††thanks: Corresponding author<EMAIL_ADDRESS>
# Reductive Quantum Phase Estimation

Nicholas J.C. Papadopoulos  JILA, NIST, and Department of Physics, University
of Colorado, 440 UCB, Boulder, CO 80309, USA  Department of Computer Science,
University of Colorado, 440 UCB, Boulder, CO 80309, USA  Jarrod T. Reilly
JILA, NIST, and Department of Physics, University of Colorado, 440 UCB,
Boulder, CO 80309, USA  John Drew Wilson  JILA, NIST, and Department of
Physics, University of Colorado, 440 UCB, Boulder, CO 80309, USA  Murray J.
Holland  JILA, NIST, and Department of Physics, University of Colorado, 440
UCB, Boulder, CO 80309, USA

###### Abstract

Estimating a quantum phase is a necessary task in a wide range of fields of
quantum science. To accomplish this task, two well-known methods have been
developed in distinct contexts, namely, Ramsey interferometry (RI) in atomic
and molecular physics and quantum phase estimation (QPE) in quantum computing.
We demonstrate that these canonical examples are instances of a larger class
of phase estimation protocols, which we call reductive quantum phase
estimation (RQPE) circuits. Here we present an explicit algorithm that allows
one to create an RQPE circuit. This circuit distinguishes an arbitrary set of
phases with a fewer number of qubits and unitary applications, thereby solving
a general class of quantum hypothesis testing to which RI and QPE belong. We
further demonstrate a trade-off between measurement precision and phase
distinguishability, which allows one to tune the circuit to be optimal for a
specific application.

##  I Introduction

For over a century, physics has benefited greatly from exploiting interference
effects between waves [1, 2]. In particular, the accurate estimation of a
relative phase between parts of a wavefunction is a pivotal task in numerous
fields of quantum physics and quantum computing. For example, the central goal
of quantum metrology is to construct experimental platforms capable of making
high-precision measurements of the quantum phase that correspond to a physical
parameter [3, 4, 5]. Progress in this area has led to the development of
quantum sensors that have then been used in a wide range of groundbreaking
technologies, from atomic clocks [6, 7] to medical devices [8, 9]. In quantum
information science, there exist important algorithms that seek to calculate
the quantum phase as precisely as possible in a single measurement. This can
be used to find the eigenvalues of a unitary operator, thereby allowing one to
perform computations such as matrix inversion and modular multiplication with
a quantum advantage [10, 11, 12]. For example, it is a crucial step in the
Harrow-Hassidim-Lloyd linear system of equations algorithm [13, 14] as well as
the crux of Shor’s algorithm for prime factorization [10, 15].

Due to the far-reaching impact of estimating a quantum phase, various
techniques have been developed to accomplish this task. For example, in
quantum metrology the standard method is Ramsey interferometry (RI) [16]. In
RI, with a direct correspondence to optical interferometers, a single qubit is
split into a coherent superposition, undergoes unitary encoding of a phase,
and is then recombined (see Fig. 3(a)). The alternate approach used in quantum
computation is founded on Kitaev’s quantum phase estimation (QPE) algorithm
[17, 10, 18], which aims to determine the correct phase from a discrete set of
possibilities in a single run of a multi-qubit quantum circuit. The QPE
algorithm consists of conditional rotations to estimate the quantum phase over
small intervals of the Bloch sphere’s equator, and the intervals become
exponentially smaller as the number of qubits increases.

Many quantum algorithms have a phase estimation subroutine that ideally
estimates an encoded phase $\theta$ after a single run of the circuit. This
can be accomplished for phases where every qubit in the circuit has unit
probability of being in one of the computational basis states (i.e., the bare
eigenstates). The canonical QPE algorithm consisting of $n$ qubits can
discriminate between a set of $2^{n}$ phases evenly distributed throughout the
interval $[0,2\pi)$. However, there are important problems in quantum
hypothesis testing [19, 20, 21, 22, 23], a central pillar of modern quantum
information science research, where one wants to discriminate between a
certain discrete set of phases starting with a flat prior probability
distribution. In these situations, the QPE circuit is excessive with
potentially many unneeded qubits performing unnecessary rotations, increasing
the chance of errors to occur during the algorithm through both quantum and
classical noise. Furthermore, there are simple situations in which QPE would
actually require an infinite number of qubits to distinguish between two
phases with certainty after a single run of the circuit, such is the case with
$\theta=0$ and $\theta=\pi/3$.

In this paper, we present an algorithm that generates a phase estimation
circuit capable of perfectly discriminating between any set of phases with
certainty after a single run, given the phases are rational multiples of
$\pi$. This allows one to design a phase estimation circuit with fewer qubits
and unitary gates than QPE in many cases. This algorithm therefore develops a
more general class of phase estimation circuits that we call reductive quantum
phase estimation (RQPE), of which RI and QPE are special cases. We demonstrate
that RQPE circuits have a trade-off between phase measurement precision for
higher distinguishability of phases, which we show is an interpolation between
the canonical RI and QPE circuit. This allows one to tune a phase estimation
circuit to be optimized for a specific task.

The article is organized as follows. In Sec. II, we introduce an algorithm
that produces RQPE circuits and demonstrate its use for two illustrative
examples. Then in Sec. III, we analyze how to compare different RQPE circuits
with a cost-benefit analysis. We show relevant calculations for our analysis
of RQPE circuits in Appendix F.

##  II RQPE Generation Algorithm

We begin by presenting an algorithm that generates RQPE circuits. We consider
circuits consisting of a set of $n$ qubits, each prepared in the state
$\ket{0}$. We label the qubit states $\ket{q_{j}}$ with index $j$, and we
assume that one can perfectly perform instantaneous, noiseless gates and
measurements. The gates used in the RQPE algorithm are the Z gate
$Z_{j}=\outerproduct{0}{0}_{j}-\outerproduct{1}{1}_{j}$, powers of the Z gate
$Z^{p}_{j}=\outerproduct{0}{0}_{j}+e^{i\pi p}\outerproduct{1}{1}_{j}$, the
Hadamard gate
$H_{j}=(\outerproduct{0}{1}_{j}+\outerproduct{1}{0}_{j}+Z_{j})/\sqrt{2}$, and
powers of the controlled Z-gate with target $\ket{q_{j}}$ controlled by
$\ket{q_{k}}$:
$C\\!Z^{p}_{j,k}=\mathbb{I}_{j}\otimes\outerproduct{0}{0}_{k}+Z^{p}_{j}\otimes\outerproduct{1}{1}_{k}$.

The objective of quantum phase estimation is to accurately estimate an unknown
quantum phase $\theta$ using minimal resources. In this work, we assume the
phase is encoded by $Z$ rotations, such that $U_{j}=e^{-i\theta Z_{j}/2}$.
Note that we consider circuits that apply the phase shift directly onto the
control qubits through $U_{j}$, but our results extend to methods that apply
the phase shift using any controlled unitary acting on an ancillary register,
as is typically done in QPE [10].

We now present an algorithm that generates a circuit that, given some set of
phases, $\Theta$ with $|\Theta|=T$, which is some subset of $\\{\pi
f_{i}=\frac{\pi x_{i}}{d}:0\leq x_{i}<2d,x_{i}\in\mathbb{Z}\\}$ where
$\mathbb{Z}$ is the set of integers, allows one to determine the encoded phase
$\theta\in\Theta$ with certainty after a single run. Here, all $f_{i}$ are
rational and can therefore be rewritten with a common integer denominator $d$
and a set of numerators $S_{0}=\\{x_{i}\\}$. Starting with $i=0$, the circuit
generating algorithm consists of the sequence enumerated in Algorithm 1.

  1. (S1)

Set $G_{i}$ as the greatest common divisor (GCD) of the numerators $S_{i}$.

  2. (S2)

Set $Q_{i}$ as $\\{y=\frac{x}{G_{i}}:x\in S_{i}\\}$.

  3. (S3)

Set $A_{i}$ as the mode of the differences $y_{e}-y_{o}$ for all even
$y_{e}\in Q_{i}\cap 2\mathbb{Z}$ and odd $y_{o}\in Q_{i}\cap(2\mathbb{Z}+1)$
integers. If there are no even integers, $Q_{i}\cap 2\mathbb{Z}=\varnothing$,
$A_{i}$ is the minimum of $Q_{i}$.

  4. (S4)

Set $S_{i+1}$ equal to $Q_{i}$ with $A_{i}$ added to the resulting odd
integers: $S_{i+1}=\\{y_{e}:\forall y_{e}\in Q_{i}\cap
2\mathbb{Z}\\}\cup\\{y_{o}+A_{i}:\forall y_{o}\in
Q_{i}\cap(2\mathbb{Z}+1)\\}$.

  5. (S5)

Iterate (S1)-(S4) by incrementing $i$ until $S_{i+1}=\\{0\\}$.

List of algs 1 Steps of the circuit generating algorithm. Note that the set
theory notation ignores repeated elements.

To construct the circuit that distinguishes phases in $\Theta$ with certainty
after a single run, the gate sequence (see Appendix A)

$H_{j}\left(\prod_{k=0}^{j-1}{C\\!Z}_{j,k}^{\frac{A_{k}}{\prod_{\ell=k+1}^{j}G_{\ell}}}\right)U_{j}^{\frac{d}{\prod_{\ell=0}^{j}G_{\ell}}}H_{j}\ket{q_{j}},$
(1)

is applied on each $\ket{q_{j}}$. Here, the application of the $H$ and $C\\!Z$
gates across all qubits after the unitary applications is reminiscent of the
$QFT^{\dagger}$ gate (see Appendix H), $QFT$ standing for the quantum Fourier
transform, which can be found in Ref. [10]. Performing a measurement on
$\ket{q_{j}}$ produces a measurement outcome $m_{j}\in\\{0,1\\}$, and the
measurement of all $n$ qubits produces a binary string $m_{0}\ldots m_{n-1}$.
This binary string gives an estimation of $\theta$ (see Appendix B):

$\theta_{\mathrm{est}}=-\frac{\pi}{d}\sum_{j=0}^{n-1}m_{j}A_{j}\prod_{k=0}^{j}G_{k}.$
(2)

We note that RQPE circuits can be run sequentially on a single qubit that is
reset to $\ket{0}$ after performing each line of the circuit, and each
measurement effectively modifies the encoded phase in subsequent unitary
applications. The sequential approach is explored in more depth in Refs. [24,
25] and is effectively equivalent to the multi-qubit, parallel circuits
presented here. In Appendix C we analyze the time and space complexity of the
generated circuits from Eq. (1) as well as Algorithm 1. Here, we find that the
circuit generating algorithm runs in polynomial time with respect to $T$ and
$\log_{2}h$, where $h=\max[S_{0}]$, and the number of qubits needed is upper
bounded by $O(\min[T,\log_{2}h])$.

Figure 1: (a) Visualization of $\Theta=\\{\frac{\pi
x}{64}:x\in\\{21,22,64,65,107,108\\}\\}$ around the equator of the Bloch
sphere. (b) Application of Algorithm 1 to find $G_{i}$ and $A_{i}$ for all
iterations. (c) The circuit generated by Algorithm 1 by way of Eq. (1).

A common situation in which the RQPE circuits of Eq. (1) can be very useful
for hypothesis testing is systems where an external perturbation splits
degenerate energy levels. As an example, we consider a system in which
$\ket{1}$ is physically a $F=1$ hyperfine state while $\ket{0}$ is
$F^{\prime}=0$. Therefore, a magnetic field will cause a Zeeman energy shift
of the $\ket{F=1,m_{F}=\pm 1}$ states by $\pm\hbar\delta_{B}$. Each qubit thus
undergoes an additional rotation $\exp[im_{F}\delta_{B}Z_{i}t/2]$ for a run
time $t$, such that $\theta=\theta^{\prime}+m_{F}\delta_{B}t$. We therefore
may wish to distinguish between three locations on the Bloch sphere’s equator
to determine which transition is being driven, as shown in Fig. 1(a). We thus
use Algorithm 1 to create a circuit that can distinguish the set
$\Theta=\\{\frac{\pi x_{i}}{64}:x_{i}\in\\{21,22,64,65,107,108\\}\\}$ with
certainty after a single run. In Fig. 1(b), we show the outcome of the
iterations of Algorithm 1 for this particular set of phases.

