This paper was converted on www.awesomepapers.org from LaTeX by an anonymous user.
Want to know more? Visit the Converter page.

Quantum Approximate Counting for Markov Chains and Application to Collision Counting

François Le Gall111[email protected]
Graduate School of Mathematics
Nagoya University
   Iu-Iong Ng222[email protected]
Graduate School of Mathematics
Nagoya University
Abstract

In this paper we show how to generalize the quantum approximate counting technique developed by Brassard, Høyer and Tapp [ICALP 1998] to a more general setting: estimating the number of marked states of a Markov chain (a Markov chain can be seen as a random walk over a graph with weighted edges). This makes it possible to construct quantum approximate counting algorithms from quantum search algorithms based on the powerful “quantum walk based search” framework established by Magniez, Nayak, Roland and Santha [SIAM Journal on Computing 2011]. As an application, we apply this approach to the quantum element distinctness algorithm by Ambainis [SIAM Journal on Computing 2007]: for two injective functions over a set of NN elements, we obtain a quantum algorithm that estimates the number mm of collisions of the two functions within relative error ϵ\epsilon by making O~(1ϵ25/24(Nm)2/3)\tilde{O}\left(\frac{1}{\epsilon^{25/24}}\big{(}\frac{N}{\sqrt{m}}\big{)}^{2/3}\right) queries, which gives an improvement over the Θ(1ϵNm)\Theta\big{(}\frac{1}{\epsilon}\frac{N}{\sqrt{m}}\big{)}-query classical algorithm based on random sampling when mNm\ll N.

1 Introduction

Quantum search.

Grover’s search [9] is the most basic version of quantum search. This quantum algorithm considers the following problem called unstructured search: for a function f:{1,,N}{0,1}f\colon\{1,\ldots,N\}\to\{0,1\} given as a black-box, find one element x{1,,N}x\in\{1,\ldots,N\} such that f(x)=1f(x)=1 (we call such an element a solution and assume that there exists at least one). Let M=|f1(1)|M=|f^{-1}(1)| denote the number of solutions. Grover’s algorithm outputs with high probability a solution using O(N/M)O(\sqrt{N/M}) calls to the function ff. This is a quadratic improvement over the classical (i.e., non-quantum) strategy, which is based on random sampling and requires Θ(N/M)\Theta(N/M) calls to ff to find a solution with high probability.

Another fundamental, but more sophisticated, quantum search technique is quantum walk based search [2, 16, 21]. The problem considered here is a generalization of unstructured search. As for unstructured search, this problem accesses the data via a black-box. It can be defined in an abstract way for any Markov chain (Markov chains are generalizations of the concept of random walks over a graphs — see Section 2.2 for details). Some states of the Markov chains corresponding to “solutions” are called the marked states. The goal of the problem is to find one marked state (here we assume again that there is at least one marked state). Let λ>0\lambda>0 be a lower bound on the fraction of marked states. Magniez, Nayak, Roland and Santha [16] have shown that this problem can be solved with high probability by a quantum algorithm that makes

O(𝖲+1λ(1δ𝖴+𝖢))O\left(\mathsf{S}+\frac{1}{\sqrt{\lambda}}\left(\frac{1}{\sqrt{\delta}}\mathsf{U}+\mathsf{C}\right)\right) (1)

queries to the black-box, were δ\delta denotes the spectral gap of the Markov chain and 𝖲\mathsf{S}, 𝖴\mathsf{U} and 𝖢\mathsf{C} represent the number of queries needed to implement the three basic quantum operations corresponding to search: the setup operation, the update operation and the checking operation. Unstructured search simply corresponds to the Markov chain representing a random walk on a complete graph of NN vertices, which has spectral gap δ=1\delta=1, with λ=M/N\lambda=M/N, 𝖲=1\mathsf{S}=1, 𝖴=2\mathsf{U}=2 and 𝖢=0\mathsf{C}=0. The complexity becomes O(λ)=O(N/M)O(\sqrt{\lambda})=O(\sqrt{N/M}), as for Grover’s search.333Grover’s search can also be derived in another (more direct) way, with costs 𝖲=0\mathsf{S}=0, 𝖴=0\mathsf{U}=0 and 𝖢=1\mathsf{C}=1.   A striking illustration of the power of quantum walk based search is the problem called element distinctness: for two functions f,g:{1,,N}{1,,K}f,g\colon\{1,\ldots,N\}\longrightarrow\{1,\ldots,K\} accessible as black boxes, find a pair (i,j){1,,N}2(i,j)\in\{1,\ldots,N\}^{2} satisfying f(i)=g(j)f(i)=g(j) if such a pair exists (such a pair is called a collision). Ambainis [2] showed how to solve this problem with O(N2/3)O(N^{2/3}) queries using quantum walk based search.444While the version of element distinctness considered in [2] uses only one function, the version we present here is essentially equivalent (see [13] for details).   Besides element distinctness, quantum walk based search has been used to design quantum algorithms for many other problems, such as matrix multiplication [6], triangle finding [10, 12, 15] or associativity testing [14].

Quantum approximate counting.

Quantum approximate counting is another very useful quantum primitive designed by Brassard, Høyer and Tapp [5]. It solves the (approximate) counting version of unstructured search: for any given ϵ>0\epsilon>0 and a function f:{1,,N}{0,1}f\colon\{1,\ldots,N\}\to\{0,1\} given as a black-box, output an ϵ\epsilon-approximation of the number of solution M=|f1(1)|M=|f^{-1}(1)|, i.e., output an integer M^\hat{M} such that |MM^|ϵM|M-\hat{M}|\leq\epsilon M. The quantum approximate counting algorithm from [5] solves this problem using O(1ϵN/M)O(\frac{1}{\epsilon}\sqrt{N/M}) calls to ff. This is again a quadratic improvement over the classical strategy, which is based on random sampling and requires Θ(1ϵ2N/M)\Theta(\frac{1}{\epsilon^{2}}N/M) calls to ff [18]. Very recently, several variants of quantum approximate counting have been proposed [1, 20, 23, 24]. These variants have the same asymptotic complexity as the original algorithm but may be easier to implement in practice, especially on near-future quantum computers.

Since quantum walk based search is a generalization of Grover search, a natural question is whether a version of quantum approximate counting can be obtained for quantum walk based search as well, i.e., whether there exists an efficient quantum algorithm to estimate the number of marked states of a Markov chain. To our knowledge, this problem has never been studied in the literature. This problem is especially motivated by the task of approximate collision counting: for two functions f,g:{1,,N}{1,,K}f,g\colon\{1,\ldots,N\}\longrightarrow\{1,\ldots,K\} accessible as black boxes, output an approximation of the number of collisions. While not stated explicitly, this task is at the heart of most algorithms for estimating the edit distance between two non-repetitive strings [3, 13, 17], and is also used for estimating the 1\ell_{1}-distance between two probability distributions [4, 22].

Description of our results.

Our main technical result is the following general approximate counting version for reversible Markov chains.

Theorem 1.1.

Let PP be a reversible ergodic Markov chain with uniform stationary distribution, δ>0\delta>0 be the spectral gap of PP and λ>0\lambda>0 be a known lower bound on the fraction of marked states of PP. Let 𝖲\mathsf{S}, 𝖴\mathsf{U} and 𝖢\mathsf{C} be the number of queries needed to implement, respectively, the setup operation, the update operation and the checking operation. For any ϵ(0,1)\epsilon\in(0,1), there exists a quantum algorithm which outputs with high probability an estimate M^\hat{M} such that |MM^|<ϵM|M-\hat{M}|<\epsilon M, and uses

O~(𝖲+1ϵ1λ(1δ𝖴+𝖢))\tilde{O}\left(\mathsf{S}+\frac{1}{\epsilon}\frac{1}{\sqrt{\lambda}}\left(\frac{1}{\sqrt{\delta}}\mathsf{U}+\mathsf{C}\right)\right)

queries to the black box.555In this paper the notation O~()\tilde{O}(\cdot) removes the polylogarithmic factors in all parameters.

As an application of Theorem 1.1, we show how to construct a quantum algorithm to approximate the number of collisions. More precisely, the version of approximate collision counting we consider is as follows: for ϵ>0\epsilon>0 and for two injective functions f,g:{1,,N}{1,,K}f,g\colon\{1,\ldots,N\}\longrightarrow\{1,\ldots,K\}, where K>NK>N, output an ϵ\epsilon-approximation of the number of collisions mm, i.e., an estimate m^\hat{m} such that |mm^|<ϵm|m-\hat{m}|<\epsilon m. (We restrict our attention to the case of injective functions since this simplifies the exposition of our result. Note that this version with injective functions is still interesting since it is precisely the version needed for estimating the edit distance between two non-repetitive strings [3, 13, 17].)

In order to derive worst-case complexity upper bounds that explicitly depend on the number of collisions, we assume that we know a lower bound m¯m\bar{m}\leq m, and state the complexities using m¯\bar{m}. There is an easy randomized algorithm based on sampling (which has been, for instance, used implicitly in [3, 17]) that outputs with high probability an ϵ\epsilon-approximation of mm using O(1ϵNm+Nm¯)O\big{(}\frac{1}{\epsilon}\frac{N}{\sqrt{m}}+\frac{N}{\sqrt{\bar{m}}}\big{)} evaluations of ff and gg, which is essentially tight (see Appendix A for details). Based on the technique of Theorem 1.1, we design a fast quantum algorithm for this problem:

Theorem 1.2.

