Quantum Lazy Sampling and Path Recording for Any Group Ben Foxman∗
Alex Lombardi†
Fermi Ma‡
Barak Nehoran§
John Wright¶
arXiv:2606.30281v1 [quant-ph] 29 Jun 2026
Abstract A central challenge in quantum algorithm analysis and cryptography is reasoning about algorithms with oracle access to a random group element (e.g. a random function, a random permutation, a random unitary). Can we efficiently simulate such algorithms? Can we determine what they know after t queries? Classically, an important tool for this is lazy sampling, where the oracle does not commit to the full group element at the beginning, but rather samples partial information about it on the fly. We study a quantum analog of lazy sampling: compressed oracles (or recording oracles), which are quantum data structures that allow such on-the-fly simulation for quantum queries. Compressed oracles were originally introduced by Zhandry (CRYPTO ’19) for random functions, were generalized to random unitaries by Ma-Huang (STOC ’25) and to permutations by Carolan (STOC ’26), and have been employed to great effect in security proofs and query complexity lower bounds due to their interpretability. In this work, we define and analyze a general-purpose and interpretable path-recording oracle, derived from first principles, that perfectly simulates random elements of any closed subgroup of U (N ). Our path-recording oracle stores superpositions of t input-output pairs |(x1 , y1 ), . . . , (xt , yt )⟩, which encode a Feynman path explored by the algorithm and thus transparently records the information that the algorithm may have learned from its queries. Our compressed oracle builds on a recent work of Grinko and Yoshida (QIP ’26), who proposed a different kind of general-purpose compressed oracle without clear interpretability. Crucially for applications, we derive an operationally useful mathematical description of our update procedure in terms of the commutant of the group’s tensor power representation. One powerful feature of our path-recording oracle is that it enables direct comparisons between compressed oracles for different groups, which gives a new technique for proving pseudorandomness results. For our main application, we formally relate the SN and U (N ) compressed oracles, yielding what is arguably the simplest construction to date of pseudorandom unitaries: the product P C of a pseudorandom permutation and a random Clifford. This improves on the prior “P F C” construction of (Metger-Poremba-Sinha-Yuen, FOCS ’24; Ma-Huang, STOC ’25).
∗
Yale University, New Haven, CT, USA Princeton University, Princeton, NJ, USA ‡ New York University, New York, NY, USA § Columbia University, New York, NY, USA ¶ University of California Berkeley, Berkeley, CA, USA †
Contents 1 Introduction 4 1.1 Prior Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 1.2 Our Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 1.2.1 Tableau Recording . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1.2.2 Path Recording . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.2.3 Approximations and Pseudorandomness of the P C Ensemble . . . . . . . . . 13 2 Technical Overview 2.1 Tableau Recording . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.1.1 Other Query Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 Path Recording . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3 Pseudorandomness of the P C Ensemble . . . . . . . . . . . . . . . . . . . . . . . . .
14 14 18 20 27
3 Preliminaries 3.1 Notation for compact groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2 Purified Oracle Algorithms (or Adversaries) . . . . . . . . . . . . . . . . . . . . . . . 3.3 Peter-Weyl Theorem and the Fourier Transform . . . . . . . . . . . . . . . . . . . . . 3.3.1 Properties of the Fourier Transform . . . . . . . . . . . . . . . . . . . . . . . 3.4 Complete Reducibility and Schur-Weyl Duality . . . . . . . . . . . . . . . . . . . . . 3.5 Diagram Algebras and the Schur Representation . . . . . . . . . . . . . . . . . . . . 3.6 Trace forms and dual bases for semisimple algebras . . . . . . . . . . . . . . . . . . . 3.7 The (dual) Clebsch–Gordan transform and Clebsch–Gordan coefficients . . . . . . . 3.8 The Generalized Schur Transform . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.9 Young Tableaux and Bratteli Paths . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.10 Clebsch-Gordan Coefficients in the Gelfand-Tsetlin Basis of Unitaries . . . . . . . . 3.11 The Fourier Basis of Semisimple Algebras . . . . . . . . . . . . . . . . . . . . . . . . 3.12 Ratios of Irrep Dimensions for the Partition and Symmetric Group Algebras . . . . .
30 30 31 31 32 33 34 36 37 39 40 43 45 45
4 The Tableau Recording Oracle 4.1 The Uncompressed Representation Oracle . . . . . . . . . . . . . . . . . . . . . . . . 4.2 The Tableau Recording Oracle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2.1 Equivalence of the uncompressed and tableau recording oracles . . . . . . . . 4.2.2 Other query types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2.3 Efficient Implementation for the Unitary Group . . . . . . . . . . . . . . . . .
46 47 47 48 51 52
5 The Path Recording Oracle 5.1 Defining the Path Recording Oracle . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.2 Path Recording Theorem Statement . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.3 Defining the partial isometry Ut . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.4 Path Matrix Elements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.5 Proof of Theorem 5.3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.6 Transpose queries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.7 Schur Orthogonality for the Commutant Algebras . . . . . . . . . . . . . . . . . . . . 5.8 Interpretation of the Commutant EPR projector . . . . . . . . . . . . . . . . . . . . 5.9 Adaptive Queries to the Update Rule . . . . . . . . . . . . . . . . . . . . . . . . . . .
59 60 62 63 64 66 67 68 70 71
6 Approximation and Specialization to Specific Groups 6.1 The Unitary Path-Recording Oracle of [MH25] . . . . . . . . . . . . . . . . . . . . . 6.1.1 The Distinct Subspace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.1.2 The [MH25] oracle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.1.3 Proof of approximate equivalence . . . . . . . . . . . . . . . . . . . . . . . . . 6.2 The Unitary Haar Cipher . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.2.1 Recording Oracle for the Unitary Haar Cipher . . . . . . . . . . . . . . . . . 6.2.2 Diagonal Unitaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3 Zhandry’s Compressed Phase Oracle . . . . . . . . . . . . . . . . . . . . . . . . . . .
77 77 77 77 78 82 86 89 91
7 PC is a Pseudorandom Unitary 96 7.1 The Distinct, Nonplussed Subspace . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 7.1.1 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 7.1.2 Unitary 2-designs and the Distinct Nonplussed Subspace . . . . . . . . . . . . 98 7.2 The Action of the Partition Algebra on the Distinct Nonplussed Subspace . . . . . . 104 7.2.1 The Dual of a Permutation Element . . . . . . . . . . . . . . . . . . . . . . . 106 7.3 Additional Properties of the Update Operators . . . . . . . . . . . . . . . . . . . . . 108 7.4 Updates in the Distinct Nonplussed Subspace . . . . . . . . . . . . . . . . . . . . . . 110 7.5 Putting it Together . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
1
Introduction
In algorithms, complexity, cryptography, and quantum information science, it is common to encounter an algorithm or experiment that has access to some form of random transformation. In the context of quantum computing, the algorithm is typically quantum, and the transformation itself may be either classical (a function x 7→ f (x)) or quantum (an n-qubit unitary transformation or a quantum channel). Although these transformations, such as random Boolean functions or Haar-random unitaries, are not computationally efficient, they serve several important purposes: • They serve as an ideal model for justifying the correctness of algorithms. In practice, they can be replaced with an efficient transformation that is either provably pseudorandom or “scrambling” enough that the ideal model is accepted as a heuristic [BR93, SML+ 25]. This captures a variety of applications from the classical use of hashing in data structures [MU17] to theoretical justifications of quantum algorithms such as random circuit sampling [AAB+ 19]. • They can be used to prove lower bounds ruling out efficient black-box algorithms for computational problems (as “random instances” of black-box problems are often the hardest). For example, this can be used to rule out black-box quantum algorithms for NP that are faster than Grover search [BBBV97, Zha19]. • They can be used for analyzing the security of cryptographic constructions such as the LubyRackoff construction of pseudorandom permutations/block ciphers [LR88, Car26] and the Metger-Poremba-Sinha-Yuen construction (and Ma-Huang analysis) of pseudorandom unitaries [MPSY24, MH25]. Indeed, most such security proofs proceed by a hybrid argument: switching a pseudorandom object (such as a PRF) to a fully random one (a random function) and then arguing that an adversary cannot break the idealized variant of the construction. In this work, we seek to understand how to analyze the behavior of such algorithms. Classically, the basic tool/data structure for such analysis is called “lazy sampling”: instead of thinking of the exponential-size random object as being sampled “at the beginning”, only sample the pieces of the object that are needed for each step of the algorithm. For example, • Instead of sampling a random Boolean function f : {0, 1}n → {0, 1}n , one can lazily sample its truth table. Whenever the algorithm wants to query f (x), it (1) checks whether an input-output pair (x, y) has been recorded in the existing partial truth table (and uses y if so), and (2) otherwise samples a new random string y and appends (x, y) to the data structure. • If instead the algorithm wants to query a random permutation p : {0, 1}n → {0, 1}n , one can do exactly the same thing, except that each lazily sampled output y should be sampled uniformly from all output strings that do not already appear in the data structure. In general, this kind of lazy sampling can be done for any distribution D of functions such that the conditional distribution h i p(y | x, (x1 , y1 ), . . . , (xt , yt )) = Pr f (x) = y | f (x1 ) = y1 , . . . , f (xt ) = yt f ←D
is efficiently sampleable. For this efficient simulation, we think of f as undetermined outside of the partial truth table (x1 , y1 ), . . . , (xt , yt ).
4
Compressed Oracles and Recording Oracles. For quantum algorithms, the tool of choice for this problem has been compressed oracles [Zha19, MH25] (also known as recording oracles). Compressed oracles are quantum data structures that adapt the classical notion of lazy-sampling to allow quantum interactions. That is, they enable efficient simulation of quantum algorithms that interact (in a black-box manner) with a randomly chosen operation. In this work, this random operation will be a unitary sampled from some distribution D. Specifically, we will consider the case in which D is chosen from the uniform measure over a finite group or, more generally, from the Haar measure over any compact Lie group.1 Informally, a compressed oracle records in superposition the partial information that the algorithm would have discovered about the group element g if it were interacting with the real oracle. Rather than fully sampling g, the compressed oracle is stateful, maintaining this partial information on-thefly. But unlike classical lazy-sampling, the “random choices” are made coherently, in superposition. As the algorithm queries the oracle, its internal state and the data structure become entangled. The functionality of compressed oracles is that a quantum query algorithm should not be able to distinguish whether it is interacting with the real oracle or with the stateful compressed oracle. This allows us to use the compressed oracle to analyze the behavior of the algorithm if it were to query the real oracle. Remark 1.1 (Desiderata for compressed oracles). We list some key desirable properties of a compressed oracle. 1. Polynomial-space encoding of the data structure. This is the bare minimum requirement to consider the oracle “compressed”. 2. Polynomial-time update algorithm. This enables efficient simulation of quantum query algorithms accessing the oracle. 3. Perfect simulation, or at least small simulation error. That is, the algorithm should not be able to distinguish it from the real oracle. Ideally, this simulation is perfect, but if not, then we would like it to be valid for as many queries as possible. 4. Interpretability. This property is somewhat subjective. Given a quantum query algorithm A(·) that we are simulating using a compressed oracle, we would like the data structure to encode, in some understandable way, useful information about the algorithm’s computation. This is often crucial for proving any sort of lower bound (including cryptographic security proofs) against quantum query algorithms. In the classical setting, lazy sampling algorithms indeed satisfy all of these properties (with property (2) requiring efficient conditional sampling). For example, after t classical queries to a random function f , lazy-sampling the function has the effect of recording exactly the information of a t-size partial truth table of f . Unlike classical algorithms, quantum algorithms can learn information in superposition, and even forget the information previously learned. Despite much recent effort, building and analyzing compressed oracles in the quantum setting has thus proved to be far more subtle. In this paper, we ask the following question: Is there a general-purpose, interpretable compressed oracle that allows one to implement such quantum lazy-sampling for every compact group? 1
Compact Lie groups are the groups that can be realized as closed subgroups of the unitary group in finite dimension, and include all finite groups.
5
1.1
Prior Work
We briefly discuss some prominent examples of existing compressed oracles: Random Boolean functions. A seminal work of Zhandry [Zha19] built compressed oracles for simulating quantum queries to random Boolean functions. Zhandry considered two related query models: • For a random function f : {0, 1}n → {0, 1}, queries to the n-qubit unitary |x⟩ 7→ (−1)f (x) |x⟩. • For a random function f : {0, 1}n → {0, 1}m , queries to the (n + m)-qubit unitary |x⟩ |y⟩ 7→ |x⟩ |y ⊕ f (x)⟩. [Zha19] gives compressed oracles for both of these models. The compressed phase oracle (and its generalization to a controlled phase oracle) unambiguously satisfies all four of the above desiderata. Regarding (4), the compressed phase oracle simply records, for each input x that has been queried by the algorithm, the parity of the number of times that it has been queried. The compressed “standard” oracle is written to satisfy properties (1)–(3) and mostly satisfies (4) up to some small error terms (see, e.g., [Unr23, Section 3]). These compressed oracles have been used to great effect in proving quantum query complexity lower bounds [Zha19, LZ19a, PCX25, TW25, JZ25] as well as in (post-)quantum cryptographic constructions and security analyses [Zha19, LZ19b, CFHL21, HLS24, Car26]. Haar-random unitaries. A recent work of Ma and Huang [MH25] constructs a compressed oracle that simulates Haar-random unitaries. Their construction achieves simulation error O(t2 /N ) for algorithms that make t queries to an N -dimensional unitary, and has an extremely natural interpretation: the compressed oracle records superpositions of Feynman path information |x1 ⟩ 7→ |y1 ⟩ , . . . , |xt ⟩ 7→ |yt ⟩ of the algorithm’s queries, but forgets the order of the queries (so only the set {(x1 , y1 ), . . . , (xt , yt )} is recorded). Thus their compressed oracle satisfies properties (1)–(4) except that it fails to achieve perfect simulation for (3). Moreover, their compressed oracle has already proved quite useful in quantum cryptographic constructions [MH25, ABGL25b, ABGL25a, HY25, AGL25, SML+ 25, BG26], starting with the first provable construction of pseudorandom unitaries using post-quantum cryptography (analyzing the “P F C” construction proposed by [MPSY24]). Random permutations. More recently, impressive progress has been made towards understanding compressed permutations [Unr23, MMW25, Car26].2 Thus far, the model of choice has been a “standard” XOR oracle b |x⟩ |y⟩ |b⟩ 7→ |x⟩ |y ⊕ π (−1) (x)⟩ |b⟩ for a random permutation π : {0, 1}n → {0, 1}n . The state-of-the-art result here is a compressed permutation oracle of Carolan [Car26] (as well as a compressed oracle of Unruh [Unr23] that is not an isometry) that provably simulates random permutations for up to O(N 1/12 ) queries [Car26]. Intriguingly, [Car26] proves quantum query lower bounds for several problems that are tight relative to his compressed permutation oracle, which would imply tight lower bounds relative to random permutations if the simulation error could be improved. 2
See also [Ros21] for a related work on quantum query lower bounds for permutations. We discuss this related work in more detail in Section 1.2.1.
