One of the most basic problems in computer science is unstructured search. This problem can be formalised as follows: boxed-text

It is easy to see that, with no prior information about f, any classical algorithm, which solves the unstructured search problem with certainty must evaluate f N=2n times in the worst case. Even if we seek a randomised algorithm which succeeds, say, with probability 1/2 in the worst case, then the number of evaluations required is of order N. However, remarkably, there is a quantum algorithm due to Grover,18 which solves this problem using O ( N ) evaluations of f in the worst case (Grover’s original algorithm solved the special case where the solution is unique; the extension to multiple solutions came slightly later.19). The algorithm is bounded error; that is, it fails with probability ϵ, for arbitrarily small (but fixed) ϵ>0. Although f may have some kind of internal structure, Grover’s algorithm does not use this at all; we say that f is used as an oracle or black box in the algorithm.

Grover’s algorithm can immediately be applied to any problem in the complexity class NP. This class encapsulates decision problems whose solutions can be checked efficiently, in the following sense: there exists an efficient classical checking algorithm A such that, for any instance of the problem where the answer should be ‘yes’, there is a certificate that can be input to A such that A accepts the certificate. In other words, a certificate is a proof that the answer is ‘yes’, which can be checked by A. On the other hand, for any instance where the answer should be ‘no’, there should be no certificate that can make A accept it. The class NP encompasses many important problems involving optimisation and constraint satisfaction.

Given a problem in NP that has a certificate of length m, by applying Grover’s algorithm to A and searching over all possible certificates, we obtain an algorithm which uses time O(2m/2poly(m)), rather than the O(2mpoly(m)) used by classical exhaustive search over all certificates. This (nearly) quadratic speedup is less marked than the super-polynomial speedup achieved by Shor’s algorithm, but can still be rather substantial. Indeed, if the quantum computer runs at approximately the same clock speed as the classical computer, then this implies that problem instances of approximately twice the size can be solved in a comparable amount of time.

As a prototypical example of this, consider the fundamental NP-complete circuit satisfiability problem (Circuit SAT), which is illustrated in Figure 1. An instance of this problem is a description of an electronic circuit comprising AND, OR and NOT gates which takes n bits as input and produces 1 bit of output. The task is to determine whether there exists an input to the circuit such that the output is 1. Algorithms for Circuit SAT can be used to solve a plethora of problems related to electronic circuits; examples include design automation, circuit equivalence and model checking.20 The best classical algorithms known for Circuit SAT run in worst-case time of order 2n for n input variables, i.e., not significantly faster than exhaustive search.21 By applying Grover’s algorithm to the function f(x) which evaluates the circuit on input x∈{0, 1}n, we immediately obtain a runtime of O(2n/2poly(n)), where the poly(n) comes from the time taken to evaluate the circuit on a given input.

Figure 1 An instance of the Circuit SAT problem. The answer should be ‘yes’ as there exists an input to the circuit such that the output is 1. Full size image

Amplitude amplification

Grover’s algorithm speeds up the naive classical algorithm for unstructured search. Quantum algorithms can also accelerate more complicated classical algorithms. boxed-text

One way to solve the heuristic search problem classically is simply to repeatedly run A and check the output each time using f, which would result in an average of O(1/ϵ) evaluations of f. However, a quantum algorithm due to Brassard, Høyer, Mosca and Tapp22 can find w such that f(w)=1 with only O (1/ ε ) uses of f, and failure probability arbitrarily close to 0, thus achieving a quadratic speedup. This algorithm is known as amplitude amplification, by analogy with classical probability amplification.

The unstructured search problem discussed above fits into this framework, by simply taking A to be the algorithm, which outputs a uniformly random n-bit string. Further, if there are k inputs w∈{0, 1}n such that f(w)=1, then

Pr [ A outputs w such that f ( w ) = 1 ] = k N ,

so we can find a w such that f(w)=1 with O ( N / k ) queries to f. However, we could imagine A being a more complicated algorithm or heuristic targeted at a particular problem we would like to solve. For example, one of the most efficient classical algorithms known for the fundamental NP-complete constraint satisfaction problem 3-SAT is randomised and runs in time O((4/3)npoly(n)).23 Amplitude amplification can be applied to this algorithm to obtain a quantum algorithm with runtime O((4/3)n/2poly(n)), illustrating that quantum computers can speedup non-trivial classical algorithms for NP-complete problems.

An interesting future direction for quantum algorithms is finding accurate approximate solutions to optimisation problems. Recent work of Farhi, Goldstone and Gutmann24 gave the first quantum algorithm for a combinatorial task (simultaneously satisfying many linear equations of a certain form) which outperformed the best efficient classical algorithm known in terms of accuracy; in this case, measured by the fraction of equations satisfied. This inspired a more efficient classical algorithm for the same problem,25 leaving the question open of whether quantum algorithms for optimisation problems can substantially outperform the accuracy of their classical counterparts.

