appeared on the quant-ph archive in November 1998 in [46]). It has subsequently been improved by means of different proof techniques to (log N )/2 log log N [69], then to (log N )/12− O(1) [8], and then to (log N)/(π log e) − O(1) [93]. Thus at most a linear speed-up is possible over classical computers. Such a linear quantum speed-up is indeed possible: an upper bound of 0.53 log N can be achieved [70]
(see [93] for a slightly worse but more intuitive algorithm).
3.2 Tight Bounds for Unordered Search
To restate the unordered search problem: we have an N -element search space x = (x1, . . . , xN) that we can only access by means of queries. A query corresponds to the unitary transformation that maps |i, bi → |i, b ⊕ xii. The aim is to find an i such that xi = 1. Such an i is a called a solution. We assume the space contains (at least) t solutions, and use T (N, t, ε) to denote the minimal numbers of queries that a quantum algorithm needs in order to find a solution in this space with probability at least 1− ε.
In this section we prove tight bounds on T (N, t, ε). We first consider lower bounds on T (N, t, ε). The main idea is the following. It will be convenient for us to analyze the quantum complexity of the ORN-function under the promise that the number of solutions is either 0 or at least t. Clearly, searching for a solution is at least as hard as the ORN-function, so a lower bound for ORN gives a lower bound for search. By Lemma 2.4.1, the acceptance probability of a quantum computer with T queries that computes the ORN with error probability ≤ ε (under the promise that there are either 0 or at least t solutions) can be written as an N -variate multilinear polynomial P (x) of degree ≤ 2T . This polynomial has the properties that
P (~0) = 0
1− ε ≤ P (x) ≤ 1 whenever |x| ∈ [t, N]
Since we can always test whether we actually found a solution at the expense of one more query, we can assume the algorithm always gives the right answer ‘no solutions’ if the input contains only 0s, hence the property P (0) = 0. However, our results remain unaffected up to constant factors if we also allow a small error here (i.e., 0≤ P (0) ≤ ε).
By symmetrizing (Lemma 2.2.2), P can be reduced to a single-variate poly-nomial s of degree d≤ 2T with the following properties:
s(0) = 0
1− ε ≤ s(z) ≤ 1 for all integers z ∈ [t, N]
We will prove a lower bound on ε in terms of d, N , and t. Since d≤ 2T , this will imply a lower bound on ε in terms of T, N, t. Equivalently, it will imply a lower bound on T in terms of N, t, ε.
Our proof uses three results about polynomials. The first is by Coppersmith and Rivlin [58, p. 980] and gives a general bound for polynomials that are bounded by 1 at integer points:
3.2.1. Theorem (Coppersmith & Rivlin [58]). Every polynomial p of de-gree d that has absolute value
|p(z)| ≤ 1 for all integers z ∈ [0, n], satisfies
|p(z)| < aebd2/n for all real z∈ [0, n],
where a, b > 0 are universal constants. (No explicit values for a and b are given in [58].)
The second two tools concern the Chebyshev polynomials Td, defined as in [143]:
Td(z) = 1 2
µ³z +√
z2− 1´d
+³ z−√
z2− 1´d¶ .
Td has degree d and its absolute value |Td(z)| is bounded by 1 if z ∈ [−1, 1]. On the interval [1,∞), Td exceeds all others polynomials with those two properties ([143, p.108] and [136, Fact 2]):
3.2.2. Theorem. If q is a polynomial of degree d such that |q(z)| ≤ 1 for all z ∈ [−1, 1] then |q(z)| ≤ |Td(z)| for all z ≥ 1.
Paturi ([136, before Fact 2] and personal communication) proved 3.2.3. Lemma (Paturi [136]). Td(1 + µ)≤ e2d√
2µ+µ2 for all µ≥ 0.
Proof. For z = 1 + µ: Td(z) ≤ (z +√
z2 − 1)d = (1 + µ +p
2µ + µ2)d ≤ (1 + 2p
2µ + µ2)d≤ e2d√
2µ+µ2 (using that 1 + x≤ ex for all real x). 2
Now we can prove our lower bound on ε in terms of d (and N and t):
3.2.4. Theorem (BCWZ [43]). Let 1 ≤ t < N be an integer. Every polyno-mial s of degree d≤ N − t such that s(0) = 0 and 1 − ε ≤ s(z) ≤ 1 for all integers z ∈ [t, N] has
ε≥ 1
ae−(bd2/(N −t))−4d√
tN/(N −t)2, where a, b are as in Theorem 3.2.1.
3.2. Tight Bounds for Unordered Search 57 Proof. Every polynomial s satisfying s(0) = 0 and s(z) = 1 for all integers z ∈ [t, N] must have degree > N − t, because s(z) − 1 has at least N − t + 1 zeroes. Since the s in this theorem has degree d ≤ N − t, we have ε > 0 (and hence we can divide by ε later on). Consider the polynomial p(z) = 1− s(N − z).