6
We emphasize that each of the above compressed oracles was arrived at via a (very clever) ad-hoc argument tailored to the specific simulation problem at hand. Indeed, it has proved especially challenging to identify the right kind of construction/argument for compressed permutations, let alone anything more sophisticated that might come along in the future. Compressed Group Representations. A recent work of Grinko and Yoshida [GY25] proposed what we call a tableau-recording oracle: a general-purpose compressed oracle for simulating query access to a Haar-random element of a compact Lie group G that records the partial information in the Fourier basis of G. We describe the relevant formalism in more detail in Section 1.2, as it is essential to our work. Along the way to our main results, we also give a new proof of the main result of [GY25]. We emphasize that unlike prior compressed oracles, the tableau-recording oracle is not clearly interpretable (see Section 2.1 for more details). This presents a major obstruction to using it in applications such as query complexity lower bounds and cryptographic security proofs.
1.2
Our Results
In this work, we develop a general paradigm for designing and analyzing compressed oracles. In particular, we define an interpretable compressed oracle for a Haar-random element of an arbitrary compact Lie group G3 that acts on n-qubit states via a representation ρ : G → U (N ).4 This setting easily captures the three prominent examples described above, as random functions, random permutations,5 and Haar-random unitaries can all be described as Haar-random group representations.6 Our framework also captures several other natural examples of interest, including: • Haar-random orthogonal unitaries O ← O(N ) (unitaries with real entries). • Random elements of the hyperoctohedral group of products P F , where P is a permutation unitary and F is a binary phase unitary. This group arises naturally in [MH25]. • Similarly, the colored permutation groups of products P F where F can be a q-ary or even continuous complex phase unitary. • The Haar-random unitary cipher |k⟩ ⊗ |x⟩ 7→ |k⟩ ⊗ Uk |x⟩ for a collection of i.i.d. Haar-random unitaries {Uk }; this model represents an idealized pseudorandom unitary or encryption scheme. • Random elements of subgroups of the symmetric group such as the alternating group AN . Since our compressed oracle can be seen as a generalization of the Ma-Huang oracle, we refer to our compressed oracle as the path-recording oracle. 3
We note, again, that this includes all finite groups as a special case. A unitary representation of a group G is any homomorphism from the group to the unitaries. That is, it requires that ρ(g) ρ(h) = ρ(gh) for all group elements g, h ∈ G. 5 To capture permutations, we instead consider the in-place permutation oracle |x⟩ 7→ |π(x)⟩, which (along with its inverse) is algorithmically equivalent to the XOR oracle. 6 We discuss later how to handle inverse queries, which are an anti-representation of the group. 4
7
x9 x3 x1 x6
y7 y2 y11 y4
x5 x4
y9 y1
n
(x1 ,y1 ), (x2 ,y2 ), (x3 ,y3 ), (x4 ,y4 ), (x5 ,y5 ), (x6 ,y6 ), (x7 ,y7 ), (x8 ,y8 ), (x9 ,y9 ), (x10 ,y10 ), (x11 ,y11 )
x2 x10
y6 y10
x8 x11 x7
y3 y8 y5
o
(b) A basis element of the path recording.
(a) A basis element of the tableau recording.
Figure 1: In the two types of compressed oracles, the resulting data structures take different forms. The examples shown above correspond to the case in which the group is the unitary group.
In fact, we derive both the tableau-recording oracle and the path-recording oracle together from first principles, establishing the following: • For every unitary representation ρ of a compact Lie group G, the tableau- and path-recording oracles perfectly simulate query access to a Haar-random ρ(g) (and therefore, simulate each other). We identify simple Uhlmann transformations relating these compressed oracles to each other and to a naı̈ve “uncompressed oracle” (see Section 2.1). • In the special case G = U (N ), our framework easily recovers the Ma-Huang approximate path-recording oracle while avoiding their O(t2 /N ) simulation error. • Other settings of our path-recording oracle automatically recover Zhandry’s compressed oracle as well as other natural ideal models. Finally, as our main application, we use our path-recording oracles to prove the security of a new, extremely simple construction of a pseudorandom unitary: the product P C of a random permutation P and a circuit C sampled from a unitary 2-design (such as a random Clifford circuit). 1.2.1
Tableau Recording
As a starting point, in Section 4, we give a new proof of the following theorem. Theorem 1.2 ([Har05, GY25]). Let ρ be an N -dimensional unitary representation of a compact Lie group G. Let Aρ(g) denote a quantum query algorithm with oracle access to ρ(g) for a Haar-random g ← G (for finite groups, the uniform distribution). Then, there is an isometry QTab acting on the algorithm’s query register A and a recording ρ register R with the following properties: 2t 1. After t queries to QTab ρ , the dimension of R is at most N .
2. QTab has an efficient implementation relative to the Clebsch-Gordan transform [BCH05, ρ Har05] and dual Clebsch-Gordan transform [Ngu23, GBO23] for G. 3. The mixed state obtained by running Aρ(g) for a Haar-random g is identical to that of running Tab AQρ and tracing out the R register. Moreover, there is a variant of this isometry that also supports queries to the conjugate representation ρ(g)∗ , the inverse map ρ(g)† , the transpose map ρ(g)T , and controlled versions of these unitaries. Thus, the Tableau-recording oracle always satisfies desiderata (1) and (3), and reduces property (2) (efficient updates) to a previously studied problem in algorithmic representation theory. In particular, applying this framework to the defining representation of the unitary group U (N ), this gives an efficient algorithm for perfect stateful simulation of Haar-random unitaries. 8
Related work to Theorem 1.2. The tableau recording isometry QTab was originally studied in ρ [Har05, Section 8.1.3] in the different context of “generalized phase estimation”.7 Its application to compressed oracles and simulation, including the first proof of Theorem 1.2 and the first efficient U (N ) implementation, is due to the recent work [GY25]. Our proof uses a different formalism/approach compared to [GY25], proceeding from first principles by purifying the group element in the (countably infinite-dimensional) Hilbert space of square integrable functions on the group, L2 (G), and then viewing it in the Fourier basis to recover the tableau-recording oracle (see Section 2.1 for more details). This gives an explicit Uhlmann transformation (the Fourier transform) relating the compressed and naı̈ve uncompressed representation oracles. Additionally, a recent work of Rosmanis [Ros21] considers the special case of random permutations and proves a quantum query lower bound for permutation inversion. While [Ros21] uses many of the techniques typical of the compressed oracle literature, the work only considers an uncompressed oracle, with the purification register consisting of a structured superposition of permutations that agree with a partial assignment {xi → yi }i∈[t] . Such states are not orthogonal, and so it does not define or study a compressed oracle. It does take a representation-theoretic view of the projectors onto low and high success probability, which correspond to projectors onto certain natural subspaces in the Fourier/tableau basis. Other Query Types. We briefly mention two improvements that we make to Theorem 1.2. First, we give simple black-box reductions between the four query types ρ(g), ρ(g)∗ , ρ(g)† , and ρ(g)T . Tab Tab Tab Theorem 1.3. Given black-box access8 to QTab ρ , we can implement Qρ∗ , QρT , and Qρ† each with a single application of QTab ρ , and simple pre- and post-processing.
In the case of transpose queries, QTab , this pre- and post-processing only involves exchanging ρT two registers, which is, of course, simple and efficient. In the case of conjugate and inverse queries, this involves performing a bijective mapping between the labels and bases of two corresponding irreducible representations9 (between an irrep and its dual irrep), and its efficiency depends on the group and how its irreps are encoded. The Unitary Group. For the unitary case in particular, we show in Section 4.2.3 that this mapping is a simple signed flip on the tableau data structure (which consists of simply rotating the data structure, with an attached ±1 phase depending on its parity; see Definition 4.2). This in particular allows us to show that the dual Clebsch-Gordan transform [Ngu23, GBO23] for the unitary group can be very simply reduced to the (standard) Clebsch-Gordan transform. 7
Harrow was interested in an algorithm — called generalized phase estimation (GPE) — that allowed for L measuring (and performing operations controlled on) the hidden irrep label associated with a state |ψ⟩ ∈ V ≃ λ Vλ ⊗ Mλ belonging to a completely reducible representation of G, without having to explicitly decompose V . Rather than maintaining a recording register R for simulating queries to a Haar-random ρ(g), Harrow used R as a temporary workspace for GPE, which only requires one query to what we call QTab . In Section 8.1.3, Harrow observes the form ρ of QTab as part of a discussion on the relationship between the Clebsch-Gordan transform and the Fourier transform. ρ 8 For complex conjugate queries and transpose queries, we technically need the complex conjugate, QTab , of QTab . ρ ρ For all the cases we consider, it is possible to write QTab using only real coefficients, which makes these the same. But ρ even for general groups, this provides a useful reduction from conjugate and transpose queries to QTab , which has a ρ generic efficient implementation given any implementation of QTab . ρ 9 A representation ρλ is irreducible if it has no non-trivial G-invariant subspaces. It turns out that for all compact Lie groups G, there is a countable list of all irreducible representations (or irreps) of G up to isomorphism, and for particular groups of interest enumerating irreps and their bases often has a simple combinatorial interpretation.
9
Lemma 1.4. For the unitary group, the dual Clebsch-Gordan transform, in the same basis need for Theorem 1.2, is given by a signed flip (the Flip operation in Definition 4.2), followed by a Clebsch-Gordan transform, followed by another signed flip. That is, dCG = Flip · CG · Flip. Thus we can express the update of Theorem 1.2 purely in terms of the Clebsch-Gordan transform without requiring a separate dual Clebsch-Gordan transform. Moreover, the different query types are recovered by pre- and post-processing with a Swap, a Flip, or both.10 Query type
Update
Standard ρ(g)
QTab ρ
Transpose ρ(g)T
Swap · QTab · Swap ρ
Conjugate ρ(g)∗
Flip · QTab · Flip ρ
Inverse ρ(g)†
Swap · Flip · QTab · Flip · Swap ρ
Table 1: Summary of the four different query types for the unitary group. In each case, one must only preand post-process with one or both of two simple operations.
1.2.2
Path Recording
The primary drawback of QTab is interpretability; given the contents of the recording register R, it ρ is hard to intuit and argue what information about ρ(g) has actually been recorded. For our first main contribution, we give a second compressed oracle QPath that provides better ρ interpretability. In order to motivate QPath , we briefly recall the [MH25] approximate path-recording ρ oracle for the defining representation of U (N ). In the [MH25] oracle, • The compressed oracle register R is spanned by set states |{(x1 , y1 ), . . . , (xt , yt )}⟩, on which the restriction is imposed that the yi are all distinct. • When a new query is made on an input |x⟩, the recording register |S⟩ is updated to a uniform superposition of |S ∪ {(x, y)}⟩ over all y ∈ / S, while the state |y⟩ (entangled with the recording register |S ∪ {(x, y)}⟩) is returned as the output. The rough intuition for this oracle is that the compressed purification R is supposed to record Feynman path information x1 7→ y1 , . . . , xt 7→ yt about the oracle queries; however, only the set of pairs is recorded, which means that the order of the queries has been forgotten by the data structure. We build a path-recording oracle that, unlike the one in [MH25], is exact (no simulation error), and moreover fully generalizes to work for any compact Lie group. While for G = U (N ) (and ρ the defining representation11 ), the path-recording oracle records Feynman paths up to a permutation symmetry (that is, a symmetry in the group algebra C[St ]), our general path-recording oracle records Feynman paths up to symmetries imposed by the commutant algebra of ρ⊗t . This is the algebra At 10 Here, we are writing Swap to swap between two sets of registers in the recording, and Flip to apply in parallel to both sets of registers. Note that Flip itself is simply rearranging the entries on each side, plus a sign that is trivial to compute based on the parity of all the entries. 11 The defining or fundamental representation of U (N ) is the one that represents each unitary as its own matrix ρ(U ) = U for every group element U ∈ U (N ).
