Quantum Computation (CMU 15-859BB, Fall 2015)

Lecture 4: Grover’s Algorithm

September 21, 2015
Lecturer: John Wright Scribe: Tom Tseng

1 Introduction
In the previous lecture, we discussed how a quantum state may be transferred via quantum
teleportation and how quantum mechanics is, in a sense, more powerful than classical me-
chanics in the CHSH game. Today, we are going to move on to discussing how we can apply
quantum mechanics to computer science. We will see our first example of a quantum algo-
rithm: Grover’s algorithm, described in a paper published by Lov Grover in 1996 [Gro96].
Much of the excitement over quantum computation comes from how quantum algorithms can
provide improvements over classical algorithms, and Grover’s algorithm exhibits a quadratic
speedup.

2 Grover’s algorithm
2.1 What it solves
Grover’s algorithm solves the problem of unstructured search.

Definition 2.1. In an unstructured search problem, given a set of N elements forming a set
X = {x1 , x2 , . . . , xN } and given a boolean function f : X → {0, 1}, the goal is to find an
element x∗ in X such that f (x∗ ) = 1.

Unstructured search is often alternatively formulated as a database search problem in

which we are given a database and we want to find an item that meets some specification.
For example, given a database of N names, we might want to find where your name is located
in the database.
The search is called “unstructured” because we are given no guarantees as to how the
database is ordered. If we were given a sorted database, for instance, then we could perform
binary search to find an element in logarithmic time. Instead, we have no prior knowl-
edge about the contents of the database. With classical circuits, we cannot do better than
performing a linear number of queries to find the target element.
Grover’s algorithm leads to the following theorem:
√
Theorem 2.2. The unstructured search problem can be solved in O( N ) queries using
quantum computation.

1
 In fact, this is within a constant factor of the best we can√do for this problem under the
quantum computation model, i.e. the query complexity is Θ( N ) [BBBV97]. In particular,
since we cannot solve the unstructured search problem in logarithmic time, this problem
cannot be used as a way to solve NP problems in polynomial time; if we did have a logarithmic
time algorithm, we could, given n variables arranged in clauses, solve the SAT problem
by searching all 2n possibilities in O(log(2n )) √= O(n) queries after a few manipulations.
Nonetheless, solving the search problem in Θ( N ) queries is still significantly better than
what we can do in the classical case. √
In addition, Grover’s algorithm uses only O( N log N ) gates. If we think of the number
of
√ gates as being roughly running time, then we have running time almost proportional to
N.
There is a caveat: the algorithm only gets the correct answer with high probability, say
with probability greater than 23 . Of course, we can then make the probability of correctness
an arbitrarily large constant. We do this by running the algorithm multiple times to get
many different outputs. Then we can run each of our inputs through f to see if any match
the criterion desired. This strategy only fails if all
moutputs fail, and since these are all
independent outputs, our probability of failure is 13 .
Note that even with classical algorithms that only need to output the correct answer
with two-thirds probability, we still need a linear number of queries. Therefore, this caveat
does not provide an unfair advantage to the quantum algorithm.

2.2 The classical case

We need some sort of model for how we are allowed to interact with our database. In a
classical algorithm, our medium of interaction is an oracle Of that implements a function f .
The function f encodes information about the element of interest, and we query the oracle
to fetch results from the function. Think of the oracle as a quantum circuit or a big gate.
This oracle, given an input of i, outputs f (i) in constant time. We do not care about the
details of how it works, and instead treat it as a black box.
i Of f (i)
As we do with any good algorithm, we want to limit resources used, which in this case are
running time and number of queries to the oracle. Of course, in any classical algorithm, the
best we can do is Θ(N ) queries and Θ(N ) running time – because the data is unstructured,
we cannot help but look at every element in the worst case no matter how cleverly we choose
our queries.
(Note that, in general, number of queries and running time are not the same, but in
this case they are both linear. We care more about queries because they are simpler to
reason about, plus they represent a lower bound to running time. Running time by itself
involves many other factors that we do not know much about. In this course, we will be
more concerned about number of queries as a measure of resources used.)
This is the end of the story in the classical situation; we have tight upper and lower
bounds, and not much more can be done. Now we shall switch to the quantum setting.

