the problem B-EVHM, in which the task is to estimate the expectation value of a block-encoded matrix M with respect to a given quantum state. To derive a lower bound for B-EVHM, we leverage a known lower bound for estimating the mean of a black-box function [31]. Our algorithm for SLEP relies on a known algorithm for B-EVHM [24].
Our results rigorously prove that if M is provided by a block encoding and if α M /ǫ is super-polylogarithmic in N , then the cost of any quantum algorithm for solving SLEP is also super-polylogarithmic in N . Consequently, quantum algorithms that employ a block encoding of M show promise only for those applications for which an accuracy with α M /ǫ ∈ polylog(N ) is sufficient. If the scaling of α M /ǫ with respect to N is faster than polylog(N ), then an efficient solution is unlikely unless M is further restricted. An interesting question in this direction is whether such an efficient solution is possible if constraints on the rank or the eigenvalue distribution of M are known, in addition to restrictions on A and b.