10
of all operators that commute with the tensor power of ρ(g) for all group elements (see Table 2 for the commutant algebras of some important groups): At = {A ∈ End((CN )⊗t ) : A · ρ(g)⊗t = ρ(g)⊗t · A for all g ∈ G}. =: EndG ((CN )⊗t )
Group Unitary
U (N )
Unitary Product
U (N )K
Tensor space
Representation
VN⊗t
U ⊗t
VN⊕K
⊗t
Commutant algebra
⊗t
P
|k⟩⟨k| ⊗ Uk
k∈[K]
Symmetric Group Algebra
C[St ]
Colored Permutation Group Algebra
C[ZK ≀St ]
Brauer Algebra
Bt (N )
Tanabe Algebra
Tt (N, r)
Partition Algebra
Pt (N )
(Haar Cipher)
Orthogonal
VN⊗t
O(N )
Ug⊗t Ug is the standard embedding of g ∈ O(N ) as a unitary over Ct
Colored Zr ≀ St Permutations
VN⊗t
(Pπ Ff )⊗t Pπ is the permutation matrix of π ∈ SN , and Ff is diagonal with r’th roots of unity
Symmetric
Boolean Functions
SN
ZN 2
(VN −1 ⊕ V1 )⊗t
V1⊕N
⊗t
Pσ⊗t Pσ is the permutation matrix of σ ∈ SN
(-1)f (x) |x⟩⟨x|
P
⊗t
Colored Even-Partition Algebra
x∈[N ]
Table 2: Example instances of commutant relationships (Schur-Weyl dualities) between group actions on tensor spaces and their commutant algebras. The path-recording oracle for any compact Lie group can be described in terms of its corresponding commutant algebra.
Unlike the [MH25] oracle, the updates for our generalized path-recording also require reweighting different subspaces in an important representation-theoretic basis called the Schur basis (see Section 2.2 for details). For now, we informally state the form of our path-recording oracle to give a taste of the result. Theorem 1.5 (informal, see Definition 5.1 and Theorem 5.3). Let ρ be an N -dimensional unitary representation of a compact Lie group G. Let Aρ(g) denote a quantum query algorithm with oracle access to ρ(g) for a Haar-random g ← G. Then, there is an isometry QPath acting on the algorithm’s query register A and a recording ρ register R with the following properties: 1. After t queries to QPath , the content of R is ordered Feynman path information (x1 , . . . , xt , y1 , . . . , yt ) ρ for xi , yi ∈ [N ].
11
2. The tth application of QPath can be expressed in the following form: ρ QPath ρ,t =
ΛAt
R
| {z }
·
ΩAt
R
| {z }
· App · Λ+ At−1 | {z } |
ReweightEnd Symmetrize Append
{z
R≤t−1
ReweightStart
,
(1.1)
}
where: • At = EndG ((CN )⊗t ) denotes the commutant algebra of ρ⊗t . • ΛAt , Λ+ At−1 denote certain subspace reweighting operators, P • App = xt ,yt |yt ⟩⟨xt |A ⊗ |(xt , yt )⟩Rt denotes the (un-normalized) initialization of an EPR pair shared between the algorithm and the recording. • ΩAt denotes a symmetrization projection that can be described in terms of At and represents forgetting partial Feynman path information. 3. The mixed state obtained by running Aρ(g) for a Haar-random g is identical to that of running Path AQρ and tracing out the R register. Moreover, essentially the same update also supports queries to ρ(g)T , while another variant additionally supports queries to ρ(g)∗ and ρ(g)† . We give more details in Sections 2.2 and 5, but we emphasize that the symmetrization operation ΩAt has an extremely natural interpretation directly in the “path basis” |(x1 , y1 ), . . . , (xt , yt )⟩. (Lemma 5.11): Choose any basis for the commutant algebra (for instance, for group algebras, simply take the basis of the group elements), and apply every such basis element in superposition.12 For instance, for the unitary group, ΩSt amounts to applying all possible permutations, in superposition, among the t different (xi , yi ) pairs. Thus, modulo understanding the subspace reweighting ΛAt , the update rule is highly interpretable. Equivalence of Tableau and Path Recording. We emphasize that as written, QPath is a ρ Path mathematical description and is not necessarily algorithmic. On the other hand, we show that Qρ is isometric to the algorithmic QTab via two applications of the generalized Schur transform, special ρ cases of which have been studied in [BCH05, Kro19, FTH23, Ngu23, GBO23, BFG+ 25], and which can be built from Clebsch-Gordan transforms. We thus have that the updates to our path recording oracle can likewise be made efficient with an efficient Clebsch-Gordan transform. Concurrent Work on Path Recording. Concurrently to this work, we were made aware that the authors of [GY25] will update [GY25] to include a version of the path-recording oracle. Their path-recording oracle, like ours, is derived by use of a generalized Schur transform on the tableau-recording oracle. Their path recording update is defined by transporting the tableau update through this isometry. In the special case of G = U (N ), they also give a mathematical formula (different from ours) for the path basis update matrix coefficients. In this work, beyond defining the path-recording oracle for general compact Lie groups, we focus on providing an interpretable mathematical description of the path basis update rule (Theorem 1.5) and showing how to use it for security proofs and applications. 12
Technically, we apply each such basis element to the all the xi ’s and its dual transpose to all the yi ’s (see Lemma 5.11 for details). For group algebras, this amounts to applying the same group element across both the x and y entries.
12
1.2.3
Approximations and Pseudorandomness of the P C Ensemble
Our second main contribution is analyzing QPath in special cases of interest by introducing approxiρ mations. Our thesis is that for each group representation, knowing what the commutant algebra At looks like is the key to understanding what the exact updates to the Feynman path recording are effectively doing to the Feynman paths (when they record, when they forget, etc.), and how a more elementary approximate update can be derived. As a proof of concept, in Section 6, we show how to derive the [MH25] path-recording oracle for Haar-random unitaries from our path-recording oracle (when specialized for U (N )) via a sequence of two approximations: • restricting our oracle to appending distinct outputs y1 , . . . , yt in the path basis, and • replacing the subspace reweighting operators ΛAt , Λ+ At−1 by scalars (i.e., no reweighting), which results in the Ma-Huang oracle, rewritten as √ 1 √ Π QPath = t · Ω AppAR . · Dist C[St ] MH RY R N −t+1 Indeed, one can essentially read off the algorithmic Ma-Huang update from this expression: the key ideaPis identifying the Ma-Huang set states {(x1 , y1 ), . . . , (xt , yt )} as St -symmetrized path states ⊗2 |x , . . . , x , y , . . . , y ⟩. √1 1 t 1 t π∈St π t! Expanding on this, we show in Section 6 how the path-recording oracle can be used to automatically derive three other compressed oracles that have been either implicitly or explicitly studied before: Zhandry’s original compressed (phase) oracle, the ideal Haar cipher |k, x⟩ 7→ |k⟩ ⊗ Uk |x⟩, and Haar-random diagonal unitaries |x⟩ 7→ ux |x⟩. Finally, for our primary application, in Section 7 we analyze the path-recording oracle for the in-place representation of the permutation group SN : ρ(π) · |x⟩ = |π(x)⟩ . This compressed oracle is particularly well-behaved—it turns out to approximately match the compressed unitary oracle!—on recording states restricted to a dense “distinct, nonplussed” subspace ΠX,Y DNP . Through a careful analysis, we are able to leverage this to prove the following theorem: Theorem 1.6 (see Theorem 7.34). For all t-query adversaries Adv(·) , the oracle distribution P · C for a uniformly random in-place permutation P and C sampled from any unitary 2-design is O(t2 /N )-indistinguishable from a Haar-random unitary. This improves on the P F C construction of pseudorandom unitaries (PRUs) of Metger, Poremba, Sinha, and Yuen [MPSY24] (proved secure by Ma and Huang [MH25]): we prove that the random phase F is actually unnecessary, and P C is already a PRU! By using a pseudorandom permutation for P , this yields, in our opinion, the simplest PRU construction that has been analyzed to date. Accordingly, the same proof gives a new, simple construction of unitary t-designs using 2t-wise independent permutations: Theorem 1.7 (See Corollary 7.35). Suppose that P is sampled from a family of non-adaptive (t, ε) post-quantum pseudorandom permutations (respectively, (t, ε)-adaptively secure post-quantum pseudorandom permutations) with statistical security and that C is sampled from an exact 2-design. Then, P · C is an ε + O(t2 /N ) approximate t-design (respectively, an ε + O(t2 /N ) approximate adaptive t-design). In particular (see [Zha12, MPSY24]), the conclusions hold if P is sampled from a family of 2t-wise independent permutations, or 2ε · N −t -almost 2t-wise independent permutations. 13
More broadly, because of its wide applicability, as well as its interpretability, we believe that our path-recording oracle will facilitate a variety of additional pseudorandomness results as well as new quantum query complexity lower bounds.
2
Technical Overview
In this section, we overview the main ideas behind our results and their proofs.
2.1
Tableau Recording
We begin with the tableau recording oracle. Again, we remark that the tableau recording oracle for finite groups can be seen implicitly in [Har05, Section 8.1.3] and was also defined and analyzed in [GY25]. We describe the construction for expository purposes, for some technical reasons (a different proof and some slight variations/improvements), and because it is connected to and will help explain our path-recording oracle. First, given a representation ρ : G → U (N ), why should we expect there to be a compressed oracle at all? The reason is a direct generalization of Zhandry’s compressed oracle. Recall that in the case of the binary phase representation ρ(f ) |x⟩ = (−1)f (x) |x⟩ of functions f : {0, 1}n → {0, 1},13 Zhandry’s compressed oracle is constructed in two steps: 2n
1. First, purify the random function f to a function register F ≃ C{0,1} ; here, F is initialized to the uniform superposition |+⟩ and a function query is represented by the unitary Qρ |x⟩ |f ⟩ = (−1)f (x) |x⟩ |f ⟩ . 2. Second, apply the quantum Fourier transform (in this case, simply the Hadamard transform) to F: the initialization is then |∅⟩ rather than |+⟩, while a function query is now written as QFourier |x⟩ |D⟩ = |x⟩ |D ⊕ {x}⟩ , ρ where D is interpreted as a subset of {0, 1}n , or “database”, and D ⊕{x} adds x to the database if x ∈ / D and otherwise removes it. The magic is that in the Fourier basis, after t queries, the database state |D⟩ is always t-sparse. It can thus be stored in sparse form using tn = t log N space. (In addition, the update is extremely simple and can be implemented efficiently.) How does this generalize to other group representations? The natural idea is to consider the same two-step process: 1. First, purify the random group element g to a “uniform superposition” on a register G. In the case of finite groups, we write G = C[G] to be a Hilbert space with basis {|g⟩ , g ∈ G}. In this language, the initial state is indeed the uniform superposition |+⟩, and the purified query can be written as Qρ |x⟩ |g⟩ = ρ(g) |x⟩ ⊗ |g⟩ . In the case of infinite groups such as U (N ), this is not the right purification (it would have uncountable dimension); instead, we use the well-studied countable-dimension Hilbert space of square-integrable functions Z n o 2 L (G) = f : G → C such that |f (g)|2 dg < ∞ , G 13
n We will later see that we should treat such functions as group elements of the group ZN 2 , for N = 2 .
14
where dg denotes the Haar measure on G. This Hilbert space comes equipped with commuting left- and right- actions of G (pre- and post- composition) that together define what is called the regular representation of G. This register is naturally initialized to the purified Haar measure (f = 1) and the purified query is analogous to above: Z Z Qρ |x⟩ ⊗ f (g) |g⟩ dg = ρ(g) |x⟩ ⊗ f (g) |g⟩ dg. G
G
2. Second, apply the quantum Fourier transform to G. When generalized from finite cyclic groups to arbitrary compact Lie groups, the Fourier transform is an isomorphism M ∼ F : L2 (G) −→ Vλ ⊗ Vλ∗ , (2.1) b λ∈G
b ranges over all irreducible representations (or irreps) of G (up to where the index λ ∈ G 14 isomorphism) and Vλ denotes the vector space underlying the irreducible representation ρλ .15 In other words, there exists an orthonormal Fourier basis spanned by states Z p F −1 |λ, X, Y ⟩ = dim(Vλ ) ⟨Y | ρλ (g) |X⟩ |g⟩ dg ∈ L2 (G) (2.2) G
b and |X⟩ , |Y ⟩ ranging over a basis of Vλ , such that the Fourier transform decomposes for λ ∈ G, 2 L (G) in this basis. L We call this basis λ Vλ ⊗ Vλ∗ the tableau basis by analogy to the case G = U (N ): the irreducible representations of U (N ) are indexed by Young diagrams λ, and the basis elements |X⟩ of Vλ correspond to semi-standard Young tableaux of shape λ (see Section 3.9 for details on Young diagrams and tableaux). While this is a natural proposal, the big questions are: • Is this Fourier basis representation compressible? • What is the form of the query QTab in this basis? ρ The first question is implicitly answered by the resolution to the second, but let us answer it separately anyway since it will be relevant for the path-recording oracle. One way to see why the basis is compressible is to observe that all recording states obtained by making t queries to Qρ are in the span of the following “t-power matrix element states” of L2 (G): Z ⟨y1 , . . . , yt | ρ(g)⊗t |x1 , . . . , xt ⟩ |g⟩ dg . G
This already places a limit on the dimension of accessible states on the recording register, but it does not say how they appear in the Fourier basis. To understand this, we make use of the Schur transform [BCH05] M ∼ Schur : (CN )⊗t −→ Vλ ⊗ VλAt , (2.3) bt λ∈G 14
For a compact Lie group, there are only countably many irreps. Note that we use ρ(g) to refer to the queried representation, which may or may not be reducible. On the other b hand, ρλ (g) is the irreducible representation corresponding to λ ∈ G. 15
15
b t ranges over a finite subset of the possible irreps16 and V At is some multiplicity space where λ ∈ G λ (we will say more about VλAt later). In particular, this means that there is a Schur basis consisting ⊗t of states Schur†|λ, X, S⟩ ∈ (CN )⊗t (such that the tensor power ρ(g) acts as the λ irrep, mapping them to Schur† |λ⟩ ⊗ ρλ (g) |X⟩ ⊗ |S⟩ ), and such states together span (CN )⊗t . We can thus insert the identity Schur† Schur and write the t-power matrix element state as Z Z ⊗t ⟨y1 , . . . , yt | ρ(g) |x1 , . . . , xt ⟩ |g⟩ dg = ⟨y1 , . . . , yt | Schur† Schur ρ(g)⊗t Schur† Schur |x1 , . . . , xt ⟩ |g⟩ dg , G
G
where Schur ρ(g)⊗t Schur† = λ∈Gbt |λ⟩⟨λ| ⊗ ρλ (G) ⊗ I. This implies that each t-power matrix element state is in the span of a restricted set of Fourier basis states (Equation (2.2)), Z Z ⟨Y, T | ρλ (g) ⊗ I |X, S⟩ |g⟩ dg = δS,T ⟨Y | ρλ (g) |X⟩ |g⟩ dg ∝ δS,T · F −1 |λ, X, Y ⟩ , P
G
G
b t . This exactly says that its Fourier transform such that λ comes from the restricted set of irreps G is supported on M Vλ ⊗ Vλ∗ , bt λ∈G
a small finite subset of the Fourier basis, of dimension at most dim((CN )⊗2t ) = N 2t . So the purification is in fact sparse in the Fourier (tableau) basis! Moreover, it can be stored using space at most O(t log N ). Finally, we consider the update rule QTab ρ . For the (t + 1)th query, this must be an isometry b which, for each λ ∈ Gt , maps M |x⟩ ⊗ |λ, X, Y ⟩ ∈ CN ⊗ Vλ ⊗ Vλ∗ −→ CN ⊗ Vλ+ ⊗ Vλ∗+ , b t+1 λ+ ∈ G
whose basis elements look like |y⟩ ⊗ λ+ , X + , Y + . Intuitively, upon the algorithm’s query, we want to grow X, Y “by one element each” to record an additional piece of information. It turns out that this update can be viewed as a composition of two instances of a well-studied map from representation theory: The Clebsch-Gordan transform [BCH05, Har05] is an isomorphism describing the irrep decomposition17 M ∼ CN ⊗ Vλ −→ Vλ+ ⊗ Mλ,λ+ b t+1 λ+ ∈G
for some multiplicity spaces Mλ,λ+ . For example, in the case G = U (N ) (where the Mλ,λ+ all have dimension 1), this describes the procedure for “inserting a new box” into a Young diagram/semistandard Young tableau (as in Figure 2). 16 b t is the set of all Young diagrams with For example, in the case G = U (N ) and ρ is the defining representation, G exactly t boxes. 17 Typically, the Clebsch-Gordan transform is reserved to the setting where both tensor factors are irreducible. In the body, we will often explicitly decompose ρ into irreps and then apply a controlled Clebsch-Gordan transform. However, it is also reasonable to consider a generalized definition of the Clebsch-Gordan transform allowing for reducible tensor factors. This will be useful, for example, for SN , whose natural representation on CN is reducible.