Given a lower bound m¯>0\bar{m}>0 of the number of collision mm, for any ϵ>0\epsilon>0 there is a quantum algorithm that outputs with high probability an estimate m^\hat{m} such that |mm^|<ϵm|m-\hat{m}|<\epsilon m using

O~(1ϵ25/24(Nm)2/3+(Nm¯)2/3)\tilde{O}\left(\frac{1}{\epsilon^{25/24}}\left(\frac{N}{\sqrt{m}}\right)^{2/3}+\left(\frac{N}{\sqrt{\bar{m}}}\right)^{2/3}\right)

queries.

Overview of our techniques.

Let us start by giving an overview of the quantum approximate counting by Brassard, Høyer and Tapp [5]. Roughly speaking, the quantum approximate counting algorithm from [5] applies the technique called quantum phase estimation [7, 11], which is based on the quantum Fourier transform, in order to estimate the eigenvalues of the unitary operator used as the main subroutine of Grover’s algorithm. This operator, when restricted to the appropriate subspace, is a rotation whose angle is closely related to the number of solutions. The eigenvalues of this operator are thus closely related to the number of solutions as well. A good approximation of the eigenvalues, which can be obtained using quantum phase estimation, then gives a good approximation of the number of solutions.

The main insight is that the main operator UU of quantum walk based search by Magniez, Nayak, Roland and Santha [16] approximately corresponds to a rotation U¯\overline{U} (see Corollary 2.3 in Section 2.2). To prove Theorem 1.1, we observe that the eigenvalues of this rotation U¯\overline{U} are closely related to the fraction of marked states with respect to the stationary distribution of the Markov chain, and then shows that quantum phase estimation applied on UU (instead of U¯\overline{U}) with good enough precision gives a good estimation of these eigenvalues and thus a good approximation of the number of marked states if the stationary distribution is uniform (Section 3). To prove Theorem 1.2, we additionally establish the relation between the number of collisions and the number of marked states in the Markov chain corresponding to a random walk over the Johnson graph (which is the same Markov chain as the one used in Ambainis’ element distinctness algorithm [2]), and show that a good approximation for the latter gives a good enough approximation of the former (Section 4).

2 Preliminaries

We assume that the reader is familiar with the basics of quantum computation (we refer to, e.g., [19] for a good reference) and describe below phase estimation and quantum walk based search.

2.1 Phase estimation

We first describe phase estimation [7, 11] (see also [19]). Given a unitary matrix UU and an eigenvector |u|u\rangle of UU corresponding to an eigenvalue e2πiφue^{2\pi i\varphi_{u}}, where φu[0,1)\varphi_{u}\in[0,1), phase estimation is a quantum algorithm that outputs a good approximation of φu\varphi_{u}. The phase estimation algorithm is also given a positive integer tt as input, which controls the precision of the estimation.

In order to implement this algorithm, the unitary UU needs to be accessible as follows: we have access to a black box that performs a controlled-UU operation. Note that when an implementation of UU as a concrete quantum circuit is available, a circuit implementation of the controlled-UU operation can be simply obtained by replacing each elementary gate with its controlled version.

The phase estimation is described as Algorithm 1 below, and a concrete implementation as a quantum circuit which we denote Ct(U)C_{t}(U) is given in Figure 1. The total number of controlled-UU operations is 20+21++2t1=O(2t)2^{0}+2^{1}+\cdots+2^{t-1}=O(2^{t}). The following theorem shows that when setting tt appropriately, the algorithm outputs a good approximation with high probability.

Theorem 2.1 ([19]).

For any integer t11t_{1}\geq 1 and any ξ(0,1]\xi\in(0,1], when setting t=t1+log2(2+12ξ)t=t_{1}+\lceil\log_{2}(2+\frac{1}{2\xi})\rceil the phase estimation algorithm Est(U,|u,t)(U,|u\rangle,t) outputs with probability at least 1ξ1-\xi an approximation φ~u\tilde{\varphi}_{u} such that |φuφ~u|<2t1|\varphi_{u}-\tilde{\varphi}_{u}|<2^{-t_{1}}.

1 Prepare the quantum state |0t|u|0^{t}\rangle|u\rangle.
2 Apply a Hadamard gate of each of the first tt qubits.
3 Apply controlled-UU operations on the second register, controlled by the first register.
4 Apply the inverse Fourier transform over the first register.
5 Measure the first register in the computational basis and get an integer b{0,1,,2t1}b\in\{0,1,\ldots,2^{t}-1\}.
Output b2tφ~u\frac{b}{2^{t}}\eqqcolon\tilde{\varphi}_{u}.
Algorithm 1 The phase estimation algorithm Est(U,|u,t)(U,|u\rangle,t)
HHHHHHU20U^{2^{0}}U21U^{2^{1}}U2t1U^{2^{t-1}}FT\dots\dots\dots\dots\dots|0t|0\rangle^{\otimes t}\vdots\vdots\vdots\vdots|u|u\rangle\vdots\vdots\vdots\dots\vdots\vdots|u|u\rangle\vdotsbb
Figure 1: The circuit Ct(U)C_{t}(U) for phase estimation, where HH is the Hadamard gate and FT is the inverse Fourier transform.

2.2 Search via quantum walk

In this subsection we describe the quantum walk based search approach (also called search via quantum walk) by Magniez, Nayak, Roland and Santha [16].

Classical Markov chains.

A Markov chain PP with a finite state space XX corresponds to a random walk over a weighted graph. In this paper, as in [16], we write |X|=n|X|=n and identify the Markov chain with its transition matrix P=(pxy)P=(p_{xy}), where pxyp_{xy} is the probability of transition from xx to yy (the matrix PP is a stochastic matrix). The Markov chain is ergodic if its reachability graph is connected and non-bipartite. An ergodic Markov chain has a unique stationary distribution, which we denote π\pi. The Markov chain is reversible if the equality πxpxy=πypyx\pi_{x}p_{xy}=\pi_{y}p_{yx} holds for all x,yXx,y\in X (for example, any Markov chain induced from an undirected weighted graph is reversible).

All the Markov chains considered in this paper are ergodic and reversible. Let \mathcal{M} be a non-empty subset of XX. The elements of \mathcal{M} are called the marked states of PP. Define

pM=xπx,p_{M}=\sum_{x\in\mathcal{M}}\pi_{x},

the fraction of marked states in the stationary distribution.

Quantum implementation of Markov chains.

Due to reversibility issues in the quantum setting, the approach by Magniez, Nayak, Roland and Santha [16] for implementing Markov chains considers pairs of states (i.e., the space X×XX\times X) instead of working with states (i.e., the space XX). Consider the vector space =X×X=span(|x|y:(x,y)X×X)\mathcal{H}=\mathbb{C}^{X\times X}=\operatorname{span}(|x\rangle|y\rangle:(x,y)\in X\times X). Let 𝒜\mathcal{A} and \mathcal{B} be the subspaces of \mathcal{H} defined as 𝒜=span(|x|px:xX)\mathcal{A}=\operatorname{span}(|x\rangle|p_{x}\rangle:x\in X) and =span(|py|y:yX)\mathcal{B}=\operatorname{span}(|p^{*}_{y}\rangle|y\rangle:y\in X), where

|px=yXpxy|y and |py=xXpyx|x.|p_{x}\rangle=\sum\limits_{y\in X}\sqrt{p_{xy}}|y\rangle\hskip 8.53581pt\textrm{ and }\hskip 8.53581pt|p_{y}^{*}\rangle=\sum\limits_{x\in X}\sqrt{p_{yx}}|x\rangle.

The unitary operation W(P)W(P) defined on \mathcal{H} by W(P)=ref()ref(𝒜)W(P)=\operatorname{ref}(\mathcal{B})\cdot\operatorname{ref}(\mathcal{A}) is called the quantum walk based on the classical chain PP.

Define the following two quantum states:

|π\displaystyle|\pi\rangle =xXπx|x|px,\displaystyle=\sum\limits_{x\in X}\sqrt{\pi_{x}}|x\rangle|p_{x}\rangle,
|μ\displaystyle|\mu\rangle =1pMxπx|x|px,\displaystyle=\frac{1}{\sqrt{p_{M}}}\sum\limits_{x\in\mathcal{M}}\sqrt{\pi_{x}}|x\rangle|p_{x}\rangle,

and write 𝒮=span(|π,|μ)\mathcal{S}=\operatorname{span}(|\pi\rangle,|\mu\rangle). Let |μ|\mu^{\perp}\rangle denote the state orthonormal to |μ|\mu\rangle in the subspace 𝒮\mathcal{S} of \mathcal{H}. Then

|π=sinφ|μ+cosφ|μ,|\pi\rangle=\sin\varphi|\mu\rangle+\cos\varphi|\mu^{\perp}\rangle,

where φ[0,π2)\varphi\in[0,\frac{\pi}{2}), sinφ=pM\sin\varphi=\sqrt{p_{M}} (remember that pMp_{M} denotes the fraction of marked items of PP). Let us write ref(π)\operatorname{ref}(\pi) the unitary operation defined on 𝒜+\mathcal{A}+\mathcal{B} such that ref(π)|π=|π\operatorname{ref}(\pi)|\pi\rangle=|\pi\rangle and ref(π)|ψ=|ψ\operatorname{ref}(\pi)|\psi\rangle=-|\psi\rangle for any |ψ𝒜+|\psi\rangle\in\mathcal{A}+\mathcal{B} orthogonal to |π|\pi\rangle. Define the unitary operation V0V_{0} on 𝒜+\mathcal{A}+\mathcal{B} as follows:

V0:|x|y{|x|yif x|x|yotherwiseV_{0}\colon|x\rangle|y\rangle\mapsto\left\{\begin{aligned} -|x\rangle|y\rangle&\quad\text{if }x\in\mathcal{M}\\ |x\rangle|y\rangle&\quad\text{otherwise}\end{aligned}\right.

and let V¯=ref(π)V0\overline{V}=\operatorname{ref}(\pi)\cdot V_{0}. In the subspace 𝒮\mathcal{S} the unitary operation V¯\overline{V} is a rotation of angle 2φ2\varphi.

