Scott Aaronson ( University of Texas at Austin )

WHAT DID YOU EXPECT? COMPLEXITY THEORY Quantum Lower Bounds Via Laurent Polynomials NEW! ALGEBRAIC METHODS Scott Aaronson (University of Texas at Austin) with Robin Kothari, William Kretschmer, Justin Thaler

1 0 Polynomial Method for Quantum Lower Bounds (Beals et al. 1998)One of the greatest triumphs in the history of thought Suppose a quantum algorithm Q makes T queries to a Boolean input X=(x1,…,xN) Lemma: Then Pr[Q accepts X] can be written as a real multilinear polynomial in X, of degree at most 2T Meaning: We can lower-bound quantum query complexity by lower-bounding the degrees of real polynomials!

Application: Approximate Counting Given X{0,1}N, let S={i:xi=1} Fundamental Problem: Is |S|w or |S|(1+)w, promised that one of these is the case? Randomized query complexity: Quantum query complexity: Quantum Upper Bound (Brassard-Høyer-Tapp 1998): Grover + quantum phase estimation (or just Grover…) Quantum Lower Bound (Nayak-Wu 1998): Can be proven using the polynomial method

New Setting Suppose the quantum algorithm is also given copies of Models situations where S can be efficiently “QSampled” (Aharonov & Ta-Shma 2003) Then the lower bound from the last slide no longer holds! All the more so if the algorithm can also query an oracle that reflects about|S:

QMA Protocol for Approximate Counting? Given S[N], suppose we’re promised that either |S|w or |S|2w. Is there a short quantum witness | to prove |S|2w, which Arthur can check using few quantum membership queries to S? Good news: In the completeness case, | could be anything—not just |S Bad news: In the soundness case, | could also be anything! Easy to see: There’s no black-box QMA protocol to prove smallness of S. Merlin can always cheat and enlarge S! QMA protocol for largeness? Trickier question! E.g., if wpoly(n), the witness could just list many S elements

SBP vs. QMA SBP: Class of languages L for which there’s a polytime randomized algorithm that accepts w.p. 2 if xL, or w.p.  if xL (where =2-poly(n) is fixed in advance) Problem that had been open: Is there an oracle relative to which Quantum version of SBP SBP  QMA ? Known oracle separations:coNPSBQP(easy)AMPP(Vereshchagin 1992)SZKSBQP(A. 2010)SZKPP(Bouland et al 2016) SZK

Our Results Theorem: Given S[N], any quantum algorithm to decide whether |S|w or |S|2w, using T queries to S as well as R copies of / reflections about |S, requires either or I’ll discuss how to get a weaker bound, involving (w1/4) Theorem: Any QMA protocol to prove that |S|2w rather than |S|w, using T queries to S as well as an m-qubit witness, requires

“Laurent Polynomial Method” Our quantum lower bound incorporating copies of |S and reflections about |S, and our lower bound on QMA protocols, will both require generalizing the usual polynomial method to Laurent polynomials—although for different reasons in the two cases Degree 10 Antidegree 5

Key Lemma: Suppose a quantum algorithm gets R copies of |S and makes T queries to S. Let p(k) be its acceptance probability, averaged over all S[N] with |S|=k. Then p(k) is a Laurent polynomial in k, of degree  2T+R and antidegree  R. Proof Sketch: Initial state is Multiplies amplitudes by 1/|S|R/2, hence final probabilities by 1/|S|R Polynomials of degree R—which becomes R+T after queries, 2(R+T) after squaring  SYMMETRIZE! Reflections about |S are fine too!

Underlying Polynomial Question Suppose g,h univariate real polynomials Show: Either or

“Explosion Argument” Either g or h must have a large derivative somewhere. If it’s low-degree, that means it takes large values (Markov) But g(k)+h(1/k)[0,1] for all k[N]. So the other polynomial must take large values of the opposite sign! When switching from g to h, the x-axis gets compressed, so Markov’s inequality yields even larger values, etc. etc. 1 1 g(x) h(1/x) 0 0 1 w 2w N But polynomials that grow without bound, on a compact set like [1,N], can never have existed in the first place!

Tightening the (w1/4) to (w1/3) DUAL POLYNOMIALS

SBPQMA Attack Plan Difficulty: Essentially all known techniques for putting black-box problems outside QMA, also put them outside the larger class SBQP. But clearly no SBP problem can be outside SBQP! Key Idea of Thomas Watson:QMA is closed under intersection! So suppose SBP  QMA. Then for all L1,L2SBP, we’d also have L1L2 QMA  SBQP. Therefore, we just need to show that the AND of two black-box Approximate Counting instances is not in SBQP. This will contradict the assumption SBP  QMA.

Thus, consider an SBQP algorithm for two approximate counting instances, on S[N] and T[N]: Let p(S,T) be its acceptance probability. After “double symmetrization,” we get a bivariate real polynomial We can assume w.l.o.g. that p is symmetric in x and y, by taking

Underlying Polynomial Question N Lower-bound deg(p), where p is as shown on the left 2w w 0 0 w N 2w

Idea: Pass A Hyperbola Through! The Magic: is a special kind of Laurent polynomial —an ordinary polynomial in x+1/x—whose degree can be lower-bounded via the usual Markov’s inequality

Open Problems Nail down the dependence on ? Complexity with Queries+QSamples but not reflections? Lower-bound number of uses of a |0|S oracle? Is there a “real-world” (non-black-box) scenario where membership queries and QSampling are both easy, but approximate counting is hard? “Deep explanation” for why Laurent polynomials show up? Other applications of the Laurent polynomial method? Kretschmer, recently: Simpler proof of ~N lower bound on approximate degree of AND-OR tree!

Scott Aaronson ( University of Texas at Austin )