2
2.3 Modifications in the quantum case
Right off the bat, we’re going make some simplifications. First, we are going to assume that
the element x∗ that satisfies f (x∗ ) = 1 is unique. Second, we are going to assume the size of
our database is is a power of two, letting N = 2n where N is the size of the database. Lastly,
we are also going assume that the data is labeled as n-bit boolean strings in {0, 1}n rather
than being indexed from 1 to N . In turn, our boolean function f that we are studying will
map {0, 1}n to {0, 1}. These conditions will be more convenient for us, and we do not lose
much; the algorithm can be extended to relax the uniqueness assumption, we can always
add garbage entries to the database to make the size of the database a power of two, and
the naming of the elements is arbitrary.
Our interface with our database is not much different compared to the interface in the
classical case. We have an oracle Of that we give |xi, and it will output |f (x)i, as shown
below:
|xi Of |f (x)i
We immediately see a problem: this oracle gate is not a valid quantum gate. It takes an
n-bit input and gives a 1-bit output, and thus is not unitary or even reversible. There are a
couple of ways we can fix this.
Our first possible fix is to give the gate an extra bit |bi to use for the output. Call this
new gate the f flip gate.
|xi |xi
f flip
|bi |b ⊕ f (x)i
In particular, if we have |bi be an ancillary |0i qubit, it will end up as |f (x)i after passing
through the gate. However, this gate is somewhat unwieldy because we have to carry around
that extra qubit |bi with us. That brings us to our next fix.
Our second possible fix is to flip the input if and only if f (x) is 1. We will call the gate
that does this Of± . Given an input |xi, Of± will output
(
|xi if f (x) = 0
(−1)f (x) |xi =
− |xi if f (x) = 1.

The diagram of the gate is given below.

|xi Of± (−1)f (x) |xi

This avoids the annoyance of the extra bit that our first fix had.
These two gates are both valid versions of the oracle, and they are equivalent in the sense
that one can be constructed from the other. For example, we will prove that Of± may be
constructed using f flip .
Proof. Suppose we wanted to construct the Of± gate given access to the f flip gate. Then we
choose our ancillary bit that we send along with |xi into f flip to be |−i.

3
Before we hit the f flip gate, we have the state
1 1
|xi ⊕ |−i = |xi ⊗ √ (|0i − |1i) = √ (|x0i − |x1i).
2 2
After we pass the gate, there are two cases. If f (x) = 0, then the state is unchanged.
Otherwise, if f (x) = 1, then we end up with the state
1 1 1
|xi ⊗ √ (|0 ⊕ 1i − |1 ⊕ 1i) = |xi ⊗ √ (|1i − |0i) = √ (|x1i − |x0i)
2 2 2
which is the negative of the state we began with. Thus we have
|xi ⊗ |−i 7→ (−1)f (x) (|xi ⊗ |−i)
as desired to simulate the Of± gate.
Because the gates are equivalent, we may use either. For the circuits in this lecture, we
will use the Of± gate.

2.4 The algorithm

Recall that our goal is to, given the ability to query f using our oracle gate, find x∗ such that
f (x∗ ) = 1. We shall start by diagramming the entire circuit below and explain the details
following that.
|0i






|0i







n qubits .. Of± Of± ...
 . H ⊗n D D



|0i








|0i
√
×O( N ) times

We start with n qubits all initialized to |0i. Think of these as forming an n-bit string,
or an input to f . Let us make our goal concrete by saying that we would like the amplitude
of |x∗ i to be at least .1 in magnitude at the end of the circuit so that when we measure at
the end, we have a .12 = .01 probability of measuring |x∗ i.
What can we do with our quantum circuit that is not possible classically? We can
perhaps exploit superposition. We shall begin by transforming our input into the uniform
superposition
X 1
√ |xi .
x∈{0,1}n
N