One of the main technical contributions of [16] is the construction of a quantum circuit which efficiently implements an operator that is close to the reflection ref(π)\operatorname{ref}(\pi).

Theorem 2.2 ([16, Section 3.2]).

Let PP be a reversible ergodic Markov chain with a state space of size n2n\geq 2. Let δ\delta denote the spectral gap of PP. Then for any integer kk there exists a quantum circuit R(P)R(P) that acts on O(logn)+τO(\log n)+\tau qubits, where τ=O(klog(1/δ))\tau=O(k\log(1/\delta)), and satisfies the following properties:

  1. 1.

    The circuit R(P)R(P) uses O(klog(1/δ))O(k\log(1/\delta)) Hadamard gates, O(klog2(1/δ))O(k\log^{2}(1/\delta)) controlled phase rotations, and makes at most O(k/δ)O(k/\sqrt{\delta}) calls to the controlled quantum walk c-W(P)W(P) and its inverse c-W(P)W(P)^{\dagger}.

  2. 2.

    For any |ψ𝒜+|\psi\rangle\in\mathcal{A}+\mathcal{B}, (R(P)ref(π)I)|ψ|0τ21k\|(R(P)-\operatorname{ref}(\pi)\otimes I)|\psi\rangle|0^{\tau}\rangle\|\leq 2^{1-k}.

The following immediate corollary of Theorem 2.2 gives an upper bound for the difference between U=R(P)(V0I)U=R(P)\cdot(V_{0}\otimes I) and the rotation U¯=V¯I\overline{U}=\overline{V}\otimes I.

Corollary 2.3.

For any |ψ𝒜+|\psi\rangle\in\mathcal{A}+\mathcal{B}, (UU¯)|ψ|0τ21k\|(U-\overline{U})|\psi\rangle|0^{\tau}\rangle\|\leq 2^{1-k}.

Quantum walk based search.

When considering quantum walk based search the input is given as a black box, as for Grover’s search. The set MM of marked states is defined using the input in such a way that finding a marked state corresponds to finding a solution to the search problem. Additionally, some data from the input is stored in a data structure dd. Mathematically, this corresponds to working with Xd={(x,d(x)):xX}X_{d}=\{(x,d(x)):x\in X\} and d=Xd×Xd\mathcal{H}_{d}=\mathbb{C}^{X_{d}\times X_{d}} instead of XX and \mathcal{H}. For convenience we simply write |xd|x\rangle_{d} instead of |(x,d(x))|(x,d(x))\rangle, for any xXx\in X. The query complexity of the quantum walk based search can then be expressed in terms of three costs (see [16, Section 1.3] for details):

  • Setup cost 𝖲\mathsf{S}: The cost of constructing the state xπx|xd|0¯d\sum_{x}\sqrt{\pi_{x}}|x\rangle_{d}|\bar{0}\rangle_{d} from |0¯d|0¯d|\bar{0}\rangle_{d}|\bar{0}\rangle_{d}.

  • Update cost 𝖴\mathsf{U}: The cost of realizing any of the unitary transformations

    |xd|0¯d\displaystyle|x\rangle_{d}|\bar{0}\rangle_{d}\ |xdypxy|yd\displaystyle\mapsto\ |x\rangle_{d}\sum_{y}\sqrt{p_{xy}}|y\rangle_{d}
    |0¯d|yd\displaystyle|\bar{0}\rangle_{d}|y\rangle_{d}\ xpxy|xd|yd\displaystyle\mapsto\ \sum_{x}\sqrt{p_{xy}^{*}}|x\rangle_{d}|y\rangle_{d}

    and their inverses.

  • Checking cost 𝖢\mathsf{C}: The cost of realizing the following conditional phase flip

    |xd|yd{|xd|ydif x.|xd|ydotherwise.|x\rangle_{d}|y\rangle_{d}\ \mapsto\ \left\{\begin{aligned} -|x\rangle_{d}|y\rangle_{d}&\quad\text{if }x\in\mathcal{M}.\\ |x\rangle_{d}|y\rangle_{d}&\quad\text{otherwise}.\end{aligned}\right.

A single application of R(P)R(P) can be implemented using O(kδ𝖴)O(\frac{k}{\sqrt{\delta}}\mathsf{U}) queries, from Theorem 2.2. A single application of UU can thus be implemented using O(kδ𝖴+𝖢)O(\frac{k}{\sqrt{\delta}}\mathsf{U}+\mathsf{C}) queries. Magniez, Nayak, Roland and Santha [16] showed that by first preparing the initial state using 𝖲\mathsf{S} queries, and then applying O(1/λ)O(1/\sqrt{\lambda}) times the operation UU, a marked state (and thus a solution to the search problem) is obtained with high probability. The overall complexity of this strategy is

O(𝖲+1λ(kδ𝖴+𝖢))O\left(\mathsf{S}+\frac{1}{\sqrt{\lambda}}\left(\frac{k}{\sqrt{\delta}}\mathsf{U}+\mathsf{C}\right)\right)

queries. The factor kk can be removed from the complexity using more work (see [16, Section 4]), which gives the complexity stated in Eq. (1) in the introduction.

3 Quantum Counting for Markov Chains

In this section we prove Theorem 1.1: for a reversible ergodic Markov chain which has the uniform stationary distribution and a finite set XX of size |X|=N|X|=N and a marked subset X\mathcal{M}\subseteq X, the goal is to find an estimation M^\hat{M} of M=||M=|\mathcal{M}| such that |MM^|<ϵM|M-\hat{M}|<\epsilon M. The main idea is to apply phase estimation on the operator UU introduced in Section 2.2. Before giving the proof of Theorem 1.1 we present a high-level description of our strategy and prove a technical result (Lemma 3.1).

Consider first the operator U¯\overline{U} introduced in Section 2.2. Since U¯\overline{U} is a rotation of angle 2φ2\varphi on 𝒮|0τ\mathcal{S}\otimes|0^{\tau}\rangle, in this subspace it has orthonormal eigenvectors

|Ψ±=12(|μ±i|μ)|0τ|\Psi_{\pm}\rangle=\frac{1}{\sqrt{2}}(|\mu\rangle\pm i|\mu^{\perp}\rangle)\otimes|0^{\tau}\rangle

corresponding to the eigenvalues e±i2φe^{\pm i2\varphi}. Applying phase estimation (Algorithm 1) with U¯\overline{U} on |Ψ±|\Psi_{\pm}\rangle would give an approximation of ±φ/π\pm\varphi/\pi with high probability,666Observe that we have a π\pi factor here since the version of phase estimation presented in Section 2.1 assumes that the eigenvalues are of the form e2πiφue^{2\pi i\varphi_{u}} with φu[0,1)\varphi_{u}\in[0,1).   from which we would be able to obtain a good approximation of MM since sin(φ)=pM\sin(\varphi)=\sqrt{p_{M}}, where pM=M/N\sqrt{p_{M}}=\sqrt{M/N} if the stationary distribution of PP is uniform. There are nevertheless two issues with this strategy: we do not know the eigenvectors |Ψ±|\Psi_{\pm}\rangle and we cannot apply U¯\overline{U} directly.

The first issue is dealt with in a fairly standard way: we will instead apply phase estimation using the state |π|0τ𝒮|0τ|\pi\rangle|0^{\tau}\rangle\in\mathcal{S}\otimes|0^{\tau}\rangle. This state, which we know how to construct (at cost 𝖲\mathsf{S} queries), can be expressed as

|π|0τ=sinφ|μ|0τ+cosφ|μ|0τ=i2ei2φ|Ψ++i2ei2φ|Ψ,|\pi\rangle|0^{\tau}\rangle=\sin\varphi|\mu\rangle|0^{\tau}\rangle+\cos\varphi|\mu^{\perp}\rangle|0^{\tau}\rangle=-\frac{i}{\sqrt{2}}e^{i2\varphi}|\Psi_{+}\rangle+\frac{i}{\sqrt{2}}e^{-i2\varphi}|\Psi_{-}\rangle, (2)

and thus applying Algorithm 1 with U¯\overline{U} on |π|0τ|\pi\rangle|0^{\tau}\rangle would output with high probability an approximation of either φ/π\varphi/\pi or φ/π-\varphi/\pi, which would be enough to obtain an approximation of pMp_{M}.

To solve the second problem, we will simply apply phase estimation on UU instead of U¯\overline{U}. As in Section 2.1, let us use Ct(U)C_{t}(U) to denote the circuit of phase estimation applied on UU with the parameter tt. We can upper bound the difference between Ct(U)C_{t}(U) and Ct(U¯)C_{t}(\overline{U}) operating on |0t|ψ|0τ|0^{t}\rangle|\psi\rangle|0^{\tau}\rangle with |ψ𝒜+|\psi\rangle\in\mathcal{A}+\mathcal{B} as follows.

Lemma 3.1.

For any |ψ𝒜+|\psi\rangle\in\mathcal{A}+\mathcal{B}, (Ct(U)Ct(U¯))|0t|ψ|0τ22tk+1\|(C_{t}(U)-C_{t}(\overline{U}))|0^{t}\rangle|\psi\rangle|0^{\tau}\rangle\|\leq 2^{2t-k+1}.

