Quantum distinguishing complexity, zero-error algorithms, and statistical zero knowledge

TL;DR

This paper introduces quantum distinguishing complexity, a new measure for quantum query algorithms, establishing relationships among various quantum complexities and implications for communication complexity lifting theorems.

Contribution

It defines quantum distinguishing complexity and relates it to zero-error, bounded-error, and zero-knowledge quantum complexities, improving known bounds and providing new insights.

Findings

Q_0(f)=O~(Q(f)^5) for all total functions f

Q D(f) lower bounds QSZK(f) and upper bounds adversary bound

Implications for lifting theorems in communication complexity

Abstract

We define a new query measure we call quantum distinguishing complexity, denoted QD(f) for a Boolean function f. Unlike a quantum query algorithm, which must output a state close to |0> on a 0-input and a state close to |1> on a 1-input, a "quantum distinguishing algorithm" can output any state, as long as the output states for any 0-input and 1-input are distinguishable. Using this measure, we establish a new relationship in query complexity: For all total functions f, Q_0(f)=O~(Q(f)^5), where Q_0(f) and Q(f) denote the zero-error and bounded-error quantum query complexity of f respectively, improving on the previously known sixth power relationship. We also define a query measure based on quantum statistical zero-knowledge proofs, QSZK(f), which is at most Q(f). We show that QD(f) in fact lower bounds QSZK(f) and not just Q(f). QD(f) also upper bounds the (positive-weights) adversary bound, which yields the following relationships for all f: Q(f) >= QSZK(f) >= QS(f) = Omega(Adv(f)). This sheds some light on why the adversary bound proves suboptimal bounds for problems like Collision and Set Equality, which have low QSZK complexity. Lastly, we show implications for lifting theorems in communication complexity. We show that a general lifting theorem for either zero-error quantum query complexity or for QSZK would imply a general lifting theorem for bounded-error quantum query complexity.

Equations

$$Q_0(f)=O(\mathrm{QD}(f{)}^5\log \mathrm{QD}(f))=O(Q(f{)}^5\log Q(f)).$$

$$Q(f)\ge \mathrm{QSZK}(f)\ge \mathrm{QD}(f)=\Omega (\mathrm{Adv}(f)).$$

$$\mathrm{QD}(f)=\tilde{\Omega }(\mathrm{Adv}(f{)}^2)\mathrm{and}\mathrm{QD}(g)\ge \widetilde{\mathrm{deg}}(g{)}^{4-o(1)}.$$

$$\mathrm{QD}(h)=\tilde{\Omega }(n^{1/3})\mathrm{and}\mathrm{Adv}(h)=O(\log n).$$

$${\Vert |\psi ⟩⟨\psi |-|\varphi ⟩⟨\varphi |\Vert }_{\mathrm{tr}}=\sqrt{1-|⟨\psi |\varphi ⟩{|}^2}.$$

$$\forall x,y\in D\text{ with }f(x)\ne f(y),{\Vert {\rho }_x-{\rho }_y\Vert }_{\mathrm{tr}}\ge 1/6.$$

$$\mathrm{QD}(f)=\Omega (\mathrm{Adv}(f)).$$

$$C(f)=\underset{x\in \mathrm{Dom}(f)}{\max }D(f^x),\mathrm{RC}(f)=\underset{x\in \mathrm{Dom}(f)}{\max }R(f^x),\mathrm{and}\mathrm{QC}(f)=\underset{x\in \mathrm{Dom}(f)}{\max }Q(f^x).$$

$$\forall x,y\in D\text{mbox}withf(x)\ne f(y),D_{\mathrm{TV}}(d_x,d_y)\ge 1/6,$$

$$\sum _{t=1}^T\sum _{i\in B}{m}_i^t=\Omega \left(\frac{1}{T}\right).$$

$$\frac{1}{T}\sum _{t=1}^T\sum _{i\in B}{m}_i^t.$$

$$Q_0(f)=O(\mathrm{QD}(f{)}^{3}s(f)\log \mathrm{RC}(f)).$$

$${\rho }_x={\mathrm{Tr}}_B(|R_x⟩⟨R_x{|}_{BC})\text{ and }{\sigma }_x={\mathrm{Tr}}_B(|S_x⟩⟨S_x{|}_{BC}).$$

$$|R_x^{\prime }⟩$$

$$|S_x^{\prime }⟩$$

$${\rho }_x^{\prime }={\mathrm{Tr}}_{CD}(|R_x^{\prime }⟩⟨R_x^{\prime }{|}_{ABCD})\text{ and }{\sigma }_x^{\prime }={\mathrm{Tr}}_{CD}(|S_x^{\prime }⟩⟨S_x^{\prime }{|}_{ABCD}).$$

$${\Vert {\rho }_x\otimes {\sigma }_x-{\rho }_y\otimes {\sigma }_y\Vert }_{\mathrm{tr}}\ge 1/6.$$

$${\Vert {\rho }_x\otimes {\sigma }_x-{\rho }_y\otimes {\sigma }_y\Vert }_{\mathrm{tr}}\ge \max \left\{{\Vert {\rho }_x-{\rho }_y\Vert }_{\mathrm{tr}},{\Vert {\sigma }_x-{\sigma }_y\Vert }_{\mathrm{tr}}\right\}.$$

$${\Vert {\rho }_x-{\sigma }_x\Vert }_{\mathrm{tr}}$$

$$\le {\Vert {\rho }_x-{\rho }_y\Vert }_{\mathrm{tr}}+{\Vert {\rho }_y-{\sigma }_y\Vert }_{\mathrm{tr}}+{\Vert {\sigma }_y-{\sigma }_x\Vert }_{\mathrm{tr}}$$

$$<1/6+1/3+1/6=2/3,$$

$$\mathrm{QSZK}(f)=\Omega (\mathrm{Adv}(f)).$$

$$\mathrm{QD}(\text{textsc}{Ind}_k{\circ }_{k}f)=\Theta (Q(\text{textsc}{Ind}_k{\circ }_{k}f))=\Theta (kQ(f))$$

$$\mathrm{QD}(\text{textsc}{UInd}_k{\circ }_{k}f)=\Theta (Q(\text{textsc}{UInd}_k{\circ }_{k}f))=\Theta (kQ(f)).$$

$$Q_0^{\mathrm{cc}}(g\circ G)=\tilde{\Omega }(Q_0(g))=\tilde{\Omega }(Q(g))=\tilde{\Omega }(Q(f)).$$

$$Q^{\mathrm{cc}}(g\circ G)=\Omega ({\mathrm{QSZK}}^{\mathrm{cc}}(g\circ G))=\tilde{\Omega }(\mathrm{QSZK}(g))=\tilde{\Omega }(Q(f)).$$

$$Q^{\mathrm{cc}}(g\circ G)=\tilde{\Omega }(\mathrm{QD}(g))=\tilde{\Omega }(Q(f)).$$

$$|{\psi }_x⟩=U_T{O}_x{U}_{T-1}{O}_x\cdots O_x{U}_1{O}_x{U}_0|0^m⟩,$$

$$|{\psi }_x^0⟩:=U_0|0^m⟩\text{ and }|{\psi }_x^t⟩:=U_t{O}_x|{\psi }_x^{t-1}⟩.$$

$${\Vert |{\psi }_x^T⟩⟨{\psi }_x^T|-|{\psi }_{x^B}^T⟩⟨{\psi }_{x^B}^T|\Vert }_{\mathrm{tr}}\ge 1-2ϵ.$$

$$|⟨{\psi }_x^T|{\psi }_{x^B}^T⟩|\le \sqrt{1-(1-2ϵ{)}^2}=2\sqrt{ϵ(1-ϵ)}\le 1-(1/2)(1-2ϵ{)}^2.$$

$$\Vert |{\psi }_x^T⟩-|{\psi }_{x^B}^T⟩{\Vert }^2=2-⟨{\psi }_{x^B}^T|{\psi }_x^T⟩-⟨{\psi }_x^T|{\psi }_{x^B}^T⟩=2-2\mathrm{Re}(⟨{\psi }_{x^B}^T|{\psi }_x^T⟩)\ge 2-2|⟨{\psi }_{x^B}^T|{\psi }_x^T⟩|\ge (1-2ϵ{)}^2,$$

Full text

Using this measure, we establish a new relationship in query complexity: For all total functions $f$, $\operatorname{Q}_{0}(f)=\widetilde{O}(\operatorname{Q}(f)^{5})$, where $\operatorname{Q}_{0}(f)$ and $\operatorname{Q}(f)$ denote the zero-error and bounded-error quantum query complexity of $f$ respectively, improving on the previously known sixth power relationship.

We also define a query measure based on quantum statistical zero-knowledge proofs, $\operatorname{QSZK}(f)$, which is at most $\operatorname{Q}(f)$. We show that $\operatorname{QD}(f)$ in fact lower bounds $\operatorname{QSZK}(f)$ and not just $\operatorname{Q}(f)$. $\operatorname{QD}(f)$ also upper bounds the (positive-weights) adversary bound, which yields the following relationships for all $f$: $\operatorname{Q}(f)\geq\operatorname{QSZK}(f)\geq\operatorname{QD}(f)=\Omega(\operatorname{Adv}(f)).$ This sheds some light on why the adversary bound proves suboptimal bounds for problems like Collision and Set Equality, which have low QSZK complexity.

Lastly, we show implications for lifting theorems in communication complexity. We show that a general lifting theorem for either zero-error quantum query complexity or for QSZK would imply a general lifting theorem for bounded-error quantum query complexity.

1. 1 Introduction

2. 1.1 Quantum distinguishing complexity

3. 1.2 Fifth power query relation

4. 1.3 Quantum statistical zero knowledge

5. 1.4 Comparison with other lower bounds

6. 1.5 Lifting theorems

7. 2 Preliminaries

8. 2.1 Distance measures

9. 2.2 Quantum query complexity

10. 3 Quantum distinguishing complexity

11. 3.1 Definition

12. 3.2 Properties

13. 3.3 Relation with randomized sabotage complexity

14. 4 Fifth power query relation

15. 4.1 Hybrid argument

16. 4.2 New upper bound

17. 5 Quantum statistical zero knowledge

18. 5.1 History

19. 5.2 Definition

20. 5.3 Properties

21. 5.4 Relation with adversary bound

22. 6 Comparison with other lower bounds

23. 6.1 Index functions

24. 6.2 Index function composition

25. 6.3 Separations

26. 7 Lifting theorems

27. 7.1 Background

28. 7.2 Lifting theorem reductions

29. A Proof of the hybrid argument

1 Introduction

In the model of query complexity, we wish to compute some known Boolean function $f:\{0,1\}^{n}\to\{0,1\}$ on an unknown input $x\in\{0,1\}^{n}$ that we can access through an oracle that knows $x$. In the classical setting, the oracle responds with $x_{i}$ when queried with an index $i\in[n]$. For quantum models, we use essentially the same oracle, but slightly modified to make it unitary. The bounded-error quantum query complexity of a function $f$, denoted $\operatorname{Q}(f)$, is the minimum number of queries to the oracle needed to compute the function $f$ with probability greater than $2/3$ on any input $x$. In other words, the quantum query algorithm outputs a quantum state that is close to $|f(x)\rangle$.