16
X1+
X 1 x ⊗ 2 7
1 5
2
3
1 Clebsch-Gordan “add a box”
α1 2 7
1 x 3 2
5
X2+ 1
1
+ α2 2 x 5
2
3 + ···
7
Figure 2: Example Clebsch-Gordan update for the unitary group, with the newly added box highlighted. Roughly speaking, each shape λ (Young diagram) that contains one extra box not in the original, and each valid filling (tableau) with the contents of X plus the new x value, receive some weight.
In general, applying this transformation to |x, λ, X⟩ will produce a superposition of elements of the form λ, λ+ , X + , m with |X + ⟩ ∈ Vλ+ and |m⟩ ∈ Mλ,λ+ . This (along with |Y ⟩), of course, does not match the type of vector that the update rule is supposed to output. L However, we can arrive at a valid element of λ+ Vλ+ ⊗ Vλ∗+ by inverting another irrep decomposition M Vλ∗ ⊗ Mλ,λ+ → CN ⊗ Vλ∗+ . λ
We refer to this map as an inverse dual Clebsch-Gordan transform.18 Applying this map to L |λ+ , λ, Y, m⟩ yields an element of CN ⊗ λ+ ∈Gbt Vλ+ ⊗ Vλ∗+ . It turns out that this composition (see Fig. 3) is equal to QTab ρ ! In [Har05], Harrow gives an abstract algebraic proof that these maps are equivalent (in the case of finite groups). In Section 4, we give a proof via a direct calculation in the Fourier basis. This is somewhat necessary in order to reason about algorithmic efficiency, because the Clebsch-Gordan transform is only defined up to choices of basis for the irrep and multiplicity spaces.19 We prove that the composition correctly computes QTab whenever the Clebsch-Gordan and dual Clebsch-Gordan ρ transforms are compatibly chosen to satisfy a certain identity on their matrix coefficients (see Lemma 3.21). Since, in the case of G = U (N ), a standard choice of Clebsch-Gordan transform on the Gelfand-Tsetlin basis of Vλ satisfies this matrix coefficient identity and has an efficient algorithmic implementation [BCH05, BFG+ 25], we conclude that QTab U (N ) has an efficient algorithm. In the body, we technically define the dual Clebsch-Gordan transform to decompose Vλ+ ⊗ (CN )∗ into (primal) irreps. Prior work on the dual Clebsch-Gordan transform assumes the representation of G on CN is irreducible, implicitly identifies the dual irrep on (CN )∗ with a pre-defined irrep space Vµ∗ , and decomposes Vλ+ ⊗ Vµ∗ , which roughly forces a different choice of basis on the dual space. To align with prior work, we translate from our dual Clebsch-Gordan transform to the previously defined one at the level of matrix coefficients. 19 Harrow implicitly forces a particular choice of basis for the multiplicity space, but algorithmically we are free to choose another basis. 18
17
|λ⟩
|λ+ ⟩
|X⟩
|X + ⟩
|Y ⟩
|Y + ⟩
λ+ C
dC†
m
X+
|µ⟩
|µ⟩
|x⟩
|y⟩
Figure 3: A single query can be decomposed into a Clebsch–Gordan transformation followed by the inverse dual-Clebsch-Gordan operation, though not on the same registers. The top three registers are those of the recording oracle’s data structure, while the bottom two are the algorithm’s registers. The algorithm’s multiplicity register (in cases where it exists) is not shown here since it is not touched by the update. For unitaries, µ is the single-box fundamental irrep that acts as ρ2 (U ) = U .
X 1
1
2
5
7
X+
Y 2
3 ,
1
2
3
4
2
4
query x
5
1
1 x 3
2
2
7
5
Y+ ,
1
2
2
y
3
4
4
5
Figure 4: When updating the tableau recording, both tableaux grow in the same way, such that the resulting shapes will always be identical. For the unitary group, this (very roughly) means that we add a box in the same place (in superposition over valid locations) for both the X and Y tableaux.
In fact, rather than using direct implementations of a dual Clebsch-Gordan transform [Ngu23, GBO23], we observe a simple identity (Lemma 4.3) that efficiently reduces the U (N ) dual ClebschGordan transform to the “primal” one, in the Gelfand-Tsetlin (or Young tableau) basis. This gives an efficient unitary compressed oracle in terms of only an efficient Clebsch-Gordan transform. 2.1.1
Other Query Types
What if we want to be able to query the complex conjugate ρ(g)∗ , the inverse ρ(g)† , or the transpose ρ(g)T of the representation? And what if we want to be able to perform controlled queries? Complex Conjugate Queries. We present two distinct ways to handle conjugate queries. We defer the second approach to the “transpose and inverse queries” discussion. For the first approach, complex conjugate queries ρ(g)∗ are themselves another representation of the group, which, for unitary representations, is also known as the dual representation ρ∗ (g). So we can consider the same derivation, but for ρ∗ instead of ρ. This has us switch the roles of the Clebsch-Gordan and dual Clebsch-Gordan transforms. Thus each ρ∗ (g) query can be implemented as in Figure 3, but with a dual Clebsch-Gordan followed by an inverse Clebsch-Gordan. 18
We also derive an alternative interpretation of this update for the special case G = U (N ): as referenced above, we show that a simple signed rotation (a Flip operation) of the Young tableaux is sufficient to implement a dual Clebsch-Gordan transform in terms of the primal Clebsch-Gordan transform. This means that (1) we can reduce conjugate queries to standard queries by simply flipping the Young tableaux |X⟩ and |Y ⟩ before and after the query, and (2) even standard queries can be implemented relative to just a primal Clebsch-Gordan transform, without any explicit reference to a dual Clebsch-Gordan transform. X
Y
3 3 4 4 5
,
4 3 5 2 2 1
4 3 6 4 3 1
2 2 5 3 5
Flip
Y
X
1 2 2 5 3 4
1 3 4 6 3 4
1 2 2 5 3 x 4
,
5 4 4 3 3
+
X
Query
5 3 5 2 2
Y ,
5 4 4 3 3
+
1 y 3 6 3 4 4
X+ Flip
5 3 5 2 2
Y+
3 3 4 4 5
,
4 x 3 5 2 2 1
2 2 5 3 5
4 4 3 6 3 y 1
Figure 5: Example complex conjugate query for the unitary group.
Of course, we may want to make queries to both ρ(g) and ρ∗ (g), or more generally to query both in superposition, as |0⟩⟨0| ⊗ ρ(g) + |1⟩⟨1| ⊗ ρ∗ (g). This is merely another representation of the group, and our framework above also works for this representation. The (generalized) Schur transform that results is closely related to the mixed Schur transform of [FTH23, Ngu23, GBO23] (more precisely, it is the direct sum of mixed Schur transforms for different sequences of ρ(g) and ρ∗ (g)). As before, each query is still a pair of Clebsch-Gordan transforms (the same Clebsch-Gordan transforms as for the standard query ρ(g)), depending on the control qubit. Controlled Queries. Controlled queries can be handled similarly, taking the representation ρcontrolled (g) := |0⟩⟨0| ⊗ I + |1⟩⟨1| ⊗ ρ(g). Since this is also a representation of the group, we can similarly apply the framework to this representation. This will, as expected,20 recover a tableau recording with an update that performs a normal ρ(g) update on the |1⟩ branch and does nothing on the |0⟩ branch. Transpose and Inverse Queries. Unlike complex conjugate queries, which are representations of the group, transpose and inverse queries are anti-representations,21 and therefore do not fall directly into the framework above. However, we make use of the following simple idea: implementing a transpose query can be thought of as conjugating a forward query by the following (anti-linear) isometry on L2 (G) Z Z Transpose ·
f (g −1 )∗ |g⟩ dg.
f (g) |g⟩ dg = G
G
In order to reason about this, we observe that Transpose implements the following simple involution on the Fourier basis (see Section 3.3.1): Transpose · F −1 |λ, X, Y ⟩ = F −1 |λ, Y, X⟩ . Thus, performing a transpose query in the Tableau basis simply requires swapping the roles of |X⟩ and |Y ⟩!22 20
Of course, since we already know what a controlled query should do, rerunning this framework for the controlled representation ρcontrolled (g) just to recover this behavior may be overkill. However, we say this to emphasize that we do not need any specialized ad hoc modifications for each new query type. 21 Unlike representations, which have ρ(g) ρ(h) = ρ(gh), anti-representations multiply in reverse order: ρ† (g) ρ† (h) = † ρ (hg) 22 Since Transpose is anti-linear (or conjugate-linear) and is not a physically implementable operation, it turns out that rather than performing the update rule QTab on the swapped registers, one needs to perform the complex ρ
19
(λ) X
(λ) Y
3 3 4 4 5
,
4 3 5 2 2 1
Y 2 2 5 3 5
2 2 5 3 5
Swap
4 3 6 4 3 1
(λ) 3 3 4 4 5
,
4 3 6 4 3 1
Y+
X
2 2 5 3 x 5
Query
4 3 5 2 2 1
(λ) X+
,
4 3 6 4 3 1
y 3 3 4 4 5
X+ Swap
4 3 5 2 2 1
Y+
y 3 3 4 4 5
,
4 3 5 2 2 1
2 2 5 3 x 5
4 3 6 4 3 1
Figure 6: Example transpose query for the unitary group.
Similarly, we can perform an inverse query by implementing a conjugate query with |X⟩ and |Y ⟩ reversed. In fact any anti-representation can be handled this way. Finally, we remark that a similar idea can be used to derive a conjugate query in the Tableau basis, in terms of a (complex conjugated) standard query, using the anti-linear isometry Z Z Conj · f (g) |g⟩ dg = f (g)∗ |g⟩ dg. G
G
We refer the reader to Section 4.2.2 for more details.
2.2
Path Recording
While the Tableau recording oracle is mathematically beautiful, satisfies perfect simulation, and can be algorithmically efficient, it seems quite difficult to prove operationally useful properties of this compressed oracle. In contrast, Zhandry’s compressed oracle and the Ma-Huang path-recording oracle have easily interpretable “database states” on the recording register that can be used for proving quantum query lower bounds and pseudorandomness results. For example, in the Ma-Huang path-recording oracle, • The recording register contains superpositions of “set states” of the form |{(x1 , y1 ), . . . , (xt , yt )}⟩. • To make a query on an input |x⟩, and database state |D⟩, one does the following: – Create an EPR pair in superposition over y ∈ / {y1 , . . . , yt }23 – Swap one of the |y⟩’s into the algorithm’s register (replacing |x⟩) – Add the pair (x, y) (using the second |y⟩) to the database set D. One might naturally ask: why are they stored as sets rather than ordered tuples? This is easy to understand in the case of non-adaptive queries applied to distinct inputs: if you query a (purified) Haar-random unitary on distinct inputs |x1 , . . . , xt ⟩, this results in the uncompressed conjugate QTab ; but any circuit for QTab can be generically converted into a circuit for QTab ; following [Zha25], we ρ ρ ρ consider this to be a form of “black-box access” to the update. Moreover, in all the cases we consider, it is possible to write QTab in a basis in which it is purely real, in which case QTab = QTab and this distinction becomes moot. ρ ρ ρ 23 We remark that while y ∈ / {y1 , . . . , yt } is enforced to make this update procedure an isometry, this is not perfectly consistent with a Haar-random unitary (for example, if you query U ⊗t |x1 , x2 , . . . , xt ⟩ you may observe the same output y multiple times). As we will show, this is one out of two sources of simulation error in the Ma-Huang oracle.