In the first iteration, $i=0$, Algorithm 1 Steps (S1) and (S2) ensures some
odd numerators, enabling $\ket{q_{0}}$ to distinguish between all
$\theta_{0,e}$ from all $\theta_{0,o}$ within the set $\\{\frac{\pi
G_{0}x}{64}:0\leq x<\frac{128}{G_{0}},x\in\mathbb{Z}\\}$. Here, $j$ in
$\theta_{i,j}$ indicates whether $x$ is even or odd so that all $\theta_{i,e}$
measure 0 with certainty while all $\theta_{i,o}$ measure 1 with certainty on
$\ket{q_{i}}$. This is accomplished by the unitary rotation $U^{d/G_{0}}_{0}$
as it becomes $\exp[-ix_{i}\pi Z_{j}/(2G_{0})]$ with
$x_{i}/G_{0}\in\mathbb{Z}$. The goal of Step (S3) is to pick an addition
$A_{0}$ such that it reduces the size of the set of integers as much as
possible, i.e., it converts the maximum amount of odd integers to even
integers in the set. This addition dictates the controlled rotation on
subsequent qubits. Step (S4) then returns a new set of integers $S_{1}$ from
which one finds a new GCD, $G_{1}$, in the next iteration. This allows one to
distinguish between all $\theta_{1,e}$ from all $\theta_{1,o}$ within the set
$\\{\frac{\pi G_{1}G_{0}x}{64}:0\leq
x<\frac{128}{G_{1}G_{0}},x\in\mathbb{Z}\\}$. Step (S5) iterates this process
such that each iteration corresponds to a qubit in the generated circuit.

Using this reduction process in conjunction with Eq. (1), we produce the
circuit displayed in Fig. 1(c) to distinguish the phases in $\Theta$, where
the final symbol stands for an individual qubit measurement in the $Z$-basis.
Note that only four qubits are used to distinguish the desired phases in RQPE
with certainty after a single run. This can be compared to seven qubits needed
in QPE, since $2d=2^{7}$, demonstrating the utility of our circuit generation
algorithm. Furthermore, while running it once can determine which
$\theta\in\Theta$ is encoded, running it many times and using some statistical
analysis such as Bayes theorem [16, 26] reliably estimates any continuous
$\theta$ within the desired ranges.

Figure 2: (a) Visualization of $\Theta=\\{\frac{\pi
x}{70}:x\in\\{66,93,108,123,138\\}\\}$ around the equator of the Bloch sphere.
(b) Application of Algorithm 1 to find $G_{i}$ and $A_{i}$ for all iterations.
(c) The circuit generated by Algorithm 1 by way of Eq. (1) and removing
phantom qubits.

Another interesting feature of Algorithm 1 can be demonstrated with the
example shown in Fig. 2. Here, we use the circuit generation algorithm to
distinguish the phases $\Theta\in\\{\frac{\pi
x_{i}}{70}:x_{i}\in\\{66,93,108,123,138\\}\\}$ with certainty after a single
run. As shown in Fig. 2(b), we find a set of only odd numerators in the line
for $\ket{q_{2}}$. This ensures that, for all phases in $\Theta$, the qubit
$\ket{q_{2}}$ will always be in the $\ket{1}$ state when the measurement is
performed. Therefore, this qubit can be removed from the circuit while
$C\\!Z_{j,2}^{p}$ gates can be replaced with uncontrolled $Z_{j}^{p}$ gates.
When estimating the original theta, consider this qubit as if it had existed
and measured 1, i.e. $m_{2}=1$. We label $\ket{q_{2}}$ as a “phantom” qubit
and display the reduced circuit where we have removed the phantom qubit
$\ket{q_{2}}$ in Fig. 2(c). One can see that the last qubit in Fig. 1 is a
phantom qubit as well.

Removing a phantom qubit from a circuit does not decrease distinguishability
of the discrete phases in $\Theta$ and does not necessarily decrease
distinguishability of continuous phase estimation. We see, for example, that
it does not affect distinguishability within the desired ranges in Fig. 1.
Precision, on the other hand, will be affected due to Eq. (4).

##  III Trade-off Between Precision and Distinguishability

RQPE circuits can be compared by three key properties: the number of unitary
applications, distinguishability, and precision. Interestingly, the extremes
of this circuit generation algorithm create circuits for both RI and QPE, and
these serve as perfect examples to showcase these comparable properties. RI
will be automatically generated from Algorithm 1 when $|\Theta|=2$, the
smallest possible size, while QPE will be automatically generated when
$|\Theta|=2d$, the largest possible size. We display the circuit diagrams for
these procedures in Figs. 3(a) and 3(c).

Figure 3: Canonical phase estimation procedures. (a) RI circuit with the
corresponding Bloch sphere rotations. (b) The perfectly distinguishable phases
of RI with 7 unitary applications. (c) QPE circuit. (d) The perfectly
distinguishable phases of QPE with 3 qubits.

Figure 4: The conditional probability of (a) RI with 7 unitary applications
and (b) QPE with 3 qubits. The distance between phases $\theta_{a}$ and
$\theta_{b}$ calculated by Eq. (3) for (c) RI with 7 unitary applications and
(d) QPE with 3 qubits.

In order to compare circuits in general, we use the total number of unitary
applications, $r$, during a single run as the constrained resource. This can
be written as a sum over all qubits, $r=\sum_{j=0}^{n-1}u_{j}$, where $u_{j}$
represents the number of applications of $U_{j}$ to $\ket{q_{j}}$. In this
way, QPE has $r_{\text{QPE}}=2^{n}-1$, and RI has $r_{\text{RI}}=u_{0}$. One
way to compare an RI circuit to QPE would then be to set
$r_{\text{RI}}=r_{\text{QPE}}$, thereby applying $(U_{0})^{r_{\text{QPE}}}$ on
the qubit in RI, and compare the resulting precision and distinguishability.
We consider an optimal circuit to be one that minimizes the number of unitary
applications while achieving some desired precision and distinguishability, as
discussed in more detail in Appendix F.

Let $M_{k}$ be the measured binary string corresponding to the $n$-qubit
measurement outcome in the measurement basis
$\mathcal{M}=\\{M_{k}:k\in\mathbb{Z},0\leq k<2^{n}\\}$. If, for each
$\theta_{i}\in\Theta$, there exists a unique measurement outcome $M_{k}$ with
conditional probability $P(M_{k}\lvert\theta_{i})=1$, and for all
$\theta_{j}\in\Theta$ with $\theta_{j}\neq\theta_{i}$ the same measurement
outcome $M_{k}$ has conditional probability $P(M_{k}\lvert\theta_{j})=0$, then
we say the circuit perfectly distinguishes the set of phases $\Theta$, i.e.,
distinguishes them with certainty after a single run of the circuit.

In general, every phase estimation circuit has a unique set of phases which it
can perfectly distinguish. In RI, one can perfectly distinguish exactly $T=2$
phases, $\Theta=\\{0,\frac{\pi}{r_{\mathrm{RI}}}\\}$, as these are the points
where the Ramsey fringes reach their extremum values (see Fig. 4(a)). For the
example circuits we consider, this corresponds to
$\theta\in\\{0,\frac{\pi}{7}\\}$ on the equator of the Bloch sphere as shown
in Fig. 3(b). Conversely, the QPE algorithm can perfectly distinguish the
phases $\Theta=\\{\frac{\pi x}{2^{n-1}}:x\in\mathbb{Z},0\leq x<2^{n}\\}$, such
that $T=2^{n}$. This feature of QPE can be seen in Fig. 4(b), where one has
$T=8$ perfectly distinguishable phases corresponding to the eight possible
measurement outcomes for $n=3$ qubits. These perfectly distinguishable phases
are shown on the equator of the Bloch sphere in Fig. 3(d).

Using quantum state geometry (adapted from Eq. (1.57) in [27]), one can define
the distance between two phases, $\theta_{a}$ and $\theta_{b}$, using the
$l_{2}$-distance between conditional probabilities in a measurement basis
$\mathcal{M}$:

$\mathcal{D}_{\mathcal{M}}(\theta_{a},\theta_{b})=\sqrt{\frac{1}{2}\sum_{k=0}^{2^{n}-1}\left[P(M_{k}\lvert\theta_{a})-P(M_{k}\lvert\theta_{b})\right]^{2}}.$
(3)

When $\mathcal{D}_{\mathcal{M}}(\theta_{a},\theta_{b})=1$, this is the maximum
distance corresponding to two perfectly distinguishable phases, whereas
$\mathcal{D}_{\mathcal{M}}(\theta_{a},\theta_{b})=0$ corresponds to two phases
which cannot be distinguished. In Figs. 4(c) and 4(d), we compare RI and QPE
using the distance metric in Eq. (3) and measurements in the $Z$-basis.

While QPE has a larger range of distinguishable phases than RI, this is not
the only figure of merit that one wishes to optimize when performing phase
estimation. In the context of quantum metrology, one performs many runs of the
circuit to measure $\theta$ from a continuous set of phases,
$\Theta_{c}=\\{x\in\mathbb{R},0\leq x<2\pi\\}$, with greater and greater
accuracy. Therefore, another important metric of phase estimation circuits is
the precision. This is nicely encapsulated by the classical Fisher information
(CFI) [28] with a given measurement basis $\mathcal{I}(\theta|\mathcal{M})$,
as the maximal achievable precision over $R$ runs of the circuit is given by
the Cramér-Rao bound [29] $\Delta\theta^{2}\propto
1/\sqrt{R\mathcal{I}_{\mathcal{M}}}$. For the circuits we consider, the CFI
for the $Z$-basis is given by (see Appendix E)

$\mathcal{I}(\theta|\mathcal{M})=\sum_{j=0}^{n-1}u_{j}^{2}.$ (4)

One can see that the CFI is dominated by the qubit that has the largest number
of unitary applications. This $\max[u_{j}]$ in QPE is only on the order of
half of $\max[u_{j}]$ in RI when $r_{\mathrm{RI}}=r_{\mathrm{QPE}}$ because RI
has all of its unitary applications acting on a single qubit. Therefore, QPE
will have on the order of half as much precision given the same number of
unitary applications. This can be seen in Figs. 4(a) and 4(b) by the width of
the fringes.

In a general RQPE circuit with $n$ qubits, one can perfectly distinguish
$T\leq 2^{n}$ phases. However, the phases need not be evenly distributed
around the equator of the Bloch sphere, as is the case with QPE, since the
exponential on the unitary gate applications over subsequent qubits are not
restricted to powers of two. Therefore, there is a trade-off between
distinguishability and precision that can be tuned for a given parameter
estimation objective by employing different RQPE circuits. As with the
canonical examples, RQPE circuits can either be run once for perfect
distinguishability between the phases in $\Theta$ or can be run multiple times
to estimate a continuous phase.

Figure 5: Using an RQPE circuit with 1 and 6 unitary applications on two
qubits, shown are (a) the conditional probability and (b) the distance
calculated by Eq. (3) between two phases.

We consider an example circuit in Fig. 5, which is a two-qubit circuit with
$\ket{q_{0}}$ and $\ket{q_{1}}$. We use the unitaries $U_{0}^{6}$ and $U_{1}$
to match the number of unitary applications used in the canonical circuits
studied in Fig. 3. The probability distribution for different phases is
displayed in Fig. 5(a). Since the CFI is dominated by $\max[u_{j}]$, we expect
this RQPE circuit, having $\max[u_{j}]=6$, to have a higher precision than QPE
with $\max[u_{j}]=4$, but lower than RI with $\max[u_{j}]=7$. This is
confirmed in Fig. 5(a) where we compare the width of the first fringe to that
of the canonical circuits.

Meanwhile, the opposite relationship is true when comparing the circuit’s
distinguishablility. We show this in Fig. 5(b) where we calculate Eq. (3) for
our RQPE circuit. We say that a circuit is more distinguishable if it has a
greater number of $\theta_{i}$ having a distance of 0 to only itself rather
than additionally having a distance of 0 to some other $\theta_{j}$. Then,
this RQPE circuit can be compared to Figs. 4(a) and 4(b) for the canonical
examples to see that it is more distinguishable than RI but less
distinguishable than QPE.

There are two notable features of distinguishability in RQPE circuits, further
analyzed in Appendix G. One is the repetition of probability distributions.
This is determined by the qubit with the lowest number of unitary applications
causing the probability distributions over the range
$\left[0,\frac{2\pi}{\min[u_{j}]}\right)$ to repeat over the full $2\pi$
range, being truncated after $2\pi$. The second distinguishability feature is
the distinguishability within this repeated range, which is determined by the
distribution of unitary applications over the qubits. The generation algorithm
that we have presented in this paper utilizes these two features with the goal
of optimizing the distribution of unitary applications for any given $\Theta$.