In this paper we study “quantum distinguishing complexity,” a query measure obtained by relaxing the output requirement of quantum query algorithms. Essentially, a quantum distinguishing algorithm for $f$ doesn’t need to compute $f(x)$, but merely needs to behave differently on input $x$ and input $y$ if $f(x)\neq f(y)$. We claim that this weaker notion of computation helps shed light on quantum query complexity and various lower bound techniques for it. We use quantum distinguishing complexity to prove a new query complexity relationship for total functions: $\operatorname{Q}_{0}(f)=O(\operatorname{Q}(f)^{5}\log\operatorname{Q}(f))$. We also use it to explain why the non-negative adversary bound fails for some problems, to provide lower bound techniques for the query version of the complexity class $\mathsf{QSZK}$, and to prove some reductions between lifting theorems in communication complexity.

1.1 Quantum distinguishing complexity

The quantum distinguishing complexity of a function $f:D\to\{0,1\}$ (where $D\subseteq\{0,1\}^{n}$), denoted $\operatorname{QD}(f)$, is the minimum number of queries needed to the input $x\in D$ to produce an output state $|\psi_{x}\rangle$, such that the output states corresponding to [math]-inputs and $1$-inputs are nearly orthogonal (or far apart in trace distance). Note that the usual bounded-error quantum query complexity of a function $f$, denoted $\operatorname{Q}(f)$, is defined similarly with the additional requirement that there should exist a 2-outcome measurement that (with high probability) accepts states corresponding to $1$-inputs and rejects states corresponding to [math]-inputs. Since measurements can only distinguish nearly orthogonal states, every quantum algorithm for computing $f$ satisfies the definition of quantum distinguishing complexity. Hence for all functions $f$, we have $\operatorname{QD}(f)\leq\operatorname{Q}(f)$. We formally define quantum distinguishing complexity and establish some basic properties in Section 3.

This is a natural relaxation of bounded-error quantum query complexity and has been mentioned in passing in several prior works. Indeed, Barnum, Saks, and Szegedy call this measure $\textrm{DQA}(f)$ in an early technical report [BSS01, Remark 1]. This measure often comes up in discussions about the (positive-weights) adversary bound,111The positive-weights adversary bound should not be confused with the stronger negative-weights adversary bound (also known as the general adversary bound), which essentially equals quantum query complexity [HLŠ07, LMR*+*11]. a lower bound for quantum query complexity introduced by Ambainis [Amb02]. The (positive-weights) adversary bound, which we denote by $\operatorname{Adv}(f)$, has several variants [Amb02, Amb03, BSS03, LM04, Zha05], which are all essentially the same [ŠS06]. It was noted in several works [BSS03, HLŠ07] that the proof that the adversary bound lower bounds quantum query complexity only uses the fact that the outputs corresponding to [math]-inputs and $1$-inputs are nearly orthogonal, and hence for all functions $\operatorname{QD}(f)=\Omega(\operatorname{Adv}(f))$. However, it is not the case that $\operatorname{QD}(f)=\Theta(\operatorname{Adv}(f))$ for all $f$, and we exhibit functions separating these measures.

Lastly, we show in Section 3 that this measure is the quantum analogue of a lower bound method for randomized query complexity called randomized sabotage complexity [BK16]. Hence this measure could also be called “quantum sabotage complexity.”

1.2 Fifth power query relation

Our first result establishes a new relation between query measures for total functions. A total function is a function of the form $f:\{0,1\}^{n}\to\{0,1\}$, as opposed to a partial function, which is a function of the form $f:D\to\{0,1\}$, where $D\subseteq\{0,1\}^{n}$. We show a new upper bound on the zero-error quantum query complexity of $f$, denoted $\operatorname{Q}_{0}(f)$, in terms of its quantum distinguishing complexity, and hence its quantum query complexity. The zero-error quantum query complexity of $f$ is the minimum number of queries needed by a quantum algorithm that either outputs the correct answer $f(x)$ on input $x$, or outputs ? indicating that it does not know, but does this with probability at most $1/2$ on any input $x$. In Section 4 we prove the following.

Theorem 1**.**

For all total functions $f:\{0,1\}^{n}\to\{0,1\}$, we have

[TABLE]

Additionally, the algorithm also outputs a certificate for $f(x)$ when it outputs $f(x)$.

This is an improvement over the previous best relationship between zero-error and bounded-error quantum query complexity, $\operatorname{Q}_{0}(f)=O(\operatorname{Q}(f)^{6})$ [BBC*+*01], which follows from $\operatorname{D}(f)=O(\operatorname{Q}(f)^{6})$, where $\operatorname{D}(f)$ is deterministic query complexity. In fact, our result is the first upper bound on zero-error quantum query complexity that does not follow from an upper bound on zero-error randomized query complexity. Our proof is borrows ideas from the classical result $\operatorname{R}_{0}(f)=O(\operatorname{R}(f)^{2}\log\operatorname{R}(f))$ [Mid05, KT16], which is essentially optimal due to a nearly matching separation by Ambainis et al. [ABB*+*16].

1.3 Quantum statistical zero knowledge

Next we show that, surprisingly, quantum distinguishing complexity lower bounds a more powerful model of computation than quantum query complexity: the query complexity of computing a function using a quantum statistical zero-knowledge (QSZK) proof system. A QSZK proof system is an interactive protocol between a quantum verifier and a computationally unbounded, but untrusted prover in which the verifier learns the value of $f(x)$ but learns essentially no more. QSZK can also be characterized in terms of its complete problem Quantum State Distinguishability [Wat02, Wat09].

In Section 5, we discuss the history of quantum statistical zero-knowledge proofs and define an associated query measure $\operatorname{QSZK}(f)$ based on the complete problem Quantum State Distinguishability. We establish some basic properties of our definition, such as $\operatorname{QSZK}(f)\leq\operatorname{Q}(f)$, which corresponds to the complexity class containment $\mathsf{BQP}\subseteq\mathsf{QSZK}$. We then show that quantum distinguishing complexity lower bounds QSZK complexity.

Theorem 2**.**

For all (partial) Boolean functions $f$, $\operatorname{QD}(f)\leq\operatorname{QSZK}(f)$.

As a corollary of Theorem 2 and $\operatorname{QD}(f)=\Omega(\operatorname{Adv}(f))$, we have for all (partial) functions $f$,

[TABLE]

This sheds some light on why the adversary bound sometimes proves poor lower bounds: it lower bounds a more powerful model of computation! For example, it is well known that the adversary bound cannot prove a super-constant lower bound for the collision problem [AS04]. It is also easy to see that the collision problem has a constant-query QSZK (and even classical SZK) protocol.

On the bright side, this gives us a new way to prove lower bounds on QSZK query complexity and prove oracle separations against the complexity class $\mathsf{QSZK}$. For example, since we know the OR function on $n$ bits has $\operatorname{Adv}(\textrm{OR})=\Omega(\sqrt{n})$, this yields an oracle $A$ such that $\mathsf{NP}^{A}\nsubseteq\mathsf{QSZK}^{A}$, since the OR function has small certificates. A similar strategy was used recently by Menda and Watrous to show oracle separations against $\mathsf{QSZK}$ [MW18].

1.4 Comparison with other lower bounds

We compare quantum distinguishing complexity to the two main lower bound techniques for quantum query complexity: the (positive-weights) adversary bound and the polynomial method. Recall that the negative-weights adversary or general adversary completely characterizes quantum query complexity, so we do not compare quantum distinguishing complexity with it.

As noted earlier, the adversary bound is weaker than quantum distinguishing complexity since for all (partial) functions $f$, $\operatorname{QD}(f)=\Omega(\operatorname{Adv}(f))$. This implies that $\operatorname{QD}(f)$ coincides with $\operatorname{Q}(f)$ for most functions studied in the literature, since most quantum lower bounds are proved using the adversary method. Moreover, not only is quantum distinguishing complexity always larger than the adversary bound, it can be exponentially larger for partial functions and quadratically larger for total functions as we show in Theorem 3.

Another popular lower bound technique is the polynomial method [BBC*+*01], which uses the fact that the approximate degree of a function lower bounds $\operatorname{Q}(f)$. The approximate degree of a Boolean function $f$, denoted $\operatorname{\widetilde{\deg}}(f)$, is the minimum degree of a real polynomial $p(x)$ over the input variables such that for all inputs $x$ we have $|f(x)-p(x)|\leq 1/3$.

We do not know an exponential separation between quantum distinguishing complexity and approximate degree (for a partial function), since it is not even known if quantum query complexity can be exponentially larger than approximate degree for a partial functions. We do, however, show in Theorem 3 that quantum distinguishing complexity can be polynomially larger than approximate degree for total functions.

Theorem 3**.**

There exist total functions $f$ and $g$ with

[TABLE]

There also exists an $n$-bit partial function $h$ with

[TABLE]

This theorem is proved in Section 6. Figure 1 shows the known relationships between all the measures discussed in this paper. The measures $\operatorname{RS}$ and $\operatorname{QC}$ are introduced later, and refer to randomized sabotage complexity and quantum certificate complexity, respectively.

1.5 Lifting theorems

Most measures in query complexity have an analogous measure in communication complexity, which we denote with the superscript cc, such as $\operatorname{Q}^{\mathrm{\mathrm{cc}}}(F)$ and $\operatorname{QSZK}^{\mathrm{\mathrm{cc}}}(F)$. A lifting theorem is a result that transfers a lower bound on a query function $f$ to a lower bound in communication complexity for a lifted version of the function $f$, obtained by composing the function $f$ with a hard communication problem $G$. For example, a lifting theorem is known for deterministic protocols, which means there exists a communication problem $G$ such that for all functions $f$, $\operatorname{D}^{\mathrm{\mathrm{cc}}}(f\circ G)=\Omega(\operatorname{D}(f))$ [RM99, GPW15].

Lifting theorems have been shown for some measures, such as nondeterministic query complexity [GLM*+*16] and (zero-error or bounded-error) randomized query complexity [GPW17], and remain open for measures like zero-error and bounded-error quantum query complexity. Our next result, proved in Section 7, shows that if we could prove a lifting theorem for zero-error quantum query complexity or for QSZK query complexity, then we would get a lifting theorem for bounded-error quantum query complexity.