Proof.

Let |ψ𝒜+|\psi\rangle\in\mathcal{A}+\mathcal{B}. Since UU and U¯\overline{U} are unitary, Corollary 2.3 implies that for any ll\in\mathbb{N},

(UlU¯l)|ψ|0τ\displaystyle\|(U^{l}-\overline{U}^{l})|\psi\rangle|0^{\tau}\rangle\| =(UU¯)(Ul1+Ul2U¯++U¯l1)|ψ|0τ\displaystyle=\|(U-\overline{U})(U^{l-1}+U^{l-2}\overline{U}+\cdots+\overline{U}^{l-1})|\psi\rangle|0^{\tau}\rangle\|
l(UU¯)|ψ|0τ\displaystyle\leq l\|(U-\overline{U})|\psi\rangle|0^{\tau}\rangle\|
l21k.\displaystyle\leq l\cdot 2^{1-k}.

The quantum state at the end of Step 3 of Algorithm 1 is

12tj=02t1|jUj|ψ|0τ.\frac{1}{\sqrt{2^{t}}}\sum_{j=0}^{2^{t}-1}|j\rangle U^{j}|\psi\rangle|0^{\tau}\rangle.

Thus we have

(Ct(U)Ct(U¯))|0t|ψ|0τ\displaystyle\|(C_{t}(U)-C_{t}(\overline{U}))|0^{t}\rangle|\psi\rangle|0^{\tau}\rangle\| 2tmax0l2t1(UlU¯l)|ψ|0τ\displaystyle\leq 2^{t}\max_{0\leq l\leq 2^{t}-1}\|(U^{l}-\overline{U}^{l})|\psi\rangle|0^{\tau}\rangle\|
2t(2t1)21k\displaystyle\leq 2^{t}(2^{t}-1)2^{1-k}
22tk+1,\displaystyle\leq 2^{2t-k+1},

as claimed. ∎

We are now ready to give a proof of Theorem 1.1 by putting all these ingredients together, adjusting all the parameters and making the analysis of the approximation errors.

Proof of Theorem 1.1..

We divide the proof into several components.

Analysis of phase estimation on the ideal rotation 𝕌¯\mathbb{\overline{U}}.

From Theorem 2.1 we know that when choosing parameters t1=log2(5πϵλ)1t_{1}=\left\lceil\log_{2}\left(\frac{5\pi}{\epsilon\sqrt{\lambda}}\right)-1\right\rceil, ξ=0.01\xi=0.01, t=t1+log2(2+12ξ)t=t_{1}+\lceil\log_{2}(2+\frac{1}{2\xi})\rceil, the algorithm Est(U¯\overline{U}, |Ψ±|0τ|\Psi_{\pm}\rangle|0^{\tau}\rangle, tt) would output a value zz such that |z(±φ/π)|<2t1|z-(\pm\varphi/\pi)|<2^{-t_{1}} with probability at least 0.990.99.

Let us now interpret these probabilities in a more algebraic way. Let M+M_{+} and MM_{-} be the projection over the subspaces span{|b~:|b~2tφπ|<2t1}\operatorname{span}\left\{|\tilde{b}\rangle:\left|\frac{\tilde{b}}{2^{t}}-\frac{\varphi}{\pi}\right|<2^{-t_{1}}\right\} and span{|b~:|b~2t+φπ|<2t1}\operatorname{span}\left\{|\tilde{b}\rangle:\left|\frac{\tilde{b}}{2^{t}}+\frac{\varphi}{\pi}\right|<2^{-t_{1}}\right\}, respectively, of the vector space 2t\mathbb{C}^{2^{t}}. We thus have:

(M+I)Ct(U¯)|0t|Ψ+|0τ2=Pr[|zφπ|<2t1]\displaystyle\|(M_{+}\otimes I)C_{t}(\overline{U})|0^{t}\rangle|\Psi_{+}\rangle|0^{\tau}\rangle\|^{2}=\Pr\left[\left|z-\frac{\varphi}{\pi}\right|<2^{-t_{1}}\right] 0.99\displaystyle\geq 0.99
(MI)Ct(U¯)|0t|Ψ|0τ2=Pr[|z+φπ|<2t1]\displaystyle\|(M_{-}\otimes I)C_{t}(\overline{U})|0^{t}\rangle|\Psi_{-}\rangle|0^{\tau}\rangle\|^{2}=\Pr\left[\left|z+\frac{\varphi}{\pi}\right|<2^{-t_{1}}\right] 0.99.\displaystyle\geq 0.99.

Let us now analyze the output of Est(U¯\overline{U}, |π|0τ|\pi\rangle|0^{\tau}\rangle, tt). For conciseness, we write |Φ¯=Ct(U¯)|0t|π|0τ|\overline{\Phi}\rangle=C_{t}(\overline{U})|0^{t}\rangle|\pi\rangle|0^{\tau}\rangle. Remember the decomposition of Eq. (2) and observe that i2ei2φ2=i2ei2φ2=12{\big{\|}-\frac{i}{\sqrt{2}}e^{i2\varphi}\big{\|}^{2}}=\big{\|}\frac{i}{\sqrt{2}}e^{-i2\varphi}\big{\|}^{2}=\frac{1}{2}. Thus we have:

(M+I)|Φ¯20.99/2 and (MI)|Φ¯20.99/2,\|(M_{+}\otimes I)|\overline{\Phi}\rangle\|^{2}\geq 0.99/2\>\>\textrm{ and }\>\>\|(M_{-}\otimes I)|\overline{\Phi}\rangle\|^{2}\geq 0.99/2, (3)

which means that Est(U¯\overline{U}, |π|0τ|\pi\rangle|0^{\tau}\rangle, tt) outputs a value zz such that |zφ/π|<2t1|z-\varphi/\pi|<2^{-t_{1}} with probability at least 0.99/20.99/2 and |z+φ/π|<2t1|z+\varphi/\pi|<2^{-t_{1}} with probability at least 0.99/20.99/2.

Description of the algorithm.

We apply phase estimation on UU instead of U¯\overline{U}, with the input state |π|0τ|\pi\rangle|0^{\tau}\rangle, where UU is the operator introduced in Section 2.2. Remember that UU is defined using a parameter kk (see the statement of Theorem 2.2). We set k=2t+t1+1k=2t+t_{1}+1.

The algorithm for Theorem 1.1 is as follows.

Input : desired accuracy parameter ϵ>0\epsilon>0, lower bound on the fraction of marked states λ\lambda of the Markov chain.
0 Set t=log2(5πϵλ)1+log2(2+10.02)t=\left\lceil\log_{2}\left(\frac{5\pi}{\epsilon\sqrt{\lambda}}\right)-1\right\rceil+\lceil\log_{2}(2+\frac{1}{0.02})\rceil and k=2t+log2(5πϵλ)1+1k=2t+\left\lceil\log_{2}\left(\frac{5\pi}{\epsilon\sqrt{\lambda}}\right)-1\right\rceil+1.
1 Apply Est(UU, |π|0τ|\pi\rangle|0^{\tau}\rangle, tt) and denote yy its output.
Output M^=Nsin2(yπ)\hat{M}=N\sin^{2}(y\pi).
Algorithm 2 Quantum Approximate Counting for Markov Chains

Error Analysis.

We are going to show that |MM^|<ϵ|M-\hat{M}|<\epsilon, where M=Nsin2φM=N\sin^{2}\varphi and M^=Nsin2(yπ)\hat{M}=N\sin^{2}(y\pi), by analyzing the quantity |φ|y|π|\bigl{|}\varphi-|y|\pi\bigr{|}.

Let us write |Φ=Ct(U)|0t|π|0τ|\Phi\rangle=C_{t}(U)|0^{t}\rangle|\pi\rangle|0^{\tau}\rangle. For any measurement operator Mm{M+,M}M_{m}\in\{M_{+},M_{-}\}, we have

(MmI)|Φ2\displaystyle\|(M_{m}\otimes I)|\Phi\rangle\|^{2} =(MmI)|Φ¯+(MmI)(|Φ|Φ¯)2\displaystyle=\|(M_{m}\otimes I)|\overline{\Phi}\rangle+(M_{m}\otimes I)(|\Phi\rangle-|\overline{\Phi}\rangle)\|^{2}
(MmI)|Φ¯2+(MmI)(|Φ|Φ¯)2\displaystyle\leq\|(M_{m}\otimes I)|\overline{\Phi}\rangle\|^{2}+\|(M_{m}\otimes I)(|\Phi\rangle-|\overline{\Phi}\rangle)\|^{2}
(MmI)|Φ¯2+|Φ|Φ¯2\displaystyle\leq\|(M_{m}\otimes I)|\overline{\Phi}\rangle\|^{2}+\||\Phi\rangle-|\overline{\Phi}\rangle\|^{2}
(MmI)|Φ¯2+22t1,\displaystyle\leq\|(M_{m}\otimes I)|\overline{\Phi}\rangle\|^{2}+2^{-2t_{1}},