##  IV Conclusion and outlook

In this article, we have demonstrated that a general class of quantum phase
estimation algorithms, which we labeled as RQPE, exist that encompass the
canonical examples of RI and QPE. Furthermore, by casting these canonical
examples into the language of RQPE we are able to compare these distinct
algorithms on equal footing. The figures of merit that we considered were
precision, determined by the CFI in Eq. (4), and the distinguishablility,
determined by the distance in Eq. (3). The figures of cost that we considered
were the number of unitary applications and the number of qubits. We found
that RI is more sensitive than QPE when constrained to the same number of
unitary applications, but QPE is more distinguishable than RI. We demonstrated
that these are two extremes of RQPE circuits, and so one can find a middle
ground between these examples by tuning a trade-off between these two figures
of merit.

While the presented circuit generation algorithm can be used to improve
current phase estimation standards, it is not necessarily optimal in all
cases. Future work may therefore be directed towards either reducing
complexity in the generation algorithm or increasing optimality in the
generated circuits.

## Acknowledgments

The authors thank John Cooper and Bo Waggoner for useful discussions. This
research was supported by NSF OSI 2231377, NSF PHY 2317149, NSF OMA 2016244,
and NSF PHY Grant No. 2207963.

## References

  * Michelson and Morley [1887] A. A. Michelson and E. W. Morley, On the relative motion of the earth and the luminiferous ether, American Journal of Science s3-34, 333–345 (1887).
  * Jahrgang [1891] E. Jahrgang,  _Zeitschrift für Instrumentenkunde_ , Vol. 1881 (Springer, 1891).
  * Pezzè  _et al._ [2018] L. Pezzè, A. Smerzi, M. K. Oberthaler, R. Schmied, and P. Treutlein, Quantum metrology with nonclassical states of atomic ensembles, Rev. Mod. Phys. 90, 035005 (2018).
  * Degen  _et al._ [2017] C. L. Degen, F. Reinhard, and P. Cappellaro, Quantum sensing, Rev. Mod. Phys. 89, 035002 (2017).
  * Reilly  _et al._ [2023] J. T. Reilly, J. D. Wilson, S. B. Jäger, C. Wilson, and M. J. Holland, Optimal generators for quantum sensing, Phys. Rev. Lett. 131, 150802 (2023).
  * Chou  _et al._ [2010] C. W. Chou, D. B. Hume, T. Rosenband, and D. J. Wineland, Optical clocks and relativity, Science 329, 1630 (2010).
  * Bothwell  _et al._ [2022] T. Bothwell, C. J. Kennedy, A. Aeppli, D. Kedar, J. M. Robinson, E. Oelker, A. Staron, and J. Ye, Resolving the gravitational redshift across a millimetre-scale atomic sample, Nature 602, 420 (2022).
  * Aslam  _et al._ [2023] N. Aslam, H. Zhou, E. K. Urbach, M. J. Turner, R. L. Walsworth, M. D. Lukin, and H. Park, Quantum sensors for biomedical applications, Nature Reviews Physics 5, 157–169 (2023).
  * Taylor and Bowen [2016] M. A. Taylor and W. P. Bowen, Quantum metrology and its application in biology, Physics Reports 615, 1 (2016), quantum metrology and its application in biology.
  * Nielsen and Chuang [2010] M. A. Nielsen and I. L. Chuang, Phase estimation, in  _Quantum Computation and Quantum Information_ (Cambridge University Press, 2010) p. 221–226.
  * Quintino  _et al._ [2019] M. T. Quintino, Q. Dong, A. Shimbo, A. Soeda, and M. Murao, Reversing unknown quantum transformations: Universal quantum circuit for inverting general unitary operations, Phys. Rev. Lett. 123, 210502 (2019).
  * Cho  _et al._ [2020] S.-M. Cho, A. Kim, D. Choi, B.-S. Choi, and S.-H. Seo, Quantum modular multiplication, IEEE Access 8, 213244 (2020).
  * Harrow  _et al._ [2009] A. W. Harrow, A. Hassidim, and S. Lloyd, Quantum algorithm for linear systems of equations, Phys. Rev. Lett. 103, 150502 (2009).
  * Cai  _et al._ [2013] X.-D. Cai, C. Weedbrook, Z.-E. Su, M.-C. Chen, M. Gu, M.-J. Zhu, L. Li, N.-L. Liu, C.-Y. Lu, and J.-W. Pan, Experimental quantum computing to solve systems of linear equations, Phys. Rev. Lett. 110, 230501 (2013).
  * Shor [1994] P. Shor, Algorithms for quantum computation: discrete logarithms and factoring, in  _Proceedings 35th Annual Symposium on Foundations of Computer Science_ (1994) pp. 124–134.
  * Ramsey [1950] N. F. Ramsey, A molecular beam resonance method with separated oscillating fields, Phys. Rev. 78, 695 (1950).
  * Kitaev [1995] A. Y. Kitaev, Quantum measurements and the abelian stabilizer problem, Electron. Colloquium Comput. Complex. TR96 (1995).
  * Pezzè and Smerzi [2021] L. Pezzè and A. Smerzi, Quantum phase estimation algorithm with gaussian spin states, PRX Quantum 2, 040301 (2021).
  * Audenaert  _et al._ [2007] K. M. Audenaert, J. Calsamiglia, R. Munoz-Tapia, E. Bagan, L. Masanes, A. Acin, and F. Verstraete, Discriminating states: The quantum chernoff bound, Physical review letters 98, 160501 (2007).
  * Audenaert  _et al._ [2008] K. M. Audenaert, M. Nussbaum, A. Szkoła, and F. Verstraete, Asymptotic error rates in quantum hypothesis testing, Communications in Mathematical Physics 279, 251 (2008).
  * Calsamiglia  _et al._ [2008] J. Calsamiglia, R. Munoz-Tapia, L. Masanes, A. Acin, and E. Bagan, Quantum chernoff bound as a measure of distinguishability between density matrices: Application to qubit and gaussian states, Physical Review A 77, 032311 (2008).
  * Spedalieri and Braunstein [2014] G. Spedalieri and S. L. Braunstein, Asymmetric quantum hypothesis testing with gaussian states, Physical Review A 90, 052307 (2014).
  * Rossi and Chuang [2021] Z. M. Rossi and I. L. Chuang, Quantum hypothesis testing with group structure, Phys. Rev. A 104, 012425 (2021).
  * Mosca and Ekert [1999] M. Mosca and A. Ekert, The hidden subgroup problem and eigenvalue estimation on a quantum computer, in  _Quantum Computing and Quantum Communications_ , edited by C. P. Williams (Springer Berlin Heidelberg, Berlin, Heidelberg, 1999) pp. 174–188.
  * Dobšíček  _et al._ [2007] M. Dobšíček, G. Johansson, V. Shumeiko, and G. Wendin, Arbitrary accuracy iterative quantum phase estimation algorithm using a single ancillary qubit: A two-qubit benchmark, Phys. Rev. A 76, 030306 (2007).
  * Wiebe and Granade [2016] N. Wiebe and C. Granade, Efficient bayesian phase estimation, Phys. Rev. Lett. 117, 010503 (2016).
  * Bengtsson and Życzkowski [2020] I. Bengtsson and K. Życzkowski, Probability and statistics, in  _Geometry of Quantum States: An Introduction to Quantum Entanglement_ (Cambridge University Press, 2020) p. 25–28.
  * Lehmann and Casella [1998] E. L. Lehmann and G. Casella,  _Theory of point estimation_ (Springer, 1998) p. 115.
  * Rao [1992] C. R. Rao, Information and the accuracy attainable in the estimation of statistical parameters, in  _Breakthroughs in Statistics: Foundations and Basic Theory_, edited by S. Kotz and N. L. Johnson (Springer New York, New York, NY, 1992) pp. 235–247.
  * Bach and Shallit [1997] E. Bach and J. O. Shallit, The euclidean algorithm: Worst-cases analysis, in  _Algorithmic Number Theory_ , Vol. 1 (MIT Press, 1997) p. 68–70.
  * Hardy and Wright [1960] G. H. Hardy and E. M. Wright,  _An introduction to the theory of numbers_ (Clarendon Press, 1960).
  * Paris [2009] M. G. A. Paris, Quantum estimation for quantum technology (2009), arXiv:0804.2981 [quant-ph] .

##  Appendix A Gates on a Qubit

Define $\theta$ as $\frac{\pi x_{a}}{d}$. The goal is to perform some
operations to change $\theta$ so that the $j$-th qubit measures $e^{-i\pi
x_{j}\mathcal{Z}}$, where $x_{j}$ is the numerator from the set
$\mathcal{A}_{j}=\\{\frac{x}{G_{j}}:x\in S_{j}\\}$ to which $x_{a}$
transforms. For $x_{0}$, the algorithm only needs to divide by $G_{0}$,
resulting in the following gate

$\displaystyle e^{-i\pi x_{0}\mathcal{Z}}$
$\displaystyle=e^{-i\pi\frac{x_{a}}{G_{0}}\mathcal{Z}}$ (5)
$\displaystyle=e^{-i\pi\frac{x_{a}d}{G_{0}d}\mathcal{Z}}$
$\displaystyle=(e^{-i\pi\frac{x_{a}}{d}\mathcal{Z}})^{\frac{d}{G_{0}}}$
$\displaystyle=U^{\frac{d}{G_{0}}}_{i}.$

Now, doing the same process for $x_{1}$, the previous reduction applies as
well as $A_{0}$ and $G_{1}$, adding $A_{0}$ only if the numerator at
$\mathcal{A}_{0}$ is odd, which happens when $q_{0}=1$.

$\displaystyle x_{1}$
$\displaystyle=(\frac{x_{a}}{G_{0}}+q_{0}A_{0})\frac{1}{G_{1}}$ (6)
$\displaystyle=\frac{x_{a}}{G_{0}G_{1}}+\frac{q_{0}A_{0}}{G_{1}}$
$\displaystyle=\frac{x_{a}d}{G_{0}G_{1}d}+\frac{q_{0}A_{0}}{G_{1}}$
$\displaystyle=\frac{x_{a}}{d}\frac{d}{G_{0}G_{1}}+\frac{q_{0}A_{0}}{G_{1}}$
$\displaystyle e^{-i\pi x_{1}\mathcal{Z}}$
$\displaystyle=e^{-i\pi\left(\frac{x_{a}}{d}\frac{d}{G_{0}G_{1}}+\frac{q_{0}A_{0}}{G_{1}}\right)\mathcal{Z}}$
(7)
$\displaystyle=\left(e^{-i\pi\frac{x_{a}}{d}\mathcal{Z}}\right)^{\frac{d}{G_{0}G_{1}}}e^{-i\pi\frac{q_{0}A_{0}}{G_{1}}\mathcal{Z}}$
$\displaystyle=U^{\frac{d}{G_{0}G_{1}}}_{j}Z_{j}^{\frac{q_{0}A_{0}}{G_{1}}}$
$\displaystyle=Z_{j}^{\frac{q_{0}A_{0}}{G_{1}}}U^{\frac{d}{G_{0}G_{1}}}_{j}.$

One can see that this pattern results in the gates for qubit $q_{j}$ as

$\displaystyle\texttt{gates}(q_{j})$
$\displaystyle=H_{j}(Z_{j}^{\frac{q_{0}A_{0}}{G_{1}\dots
G_{i}}}Z_{j}^{\frac{q_{1}A_{1}}{G_{2}\dots G_{j}}}\dots
Z_{j}^{\frac{q_{j-1}A_{j-1}}{G_{j}}})U^{\frac{d}{G_{0}\dots G_{j}}}_{j}H_{j}$
(8)
$\displaystyle=H_{j}\left(\prod_{k=0}^{j-1}C\\!Z_{j,k}^{\frac{A_{k}}{\prod_{\ell=k+1}^{j}G_{\ell}}}\right)U_{j}^{\frac{d}{\prod_{\ell=0}^{j}G_{\ell}}}H_{j}.$

##  Appendix B Estimating $\theta$

Backtracking through the reductions, i.e. subtracting the additions and
multiplying by the GCDs, reveals the value assigned to each qubit measurement,
which we call the bit value. In a four-qubit circuit, the original numerator
will be

$\displaystyle\theta$
$\displaystyle=\pi((((-m_{3}A_{3})G_{3}-m_{2}A_{2})G_{2}$ (9)
$\displaystyle\quad-m_{1}A_{1})G_{1}-m_{0}A_{0})G_{0}$
$\displaystyle=\pi(-m_{3}A_{3}G_{3}G_{2}G_{1}G_{0}-m_{2}A_{2}G_{2}G_{1}G_{0}$
$\displaystyle\quad-m_{1}A_{1}G_{1}G_{0}-m_{0}A_{0}G_{0}).$

One can see the pattern that the bit value of each measured bit $b_{i}$, which
is included in the final estimate if and only if $m_{j}=1$, will be

$\displaystyle b_{j}$ $\displaystyle=-\frac{\pi}{d}A_{j}\prod_{k=0}^{j}G_{k}.$
(10)

This allows for the transformation of the measurement results
$m_{0},\dots,m_{n-1}$ into the unknown theta as

$\displaystyle\theta$
$\displaystyle=-\frac{\pi}{d}\sum_{j=0}^{n-1}m_{j}A_{j}\prod_{k=0}^{j}G_{k}$
(11)

##  Appendix C Complexity

Define $h$ as the greatest numerator in $S_{0}$ and note that $T\leq 2d$ and
$h<2d$. Each qubit will ideally reduce the size of $\Theta$ by half, imposing
a lower bound of $\lceil\log_{2}(T)\rceil$ on the number of qubits, $n$.
Additionally, the algorithm will always be able to reduce at least one theta
into another after each measurement, and the final measurement distinguishes
two thetas, therefore $n\leq T-1$.