Theorem 4** (informal).**

If a general lifting theorem holds using some gadget $G$ for either zero-error quantum query complexity, i.e., $\operatorname{Q}_{0}^{\mathrm{\mathrm{cc}}}(f\circ G)=\widetilde{\Omega}(\operatorname{Q}_{0}(f))$, or for quantum statistical zero-knowledge protocols, i.e., $\operatorname{QSZK}^{\mathrm{\mathrm{cc}}}(f\circ G)=\widetilde{\Omega}(\operatorname{QSZK}(f))$, then we obtain a general lifting theorem for bounded-error quantum query complexity (up to logarithmic factors) with the same gadget $G$.

In fact, the same conclusion follows from a weaker assumption. We can assume that the lifting theorem proves a lower bound on bounded-error quantum communication complexity assuming a lower bound on quantum distinguishing complexity. In other words, we can assume a lifting theorem of the form $\operatorname{Q}^{\mathrm{\mathrm{cc}}}(f\circ G)=\widetilde{\Omega}(\operatorname{QD}(f))$, which is weaker than a QSZK lifting theorem since it assumes a stronger lower bound and proves a weaker one.

2 Preliminaries

We assume the reader is generally familiar with quantum computation [NC00] and query complexity (for more details, see [BdW02]). We do not assume the reader is familiar with statistical zero-knowledge protocols.

For any positive integer $n$, let $[n]=\{1,\ldots,n\}$. We use $f(n)=\widetilde{O}(g(n))$ to mean there exists a constant $k$ such that $f(n)=O(g(n)\log^{k}g(n))$ and similarly $f(n)=\widetilde{\Omega}(g(n))$ means $f(n)=\Omega(g(n)/\log^{k}g(n))$ for some constant $k$.

2.1 Distance measures

For any matrix $A$, we define the spectral norm of $A$, denoted ${\left\lVert A\right\rVert}$ as the largest singular value of $A$. The $1$-norm of $A$, denoted ${\left\lVert A\right\rVert}_{1}$, is defined as \operatorname{Tr}\big{(}\sqrt{A^{\dagger}A}\big{)}, which is also equal to the sum of the singular values of $A$.

We define the trace distance between two quantum states $\rho$ and $\sigma$ as ${\left\lVert\rho-\sigma\right\rVert}_{\mathrm{tr}}=\frac{1}{2}{\left\lVert\rho-\sigma\right\rVert}_{1}$. The factor of $1/2$ makes this distance measure lie between [math] and $1$ for density matrices. Trace distance is a useful distance measure since it exactly captures distinguishability of states and is non-increasing under quantum operations [NC00, Th. 9.2]. For pure states $|\psi\rangle$ and $|\phi\rangle$, trace distance is related to their inner product as follows [Wat18, eq. 1.186].

[TABLE]

2.2 Quantum query complexity

In query complexity, we wish to compute a Boolean function $f$ on an input $x$ given query access to the bits of $x$. In this paper, we will mostly deal with functions with Boolean input and output. An $n$-bit function $f:\{0,1\}^{n}\to\{0,1\}$ is called a total function. An $n$-bit function $f:D\to\{0,1\}$, where $D\subseteq\{0,1\}^{n}$, is called a partial function since it is defined on a subset of $\{0,1\}^{n}$. We will also refer to this subset $D$ as the domain of $f$, or $\operatorname{Dom}(f)$. The goal in query complexity is to compute $f(x)$ while making the fewest queries to the oracle for the bits of $x$.

Classical algorithms have access to an oracle that given an index $i\in[n]$ outputs $x_{i}$, the $i^{\mathrm{th}}$ bit of $x$. A quantum algorithm is allowed access to a unitary map that implements this oracle, and is usually taken to be the unitary $O_{x}$ which acts as follows on inputs $i\in[n]$ and $b\in\{0,1\}$: $O_{x}|i,b\rangle=|i,b\oplus x_{i}\rangle$. A quantum algorithm that uses the gate $O_{x}$ in its circuit $k$ times is said to have made $k$ queries to the oracle.

Since we do not count the complexity of any other gates used in the algorithm, we can assume a $k$-query quantum algorithm always starts with the all-zeros state $|0^{m}\rangle$ and applies an oracle-independent unitary $U_{0}$ followed by the oracle $O_{x}$ and so on. Thus a $k$-query quantum algorithm is specified by $k+1$ oracle-independent unitaries $U_{0},\ldots,U_{k}$, which act on $m$ output qubits. The state output by the quantum algorithm is $|\psi_{x}\rangle=U_{k}O_{x}U_{k-1}O_{x}\cdots O_{x}U_{1}O_{x}U_{0}|0^{m}\rangle$, where $O_{x}$ is implicitly $(O_{x}\otimes\mathbbold{1})$ if $U_{i}$ acts on more qubits than $O_{x}$. If the quantum algorithm outputs a mixed state, then we assume it traces out some subset $S$ of the $m$ qubits, and hence outputs $\operatorname{Tr}_{S}(|\psi_{x}\rangle\langle\psi_{x}|)$. If the quantum algorithm outputs a bit, then we assume it measures the first qubit in the standard basis and outputs the result of that measurement.

We can now define the various complexity measures associated with quantum query complexity. We say the bounded-error quantum query complexity of computing a Boolean function $f$, $\operatorname{Q}(f)$, is the minimum $k$ such that there exists a $k$-query quantum algorithm that on every $x\in\operatorname{Dom}(f)$ outputs $f(x)$ with probability greater than or equal to $2/3$. As usual, the constant $2/3$ is unimportant as long as it is a constant strictly greater than half, due to standard error reduction.

A zero-error quantum algorithm (or a Las Vegas quantum algorithm) never outputs an incorrect answer on an input $x\in\operatorname{Dom}(f)$, but is allowed to claim ignorance and answer ? with probability at most $1/2$. The zero-error quantum query complexity of $f$, $\operatorname{Q}_{0}(f)$ is the minimum number of queries needed for a zero-error quantum algorithm to compute $f$. Note that $\operatorname{Q}(f)\leq\operatorname{Q}_{0}(f)$, since a zero-error algorithm can be turned into a bounded-error algorithm by simply outputting a random bit when the zero-error algorithm outputs ?.

For zero-error quantum algorithms, there is a subtlety to do with whether or not the algorithm also produces a classical certificate for the input $x$. A certificate for $x$ is a subset of bits of $x$, such that the value of $f(x)$ is completely determined by reading these bits alone. A classical zero-error algorithm can always be assumed to output such a certificate without loss of generality. However, this is not known to be true for zero-error quantum algorithms, and zero-error quantum algorithms that also output a certificate when they output a non-? answer are called self-certifying algorithms [BCdWZ99]. All the zero-error quantum algorithms in this paper are self-certifying, which makes our results stronger since we only prove upper bounds on zero-error quantum algorithms.

3 Quantum distinguishing complexity

3.1 Definition

We now define quantum distinguishing complexity more formally. As explained in the introduction, instead of requiring that the quantum algorithm output the value of the function $f(x)$, as in standard quantum query complexity, we only want the quantum algorithm’s outputs to be distinguishable (or nearly orthogonal) for [math]-inputs and $1$-inputs.

As an example of how these definitions differ, consider the collision problem. In this problem, we are given an input $x\in[n]^{n}$ and we are promised that if we view $x$ as a function from $[n]\to[n]$, the function is either $1$-to-$1$ or $2$-to-$1$. The goal is to distinguish these two cases under the assumption that the input satisfies this promise. In this problem, since every [math]-input and $1$-input differ in exactly half the positions $i\in[n]$, our quantum algorithm can simply create the state $|\psi_{x}\rangle=\frac{1}{\sqrt{n}}\sum_{i}|i,x_{i}\rangle$ and the states corresponding to [math]-inputs and $1$-inputs will have trace distance $\Omega(1)$. Thus this problem has quantum distinguishing complexity $O(1)$, but its quantum query complexity is $\Theta(n^{1/3})$ [AS04].

Definition 5** (Quantum Distinguishing complexity).**

Let $f:D\to\{0,1\}$, where $D\subseteq\{0,1\}^{n}$, be an $n$-bit partial function. $\operatorname{QD}(f)$ is defined as the smallest integer $k$ such that there exists a $k$-query quantum algorithm that on input $x\in D$ outputs a quantum state $\rho_{x}$ such that

[TABLE]

Note that the definition is robust to minor changes. First, we allow outputting mixed states, although this does not offer any additional power over only outputting pure states. The reason is that we can always assume that the quantum algorithm is pure until the final step where some subset of qubits is traced out. But if two states are far apart in trace distance after a partial trace, then they were far apart to begin with since trace distance is non-increasing under partial trace.

The constant $1/6$ in Definition 5 is also arbitrary and any constant in $(0,1)$ would not change the measure by more than a multiplicative constant. This is because we can increase the trace distance between the states by outputting multiple copies of the states. We choose the constant $1/6$ purely for aesthetic reasons: This choice ensures that the result in Theorem 2 has no constant factors.

3.2 Properties

We can now establish some basic properties of quantum distinguishing complexity. First, let us formally show that quantum distinguishing complexity lower bounds quantum query complexity.

Proposition 6**.**

For all (partial) Boolean functions $f$, $\operatorname{QD}(f)\leq\operatorname{Q}(f)$.

Proof.

Let $\operatorname{Q}(f)=k$ and consider the $k$-query algorithm that witnesses this fact. Let $p_{x}$ be the probability that this $k$-query algorithm, when run on input $x$, outputs $1$ upon measuring the first qubit. Since the algorithm computes $f$ with bounded error, we know that for all $1$-inputs $x$, $p_{x}\geq 2/3$, and for all [math]-inputs $y$, $p_{y}\leq 1/3$.

Now consider the single-qubit state $\rho_{x}$, which is obtained by taking the final state of this algorithm, tracing out all the qubits except the first one, and then applying a completely dephasing channel to it. This state is \rho_{x}=\big{(}\begin{smallmatrix}1-p_{x}&0\\ 0&p_{x}\end{smallmatrix}\big{)}. Thus for all $x,y$ with $f(x)\neq f(x)$, ${\left\lVert\rho_{x}-\rho_{y}\right\rVert}_{\mathrm{tr}}=|p_{x}-p_{y}|\geq 1/3$. ∎

As noted in the introduction, quantum distinguishing complexity is also lower bounded by the adversary bound, i.e.,

[TABLE]

We do not prove this since this follows from the arguments that establish that the adversary bound is a lower bound on quantum query complexity [Amb02, Amb03, BSS03, LM04, Zha05, ŠS06], since all these proofs only use the fact that the states output on [math]-inputs and $1$-inputs are nearly orthogonal.