20
recording24 Z U |x1 ⟩ ⊗ . . . ⊗ U |xt ⟩ ⊗ |U ⟩ dU = U
=
X Z
⟨⃗y | U ⊗t |⃗x⟩ · |⃗y ⟩ ⊗ |U ⟩ dU
y1 ,...,yt
U
X
|⃗y ⟩ ⊗
Z
=
(2.5)
U
y1 ,...,yt
X
⟨⃗y | U ⊗t |⃗x⟩ · |U ⟩ dU
(2.4)
Z |⃗y ⟩ ⊗
t Y
⟨yi | U |xi ⟩ · |U ⟩ dU ,
(2.6)
U i=1
y1 ,...,yt
and indeed the recording register has forgotten the ordering of x1 , . . . , xt (but remembers the matching between xi and yi ). Even more explicitly, let us try to compare the uncompressed L2 (G) recording with a naı̈ve path recording by defining the following map Θt : (CN )⊗2t → L2 (G). Z Θt |x1 , . . . , xt , y1 , . . . , yt ⟩ = ⟨⃗y | U ⊗t |⃗x⟩ · |U ⟩ dU. U
Then, if we think of a permutation π ∈ St as acting on |x1 , . . . , xt ⟩ by permuting the registers S(π) |x1 , . . . , xt ⟩ = xπ−1 (1) , . . . , xπ−1 (t) , we have that Z Θt · S(π) ⊗ S(π) |⃗x, ⃗y ⟩ = ⟨⃗y | S(π)† U ⊗t S(π) |⃗x⟩ · |U ⟩ dU ZU = ⟨⃗y | U ⊗t |⃗x⟩ · |U ⟩ dU
(2.7) (2.8)
U
= Θt |⃗x, ⃗y ⟩ .
(2.9)
This holds because every permutation S(π) on the registers commutes with the tensor power operator U ⊗t . In fact, let us write this identity slightly differently: Θt · S(π) ⊗ I |⃗x, ⃗y ⟩ = Θt · I ⊗ S(π)T |⃗x, ⃗y ⟩ , (2.10) which can be seen to hold by renaming S(π) |⃗y ⟩ → |⃗y ⟩. This means that the state |⃗x, ⃗y ⟩ contains redundant information and should not be used as-is in a recording oracle. However, if we instead used the state 1 X |{(x1 , y1 ), . . . , (xt , yt )}⟩ := √ S(π) ⊗ S(π) |⃗x, ⃗y ⟩ , t! π∈St then because we have symmetrized with respect to the symmetric group St , we have that (S(π) ⊗ S(π)) |{(x1 , y1 ), . . . , (xt , yt )}⟩ = |{(x1 , y1 ), . . . , (xt , yt )}⟩ , so these states satisfy the same symmetries as the states Θt |x, y⟩. Indeed, the image of the projector25 1 X ΩSt = S(π) ⊗ S(π) , (2.11) t! π∈St
24
Here and throughout the paper, we use the notation ⃗ x := (x1 , . . . , xt ) to denote a tuple of entries. It is straightforward to check from the definition that this operator is idempotent (that is, that (ΩSt )2 = ΩSt ) and Hermitian. 25
21
is precisely the set of states |ψ⟩ satisfying the identity (S(π) ⊗ I) |ψ⟩ = (I ⊗ S(π)T ) |ψ⟩ .
(2.12)
Although our argument so far has not proved it, it turns out that the image of ΩSt is precisely the subspace of valid recording states for arbitrary quantum query algorithms, even those that are adaptive and may query on non-distinct inputs. What is ΩSt ? Let us pause and try to better understand the ΩSt operator. The right tool for this job is Schur-Weyl duality. Schur-Weyl duality for the unitary representation U ⊗t on (CN )⊗t amounts to employing the following facts: 1. The only operators on (CN )⊗t that commute with every U ⊗t are linear combinations of the permutation elements S(π). In other words, the U (N )-commutant algebra of (CN )⊗t is the group algebra C[St ]. 2. Conversely, the only operators on (CN )⊗t that commute with every S(π) are linear combinations of the diagonal action operators U ⊗t . According to Schur-Weyl duality, this turns out to imply that the space (CN )⊗t decomposes in the following way: M U (N ) (CN )⊗t ≃ Vλ ⊗ VλSt , (2.13) λ U (N )
where Vλ is the space of an irreducible representation of U (N ), VλSt is a corresponding irreducible representation space of St . The isometry implementing this mapping is the Schur transform of Equation (2.3). In this decomposition, U ⊗t acts as U ⊗t |V U (N ) ⊗V St = ρλ (U ) ⊗ I. λ
λ
U (N )
That is, U ⊗t acts properly as the irrep transformation ρλ (U ) on Vλ and ignores the commutant register VλSt . On the other hand, the permutation elements S(π) act on the other tensor factor: S(π) |V U (N ) ⊗V St = I ⊗ ρλ (π). λ
λ
With this decomposition, we can understand the projection ΩSt : since states |ψ⟩ ∈ (CN )⊗t ⊗ (CN )⊗t in the image of ΩSt satisfy Eq. (2.12) and the S(π) span the commutant algebra, we conclude that (A ⊗ I) |ψ⟩ = (I ⊗ AT ) |ψ⟩ for every A ∈ C[St ]. These operators A are precisely those that act only on the commutant irreps: M A= IV U (N ) ⊗ Aλ , Aλ ∈ End(VλSt ) λ
λ
Thus, for any state |ψ⟩ ∈ (CN )⊗t ⊗ (CN )⊗t , which we can generically write (in the Schur-transformed P U (N ) U (N ) ⊗ V λ′ ⊗ VλSt ⊗ VλS′ t , we have that basis) as |ψ⟩ = λ,λ′ αλ,λ′ |λ, λ′ ⟩ ⊗ ψλ,λ′ , for ψλ,λ′ ∈ Vλ X (A ⊗ I) |ψ⟩ = αλ,λ′ λ, λ′ ⊗ (IV U (N ) ⊗ IV U (N ) ⊗ Aλ ⊗ IV St ) ψλ,λ′ λ
λ,λ′
= (I ⊗ AT ) |ψ⟩ =
X
λ′
λ′
αλ,λ′ λ, λ′ ⊗ (IV U (N ) ⊗ IV U (N ) ⊗ IV St ⊗ ATλ′ ) ψλ,λ′ λ
λ,λ′
λ′
λ
We can see, therefore, that any state satisfying Eq. (2.12) must be such that: 22
• only the blocks λ = λ′ have nonzero weight (consider A = Πλ that projects onto a fixed λ-block), and • each component |ψλ ⟩ is an EPR state on the commutant registers VλSt ⊗ VλSt in tensor product with an arbitrary state on the U (N ) registers (because the EPR state is the unique state, up to overall phase, satisfying (I ⊗ ATλ ) |ψλ ⟩ = (Aλ ⊗ I) |ψλ ⟩ for all linear maps Aλ ). Thus, we refer to ΩSt as the commutant EPR projector. Our Path-Recording Oracle. With this thought process in mind, we are ready to introduce our exact path-recording compressed oracle. As before, we assume that our goal is to simulate query-access to a single unitary representation of G Z Z Qρ (|x⟩ ⊗ f (g) |g⟩ dg) = ρ(g) |x⟩ ⊗ f (g) |g⟩ dg. G
G
By our earlier argument, we know that by applying the Fourier transform F on the L2 (G) register, after t queries the recording register will be supported on M Vλ ⊗ Vλ∗ , bt λ∈G
b t denotes exactly the set of irreps that appear in the Schur-Weyl decomposition of (CN )⊗t : where G M (CN )⊗t ≃ VλG ⊗ VλAt . bt λ∈G
Compared to the case of G = U (N ) (and ρ the defining representation) discussed earlier, this Schur-Weyl decomposition is defined with respect to the commutant algebra At = {A ∈ End((CN )⊗t ) : A · ρ(g)⊗t = ρ(g)⊗t · A for all g ∈ G}. For the defining representation of U (N ), we have that At = C[St ], while for other group representations, the commutant will be another semi-simple diagram algebra (see Table 2 for more examples). For a general representation (just as in the special case before), one can observe that uncompressed recording states obey symmetries imposed by At : Θt · (A ⊗ I) = Θt · (I ⊗ AT ) for all A ∈ At . Therefore, we should aim for a path-recording oracle with database states in the subspace in which these two commutant actions have been identified, which is exactly the commutant EPR subspace that is the image of ΩAt in the Schur basis. We now derive a path-recording oracle from the tableau-recording oracle. To begin, we will define an isometry M Γt : VλG ⊗ (VλG )∗ → (CN )⊗t ⊗ ((CN )∗ )⊗t bt λ∈G
that maps from the tableau basis to the path basis. Let |λ, X, Y ⟩ be a basis vector in the tableau b t . The isometry Γt acts as follows: basis, where λ ∈ G
23
1. It first creates an EPR state X 1 |S⟩ |S ∗ ⟩ , |EPRλ ⟩ = q At dim(Vλ ) S∈B(V At ) λ
where B(VλAt ) is a basis for VλAt , and we interpret |S ∗ ⟩ ∈ (VλAt )∗ as a dual vector, and appends it to the tableau basis vector. This produces the state |λ, X, Y ⟩ |EPRλ ⟩, which is an element of the space VλG ⊗ (VλG )∗ ⊗ VλAt ⊗ (VλAt )∗ . 2. Next, it applies the inverse Schur transform Schur† to VλG ⊗ VλAt and the inverse dual Schur transform SchurT to (VλG ⊗ VλAt )∗ . The resulting state is an element of (CN )⊗t ⊗ ((CN )∗ )⊗t , and can therefore be written as a superposition over t-tuples of pairs |(x1 , y1 ), . . . , (xt , yt )⟩. Having defined Γt , it is straightforward to state the path-recording oracle as26 := (I ⊗ Γt+1 ) QTab QPath (I ⊗ Γ†t ) = (I ⊗ (Γt+1 · F )) Qρ (I ⊗ (F † · Γ†t )) . ρ ρ In other words, if the purification register is in the path basis, QPath simply applies Γ†t to map it to ρ the tableau basis. It then applies the tableau-basis oracle, and then applies Γt+1 to convert the purification register back to the path basis. Interpreting QPath . Of course, the main reason for defining the path-recording oracle is to be ρ able to interpret the recording states and the effect of an oracle query. To do this, we prove that QPath has the following form ρ Theorem 2.1 (See Definition 5.1 and Theorem 5.3). The path-recording oracle QPath can be ρ expressed as QPath ρ,t+1 =
X
+ |y⟩⟨x| ⊗ Λt+1 · ΩAt+1 · App(t) x,y ·Λt · ΩAt ,
x,y∈[N ]
where: • At denotes the G-commutant algebra of (CN )⊗t . • ΩAt denotes the (controlled-λ) projection onto |EPRλ ⟩ in the Schur basis, (t)
• Appx,y denotes the map appending |(x, y)⟩ to the database state.27 r A L dim(Vλ t ) • Λt = λ∈Gbt · (Πλ ⊗ I), where Πλ denotes projecting onto the λ-component in the dim(V G ) λ
Schur basis.28 r L dim(VλG ) + • Λt = λ∈Gbt At · (Πλ ⊗ I) is (pseudo-)inverse to Λt dim(Vλ )
26
Here, again, F is the Fourier transform on L2 (G) as before (Equation (2.1)). Note the database here contains an ordered list of (x, y) pairs, and this operator merely appends to that list. As we will see, the operator ΩAt resymmetrizes the list, removing this ordering (and anything else that is not to be recorded). 28 Since ΩAt has already projected onto equal λ-labels on the two Schur bases, it is equivalent here to project onto the λ block on either half or both. 27
24
In other words, assuming that the recording register was already in the image of ΩAt (which will be true if it was obtained by running an algorithm that queries QPath ), the update is the following ρ sequence of operations. • Reweight subspaces in the Schur basis. P • Initialize an EPR state y∈[N ] |y⟩ |y⟩, • Append (x, y) to the database using the query input and half of the EPR state. The other half of the EPR state will be returned as the response. • Re-impose the symmetry ΩAt+1 on the recording register.29 • Reweight the (new) subspaces in the Schur basis again. We refer the reader to Section 5 for the formal proof of Theorem 2.1. The high-level idea is to relate the isometry Γt · F with Rthe map Θt from earlier (which aimed to analogize the path state |x, y⟩ with the recording state G ⟨y| ρ(g)⊗t |x⟩ · |g⟩ dg) by proving that Γt · F · Θt = Λt · ΩAt . At this point, there are two remaining questions to answer regarding interpretation of this formula for QPath for general groups: ρ 1. The commutant EPR projector ΩAt may appear somewhat mysterious in the path basis outside of the case of G = U (N ) and At = C[St ] in the earlier example. 2. The subspace reweighting operators Λt are applied in the Schur basis, which has no simple/obvious interpretation in the path basis. For the first question, we show thatP ΩAt has a clear general-purpose form directly in the path basis, generalizing the formula ΩSt = t!1 π∈St S(π) ⊗ S(π) for the case G = U (N ). This allows us to think of ΩSt as an operation in the standard (“path”) basis rather than one the Schur basis. This is accomplished as follows: let B(At ) denote a basis for the commutant algebra. For example, this basis can consist of permutations π ∈ St for the case G = U (N ) and A = C[St ]. For the case G = SN , the commutant algebra At = Pt (N ) is the partition algebra [HR05], which has a basis consisting of set-partition diagrams (see Figure 7b).
