Quantum outperforms classical Quantum computers are expected to be better at solving certain computational problems than classical computers. This expectation is based on (well-founded) conjectures in computational complexity theory, but rigorous comparisons between the capabilities of quantum and classical algorithms are difficult to perform. Bravyi et al. proved theoretically that whereas the number of “steps” needed by parallel quantum circuits to solve certain linear algebra problems was independent of the problem size, this number grew logarithmically with size for analogous classical circuits (see the Perspective by Montanaro). This so-called quantum advantage stems from the quantum correlations present in quantum circuits that cannot be reproduced in analogous classical circuits. Science, this issue p. 308; see also p. 289

Abstract Quantum effects can enhance information-processing capabilities and speed up the solution of certain computational problems. Whether a quantum advantage can be rigorously proven in some setting or demonstrated experimentally using near-term devices is the subject of active debate. We show that parallel quantum algorithms running in a constant time period are strictly more powerful than their classical counterparts; they are provably better at solving certain linear algebra problems associated with binary quadratic forms. Our work gives an unconditional proof of a computational quantum advantage and simultaneously pinpoints its origin: It is a consequence of quantum nonlocality. The proposed quantum algorithm is a suitable candidate for near-future experimental realizations, as it requires only constant-depth quantum circuits with nearest-neighbor gates on a two-dimensional grid of qubits (quantum bits).

Quantum nonlocality—the fact that measurements of multiple spatially separated quantum systems can yield certain classically nonlocal correlations—is a remarkable feature of quantum mechanics. Its understanding was revolutionized by Bell, who recognized that this phenomenon can be experimentally verified (1). His work also prompted a shift in our approach to quantum mechanical systems: Modern quantum information science seeks to exploit quantum phenomena such as nonlocality, entanglement, and the superposition principle to tackle information-processing tasks that are believed to be difficult or impossible to achieve by purely classical means.

The potential benefits resulting from the use of quantum resources in computation are challenging to quantify. A major difficulty is the fact that the computational hardness of a given task for a classical computing device is not easy to assess. The strongest evidence that quantum computers may be more powerful than classical computers is the existence of quantum algorithms, such as Shor’s efficient factoring algorithm (2), that achieve better performance than the best currently known classical algorithms for certain tasks. The appeal of Shor’s algorithm relies on the conjecture that factoring cannot be achieved in polynomial time on a classical computer. Other existing proposals for quantum speed-ups [see, e.g., (3)] similarly rely on complexity-theoretic conjectures and, as a result, the potential for quantum advantage disappears if these conjectures turn out to be false (4). To sidestep this issue, one can instead work within the framework of so-called query complexity, in which, in addition to a classical or quantum computer, we are also given black-box access to an “oracle” operation whose internal structure cannot be examined. The computational task is to determine some property of the oracle, using the smallest possible number of queries to the oracle. Notable examples of quantum speed-ups obtained in terms of query complexity include quantum algorithms for unstructured search (5), element distinctness (6), and formula evaluation (7). Unfortunately, a speed-up proved in the oracular setting might not translate into a real-world advantage because the internal structure of an oracle may help to solve the problem classically.

A more practical concern is the fact that most proposed quantum algorithms are beyond current experimental capabilities: Their implementation requires a fully functional quantum computer incorporating error correction. Although the overhead for encoding and manipulating quantum data fault-tolerantly is asymptotically small (8, 9), it remains prohibitive for current technology. Accordingly, it is expected that near-term quantum computers will lack error correction capabilities (10–12). A quantum computation without error correction can perform only a constant number of operations before the qubits decohere and the entropy builds up. This is evidenced by the impossibility of realizing passive quantum memories (amounting to the identity gate) when qubits experience independent noise with constant decoherence rate (13). This leads to an interesting trade-off between the number of qubits n and the depth d of quantum circuits that can be implemented on near-term hardware. Because the total number of operations is proportional to nd, quantum circuits with a large number of qubits that can potentially be hard to simulate classically are limited to a small depth.