Quantum distinguishing complexity is also superior to quantum certificate complexity $\operatorname{QC}(f)$, as we show in Proposition 8. Quantum certificate complexity is a lower bound on quantum query complexity defined by Aaronson [Aar08]. It was later shown that quantum certificate complexity also lower bounds approximate polynomial degree [KT16].

Before proving Proposition 8, we first define certificate complexity, randomized certificate complexity, and quantum certificate complexity.

Definition 7** (Certificate complexity).**

For any (partial) function $f$ and input $x\in\operatorname{Dom}(f)$, consider the partial function $f^{x}$ defined on the domain $\{x\}\cup\{y\in\operatorname{Dom}(f):f(y)\neq f(x)\}$ that satisfies $f^{x}(x)=1$ and $f^{x}(y)=0$ for all $y\in\operatorname{Dom}(f)$ with $f(y)\neq f(x)$.

We define the certificate complexity of $f$, denoted $\operatorname{C}(f)$, the randomized certificate complexity of $f$, denoted $\operatorname{RC}(f)$, and the quantum certificate complexity of $f$, denoted $\operatorname{QC}(f)$, as follows:

[TABLE]

The problem $f^{x}$ is clearly no harder than computing $f$ itself in any model of computation, and hence these are lower bounds on their respective measures, i.e., $\operatorname{C}(f)\leq\operatorname{D}(f)$, $\operatorname{RC}(f)\leq\operatorname{R}(f)$, and $\operatorname{QC}(f)\leq\operatorname{Q}(f)$. We can now prove that $\operatorname{QD}(f)$ is a better lower bound on $\operatorname{Q}(f)$ than $\operatorname{QC}(f)$.

Proposition 8**.**

For all (partial) Boolean functions $f$, $\operatorname{QD}(f)=\Omega(\operatorname{QC}(f))$.

Proof.

Let $\operatorname{QD}(f)=k$ and consider the $k$-query quantum algorithm that witnesses this fact. We can use this algorithm to solve $f^{x}$ for any $x\in\operatorname{Dom}(f)$. Consider the output of the algorithm on input $x$ before the partial trace operation and call this $|\psi_{x}\rangle$. The trace distance between $|\psi_{x}\rangle$ and $|\psi_{y}\rangle$ for $y\in\operatorname{Dom}(f)$ with $f(y)\neq f(x)$ is at least $1/6$ since trace distance is non-increasing under partial trace [NC00, Th. 9.2].

Now we construct an algorithm for $f^{x}$ from this algorithm to show that $\operatorname{Q}(f^{x})=O(\operatorname{QD}(f))$. To do so, we run the supposed algorithm and measure whether the output state is $|\psi_{x}\rangle$ or not and accept only when the measurement accepts. This yields an algorithm that outputs $1$ on $x$ with probability $1$ and accepts inputs $y$ with $f(x)\neq f(x)$ with some constant probability strictly less than $1$. More precisely, the acceptance probability is $|\langle\psi_{x}|\psi_{y}\rangle|^{2}\leq 1-(1/6)^{2}$ due to the relationship between inner product and trace distance for pure states. Repeating this algorithm a constant number of times yields a bounded-error quantum algorithm for $f^{x}$. ∎

3.3 Relation with randomized sabotage complexity

We start by reviewing the definition of randomized sabotage complexity, as presented in [BK16]. Fix a (partial) Boolean function $f:D\to\{0,1\}$ with $D\in\{0,1\}^{n}$. For any pair $x,y\in\operatorname{Dom}(f)$ such that $f(x)\neq f(y)$, let $p\in\{0,1,*\}^{n}$ be the partial assignment of all bits where $x$ and $y$ agree (with the symbol $*$ used for the bits where $x$ and $y$ disagree). We call $p$ a “sabotaged input”, imagining that a saboteur replaced bits of $x$ with $*$ symbols until it was no longer possible to determine $f(x)$.

Let $S_{*}\subseteq\{0,1,*\}^{n}$ be the set of all sabotaged inputs to $f$, that is, the set of all partial assignments that are consistent with both a [math]-input and a $1$-input to $f$. Let $S_{\dagger}\in\{0,1,\dagger\}^{n}$ be the same as $S_{*}$, except that the $\dagger$ symbol is used instead of the $*$ symbol. Finally, let $f_{\mathrm{sab}}:S_{*}\cup S_{\dagger}\to\{0,1\}$ be the function that takes a sabotaged input and identifies whether it has $*$ symbols or $\dagger$ symbols, promised that it contains only one type of symbol. Intuitively, $f_{\mathrm{sab}}$ is a decision problem that forces an algorithm computing it to find a $*$ or $\dagger$. We then define $\operatorname{RS}(f):=\operatorname{R}_{0}(f_{\mathrm{sab}})$, the expected running time of a zero-error randomized algorithm computing $f_{\mathrm{sab}}$.

To show that $\operatorname{RS}(f)$ is larger than $\operatorname{QD}(f)$ for all $f$, we will define a classical measure analogous to $\operatorname{QD}(f)$. We will then show this measure is equivalent to $\operatorname{RS}(f)$.

Definition 9** (Randomized distinguishing complexity).**

Let $f:D\to\{0,1\}$, where $D\subseteq\{0,1\}^{n}$, be an $n$-bit partial function. $\operatorname{RD}(f)$ is defined as the smallest integer $k$ such that there exists a $k$-query randomized algorithm that on input $x\in D$ outputs a sample from a probability distribution $d_{x}$ such that

[TABLE]

where $D_{\mathrm{TV}}(\cdot,\cdot)$ stands for the total variation distance between probability distributions.

Since quantum algorithms can simulate classical algorithms, we immediately get that $\operatorname{QD}(f)\leq\operatorname{RD}(f)$. Next, we will show that $\operatorname{RD}(f)=\Theta(\operatorname{RS}(f))$, completing the argument that $\operatorname{QD}(f)=O(\operatorname{RS}(f))$.

Theorem 10**.**

Let $f$ be a partial Boolean function. Then $\operatorname{RS}(f)/12\leq\operatorname{RD}(f)\leq(12/11)\operatorname{RS}(f)$.

Proof.

First, we show that $\operatorname{RS}(f)\leq 12\operatorname{RD}(f)$. Let $A$ be an optimal randomized algorithm for $\operatorname{RD}(f)$, that on input $x$ outputs a sample from the distribution $d_{x}$. Let $z\in\operatorname{Dom}(f_{\mathrm{sab}})$ be a sabotaged input, and consider running $A$ on $z$. Since $z$ is sabotaged, there are inputs $x$ and $y$ with $f(x)\neq f(y)$ that are both consistent with the non-$*$, non-$\dagger$ bits of $z$. The variation distance between $d_{x}$ and $d_{y}$ is at least $1/6$.

A randomized algorithm can be viewed as a probability distribution over deterministic algorithms. Split the support of the distribution for $A$ into two parts: a set $S$ consisting of deterministic algorithms that, when run on $z$, query a $*$ or $\dagger$, and a set $T$ consisting of deterministic algorithms that don’t query a $*$ or $\dagger$ when run on $z$. Note that algorithms in $T$ behave the same on $x$ and $y$. If $A$ samples an algorithm from $T$ with probability $p$, the total variation distance between the run of $A$ on $x$ and the run of $A$ on $y$ must therefore be at most $2(1-p)$. Since this is at least $1/6$, we have $p\leq 11/12$. Hence when $A$ is run on $z$, it queries a $*$ or $\dagger$ with probability at least $1/12$.

If we repeat $A$ whenever it does not query a $*$ or $\dagger$, we get an algorithm that always finds such an entry and uses at most $12\operatorname{RD}(f)$ queries on expectation. This is a zero-error randomized algorithm for $f_{\mathrm{sab}}$, so $\operatorname{RS}(f)\leq 12\operatorname{RD}(f)$.

We now handle the other direction, showing $\operatorname{RD}(f)\leq(12/11)\operatorname{RS}(f)$. Let $A$ be an optimal zero-error randomized algorithm for $f_{\mathrm{sab}}$. It makes $\operatorname{RS}(f)$ queries on expectation, and always finds a $*$ or $\dagger$ in any sabotaged input. Consider the algorithm $B$ that, on input $x\in\operatorname{Dom}(f)$, runs $A$ for at most $2\operatorname{RS}(f)$ queries and outputs the partial assignment it queried (that is, it outputs all the pairs $(i,x_{i})$ that were queried by the algorithm $A$).

Let $x$ and $y$ be inputs to $f$ with $f(x)\neq f(y)$. Let $z$ be the sabotaged input defined by $x$ and $y$, that is, $z_{i}=*$ if $x_{i}\neq y_{i}$ and $z_{i}=x_{i}=y_{i}$ otherwise. By Markov’s inequality, after $(12/11)\operatorname{RS}(f)$ queries, $A$ finds a $*$ with probability at least $1/12$ when it is run on $z$. This means that when $A$ is run on $x$, it queries an index $i$ for which $x_{i}\neq y_{i}$ with probability at least $1/12$. When this happens, the output of $B(x)$ is not in the support of $d_{y}$. This means $d_{x}$ puts weight at least $1/12$ on symbols not in the support of $d_{y}$. Conversely, $d_{y}$ puts weight at least $1/12$ on symbols not in the support of $d_{x}$. The total variation distance between the two distributions is therefore at least $1/6$, meaning $B$ is a valid $\operatorname{RD}(f)$ algorithm. We conclude that $\operatorname{RD}(f)\leq(12/11)\operatorname{RS}(f)$. ∎

Combined with $\operatorname{QD}(f)\leq\operatorname{RD}(f)$, this theorem gives us the following corollary.

Corollary 11**.**

For all (partial) Boolean functions $f$, $\operatorname{QD}(f)=O(\operatorname{RS}(f))$.

4 Fifth power query relation

In this section we prove a new relationship between zero-error quantum query complexity and quantum distinguishing complexity and bounded-error quantum query complexity, restated below.

See 1

Our proof uses ideas from an analogous classical result [Mid05, KT16] and the main quantum ingredient used is the hybrid argument of Bennett, Bernstein, Brassard, and Vazirani [BBBV97]. We now describe and prove a version of the hybrid argument that we use.

4.1 Hybrid argument

We start by defining the concept of a sensitive block. For a string $x\in\{0,1\}^{n}$ and a subset of input bits $B\subseteq[n]$, which we call a block, we use $x^{B}$ to denote the input with all bits in $B$ flipped. In other words, $x^{B}$ agrees with $x$ on all positions outside $B$ and disagrees on $B$. For a function $f$ and an input $x\in\operatorname{Dom}(f)$, we say a block $B$ is a sensitive block if $f(x)\neq f(x^{B})$.