(a) An example basis element of the symmetric group algebra, C[St ], for t = 8.
(b) An example basis element of the partition algebra, Pt (N ), for t = 8.
Figure 7: The symmetric group algebra, C[St ], the partition algebra, Pt (N ), and other diagram algebras can be described in terms of a basis of partition diagrams that partition t top vertices and t bottom vertices into components. See Section 3.5 for more details. 29
We remark that the recording register was previously in the image of ΩAt , so intuitively ΩAt+1 is only imposing additional symmetries involving the last register.
25
Using a variant of the Schur orthogonality relations we show (see Lemma 5.11) that in general, X S(a) ⊗ S(a∗ )T , ΩAt = a∈B(At )
where a∗ denotes a dual basis element with respect to the trace pairing trAt (ab).30 As an example, for G = U (N ), the elements of B(C[St ]) are orthogonal under this trace pairing, except that tr [π] · [π −1 ] = t! . We thus have that [π]∗ = t!1 [π −1 ], recovering the form of ΩSt in Equation (2.11). Of course, this operator ΩAt depends on the group G and its representation, but understanding it simply amounts to understanding the commutant algebra At (in other words, the algebraic symmetries of ρ⊗t ) and does not require the Schur basis. For example, we study this operator closely for the case G = SN in Section 7, as well as some simpler cases in Section 6. Thus, what remains in order to understand the exact path-recording oracle is to understand the reweighting operator ΛAt . As we discuss next, if one is willing to make approximations, this challenge can be surmounted as well. [MH25] as an approximation of our oracle. How does our path-recording oracle (for the case G = U (N )) compare with the Ma-Huang oracle? Here is a direct comparison: • The [MH25] oracle and our oracle both begin by creating an EPR state over outputs |y⟩; however, [MH25] restricts y to not collide (in the standard basis) with the y values in the existing recording state. • The [MH25] oracle then adds the pair |(x, y)⟩ to an unordered set, while our path-recording oracle first appends |(x, y)⟩ to an ordered list or t-tuple and then symmetrizes with respect to St (permuting the pairs into all possible positions in the list). On states with distinct yi , these operations are the same up to a multiplicative scalar. • Finally, our oracle contains two subspace reweightings (one at the beginning and one at the end) that the [MH25] oracle does not have. Thus, the fact that the [MH25] oracle approximates ours (for G = U (N )) follows from two facts that we prove in Section 6: Path
1. For any t-query adversary AQρ , the probability that the yi in the recording register are all distinct is at least 1 − O(t2 /N ). 2. The rescaling operators Λt are scalar multiples of the identity, up to multiplicative error (1 ± O(t2 /N )). Conversely, this gives a method of deriving the Ma-Huang approximate path-recording oracle from first principles: 1. Theorem 2.1 describes a general exact path-recording oracle. 2. For a simpler form with easier interpretability, approximate the ΛSt reweightings with scalar e Path . multiples of the identity, resulting in an operator Q ρ 30 trAt (ab) is defined to be the trace of the “multiplication by ab map” on At . The dual basis element a∗ corresponding to a basis element a ∈ B(At ) is the unique element of At such that trAt (a∗ b) = δab where b runs over the basis of the algebra, B(At ).
26
e Path is not an isometry; however, it is an isometry 3. Without the subspace reweighting, Q ρ when inserted y values are restricted to be distinct. This gives the interpretable—and, upon inspection, efficiently implementable—approximate path-recording oracle H QM =√ ρ
X √ 1 |y⟩⟨x| ⊗ t + 1 · ΩAt+1 · ΠYDist · App(t) x,y , N − t x,y∈[N ]
which is precisely the path-recording oracle of [MH25]. See Section 6, for additional examples of how to derive path recording oracles for other groups in this way.
2.3
Pseudorandomness of the P C Ensemble
Finally, we describe our approach for proving that our P C ensemble is a pseudorandom unitary (Theorem 1.6). To gain some intuition, we can start by asking: what is the difference between querying a random permutation unitary31 P and querying a Haar-random unitary U ? There are two simple, detectable differences: • If you query any permutation unitary P on a uniform superposition32 |+⟩ ∈ CN , the result is |+⟩. However, for Haar-random unitary U , the state U |+⟩ is a Haar-random state in CN . • If you query any permutation P ⊗2 on two copies the same computational basis state |x⟩ |x⟩, the resulting state |P (x)⟩ |P (x)⟩ has the same computational basis state y = P (x) appearing on both registers. However, for Haar-random U , the state U ⊗2 |x⟩ |x⟩ is two copies of a Haar-random state, which will almost never agree in the computational basis. However, conveniently, prepending P with a random Clifford circuit (or any unitary 2-design) C thwarts both of these attacks: • If you query P · C on an arbitrary pure state |ψ⟩ (independent of P, C), C |ψ⟩ has almost no overlap with |+⟩. • If you query (P · C)⊗2 on an arbitrary state |ψ⟩ ∈ (CN )⊗2 , the state C ⊗2 |ψ⟩ with high probability has no collisions in the computational basis. That is, it is almost completely contained within the distinct subspace ΠDist = Span{|x1 , x2 ⟩ : x1 ̸= x2 }. Of course, just because these two attacks are thwarted does not necessarily mean that all possible attacks are thwarted. Perhaps a more clever attack, which makes queries on something more sophisticated, could distinguish a random permutation from a random unitary? We show that this is not the case: At a high level, we use our path-recording formalism, specialized to both groups SN and U (N ), to prove that these are in fact the only obstructions to a random permutation P looking like a random unitary, and so multiplying P by C does in fact result in a pseudorandom unitary. More formally, for any t, we define the “distinct, nonplussed” subspace DNP ⊂ (CN )⊗t to be the intersection of the distinct subspace with the “nonplussed subspace” NoPlus = Im((I − |+⟩⟨+|)⊗t ). We must argue both that it suffices to consider only the distinct 31
The permutation here is an element of G = SN (not to be confused with the commutant algebra C[St ] that we considered earlier for the case where G = U (N )). For each such permutation, it acts on CN by permuting the N basis vectors in the standard basis. 32 We willPalways use the plus state to denote the uniform positive superposition in the computational basis, |+⟩ := √1N z∈[N ] |z⟩.
27
nonplussed subspace, and that permutations and unitaries are statistically indistinguishable on this subspace. We sketch the main points of the argument below (and see Section 7 for the proof in detail). We know from Theorem 1.5 that queries to a Haar random unitary U ← U (N ) are perfectly indistinguishable from queries the the path-recording oracle QPath U (N ) , and similarly, that queries to a random permutation P ← SN are perfectly indistinguishable from those to QPath SN . To prove that P · C is indistinguishable from a Haar random unitary, we can thus take any t-query adversary Advt which may attempt to distinguish them, and directly compare the path-recording purifications33 QPath QPath ·C SN · C U (N ) Advt and Advt . (2.14) Crucially, the two path-recording oracles are acting on the same Hilbert space ((CN )⊗t )⊗2 in their recording registers, which is what allows us to make the direct comparison. We proceed in three steps: 1. Projecting onto the Distinct Nonplussed Subspace. First, we prove that for any possible adversary making t queries to either of the two path-recording oracles, the recording register will only ever have at most O(t2 /N ) mass outside the distinct nonplussed subspace DNP⊗2 ⊂ ((CN )⊗t )⊗2 . The distinct nonplussed subspace DNP, as the intersection of two simpler subspaces (the distinct subspace, Dist, and the nonplussed subspace, NoPlus) is somewhat tricky to reason about on its own. But by bounding the Friedrichs angle between the two subspaces, we show that the projection ΠX,Y DNP onto the distinct nonplussed subspace can be approximated by the X,Y X,Y product ΠDist · ΠNoPlus of projections onto the two larger subspaces. We then show a ricochet property of the path-recording oracles. This says, roughly, that any unitary C that is applied before each path-recording oracle query can instead be thought of as if it were applied in parallel as C ⊗t to the X part of the recording register. We can then use the 2-design property of random Cliffords to argue that the X part of the recording register will, with high probability, be in the distinct subspace, and separately in the nonplussed subspace. A direct calculation also shows the same for the Y part of the recording register. We then argue by a quantum union bound that the recording register must, with similarly high probability, be in the subspaces simultaneously. Thus, we may apply the projection ΠX,Y DNP onto the distinct nonplussed subspace, while incurring error at most O(t2 /N ). 2. The Symmetrization Operators ΩAt on the Distinct Nonplussed Subspace. Second, we prove that the commutant EPR projectors ΩSt and ΩPt (N ) are in fact equal on the subspace DNP⊗2 , meaning X,Y ΩSt ΠX,Y DNP = ΩPt (N ) ΠDNP . In our opinion, this is the most important step of the analysis. Consider the operators ΩSt and ΩPt (N ) written in the diagram bases of the two commutant algebras (see Figure 7): ΩSt =
1 X S(a) ⊗ S(a) t!
ΩPt (N ) =
a∈St
X
S(a) ⊗ S(a∗ )T
(2.15)
a∈B(Pt (N ))
33
The (right-) invariance of the Haar measure of U (N ) says that for a unitary U drawn from the Haar measure and any other unitary C, U · C is identically distributed to U . Thus queries to QPath U (N ) · C are perfectly indistinguishable from queries to U · C (by Theorem 1.5), and consequently from those to the Haar random unitary U .
28
Since the partition diagrams of Pt (N ) can be arbitrary partitions of the 2t vertices (t top/output vertices and t bottom/input vertices), they range over a much larger set than the permutation diagrams of C[St ] (which require a perfect matching between the t input vertices and the t output vertices in order to be a permutation in St ). Thus ΩPt (N ) ranges over a much larger basis than does ΩSt . How could they be equal? But observe something important about how these set-partition diagrams act on (CN )⊗t : Suppose a diagram a ∈ B(Pt (N )) has a component with at least two vertices on the bottom row (say, vertices numbered i and j P when counting from the left). Then its representation S(a) on the space (CN )⊗t has the form z∈[N ], ... |. . .⟩⟨. . . , z, . . . , z, . . .| with the two z’s appearing (at least) on the i’th and j’th positions. But such an operator acts as exactly 0 unless the state it acts on has a collision (in the computational basis) on those two registers. So we know that on the distinct subspace, such diagrams must drop out of the sum on the right of Equation (2.15). Now suppose instead that a diagram a ∈ B(Pt (N )) has some component consisting of only a single vertex on the bottom row (say,Pat vertex numbered i from the left). Then its representation S(a) on (CN )⊗t has the form z∈[N ], ... |. . .⟩⟨. . . , z, . . .| with the z appearing only at position i in the bra of the operator. Such an operator acts as exactly 0 unless the state it acts on has a plus state |+⟩ in position i. So we know that on the nonplussed subspace, such diagrams must drop out of the right-hand sum of Equation (2.15). On the distinct nonplussed subspace, both kinds of set-partition diagrams are annihilated. It is not hard at this point to convince yourself that the only diagrams remaining are those in which each component has exactly one vertex on the bottom row, and one vertex on the top row of the diagram, in other words, permutation diagrams. We are not quite done yet, however, since we are now left with X S(a) ⊗ S(a∗Pt (N ) )T a∈B(Pt (N )) a is a permutation diagram
where the dual relationship a∗Pt (N ) is still with respect to the trace pairing of the partition algebra Pt (N ) (and not of the symmetric group algebra C[St ]). Nevertheless, we prove that for every permutation π ∈ St , the dual element [π]∗Pt (N ) is a linear combination of t!1 [π −1 ] (matching the St case) and non-permutation elements of B(Pt (N )) (which, as we have argued, act as zero on the distinct nonplussed subspace DNP). Thus, after our restriction to DNP⊗2 , the path-recording updates are identical up to the subspace reweighting operators. 3. The Reweighting Operators ΛAt on the Distinct Nonplussed Subspace. At this point, we already know that ΛSt is approximately a constant. We additionally show that ΛPt (N ) is approximately constant (indeed, the same constant) on the subspace DNP⊗2 . This conclusion comes from viewing the distinct nonplussed subspace from the standpoint of the representation theory of SN : it turns out that in the Schur basis of SN and Pt (N ), L P (N ) the projector ΠDNP projects λ VλSN ⊗ Vλ t precisely onto the “full-box” irrep labels λ. b In more detail, each irrep label λ ∈ Pt (N ) corresponds to a Young diagram with at most t boxes below the top row.34 We show that the distinct nonplussed projector ΠDNP projects onto the irreps λ with exactly t boxes below the top row. Moreover, we can compute that the 34
by the common convention of indexing irreps of SN with Young diagrams of exactly N boxes. Often, we ignore the top row of boxes, and instead count only the boxes that are moved to the second row or further.
29
dimensions of such irreps are very close (up to a multiplicative (1 ± O(t2 /N ))) between SN and UN and between Pt (N ) and C[St ], showing that ΛSt and ΛPt (N ) are approximately the same, up to error O(t2 /N ). We can thus conclude that the two purified states in Equation (2.14), when querying the pathrecording oracles for either a random unitary or a random permutation (preceded with a random Clifford), have distance at most O(t2 /N ), which is negligible when t = poly(n) and N = 2n . Thus the t-query adversary cannot distinguish P · C from a Haar random unitary with anything better than negligible advantage. We finally conclude by replacing the random permutation P with either a pseudorandom permutation to get a pseudorandom unitary or a 2t-wise independent permutation to get a unitary t-design.
