We study quantum algorithms that are given access to trusted and untrusted quantum witnesses. We establish strong limitations of such algorithms, via new techniques based on Laurent polynomials (i.e., polynomials with positive and negative integer exponents). Specifically, we resolve the complexity of approximate counting, the problem of multiplicatively estimating the size of a nonempty set $S \subseteq [N]$, in two natural generalizations of quantum query complexity.
Our first result holds in the standard Quantum Merlin--Arthur ($\mathsf{QMA}$) setting, in which a quantum algorithm receives an untrusted quantum witness. We show that, if the algorithm makes $T$ quantum queries to $S$, and also receives an (untrusted) $m$-qubit quantum witness, then either $m = \Omega(|S|)$ or $T=\Omega \bigl(\sqrt{N/\left| S\right| } \bigr)$. This is optimal, matching the straightforward protocols where the witness is either empty, or specifies all the elements of $S$. As a corollary, this resolves the open problem of giving an oracle separation between $\mathsf{SBP}$, the complexity class that captures approximate counting, and $\mathsf{QMA}$.
In our second result, we ask what if, in addition to a membership oracle for $S$, a quantum algorithm is also given "QSamples" ---i.e., copies of the state $\left| S\right\rangle = \frac{1}{\sqrt{\left| S\right| }} \sum_{i\in S}|i\rangle$--- or even access to a unitary transformation that enables QSampling? We show that, even then, the algorithm needs either $\Theta \bigl(\sqrt{N/\left| S\right| }\bigr)$ queries or else $\Theta \bigl(\min \bigl\{\left| S\right| ^{1/3}, \sqrt{N/\left| S\right| }\bigr\}\bigr)$ QSamples or accesses to the unitary.
Our lower bounds in both settings make essential use of Laurent polynomials, but in different ways.
Minor revisions and references to followup work
We study quantum algorithms that are given access to trusted and untrusted quantum witnesses. We establish strong limitations of such algorithms, via new techniques based on Laurent polynomials (i.e., polynomials with positive and negative integer exponents). Specifically, we resolve the complexity of approximate counting, the problem of multiplicatively estimating the size of a nonempty set $S \subseteq [N]$, in two natural generalizations of quantum query complexity.
Our first result holds in the standard Quantum Merlin--Arthur ($\mathsf{QMA}$) setting, in which a quantum algorithm receives an untrusted quantum witness. We show that, if the algorithm makes $T$ quantum queries to $S$, and also receives an (untrusted) $m$-qubit quantum witness, then either $m = \Omega(|S|)$ or $T=\Omega \bigl(\sqrt{N/\left\vert S\right\vert } \bigr)$. This is optimal, matching the straightforward protocols where the witness is either empty, or specifies all the elements of $S$. As a corollary, this resolves the open problem of giving an oracle separation between $\mathsf{SBP}$, the complexity class that captures approximate counting, and $\mathsf{QMA}$.
In our second result, we ask what if, in addition to a membership oracle for $S$, a quantum algorithm is also given "QSamples" ---i.e., copies of the state $\left\vert S\right\rangle = \frac{1}{\sqrt{\left\vert S\right\vert }} \sum_{i\in S}|i\rangle$--- or even access to a unitary transformation that enables QSampling? We show that, even then, the algorithm needs either $\Theta \bigl(\sqrt{N/\left\vert S\right\vert }\bigr)$ queries or else $\Theta \bigl(\min \bigl\{\left\vert S\right\vert ^{1/3}, \sqrt{N/\left\vert S\right\vert }\bigr\}\bigr)$ QSamples or accesses to the unitary.
Our lower bounds in both settings make essential use of Laurent polynomials, but in different ways.
Strengthened results.
This paper proves new limitations on the power of quantum computers to solve approximate counting---that is, multiplicatively estimating the size of a nonempty set $S\subseteq [N]$.
Given only a membership oracle for $S$, it is well known that approximate counting takes $\Theta(\sqrt{N/|S|})$ quantum queries. But what if a quantum algorithm is also given "QSamples"---i.e., copies of the state $|S\rangle = \sum_{i\in S}|i\rangle$---or even the ability to apply reflections about $|S\rangle$? Our first main result is that, even then, the algorithm needs either $\Theta(\sqrt{N/|S|})$ queries or else $\Theta(\min\{|S|^{1/3},\sqrt{N/|S|}\})$ reflections or samples. We also give matching upper bounds.
We prove the lower bound using a novel generalization of the polynomial method of Beals et al. to Laurent polynomials, which can have negative exponents. We lower-bound Laurent polynomial degree using two methods: a new "explosion argument" and a new formulation of the dual polynomials method.
Our second main result rules out the possibility of a black-box Quantum Merlin-Arthur (or QMA) protocol for proving that a set is large. We show that, even if Arthur can make $T$ quantum queries to the set $S$, and also receives an $m$-qubit quantum witness from Merlin in support of $S$ being large, we have $Tm=\Omega(\min\{|S|,\sqrt{N/|S|}\})$. This resolves the open problem of giving an oracle separation between SBP and QMA.
Note that QMA is "stronger" than the queries+QSamples model in that Merlin's witness can be anything, rather than just the specific state $|S\rangle$, but also "weaker" in that Merlin's witness cannot be trusted. Intriguingly, Laurent polynomials also play a crucial role in our QMA lower bound, but in a completely different manner than in the queries+QSamples lower bound. This suggests that the "Laurent polynomial method" might be broadly useful in complexity theory.