Now any algorithm that computes $f$ must also be able to distinguish $x$ from $x^{B}$, where $B$ is a sensitive block. Any algorithm that can distinguish $x$ from $x^{B}$ must “look at” the bits in $B$ in some informal sense. For classical algorithms, this simply means the algorithm has to query a bit from $B$ with high probability. The analogous statement for quantum algorithms is not so clear, since quantum algorithms can query all input bits in superposition. Nevertheless, the hybrid argument still allows us to formalize this intuition in the quantum setting. The hybrid argument asserts that the total weight of queries within the sensitive block (i.e., the total sum of probabilities of querying within the sensitive block over the course of the algorithm) cannot be too small [BBBV97]:

Lemma 12** (Hybrid Argument).**

Let $x\in\{0,1\}^{n}$ be an input, and let $B\subseteq[n]$ be a block. Let $Q$ be a $T$-query quantum algorithm that accepts $x$ and rejects $x^{B}$ with high probability, or more generally produces output states that are a constant distance apart in trace distance for $x$ and $x^{B}$.

Let $m_{i}^{t}$ be the probability that, when $Q$ is run on $x$ for $t$ queries and then subsequently measured, it is found to be querying position $i$ of $x$ (i.e., the query register collapses to $|i\rangle$). Then

[TABLE]

Note that for a randomized algorithm, we would have $\Omega(1)$ on the right-hand side instead of $\Omega(1/T)$, since a randomized algorithm must look within $B$ (with high probability) at some point during its execution. This lemma was implicitly proven in [BBBV97]. We reproduce the proof in Appendix A for the reader’s convenience.

4.2 New upper bound

To prove our result we also need to upper bound the number of minimal sensitive blocks of a function. It is not too hard to show that any minimal sensitive block has size at most the sensitivity of $f$, $s(f)$, which is the maximum number of sensitive blocks of size $1$ over all inputs $x$. Since there are at most $\binom{n}{\operatorname{s}(f)}=O(n^{\operatorname{s}(f)})$ different subsets of $n$ positions of size $\operatorname{s}(f)$, we know that the number of minimal sensitive blocks is at most this quantity. Kulkarni and Tal [KT16] improve this simple upper bound replacing $n$ with randomized certificate complexity $\operatorname{RC}(f)$ (Definition 7).

Lemma 13**.**

For any total function $f:\{0,1\}^{n}\to\{0,1\}$ and any input $x\in\{0,1\}^{n}$, the number of minimal sensitive blocks of $x$ with respect to $f$ is at most $O(\operatorname{RC}(f)^{\operatorname{s}(f)})$.

We are now ready to prove Theorem 1.

Proof of Theorem 1..

Let $Q$ be the optimal quantum distinguishing algorithm for $f$, that uses $T=\operatorname{QD}(f)$ queries. Consider running the following quantum algorithm $P$ on oracle input $x\in\{0,1\}^{n}$:

Pick $t\in[T]$ uniformly at random. 2. 2.

Run $Q$ on $x$ for $t$ queries and measure the query register. 3. 3.

Write down (on a classical tape) the position $i$ where $Q$ is found to be querying, as well as the query output $x_{i}$.

The algorithm $P$ uses $t\leq T$ quantum queries. Now that the probability $P$ wrote down the index $i$ is $(1/T)\sum_{t=1}^{T}m_{i}^{t}$. For any block $B\subseteq[n]$, the probability that $P$ wrote down some index in $B$ is

[TABLE]

If $B$ is a sensitive block for the input $x$, then the hybrid argument (Lemma 12) implies the probability that our new algorithm $P$ outputs an index in $B$ is $\Omega(1/T^{2})$.

Next, we repeat the algorithm $P$ several times. We claim that after $O(T^{2}\operatorname{s}(f)\log\operatorname{RC}(f))$ repetitions, the outputs of $P$ constitute a certificate for $x$ with constant probability.

To see this, note that for any minimal sensitive block $B$ of the input $x$, the probability that some run of $P$ (out of the $O(T^{2}\operatorname{s}(f)\log\operatorname{RC}(f))$ many runs) queries in the block $B$ is $1-O(\operatorname{RC}(f)^{-\operatorname{s}(f)})$. This is because $T^{2}$ repetitions boost the probability of querying in a minimal sensitive block from $\Omega(1/T^{2})$ to $\Omega(1)$, and then $\operatorname{s}(f)\log\operatorname{RC}(f)$ repetitions of this boosted algorithm further boost the probability to the claimed bound. Hence, by Lemma 13 and the union bound, there is a constant probability that these runs of $P$ query a bit in every minimal sensitive block of the input $x$. But a set of bits that intersects every sensitive block of $x$ is a certificate for $x$. Thus these runs of $P$ output a certificate for the input $x$ with constant probability.

Any algorithm that finds a certificate with constant probability can be turned into a zero-error algorithm by repeating whenever a certificate is not found. We therefore get a zero-error algorithm that works simply by repeating $P$ a sufficient number of times. Note that $P$ uses $O(T)$ quantum queries and must be repeated $O(T^{2}\operatorname{s}(f)\log\operatorname{RC}(f))$ times. Recalling that $T=\operatorname{QD}(f)$, we get

[TABLE]

We can simplify this to $\operatorname{Q}_{0}(f)=O(\operatorname{QD}(f)^{5}\log\operatorname{QD}(f))$, since $\operatorname{s}(f)=O(\operatorname{RC}(f))=O(\operatorname{QC}(f)^{2})$ [Aar08] and $\operatorname{QC}(f)=O(\operatorname{QD}(f))$ (Proposition 8). ∎

5 Quantum statistical zero knowledge

5.1 History

The subject of statistical zero-knowledge proof systems has a rich history in the classical setting, and the interested reader is referred to the paper of Sahai and Vadhan [SV03]. Informally, the complexity class $\mathsf{SZK}$ contains problems that can be solved by a probabilistic polynomial-time verifier interacting with a computationally unbounded prover (like the class $\mathsf{IP}$) with the additional restriction that the verifier not learn anything from the prover (statistically) other than the answer to the problem. From this it is clear that $\mathsf{BPP}\subseteq\mathsf{SZK}$, since the verifier can simply not interact with the prover, and $\mathsf{SZK}\subseteq\mathsf{IP}$, since $\mathsf{IP}$ is simply $\mathsf{SZK}$ without the zero-knowledge constraint.

More surprisingly, it is also known that $\mathsf{SZK}=\mathsf{coSZK}$, and that we can assume without loss of generality that the interaction is only one round and uses public randomness, which means $\mathsf{SZK}\subseteq\mathsf{AM}\cap\mathsf{coAM}$. Another interesting subtlety is that $\mathsf{SZK}$ can be defined assuming an honest verifier, one who does not deviate from the protocol to learn more, or a cheating verifier, who may deviate from the protocol. It turns out that these definitions lead to the same complexity class [GSV98]. The class $\mathsf{SZK}$ also has a much simpler characterization in terms of a complete problem called statistical difference, as shown by Sahai and Vadhan [SV03], which yields easier proofs of some of these facts. Informally, in the statistical difference problem we are given two circuits that sample from probability distributions, and the task is determine whether the distributions are far or close in total variation distance.

On the quantum side, (honest-verifier) $\mathsf{QSZK}$ was first defined by Watrous [Wat02], and like the classical case, it satisfies $\mathsf{BQP}\subseteq\mathsf{QSZK}\subseteq\mathsf{QIP}$. The same paper strengthened these obvious containments by showing that $\mathsf{QSZK}$ is closed under complement (i.e., $\mathsf{QSZK}=\mathsf{coQSZK}$) and that the protocol can be assumed to be one round, which gives $\mathsf{QSZK}\subseteq\mathsf{QIP(2)}$. Watrous also showed that $\mathsf{QSZK}$ has a complete problem, called quantum state distinguishability, which is a quantum generalization of the statistical difference problem of Sahai and Vadhan. In this problem, we are given two quantum circuits outputting mixed states and have to decide if the states are far apart or close in trace distance. Later, Watrous [Wat09] also showed that honest-verifier $\mathsf{QSZK}$ and cheating-verifier $\mathsf{QSZK}$ are the same, as in the classical case.

5.2 Definition

We now define a query analogue of quantum statistical zero-knowledge. Instead of defining $\operatorname{QSZK}(f)$ in terms of an interactive zero-knowledge protocol for $f$, we use the complete problem characterization by Watrous. This yields a considerably simpler definition of $\mathsf{QSZK}$ in the query setting.222The complete problem is often used to define SZK (and its variants, like NISZK) in query complexity and communication complexity (for example, see [BCH*+*17, Sub17]). It is not obvious whether the definition via an interactive proof and the definition via the complete problem coincide exactly as the problem is complete under polynomial-time reductions, which may add polynomial overhead.

Definition 14** (QSZK).**

Let $f:D\to\{0,1\}$, where $D\subseteq\{0,1\}^{n}$, be an $n$-bit partial function. $\operatorname{QSZK}(f)$ is defined as the smallest integer $k$ such that there exists two quantum query algorithms making $k$ queries in total that on input $x\in D$ output states $\rho_{x}$ and $\sigma_{x}$ of the same size such that

• •

$\forall x\in D$* with $f(x)=1,\enspace{\left\lVert\rho_{x}-\sigma_{x}\right\rVert}_{\mathrm{tr}}\geq 2/3$,*

• •

$\forall x\in D$* with $f(x)=0,\enspace{\left\lVert\rho_{x}-\sigma_{x}\right\rVert}_{\mathrm{tr}}\leq 1/3$.*

This definition is also robust to some changes. In particular, the constants $2/3$ and $1/3$ can be replaced by any constants $\alpha\in[0,1]$ and $\beta\in[0,1]$ as long as $\alpha^{2}>\beta$. Hence an alternate definition with $0.99$ instead of $2/3$ and $0.01$ instead of $1/3$ leads to the same complexity measure up to multiplicative constants. This follows from the analogous property of the complexity class $\mathsf{QSZK}$, which was shown by Watrous [Wat02] (see Theorem 1 in the conference version or Theorem 5 in the full version for more details).

5.3 Properties

As a sanity check, let us prove the query analog of the obvious containment $\mathsf{BQP}\subseteq\mathsf{QSZK}$.

Proposition 15**.**

For all (partial) Boolean functions $f$, $\operatorname{QSZK}(f)\leq\operatorname{Q}(f)$.

Proof.

Let $\operatorname{Q}(f)=k$ and consider the $k$-query algorithm that witnesses this fact. Let $p_{x}$ be the probability that this $k$-query algorithm when run on input $x$ outputs $1$ upon measuring the first qubit. Since the algorithm computes $f$ with bounded error, we know that $p_{x}\geq 2/3$ for $1$-inputs and $p_{x}\leq 1/3$ for [math]-inputs.