where we used Lemma 3.1 to derive the last inequality (remember that we are taking k=2t+t1+1k=2t+t_{1}+1). Combined with (3), this implies that with probability at least 0.99/222t10.99/2-2^{-2t_{1}} the output of Est(UU, |π|0τ|\pi\rangle|0^{\tau}\rangle, tt) satisfies the condition |yφ/π|2t1|y-\varphi/\pi|\leq 2^{-t_{1}}, and with probability at least 0.99/222t10.99/2-2^{-2t_{1}} it satisfies the condition |y+φ/π|2t1|y+\varphi/\pi|\leq 2^{-t_{1}}. It follows from this condition that ||y|φ/π|2t1\big{|}|y|-\varphi/\pi\big{|}\leq 2^{-t_{1}} holds with probability at least 0.99212t10.99-2^{1-2t_{1}}, since φ0\varphi\geq 0. Assume that this inequality holds. Then |φ|y|π|=π|φπ|y||2t1π\bigl{|}\varphi-|y|\pi\bigr{|}=\pi\left|\frac{\varphi}{\pi}-|y|\right|\leq 2^{-t_{1}}\pi. Notice that for any α,β\alpha,\beta\in\mathbb{R}, |sinαsinβ||αβ||\sin{\alpha}-\sin{\beta}|\leq|\alpha-\beta| by the mean value theorem. We thus have

|pMsin(|y|π)|\displaystyle\left|\sqrt{p_{M}}-\sin{(|y|\pi)}\right| =|sinφsin(|y|π)|\displaystyle=\big{|}\sin{\varphi}-\sin{(|y|\pi)}\big{|}
|φ|y|π|\displaystyle\leq\bigl{|}\varphi-|y|\pi\bigr{|}
<2t1π\displaystyle<2^{-t_{1}}\pi
25ϵλ\displaystyle\leq\frac{2}{5}\epsilon\sqrt{\lambda}

and it follows that

|M^M|\displaystyle|\hat{M}-M| =|Nsin2(|y|π)NpM|\displaystyle=\left|N\sin^{2}(|y|\pi)-Np_{M}\right|
=N|(pMsin(|y|π))2+2pMsin(|y|π)2pM|\displaystyle=N\left|(\sqrt{p_{M}}-\sin(|y|\pi))^{2}+2\sqrt{p_{M}}\sin(|y|\pi)-2p_{M}\right|
N(|pMsin(|y|π)|2+2pM|pMsin(|y|π)|)\displaystyle\leq N\left(\left|\sqrt{p_{M}}-\sin(|y|\pi)\right|^{2}+2\sqrt{p_{M}}\left|\sqrt{p_{M}}-\sin(|y|\pi)\right|\right)
<((25ϵλ)2+2pM25ϵλ)N\displaystyle<\left(\left(\frac{2}{5}\epsilon\sqrt{\lambda}\right)^{2}+2\sqrt{p_{M}}\cdot\frac{2}{5}\epsilon\sqrt{\lambda}\right)N
<2425ϵpMN\displaystyle<\frac{24}{25}\epsilon p_{M}N
<ϵM.\displaystyle<\epsilon M.

Complexity.

Under the framework presented in Section 2.2, the quantum state |π|\pi\rangle can be created using 𝖲\mathsf{S} queries, and the operator UU can be implemented using kδ𝖴+𝖢\frac{k}{\sqrt{\delta}}\mathsf{U}+\mathsf{C} queries. The operator UU is applied for O(2t)=O(1ϵ1λ)O(2^{t})=O(\frac{1}{\epsilon}\frac{1}{\sqrt{\lambda}}) times by the phase estimation algorithm. The overall complexity of Algorithm 2 is thus

O(𝖲+1ϵ1λ(kδ𝖴+𝖢))=O~(𝖲+1ϵ1λ(1δ𝖴+𝖢))O\left(\mathsf{S}+\frac{1}{\epsilon}\frac{1}{\sqrt{\lambda}}\left(\frac{k}{\sqrt{\delta}}\mathsf{U}+\mathsf{C}\right)\right)=\tilde{O}\left(\mathsf{S}+\frac{1}{\epsilon}\frac{1}{\sqrt{\lambda}}\left(\frac{1}{\sqrt{\delta}}\mathsf{U}+\mathsf{C}\right)\right)

queries, as claimed. ∎

From the argument above, we then obtain the following immediate corollary for any reversible ergodic Markov chain whose stationary distribution is not necessarily uniform.

Corollary 3.2.

Let PP be a reversible ergodic Markov chain, δ>0\delta>0 be the spectral gap of PP and λ>0\lambda>0 be a known lower bound on the fraction pMp_{M} of marked states of PP with respective to its stationary distribution. For any ϵ(0,1)\epsilon\in(0,1), there exists a quantum algorithm which outputs with high probability an estimate p^M\hat{p}_{M} such that |pMp^M|<ϵpM|p_{M}-\hat{p}_{M}|<\epsilon p_{M}, and uses

O~(𝖲+1ϵ1λ(1δ𝖴+𝖢))\tilde{O}\left(\mathsf{S}+\frac{1}{\epsilon}\frac{1}{\sqrt{\lambda}}\left(\frac{1}{\sqrt{\delta}}\mathsf{U}+\mathsf{C}\right)\right)

queries to the black box.

4 Application: Approximate Collision Counting

Consider two injective functions f,g:{1,2,,N}{1,2,,K}f,g:\{1,2,\dots,N\}\longrightarrow\{1,2,\dots,K\}, where K>NK>N, given as quantum oracles Uf,UgU_{f},U_{g}. More precisely, UfU_{f} and UgU_{g} act on log2(N)+log2(K)\lceil\log_{2}(N)\rceil+\lceil\log_{2}(K)\rceil qubits and are defined as follows: for any i{1,2,,N}i\in\{1,2,\dots,N\} and any a{1,2,,K}a\in\{1,2,\dots,K\},

Uf:|i|a\displaystyle U_{f}\colon|i\rangle|a\rangle |i|af(i),\displaystyle\mapsto|i\rangle|a\oplus f(i)\rangle,
Ug:|i|a\displaystyle U_{g}\colon|i\rangle|a\rangle |i|ag(i),\displaystyle\mapsto|i\rangle|a\oplus g(i)\rangle,

where we are interpreting integers as binary strings (via some fixed encoding), and \oplus denotes the bit-wise parity. Let mm be the number of collisions, i.e., m=|{(i,j){1,,N}×{1,,N}:f(i)=g(j)}|m=|\{(i,j)\in\{1,\dots,N\}\times\{1,\dots,N\}:f(i)=g(j)\}|. In this section we show how to use Theorem 1.1 to approximate mm.

Define DD to be the disjoint union of the domain of ff and the domain of gg. Note that |D|=2N|D|=2N. For convenience, we will later identify DD with the set {1,,N}×{0,1}\{1,\dots,N\}\times\{0,1\}. Similarly to Ambainis’s algorithm for element distinctness [2], we consider a Johnson graph GrG_{r} determined by a parameter r{1,2,,2N}r\in\{1,2,\dots,2N\}, which is defined by V(Gr)={SD:|S|=r}V(G_{r})=\{S\subset D:|S|=r\} and E(Gr)={ST:|ST|=r+1}E(G_{r})=\{ST:|S\cup T|=r+1\}. Then |V(Gr)|=(2Nr)|V(G_{r})|=\binom{2N}{r}. We say a vertex SS in GrG_{r} is marked if it contains a collision, i.e., there exist (i,0),(j,1)S(i,0),(j,1)\in S such that f(i)=g(j)f(i)=g(j). Denote the Markov chain corresponding to the random walk on GrG_{r} by PG,rP_{G,r}. We identify the states of PG,rP_{G,r} with the vertices of GrG_{r}.

By the principle of inclusion and exclusion, the number of marked vertices in GrG_{r} is

Mr=j=1m(1)j+1(mj)(2N2jr2j)=m(2N2r2)+j=2m(1)j+1(mj)(2N2jr2j).M_{r}=\sum_{j=1}^{m}(-1)^{j+1}\binom{m}{j}\binom{2N-2j}{r-2j}=m\binom{2N-2}{r-2}+\sum_{j=2}^{m}(-1)^{j+1}\binom{m}{j}\binom{2N-2j}{r-2j}.

Define j(mj)(2N2jr2j)\ell_{j}\coloneqq\binom{m}{j}\binom{2N-2j}{r-2j}, Rjj+1jR_{j}\coloneqq\frac{\ell_{j+1}}{\ell_{j}} and R01R_{0}\coloneqq 1. Then

Mr=j=1m(1)j+1j=1i=0m1((1)ij=0iRj).M_{r}=\sum_{j=1}^{m}(-1)^{j+1}\ell_{j}=\ell_{1}\sum_{i=0}^{m-1}\left((-1)^{i}\displaystyle\prod_{j=0}^{i}R_{j}\right).

Observe that RjRj+1R_{j}\geq R_{j+1} for j=0,,m2{j=0,\dots,m-2}.

The following lemma characterizes the relation between an approximation of MrM_{r} and an approximation of mm.

Lemma 4.1.

Let ϵ(0,1]\epsilon\in(0,1] and r{2,3,,2N}r\in\{2,3,\dots,2N\} be such that R1=m12(r2)(r3)(2N2)(2N3)<ϵ2R_{1}=\frac{m-1}{2}\frac{(r-2)(r-3)}{(2N-2)(2N-3)}<\sqrt{\frac{\epsilon}{2}} holds. Define R=mup12(r2)(r3)(2N2)(2N3)R^{\prime}=\frac{m_{\text{up}}-1}{2}\frac{(r-2)(r-3)}{(2N-2)(2N-3)} and assume that RϵR^{\prime}\leq\sqrt{\epsilon}, where mupm_{\text{up}} is an upper bound of mm. Then for any value M^r\hat{M}_{r} that satisfies the condition |MrM^r|<ϵ3Mr|M_{r}-\hat{M}_{r}|<\frac{\epsilon}{3}M_{r}, the inequality

|m1+R(2N2r2)M^r|<ϵm\left|m-\frac{1+R^{\prime}}{\binom{2N-2}{r-2}}\hat{M}_{r}\right|<\epsilon m

holds.