4
The uniform amplitudes of all the n-bit strings, in a sense, represents our current complete
uncertainty as to what x∗ is.
We achieve this uniform superposition of all the basis states by sticking a Hadamard gate
on every wire, or equivalently a H ⊗n gate on all wires. This superposition trick is common
in quantum algorithms, so get used to it.
The current state can be visualized with a diagram representing amplitudes in a fashion
similar to a bar graph.
µ = mean of amplitudes
√1
N

... ... 0
{00 . . . 00} {00 . . . 01} x∗ {11 . . . 11}

Now we shall query this state by adding an oracle Of± gate. That flips the amplitude of
the x∗ component and leaves everything else unchanged, giving us a state of
1 X 1
− √ |x∗ i + √ |xi .
N x∈{0,1}n N
x6=x∗

Graphically, we now have

µ
∼ √1
N
x∗
... ...
{00 . . . 00} {00 . . . 01} {11 . . . 11}

What we want is to increase the amplitude of x∗ absolutely. This motivates the introduc-
tion of a new gate that performs what is called the Grover diffusion operator. What does
this gate do? First, we have to define a new number
1 X
µ= αx = average of αx for x ∈ {0, 1}n .
N x

where for αx is the amplitude of x for a given x in {0, 1}n . Our Grover diffusion gate is
defined to have the mapping
X X
αx |xi 7→ (2µ − αx ) |xi .
x∈{0,1} x∈{0,1}n

Note that this is a valid quantum gate; it is linear since all the operations in the mapping
are linear, and it is also unitary. We can show it is unitary by verifying that the operation
preserves the norm of the input. In addition, we will later construct the gate out of other
unitary gates.
O.K., what does this gate really do? It flips amplitudes around the average, µ. To
illustrate this, we will apply the gate, labeled D on the original circuit diagram, after the
oracle gate. Here is what our amplitudes look like after application:

5
 µ − αx∗
∼ √3
N
µ
∼ √1
N

... ...
{00 . . . 00} {00 . . . 01} x∗ µ − αx∗ {11 . . . 11}

The mean amplitude prior to applying the gate was

X 2n − 1 1 2n − 2 N 1
αx = √ −√ = √ ≈√ =√
x∈{0,1}n
N N N N N

i.e. √1N minus an insignificant amount. That means when the “reflection around the mean”
occurs with the application of the Grover diffusion operator, almost all the entries x ∈ {0, 1}n
stay roughly the same. But – and here is where the magic happens – the amplitude of x∗
gets magnified to about √3N in magnitude!
Still, this is quite far from our goal of making the amplitude of x∗ greater than a constant.
To make further progress, we can try the most brain-dead thing possible: apply the oracle
and the Grover diffusion gate again! After applying Of± for the second time, we have
µ
∼ √1
N
x∗
... ...
{00 . . . 00} {00 . . . 01} {11 . . . 11}

∼ √3
N

and after applying the Grover diffusion for the second time, we obtain

∼ √5
N

µ
∼ √1
N

... ...
{00 . . . 00} {00 . . . 01} x∗ {11 . . . 11}

6
 The computation to see that this is true is more or less the same. We flip x∗ to its
negative, and then flip it around the mean while everything else stays roughly unchanged.
The √ intuitive, high-level picture of what is happening is that αx∗ is going up by more
than 1/ N each time we repeat the application of the pair of gates Of± and D. With that
√
logic, after O( N ) steps, αx∗ should exceed the√constant .1 as desired.
Of course, αx∗ cannot actually increase by 1/ N at every step since the amplitude cannot
go above 1. The increase of αx∗ has to slow down or reverse at some point. For instance, if
αx∗ is sufficiently large, then when we flip αx∗ to negative by using the Of± gate, this large
negative value might actually drag the mean down to be negative. With a negative mean,
the magnitude of x∗ will decrease after using the Grover diffusion gate. In light of that, we
must be careful when we are analyzing this algorithm to make sure we never get that kind
of negative progress. However, so long as αx∗ is not too large, it seems we will always step
closer to our goal.