Moreover, any set of theta numerators is a subset of
$\\{i:i\in\mathbb{Z}\text{ and }0\leq i<2^{\lfloor\log_{2}h\rfloor+1}\\}$,
which can be distinguished using $A=[-1,-1,-1,\dots]$ and $G=[1,2,2,2,\dots]$
with $\lfloor\log_{2}h\rfloor+1$ qubits. If one restricts the additions used
in the classical generation algorithm negative, then the number of qubits will
always be less than or equal to this. However, allowing positive additions
further optimizes many circuits, and since we cannot guarantee this constraint
in this case, it can be trivially ensured by using these $A$ and $G$ values if
the generated circuit uses more qubits than this. This puts a second upper
bound on $n$, resulting in the following bounds.

$\lceil\log_{2}(T)\rceil\leq n\leq\min(T-1,\lfloor\log_{2}h\rfloor+1)$ (12)

In the worst case, the generation algorithm will produce this $G$, resulting
in the geometric sequence

$a_{i}=d\left(\frac{1}{2}\right)^{i}$ (13)

where $a_{i}$ is the number of unitary applications on $q_{i}$. This series
results in an upper bound on the total number of unitary applications, $r$, in
one run of the circuit as

$\displaystyle r$ $\displaystyle<2d$ (14)

Each reduction in the generation algorithm is composed of first finding the
GCD of the set of thetas. Finding the GCD of two numbers $a$ and $b$ can be
done using the Euclidean GCD Algorithm in $O(\log_{2}\min(a,b))$ time [30].
The algorithm can then perform this iteratively for all the possible thetas in
a set, achieving a time complexity of $O(T\log_{2}h)$.

The second phase of a reduction consists of finding a value to add to the odd
numerators which reduces the set size as much as possible. The method
described in this paper runs in at most $O(T^{2})$ time, since in the worst
case there will be an equal number of even and odd thetas, $\frac{T}{2}$, and
each odd will be added to each even, producing $\frac{T^{2}}{4}$ results. Each
result is then counted to find the mode, which results in a total of
$\frac{T^{2}}{4}$ time in the worst case.

Each multiplication and addition can be considered to run in constant time
(assuming all numbers fit into the word size of the hardware) over each theta,
so the operations after finding a GCD or addition can be done in time $O(2T)$.

The combination of all of these steps within an iteration multiplied by the
number of iterations necessary results in a total time complexity of
$O((T^{2}+T\log_{2}h)\cdot\min(T,\log_{2}h))$ to generate the quantum circuit.
Let’s look at each case more specifically. In the case that $T\leq\log_{2}h$:

$\displaystyle O((T^{2}+T\log_{2}h)\cdot T)$
$\displaystyle=O(T^{3}+T^{2}\log_{2}h)$ (15)
$\displaystyle=O(T^{2}(T+\log_{2}h))$ $\displaystyle=O(T^{2}\log_{2}h)$

because $\log_{2}h$ is the larger term in $(T+\log_{2}h)$. In the case that
$T\geq\log_{2}h$:

$\displaystyle O((T^{2}+T\log_{2}h)\cdot\log_{2}h)$
$\displaystyle=O(T^{2}\log_{2}h+T(\log_{2}h)^{2})$ (16)
$\displaystyle=O(T\log_{2}h(T+\log_{2}h))$ $\displaystyle=O(T^{2}\log_{2}h)$

because $T$ is the larger term in $(T+\log_{2}h)$. Therefore, both cases end
up being the same and produce a runtime of

$\displaystyle O(T^{2}\log_{2}h).$ (17)

The algorithm stores the possible thetas and two arrays for the GCDs and
additions in each reduction, which are all on the order $O(T)$. In this
paper’s method to find a particular addition in a reduction step, however, the
algorithm stores $O(T^{2})$ possibilities to consider, which is the dominant
factor. This equates to a total space complexity of $O(T^{2})$.

##  Appendix D Building a Circuit from Bit Values

The goal of the circuit-building reductions is to find the $A$s and $G$s. If
one is given the bit values instead of a $\Theta$ set, thereby distinguishing
$\Theta$ consisting of all possible subset sums of these bit values, one can
find these values with much more simplicity. First, find $S_{0}$ and $d$,
which can be done by first finding the fraction forms using the continued
fractions algorithm [31]. Then, set $G_{0}=\texttt{GCD}(S_{0})$ and
$A_{0}=\frac{S_{0,0}}{G_{0}}$, where $S_{0,j}$ is the $j$th numerator
corresponding to $b_{j}$. Next, set
$G_{1}=\texttt{GCD}(\\{\frac{S_{0,j}}{G_{0}}:j\geq 1\\})$ and
$A_{1}=\frac{S_{0,1}}{G_{0}G_{1}}$. Continue this way until all $G$s and $A$s
are found.

Note that all $A$ must be odd valued and all $G$, except $G_{0}$, must be even
valued for the presented circuit generation to be sure to work correctly. If
these do not hold, then the presented circuit generation algorithm likely
cannot be used to distinguish a $\Theta$ set matching these bit values
exactly.

For example, if one wanted to build a circuit that distinguishes thetas in the
range $[0,\frac{21}{d}]$ in even multiples of $\frac{3}{d}$, one could use the
bit values $b=[\frac{3}{d},\frac{6}{d},\frac{12}{d}]$.

$\displaystyle G_{0}$ $\displaystyle=\texttt{GCD}(S_{0})$ (18)
$\displaystyle=3$ $\displaystyle A_{0}$ $\displaystyle=\frac{S_{0,0}}{G_{0}}$
(19) $\displaystyle=\frac{3}{3}$ $\displaystyle=1$ $\displaystyle G_{1}$
$\displaystyle=\texttt{GCD}(\left\\{\frac{S_{0,1}}{G_{0}},\frac{S_{0,2}}{G_{0}}\right\\})$
(20) $\displaystyle=\texttt{GCD}(\left\\{\frac{6}{3},\frac{12}{3}\right\\})$
$\displaystyle=\texttt{GCD}(\\{2,4\\})$ $\displaystyle=2$ $\displaystyle
A_{1}$ $\displaystyle=\frac{S_{0,1}}{G_{0}G_{1}}$ (21)
$\displaystyle=\frac{6}{3\cdot 2}$ $\displaystyle=1$ $\displaystyle G_{2}$
$\displaystyle=\texttt{GCD}(\left\\{\frac{S_{0,2}}{G_{0}G_{1}}\right\\})$ (22)
$\displaystyle=\texttt{GCD}(\left\\{\frac{12}{3\cdot 2}\right\\})$
$\displaystyle=2$ $\displaystyle A_{2}$
$\displaystyle=\frac{S_{0,2}}{G_{0}G_{1}G_{2}}$ (23)
$\displaystyle=\frac{12}{3\cdot 2\cdot 2}$ $\displaystyle=1$

Since only the first $G$ is odd and all the $A$ are odd, this $b$ is valid,
and these $A$s and $G$s may be used in the rest of the circuit generation.

##  Appendix E Fisher Information

As explored in [25], RQPE circuits may be equivalently run sequentially on a
single qubit, so each line in the circuit will be run separately from each
other. This means that each line of the circuit can be considered a Ramsey
Interferometry (RI) circuit with additional Z-rotation gates. These rotation
gates have the following effect

$\displaystyle H(Z^{z_{0}}Z^{z_{1}}\dots)U^{r}H\ket{0}$
$\displaystyle=H(Z^{z_{0}+z_{1}\dots})U^{r}H\ket{0}$ (24)
$\displaystyle=HZ^{j}U^{r}H\ket{0}$
$\displaystyle=\frac{1}{2}\begin{bmatrix}1+e^{-i(r\theta+j)}\\\
1-e^{-i(r\theta+j)}\end{bmatrix}$

where $z_{i}$ is the power of the $i$th Z-rotation gate, and $j$ is a
simplifying variable $j=\sum_{i=0}z_{i}$.

Let $R[a]$ be the $a$-th element of Eq. (24), and let $a^{*}$ mean the
conjugate of $a$. The classical Fisher information of Eq. (24) is then (see
[32])

$\displaystyle\mathcal{I}_{\mathcal{M}}(RI)$
$\displaystyle=\sum_{a=0}^{1}\frac{\left(\frac{\partial}{\partial\theta}(R[a]R[a]^{*})\right)^{2}}{R[a]R[a]^{*}}$
(25)
$\displaystyle=\frac{\left(\frac{\partial}{\partial\theta}(\cos(\frac{r\theta+j}{2}))^{2}\right)^{2}}{(\cos(\frac{r\theta+j}{2}))^{2}}+\frac{\left(\frac{\partial}{\partial\theta}(\sin(\frac{r\theta+j}{2}))^{2}\right)^{2}}{(\sin(\frac{r\theta+j}{2}))^{2}}$
$\displaystyle=\frac{\left(-\frac{r}{2}\sin(r\theta+j)\right)^{2}}{(\cos(\frac{r\theta+j}{2}))^{2}}+\frac{\left(\frac{r}{2}\sin(r\theta+j)\right)^{2}}{(\sin(\frac{r\theta+j}{2}))^{2}}$
$\displaystyle=\frac{r^{2}}{4}\left(\frac{(\sin(r\theta+j))^{2}}{(\cos(\frac{r\theta+j}{2}))^{2}}+\frac{(\sin(r\theta+j))^{2}}{(\sin(\frac{r\theta+j}{2}))^{2}}\right)$
$\displaystyle=r^{2}\left(\left(\sin(\frac{r\theta+j}{2})\right)^{2}+\left(\cos(\frac{r\theta+j}{2})\right)^{2}\right)$
$\displaystyle=r^{2}$

where $r$ is the number of unitary applications on the qubit. One can see that
the Fisher information of an RI circuit is irrespective of the embedded
$\theta$ or $j$. Hence, additional rotation gates on a Ramsey line have no
effect on the the Fisher information of that line, and we may simply add the
Fisher information of all lines in the RQPE circuit to calculate the full
Fisher information with

$\mathcal{I}_{\mathcal{M}}(RQPE)=\sum_{i=0}^{n-1}u_{i}^{2}.$ (26)

##  Appendix F Examples of Comparing Optimality

We define a phase estimation problem as desiring some precision, defined by
the Cramer-Rao bound, while being able to distinguish some range of thetas,
$0\leq\theta\leq h$ in $e^{-i\theta\mathcal{Z}}$ where $h$ is the largest
phase, after many runs. This is because if there were separate ranges, RI
would still need to distinguish one large range that covers all the separate
ranges. A more optimal circuit achieves both of these things while using fewer
unitary application and qubits. Define precision as $\frac{1}{p}$ where $p\geq
1$ and $h=\frac{a}{d}$. The precision is defined by the Cramer-Rao bound, so
$\frac{1}{p}=\frac{1}{\sqrt{t}\mathcal{I}}$, where $t$ is the total number
number of runs and $\mathcal{I}$ is the classical Fisher information.

First, we see what Ramsey Interferometry (RI) requires. RI optimally satisfies
these requirements with $r=\frac{1}{h}=\frac{d}{a}$ unitary applications per
run. Increasing this shrinks the dynamic range to be less than the required
theta range, and distinguishability is lost, while decreasing this
exponentially increases the total number of runs to achieve the same
precision, resulting in more unitary applications overall. Since the classical
Fisher information is $(\frac{d}{a})^{2}$ according to Eq. (4), we have

$\displaystyle\frac{1}{p}$ $\displaystyle=\frac{a}{d\sqrt{t}}$ (27)
$\displaystyle t$
$\displaystyle=\left\lceil\left(\frac{pa}{d}\right)^{2}\right\rceil,$

taking the ceiling because $t$ is an integer, meaning RI requires
$\left\lceil\left(\frac{pa}{d}\right)^{2}\right\rceil$ runs to satisfy the
requirements. Since each RI run uses exactly one qubit, it requires the same
number of qubits. The total number of unitary applications it needs across all
runs is therefore

$\displaystyle\frac{d}{a}t$ $\displaystyle\geq\frac{p^{2}a}{d}.$ (28)

Quantum phase estimation (QPE) always has full distinguishability and achieves
at least the desired precision when it’s most precise qubit reaches it, which
happens after 1 run when

$\displaystyle\frac{1}{p}$ $\displaystyle=\frac{1}{\sqrt{\mathcal{I}}}$ (29)
$\displaystyle p$ $\displaystyle\geq u_{max}$

where $u_{max}$ is the number of unitary applications on the most precise
qubit. Since the unitary applications for each qubit in QPE follow powers of
two, the most precise qubit having $2^{\lceil\log_{2}p\rceil}\leq
2^{\log_{2}(p)+1}$ unitary applications satisfies the precision requirement.
This, in turn, results in less than $4p$ total unitary applications across all
qubits and $\lceil\log_{2}p\rceil+1$ total qubits.