Proof of Lemma 4.1..

From the definitions of RjR_{j} and RR^{\prime}, we have Rj+1Rj1R_{j+1}\leq R_{j}\leq 1 for j=0,,m2{j=0,\dots,m-2} and R1RR_{1}\leq R^{\prime}. Then

|m1+R(2N2r2)Mr|\displaystyle\left|m-\frac{1+R^{\prime}}{\binom{2N-2}{r-2}}M_{r}\right| =|m1+R(2N2r2)1i=0m1((1)ij=0iRj)|\displaystyle=\left|m-\frac{1+R^{\prime}}{\binom{2N-2}{r-2}}\ell_{1}\sum_{i=0}^{m-1}\left((-1)^{i}\prod_{j=0}^{i}R_{j}\right)\right|
=m|1(1+R)(1R1+R1R2)|\displaystyle=m\left|1-(1+R^{\prime})(1-R_{1}+R_{1}R_{2}-\cdots)\right|
m|R12(1+R)R1R2(1R3+)|\displaystyle\leq m\left|R_{1}^{2}-(1+R^{\prime})R_{1}R_{2}(1-R_{3}+\cdots)\right|
mR12\displaystyle\leq mR_{1}^{2}
ϵ2m.\displaystyle\leq\frac{\epsilon}{2}m.

Hence 1+R(2N2r2)Mrm(1+ϵ2)\frac{1+R^{\prime}}{\binom{2N-2}{r-2}}M_{r}\leq m\left(1+\frac{\epsilon}{2}\right), and

|m1+R(2N2r2)M^r|\displaystyle\left|m-\frac{1+R^{\prime}}{\binom{2N-2}{r-2}}\hat{M}_{r}\right| |m1+R(2N2r2)Mr|+1+R(2N2r2)|MrM^r|\displaystyle\leq\left|m-\frac{1+R^{\prime}}{\binom{2N-2}{r-2}}M_{r}\right|+\frac{1+R^{\prime}}{\binom{2N-2}{r-2}}\left|M_{r}-\hat{M}_{r}\right|
<ϵ2m+1+R(2N2r2)ϵ3Mr\displaystyle<\frac{\epsilon}{2}m+\frac{1+R^{\prime}}{\binom{2N-2}{r-2}}\frac{\epsilon}{3}M_{r}
ϵ2m+m(1+ϵ2)ϵ3\displaystyle\leq\frac{\epsilon}{2}m+m(1+\frac{\epsilon}{2})\frac{\epsilon}{3}
ϵm(12+13+16)\displaystyle\leq\epsilon m(\frac{1}{2}+\frac{1}{3}+\frac{1}{6})
=ϵm,\displaystyle=\epsilon m,

as claimed. ∎

We are now ready to give the proof of Theorem 1.2.

Proof of Theorem 1.2..

We first compute a constant-factor approximation of the number of collision mm. Concretely, we can use Algorithm 4 in Appendix B with the lower bound m¯\bar{m} to obtain a value m^1\hat{m}_{1} such that |mm^1|<m/2|m-\hat{m}_{1}|<m/2, i.e., such that m/2<m^1<3m/2m/2<\hat{m}_{1}<3m/2 or, equivalently, 2m^1/3<m<2m^12\hat{m}_{1}/3<m<2\hat{m}_{1}. Denote 2m^1/3\left\lfloor 2\hat{m}_{1}/3\right\rfloor and 2m^1\left\lceil 2\hat{m}_{1}\right\rceil by mlowm_{\text{low}} and mupm_{\text{up}}, respectively.

Let rr be a positive integer satisfying the conditions R1<ϵ2R_{1}<\sqrt{\frac{\epsilon}{2}} and RϵR^{\prime}\leq\sqrt{\epsilon} (the choice of rr will be discussed later). Take

λ=1|V(Gr)|j=1mlow(1)j+1(mlowj)(2N2jr2j)pM,r.\lambda=\frac{1}{|V(G_{r})|}\sum_{j=1}^{m_{\text{low}}}(-1)^{j+1}\binom{m_{\text{low}}}{j}\binom{2N-2j}{r-2j}\leq p_{M,r}.

Since GrG_{r} is a regular graph, the stationary distribution of PG,rP_{G,r} is uniform. It follows that applying Theorem 1.1 on PG,rP_{G,r} with ϵ/3\epsilon/3 and λ\lambda outputs with high probability a value M^r\hat{M}_{r} such that |MrM^r|<ϵ3Mr{|M_{r}-\hat{M}_{r}|<\frac{\epsilon}{3}M_{r}} using

O~(𝖲+1ϵ1λ(1δ𝖴+𝖢))\tilde{O}\left(\mathsf{S}+\frac{1}{\epsilon}\frac{1}{\sqrt{\lambda}}\left(\frac{1}{\sqrt{\delta}}\mathsf{U}+\mathsf{C}\right)\right)

queries. Then we output m^=1+R(2N2r2)M^r\hat{m}=\frac{1+R^{\prime}}{\binom{2N-2}{r-2}}\hat{M}_{r}. Lemma 4.1 guarantees that |mm^|<ϵm|m-\hat{m}|<\epsilon m when |MrM^r|<ϵ3Mr{|M_{r}-\hat{M}_{r}|<\frac{\epsilon}{3}M_{r}} holds.

Complexity.

The spectral gap δr\delta_{r} of the Johnson graph GrG_{r} is such that δr=Θ(1/r)\delta_{r}=\Theta(1/r) (see for instance [2, 16]).

Applying Algorithm 4 costs O~((N/m¯)2/3)\tilde{O}\left(\left(N/\sqrt{\bar{m}}\right)^{2/3}\right) queries (see Theorem B.1).

In the main algorithm, the setup cost is 𝖲=r\mathsf{S}=r, the update cost 𝖴=2\mathsf{U}=2, and the checking cost 𝖢=0\mathsf{C}=0. Since m^1=Θ(m)\hat{m}_{1}=\Theta(m) and we chose λ\lambda as

λ=mlowr(r1)2N(2N1)(1j=2mlow(1)j(mlowj)mlow(2N2jr2j)(2N2r2)(2Nr))=Θ(mN2r2),\lambda=m_{\text{low}}\frac{r(r-1)}{2N(2N-1)}\left(1-\sum_{j=2}^{m_{\text{low}}}(-1)^{j}\frac{\binom{m_{\text{low}}}{j}}{m_{\text{low}}}\frac{\binom{2N-2j}{r-2j}}{\binom{2N-2}{r-2}\binom{2N}{r}}\right)=\Theta\left(\frac{m}{N^{2}}r^{2}\right),

the query complexity for the main algorithm is

O~(𝖲+1ϵ1λ(1δ𝖴+𝖢))=O~(r+1ϵNm1r).\tilde{O}\left(\mathsf{S}+\frac{1}{\epsilon}\frac{1}{\sqrt{\lambda}}\left(\frac{1}{\sqrt{\delta}}\mathsf{U}+\mathsf{C}\right)\right)=\tilde{O}\left(r+\frac{1}{\epsilon}\frac{N}{\sqrt{m}}\frac{1}{\sqrt{r}}\right).

We finally explain how to choose rr. Below we assume that ϵ>1/mup\epsilon>1/m_{\text{up}}. This assumption can be done without loss of generality since smaller values of ϵ\epsilon do not lead to better approximation of mm (since mm is an integer). For convenience we also assume that mupm_{\text{up}} is such that N/mup=Ω(logN)N/m_{\text{up}}=\Omega(\log N): for larger values of mupm_{\text{up}} we can simply use the classical algorithm from Appendix A.

Take r=Θ(ϵ1/12(Nmup)2/3)=Θ(ϵ1/12(Nm)2/3)r=\Theta\left(\epsilon^{1/12}\left(\frac{N}{\sqrt{m_{\text{up}}}}\right)^{2/3}\right)=\Theta\left(\epsilon^{1/12}\left(\frac{N}{\sqrt{m}}\right)^{2/3}\right) such that R1<ϵ/2R_{1}<\sqrt{\epsilon/2}, RϵR^{\prime}\leq\sqrt{\epsilon}, r1r\geq 1 and r2Nr\leq 2N. Such an rr exists since

Θ(mN2(ϵ1/12(Nm)2/3)2)\displaystyle\Theta\left(\frac{m}{N^{2}}\left(\epsilon^{1/12}\left(\frac{N}{\sqrt{m}}\right)^{2/3}\right)^{2}\right) =Θ(m1/3N2/3ϵ1/6)\displaystyle=\Theta\left(\frac{m^{1/3}}{N^{2/3}}\cdot\epsilon^{1/6}\right)
=O(1N1/3(logN)1/3ϵ1/6)\displaystyle=O\left(\frac{1}{N^{1/3}(\log N)^{1/3}}\cdot\epsilon^{1/6}\right)
=O(ϵ1/3(logN)1/3ϵ1/6)=O(ϵ1/2(logN)1/3)\displaystyle=O\left(\frac{\epsilon^{1/3}}{(\log N)^{1/3}}\cdot\epsilon^{1/6}\right)=O\left(\frac{\epsilon^{1/2}}{(\log N)^{1/3}}\right)

and

Θ(ϵ1/12(Nm)2/3)=Ω((1m)1/12(Nm)2/3)=Ω((Nm)2/3)=Ω((logN)2/3).\Theta\left(\epsilon^{1/12}\left(\frac{N}{\sqrt{m}}\right)^{2/3}\right)=\Omega\left(\left(\frac{1}{m}\right)^{1/12}\left(\frac{N}{\sqrt{m}}\right)^{2/3}\right)=\Omega\left(\left(\frac{N}{m}\right)^{2/3}\right)=\Omega\left((\log N)^{2/3}\right).