2.5 Analysis
We have constructed the circuit, and now it remains to formally show that the math behind
the circuit actually works out.
First, we will introduce some notation. Let α(t) be the amplitude of x∗ after the t-th
step, where one step consists of applying an Of± gate and then a Grover diffusion gate. Let
β (t) be the amplitude of any other x ∈ {0, 1}n after the t-th step. Finally, let µ(t) be the
mean of all the amplitudes, which is −α(t) + NN−1 β (t) , after the oracle gate on the t-th step.
For example, α(0) = β (0) = √1N . Also, if we know the values for a given step t, we can
calculate α(t+1) = 2µ(t) + α(t) and so forth.
Now that notation is defined, we can move on to the body of the proof. We first show
that α increases by a significant amount if α is not already too large.

Proposition 2.3. Suppose α(t) ≤ 1/2 and N ≥ 4. Then α(t+1) ≥ α(t) + √1 .

N

Proof. The sum of all the squares of the amplitudes is one, so

1 = (α(t) )2 + (N − 1)(β (t) )2

1
≤ + (N − 1)(β (t) )2 .
4
With some rearranging, we get a bound on β (t) of
s
3
β (t) ≥ .
4(N − 1)

7
Therefore,
−α(t) + (N − 1)β t
µ(t) =
N q
− 2 + (N − 1) 4(N3−1)
1

≥
N
q
3
1 (N − 1) N −1 − 1
=
2√ N
1 3N − 3 − 1
=
2 N
1 1
≥ √ given N ≥ 4.
2 N

Knowing this bound on µ(t) , we may calculate α(t+1) to be

1
α(t+1) = 2µ(t) + α(t) ≥ √ + α(t) ,
N
and the result is proven.
The next proposition tells us that the increases of α(t+1) are relatively controlled. This
is useful because it will be used to show that α(t) stays below one-half for a number of steps
so that the previous proposition may be applied.
Proposition 2.4. For any t, α(t+1) ≤ α(t) + √2 .
N

Proof. For any given step t, α(t) is positive, and therefore

−α(t) + (N − 1)β (t)
(t) N − 1 (t)
µ = ≤ β .
N N

2
We also know that (N − 1) β (t) ≤ 1, and so β (t) ≤ √N1−1 . This gives us

α(t+1) = 2µ(t) + α(t)

N − 1 (t)
≤2 β + α(t)
N
N −1 1
≤2 √ + α(t)
N N −1
√
N −1
=2 + α(t)
N
2
≤ √ + α(t) ,
N
which is the desired result.

8
 √
Now we can show that we get α > .1 with O( N ) steps. If N < 16, then α(t) = √1 ≥ .25,
√ N
so we are already done. Otherwise, if N ≥ 16, as long as t ≤ N /8 we get
2
α(t) ≤ α(0) + √ t
N
√
(0) 2 N
≤α +√
N 8
1 1
=√ +
N 4
1
≤
2
√
by Proposition 2.4. This means that we may apply Proposition 2.3 for N /8 steps to get
√
√ N 1 1
( N /8)
α ≥ √ = > .1,
8 N 8
√
and so we are indeed done with O( N ) steps.
Of course, with just this one pass through the circuit, our probability of measuring x∗ is
√ 2
only α( N /8) > .01. However, if we repeat the process a constant number of times, say
110 times, our probability of finding x∗ is

Pr[one output out of 110 being x∗ ] = 1 − Pr[output is not x∗ ]110

≥ 1 − .99110
2
≥
3
which is certainly a respectable probability.

2.6 Gate complexity

√
We also promised an O( N log N ) bound on the number of gates used in the algorithm. To
prove this bound, it suffices to construct the Grover diffusion gate. To do so, we will invent
yet another gate Z0 defined by
(
|xi if |xi = |0n i
Z0 |xi =
− |xi otherwise

In unitary matrix form, Z0 = 2 |0n i h0n | − I where I is the n × n identity matrix. We can
confirm that this matrix indeed implements Z0 by trying different inputs. If we give the
input |0n i, we get