It has degree d and
0≤ p(z) ≤ ε for all integers z ∈ [0, N − t]
p(N ) = 1
Applying Theorem 3.2.1 to p/ε (which is bounded by 1 at integer points z ∈ [0, N− t]) with n = N − t we obtain:
|p(z)| < εaebd2/(N −t) for all real z ∈ [0, N − t].
Now we rescale p to q(z) = p((z + 1)(N − t)/2) (i.e., the domain [0, N − t] is transformed to [−1, 1]), which has the following properties:
|q(z)| < εaebd2/(N −t) for all real z∈ [−1, 1]
q(1 + µ) = p(N ) = 1 for µ = 2t/(N − t).
Thus q is “small” on all z ∈ [−1, 1] and “large” at z = 1 + µ. Linking this with Theorem 3.2.2 and Lemma 3.2.3 we obtain
1 = q(1 + µ)
≤ εaebd2/(N −t)|Td(1 + µ)|
≤ εaebd2/(N −t)e2d√
2µ+µ2
= εaebd2/(N −t)+2d√
4t/(N −t)+4t2/(N −t)2
= εaebd2/(N −t)+4d√
tN/(N −t)2.
Rearranging gives the bound. 2
Note that if T > N−t then we can achieve ε = 0 by just checking an arbitrary set of T elements. Since there are t solutions, this set must contain at least one solution. Conversely, it follows from Proposition 2.6.5 that if T ≤ N − t, then we must have ε > 0. Since a T -query quantum search algorithm induces a degree-d polynomial s with the properties mentioned in Theorem 3.2.4 and d ≤ 2T , we obtain the following bound for quantum search under the promise:
3.2.5. Theorem (BCWZ [43]). Under the promise that the number of solu-tions is at least t, every quantum search algorithm that uses T ≤ N − t queries has error probability
ε∈ Ω³
e−(4bT2/(N −t))−8T√
tN/(N −t)2´ .
This theorem implies a lower bound on T in terms of N , t, and ε. To give a tight characterization of the relations between T , N , t and ε, we need the following upper bound on T for the case t = 1:
3.2.6. Theorem (BCWZ [43]). For every ε > 0 there exists a quantum search algorithm with error probability ≤ ε and O³p
N log(1/ε)´
queries.
Proof. Set t0 =⌈log(1/ε)⌉. Consider the following algorithm:
1. Apply the exact quantum search algorithm for the values t = 1, . . . , t0. One such application takes O(p
N/t) queries.
2. If no solution has been found, then apply t0 ordinary Grover searches, each with O(p
N/t0) queries.
3. Output a solution if one has been found, otherwise output ‘no solutions’.
The query complexity of this algorithm is bounded by
t0 with certainty in step 1. If the real number of solutions was > t0, then each of the searches in step 2 can be made to have error probability ≤ 1/2, so we have
total error probability at most (1/2)t0 ≤ ε. 2
The main theorem of this section tightly characterizes the various trade-offs between the size of the search space N , the promise t, the error probability ε, and the required number of queries (we need some mild conditions on t and ε to make it all work):
3.2.7. Theorem (BCWZ [43]). Let N > 0, 1 ≤ t ≤ 0.9N, ε ≥ 2−N. Let T = T (N, t, ε) be the optimal number of queries a quantum computer needs to search with error ≤ ε through an unordered N-element space that contains at least t solutions. Then
Proof. From Theorem 3.2.5 we obtain log(1/ε) ∈ O³
T2/N + Tp t/N´
. To prove a lower bound on log(1/ε) we distinguish two cases.
3.2. Tight Bounds for Unordered Search 59 Case 1: T ≥ √
tN . By Theorem 3.2.6, we can achieve error ≤ ε using Tu ∈ O(p
N log(1/ε)) queries. Now (leaving out some constant factors):
log(1/ε)≥ Tu2
tN . We can achieve error ≤ 1/2 by using ordinary Grover search with O(p
N/t) queries and then classically amplifying this to error ≤ ε using O(log(1/ε)) repetitions. This takes Tu ∈ O(p
N/t log(1/ε)) queries in total. Ignoring constant factors, the theorem can be written as
log(1/ε) = T2 N + T
r t N.
Viewing this as a quadratic equation in T , we can solve for T and obtain (still ignoring constant factors)
We note some interesting consequences of this general theorem:
• T (N, t, 1/2) ∈ Θ(p N/t) This was first proven in [30].
• T (N, 1, ε) ∈ Θ(p
N log(1/ε))
This is slightly better than classical amplification of Grover’s algorithm (which would take √
N log(1/ε) queries). It also implies that no quantum search algorithm with O(√
N ) queries can achieve ε∈ o(1).
• T (N, t, ε) ∈ Θ(p
N/t log(1/ε)) if t≫ log(1/ε)
This shows that if t is large relative to log(1/ε), then classical amplification is optimal. We will elaborate further on this in the next section.
• T (N, t, 2−N)∈ Θ(N)
If we want exponentially small error probability ε = 2−N, then we might as well run a classical algorithm that queries all N elements. This also justifies the restriction ε≥ 2−N of Theorem 3.2.7: if we want ε≤ 2−N then quantum search is not significantly faster than classical search.