We now have circuits for both RI and QPE that satisfy the distinguishability
requirement, so, in order for QPE to outperform RI, we find a precision where
the total number of unitary applications for QPE is less than that of RI.

$\displaystyle 4p<\frac{p^{2}a}{d}$ (30) $\displaystyle 4p<p^{2}h$
$\displaystyle\frac{4}{p}<h$

This means that QPE is guaranteed to use fewer unitary applications whenever
the highest theta is at least four times the desired precision, i.e. when you
would like to estimate theta using at least 4 bins of equal spacing.

We do a similar analysis for RQPE. If one wanted to split the range into
between some positive integer $k$ and $k+1$ bins, we have

$\displaystyle\frac{1}{p}$ $\displaystyle=\frac{b}{c}h$ (31)
$\displaystyle=\frac{ba}{cd}$

where $\frac{c}{k+1}<b<\frac{c}{k}$. One could, for example, run the CDA with
$\Theta=\\{\frac{bax_{i}}{cd}:x_{i}\in\mathbb{Z},0\leq x_{i}\leq k+1\\}$,
which satisfies the precision and distinguishability requirements after a
single run. We will compare the optimality of this circuit, which uses

$\displaystyle r_{RMQPE}$
$\displaystyle=\frac{cd}{ba}(1+\frac{1}{2}+\frac{1}{4}+\dots+\frac{1}{2^{\lfloor\log_{2}k\rfloor}})$
(32)
$\displaystyle=\frac{cd}{ba}\left(2-\frac{1}{2^{\lfloor\log_{2}k\rfloor}})\right)$

Since RI requires

$\displaystyle t$
$\displaystyle=\left\lceil\left(\frac{pa}{d}\right)^{2}\right\rceil$ (33)
$\displaystyle=\left\lceil\left(\frac{cda}{bad}\right)^{2}\right\rceil$
$\displaystyle=\left\lceil\left(\frac{c}{b}\right)^{2}\right\rceil$
$\displaystyle>k^{2}$ $\displaystyle\geq k^{2}+1$

runs to reach the desired precision, RI is more optimal than this RQPE circuit
when

$\displaystyle\left\lceil\left(\frac{c}{b}\right)^{2}\right\rceil\left(\frac{d}{a}\right)$
$\displaystyle<\frac{cd}{ab}\left(2-\frac{1}{2^{\lfloor\log_{2}k\rfloor}})\right)$
(34) $\displaystyle\left\lceil\left(\frac{c}{b}\right)^{2}\right\rceil$
$\displaystyle<\frac{c}{b}\left(2-\frac{1}{2^{\lfloor\log_{2}k\rfloor}})\right)$
$\displaystyle k^{2}+1$
$\displaystyle<\frac{c}{b}\left(2-\frac{1}{2^{\lfloor\log_{2}k\rfloor}})\right)$
$\displaystyle b$
$\displaystyle<\frac{c}{k^{2}+1}\left(2-\frac{1}{2^{\lfloor\log_{2}k\rfloor}})\right)$

When $k=0$, the given RQPE circuit simply returns RI, so they are equally
optimal. For $k=1$, we see that RI is more optimal when $b<\frac{3c}{4}$, i.e.
one wants a precision of $\frac{3}{4}h$. For $k=2$, $b<\frac{3c}{10}$, which
violates $b>\frac{c}{3}$. This violation persists for all $k>1$. Therefore,
this RQPE circuit is always more optimal than RI except for in the very
specific case when one wants $\frac{3}{4}h<\frac{1}{p}\leq h$.

##  Appendix G Features of Indistinguishability

For all reductive quantum phase estimation circuits, a single qubit can
distinguish between a phase of 0 and $\frac{\pi}{u_{i}}$ with certainty.
However, it also creates a range
$\left[0,\frac{2\pi}{\max[1,\min[u_{j}]]}\right)$ where each $\theta$ within
it results in an identical Bloch sphere positions as
$\theta+j\frac{2\pi}{\max[1,\min[u_{j}]]}:j\in\mathbb{N},j<\max[1,u_{i}]$,
where $\mathbb{N}$ are the natural numbers. That is, on the full $2\pi$ range
of possible thetas, there will be $\max[1,u_{i}]$ sets of physically
indistinguishable thetas after the unitary applications. We call this range
the repeated range, $\mathcal{S}$, and we call this principle of
indistinguishable sets “indistinguishability due to repitition”. This can be
extended to a multi-qubit RQPE circuit, where

$\displaystyle\mathcal{S}=\frac{2\pi}{\max[1,\min[u_{j}]]}$ (35)

as $\min[u_{j}]$ has the largest repeated range, and no repetition occurs
until repetition over this largest repeated range occurs.

Another type of indistinguishability, which this paper refers to as
“indistinguishability due to measurement basis”, is due to identical
measurement probability distributions for thetas within the repeated range
itself. This means that thetas may lie on different points in the Bloch sphere
after the unitary applications but have identical probability distributions
given the measurement basis. This is the type of distinguishability that can
be increased by distributing unitary applications across multiple qubits in
certain ways. This is also the type that is plotted in our distance graphs,
since this distinguishability is simply repeated as the repeated range
repeats.

##  Appendix H RQPE as a Gate

In the same way that the $H$ and $C\\!Z$ gates after the unitary applications
of a QPE circuit can be viewed as a $QFT^{\dagger}$ gate, one can view the $H$
and $C\\!Z$ gates after the unitary applications of an RQPE circuit as a
$(RQPE_{G,A})^{\dagger}$ gate. In the following definitions, we include SWAP
gates to reverse the order of qubits as the final step in the
$(RQPE_{G,A})^{\dagger}$ gate, while keeping the definition of $b_{i}$
unchanged, in order to more closely match the traditional definition of the
$QFT$ gate. However, to match the circuit given in the paper, i.e. without
final SWAP gates, $\tilde{b}$ (defined below) should be exchanged with $b$ in
the following equations.

The $RQPE_{G,A}$ gate, given some GCDs $G$ and additions $A$, maps a quantum
state $\ket{x}=\sum_{k=0}^{2^{n}-1}x_{k}\ket{k}$ to a state
$\sum_{k=0}^{2^{n}-1}y_{k}\ket{k}$ according to the formula:

$\displaystyle
y_{k}=\frac{1}{\sqrt{2^{n}}}\sum_{j=0}^{2^{n}-1}x_{j}\exp[i(b\cdot
j)(\tilde{u}\cdot k)].$ (36)

where the $\cdot$ operation of two operands $r$ and $s$ is $r\cdot
s=\sum_{i=0}^{n-1}r_{i}s_{i}$, $\tilde{r}_{i}=r_{n-1-i}$, $s_{i}$ is the
$i$-th bit of the binary representation of $s$, $b_{i}$ is the $i$-th bit
value of the RQPE procedure, and $u_{i}$ is the number of unitary applications
on the $i$-th qubit, given by

$\displaystyle u_{i}=\frac{d}{\prod_{k=0}^{i}G_{k}}.$ (37)

When $\ket{x}$ is a basis state, the $RQPE_{G,A}$ gate can be expressed as the
map

$\displaystyle
RQPE_{G,A}:\ket{x}\rightarrow\frac{1}{\sqrt{2^{n}}}\sum_{k=0}^{2^{n}-1}\exp[i(b\cdot
x)(\tilde{u}\cdot k)]\ket{k}.$ (38)

The unitary matrix of the $RQPE_{G,A}$ gate acting on quantum state vectors is
then

$\displaystyle\frac{1}{\sqrt{2^{n}}}\begin{bmatrix}1&1&1&1&\dots&1\\\
1&e^{ib_{0}\tilde{u}_{0}}&e^{ib_{1}u_{0}}&e^{i(b_{0}+b_{1})\tilde{u}_{0}}&\dots&e^{ic\tilde{u}_{0}}\\\
1&e^{ib_{0}\tilde{u}_{1}}&e^{ib_{1}\tilde{u}_{1}}&e^{i(b_{0}+b_{1})\tilde{u}_{1}}&\dots&e^{ic\tilde{u}_{1}}\\\
1&e^{ib_{0}(\tilde{u}_{0}+\tilde{u}_{1})}&e^{ib_{1}(\tilde{u}_{0}+\tilde{u}_{1})}&e^{i(b_{0}+b_{1})(\tilde{u}_{0}+\tilde{u}_{1})}&\dots&e^{ic(\tilde{u}_{0}+\tilde{u}_{1})}\\\
\vdots&\vdots&\vdots&\vdots&&\vdots\\\
1&e^{ib_{0}r}&e^{ib_{1}r}&e^{i(b_{0}+b_{1})r}&\dots&e^{icr}\end{bmatrix},$
(39)

where $c=\sum_{i=0}^{2^{n}-1}b_{i}$.


affiliationtext: †Columbia University ⋆IBM Research

# Denoising quantum states with Quantum Autoencoders - Theory and Applications

Tom Achache${}^{{\dagger},\>}$<EMAIL_ADDRESS>Lior Horesh  John Smolin

(August 28, 2024)

###### Abstract

We implement a Quantum Autoencoder (QAE) as a quantum circuit capable of
correcting Greenberger–Horne–Zeilinger (GHZ) states subject to various noisy
quantum channels : the bit-flip channel and the more general quantum
depolarizing channel. The QAE shows particularly interesting results, as it
enables to perform an almost perfect reconstruction of noisy states, but can
also, more surprisingly, act as a generative model to create noise-free GHZ
states. Finally, we detail a useful application of QAEs : Quantum Secret
Sharing (QSS). We analyze how noise corrupts QSS, causing it to fail, and show
how the QAE allows the QSS protocol to succeed even in the presence of noise.

##  1 Introduction

Autoencoders are a powerful type of Neural Networks that can realize compact
representations of data, and are often used as a denoising method [1].
Following this idea, Quantum Autoencoders (QAEs) have recently emerged as a
possible solution to tackle the crippling quantum noise problem, which is
ubiquitous in real-device quantum computations. Here, we choose to focus on
QAEs as proposed in [2], which enable an almost perfect reconstruction of
Greenberger–Horne–Zeilinger (GHZ) states subject to random bit-flips and small
unitary noise. A $m$-qubit GHZ state is defined by

$\displaystyle\frac{1}{\sqrt{2}}(\ket{0}^{\bigotimes m}+\ket{1}^{\bigotimes
m}).$ (1)

Studying GHZ states is of particular relevance as they exhibit long-range
entanglement, and are used in a wide range of applications.

Noticeably, the circuit depth of the QAEs considered in this paper is very
shallow (for instance, the QAE denoising 3-qubit GHZ states only requires 4
qubits), making them easy to implement on currently existing quantum devices.

These QAEs rely on the Quantum Neural Networks (QNNs) architecture described
in [3], and are trained in an unsupervised learning fashion [4]. While [3]
already provides an implementation of QNNs in Matlab [5], we choose here to
implement the QAEs in a pure quantum framework, using the Qiskit [6] library.

In this study, we propose an end-to-end quantum (circuit) encoding of all the
algorithmic steps associated with QAEs training and testing. Further, we
discuss important implementation and training details accompanied by extended
results of the QAEs. Lastly, we perform a thorough mathematical analysis of
the impact of noise in Quantum Secret Sharing (QSS) and show how to counter
it. Hence, this work covers both theoretical and experimental aspects of QAEs.

This paper is organized as follows. Section 2 addresses the theoretical
background regarding the implementation and training of QAEs on quantum
circuits. Section 3 presents numerical results pertaining to the performance
of the QAEs when denoising corrupted states subject to different kinds of
noise. Eventually, in section 4 we discuss an application of QAEs in QSS, and
demonstrate their significance in that context.

##  2 Algorithmic Description

This section summarizes the theory for implementing a QNN on a quantum
computer, with particular attention to the specific behavior of QAEs. The
critical steps of the computation are described below, but the reader
interested in the details of the calculus is referred to [3].

