Quantum plug n’ play: modular computation in the quantum regime

Classical computation is modular. It exploits plug n’ play architectures which allow us to use pre-fabricated circuits without knowing their construction. This bestows advantages such as allowing parts of the computational process to be outsourced, and permitting individual circuit components to be exchanged and upgraded. Here, we introduce a formal framework to describe modularity in the quantum regime. We demonstrate a ‘no-go’ theorem, stipulating that it is not always possible to make use of quantum circuits without knowing their construction. This has significant consequences for quantum algorithms, forcing the circuit implementation of certain quantum algorithms to be rebuilt almost entirely from scratch after incremental changes in the problem—such as changing the number being factored in Shor’s algorithm. We develop a workaround capable of restoring modularity, and apply it to design a modular version of Shor’s algorithm that exhibits increased versatility and reduced complexity. In doing so we pave the way to a realistic framework whereby ‘quantum chips’ and remote servers can be invoked (or assembled) to implement various parts of a more complex quantum computation.

The solution of complicated computational problems is typically split into a sequence of subroutines that solve smaller problems.One can construct the desired solution without the necessity of understanding the detailed physical implementation of each individual component.This modularity is of particular importance in quantum computing, where quantum speedup often exploits our ability to encode unitary matrices U of exponential size-within polynomial sized quantum circuits [1,2].The execution of such circuits as subroutines allows us to efficiently compute some otherwise intractable functions of U .
Deterministic quantum computing with one qubit (DQC1), which efficiently evaluates the trace of an exponentially large unitary matrix U , presents an archetypical example [1,3].Whereas a classical algorithm is forced to access an exponentially large string of numbers, and thus requires exponential time, certain U can be represented with a polynomial sequence of elementary (one or two-qubit) quantum gates.In probing the properties of this circuit by applying it on a maximally mixed register conditioned on an ancillary qubit, one can determine the trace of U efficiently.Indeed, this strategy underpins several important quantum protocols [4][5][6][7], all of which estimate properties of a given quantum circuit by implementing it as a subroutine.
Naively, one may expect that these protocols function in a modular fashion-if an alien gives us an unknown device that implements U , we would still be able to such protocols by treating this device as a black box.Just as we call upon the built-in functions in Mathematica, we can make use of U without knowing anything about its physical implementation or circuit decomposition.This is useful computationally, since our procedure for computing the trace of U is independent of the physical details of U .Indeed, in many physical situations such as in Hamiltonian estimation [8], U could represent some unknown physical process; and be poorly understood.
Here, we prove that if it were generally possible to execute unknown quantum subroutines, then a fundamental physical principle would be violated.This precludes any protocol that invokes a black-box unitary U conditioned on a quantum mechanical state.The physical implementation of any such protocol, DQC1 included, must necessarily depend on the physical implementation of U .This calls into question whether it is still possible for quantum processors to offer any speed-up in computing certain properties of a black-box unitary.
We answer this question in presenting a black-box DQC1 protocol that efficiently evaluates |tr(U )|, even when U represents an unknown physical process; such that only its input-output relations are accessible.Thus, we introduce a class of protocols that demonstrate exponential speed-up on black-box inputs.We demonstrate that this modularity has immediate practical consequence.A polynomial sequence of black-box DQC1 protocols imparts full quantum factoring capability with efficiency comparable to existing quantum factoring algorithms [9][10][11].This enhanced factoring algorithm displays the many advantages of modularity, in both a quadratic reduction in the number of control gates required for implementation, and in reducing the extent to which quantum circuits need to be tailored to factor specific numbers.The general DQC1 protocol, however, no longer functions in situations where U is a black-box unitary, and represents the actions of a completely unknown physical process.In this scenario, no amount of repeated experiments should ever reveal to us any information about the global phase of U .Indeed, if any protocols existed that could differentiate two black box unitary transformations, U and e iφ U , that differ only by a global phase, it would violate one of the fundamental tenets of quantum theory: two unitary operations that differ only by a global phase represent the same physical process.Thus, any quantum algorithm whose output depends on the global phase φ cannot be implemented when supplied with a black-box unitary.Indeed, locality considerations indicate that the global phase is not stored within an unknown physical process, and thus cannot be measured (See Fig. 2).Note that this argument also applies when many copies of U are supplied.