This motivates the study of quantum parallel algorithms running in a constant time. These take as input a classical bit string, apply a constant-depth quantum circuit, and output a random bit string obtained by measuring each qubit in the 0,1 basis. By definition, a quantum circuit of depth d consists of d layers of one- and two-qubit gates, where gates within each layer act on disjoint sets of qubits. We assume that such disjoint gates can be applied in parallel. Constant-depth quantum circuits can therefore be implemented in a constant time, which is independent of the problem size or the number of qubits n. For brevity, we refer to such parallel constant-time quantum computations as shallow quantum circuits (SQCs).

Although SQCs constitute a highly restricted form of quantum computation, they are of central practical and theoretical importance. First, as discussed above, SQCs are among those forms of quantum computations most likely to be realized in the near future. Second, there are reasons to believe that SQCs may outperform classical circuits in certain tasks. The first evidence in this direction was provided in pioneering work (14) where it was argued that SQCs may be computationally hard to simulate classically. Quite recently, building on earlier studies of so-called instantaneous quantum polynomial-time circuits (15–17) and relying on complexity-theoretic assumptions, it was shown (18) that the output distribution of SQCs may be computationally hard to sample classically even if a constant statistical error is allowed [see also (19)]. Various models of computation closely related to SQCs have been studied (20–26).

Here, we compare the computational power of SQCs and their classical counterparts—that is, constant-depth classical (probabilistic) circuits. We present a simple linear algebra problem associated with binary quadratic forms that can be solved with certainty by a SQC composed of nearest-neighbor gates acting on a two-dimensional (2D) grid; this setup reflects near-term experimental abilities. At the same time, we prove that no constant-depth classical probabilistic circuit can solve the considered problem with a sufficiently small error probability for all instances. The classical circuit does not have to be geometrically local in any sense and may access random bits drawn from an arbitrary probability distribution that depends only on the input size. The only requirement is that all gates in the classical circuit must have bounded fan-in (i.e., each gate has a constant number of input wires). This result provides an unconditional separation between the power of constant-depth quantum and classical circuits.

The computational problem we use to establish the above separation can be viewed as a non-oracular variant of the well-known Bernstein-Vazirani problem (27). The latter involves a quantum oracle computing a linear function l: {0,1}n → {0,1} such that for some “hidden” bit string z ∈ {0,1}n. The oracle is a unitary operator that can evaluate l(x) on any superposition of inputs x. The task is to identify the hidden string z. As was shown in (27), the problem can be solved by a simple quantum algorithm making a single query to the oracle, whereas any classical algorithm with access to a classical oracle computing ℓ requires n queries to find z. To obtain a non-oracular variant of this problem, we ask: Where else—other than inside an oracle—can we hide a linear function?

We now explain how to hide a linear Boolean function inside a quadratic form. We consider quadratic forms q: {0,1}n → ℤ 4 = {0,1,2,3} defined as (1)where x = (x 1 , …, x n ) is a vector of n binary variables and A is a symmetric binary matrix; that is, A i , j = A j , i ∈ {0,1}. Evaluation of q(x) modulo 4 ensures that q(x) depends only on the value of input variables modulo 2. As a consequence, many properties of real-valued quadratic forms carry over to the binary case considered here. We are interested in the case when x lies in the binary null-space of A, (2)Here and below, we consider x as a column vector. We write xT for the transposed row vector. If x is a real vector and q(x) = xTAx is a real-valued quadratic form, then the restriction of q(x) onto the null-space of A is clearly zero because Ax = 0 implies q(x) = 0. In the binary case, this is no longer true. However, we will see that the restriction of q(x) onto the binary null-space of A is always a linear function. In other words, for any quadratic form q(x) as above, there exists a (generally not unique) vector z ∈ {0,1}n such that (3)[See (28) for the proof of Eq. 3.] Thus, one can say that the quadratic form q(x) hides a linear function l(x) = 2zTx(mod4), which is analogous to the hidden linear function in the Bernstein-Vazirani problem. However, in our case the form q(x) is explicitly specified by its matrix of coefficients A, so there is no need for the oracle.

We consider the following hidden linear function (HLF) problem: Given an n × n symmetric binary matrix A specifying a quadratic form q(x) = xTAx, which is evaluated modulo 4, find a binary vector z ∈ {0,1}n such that q(x) = 2zTx for all x in the binary null-space of A. [We note that any instance of the HLF problem (29) can be solved classically with O(n3) binary arithmetic operations by computing a basis of Ker(A) and evaluating q(x) on each basis vector x ∈ Ker(A).]