Now consider the single-qubit state $\rho_{x}$, which is obtained by taking the final state of this algorithm, tracing out all the qubits except the first one, and then applying a completely dephasing channel to it. This is equivalent to measuring the first qubit in the standard basis and outputting $|b\rangle$ when the result is $b$. This state is \rho_{x}=\big{(}\begin{smallmatrix}1-p_{x}&0\\ 0&p_{x}\end{smallmatrix}\big{)}. Let us also define $\sigma_{x}$ as \big{(}\begin{smallmatrix}1&0\\ 0&0\end{smallmatrix}\big{)} for all $x$.

Now let us check that the conditions of Definition 14 are satisfied by these states. For all inputs $x$, we have ${\left\lVert\rho_{x}-\sigma_{x}\right\rVert}_{\mathrm{tr}}=|p_{x}|$. And we know that $p_{x}\geq 2/3$ for $1$-inputs and $0\leq p_{x}\leq 1/3$ for [math]-inputs, which completes the proof. ∎

The measure $\operatorname{QSZK}(f)$ also satisfies another useful property, that $\operatorname{QSZK}(f)=\Theta(\operatorname{QSZK}(\neg f))$. This is the analogue of the result that $\mathsf{QSZK}=\mathsf{coQSZK}$ [Wat02]. Since we do not use this property, we only provide a sketch of the proof.

Sketch of proof of $\operatorname{QSZK}(f)=\Theta(\operatorname{QSZK}(\neg f))$.

To prove this, we would like to reduce the complete problem to its complement. In other words, we are given two circuits that query an oracle preparing $\rho_{x}$ and $\sigma_{x}$ that are either far apart in trace distance (when $f(x)=1$) or close in trace distance (when $f(x)=0$). From these circuits, we want to define two new states $\rho^{\prime}_{x}$ and $\sigma^{\prime}_{x}$, such that these states are far when $\rho_{x}$ and $\sigma_{x}$ were close, and close when $\rho_{x}$ and $\sigma_{x}$ were far. Before starting the transformation, we first boost the parameters $2/3$ and $1/3$ to be extremely close to $1$ and [math] respectively. For this sketch we will assume the parameters are exactly $1$ and [math], which means when the states are far, they are perfectly distinguishable (i.e., ${\left\lVert\rho_{x}-\sigma_{x}\right\rVert}_{\mathrm{tr}}=1$), and when they are close, they are equal (i.e., $\rho_{x}=\sigma_{x})$.

To perform this transformation, consider the pure states output by the circuits before tracing out any qubits. Let $|R_{x}\rangle_{BC}$ and $|S_{x}\rangle_{BC}$ be the pure state on registers $B$ and $C$, which yields $\rho_{x}$ and $\sigma_{x}$, respectively when register $B$ is traced out. More formally, we have

[TABLE]

From the pure states $|R_{x}\rangle_{BC}$ and $|S_{x}\rangle_{BC}$, we define two new pure states on registers $A$, $B$, $C$, and $D$, as follows:

[TABLE]

Note that the only difference between these states is in register $D$. If we have circuits preparing states $|R_{x}\rangle_{BC}$ and $|S_{x}\rangle_{BC}$, it is easy to see that we can construct circuits preparing $|R^{\prime}_{x}\rangle_{ABCD}$ and $|S^{\prime}_{x}\rangle_{ABCD}$. We now define the states $\rho^{\prime}_{x}$ and $\sigma^{\prime}_{x}$ from these states by tracing out registers $C$ and $D$:

[TABLE]

We claim that these states satisfy the conditions we require. When $f(x)=1$, we have that ${\left\lVert\rho_{x}-\sigma_{x}\right\rVert}_{\mathrm{tr}}=1$, i.e., the residual state on register $C$ for states $|R^{\prime}_{x}\rangle$ and $|S^{\prime}_{x}\rangle$ is completely distinguishable. In this case, before we trace out registers $C$ and $D$, we could implement a unitary on these registers which reads register $C$ and writes onto register $D$ whether the state in $C$ is $\rho_{x}$ or $\sigma_{x}$. This operation maps the state $|R^{\prime}_{x}\rangle$ to the state $|S^{\prime}_{x}\rangle$ and only acts on the traced out qubits, which does not affect the qubits that are not traced out, and we have $\rho^{\prime}_{x}=\sigma^{\prime}_{x}$.

When $f(x)=0$, we have that $\rho_{x}=\sigma_{x}$. In this case we want to show that $\rho^{\prime}_{x}$ and $\sigma^{\prime}_{x}$ are distinguishable. We will show that after applying a specific unitary to these states are tracing out register $B$, in the first case we are left with the state $|+\rangle\langle+|_{A}$, but in the second case we have $\frac{1}{2}\mathbbold{1}_{A}$, which can be distinguished.

Since $\rho_{x}=\sigma_{x}$, there is a unitary $U_{B}$ such that $(U_{B}\otimes\mathbbold{1}_{C})|R_{x}\rangle_{BC}=|S_{x}\rangle_{BC}$. Controlled on the qubit in register $A$, let us apply the unitary $U_{B}$ to register $B$ of $|R^{\prime}_{x}\rangle$ and $|S^{\prime}_{x}\rangle$ before we trace out registers $C$ and $D$, which is equivalent to applying it after tracing out the registers. This makes registers $BC$ unentangled with the rest of the state, and equal to $|S_{x}\rangle_{BC}$. In the first case we are left with the state $|+\rangle_{A}|0\rangle_{D}$ on registers $A$ and $D$, while in the second case we have $\frac{1}{2}(|00\rangle_{AD}+|11\rangle_{AD})$. Tracing out register $D$ leaves us with the $|+\rangle$ state in the first case and the maximally mixed state in the second case, as claimed.

5.4 Relation with adversary bound

We have already showed that $\operatorname{QD}(f)\leq\operatorname{Q}(f)$ (Proposition 6) and $\operatorname{QSZK}(f)\leq\operatorname{Q}(f)$ (Proposition 15). We now show that $\operatorname{QD}(f)$ is actually smaller than $\operatorname{QSZK}(f)$.

See 2

Proof.

Let $\operatorname{QSZK}(f)=k$ and consider the quantum algorithms that witnesses this fact. We claim that the tensor product of outputs of these algorithms already satisfies the conditions in Definition 5 and hence proves $\operatorname{QD}(f)\leq k$.

To see this, observe that the algorithm outputs the state $\rho_{x}\otimes\sigma_{x}$ on input $x$, which satisfies the conditions of Definition 14. More precisely, this means for any $x$ and $y$ such that $f(x)=1$ and $f(y)=0$, we know that ${\left\lVert\rho_{x}-\sigma_{x}\right\rVert}_{\mathrm{tr}}\geq 2/3$ and ${\left\lVert\rho_{y}-\sigma_{y}\right\rVert}_{\mathrm{tr}}\leq 1/3$. We want to show that

[TABLE]

Since trace distance is non-increasing under partial trace, we have ${\left\lVert\rho_{x}\otimes\sigma_{x}-\rho_{y}\otimes\sigma_{y}\right\rVert}_{\mathrm{tr}}\geq{\left\lVert\rho_{x}-\rho_{y}\right\rVert}_{\mathrm{tr}}$ and ${\left\lVert\rho_{x}\otimes\sigma_{x}-\rho_{y}\otimes\sigma_{y}\right\rVert}_{\mathrm{tr}}\geq{\left\lVert\sigma_{x}-\sigma_{y}\right\rVert}_{\mathrm{tr}}$, which imply

[TABLE]

Now if we can show the right-hand side is at least $1/6$, then we are done. To show this, toward a contradiction assume that $\max\left\{{\left\lVert\rho_{x}-\rho_{y}\right\rVert}_{\mathrm{tr}},{\left\lVert\sigma_{x}-\sigma_{y}\right\rVert}_{\mathrm{tr}}\right\}<1/6$. Then we have

[TABLE]

which contradicts ${\left\lVert\rho_{x}-\sigma_{x}\right\rVert}_{\mathrm{tr}}\geq 2/3$. ∎

As noted, as a corollary of this theorem and $\operatorname{QD}(f)=\Omega(\operatorname{Adv}(f))$, we have for all (partial) functions $f$,

[TABLE]

This can be used to prove lower bounds on QSZK protocols for functions. For example, consider the OR function and let us try to compute it with an interactive protocol without the zero-knowledge requirement. It is easy to see that when $\textrm{OR}(x)=1$, a computationally unbounded prover can simply send over the location of a bit $i$ such that $x_{i}=1$, which can be checked using only $1$ query. Of course, this protocol leaks information and in particular lets the verifier know the location of a $1$. But is it necessary that an efficient protocol for OR must leak information? Our lower bound says this must be the case, because $\operatorname{Adv}(\mathrm{OR})=\Omega(\sqrt{n})$ and hence any zero-knowledge protocol for the function must make $\Omega(\sqrt{n})$ queries.

6 Comparison with other lower bounds

In this section, we establish the separations between quantum distinguishing complexity and the adversary bound and the polynomial method claimed in Theorem 3.

To prove this, we will compose known functions with the index function and establish the behavior of quantum distinguishing complexity under composition with the index function. This kind of composition was also studied by Chen [Che16], who used it to show an oracle separation between $\mathsf{P}^{\mathsf{SZK}}$ and $\mathsf{QSZK}$.

6.1 Index functions

Let $\textsc{Ind}_{k}:\{0,1\}^{k+2^{k}}\to\{0,1\}$ denote the index function, the function that on input $(x,y)$ with $x\in\{0,1\}^{k}$ and $y\in\{0,1\}^{2^{k}}$, outputs the bit of $y$ indexed by the string $x$. We wish to study the composition of the index function with an arbitrary Boolean function $f$, but composed only on the first $k$ bits of the index function. We’ll denote this composition by $\textsc{Ind}_{k}\circ_{k}f$. More precisely, if $f$ is an $n$-bit function, $\textsc{Ind}_{k}\circ_{k}f$ is a function on $nk+2^{k}$ bits that evaluates $f$ on the first $k$ $n$-bit strings to obtain a binary string $x$ of length $k$, and then uses $x$ to index into the next $2^{k}$ bits of the input and outputs the bit indexed by $x$.

In addition to the index function, which is total, we will also study a function we call the “unambiguous index function,” $\textsc{UInd}_{k}$. This is a partial function defined similarly to the index function, except that the location of the array $y$ pointed to by the first part of the input is “marked,” and we are promised that no other bits of the array are “marked.” More explicitly, the function is defined on $k+2\cdot 2^{k}$ bits, with the first $k$ bits indexing a pair of adjacent bits in the remainder of the input. So if the first part of the input represents the integer $x$, that means it points to the cells $2x$ and $2x+1$ in the second part of the input. The output of $\textsc{UInd}_{k}$ is the first bit of the pair pointed to, i.e., it will be the bit stored at array location $2x$. Moreover, we are promised that the second bit of this pair (the bit at array location $2x+1$) will always be $1$, and also that the second bit in every other pair (i.e., other than the pair $2x$, $2x+1$) will always be [math].