###  2.1 Circuit design

The QAE used in this study was selected from [3] for its appealing and
practical property of being able to be trained and tested using a single
quantum circuit and a minimal number of qubits. We denote by
$[m_{1},\dots,m_{\ell}]$ a QNN with $\ell$ layers, each layer having size
$m_{i},1\leq i\leq\ell$ (thus the input of the QNN is a quantum state of
$m_{1}$ qubits). For such a QNN, the quantum circuit is made up of $Q$ qubits,
where

$\displaystyle Q=1+m_{1}+w$ (2) with $\displaystyle w=\max\limits_{1\leq
i\leq\ell-1}(m_{i}+m_{i+1}).$ (3)

$w$ is the width of the QNN, and the other bits provide a measure of the
fidelity (see Eq. (4)) between the results of the QNN and the target states
during the training phase. The fidelity between a state $\ket{\phi}$ and a
density matrix $\rho$ is defined as

$\displaystyle F(\ket{\phi},\rho)=\expectationvalue{\rho}{\phi}.$ (4)

It should be underlined that once the training has been completed, we only use
the QAE, which has $w$ qubits. An example of the complete circuit is
represented in Figure 1. We divided it in four parts, separated with vertical
grey lines (”barriers”). The first part of the network represents the states’
preparation, the second part contains the QAE itself, the third part allows us
to compute the fidelity between the output of the QAE and the target state, as
demonstrated in [3], and the last part is the measurement. If we denote $\rho$
the density matrix of the state output by the QAE, $\ket{\phi}$ the target
state, and $p_{0}$ the probability of getting $0$ when doing the measurement,
we then have

$\displaystyle p_{0}=\frac{1}{2}(1+F(\ket{\phi},\rho)),$ (5)

where $F$ is the fidelity function defined in Eq. (4).

Figure 1: Circuit for the training of a [3,1,3] QAE. Here, $w=4$ and $Q=8$.

The QAE circuit is represented in Figure 2. It has two internal layers,
separated by a barrier.

Figure 2: Circuit of a [3,1,3] QAE

As explained in [3], a QNN is composed of layers of qubits (replacing the
neurons in classical NNs), connected by unitary transformations (replacing the
weights). Each unitary transformation acts on all the qubits of the input
layer and one qubit of the output layer. This is equivalent to classical NNs
where each neuron at a certain layer is connected to all the neurons of the
previous one. Thus, there are as many unitary transformations connecting two
layers as there are qubits in the output layer. Moreover, each unitary
transformation $U$ is defined by

$\displaystyle U=e^{iK}\text{ with }K=\sum\limits_{\sigma\in
P^{\otimes(m+1)}}k_{\sigma}\cdot\sigma,$ (6)

where the $k_{\sigma}$ are the parameters to be learned, $m$ is the size of
the input layer, $P=\\{I,X,Y,Z\\}$ is the set of Pauli matrices and the
identity, and $P^{\otimes j}$ denotes the set of all possible tensor products
of length $j$ between the elements of $P$. For instance, $P^{\otimes
2}=\\{II,IX,IY,IZ,XI,XX,XY,XZ,\ldots\\}$. Since $P$ forms a basis for the real
vector space of $2\times 2$ Hermitian matrices, $P^{\otimes(m+1)}$ naturally
forms a basis for the real vector space of $2^{m+1}\times 2^{m+1}$ Hermitian
matrices. Hence, $K$ is uniquely defined by its coefficients $k_{\sigma}$.

As a reminder, the expressions of the Pauli matrices are

$\displaystyle X=\begin{pmatrix}0&1\\\
1&0\end{pmatrix},Y=\begin{pmatrix}0&-i\\\
i&0\end{pmatrix},Z=\begin{pmatrix}1&0\\\ 0&-1\end{pmatrix}$ (7)

Thus, between two layers of size $m_{i}$ and $m_{i+1}$, we will have $m_{i+1}$
unitary transformations, each having $4^{m_{i}+1}$ coefficients. Hence, for a
circuit of shape $[m_{1},\ldots,m_{\ell}]$, the total number of coefficients
trained is

$\displaystyle\sum\limits_{i=1}^{\ell-1}m_{i+1}\cdot 4^{m_{i}+1}.$ (8)

In order to use the minimum possible amount of qubits for the QAE circuit, we
can reuse the qubits of the precedent layers by resetting them, as illustrated
in Figure 2 (the $\ket{0}$’s). In practice, at all times during training, we
only need the qubits representing two consecutive layers. So we can use a
fixed number of qubits by resetting the ones used in the past layers. However,
one has to be particularly careful at the end of the circuit to identify the
qubits where the states is actually encoded.

###  2.2 Training

The aim of the training part is to maximize the fidelity between the output of
the QAE and the actual state(s) we are trying to reconstruct (for instance,
the noise-free GHZ states).

As in a regular Neural Network, we have $N$ training pairs, which here consist
in two circuits preparing the input and target states (see Figure 1). Since
our aim is to denoise GHZ states, it is not possible to set them as the
targets of our network, because that would imply that actual access to them is
viable. Rather, we train our QAE in an unsupervised way, similarly to the
training of classical AEs. However, classical AEs are trained with pairs
$(x,x)$, i.e. where the input and the target are identical. This method does
not apply here, as we do not have access to the specific noise affecting a
state. Therefore, we train our QAE on pairs $(x,y)$, where $x$ and $y$ are
drawn from the same noisy distribution.

The cost function $C$ is a function of the vector $\kappa$ of all the
parameters $k_{\sigma}$. We denote by $\rho_{i}^{\kappa}$ the output of the
QAE with parameters $\kappa$, when fed with the $i$-th training state
$\ket{\phi}_{i}$. We have

$\displaystyle
C(\kappa)=\frac{1}{N}\sum\limits_{i=1}^{N}F(\ket{\phi}_{i},\rho_{i}^{\kappa}).$
(9)

The network is trained using a gradient ascent method. To approximate the
gradient of the cost function, we use the finite difference method, due to its
simplicity. However, this method can be rather unstable numerically in the
case of noisy functions, and one might want to consider other Derivative Free
Optimization methods instead [7].

Let $\epsilon>0$, for every parameter $k_{\sigma}$, if $\epsilon$ is small
enough,

$\displaystyle\frac{\partial C}{\partial
k_{\sigma}}(\kappa)\simeq\frac{C(\kappa+\epsilon_{k_{\sigma}})-C(\kappa)}{\epsilon},$
(10)

where $\epsilon_{k_{\sigma}}$ is an indicator vector with $\epsilon$ at the
position corresponding to $k_{\sigma}$, and $0$ otherwise. We can then update
the parameters vector $\kappa$ with the classical rule

$\displaystyle\kappa\longleftarrow\kappa+\eta\frac{\partial C}{\partial
k_{\sigma}}(\kappa),$ (11)

where $\eta$ is the learning rate.

Hence, we implemented the training algorithm as follows : at each epoch, we
start by computing $C(\kappa)$ (with the circuit depicted in Figure 1), and
then, for each coefficient $k_{\sigma}$, we compute
$C(\kappa+\epsilon_{k_{\sigma}})$. Finally, we update $\kappa$.

In terms of complexity, we need to make $N\cdot(|\kappa|+1)\cdot S$
measurements, where $|\kappa|$ is the value defined in Eq. (8) and $S$ is the
number of times we run each circuit in order to estimate the probability of
getting 0 as a result (and thus the fidelity, through Eq. (5)). Choosing a
large $S$ may unnecessarily increase the computation time. Conversely,
choosing a small $S$ may result in a poor approximation of $p_{0}$ (and thus
of the fidelity) which will hinder the training performance. We decided to use
$S=1000$ in all simulations, as it offers a sensible approximation of $p_{0}$
while keeping the number of measurements reasonable.

All the measurements can be done sequentially. This confers its practical
interest to the QAE as it can be implemented and trained using a single and
relatively small quantum circuit. However, running measurements in parallel
can significantly decrease the training time of the algorithm, as each epoch
can be entirely parallelized. We included both options in our code.

Besides, we need to tune two hyperparameters in the training phase, $\epsilon$
(the differential length) and $\eta$ (the learning rate), which can be
prohibitive. However, while the success of the training phase is dependent on
these two parameters, in practice $\epsilon=0.1$ and $\eta=1/4$ gave very good
results in all cases. We also implemented Adam gradient ascent [8] as it
should be able to curb the significance of $\eta$ due to its adaptive learning
rate. However, using the vanilla gradient ascent with the value of $\eta$
stated yielded more than satisfying results.

##  3 Results

Due to the high number of coefficients (see Eq. (8)) and training states
needed to properly train the QAE, the training phase is heavily time-
expensive. Indeed, we were able to obtain almost-perfect results (fidelity
above 0.95) on [2,1,2] and [3,1,3] QAEs, but the resources needed for the
training of larger networks exceeded our capacity. But the method should work
in theory, independently of the size of the network. [2] shows the results on
a [4,2,1,2,4] network.

###  3.1 Bit-flip channel

We first tested our QAE on the task of denoising GHZ states submitted to
random bit-flips. In our model, every bit of the state is flipped with a
certain probability $p$.

We trained a $[2,1,2]$ QAE with 100 training pairs, drawn by taking GHZ states
submitted to a bit-flip probability $p=0.2$. The training curve is shown in
Figure 3. At the end of each epoch we computed the fidelity on the training
pairs and on validation pairs (100 pairs, drawn from the same distribution as
the training pairs). As we can observe by the small discrepancies between the
training and the validation sets performance in Figure 3, overfitting is not a
concern here. Indeed, the validation set performance closely follows the
performance of the training set, and in particular does not start decreasing
at some point.

Figure 3: Training fidelity of a $[2,1,2]$ QAE using 100 training pairs, for a
bit-flip noise of probability $p=0.2$. We used $\epsilon=0.1$ and $\eta=1/4$.

We then tested our QAE on a test set consisting of 200 pairs drawn from the
same distribution (GHZ states affected by bit-flips with probability 0.2). The
average fidelity of the test set was 0.99, demonstrating that our QAE is
working (almost) perfectly.

Thereafter, we evaluated whether the QAE trained for $p=0.2$ would maintain
its performance for larger bit-flip probabilities (i.e. with a stronger
noise). The results are displayed in Figure 4. The theoretical fidelity of
noisy states for a probability $p$ can be computed by noting that when
submitting a two-qubit GHZ state to random bit-flips, there are only two
possible resulting states :

$\displaystyle\frac{1}{\sqrt{2}}(\ket{00}+\ket{11})\text{ and
}\frac{1}{\sqrt{2}}(\ket{01}+\ket{10}).$ (12)

The fidelities of these states with the GHZ state are respectively 1 and 0.
Moreover, to get the first state (the GHZ state), either zero or both qubits
have to be flipped. Hence, the theoretical fidelity is simply

$\displaystyle(1-p)^{2}+p^{2}.$ (13)

Figure 4: Mean and deviation of the fidelity of the $[2,1,2]$ network, trained
with $p=0.2$, over different bit-flip probabilities. For each $p$, 200 test
states were drawn. The green points are the fidelities of the test states. The
red points are their theoretical fidelities.

(a) $p=0.1$

(b) $p=0.2$

(c) $p=0.3$

(d) $p=0.37$

(e) $p=0.4$

(f) $p=0.4$

Figure 5: Training fidelities of a [2,1,2] QAE trained with pairs affected by
the bit-flip channel for various strengths. In all experiments, we trained on
100 pairs, using $\epsilon=0.1$ and $\eta=1/4$. We can indeed see that the
larger $p$ is, the slower the convergence. For instance, one can compare the
epoch at which the fidelity crosses the 0.9 threshold.

Thus, our QAE almost perfectly reconstructs GHZ states affected by bit-flips
of arbitrary probability.

Since increasing the bit-flip probability does not affect our QAE’s
performance, one could wonder whether the strength of the bit-flip channel
(i.e. the bit-flip probability) is totally irrelevant in the whole experiment.
Actually, it is not the case. The strength of the channel plays a critical
role in the training part : the stronger the noise, the slower the
convergence. And if the noise is too strong, the QAE might never converge to
the desired state. For instance, if $p$ is too large, we will have more
$\frac{1}{\sqrt{2}}(\ket{01}+\ket{10})$ states than GHZ states, thus the QAE
will erroneously conclude that this is the original state to learn. This is
represented in Figure 5.