An instance of the HLF problem can be alternatively described by a graph G(A) with n vertices i = 1, …, n such that the off-diagonal part of A is the adjacency matrix of G(A) and the nonzero entries on the diagonal of A specify a subset of marked vertices. Thus, by definition, a pair of vertices i ≠ j is connected by an edge if A i , j = 1. We consider special instances of the HLF, where n = N2 for some integer N and G(A) is a subgraph of the square grid with N × N vertices. In other words, A i , j = 0 unless i and j are nearest-neighbor vertices of the grid or i = j. Such instances constitute what we call the 2D HLF problem. As far as we are aware, the best classical algorithm that solves the 2D HLF problem requires O(n2) arithmetic operations (30).

A quantum algorithm solving the 2D HLF problem is similar to the one considered by Bernstein and Vazirani (27). Suppose first that one has access to a quantum circuit U q acting on the basis states x ∈ {0,1}n as U q |x〉 = iq(x)|x〉. Consider a system of n qubits and a quantum state (4)where (5)is the Hadamard gate. It can be easily checked that destructive interference between different terms x in Eq. 4 results in a vanishing amplitude 〈z|Ψ q 〉 = 0 on basis states z that are not solutions of the HLF problem. Conversely, all solutions z appear in the state |Ψ q 〉 with nonzero amplitudes (28). Therefore, measuring each qubit of |Ψ q 〉 in the standard basis produces a random bit string z that is a solution of the HLF problem. The circuit U q can be decomposed into a product of controlled-Z gates CZ and phase-shift gates S defined as (6)Here, the subscripts i, j indicate qubits acted upon by the gate. Indeed, applying a CZ i , j gate for each pair of qubits such that A i , j = 1 and applying an S i gate for each qubit such that A i , i = 1 gives U q .

Let us consider the quantum resources required to implement the circuit U q . We place the ith qubit at the ith vertex of the graph G(A) embedded into a 2D grid. Then U q contains only nearest-neighbor CZ gates and single-qubit S gates.

One can decompose the CZ part of U q into four layers of CZ gates such that each layer is a depth-one circuit composed of pairwise disjoint CZ gates. This shows that U q is a constant-depth quantum circuit. The above algorithm can be easily converted into a SQC by adding ancillary qubits that store the input matrix A and replacing each gate of U q by its controlled version. We envision each input bit A i , j as being provided at the edge {i, j} and each bit A i , i at the vertex i of the 2D grid. Then each gate in the controlled version of U q acts on at most three qubits located on the same edge or the same vertex of the grid. Hence, the 2D HLF can be solved with certainty by a SQC with geometrically local gates on a 2D grid.

The above algorithm can be alternatively described as a sequence of single-qubit Pauli measurements performed on the graph state (31, 32) associated with the graph G(A). The latter is a quantum state of n qubits defined as (7)Here, a CZ gate is applied for every edge of the graph G(A). We claim that a solution z of the HLF problem can be obtained by preparing the graph state |Ψ G ( A ) 〉 and measuring each qubit i in either the X basis (if A i , i = 0) or the Y basis (if A i , i = 1). Indeed, a comparison of Eqs. 4 and 7 reveals that |Ψ q 〉 can be obtained from |Ψ G ( A ) 〉 by applying a gate S i to each qubit i with A i , i = 1 and applying a layer of n Hadamard gates. Furthermore, because the states Ψ q and Ψ q * (the complex conjugate of Ψ q ) give rise to the same measurement statistics in the Z basis, one can replace all gates S i by their complex conjugates S i * = S i 3. The above claim then follows from the identities ZH = HX and Z(HS3) = (HS3)Y.

To understand the difficulty of solving the 2D HLF problem using classical circuits, recall that such a circuit is specified by a directed acyclic graph in which each vertex is either an input (if it has in-degree 0), an output (if it has out-degree 0), or a gate. For each gate we must also specify a Boolean function {0,1}k → {0,1} that is computed by the gate, where k is the in-degree or “fan-in” of the gate. The output bit computed by a gate is copied to all outgoing edges of this gate. The out-degree or “fan-out” of a gate is the number of times the output of the gate is used in the remainder of the circuit. The depth d of a classical circuit is the maximum number of gates along a path from an input (variable) to an output. We are interested in circuits C with constant depth d = O(1) such that all gates have fan-in at most K = O(1).