Executing
Noting that the trace of U and e iφ U differ, we conclude that computing the trace of a black-box unitary is impossible.To see exactly where the standard DQC1 protocol fails, we note that DQC1 relies on adding a control to the unitary operator U .This procedure would automatically reveal information about the global phase, and is thus not implementable when U represents a completely unknown physical process.
Indeed, existing methods for adding controls to unknown physical processes depend crucially on extra knowledge that these processes act as the identity on some subspace of the input system [12,13].Such methods creatively exploit special properties in certain physical systems, such as linear optics, and thus require knowledge of the physical processes that underly U (See Meth- FIG. 2: Non-physicality of the Global Phase.One of the standard methods to observe the global phase of a unitary V is to implement Vc, i.e., control V with respect to some external degree of freedom (a).Suppose V = e iφ U for some fixed U .The control of V can be decomposed into a control on U , followed by a control of e iφ (b).However, the control of e iφ is actually mathematically equivalent to a local operation on the control qubit (c).We see that the controlled global phase is a physical property of the control, rather than the system being controlled.It is therefore impossible to extract the global phase information from a black-box unitary.
ods for an extended discussion).When such knowledge is unavailable, this is no longer possible; and we will need to abandon adding controls to unknown unitary transformations to restore modularity.
Black-Box DQC1.The modulus of the trace of a unitary contains no information about its global phase, and thus evaluation of |tr(U )| is not forbidden by the above constraints.We propose a black-box DQC1 protocol that performs this task in Fig. 3.In this protocol, we begin with a pure control qubit and two completely mixed registers of n qubits.The two registers are then coherently swapped, by controlling on the state of an ancillary qubit.While the usefulness of this operation appears highly paradoxical-swapping two completely mixed subsystems that look identical appears to achieve little-it is in fact the only interaction between control and register that we need.|Tr[U ]| can be evaluated by feeding one of the registers into the black box that implements U , together with controlled-swap operations.This protocol involves only a single pure qubit, and therefore falls within the DQC1 paradigm.The protocol is operationally equivalent to executing standard DQC1 to compute the trace of V = U † ⊗U (See Fig. 1

.a). Measurement of the control qubit thus estimates tr(
The black-box DQC1 protocol makes no sacrifices on efficiency; while it requires a doubling in the size of the maximally mixed register, this is counterbalanced by the need to only measure the control qubit in a single basis.Meanwhile, it features a notable advantage; in dropping the requirement for us to have any knowledge of U , blackbox DQC1 functions as a algorithm that truly treats U as an arbitrary input.The quantum circuit for the protocol does not need to be individually tailored to specific inputs; we can design an optimal implementation on the controlled-swap gates, and use the resulting design to probe the modulus of the trace of an arbitrary physical process.
The above results indicate that when we do not care about the global phase of U , modularity can sometimes be restored.One may speculate whether this sacrifice makes the protocol trivial; perhaps classical algorithms of comparable efficiency exist.Certain appeals to intuition appear compelling.The swap operation is Hermitian, and control Hermitian operators have been suspected to be classical within the DQC1 setting.They generate no quantum correlations, entanglement or discord [3,[14][15][16].Meanwhile, U is applied locally, without modification, on a maximally mixed register; and does not facilitate interactions between control and register at all.We will see however, that the same protocol can be applied to construct a modular variant of Shor's algorithm.
Modular Factoring with black-box DQC1.A polynomial sequence of black-box DQC1 circuits can factor efficiently.The core information required to factor can be encoded in the eigenspectrum of a specific Hamiltonian, H a .In general this energy eigenspectrum is of the form {j/r : a r ≡ 1 mod N, j = 0, . . ., r − 1}, while the ability to find r such that a r ≡ 1 mod N for some suitable a < N is sufficient to find a factor of N = pq.
These eigenvalues can be isolated by implementing a series of unitary operations, U 2 x a = exp (2 x 2πiH a ), for x = 0, 1, . . ., L − 1 ∈ O(log 2 N ) on a completely mixed register of n = log 2 N qubits, controlled on some ancillary qubit; followed by an inverse quantum Fourier transform (analogous to standard phase estimation protocols).The value of r can then be retrieved with high probability [11].
The black-box DQC1 architecture can be used instead of a control unitary operator, as the elementary building block of a factoring routine (See Fig. 4).The resulting algorithm recovers the differences between eigenvalues; in general these are also of the form k/r for k = 0, . . ., r − 1; for the purposes of factoring these differences contain the same amount of useful information as the spectrum itself.In Methods and Supplementary Materials, we prove our The black-box DQC1 circuit can be operationally interpreted by considering two boxes full of completely mixed qubits which are (a) swapped controlled on a single external pure qubit (This is formally a controlledswap gate, Sc, where S|φ |ψ = |ψ |φ is the swap gate that swaps the states of the two boxes, see supplementary materials for details).The black-box unitary U is then performed on the qubits in one of the boxes (b); this operation leaves the box completely mixed.A second controlled-swap is then performed followed by a measurement on the external control qubit (c).