In sub-figures 5(a) to 5(d), the QAE is able to achieve an almost-perfect
fidelity. However, in sub-figures 5(e) and 5(f), we observe two different
behavior : the fidelity stagnates around 0.5 or goes to 0 instead of 1. This
is because when $p=0.4$, by Eq. (13), we have $52\%$ of GHZ state (and thus
$48\%$ of the $\frac{1}{\sqrt{2}}(\ket{01}+\ket{10})$ state). Since these
probabilities are very close to $50\%/50\%$, chances are we train our QAE on
an almost-even number of pairs for each states, hence it will not be able to
determine which state is the original one and which is the noisy one (sub-
figure 5(e)). Furthermore, we may also train our QAE on more pairs of the non-
GHZ state, hence it will be misled to deduce that the GHZ states are actually
the noisy ones, and will convert them in the
$\frac{1}{\sqrt{2}}(\ket{01}+\ket{10})$ state (sub-figure 5(f)).

###  3.2 Quantum depolarizing channel

Considering the ability of our QAE to denoise states corrupted by bit-flips,
we further attempted to denoise states affected by the quantum depolarizing
channel (QDC), which is a more general form of noise. For an input state with
density matrix $\rho$ representing $m$ qubits, the QDC with noise strength $p$
is defined as

$\displaystyle\rho\xrightarrow[]{QDC}(1-p)\rho+p\big{(}\frac{1}{m}\cdot\large{\textbf{1}}\big{)},$
(14)

where $\frac{1}{m}\cdot\large{\textbf{1}}$ is the density matrix of the
maximally mixed state. One can show that this is equivalent to applying
exactly one of the matrices $\\{I,X,Y,Z\\}$ (the Pauli matrices and the
identity) to each qubit, with respective probabilities
$\\{1-\frac{3p}{4},\frac{p}{4},\frac{p}{4},\frac{p}{4}\\}$.

We trained a [2,1,2] QAE with 100 training pairs submitted to the QDC with
noise strength $p=0.2$. The training fidelity is represented in Figure 6.

Figure 6: Training fidelity of a $[2,1,2]$ QAE using 100 training pairs
affected by the QDC with noise strength $p=0.2$. We used $\epsilon=0.1$ and
$\eta=1/4$.

Once again, we tested the robustness of our model when states are corrupted
with stronger noise. The results, displayed in Figure 7, are impressive. As
before, the theoretical fidelity can be computed as a function of the noise
strength $p$.

######  Proposition.

For a $m$-qubit GHZ state corrupted by the QDC with noise strength $p$, the
theoretical fidelity with GHZ is

$\displaystyle\sum\limits_{\begin{subarray}{c}k=0\\\ k\text{
even}\end{subarray}}^{m}\binom{m}{k}\Big{(}\frac{p}{4}\Big{)}^{k}\Big{(}1-\frac{3p}{4}\Big{)}^{m-k}+2^{m-1}\cdot\Big{(}\frac{p}{4}\Big{)}^{m}.$
(15)

###### Proof.

Every state output by the QDC that is not GHZ (up to a global phase) will be
orthogonal to it, hence their fidelity will be 0. And for the QDC to output
the GHZ state (up to a global phase), there is only two possibilities :

  * •

an even number of qubits were affected by $Z$ and the rest by $I$

  * •

an even number of qubits were affected by $Y$ and the rest by $X$

Since the fidelity of these states with GHZ is 1, the theoretical fidelity is
thus

$\displaystyle\sum\limits_{\begin{subarray}{c}k=0\\\ k\text{
even}\end{subarray}}^{m}\binom{m}{k}\Big{(}\frac{p}{4}\Big{)}^{k}\Big{(}1-\frac{3p}{4}\Big{)}^{m-k}$
$\displaystyle+$ $\displaystyle\sum\limits_{\begin{subarray}{c}k=0\\\ k\text{
even}\end{subarray}}^{m}\binom{m}{k}\underbrace{\Big{(}\frac{p}{4}\Big{)}^{k}\Big{(}\frac{p}{4}\Big{)}^{m-k}}_{(\frac{p}{4})^{m}}.$
(16)

Since $\sum\limits_{\begin{subarray}{c}k=0\\\ k\text{
even}\end{subarray}}^{m}\binom{m}{k}=2^{m-1}$, we get the final result. ∎

Figure 7: Mean and deviation of the fidelity of the $[2,1,2]$ network, trained
with $p=0.2$, over different noise strength of the QDC. For each $p$, 200 test
states were drawn. The green points are the fidelities of the test states. The
red points are their theoretical fidelities.

As it was the case with the bit-flip channel, our QAE is indifferent to the
strength of the QDC and displays almost perfect reconstruction of GHZ states
in every case.

The QAE also features impressive generative abilities. Since the QAE is able
to effectively recreate GHZ states independently of the noise strength, it
should be able to recreate them without taking any input (i.e. starting with
the state $\ket{0\cdots 0}$), and thus act as a generative model for non-noisy
GHZ states. We ran 200 simulations, and found that the average fidelity
between the states created by our QAE and the GHZ state is 0.96 with a
standard deviation of 0.01, thus supporting the above claim.

In a second experiment, we trained a $[3,1,3]$ QAE on the same noise
distribution. The training fidelity is represented in Figure 8.

Figure 8: Training fidelity of a $[3,1,3]$ QAE using 150 training pairs
affected by the QDC with noise strength $p=0.2$. We used $\epsilon=0.1$ and
$\eta=1/4$.

The robustness of the $[3,1,3]$ QAE is displayed in Figure 9. Once again, the
QAE is rather insensitive to stronger noise. However, the fidelity is not as
high as with the $[2,1,2]$ QAE (between 0.9 and 0.95 here), and the standard
deviation is quite large, especially for very strong levels of noise.

Figure 9: Mean and deviation of the fidelity of the $[3,1,3]$ network, trained
with $p=0.2$, over different noise strength of the QDC. For each $p$, 200 test
states were drawn. The green points are the fidelities of the test states. The
red points are their theoretical fidelities.

To further improve the fidelity and dampen the standard deviation, we can
apply our $[3,1,3]$ QAE twice. The results are presented in Figure 10.

Figure 10: Mean and deviation of the fidelity of the $[3,1,3]$ network,
trained with $p=0.2$ and applied twice, over different noise strength of the
QDC. For each $p$, 200 test states were drawn. The green points are the
fidelities of the test states. The red points are their theoretical
fidelities.

Our $[3,1,3]$ QAE can also be used as a generative model. Running the same
experiment as with the $[2,1,2]$ QAE, we found that the states created by our
QAE achieved an average fidelity of $0.95\pm 0.01$ with the 3-qubit GHZ state.

To conclude this section, we can visualize the effect of our $[2,1,2]$ QAE on
noisy states, using the ’States City’ plot feature of Qiskit (see Figure 11).
It can be observed how the QAE is re-heightening the relevant states, i.e. the
states corresponding to the density matrix of the GHZ state.

(a) Noisy states city

(b) Denoised states city

Figure 11: States city of noisy and denoised states. We used 200 GHZ states
affected by the QDC with noise strength $p=0.4$. The states city are
respectively the average initial state vector and the average density matrix
output by the QAE.

###  3.3 Noise Robustness

It is interesting to assess the robustness of our QAEs to internal noise, as
it is ubiquitous in a real quantum device. To do so, we introduce a Gaussian
noise in the unitary gates composing our QAEs. Using Eq. (6), the addition of
a noisy term $\delta$ leads to the following equation for the noisy gates :

$\displaystyle\widetilde{U}=e^{i(K+\delta)}=e^{i\delta}\cdot U$ (17)

For a meaningful comparison, the introduced noise $\delta$ has to be
significantly smaller than $K$, which was found in previous simulations to be
about $-0.3\pm 0.25$. We choose a Gaussian noise $\delta$ centered on $0$, and
tested the robustness of the QAE while increasing its standard deviation. The
results are illustrated in Figures 12 and 13, respectively for the [2,1,2] and
[3,1,3] QAEs. In each case, 200 states are picked from the noisy QDC with
noise strength $p=0.3$. The results show a significant robustness to noise, as
the QAEs still increase the fidelity of the denoised states, until the
standard deviation of the gates’ noise reaches roughly one third of the
average value of the coefficients $K$. Furthermore, Figures 12 and 13 display
that the GHZ states are almost perfectly reconstructed by the QAEs as long as
the standard deviation remains below 0.03.

Figure 12: Noise robustness of the [2,1,2] QAE Figure 13: Noise robustness of
the [3,1,3] QAE

###  3.4 Findings

In this section, we have demonstrated that the QAEs studied in this paper are
able to (almost) perfectly denoise GHZ states, and at the same time generate
them without explicitly being given the goal state. Furthermore, we have shown
that these QAEs are extremely robust to internal noise.

We emphasize once again that during the whole training phase, the QAE only
sees noisy GHZ states, both on the input and on the target. It is then able to
perceive the underlying structure behind all these noisy states, and to
recompose it.

##  4 Application : Quantum Secret Sharing

We detailed the creation and training of QAEs. We now discuss a practical
application of them in the context of QSS. We analyze the limitation noise
confers to QSS and show how QAEs can save QSS protocols by dampening the
impact of noise. But first, we explain the basis of a QSS protocol.

###  4.1 Preliminaries

A Secret Sharing protocol is a method that allows a secret to be split between
participants, so that each share does not give any information about the
secret, but if combined together, they allow the participants to recover the
secret.

In a classical setting, for instance, a secret could be a two digit number
(i.e. between $00$ and $99$). If we have two participants, one possible scheme
would be to give one digit of the number to each participant. However, this
scheme is not considered as a secure secret sharing protocol, as having a
digit of a number gives considerable information about that number. In
contrast to this insecure protocol, consider a scheme where a randomly drawn
number is added to the secret and the sum is reduced modulo 100. We then give
the first participant the result, and the second party the drawn number. In
this example, none of the participants can learn anything about the secret
alone. But by collaborating, they can fully retrieve it.

Formally, a secured Secret Sharing protocol must ensure that :

  * •

collaboration allows the participants to recover the secret

  * •

shares alone do not allow any participant to reduce the search state space in
which the secret lies

Quantum Physics helps building secure Secret Sharing protocols by distributing
entangled states between participants. We refer to QSS as described in [9].
The interest of QSS is both to make it difficult for a malignant participant
to cheat and for an eavesdropper to intercept information, as they will be
(with a high probability) detected by the other participants.

We consider here a GHZ triplet, shared between Alice, Bob and Charlie.
Initially, Charlie possesses the whole triplet. He sends to Alice and Bob the
first and second qubits, and then each of the parties makes a measurement in
either the $\mathcal{X}$ or $\mathcal{Y}$ basis (randomly selected), defined
by

$\displaystyle\mathcal{X}$
$\displaystyle:\left\\{\begin{array}[]{c}\ket{+x}=\frac{1}{\sqrt{2}}(\ket{0}+\ket{1})\\\
\ket{-x}=\frac{1}{\sqrt{2}}(\ket{0}-\ket{1})\end{array}\right.,$ (20)
$\displaystyle\mathcal{Y}$
$\displaystyle:\left\\{\begin{array}[]{c}\ket{+y}=\frac{1}{\sqrt{2}}(\ket{0}+i\ket{1})\\\
\ket{-y}=\frac{1}{\sqrt{2}}(\ket{0}-i\ket{1})\end{array}\right..$ (23)

Once all measurements are made, each participant announces the basis he has
chosen. As we will show, in half of the cases Alice and Bob will know the
result of Charlie’s measurement, provided that they collaborate (and they can
not find it if they do not). They will then have a secret bit in common. By
repeating this protocol multiple times, Charlie will be able to establish a
secret key with Alice and Bob, that can be used, for instance, for sending a
classical message encrypted with the shared key (like a One-Time-Pad [10]).

To show how Alice and Bob can know the result of Charlie’s measurement, we can
re-write the GHZ triplet in all the possible combinations of the $\mathcal{X}$
and $\mathcal{Y}$ basis. We have :

$\displaystyle\ket{\psi}$
$\displaystyle=\frac{1}{\sqrt{2}}(\ket{000}+\ket{111})$ (24)
$\displaystyle=\medmath$ $\displaystyle\leavevmode\nobreak\
\leavevmode\nobreak\ \leavevmode\nobreak\ \leavevmode\nobreak\
\leavevmode\nobreak\
\medmath{+\big{(}\ket{+x}\ket{-x}+\ket{-x}\ket{+x}+\ket{+y}\ket{+y}+\ket{-y}\ket{-y}\big{)}\ket{-x}}$
$\displaystyle\leavevmode\nobreak\ \leavevmode\nobreak\ \leavevmode\nobreak\
\leavevmode\nobreak\ \leavevmode\nobreak\
\medmath{+\big{(}\ket{+x}\ket{-y}+\ket{-x}\ket{+y}+\ket{+y}\ket{-x}+\ket{-y}\ket{+x}\big{)}\ket{+y}}$
$\displaystyle\leavevmode\nobreak\ \leavevmode\nobreak\ \leavevmode\nobreak\
\leavevmode\nobreak\ \leavevmode\nobreak\
\medmath{+\big{(}\ket{+x}\ket{+y}+\ket{-x}\ket{-y}+\ket{+y}\ket{+x}+\ket{-y}\ket{-x}\big{)}\ket{-y}\Big{]}}.$
(25)

Hence, we can see that the ’valid’ bases (under which Charlie will be able to
have a shared bit with Alice and Bob) are
$\\{\mathcal{XXX},\mathcal{YYX},\mathcal{XYY},\mathcal{YXY}\\}$ or simply when
an even number of participants takes a measurement according to the
$\mathcal{Y}$ basis (as measuring a basis in the other one leads to a
probability of $1/2$ for each state of the basis). When the three participants
have chosen one of the above bases, by sharing their results, Alice and Bob
can know the result of Charlie, but they can’t know it individually.