The structure of such a circuit C imposes severe restrictions on the form of correlations present between the input (33) x ∈ {0,1}m and outputs z = F(x) ∈ {0,1}n, where F is the function computed by C. Let us say that the input bit (variable) x j is correlated with the output bit (variable) z k if and only if there is some y ∈ {0,1}m such that flipping the jth bit of y flips the kth bit of F(y). Then the function F computed by C is local in the sense that each output bit can only be correlated with a constant number of input bits. Indeed, defining the (“backward”) lightcone of the output bit z k as the set L C (z k ) of input variables x j correlated with z k , we have the obvious inequality (8)Similarly, we can argue [see claim 5 in (28)] that a constant fraction of input bits x j have a small (“forward”) lightcone L C (x j ). The latter is the set of output variables z k correlated with x j . We will see that locality restrictions of this kind ultimately prevent solution of the 2D HLF by constant-depth classical circuits.

To understand why, recall that correlations present in the measurement statistics of entangled quantum states exhibit quantum nonlocality. A famous illustration (34, 35) of this phenomenon is based on the three-qubit GHZ state . Let b ∈ {0,1}3 and consider the measurement outcomes z ∈ {0,1}3 obtained by measuring each qubit j of |GHZ〉 in either the X basis (if b j = 0) or the Y basis (if b j = 1). Then the measurement statistics satisfy (9)In contrast, it is well known (35) that Eq. 9 cannot be satisfied by a local hidden-variable model in which every output bit z j is a function only of the local measurement setting b j and some shared random string r, that is, z j = z j (b j , r). A local hidden-variable model can equivalently be viewed as a strictly local classical circuit in which every output bit depends only on one input bit (as well as the shared random string). Thus, rephrasing the GHZ example in terms of circuits, we conclude that a strictly local, possibly randomness-assisted classical circuit cannot solve the relational problem of producing a string z ∈ {0,1}3 satisfying Eq. 9 for any input b ∈ {0,1}3.

Our main technical contribution is a proof that this type of quantum nonlocality provides a relational problem that cannot be solved by general constant-depth classical circuits in the case when the GHZ state is replaced by the graph state defined in Eq. 7. To arrive at this result, we first consider 1D instances of the HLF problem and show that a constant-depth classical circuit with geometrically local gates cannot solve all such instances. We then use this result to show that a classical circuit that is “constant-depth local” (in the sense of having constant-size backward lightcones) cannot solve all instances of the 2D HLF problem.

Our starting point is an extension of the GHZ example described in (36). It shows that the statistics of single-qubit X and Y measurements performed on the graph state |Ψ Γ 〉 corresponding to a cycle graph Γ possess geometrically nonlocal correlations. In other words, certain measurement outcomes are correlated with measurement settings (i.e., choice of single-qubit measurement bases) that are far away with respect to the shortest path on the cycle. As a consequence, low-depth classical circuits that are geometrically local in one dimension cannot reproduce these statistics. Because the considered Pauli measurements are identical to those required to solve instances of the HLF problem on the cycle graph, we conclude that these instances cannot be solved by geometrically local constant-depth classical circuits.

In more detail, let Γ be a cycle graph of even length M and let Δ be the adjacency matrix of Γ. Suppose u, v, w are vertices of Γ such that all pairwise distances between them are even (Fig. 1). We define the distance dist Γ (j, k) between any two vertices j, k to be the number of edges in the shortest path between them in Γ. Given a string b = b u b v b w ∈ {0,1}3, we can write 0M–3b ∈ {0,1}M for the string that associates the bits b u , b v , b w to the vertices u, v, w and the value 0 to all other vertices. Let Δ b be a matrix obtained from Δ by placing the string 0M–3b on the main diagonal. This defines eight instances of the HLF problem on the cycle graph Γ with A = Δ b and b ∈ {0,1}3. Each instance has M output bits z 1 , …, z M . In (28) we show that any classical randomness-assisted circuit C that solves all eight instances Δ b with probability of at least ⅞ is geometrically nonlocal: The lightcone L C (b i ) of at least one of the input bits b i ∈ {b u , b v , b w } contains an output bit z q such that dist Γ (i,q) ≥ ½D Γ ({u, v, w}), where D Γ ({u, v, w}) is the minimum pairwise distance between two vertices in the set {u, v, w}. The proof of this intermediate result proceeds by establishing a relation analogous to Eq. 9 for the graph state |Ψ Γ 〉 [similar to (36); see (28)].