Z0 |0n i = 2 |0n i h0n |0n i − |0n i = 2 |0n i 1 − |0n i = |0n i

9
as desired, and if we give some input |xi that has no 0n component, then we know that
h0n |xi = 0, so we get
Z0 |xi = 2 |0n i h0n |xi − |xi = − |xi
also as desired.
Now we can construct the Grover diffusion gate, D, with a Z0 gate and O(n) = O(log N )
Hadamard gates. In matrix form, knowing that the Hadamard gate is its own inverse, we
can write the diffusion gate as
D = H ⊗n Z0 H ⊗n
= H ⊗n (2 |0n i h0n | − I)H ⊗n

† 
= 2 (H |0i)⊗n (H |0i)⊗n − H ⊗n H ⊗n
= 2 |+n i h+n | − I.
It is the same as Z0 but with |+i instead of |0i. In diagram form, it is

|x1 i H H
|x2 i H H
Z0
.. H H
.
|xn i H H
P
Let us try giving the matrix an arbitrary input |ψi = x∈{0,1}n αx |xi to make sure it
works. We get
D |ψi = (2 |+n i h+n | − I) |ψi
= 2 |+n i h+n |ψi − |ψi .
Notice that we can rewrite h+n | to get
 ⊗n
n h0| + h1|
h+ | = √
2
X 1
= √ hx| ,
x∈{0,1}n
N

and therefore
X α
h+n |ψi = √ x hx|xi
x∈{0,1}n
N
X αx
= √
x∈{0,1}n
N
√
= µ N.

10
That means that we can continue simplifying D |ψi to get

D |ψi = 2 |+n i h+n |ψi − |ψi

√
= 2 |+n i µ N − |ψi
√
 
|0i + |1i
=2 √ µ N − |ψi
N
 
X 1 √
= 2 √ |xi µ N − |ψi
x∈{0,1}n
N
 
X
= 2 µ |xi − |ψi
x∈{0,1}n
X
= (2µ − αx ) |xi
x∈{0,1}n

which is precisely what we expect from the diffusion operator.

Lastly, we need to show that we actually can construct the Z0 gate. What does Z0 do?
It negates |xi if and only if the logical OR of {x1 , x2 , . . . , xn } is 1, where xi is the i-th qubit
that makes up |xi. These kinds of logical operations are easy to compute. In particular,
there is a classical circuit that computes the logical OR of n bits with O(n) = O(log N )
Toffoli or CNOT gates. This circuit is not reversible, but of course we may use the results
of problem 4 on homework 1 to fix that. Given a circuit C that computes the logical OR of
n bits, we can construct a circuit C 0 with m ∈ N ancillary bits that does the following:

|x1 i |x1 i
|x2 i |x2 i
.. ..
. .
|xn i |xn i
C0
|bi |b ⊕ OR(x1 , x2 , . . . , xn )i
|0i |0i
.. ..
. .
|0i |0i

Now if we send |xi ⊗ |−i ⊗ |0m i into C 0 , we get (−1)OR(x) (|xi ⊗ |−i ⊗ |0m i) out, which is
exactly what Z0 does. There are some extra gabrage bits, but those can be ignored.
Ultimately, what this all means is that the Grover diffusion√gate can be constructed with
O(log N ) gates. That means that Grover’s algorithm takes O( N log N ) gates to implement.

11
3 Conclusion
We now are closely familiar with Grover’s algorithm, one of the most famous quantum
algorithms at present. It demonstrates a provable polynomial improvement over its classical
counterpart by combining the quantum features of superposition and negative amplitudes to
solve the unstructured search√problem. In this lecture, we showed how to find a unique entry
x∗ from a database using O( N ) iterations, but, in general, if there are k entries thatpmatch
the desired criterion, then Grover’s algorithm can be extended to find an item in O( N/k)
iterations. Next lecture, we’ll discuss the quantum query model and learn about some other
algorithms that are based on querying the black-box implementation of a function.

References
[BBBV97] Charlies H. Bennett, Ethan Bernstein, Gilles Brassard, and Umesh Vazirani.
Strengths and weaknesses of quantum computing. SIAM Journal on Computing,
26(5):1510–1523, 1997.

[Gro96] Lov Grover. A fast quantum mechanical algorithm for database search. In Pro-
ceedings of 28th ACM Symposium on Theory of Computing, pages 212–219, 1996.

12