3
Preliminaries
Throughout this paper, we consider the following setting. Let G be a compact Lie group. Without loss of generality, G can be thought of as a closed subgroup of the group of unitary matrices on a finite-dimensional Hilbert space. Compact Lie groups admit a unique normalized Haar measure that R allows us to define uniform averages over G. We use G dg to denote integration under the Haar measure on G. This setting captures the following special cases of interest to quantum computation: • G = U (N ) is the group of N × N unitary matrices. • G = O(N ) is the group of N × N real orthogonal matrices. • G = (U (1))N is the group of N × N diagonal unitary matrices. R 1 P • Any finite group G, in which case G f (g)dg = |G| g f (g). This includes the permutation group SN , which can be embedded as N × N permutation matrices, as well as the abelian group {±1}N embedded as diagonal sign matrices. We will consider a finite-dimensional representation ρ : G 7→ U (N ) of the group G. Our goal is to perform efficient on-the-fly simulation of a quantum algorithm A with “oracle access to ρ(g) for a random g”, where g is sampled (once) from the Haar measure and used for all queries. By efficient on-the-fly simulation, we mean a stateful simulation such that the t-th query that A makes can be simulated by a poly(t, log(N ))-time algorithm operating on a poly(t, log(N ))-qubit Hilbert space.
3.1
Notation for compact groups
Definition 3.1 (Haar measure). Let G be a compact Lie group. We say that a (regular Borel) measure µ is left-invariant if for any measureable subset of the group, S ⊆ G, and for every g ∈ G, µ(gS) = µ(S). Similarly, we say that µ is right-invariant if for all S ⊆ G, and for every g ∈ G, µ(Sg) = µ(S). The Haar measure on G is the unique such measure (up to a rescaling) which is both left-invariant and right-invariant. Definition 3.2 (Group element kets). Let G be a compact Lie group with normalized Haar measure dg. We write {|g⟩ : g ∈ G} for kets labeled by group elements, with ⟨g|g ′ ⟩ = δg,g′ (so ⟨g|g⟩ = 1). To make this notation consistent between the finite and infinite cases, we write dg to denote a “half-measure”. Then for any (square-integrable) function f : G 7→ C, we define Z |f ⟩ = f (g) |g⟩ dg G
30
with the convention that
Z ⟨f1 |f2 ⟩ =
f1 (g)f2 (g) dg. G
1 P 2 finite G, this means that |f ⟩ = |G| g∈G f (g) |g⟩ and G |f (g)| dg = 1. For p ′ we identify unit-norm basis vectors |g⟩ = |G| · |fg ⟩, where fg (g ) = δg,g′ .
Thus, ⟨f |f ⟩ = 1 when
R
Definition 3.3 (L2 function space). L2 (G) is defined to be the space of square-integrable functions f : G → C. Each function is represented by |f ⟩ as in Definition 3.2. Definition 3.4 (Regular representation). The left regular representation L : G → U (L2 (G)) is defined by (Lg f )(x) = f (g −1 x),
f ∈ L2 (G), g, x ∈ G.
This gives L2 (G) the structure of a unitary representation of G. We note that unlike all other representations considered in this work, the regular representation may be infinite-dimensional.
3.2
Purified Oracle Algorithms (or Adversaries)
We formalize the notion of an algorithm, or adversary, with oracle access to a unitary OAR acting on the algorithm’s query register A along with a purification register R that is hidden from the algorithm. This formalism enables all of our compressed oracle definitions and will be used explicitly in Sections 5.9, 7.4 and 7.5. Definition 3.5 (Purified Oracle Adversaries). A t-query adversary, denoted AdvO t , is specified by a list of n + m qubit unitaries (A1 , . . . , At ). Ai acts on a n-qubit query register A, along with a m-qubit workspace register B. The purified oracle O acts on both the adversary’s query register, as well as a database register R, which is inaccessible to the adversary. After t queries to O, the state of the adversary is35 " t ! # Y O trR Advt (|0⟩AB ⊗ |∅⟩R ) = trR OAR · Ai AB (|0⟩AB ⊗ |∅⟩R ) (3.1) i=1
In this paper, we study purified oracle adversaries AdvO t that have access to an oracle O corresponding to a purified random group representation ρ(g).
3.3
Peter-Weyl Theorem and the Fourier Transform
The first step towards understanding how to simulate group representations is defining the Fourier transform, which is an algorithmic form of the Peter–Weyl theorem. Theorem 3.6 (Peter–Weyl). There is a unitary isomorphism of representations M L2 (G) ≃ Vλ ⊗ Vλ∗ , b λ∈G
where L2 (G) denotes the left regular representation and g acts as ρλ (g) ⊗ IVλ∗ on the right hand side. b refers to the set of isomorphism classes of irreducible representations of G. Here, G 35
We are using the conventions that tr[|ψ⟩] := tr[ |ψ⟩⟨ψ| ] and that
31
Qt
i=1 Xi := Xt Xt−1 · · · X2 X1 .
Definition 3.7 (Fourier Transform). We define the Fourier transform as the Peter-Weyl decomposition isomorphism in a particular basis. For every irreducible representation λ, choose an orthonormal basis { |X⟩ : X ∈ Iλ } of Vλ , with dual basis {|Y ∗ ⟩ : Y ∈ Iλ L } of Vλ∗ , where |Y ∗ ⟩ ∈ Vλ∗ acts as ⟨Y | on Vλ . This leads to a basis |λ, X, Y ⟩ of the right hand side λ∈Gb Vλ ⊗ Vλ∗ of the form |λ, X, Y ⟩ = |X, Y ∗ ⟩ ∈ Vλ ⊗ Vλ∗ . In this basis, it turns out that the isomorphism F in the Peter-Weyl theorem can be written as p Z −1 F |λ, X, Y ⟩ = dλ ⟨Y | ρλ (g) |X⟩ |g⟩ dg. G
We define this isomorphism F to be the Fourier transform. By the unitarity of the Fourier transform, the equation above implies the Schur orthogonality relations: Lemma 3.8 (Schur orthogonality for compact groups). For all λ, λ′ , X, X ′ , Y, Y ′ , we have p p Z dλ dλ′ ⟨Y | ρλ (g) |X⟩ ⟨Y ′ | ρλ′ (g) |X ′ ⟩ dg = δλ,λ′ · δX,X ′ · δY,Y ′ . G
In Section 5.7, we derive generalized Schur orthogonality relations for arbitrary semisimple algebras. 3.3.1
Properties of the Fourier Transform
In this section, we consider the following simple isometries defined on L2 (G): Z Conj : |f ⟩ 7→ f (g)∗ |g⟩ dg ZG Inv : |f ⟩ 7→ f (g −1 ) |g⟩ dg ZG Transpose : |f ⟩ 7→ f (g −1 )∗ |g⟩ dg
(3.2) (3.3) (3.4)
G
where the third map is the composition of the first two. Note that Conj and Transpose are anti-linear (or conjugate-linear) rather than linear maps. We now describe how these maps act on the Fourier basis. For the first, p Z p Z ∗ −1 Conj·F |λ, X, Y ⟩ = dλ ⟨Y | ρλ (g) |X⟩ |g⟩ dg = dλ ⟨Y | ρλ (g)∗ |X⟩ |g⟩ dg = F −1 |λ∗ , X, Y ⟩ , G
G
where λ∗ denotes a dual representation acting as ρλ∗ (g) = ρλ (g)∗ on an appropriate dual basis, and we have identified |X⟩ non-canonically as a basis element of Vλ∗ . For the second, we have p Z p Z −1 −1 Inv·F |λ, X, Y ⟩ = dλ ⟨Y | ρλ (g ) |X⟩ |g⟩ dg = dλ ⟨Y | ρλ (g)† |X⟩ |g⟩ dg = F −1 |λ∗ , Y, X⟩ , G
G
via the identity ⟨Y | U † |X⟩ = ⟨X| U ∗ |Y ⟩, where |Y ⟩ and |X⟩ are identified as elements of Vλ∗ and (Vλ∗ )∗ , respectively. Finally, this tells us that the third map is given by Transpose · F −1 |λ, X, Y ⟩ = F −1 |λ, Y, X⟩ .
32
3.4
Complete Reducibility and Schur-Weyl Duality
In order to simulate oracle access to ρ, we will reduce to the case where ρ is an irreducible b denote the set of all representation of G. To do this, we make use of the following result. Let G finite-dimensional irreducible representations of G. Theorem 3.9 (Complete reducibility for compact Lie groups, [Hal13, Section 4.10]). Let G be a compact Lie group and let ρ be a finite-dimensional unitary representation. Then ρ decomposes as a finite direct sum of irreducible representations ρ ≃
k M
ρλi .
i=1
b which appears in the b (not necessarily distinct). We write Irr(ρ) to be the subset of G for λi ∈ G decomposition of ρ with non-zero multiplicity. Finally, of particular interest to us is the decomposition of tensor power representations ρ⊗t (g) = ρ(g)⊗t ,
g∈G
given a fixed “base” representation ρ. It turns out that the decomposition of ρ⊗t into irreducible representations can be understood in terms of the commutant algebra of the (tensor power) representation, defined below. Definition 3.10 (Commutant algebra). Let ρ : G → U (N ) be a unitary representation of a compact Lie group G. For any integer t ≥ 1, consider the tensor power representation ρ⊗t acting on (CN )⊗t . The commutant algebra At of ρ⊗t is the set of all N t × N t matrices that commute with every ρ⊗t (g): t
t
At = EndG ((CN )⊗t ) = { X ∈ CN ×N : Xρ⊗t (g) = ρ⊗t (g)X for all g ∈ G }. By definition, the commutant algebra At acts on (CN )⊗t in a way that commutes with the action of G. Throughout the paper, we make use of Schur-Weyl duality, which explains the structure of the representation ρ⊗t using the commutant algebra At . Theorem 3.11 (Schur–Weyl Duality). Let G be a compact Lie group and ρ be a finite-dimensional unitary representation ρ : G → U (V ). Let At ≃ EndG (V ⊗t ) denote the commutant algebra. Then, the space V ⊗t decomposes as M V ⊗t ≃ VGλ ⊗ VAλt , λ
where each VGλ is an irreducible representation of G and each VAλt is an irreducible representation of At . Under this decomposition, G and At act as M M ρ⊗t (g) = ρλ (g) ⊗ IV λ , X= IV λ ⊗ ρλ (X), X ∈ At . λ
At
G
λ
In particular, the At -commutant of V ⊗t can be described as the following finite-dimensional algebra: EndAt (V ⊗t ) = Span{ρ(g)⊗t }g∈G . This theorem is a standard consequence of complete reducibility along with the double centralizer theorem [GW09, Section 4.1.5]. 33
Example 3.12. Take G = U (N ), and let ρ be the fundamental representation, satisfying ρ(U ) = U . Classical Schur-Weyl duality [Sch27, Wey39] proves that the commutant algebra At of ρ⊗t is the algebra spanned by all permutation matrices on the t registers: At = span{Xπ : π ∈ St },
Xπ |i1 , i2 , . . . , it ⟩ = iπ−1 (1) , iπ−1 (2) , . . . , iπ−1 (t)
(3.5)
which is itself a representation of the symmetric group algebra C[St ] known as the permutation representation.
3.5
Diagram Algebras and the Schur Representation
Throughout the paper, we consider other instances of Schur-Weyl duality which generalize the classical (U (N ), C[St ])-duality in Example 3.12. In these settings, the relevant commutant algebras are obtained by extending the basis of C[St ] (which consists of all permutations in St ) to more general partition diagrams: Definition 3.13 (Partition Diagram). A partition diagram is a set partition of the 2n vertices {1, . . . , n} ∪ {1′ , . . . , n′ }. Partition diagrams are typically visualized using a n × 2 grid. We refer to the top row of the diagram as the output row, and the bottom row of the diagram as the input row. 1out
2out
3out
4out
5out
6out
7out
8out
9out
1in
2in
3in
4in
5in
6in
7in
8in
9in
Figure 8: Example of a partition diagram. Note that the connected components are important, but the specific graph connecting them is not.
Definition 3.14 (Multiplication of Diagrams). Given two partition diagrams D1 and D2 , the product diagram D1 D2 is defined by identifying the vertices in the bottom row of D1 with the vertices in the top row of D2 (see Fig. 9). The vertices in the identified middle rows are then removed—if c connected components are removed this way, the product is multiplied by N c . Here, N is a free parameter, although we will typically identify N with the dimension of the group in Table 3.
34
(3.6)
=
(3.7)
= N ·
(3.8)
Figure 9: Multiplication of partition diagrams. The green component is confined to the middle layer and drops out to become an extra factor of N .