Box 2: Heuristic search problem Given the ability to execute a probabilistic ‘guessing’ algorithm Α, and a ‘checking’ function f, such that Pr[Α outputs w such that f(w) = 1] = ε, output w such that f(w) = 1.

Applications of Grover’s algorithm and amplitude amplification

Grover’s algorithm and amplitude amplification are powerful subroutines, which can be used as part of more complicated quantum algorithms, allowing quantum speedups to be obtained for many other problems. We list just a few of these speedups here.

1 Finding the minimum of an unsorted list of N integers (equivalently, finding the minimum of an arbitrary and initially unknown function f:{0,1}n→ℤ). A quantum algorithm due to Dürr and Høyer26 solves this problem with O ( N ) evaluations of f, giving a quadratic speedup over classical algorithms. Their algorithm is based on applying Grover’s algorithm to a function g:{0, 1}n→{0, 1} defined by g(x)=1, if and only if f(x)<T for some threshold T. This threshold is initially random, and then updated as inputs x are found such that f(x) is below the threshold. 2 Determining graph connectivity. To determine whether a graph on N vertices is connected requires time of order N2 classically in the worst case. Dürr, Heiligman, Høyer and Mhalla27 give a quantum algorithm which solves this problem in time O(N3/2), up to logarithmic factors, as well as efficient algorithms for some other graph-theoretic problems (strong connectivity, minimum spanning tree, shortest paths). 3 Pattern matching, a fundamental problem in text processing and bioinformatics. Here the task is to find a given pattern P of length M within a text T of length N, where the pattern and the text are strings over some alphabet. Ramesh and Vinay have given a quantum algorithm28 which solves this problem in time O ( N + M ) , up to logarithmic factors, as compared with the best possible classical complexity O(N+M). These are both worst-case time bounds, but one could also consider an average-case setting where the text and pattern are both picked at random. Here the quantum speedup is more pronounced: there is a quantum algorithm which combines amplitude amplification with ideas from the dihedral hidden subgroup problem and runs in time O ( N / M 2 O ( log M ) ) up to logarithmic factors, as compared with the best possible classical runtime O ( N / M + N ) .29 This is a super-polynomial speedup when M is large.

Adiabatic optimisation

An alternative approach to quantum combinatorial optimisation is provided by the quantum adiabatic algorithm.30 The adiabatic algorithm can be applied to any constraint satisfaction problem (CSP) where we are given a sequence of constraints applied to some input bits, and are asked to output an assignment to the input bits, which maximises the number of satisfied constraints. Many such problems are NP-complete and of significant practical interest. The basic idea behind the algorithm is physically motivated, and based around a correspondence between CSPs and physical systems. We start with a quantum state that is the uniform superposition over all possible solutions to the CSP. This is the ground (lowest energy) state of a Hamiltonian that can be prepared easily. This Hamiltonian is then gradually modified to give a new Hamiltonian whose ground state encodes the solution maximising the number of satisfied constraints. The quantum adiabatic theorem guarantees that if this process is carried out slowly enough, the system will remain in its ground-state throughout; in particular, the final state gives an optimal solution to the CSP. The key phrase here is ‘slowly enough’; for some instances of CSPs on n bits, the time required for this evolution might be exponential in n.

Unlike the algorithms described in the rest of this survey, the adiabatic algorithm lacks general, rigorous worst-case upper bounds on its runtime. Although numerical experiments can be carried out to evaluate its performance on small instances,31 this rapidly becomes infeasible for larger problems. One can construct problem instances on which the standard adiabatic algorithm provably takes exponential time;32,33 however, changing the algorithm can evade some of these arguments.34,35

The adiabatic algorithm can be implemented on a universal quantum computer. However, it also lends itself to direct implementation on a physical system whose Hamiltonian can be varied smoothly between the desired initial and final Hamiltonians. The most prominent exponent of this approach is the company D-Wave Systems, which has built large machines designed to implement this algorithm,36 with the most recent such machine (‘D-Wave 2X’) announced as having up to 1,152 qubits. For certain instances of CSPs, these machines have been demonstrated to outperform classical solvers running on a standard computer,37,38 although the speedup (or otherwise) seems to have a rather subtle dependence on the problem instance, classical solver compared, and measure of comparison.38,39

As well as the theoretical challenges to the adiabatic algorithm mentioned above, there are also some significant practical challenges faced by the D-Wave system. In particular, these machines do not remain in their ground state throughout, but are in a thermal state above absolute zero. Because of this, the algorithm actually performed has some similarities to classical simulated annealing, and is hence known as ‘quantum annealing’. It is unclear at present whether a quantum speedup predicted for the adiabatic algorithm would persist in this setting.