construction succeeds in approximately
runs.This is comparable to Shor's algorithm which typically succeeds in O(log log r) runs.This results in a much more modular implementation of Shor's protocol.Conventional methods would require decomposing each unitary U 2 x a into a sequence of elementary quantum gates, and explicitly implementing individual controls on each gate.This would require O(n 3 ) controls per operator [17], and force a redesign of the circuit when factoring different numbers (as U a depends on N ).In contrast, in the black-box enhanced factoring algorithm, the number of controls can be significantly reduced -we need only O(n) controlled-swap gates, all of which can be reused regardless of which number we factor.This modularity may improve the feasibility of noncompiled quantum factoring protocols; making it possible to go beyond the current criticism that pre-existing compiled implementations use prior knowledge of the answer |0i h0| to simplify the computation [18].

DISCUSSION
In this article, we explored a general class of quantum protocols in which the input is not a quantum state, but rather a physical process that implements a unitary U .We demonstrated that when the only accessible information about the process is its black-box properties, any protocols that reveal the global phase of U will fail.This constraint effects many existing quantum protocols, including quantum phase estimation and DQC1; these algorithms would at best, need to be tailored to each specific unitary, and at worst, cease to function.This immediately motivates the question, whether these protocols can be modified, such that modularity is restored.
We addressed this question in proposing a black-box DQC1 protocol, designed to function even when U is supplied as an unknown physical process.In executing U purely as a subroutine, the protocol is able to evaluate |tr(U )| of an exponentially sized U , in polynomial time.A polynomial sequence of these protocols allows efficient factoring.This establishes that certain quantum algorithms do not require exact execution of a desired sub-routine to achieve its intended output.
The results presented are of both practical and foundational interest.In the theory of computation, the modularity of algorithms is a feature of great importance.Most complex algorithms consists of many different subroutines, and it is highly desirable if these algorithms can be constructed separately, and combined by a third party who needs not understand the exact code, circuit, or physical implementation of each individual component.Our results thus provide a no-go theorem that details when such modularity is impossible, and simultaneously presents a method to avoids this situation for certain computational problems.
Our method can be used to construct black-box variants of other quantum protocols whose input is encoded within a controlled unitary operator; candidates include quantum phase estimation, as well as quantum algorithms to solve linear systems, and simulate Jarzynski's equality [2,10,[19][20][21].In some scenarios, as was in DQC1, this extra modularity comes at the price of sacrificing some of the information such algorithms compute.In other's however, such as factoring, the information sacrificed may not be of any relevance, and thus modularity comes for free.
From a foundational viewpoint, the study of quantum computation has identified a number of classically trivial tasks whose quantum analogues are impossible [22][23][24].The observation that certain properties of U can never be computed from its black-box properties adds to this surprising list.This seems to mirror the Halting problem (and its generalization to Rice's theorem [25]) in computer science, which indicates that not all non-trivial black-box properties of an algorithm can be computed from its code.Here, quantum theory hints at a converse; not all properties of an algorithm's code can be computed from its black-box properties.