(The third condition r2Nr\leq 2N is trivially satisfied.) For this choice of rr the complexity of the main algorithm becomes O~(1ϵ25/24(Nm)2/3)\tilde{O}\left(\frac{1}{\epsilon^{25/24}}\left(\frac{N}{\sqrt{m}}\right)^{2/3}\right).

The overall query complexity (including the complexity of computing the constant-factor approximation) is

O~(1ϵ25/24(Nm)2/3+(Nm¯)2/3),\tilde{O}\left(\frac{1}{\epsilon^{25/24}}\left(\frac{N}{\sqrt{m}}\right)^{2/3}+\left(\frac{N}{\sqrt{\bar{m}}}\right)^{2/3}\right),

as claimed. ∎

Acknowledgments

FLG was supported by JSPS KAKENHI grants Nos. JP19H04066, JP20H05966, JP20H00579, JP20H04139, JP21H04879 and MEXT Quantum Leap Flagship Program (MEXT Q-LEAP) grants No. JPMXS0118067394 and JPMXS0120319794.

References

  • [1] Scott Aaronson and Patrick Rall “Quantum Approximate Counting, Simplified” In Proceedings of the 3rd Symposium on Simplicity in Algorithms (SOSA 2020), 2020, pp. 24–32 DOI: 10.1137/1.9781611976014.5
  • [2] Andris Ambainis “Quantum Walk Algorithm for Element Distinctness” In SIAM Journal on Computing 37.1, 2007, pp. 210–239 DOI: 10.1137/S0097539705447311
  • [3] Alexandr Andoni and Huy L. Nguyen “Near-Optimal Sublinear Time Algorithms for Ulam Distance” In Proceedings of the Twenty-First Annual ACM-SIAM Symposium on Discrete Algorithms (SODA 2010), 2010, pp. 76–86 DOI: 10.1137/1.9781611973075.8
  • [4] Tugkan Batu et al. “Testing Closeness of Discrete Distributions” In Journal of the ACM 60.1, 2013, pp. 4:1–4:25 DOI: 10.1145/2432622.2432626
  • [5] Gilles Brassard, Peter Høyer and Alain Tapp “Quantum Counting” In Proceedings of the 25th International Colloquium on Automata, Languages and Programming 1443, Lecture Notes in Computer Science, 1998, pp. 820–831 DOI: 10.1007/BFb0055105
  • [6] Harry Buhrman and Robert Špalek “Quantum verification of matrix products” In Proceedings of 17th Annual ACM-SIAM Symposium on Discrete Algorithms, 2006, pp. 880–889 DOI: 10.1145/1109557.1109654
  • [7] Richard Cleve, Artur Ekert, Chiara Macchiavello and Michele Mosca “Quantum algorithms revisited” In Proceedings of The Royal Society of London A 454, 1998, pp. 339–354 DOI: 10.1098/rspa.1998.0164
  • [8] Devdatt Dubhashi and Alessandro Panconesi “Concentration of Measure for the Analysis of Randomized Algorithms” Cambridge University Press, 2009
  • [9] Lov K. Grover “A Fast Quantum Mechanical Algorithm for Database Search” In Proceedings of the 28th Annual ACM Symposium on the Theory of Computing, 1996, pp. 212–219 DOI: 10.1145/237814.237866
  • [10] Stacey Jeffery, Robin Kothari and Frédéric Magniez “Nested Quantum Walks with Quantum Data Structures” In Proceedings of the 24th Annual ACM-SIAM Symposium on Discrete Algorithms, 2013, pp. 1474–1485 DOI: 10.1137/1.9781611973105.106
  • [11] Alexey Yu. Kitaev “Quantum measurements and the Abelian Stabilizer Problem” ArXiv:quant-ph/9511026, 1995
  • [12] François Le Gall “Improved Quantum Algorithm for Triangle Finding via Combinatorial Arguments” In Proceedings of the 55th IEEE Annual Symposium on Foundations of Computer Science, 2014, pp. 216–225 DOI: 10.1109/FOCS.2014.31
  • [13] François Le Gall and Saeed Seddighin “Quantum Meets Fine-grained Complexity: Sublinear Time Quantum Algorithms for String Problems” In 13th Innovations in Theoretical Computer Science Conference (ITCS 2022) 215, LIPIcs, 2022, pp. 97:1–97:23 DOI: 10.4230/LIPIcs.ITCS.2022.97
  • [14] Troy Lee, Frédéric Magniez and Miklos Santha “Improved Quantum Query Algorithms for Triangle Detection and Associativity Testing” In Algorithmica 77.2, 2017, pp. 459–486 DOI: 10.1007/s00453-015-0084-9
  • [15] Frédéric Magniez, Miklos Santha and Mario Szegedy “Quantum Algorithms for the Triangle Problem” In SIAM Journal on Computing 37.2, 2007, pp. 413–424 DOI: 10.1137/050643684
  • [16] Frédéric Magniez, Ashwin Nayak, Jérémie Roland and Miklos Santha “Search via Quantum Walk” In SIAM Journal on Computing 40.1, 2011, pp. 142–164 DOI: 10.1137/090745854
  • [17] Timothy Naumovitz, Michael E. Saks and C. Seshadhri “Accurate and Nearly Optimal Sublinear Approximations to Ulam Distance” In Proceedings of the Twenty-Eighth Annual ACM-SIAM Symposium on Discrete Algorithms (SODA 2017), 2017, pp. 2012–2031 DOI: 10.1137/1.9781611974782.131
  • [18] Ashwin Nayak and Felix Wu “The Quantum Query Complexity of Approximating the Median and Related Statistics” In Proceedings of the Thirty-First Annual ACM Symposium on Theory of Computing (STOC 1999), 1999, pp. 384–393 DOI: 10.1145/301250.301349
  • [19] Michael A. Nielsen and Isaac L. Chuang “Quantum Computation and Quantum Information (10th Anniversary edition)” Cambridge University Press, 2016
  • [20] Yohichi Suzuki et al. “Amplitude estimation without phase estimation” In Quantum Information Processing 19, 2020, pp. article 75 DOI: 10.1007/s11128-019-2565-2
  • [21] Mario Szegedy “Quantum Speed-Up of Markov Chain Based Algorithms” In Proceedings of the 45th Symposium on Foundations of Computer Science (FOCS 2004), 2004, pp. 32–41 DOI: 10.1109/FOCS.2004.53
  • [22] Paul Valiant “Testing Symmetric Properties of Distributions” In SIAM Journal on Computing 40.6, 2011, pp. 1927–1968 DOI: 10.1137/080734066
  • [23] Ramgopal Venkateswaran and Ryan O’Donnell “Quantum Approximate Counting with Nonadaptive Grover Iterations” In Proceedings of the 38th International Symposium on Theoretical Aspects of Computer Science (STACS 2021) 187, LIPIcs, 2021, pp. 59:1–59:12 DOI: 10.4230/LIPIcs.STACS.2021.59
  • [24] Chu-Ryang Wie “Simpler quantum counting” In Quantum Information & Computation 19.11&12, 2019, pp. 0967–0983 DOI: 10.26421/QIC19.11-12-5

Appendix A Classical Algorithm for Approximate Collision Counting

In this appendix we describe the “folklore” classical algorithm based on random sampling for approximating the number of collisions mm of two injective functions f,g:{1,,N}{1,,K}f,g\colon\{1,\ldots,N\}\to\{1,\ldots,K\}, which has been used implicitly in [3, 17]. More precisely, we show that given a lower bound m¯m\bar{m}\leq m, there exists a randomized algorithm which outputs a value m^\hat{m} such that |mm^|<ϵm|m-\hat{m}|<\epsilon m holds with high probability, using

O(1ϵNm+Nm¯)O\left(\frac{1}{\epsilon}\frac{N}{\sqrt{m}}+\frac{N}{\sqrt{\bar{m}}}\right)

evaluations of ff and gg.

Let us write Nf,Ng={1,,N}N_{f},N_{g}=\{1,\ldots,N\}. The main procedure, which is parametrized by a real number p(0,1)p\in(0,1), is given as Algorithm 3 below.

1 Sf,SgS_{f},S_{g}\leftarrow\emptyset.
2 for each ifNfi_{f}\in N_{f} do
3      include ifi_{f} to SfS_{f} with probability pp.
4for each igNgi_{g}\in N_{g} do
5      include igi_{g} to SgS_{g} with probability pp.
6for each ifSfi_{f}\in S_{f} do
7      query f(if)f(i_{f}).
8for each igSgi_{g}\in S_{g} do
9      query g(ig)g(i_{g}).
10Compute the number mSm_{S} of collisions in Sf×SgS_{f}\times S_{g}.
Output m^=mSp2\hat{m}=\frac{m_{S}}{p^{2}}.
Algorithm 3 Classical Approximate Collision Counting (here p(0,1)p\in(0,1) is a parameter)

The complexity of Algorithm 3 is O(|Sf|+|Sg|)O(|S_{f}|+|S_{g}|) queries. Since the expected value of the size of these sets is E[|Sf|+|Sg|]=2Np\operatorname{E}[|S_{f}|+|S_{g}|]=2Np, the expected query complexity of Algorithm 3 is O(Np)O(Np). We now analyze its correctness.