###  4.2 Noisy QSS Protocol

Figure 14: Noisy QSS circuit. Here, the basis chosen is $\mathcal{YXY}$.

Now let us assume that participants do not have access to a noise-free GHZ
triplet (for instance because of hardware constraints or shortcomings), or
that the one they have has been corrupted by noise. In this section, we
analyze how that will impact the protocol.

To do so, we suppose that the GHZ triplet is corrupted by the QDC with
strength $p$. This means that each of the qubits will be affected by a
particular Pauli matrix with probability $\frac{p}{4}$ (for each of the three
matrices), and will stay unharmed with probability $1-\frac{3p}{4}$. Hence, to
quantify the impact of the QDC, we only have to assess the effect of Pauli
matrices on the basis $\mathcal{X}$ and $\mathcal{Y}$. We have

$\displaystyle\left\\{\begin{array}[]{lcl}X\ket{\pm x}=\pm\ket{\pm
x}&&X\ket{\pm y}=\pm i\ket{\mp y}\\\ Y\ket{\pm x}=\mp i\ket{\mp x}&&Y\ket{\pm
y}=\pm\ket{\pm y}\\\ Z\ket{\pm x}=\ket{\mp x}&&Z\ket{\pm y}=\ket{\mp
y}\end{array}\right.$ (29)

i.e. $X$ affects the $\mathcal{Y}$ basis, $Y$ affects the $\mathcal{X}$ basis,
and $Z$ affects both. By ’affecting’ the basis, we mean that it inverts the
basis’ states, which will disorder Eq. (25). The coefficients are irrelevant
here.

It then becomes straightforward to understand how the QDC affects the
protocol. Let’s suppose that we are in the case of a ’valid’ basis, hence the
result of this measurement is kept a part of the shared key. Let’s further
suppose that in the QDC, Alice’s qubit is affected by $X$, and Bob and
Charlie’s qubits are lucky enough to stay still. Will the protocol fail ?

If Alice chooses to do her measurement according to the $\mathcal{X}$ basis,
nothing will change, as $X$ leaves the $\mathcal{X}$ basis unharmed, so the
protocol will succeed. However, if she chooses the $\mathcal{Y}$ basis, then
the bit recovered by Alice and Bob (which is supposed to be Charlie’s bit)
will always be the wrong one. Indeed, let us assume for instance that Bob
chooses the $\mathcal{Y}$ basis too and finds $\ket{-y}$, and Charlie chooses
the $\mathcal{X}$ basis. If Alice finds $\ket{+y}$, then, by referring to Eq.
(25), Bob and her will assume that Charlie found $\ket{+x}$, when he actually
found $\ket{-x}$, since Alice’s measurement should have been $\ket{-y}$, had
her qubit not been affected by $X$. Hence, in this case, the probability of
getting the wrong bit (and thus, having the protocol failed) is 1/2. We can
conduct the same reasoning for every other options (syndromes) in the QDC,
which leads to the following result.

######  Proposition.

If the QSS protocol is affected by the QDC with strength $p$, the probability
$\Gamma$ of the protocol failing is

$\displaystyle\Gamma=\frac{p}{2}(p^{2}-3p+3).$ (30)

###### Proof.

Assuming that Charlie’s qubit is left unharmed, we get for Alice and Bob :

  * •

$XI,YI,IX,IY,XX,YY,XY,YX,XZ,ZX$, $YZ,ZY\Longrightarrow$ the protocol fails
half of the time

  * •

$IZ,ZI\Longrightarrow$ the protocol always fails

  * •

$II,ZZ\Longrightarrow$ the protocol never fails (we can see in Eq. (25) that
if both signs of the two first qubits change, that will leave the protocol
unharmed)

We can then obtain the probability $\Gamma_{I}$ of the protocol failing when
Charlie’s qubit is affected by $I$ (i.e. is unharmed) by multiplying the
probabilities of failing and the probabilities of having each syndrome in the
QDC :

$\displaystyle\Gamma_{I}$
$\displaystyle=\frac{1}{2}\Big{[}4\cdot\frac{p}{4}\big{(}1-\frac{3p}{4}\big{)}+8\cdot\big{(}\frac{p}{4}\big{)}^{2}\Big{]}+2\cdot\frac{p}{4}\big{(}1-\frac{3p}{4}\big{)}$
$\displaystyle=\frac{1}{2}\Big{[}p-\frac{3p^{2}}{4}+\frac{p^{2}}{2}\Big{]}+\frac{p}{2}-\frac{3p^{2}}{8}$
$\displaystyle=p(1-\frac{p}{2}).$ (31)

We can apply the same method when Charlie’s qubit is affected by $X$ or $Y$,
which yields :

$\displaystyle\Gamma_{X}=\Gamma_{Y}=\frac{1}{2}.$ (32)

Finally, when Charlie’s qubit is affected by $Z$, we have :

$\displaystyle\Gamma_{Z}=1-p+\frac{p^{2}}{2}.$ (33)

Putting everything together, we get the total probability $\Gamma$ of the
protocol failing :

$\displaystyle\Gamma$
$\displaystyle=(1-\frac{3p}{4})\cdot\Gamma_{I}+\frac{p}{4}\cdot\Gamma_{X}+\frac{p}{4}\cdot\Gamma_{Y}+\frac{p}{4}\cdot\Gamma_{Z}$
$\displaystyle=\frac{p}{2}(p^{2}-3p+3).$ (34)

∎

We simulated the QSS protocol on Qiskit, as can be seen in Figure 14 (making a
measurement in the $\mathcal{X}$ basis is equivalent to applying $H$ and
making a measurement in the $\mathcal{Z}=\\{\ket{0},\ket{1}\\}$ basis, and
similarly for the $\mathcal{Y}$ basis by adding a $S^{\dagger}$ before $H$).

In every simulation, the bases are randomly chosen, and if they correspond to
a valid configuration, the secret bit is kept for the key. We made $p$ vary
between 0 and 1, ran 1000 measurements for each value of $p$, then computed
the number of differences between the two keys, weighted by the key length.
The results are shown in Figure 15.

Figure 15: Probabilities of the QSS protocol failing when submitted to the QDC
with noise strength $p$. The blue line corresponds to $\Gamma$.

The probability of failure increases with $p$, and at the limit $p=1$ (for a
full-noise QDC), we have $\Gamma=\frac{1}{2}$, thus the protocol is not better
than guessing a bit at random. Even a small value of $p$, like $p=0.2$, will
lead to $\Gamma=0.24$, so on average approximately 1 bit out of 4 of the final
secret key will be wrong, rendering it rather useless.

Moreover, Charlie will not be able to detect if Alice or Bob is cheating, or
if a malignant third party is trying to get a hold of the key, at it was the
case in a non-noisy QSS protocol. Indeed, [9] showed that if Alice or Bob is
cheating by getting both qubits and sending the other a qubit she/he carefully
prepared, or if a third party is grafting an ancilla to the GHZ state to get
any information, then it will irreducibly introduce errors. In a non-noisy QSS
scheme, the participants can detect that, by revealing a fraction of the key,
and see if there are any discrepancies. However, in a noisy QSS scheme, it
will be challenging to determine if the error is due to a cheating act or
simply due to the noisy channel. Although, cheating activities can still be
detected, provided that the channel is not too noisy, and at the expense of a
great number of simulations of the protocol, which may not be possible in
practice. Indeed, the probability of the protocol failing in the presence of a
cheater is 1/4. Hence, if the noise strength of the channel leads to a fewer
probability of errors (for instance, when it is fewer than $0.2$ in the case
of the QDC), then the participants can reveal a fraction of their keys and see
if the mismatch probability is suspiciously high. However, that would require
the fraction of the keys revealed to be large enough for a precise estimation,
as variance can mislead the participants in their decision regarding the
presence of an internal or external cheater.

###  4.3 Denoising QSS

We have seen in the previous section that noise is a serious limitation to QSS
protocols. In this section, we show how QAEs can limit the impact of noise by
drastically diminishing the probability of the protocol failing.

To do so, Charlie can apply the QAE to denoise the triplet before it sends
Alice and Bob their qubits. Alternatively, Charlie can directly use the QAE to
create an almost perfect GHZ triplet, as demonstrated in section 3. This will
dampen, if not almost annihilate, the probability of having erroneous shared
bits between Alice and Bob, and Charlie.

The circuit used for this experiment is represented in Figure 16. We use our
$[3,1,3]$ QAE trained on the QDC. Qubit 0 is Alice’s qubit, qubit 1 is Bob’s
qubit, qubit 2 is Charlie’s qubit, and qubit 3 is an ancilla used by the QAE
(remember that the width of our QAEs is defined by $\max\limits_{1\leq
i\leq\ell-1}(m_{i}+m_{i+1})=4$ here). At the output of the QAE, the state is
encoded in qubit 0, 1 and 2 (but that may not always be the case, for instance
if the QAE had shape $[3,1,1,3]$, the state would be encoded in qubits 1, 2
and 3).

Figure 16: Quantum circuit to denoise the QSS protocol

The results are shown in Figure 15, for a noise strength ranging from 0 to 1.
As one can see, the QAE manages to substantially reduce the failure
probability regardless of the noise strength, hence saving the QSS protocol.

##  5 Conclusion

We successfully implemented the QAE from [2], using Python and Qiskit.
Additionally, we demonstrated the QAE denoising ability on GHZ states for
multiple noise channels. The network is able to effectively denoise all of the
given channels for various noise strengths, and is itself resistant to noise.
Finally, we have shown that after being trained, the QAE is able to function
as a generative model for the denoised state. It also proved itself
particularly useful in the context of QSS. Other advantages of the QAE lie in
its compactness and in the fact that it can be applied instantaneously once
trained, despite a lengthy training process.

There are many avenues worth exploring with this QAE in the future. In
particular, since the network can function as a quantum error correcting code
(QECC), it would be interesting to benchmark it again other state-of-the-art
QECCs, notably to compare its denoising accuracy as well as the time and
resources involved.

In this paper, we were limited by computational resources, so we could only
fully test $[2,1,2]$ and $[3,1,3]$ networks. In the future, it would be useful
to explore the effectiveness of the network with different topologies.

## Code

The code to create, train and test the QAEs, as well as for the QSS part can
be found at https://github.com/Tom-Achache/QAEs.

## References

  * [1] P. Vincent, H. Larochelle, Y. Bengio, and P.-A. Manzagol, Extracting and Composing Robust Features with Denoising Autoencoders.  ICML ’08, New York, NY, USA: Association for Computing Machinery, 2008\.
  * [2] D. Bondarenko and P. Feldmann, Quantum autoencoders to denoise quantum data.  In arXiv:1910.09169, 2019.
  * [3] K. Beer, D. Bondarenko, T. Farrelly, T. J. Osborne, R. Salzmann, and R. Wolf, Efficient Learning for Deep Quantum Neural Networks.  In arXiv:1902.10445, 2019.
  * [4] G. Sentís, A. Monràs, R. Muñoz-Tapia, J. Calsamiglia, and E. Bagan, Unsupervised classification of quantum data.  In arXiv:1903.01391, 2019.
  * [5] https://github.com/R8monaW/DeepQNN.
  * [6] https://github.com/Qiskit.
  * [7] A. R. Conn, K. Scheinberg, and L. N. Vicente, Introduction to derivative-free optimization.  SIAM, 2009.
  * [8] D. P. Kingma and J. Ba, Adam: A Method for Stochastic Optimization.  In arXiv:1412.6980, 2014.
  * [9] M. Hillery, V. Buzek, and A. Berthiaume, Quantum secret sharing.  In arXiv:quant-ph/9806063, 1998.
  * [10] F. Miller, Telegraphic Code to Insure Privacy and Secrecy in the Transmission of Telegrams.  C.M. Cornwell, 1882.