Control unitary transformations in special physical architectures.
There exist situations where partial information is available about a unitary U , such as what physical processes underly its synthesis.Here, U is not longer a black-box unitary, and this extra knowl-edge can help us construct algorithms that determine the global phase of U and/or add a control to U .
Let P denote a physical process that synthesizes an unknown U ∈ SU (d) that acts on input system S. S thus encodes a quantum state |φ spanned by |0 , . . ., |d − 1 , which transforms to U |φ under the action of P. Our no-go result states that With no prior knowledge of P, computing the global phase of U is impossible, and as a corollary, we cannot add a control to U .However, if we (i) can isolate an extra d degrees of freedom, |d , . . ., |2d − 1 in S, (ii) know that P leaves these degrees of freedom unchanged, i.e., P : |d + k → |d + k for all k = 0, . . ., d − 1.The action of P on the entire 2d degrees of freedom in S has the matrix representation where 1 1 d is an identity matrix of dimension d.We can define a 'virtual' qubit by relabeling |d * b + k as |k A |b B where b ∈ {0, 1}, then V coincides exactly with applying a unitary U to A controlled on B. This strategy relied on knowledge of both (i) and (ii) and thus U is not a blackbox.Formally, the phase of U is not a global phase, and our no-go result does not apply.Note that ancillary qubits do not help.If P acts only on a qudit system A, and we introduced an ancillary qubit B, then the action of P on this joint system is represented by the unitary U ⊗ 1 1, which does not equal U ⊕ 1 1.
However, certain physical architectures allow constructions that satisfy (i) and (ii).For example, let S be an optical mode and let P represent a sequence of linear optical gates that implements some U ∈ SU (2) on the polarization degree of freedom of S. Physics tells us that U does not affect the vacuum.Thus, the action of P is in fact, U controlled on whether a photon is present in the mode.This enables adding controls on an unknown U using photons traveling in a superposition of two different optical paths, one of which passes though P [12,13].Of course, such methods depend crucially on prior knowledge that P does not decohere the path degree of freedom, and fails if U is truly a black box; for example, when U is implemented by some third party, who chooses to encode output U |φ in a different physical system.Upon the completion of this work, we were notified of a complementary viewpoint of these experiments which was concurrently developed by Brukner et al [27].
Intuition behind Modular Factoring.To efficiently factor, it is sufficient to have an efficient algorithm that solves the order finding problem [9,10]: Given an input a ∈ N, 1 < a < N , output the first value of r such that a r ≡ 1 mod N .If a is chosen at random, the value of r will, with good probability, reveal the factors of N .
Quantum factoring algorithms function by noting the eigenvalues of a modular exponentiation operator encode the value of r.Since (U a ) r is the N -dimensional identity matrix.This last constraint forces the eigenvalues of this operator to be the r th roots of unity; these are complex numbers ω −j which carry information about r through ω = exp 2πi/r and j = 1, . . ., r − 1.If we can measure the phase of an eigenvalue for which j/r is an irreducible fraction then we can find r.
Due to the closure of the r th roots of unitary under multiplication the eigenvalues of U a ⊗ U † a are also r th roots of unity.Hence it is functionally equivalent to find the phase associated with an eigenvalue of V a = U a ⊗ U † a .Thus, noting that the black-box DQC1 protocol with input U a is equivalent to DQC1 with input V a , we may replace each control U a with its more modular variant with negligible loss in efficiency (See proof in Supplementary Materials).
Proof of Correctness.Firstly we characterize the modular exponentiation operator defined in Eq. (3).Every eigenvector of this N ⊗ N unitary operator can be expressed in terms of some natural number g d < N , as: where r d is an exponent satisfying g d * a r d ≡ g d mod N while the coefficients are defined through ω d = exp 2πi/r d and j d ∈ {0, . . ., r d −1}.The associated eigenvalue is ω j d d .Note that the case g d = 1 has r eigenvectors and associated eigenvalues of the form ω j = exp 2πij/r for j = 0, . . ., r − 1, while in general r d |r because a r ≡ 1 mod N .Furthermore whenever N = pq is coprime with g d the relation g d (a r d − 1) ≡ 1 mod N implies r d = r; these conditions are met by (p − 1)(q − 1) natural numbers less than N .Implying that at most p+q −1 possible values of g d correspond to eigenrelations for U a where the phase of ω d has denominator r d = r [11].
With respect to the eigenbasis |ψ j d we write the op-erator U a as where the first sum, indexed by d, runs over the set {g d } and the nested sum runs over j d = 0, . . ., r d − 1.
We now use this information to analyse the circuit in Fig. 4. We simplify the calculation by using the binary decimal expansion In this convention a measurement of the control register at the end of the circuit yields a number where the binary digit c i is 1 if the ith detector clicked and 0 otherwise, while the binary decimal c/2 L is the best estimate to some eigenvalue of U a ⊗ U † a .To achieve sufficient accuracy we require L = log 2 t ancillary qubits where t is the power of 2 satisfying N 2 ≤ t ≤ 2N 2 [11].
The probability of obtaining a specific binary number c when measuring the circuit in Figure 4 is: where We deliberately chose the number of control qubits so that our measurement c/t can resolve j d /r d − j d /r d to an accuracy sufficient for determining r: this implies their exists an eigenvalue for which our estimate has a bounded amount of error: Under these conditions we inherit a lower bound on |G| 2 ≥ 4t 2 /π 2 [11], see also [9] for a more detailed argument.
If we are going to be successful in retrieving any information about r from c/t then (a) we need j d /r d − j d /r d to have denominator r and (b) we need the numerator to be coprime with r.
In the next section we demonstrate that for every j d /r d satisfying r d = r and gcd(j d , r) = 1 there is a faction j d /r d − j d /r d satisfying both (a) and (b); by symmetry this argument should apply equally to j d /r d .Hence the number of eigenvalues j d /r d − j d /r d from which we can successfully determine r is: where χ = φ(r)(p−1)(q−1) r .And the probability our circuit succeeds (that is estimates a fraction with denominator r and numerator coprime with r) is For a direct comparison with Shor's result [9] we give the lower bound on the success probability: This scales as the same order in N as standard factoring algorithms [9,11]; in fact, asymptotically the probability of success using the black-box DQC1 protocol goes like P * (2−P ) where P is the probability of success for Parker and Plenio's factoring routine [11]; so to first order in P (which tends to 0 as N → ∞) we get a doubling in the success probability of the black-box DQC1 protocol over that of Parker and Plenio, which recovers the cost of the extra register qubits used in our construction.This section contains information required to derive Eq. (10).
Firstly fix the eigenvalue j d /r d and assume r d = r then where we have let r d = r/k d for some integer k d (which is always possible because r d divides r).Now for a fixed value of j d /r d there are r possible numerators in Eq. ( 13) corresponding to the possible values of j = 0, . . ., r − 1.We want to establish a one to one correspondence between values of j which are coprime with r and values of the numerator of Eq. ( 13) which are coprime with r (for a fixed j d /r d ).
Since we have fixed k d j d we know j −k d j d ≡ 0, . . ., r−1 mod r (i.e., when j = 0, . . ., r −1 so does j −k d j d mod r).
Additionally for any α, β ∈ Z we have: α + β * r is coprime with r if and only if α is coprime with r (this follows very quickly from the contrapositive).
It follows that for a fixed j d /r d ; if the conditions: (a) fraction has denominator r and (b) numerator is coprime with r, are satisfied by j d /r d then there is a corresponding value of j d /r d − j d /r d also satisfying (a) and (b).This argument is symmetric and can also be applied to j d /r d .
So the number of eigenvalues j d /r d − j d /r d which can not be used to determine r is the number of pairs (j d /r d , j d /r d ) for which is it impossible to determine r from either j d /r d , or j d /r d .Eq. ( 10) is simply the total number of eigenvalues of U a ⊗ U † a minus the number that can not be used to determine r.