Lemma A.1.

If p1ϵ3mlog2νp\geq\frac{1}{\epsilon}\sqrt{\frac{3}{m}\log{\frac{2}{\nu}}} for some ν\nu, then with probability at least 1ν1-\nu the output m^\hat{m} of Algorithm 3 is such that |mm^|<ϵm|m-\hat{m}|<\epsilon m.

Proof.

Since each element is included into SfS_{f} or SgS_{g} with probability pp, the probability for a collision pair to be included is p2p^{2}. Then the expected value of the number of collisions jj in Sf×SgS_{f}\times S_{g} is E[j]=mp2\operatorname{E}[j]=mp^{2}. With m=jp2=jE[j]mm^{\prime}=\frac{j}{p^{2}}=\frac{j}{\operatorname{E}[j]}m, the condition |mm|<ϵm|m-m^{\prime}|<\epsilon m is established if and only if |jE[j]1|<ϵ|\frac{j}{\operatorname{E}[j]}-1|<\epsilon holds. By the use of Chernoff-Hoeffding bound [8] we have

Pr[jE[j]>(1+ϵ)]\displaystyle\operatorname{Pr}\left[\frac{j}{\operatorname{E}[j]}>(1+\epsilon)\right] eϵ23E[j].\displaystyle\leq e^{-\frac{\epsilon^{2}}{3}\operatorname{E}[j]}.
Pr[jE[j]<(1ϵ)]\displaystyle\operatorname{Pr}\left[\frac{j}{\operatorname{E}[j]}<(1-\epsilon)\right] eϵ22E[j].\displaystyle\leq e^{-\frac{\epsilon^{2}}{2}\operatorname{E}[j]}.

If p1ϵ3mlog2νp\geq\frac{1}{\epsilon}\sqrt{\frac{3}{m}\log{\frac{2}{\nu}}} for some ν\nu, then ν2eϵ23mp2=2eϵ23E[j]\nu\geq 2e^{-\frac{\epsilon^{2}}{3}mp^{2}}=2e^{-\frac{\epsilon^{2}}{3}\operatorname{E}[j]}, which implies that the probability of success is at least 1ν1-\nu if p1ϵ3mlog2νp\geq\frac{1}{\epsilon}\sqrt{\frac{3}{m}\log{\frac{2}{\nu}}}. ∎

We now describe the whole algorithm. Let δ\delta be a small constant. First, we apply Algorithm 3 with

p=1ϵ03m¯log2δ/2p=\frac{1}{\epsilon_{0}}\sqrt{\frac{3}{\bar{m}}\log{\frac{2}{\delta/2}}}

for a constant ϵ0>0\epsilon_{0}>0. It outputs m^1\hat{m}_{1} such that |mm^1|<ϵ0|m-\hat{m}_{1}|<\epsilon_{0} with probability at least 1δ/21-\delta/2. Then we apply Algorithm 3 with

p=1ϵ3m^1log2δ/2.p=\frac{1}{\epsilon}\sqrt{\frac{3}{\hat{m}_{1}}\log{\frac{2}{\delta/2}}}.

It outputs m^\hat{m} such that |mm^|<ϵm|m-\hat{m}|<\epsilon m with probability at least 1δ/21-\delta/2. The overall expected query complexity is

O(1ϵNm(log1δ)1/2+Nm¯(log1δ)1/2),O\left(\frac{1}{\epsilon}\frac{N}{\sqrt{m}}\left(\log\frac{1}{\delta}\right)^{1/2}+\frac{N}{\sqrt{\bar{m}}}\left(\log\frac{1}{\delta}\right)^{1/2}\right),

and the probability of success is at least (1δ/2)(1δ/2)1δ(1-\delta/2)(1-\delta/2)\geq 1-\delta. This upper bound on the expected query complexity can be converted into an upper bound on the worst-case query complexity using a tail bound.

Note that the dependence on NN and mm in the above complexity is optimal. Indeed, by an argument similar to the argument used in the proof of Lemma A.1, it is easy to show that Ω(N/m)\Omega(N/\sqrt{m}) queries are necessary to hit a collision.

Appendix B Quantum Constant-Factor Approximate Collision Counting

In this appendix we describe a simple algorithm that uses Ambainis’ element distinctness algorithm [2] instead of the classical strategy of Steps 6-10 of Algorithm 3, and computes a constant-factor approximation of the number of collisions mm using O~((N/m¯)2/3)\tilde{O}((N/\sqrt{\bar{m}})^{2/3}) queries. Here is the formal statement of our result (again we assume that a lower bound m¯m\bar{m}\leq m is known and state the complexity in term of m¯\bar{m}).

Theorem B.1.

There exists a quantum algorithm that uses O~((N/m¯)2/3)\tilde{O}((N/\sqrt{\bar{m}})^{2/3}) queries and outputs with probability at least 11/poly(N)1-1/\textrm{poly}(N) an estimator m^\hat{m} such that |mm^|m/2|m-\hat{m}|\leq m/2.

The quantum algorithm is described as Algorithm 4 below, where again we write Nf,Ng={1,,N}N_{f},N_{g}=\{1,\ldots,N\}.

1 m^0\hat{m}\leftarrow 0, p23Nlog(2N)p\leftarrow 2\sqrt{\frac{3}{N}\log{(2N)}}.
2 while p<43m¯log(2N)p<4\sqrt{\frac{3}{\bar{m}}\log{(2N)}} do
3       Sf,SgS_{f},S_{g}\leftarrow\emptyset.
4       for each ifNfi_{f}\in N_{f} do
5            include ifi_{f} to SfS_{f} with probability pp.
6      for each igNgi_{g}\in N_{g} do
7            include igi_{g} to SgS_{g} with probability pp.
8      if |Sf|10logNNp|S_{f}|\leq 10\log N\cdot Np and |Sg|10logNNp|S_{g}|\leq 10\log N\cdot Np then
9            Compute the number mSm_{S} of collisions in Sf×SgS_{f}\times S_{g}.
10             if mS<100(logN)2m_{S}<\lfloor 100(\log N)^{2}\rfloor then
11                  m^mSp2\hat{m}\leftarrow\frac{m_{S}}{p^{2}}.
12            
13      p2pp\leftarrow 2p.
Output m^\hat{m}.
Algorithm 4 Quantum Constant-Factor Approximate Collision Counting

At Steps 9-10, observe that we actually only need to check whether mS<100(logN)2m_{S}<\lfloor 100(\log N)^{2}\rfloor holds. We thus simply apply Ambainis’ element distinctness algorithm [2] consecutively k=100(logN)2k=\lfloor 100(\log N)^{2}\rfloor times, removing the collisions as soon as they are discovered, and check if we obtain strictly less than kk collisions, in which case we decide that mS<100(logN)2m_{S}<\lfloor 100(\log N)^{2}\rfloor. The complexity of Steps 9-10 is thus O~((|Sf|+|Sg|)2/3)=O~((Np)2/3)=O~((N/m¯)2/3)\tilde{O}((|S_{f}|+|S_{g}|)^{2/3})=\tilde{O}((Np)^{2/3})=\tilde{O}((N/\sqrt{\bar{m}})^{2/3}) queries. Since Steps 9-10 are repeated O(logN)O(\log N) times, and all other steps can be implemented without any queries, the overall query complexity of Algorithm 4 is O~((N/m¯)2/3)\tilde{O}((N/\sqrt{\bar{m}})^{2/3}).

We now analyze the correctness of the algorithm. First, observe that since E[|Sf|]=E[|Sg|]=Np\operatorname{E}[|S_{f}|]=\operatorname{E}[|S_{g}|]=Np, the two conditions of Step 8 hold with probability at least 11/poly(N)1-1/\textrm{poly}(N), from Chernoff bound. Since the success probability of Ambainis’ element distinctness algorithm can also be made larger than 11/poly(N)1-1/\textrm{poly}(N) (e.g., by repeating Ambainis’ algorithm O(logN)O(\log N) times), the implementation of test of Step 10 described in the previous paragraph is correct with probability at least 11/poly(N)1-1/\textrm{poly}(N). Below, we assume that the two conditions of Step 8 hold and that the test of Step 10 is implemented correctly, and show that Algorithm 4 outputs with high probability a good approximation of mm under these assumptions.

Lemma A.1 guarantees that as soon as the inequality

p23mlog(2N)p\geq 2\sqrt{\frac{3}{m}\log{(2N)}} (4)

becomes true, the number of collisions mSm_{S} at Step 10 satisfies |mmS/p2|<m/2|m-m_{S}/p^{2}|<m/2 with probability at least 11/N1-1/N. Inequality (4) necessary becomes true during the while loop of Algorithm 4 and once it becomes true, it remains true for all the subsequent values of pp. Let p0p_{0} denote the first value taken by pp during the while loop such the Inequality (4) holds. The correctness of Algorithm 4 then follows from the following lemma.

Lemma B.2.

For the value p=p0p=p_{0}, we have

Pr[mS<100(logN)2]11/poly(N).\Pr[m_{S}<\lfloor 100(\log N)^{2}]\geq 1-1/\textrm{poly}(N).
Proof.

Notice that p0[ 23mlog(2N), 43mlog(2N))p_{0}\in\left[\>2\sqrt{\frac{3}{m}\log{(2N)}},\>4\sqrt{\frac{3}{m}\log{(2N)}}\>\right). The expected value of mSm_{S} is thus

E[mS]=mp0248log(2N)\operatorname{E}[m_{S}]=mp_{0}^{2}\leq 48\log{(2N)}

and the claim follows from Chernoff bound. ∎