Fig. 1 Cycle graph Γ. Shown is a cycle Γ of even length M and three vertices u, v, w such that all pairwise distances are even. The sides L, R, B may have unequal lengths.

Now consider the more general family of constant-depth classical circuits, which may not be geometrically local. Here, the HLF associated with the cycle graph Γ is not suitable for establishing our desired separation. Classical constant-depth circuits can communicate values b u , b v , b w of input bits to distant locations in the cycle Γ and solve the HLF in this case essentially by simulating geometric nonlocality. We thus turn to the 2D HLF problem: We establish that the correlations between the input A and the solutions z in the 2D HLF problem have a strong form of nonlocality that cannot be reproduced by constant-depth randomness-assisted classical circuits of bounded fan-in. The key difference relative to the cycle graph setting is that the underlying graph G(A) in the problem is also varied. Our main technical result is the following lower bound, which is valid for all sufficiently large N: If a classical circuit C N with fan-in at most K solves all N × N instances of the 2D HLF problem with probability greater than ⅞, then the depth of C N is at least [1/(8 log K)] log N.

Thus, no constant-depth circuit with bounded fan-in can solve all instances of the 2D HLF problem with high probability. The full proof of this result is given in (28). It proceeds by contradiction. Suppose a small-depth circuit C N with bounded fan-in solves all size-N instances of the 2D HLF. To conform with the previous notations, we write b i ≡ A i , i for the diagonal elements of A. We restrict our attention to instances A where G(A) is a subgraph Γ of the 2D grid chosen in a particular way (depending on C N ) such that

1) Γ is an even length cycle of length proportional to N,

2) There are vertices u, v, w on Γ, with even pairwise distances at least proportional to N, and

3) Any output bit z q lying on the cycle Γ and correlated with one of the input bits b u , b v , b w must be located in a small neighborhood of this input bit (of size proportional to N1/2).

We establish the existence of such a cycle Γ by a probabilistic argument. Informally, restricting C N to the instances of the HLF defined above gives rise to a certain geometrically local structure, as described by condition 3. However, such a geometrically local structure can be ruled out using the example of the HLF on the cycle graph. Indeed, in the latter case we have already shown that the lightcone of at least one input bit b i ∈ {b u , b v , b w } must contain an output bit z q located far from b i , such that dist Γ (i,q) ≥ ½D Γ ({u, v, w}). This contradicts condition 3 because D Γ ({u, v, w}) is proportional to N. Thus, we obtain the desired lower bound on the depth of C N . This lower bound can be viewed as a worst-case hardness result, as we assume that the classical circuit solves all instances of the problem. In (28), we provide an analogous average-case hardness result that assumes only that the classical circuit solves a constant fraction of instances from a suitable random ensemble.

Our result constitutes a provable separation between analogously defined classical and quantum computational models that uses quantum nonlocality in answering a complexity-theoretic question. Our quantum circuit for the 2D HLF problem, which uses only classically controlled Clifford gates in a 2D geometry, is a promising target for future experimental demonstration of a quantum algorithm with provably better scaling (in terms of circuit depth) than any classical algorithm. Future theoretical work may address the question of minimizing resource requirements for practical demonstrations of such a quantum advantage, and may incorporate methods of fault tolerance tailored to hardware architectures of interest.

Supplementary Materials www.sciencemag.org/content/362/6412/308/suppl/DC1 Supplementary Text Figs. S1 and S2

http://www.sciencemag.org/about/science-licenses-journal-article-reuse This is an article distributed under the terms of the Science Journals Default License.

Acknowledgments: We thank the anonymous referees for their comments. Funding: Supported by the IBM Research Frontiers Institute (S.B. and D.G.) and by the Technical University of Munich–Institute for Advanced Study, funded by the German Excellence Initiative and the European Union Seventh Framework Programme under grant agreement 291763 (R.K.). Author contributions: S.B., D.G., and R.K. contributed equally to this work. Competing interests: None.