EQUIVALENCE OF THE BLACK-BOX DQC1 SUBROUTINE TO A CONTROL UNITARY ON A COMPLETELY MIXED REGISTER
We characterize the resulting action of the black-box DQC1 protocol for the general case where the two reservoirs are initialized in arbitrary states ρ and σ.We compare this to the use of a control U ⊗ U † operation.We demonstrate equivalence when the case of the factoring protocol. Consider = ijk lmn α ijk β lmn |li, mj, nk =|φ ⊗ |ψ .
This furnishes a swap operator which interchanges two m qubit registers ρ and σ ρ ⊗ σ → Sρ ⊗ σS = σ ⊗ ρ. ( When the registers are initialized as two arbitrary m qubit states, ρ and σ, due to the relation U ⊗ 1 1 m ρ ⊗ σ S U † ⊗ 1 1 m S = U ρ ⊗ σ U † , the state of the black-box DQC1 circuit after the second swap in Figure 1 is When ρ and σ are eigenstates of U with eigenvalues e iλρ and e iλσ respectively then the final state of the circuit is By comparison the state of a circuit implementing a controlled-U ⊗ U † on two registers initialized as ρ and σ is: In general the final state of these circuits are the same when the registers are initialized as eigenstates of U : ρ ⊗ σ e i(λρ−λσ) ρ ⊗ σ e i(λσ−λρ) ρ ⊗ σ ρ ⊗ σ . ( Due to the linearity of quantum mechanics, the two circuits are equal for any input state that is an improper mixture of eigenstates of U , i.e; any density operator that is diagonal in the eigenbasis of U .This clearly includes complete mixed states, and all inputs during the operation of the modular factoring algorithm. In the most general case, the black-box DQC1 circuit as represented in Eq. ( 19) is formally equivalent to a pair of controlled unitary transformations as outlined in Fig. 5.
black-box subroutines.The evaluation of |tr(U )| can, of course, be systematically solved by DQC1 when one is given a physical decomposition of U in terms of elementary quantum gates.In this paradigm, one can implement U on a register of n completely mixed arXiv:1310.2927v5[quant-ph] 21 Nov 2013

FIG. 4 :
FIG. 4: We can factor with a polynomial number of copies of the black-box DQC1 protocol; explicitly for the inputs to the factoring circuit each copy of the black-box DQC1 subroutine will be function equivalently to a controlled-V x = U x ⊗ U x † .The remaining Hadamard and Rj gates are tantamount to a quantum Fourier transform modulo 2 L on the control qubit's state, where L ∈ O(log 2 N ).The operator Rj = |0 0| + |1 1| exp (−2πi k m j−k /2 k ) is applied to the control where m j−k = (1, 0) such that the value 1 is assigned if the (j − k) th detector clicked and 0 if it did not; the index k runs over the previous detectors.