Con-versely, element distinctness requires Ω(N log N ) comparisons in case of classical bounded-error algorithms (even in a much stronger model, see [81]), so sorting and element distinctness are equally hard for classical computers. On a quantum computer, the best known upper bound for sorting is roughly 0.53 N log N com-parisons [70] and it was recently shown that such a linear speed-up is the best possible: quantum sorting requires Ω(N log N ) comparisons, even if one allows a small probability of error [93]. Accordingly, our O(N3/4log N ) quantum upper bound shows that element distinctness is significantly easier than sorting for a quantum computer, in contrast to the classical case.
In Section 4.3, we consider the case where f is ordered (monotone non-decreasing): f (1) ≤ f(2) ≤ · · · ≤ f(N). In this case, the quantum complexity of claw-finding and collision finding drops from O(N3/4log N ) to O(N1/2log N ).
In Section 4.4 we show how to remove the log N factor (replacing it by a near-constant function) if both f and g are ordered. The lower bound for this restricted case remains Ω(N1/2). We then, in Section 4.5, give bounds for the number of edges a quantum computer needs to query in order to find a triangle in a given graph (which, informally, can be viewed as a collision between three nodes).
4.2 Finding Claws if f and g Are not Ordered
We consider the following problems:
Claw-finding problem
Given two functions f : X → Z and g : Y → Z, find a pair (x, y) ∈ X × Y such that f (x) = g(y).
Collision-finding problem
Given a function f : X → Z, find two distinct elements x, y ∈ X such that f (x) = f (y).
We assume that X = [N ] = {1, . . . , N} and Y = [M] = {1, . . . , M} with N ≤ M. We are interested in the number of comparisons required for claw-finding and collision-claw-finding. A comparison between f (x) and f (y) is formalized as an application of the following unitary transformation:
|x, y, bi → |x, y, b ⊕ [f(x) ≤ f(y)]i,
where b ∈ {0, 1} and [f(x) ≤ f(y)] denotes the truth-value of the statement
“f (x)≤ f(y)”. We formalize comparisons between f(x) and g(y) similarly.
First we consider the most general case, where f and g are arbitrary func-tions. Our claw-finding algorithms are instances of the following generic algo-rithm, which is parameterized by an integer ℓ≤ min{N,√
M}:
Algorithm Generic claw-finder
Apply amplitude amplification on steps 1–4:
1. Select a random subset A⊆ [N] of size ℓ 2. Select a random subset B ⊆ [M] of size ℓ2
3. Sort the elements in A according to their f -value
4. For a specific b∈ B, we can check if there is an a ∈ A such that (a, b) is a claw using classical binary search on the sorted version of A. Combine this with quantum search on the B-elements to search for a claw in A× B.
We analyze the comparison-complexity of this algorithm. Steps 1 and 2 do not use any queries. Step 3 just employs classical sorting and takes ℓ log ℓ + O(ℓ) comparisons. Step 4 takes O(p
|B| log |A|) = O(ℓ log ℓ) comparisons, since testing if there is an A-element colliding with a given b∈ B takes O(log A) comparisons (via binary search on the sorted A) and the quantum search needs O(p
|B|) such tests to find a B-element that collides with an element occurring in A, if there is such a B-element. In total, steps 1–4 take O(ℓ log ℓ) comparisons.
If no claws between f and g exist, then this algorithm does not terminate.
Now suppose there is a claw (x, y)∈ X ×Y . Then (x, y) ∈ A×B with probability (ℓ/N )· (ℓ2/M ), and if indeed (x, y)∈ A × B, then step 4 will find this (or some other) collision with probability at least 1/2 in at most O(ℓ log ℓ) comparisons.
Hence the overall success probability of steps 1–4 is at least p = ℓ3/2N M , and the overall amplitude amplification requires an expected number of O(p
N M/ℓ3) iterations of steps 1–4. Accordingly, the total expected number of comparisons to find a claw is O(q
N M
ℓ log ℓ), provided there is one. In order to minimize the num-ber of comparisons we maximize ℓ, subject to the constraint ℓ ≤ min{N,√
M}.