Intuitively, there is only one strategy to solve $\textsc{Ind}_{k}$, which is to read the first $k$ bits and find the cell pointed to. But to solve $\textsc{UInd}_{k}$, there are two good strategies: either read the first $k$ bits (and determine $x$), or search the remainder of the input for the unique position where the second bit of a pair is $1$, which marks the cell pointed to by $x$.

6.2 Index function composition

We now examine the behavior of quantum distinguishing complexity under composition with the Index and Unambiguous Index functions. To prove our result, we need the following strong direct product theorem for quantum query complexity due to Lee and Roland [LR13]:

Theorem 16** (Strong direct product).**

Let $f$ be a partial Boolean function with $\operatorname{Dom}(f)\subseteq\{0,1\}^{n}$, and let $f^{(k)}:\operatorname{Dom}(f)^{k}\to\{0,1\}^{k}$ be the task of solving $k$ independent inputs to $f$ simultaneously. Then any quantum algorithm that solves $f^{(k)}$ with success probability at least $(5/6)^{k}$ uses $\Omega(k\operatorname{Q}(f))$ queries.

We can now prove our composition theorems.

Theorem 17**.**

There is a constant $c$ such that for any partial function $f$, if $k\geq c\log\operatorname{Q}(f)$, then

[TABLE]

[TABLE]

In other words, composing a function with a large enough index gadget makes $\operatorname{QD}$ and $\operatorname{Q}$ coincide.

Proof.

Recall that quantum query complexity composes perfectly [LMR*+*11], so $\operatorname{Q}(\textsc{Ind}_{k}\circ f)=\Theta(\operatorname{Q}(\textsc{Ind}_{k})\operatorname{Q}(f))=O(k\operatorname{Q}(f))$. We argue that $\operatorname{Q}(\textsc{Ind}_{k}\circ_{k}f)$ is smaller than $\operatorname{Q}(\textsc{Ind}_{k}\circ f)$. This is because we can convert any algorithm for $\operatorname{Q}(\textsc{Ind}_{k}\circ f)$ into an algorithm for $\operatorname{Q}(\textsc{Ind}_{k}\circ_{k}f)$: fix a [math]-input $x^{0}$ and a $1$-input $x^{1}$ for $f$; then, given an input to $\operatorname{Q}(\textsc{Ind}_{k}\circ_{k}f)$, pretend that each [math] bit in the second half of the input is actually $x^{0}$, and that each $1$ bit is actually $x^{1}$ (the algorithm can do this by applying the appropriate unitary). This converts the input into an input for $\operatorname{Q}(\textsc{Ind}_{k}\circ f)$, completing the reduction.

Thus $\operatorname{Q}(\textsc{Ind}_{k}\circ_{k}f)=O(k\operatorname{Q}(f))$. Similarly, $\operatorname{Q}(\textsc{UInd}_{k}\circ_{k}f)=O(k\operatorname{Q}(f))$. Since $\operatorname{QD}$ is smaller than $\operatorname{Q}$, it remains only to show that $\operatorname{QD}(\textsc{Ind}_{k}\circ_{k}f)=\Omega(k\operatorname{Q}(f))$ and $\operatorname{QD}(\textsc{UInd}_{k}\circ_{k}f)=\Omega(k\operatorname{Q}(f))$. We complete the argument for UInd; the argument for Ind is similar.

Let $Q$ be an optimal quantum distinguishing algorithm for $\textsc{UInd}_{k}\circ_{k}f$. We turn $Q$ into a quantum algorithm $Q^{\prime}$ that uses the same number of queries, and solves all $k$ copies of $f$ with non-negligible probability; we then apply the direct product theorem (Theorem 16) to lower bound the number of queries required by $Q^{\prime}$, and hence by $Q$.

Given $k$ inputs to $f$, the first thing the algorithm $Q^{\prime}$ does is append an all-[math] array to turn it into an input to $\textsc{UInd}_{k}\circ_{k}f$. (Since the array is all zeros, the new input does not satisfy the promise of $\textsc{UInd}_{k}\circ_{k}f$, but we will still be able to run $Q$ on it.) Then $Q^{\prime}$ picks a random number $t$ between $1$ and $T$ uniformly, where $T=\operatorname{QD}(\textsc{UInd}_{k}\circ_{k}f)$ is the number of queries used by $Q$, and simulates $Q$ for $t$ queries. The algorithm $Q^{\prime}$ then measures the state of $Q$ to determine the position at which $Q$ was going to query. If this position is in the array part of the input and is inside a pair that has index $i\in\{0,1\}^{k}$, the algorithm $Q^{\prime}$ will then output the string $i$.

Consider the correct pair in the array (the one really pointed to by the $k$ copies of $f$). Flipping the pair from $00$ to $01$ causes the input to satisfy the promise of $\textsc{UInd}_{k}\circ_{k}f$, and causes the output to become a [math]-input. On the other hand, flipping the pair from $00$ to $11$ causes the input to become a $1$-input. Let $|\psi\rangle$ be the final state of $Q$ when run on the original, illegal input. Let $|\psi_{0}\rangle$ be the final state of $Q$ when run on the flipped [math]-input, and let $|\psi_{1}\rangle$ be the final state of $Q$ when run on the $1$-input. We know that $|\psi_{0}\rangle$ and $|\psi_{1}\rangle$ are far in trace distance. Hence $|\psi\rangle$ must be a far in trace distance from at least one on them.

Thus by Lemma 12, the probability that $Q^{\prime}$ finds $Q$ querying inside the correct pair of the array is $\Omega(1/T^{2})$. This means that $Q^{\prime}$ outputs the correct string of answers to the $k$ inputs to $f$ is with probability at least $\Omega(1/T^{2})$. Since $Q^{\prime}$ uses only $T$ queries, by Theorem 16 we must have either $T=\Omega(k\operatorname{Q}(f))$ or $1/T^{2}=O((5/6)^{k})$. The latter implies $T=\Omega((6/5)^{k/2})=\Omega((6/5)^{k/4}\cdot(6/5)^{k/4})=2^{\Omega(k)}\cdot 2^{\Omega(k)}$. When $k\geq c\log\operatorname{Q}(f)$ for a large enough constant $c$, this gives $T\geq 2^{\Omega(k)}\operatorname{Q}(f)=\Omega(k\operatorname{Q}(f))$. Recalling that $T=\operatorname{QD}(\textsc{UInd}_{k}\circ_{k}f)$, we get $\operatorname{QD}(\textsc{Ind}_{k}\circ_{k}f)=\Omega(k\operatorname{Q}(f))$, as desired. ∎

6.3 Separations

Using this theorem we can now establish Theorem 3, restated for convenience:

See 3

Proof.

There exists an $n$-bit total function $f^{\prime}$ with a quadratic separation between quantum query complexity and the adversary bound, i.e., $\operatorname{Q}(f^{\prime})=\widetilde{\Omega}(\operatorname{Adv}(f^{\prime})^{2})$. The function is $k$-sum with $k\approx\log n$ (see [BS13, ABK16] for more details). Now consider the function $f=\textsc{Ind}_{k}\circ f^{\prime}$, where $k=\Omega(\log\operatorname{Q}(f))$. By Theorem 17, the $\operatorname{QD}$ of these functions increases to $\operatorname{Q}$. However, since the adversary bound satisfies a composition theorem [HLŠ07], its value only increases by a factor of $k$. Thus $\operatorname{QD}(f)=\widetilde{\Omega}(\operatorname{Adv}(f)^{2})$.

Similarly, if we start with the collision problem which has $\operatorname{Q}(h^{\prime})=\Theta(n^{1/3})$ [AS04], but $\operatorname{Adv}(h^{\prime})=O(1)$, and define $h=\textsc{Ind}_{k}\circ h^{\prime}$ for $k=\Theta(\log n)$, then $\operatorname{QD}(h)=\widetilde{\Omega}(n^{1/3})$ but $\operatorname{Adv}(f)=O(\log n)$.

There also exist total functions with $\operatorname{Q}(g^{\prime})\geq\operatorname{\widetilde{\deg}}(g^{\prime})^{4-o(1)}$ [ABK16]. Composing this function with $\textsc{Ind}_{k}$ on the first $k$ bits with $k=\Omega(\log\operatorname{Q}(f))$ yields a function $g$ with the desired separation, since approximate polynomial degree also composes in the upper bound direction [She12]. ∎

7 Lifting theorems

7.1 Background

Lifting theorems are results that relate communication complexity measures to query complexity measures. For a fixed query measure, such as $\operatorname{D}(f)$, and a communication complexity measure that intuitively corresponds to it, such as deterministic communication complexity $\operatorname{D}^{\mathrm{cc}}(F)$, we may hope to be able to prove a theorem of the form: there exists some communication gadget $G$ such that $\operatorname{D}^{\mathrm{cc}}(f\circ G)=\widetilde{\Theta}(\operatorname{D}(f))$. In fact, when the size of the gadget $G$ is allowed to depend on the input size of $f$ and the $\widetilde{\Theta}$ is allowed to hide $\operatorname{polylog}n$ factors, such a result is known [GPW15].

We remark that the upper bound direction—showing the communication measure of $f\circ G$ is at most the corresponding query measure of $f$—is usually easy. We can simulate the query algorithm in the communication complexity world, losing only a multiplicative factor that depends on the difficulty of computing $G$. The lower bound direction, which lower bounds a communication complexity measure by a query complexity measure, is usually much harder, and is what we will usually refer to when we use the term “lifting theorem.”

The result of [GPW15] gives a lifting theorem for deterministic protocols, which we will denote by $\operatorname{D}\to\operatorname{D}^{\mathrm{cc}}$ to mean it transfers a lower bound on the first measure to a lower bound on the second. Recently, lifting theorems have been shown for $\operatorname{R}$ and $\operatorname{R}_{0}$ (with the corresponding communication complexity measures being the obvious ones: randomized communication with bounded error and randomized communication with zero error, denoted $\operatorname{R}^{\mathrm{cc}}$ and $\operatorname{R}_{0}^{\mathrm{cc}}$) [GPW17]. We do not know how to lift $\operatorname{Q}$ or $\operatorname{Q}_{0}$ to their analogous communication measures; this is likely to be significantly harder.

7.2 Lifting theorem reductions

In this section, we prove several lifting theorem reductions, showing that a lifting theorem for one measure (such as $\operatorname{Q}_{0}$) implies a lifting theorem for another measure (such as $\operatorname{Q}$). Our work (including prior work [BK16]) is the first instance we know of where such reductions are shown; it is perhaps surprising that these reductions can be proven without proving the lifting theorems themselves.

Theorem 18**.**

If there is a lifting theorem for $\operatorname{Q}_{0}$ with gadget $G$, then there is also a lifting theorem for $\operatorname{Q}$ with the same gadget $G$.

Proof.

Fix a partial function $f$. We wish to show that $\operatorname{Q}^{\mathrm{cc}}(f\circ G)=\widetilde{\Omega}(\operatorname{Q}(f))$ using a lifting theorem for $\operatorname{Q}_{0}$.

Let $g=\textsc{UInd}_{k}\circ_{k}f$, with $k=\Theta(\operatorname{Q}(f))$. By Theorem 17, we have $\operatorname{Q}(g)=\widetilde{\Omega}(\operatorname{Q}(f))$. Next, apply the lifting theorem to $g$ to get

[TABLE]

To complete the argument, it remains to show that $\operatorname{Q}_{0}^{\mathrm{cc}}(g\circ G))=\widetilde{O}(\operatorname{Q}^{\mathrm{cc}}(f\circ G))$. Note that $g\circ G=\textsc{UInd}_{k}\circ_{k}f\circ G$. If we have a communication protocol for $f\circ G$, we can simulate it $k$ times (and use error reduction) to obtain the correct index with constant error. We can then use the promise of UInd to check if the index is correct, by verifying that the second bit of the pair at that index is $1$. This turns the algorithm into a zero-error algorithm. Since $k=O(\log\operatorname{Q}(f))$, our algorithm uses only $\widetilde{O}(\operatorname{Q}^{\mathrm{cc}}(f\circ G))$ communication. Thus $\operatorname{Q}^{\mathrm{cc}}(f\circ G)=\widetilde{\Omega}(\operatorname{Q}(f))$, as desired. ∎

Theorem 19**.**

If there is a lifting theorem for $\operatorname{QSZK}$ with gadget $G$, then there is also a lifting theorem for $\operatorname{Q}$ with the same gadget $G$.

By a lifting theorem for $\operatorname{QSZK}$, we mean a theorem that lifts it to some communication complexity analogue $\operatorname{QSZK}^{\mathrm{cc}}$. The only property we use of $\operatorname{QSZK}^{\mathrm{cc}}$ is that it lower bounds $\operatorname{Q}^{\mathrm{cc}}$.

Proof.

Let $f$ be a partial function. Let $g=\textsc{Ind}_{k}\circ_{k}f$, where $k=\Theta(\log\operatorname{Q}(f))$. By Theorem 17, $\operatorname{QD}(g)=\widetilde{\Omega}(\operatorname{Q}(f))$. By Theorem 2, $\operatorname{QSZK}(g)=\Omega(\operatorname{QD}(g))=\widetilde{\Omega}(\operatorname{Q}(f))$. Then

[TABLE]

Also, note that if we had a quantum communication protocol for $f\circ G$ we could easily convert it to a communication protocol for $g\circ G=\textsc{Ind}_{k}\circ_{k}f\circ G$. Thus $\operatorname{Q}^{\mathrm{cc}}(f\circ G)=\widetilde{\Omega}(\operatorname{Q}^{\mathrm{cc}}(g\circ G)=\widetilde{\Omega}(\operatorname{Q}(f))$, as desired. ∎

Theorem 20**.**

If there is a lifting theorem that lifts $\operatorname{QD}\to\operatorname{Q}^{\mathrm{cc}}$ with gadget $G$, then there is also a lifting theorem for $\operatorname{Q}$ with the same gadget $G$.

By a lifting theorem for $\operatorname{QD}\to\operatorname{Q}^{\mathrm{cc}}$, we mean a theorem that shows $\operatorname{Q}^{\mathrm{cc}}(f\circ G)=\widetilde{\Omega}(\operatorname{QD}(f))$ for all partial functions $f$. This is formally easier to prove than a $\widetilde{\Omega}(\operatorname{Q}(f))$ lower bound, but we show it is actually equivalent.

Proof.

Let $f$ be a partial function. Let $g=\textsc{Ind}_{k}\circ_{k}f$, where $k=\Theta(\log\operatorname{Q}(f))$. By Theorem 17, $\operatorname{QD}(g)=\widetilde{\Omega}(\operatorname{Q}(f))$. Then

[TABLE]

Also, note that if we had a quantum communication protocol for $f\circ G$ we could easily convert it to a communication protocol for $g\circ G=\textsc{Ind}_{k}\circ_{k}f\circ G$. Thus $\operatorname{Q}^{\mathrm{cc}}(f\circ G)=\widetilde{\Omega}(\operatorname{Q}^{\mathrm{cc}}(g\circ G)=\widetilde{\Omega}(\operatorname{Q}(f))$, as desired. ∎

In summary, what we have shown is that a lifting theorem for $\operatorname{Q}$ is implied by a lifting theorem for either $\operatorname{Q}_{0}$, $\operatorname{QSZK}$, or a $\operatorname{QD}\to\operatorname{Q}^{\mathrm{cc}}$ lifting theorem. In fact, each of these statements also has a classical analogue which remains true. Proving a lifting theorem for $\operatorname{R}_{0}$, $\operatorname{SZK}$, or $\operatorname{RS}\to\operatorname{R}^{\mathrm{cc}}$ would imply a lifting theorem for $\operatorname{R}$. This can be proved analogously; the only property we need is that $\operatorname{RS}(\textsc{UInd}_{k}\circ_{k}f)=\widetilde{\Omega}(\operatorname{R}(f))$ when $k$ is at least polylogarithmic in $\operatorname{R}(f)$. An equivalent statement to this was proven in [BK16]. However, since lifting theorems for $\operatorname{R}$ and $\operatorname{R}_{0}$ are already known (with an index gadget [GPW17]), this reduction is less interesting in the classical case, though it might still be relevant for proving lifting theorems with other gadgets.

Acknowledgements

We thank Scott Aaronson, Mika Göös, John Watrous, and Ronald de Wolf for helpful conversations about this work.

Most of this work was performed while the first author was at the Massachusetts Institute of Technology and the University of Maryland and the second author was at the Massachusetts Institute of Technology. This work was partially supported by NSF grant CCF-1629809.

Appendix A Proof of the hybrid argument

In this section, we prove Lemma 12, restated below for convenience.

See 12

Proof.

We start by fixing some notation. Let the quantum query algorithm $Q$ act on $m$ qubits, initialized in the all-zeros state $|0^{m}\rangle$. A $T$-query algorithm is specified by $T+1$ unitaries $U_{0},U_{1},\ldots,U_{T}$ acting on $m$ qubits. For any input $x\in\{0,1\}^{n}$, the oracle $O_{x}$ acts as $O_{x}|i,b\rangle=|i,b\oplus x_{i}\rangle$ for all $i\in[n]$ and $b\in\{0,1\}$. The output state produced by this quantum algorithm (before measurement) on input $x$ is

[TABLE]

where $O_{x}$ is implicitly $O_{x}\otimes\mathbbold{1}$ if $O_{x}$ acts on fewer than $m$ qubits. Within the $m$ qubits, we further group the qubits into three registers, the first register holds an index $|i\rangle$, for $i\in[n]$, the second holds a qubit $|b\rangle$, for $b\in\{0,1\}$, and the third register contains all the remaining qubits.

For a quantum algorithm outputting a Boolean function, we assume that the first qubit of $|\psi_{x}\rangle$ is measured at the end to determine the output. A quantum distinguishing algorithm may trace out some qubits of $|\psi_{x}\rangle$ before producing an output or it may simply output the state $|\psi_{x}\rangle$ without loss of generality, since tracing out qubits cannot increase the distance between a pair of states.

In our case we have an algorithm $Q$ that accepts $x$ and rejects $x^{B}$ with high probability. To be more concrete, let us assume $Q$ has error probability $\epsilon$. As we saw in Proposition 6, such an algorithm can be made to output a mixed state $\rho_{x}$ such that ${\left\lVert\rho_{x}-\rho_{x^{B}}\right\rVert}_{\mathrm{tr}}\geq 1-2\epsilon$. Since trace distance is non-increasing under partial trace [NC00, Th. 9.2], we get that the pure output states must also be far, and hence ${\left\lVert|\psi_{x}\rangle\langle\psi_{x}|-|\psi_{x^{B}}\rangle\langle\psi_{x^{B}}|\right\rVert}_{\mathrm{tr}}\geq 1-2\epsilon$. This is all we need to assume about the output of the algorithm on these inputs.

We now consider the intermediate states produced by this quantum algorithm after $t$ queries to input $x$. Let

[TABLE]

for $t\in[T]$. The final state of the algorithm is $|\psi_{x}^{T}\rangle=|\psi_{x}\rangle$, and hence we have

[TABLE]

We know that the states are far apart in trace distance, but we also want to bound their closeness in $\ell_{2}$ distance. By (5), we have

[TABLE]

Then we have

[TABLE]

and so $\||\psi^{T}_{x}\rangle-|\psi^{T}_{x^{B}}\rangle\|\geq 1-2\epsilon$.

Hence the final states of the algorithm are far in apart in $\ell_{2}$ distance on inputs $x$ and $x^{B}$. We also know that the initial states $|\psi^{0}_{x}\rangle$ and $|\psi^{0}_{x^{B}}\rangle$ are identical. We keep track of how much this distance $d_{t}:=\||\psi^{t}_{x}\rangle-|\psi^{t}_{x^{B}}\rangle\|$ changes for $t\in\{0,1,\dots,T\}$. For each $t$, we have

[TABLE]

since $U_{t+1}$ is a unitary and preserves norms. This equals

[TABLE]

[TABLE]

Next, decompose $|\psi^{t}_{x}\rangle$ by the value of the query register. On basis vectors when the query register is not in $B$, the unitaries $O_{x}$ and $O_{x^{B}}$ behave the same; such vectors therefore get mapped to zero. If $|\psi_{t}^{x,B}\rangle$ denotes the component of $|\psi^{t}_{x}\rangle$ whose query register is in $B$, we get

[TABLE]

[TABLE]

where the last equality follows from the definition of $m_{i}^{t+1}$, which is defined to be the probability that the algorithm is found to be querying position $i$ right before making query $t+1$. The increase from $d_{t}$ to $d_{t+1}$ is therefore upper bounded by $2\sqrt{\sum_{i\in B}m_{i}^{t+1}}$, so we have

[TABLE]

Using the Cauchy–-Schwarz inequality on the outer sum gives

[TABLE]

or

[TABLE]

when $\epsilon$ is a constant.333This can be slightly improved to $(1-2\sqrt{\epsilon(1-\epsilon)})/2T$ by not using the approximation in (27). ∎