This gives upper bounds of O(N1/2M1/4log N ) comparisons if N ≤ M ≤ N2, and O(M1/2log N ) if M > N2.
What about lower bounds for the claw-finding problem? We can reduce the ORM-problem to claw-finding as follows. Given an input x ∈ {0, 1}M, we set N = 1 and define f (1) = 1 and g(i) = xi. Then there is a claw between f and g iff ORM(x) = 1. Thus, if we can find a claw using c comparisons, we can decide ORM using 2c queries to x, since two x-queries suffice to implement a comparison. Using the lower bounds QE(ORM) = M and Q2(ORM) ∈ Θ(√
M ) from Chapter 2, this gives an Ω(M ) bound for exact quantum claw-finding (nearly matching the classical deterministic O(M log N ) upper bound that comes from sorting the first list and then searching the second), and an Ω(√
M ) bound for bounded-error quantum claw-finding. We thus have established the following theorem:
4.2. Finding Claws if f and g Are not Ordered 71 4.2.1. Theorem (BDHHMSW [45]). The quantum comparison-complexity of the claw-finding problem is
• Ω(M1/2)≤ Q2(Claw)≤
½ O(N1/2M1/4log N ) if N ≤ M ≤ N2 O(M1/2log N ) if M > N2
• Ω(M) ≤ QE(Claw) ≤ O(M log N).
The bounds for the case M > N2 and the case of exact computation are tight up to the log N term, but the case M ≤ N2 is nowhere near tight. In particular, for N = M the complexity lies somewhere between N1/2 and N3/4log N .
Now consider the problem of finding a collision for an arbitrary function f : [N ] → Z, i.e., to find distinct x, y ∈ [N] such that f(x) = f(y). A sim-ple modification of the above algorithm for claw-finding works fine to find such (x, y)-pairs if they exist (put g = f and avoid claws of the form (x, x)), and gives a bounded-error algorithm that finds a collision using O(N3/4log N ) comparisons.
This algorithm may be viewed as a modification of the Generic claw finder with
|A| = ℓ ∈ O(√
N ) and B = [N ]\A. Note that now the choice of A determines B, so our algorithm only has to store A and sort it, which means that the space requirements of steps 1–4 are now only O(√
N log N ) qubits. The overall am-plitude amplification requires not more space than the algorithm that is being amplified, so the total space complexity of our algorithm is O(√
N log N ) as well.
The best known lower bounds follow again via reductions from the ORN-problem:
given x ∈ {0, 1}N, we define f : [N + 1] → {0, . . . , N} as f(i) = i(1 − xi) and f (N + 1) = 0. Now ORN(x) = 1 iff f contains a collision.
As mentioned in the introduction, the problem of deciding if there is a collision is equivalent to the element distinctness (ED) problem, so we have obtained the following bounds:
4.2.2. Theorem (BDHHMSW [45]). The quantum comparison-complexity of the element distinctness problem is
• Ω(N1/2)≤ Q2(ED)≤ O(N3/4log N )
• Ω(N) ≤ QE(ED)≤ O(N log N).
In contrast, for classical (exact or bounded-error) algorithms, element distinct-ness is as hard as sorting and requires Θ(N log N ) comparisons. The Ω(N1/2) lower bound on bounded-error quantum algorithms for element distinctness was improved recently to Ω(N1/2log N ) in [93].
Collision-finding requires fewer comparisons if we know that some value z ∈ Z occurs at least k times. If we pick a random subset S of cN/k elements of the domain, for c a small constant like 10, then with high probability (at least 1− 2−Ω(c)), S will contain at least two pre-images of z. Thus running our al-gorithm on S will find a collision with high probability, resulting in complex-ity O((N/k)3/4log(N/k)). Also, if f is a 2-to-1 function, we can rederive the
O(N1/3log N ) bound of Brassard, Høyer, and Tapp [36] by taking ℓ = N1/3. This yields constant success probability after steps 1–4 in the generic algorithm, and hence only O(1) rounds of amplitude amplification are required. As in the case of [36], this algorithm can be made exact by using the exact form of amplitude amplification (the success probability can be exactly computed in this case, so exact amplitude amplification is applicable).