Note that when D1 and D2 are permutation diagrams, where each component in the input row is connected to exactly one component in the output row, Definition 3.14 coincides with the usual composition rule for permutations in St . Definition 3.15 (Diagram Algebras [KS08]). Fix an integer t ≥ 0. Let S be a subset of partition diagrams with t columns. The diagram algebra generated by S is the C-algebra AlgC (S) = spanC {D1 D2 · · · Dk : k ≥ 0, Di ∈ S},
(3.9)
using the multiplication rule defined in Definition 3.14. For example, the symmetric group algebra C[St ] is a diagram algebra with a basis given by the set of all permutation diagrams with t columns, i.e. diagrams whose connected components all contain exactly one vertex in the input and output rows. Other examples of diagram algebras include the Brauer algebra Bt (N ) ([Bra37]), spanned by partition diagrams where every connected component has size 2, and the partition algebra Pt (N ), ([Mar96]), which is spanned by the set of all partition diagrams. In Section 6.2, we also consider a generalization of partition diagrams where each connected component is assigned a “color” k ∈ [K]. For more details, see Section 6.2. Just as diagram algebras generalize the symmetric group algebra C[St ], the Schur representation generalizes the permutation representation (Example 3.12):
35
Definition 3.16 (The Schur Representation). Let A be a diagram algebra. The Schur representation 36 S(·) is an N t -dimensional representation, defined on a diagram D as follows: S(D) =
X
⃗ x,⃗ y ∈[N ]t
Y u,v∈{1,...,n,1′ ,...,n′ }
δzu ,zv |⃗x⟩ ⟨⃗y | ,
(3.10)
u, v in the same block in D
with
( xr zr = yr
r ∈ {1, . . . , n} r ∈ {1′ , . . . , n′ }
(3.11)
In other words, S(D)⃗x,⃗y = 1 if the labeling of vertices given by ⃗x, ⃗y is constant on every connected component of D, and 0 otherwise. For example,
1out
2out
3out
4out
5out
6out
X = |x1 , x2 , x3 , x4 , x2 , x6 ⟩⟨x1 , x4 , x5 , x3 , x1 , x7 |
S 1in
3.6
2in
3in
4in
5in
⃗ x∈[N ]7
6in
Trace forms and dual bases for semisimple algebras
These preliminaries are adapted from [HR05, Section 5]. In this section, we work over a finite-dimensional semisimple algebra A over the complex numbers; this means that A is isomorphic to a direct product of finite-dimensional complex matrix algebras. Let A be any such algebra, and let a ∈ A. We define the regular trace of a by trA (a) := tr(La ), where tr denotes the trace of a linear operator and La denotes left multiplication by a. This gives a symmetric bilinear pairing ⟨a, b⟩A := trA (ab). The pairing is nondegenerate because A is semisimple. Definition 3.17 (Dual basis). Given a basis B(A) of A, we write a∗ for the dual basis element corresponding to a ∈ B(A); that is, trA (ab∗ ) = δa,b
for all a, b ∈ B(A).
Throughout the paper, dual bases are taken with respect to the regular trace trA . We will later use this dual basis to interpret the commutant EPR projector ΩAt . 36
This representation is sometimes also called the “permutation representation” in the literature, since it generalizes the permutation representation of the symmetric group. For more general diagram algebras, however, it goes beyond permuting registers. Furthermore, even for the symmetric group, there is a chance for confusion with the representation as permutation matrices (in-place permutations of the standard basis vectors). Other sources call this the “natural representation”, but of course, which representation is natural depends on the algebra and its presentation. To disambiguate, we therefore follow [FND26] in calling it the Schur representation.
36
Group Unitary
U (N )
Unitary Product
U (N )K
Tensor space
Representation
VN⊗t
U ⊗t
VN⊕K
⊗t
Commutant algebra
⊗t
P
|k⟩⟨k| ⊗ Uk
k∈[K]
Symmetric Group Algebra
C[St ]
Colored Permutation Group Algebra
C[ZK ≀St ]
Brauer Algebra
Bt (N )
Tanabe Algebra
Tt (N, r)
Partition Algebra
Pt (N )
(Haar Cipher)
Orthogonal
VN⊗t
O(N )
Ug⊗t Ug is the standard embedding of g ∈ O(N ) as a unitary over Ct
Colored Zr ≀ St Permutations
VN⊗t
(Pπ Ff )⊗t Pπ is the permutation matrix of π ∈ SN , and Ff is diagonal with r’th roots of unity
Symmetric
Boolean Functions
SN
ZN 2
(VN −1 ⊕ V1 )⊗t
V1⊕N
⊗t
Pσ⊗t Pσ is the permutation matrix of σ ∈ SN
(-1)f (x) |x⟩⟨x|
P
⊗t
Colored Even-Partition Algebra
x∈[N ]
Table 3: Schur-Weyl dualities between different compact Lie groups and their commutant algebras. In all cases, the commutant algebra is the Schur representation (Definition 3.16) of the given diagram algebra. See Section 6.2 for the definition of the Schur representation of C[ZK ≀ St ]. In many of these cases, the given commutant algebra relation only holds when t is sufficiently small relative to N . For larger t, the commutant instead becomes a quotient algebra of the one listed; see Section 3.9 for more details and Section 6.2.2 for an example in which this becomes important.
Example 3.18 (Group algebras). Let A = C[G] be the group algebra of a finite group G, with basis {[g] : g ∈ G}. Left multiplication by [g] permutes this basis. Hence ( |G|, g = e, trC[G] ([g]) = (3.12) 0, g ̸= e. P Therefore, for a = g∈G ag [g], trC[G] (a) = |G| ae . The dual basis is then given by [g]∗ =
3.7
1 −1 [g ]. |G|
The (dual) Clebsch–Gordan transform and Clebsch–Gordan coefficients
Let (ρλ , VGλ ) and (ρµ , VGµ ) be irreducible unitary representations of G. By complete reducibility (Theorem 3.9), we have a decomposition M + λ+ VGλ ⊗ VGµ ≃ Mλ,µ ⊗ VGλ , b λ+ ∈G
37
+
+
λ ) and where G acts as IM λ+ ⊗ ρλ+ on the right hand side. In this setting, we let mλλ,µ = dim(Mλ,µ λ,µ
+
λ . define a standard basis {|r⟩} for Mλ,µ
Definition 3.19 (Clebsch–Gordan transform). A Clebsch–Gordan transform is any family of unitary, G-respecting isomorphisms M + ≃ λ+ Cλ,µ : VGλ ⊗ VGµ −−→ Mλ,µ ⊗ VGλ , λ+
meaning that for all g ∈ G, M † Cλ,µ ρλ (g) ⊗ ρµ (g) Cλ,µ = IM λ+ ⊗ ρλ+ (g) λ,µ
b λ+ ∈ G
The Clebsch–Gordan transform is unique P up to independent unitary changes of bases on each + λ multiplicity space Mλ,µ . We will use C = λ,µ |λ⟩⟨λ| ⊗ |µ⟩⟨µ| ⊗ Cλ,µ to denote the Clebsch–Gordan transform defined on all VGλ ⊗ VGµ simultaneously. Clebsch–Gordan Coefficients. Next, we give notation for the matrix elements of C in fixed bases for all of the underlying spaces. Under our conventions from earlier, we use { |X⟩}X , +
{ |x⟩}x ,
{ |r, X + ⟩}r,X +
+
λ ⊗ V λ . We can then write C as an explicit matrix: as bases for VGλ , VGµ , and Mλ,µ G
C=
X
⟨λ, µ, λ+ , r, X + | C |λ, µ, X, x⟩ · |λ, µ, λ+ , r, X + ⟩⟨λ, µ, X, x| ,
λ,µ,λ+ X,x r,X +
where we call the matrix elements ⟨λ, µ, λ+ , r, X + | C |λ, µ, X, x⟩ the Clebsch–Gordan coefficients for G. + In the event that mλλ,µ = 1 for all λ+ , we may drop the |r⟩ from our notation. Dual Clebsch–Gordan Transform and Coefficients. Finally, we define a related dual Clebsch– Gordan transform and state an identity involving Clebsch–Gordan and dual Clebsch–Gordan coefficients that we make use of to analyze our compressed representations. Departing slightly from prior work [Ngu23, GBO23] but more in line with [Har05], we first define the dual Clebsch-Gordan transform using dual vector spaces. Then, we fix an irreducible representation labeling convention ∗ ∗ ∗ so that for every λ, there is a “dual label” λ∗ such that VGλ ≃ VGλ and the action of G on VGλ is the dual representation (ρλ∗ (g) · v ∗ )(w) = v ∗ (ρλ (g)† · w) = (ρλ (g)v)∗ (w). Thus, in an explicit dual basis, ρλ∗ (g) acts as ρλ (g)∗ . Under these conventions, we then define “dual Clebsch-Gordan coefficients” on the underlying irrep spaces (with no explicit dual spaces). Definition 3.20 (Dual Clebsch–Gordan transform). A Dual Clebsch–Gordan transform is any family of unitary, G-respecting isomorphisms M − ≃ λ− dCλ,µ : VGλ ⊗ (VGµ )∗ −−→ Mλ,µ,∗ ⊗ VGλ , λ−
meaning that for all g ∈ G, M † dCλ,µ ρλ (g) ⊗ ρ∗µ (g) dCλ,µ = IM λ− ⊗ ρλ− (g) λ,µ,∗
b λ− ∈G
38
∗
To be compatible with prior work, given a collection of isomorphisms (VGµ )∗ ≃ VGµ for irrep label pairs (µ, µ∗ ) (suppressed for simplicity), we abuse notation and identify this dual Clebsch–Gordan transform with a map ∗
dCλ,µ : VGλ ⊗ VGµ →
−
M
−
λ λ (Mλ,µ ∗ ⊗ VG ).
b λ− ∈ G
In other words, we have X
dC =
⟨λ, µ, λ− , r, Y − | dC |λ, µ, Y, y⟩ · |λ, µ, λ− , r, Y − ⟩⟨λ, µ, Y, y| ,
λ,µ,λ− Y,y r,Y −
with ⟨λ, µ, λ− , r, Y − | dC |λ, µ, Y, y⟩ = ⟨λ, µ∗ , λ− , r, Y − | C |λ, µ∗ , Y, y⟩ and
M † dCλ,µ ρλ (g) ⊗ ρµ∗ (g) dCλ,µ = IM λ− ⊗ ρλ− (g) . b λ− ∈G
λ,µ∗
∗ ∗ Up to an identification of bases of VGµ and VGµ , this leaves us with the same degrees of freedom in choosing a dual Clebsch–Gordan transform as we have for choosing a Clebsch–Gordan transform. An additional property. For our compressed representations, we work with choices of Clebsch– Gordan and dual Clebsch–Gordan whose coefficients satisfy an additional identity. Lemma 3.21. There exist choices of C, dC satisfying the identities s +
†
+
+
⟨λ , µ, X , x| dC |λ , µ, λ, r, X⟩ =
dim VGλ dim VGλ
+
⟨λ, µ, λ+ , r, X + | C |λ, µ, X, x⟩∗
(3.13)
In fact, [VK92] give the identity s +
†
+
+
⟨λ , µ, X , x| dC |λ , µ, λ, r, X⟩ =
dim VGλ dim VGλ
+
⟨λ, µ, λ+ , r, X + | C |λ, µ, X, x⟩
for choices of C, dC with real coefficients. We state this relaxed condition in case this allows for additional efficient instantiations.
3.8
The Generalized Schur Transform
We will also make use of a generalization of the Schur transform, defined below. Definition 3.22 (Schur transform). Let (ρ, V ) be a finite-dimensional (not necessarily irreducible) unitary representation of G. A Schur transform is any family of unitary, G-respecting isomorphisms M ≃ Schurρ,t : V ⊗t −−→ VGλ ⊗ VAλt , λ
meaning that for all g ∈ G, M Schurρ,t ρ(g)⊗t Schur†ρ,t = ρλ (g) ⊗ IV λ At
b λ∈G
39
P We will use Schurρ = t≥0 |t⟩⟨t| ⊗ Schurρ,t to denote the Schur transform defined on all t simultaneously, extending Schurρ,t for smaller t to act as identity for all but the first t registers. By convention, we take Schurρ,0 to be the isometry that takes no input and produces the label for the trivial 1-dimensional irrep of G, with no multiplicity. Schur Transform for a Locally Block-Diagonal L Representation. We will P often consider cases in which ρ is already block-diagonal, with V = µ∈Irr(ρ) VGµ ⊗M µ and ρ(g) = µ∈Irr(ρ) |µ⟩⟨µ|⊗ ρµ (g) ⊗ IM µ (g) . This Schur transform is equivalent to the one described above up to the local transformation that block-diagonalizes each copy of V (which will often be efficient, but not always). The local multiplicity registers {Miµ }i∈[t] will end up being collected as part of the total multiplicity VAλt . We will sometimes ignore the local multiplicity registers for notational simplicity, since at least in principle, a Schur transform that considers them can be built from one that does not by tacking them onto the VAλt register at the end (though this may not yield the desired basis for VAλt ). The representation ρ determines which subset of irreps will appear (or equivalently, the set of available irreps will determine the representation). Furthermore, in this basis, we can view the Schur transform as not explicitly depending on the representation ρ, since we can view it as accepting b not just those that appear in ρ (though of course, if G b has infinite cardinality, any any irrep in G, b to allow). We will then just write SchurG,t actual implementation must choose some subset of G P and SchurG = t |t⟩⟨t| ⊗ SchurG,t , or just Schur when the group is clear from context. The Schur transform can then be written as a map from sequences of the form (⃗ µ, ⃗x) := ((µ1 , x1 ), (µ2 , x2 ), . . . , (µt , xt ))
(3.14)
b |TAt ⟩ ∈ V λ , and |TG ⟩ ∈ V λ , with to superpositions of states of the form |λ, TAt , TG ⟩, where λ ∈ G, At G coefficients ⟨λ, TAt , TG | Schur |⃗ µ, ⃗x⟩.
3.9
Young Tableaux and Bratteli Paths
The irreducible representations of the groups we study (and their corresponding commutant algebras) are indexed by integer partitions, typically visualized with Young diagrams. For example, the following Young diagram corresponds to the partition (5, 2, 2, 1) of N = 10:
We use |λ| to denote the total number of boxes in λ, λi to denote the number of boxes in the ith row, and λ′i to denote the number of boxes in the ith column. The Symmetric Group. Definition 3.23 (Standard Young Tableau). Let λ be a Young diagram. A standard Young tableau (SYT) corresponding to λ is a filling of the Young diagram with the numbers {1, 2, . . . |λ|}, such that all rows of λ are filled in increasing order from left to right, and all columns of λ are filled in increasing order from top to bottom. For example, the following is one valid standard Young tableau corresponding to the Young diagram above: 40
1
3
2
7
5
6
4 8 An equivalent characterization of an SYT T is as a chain of Young diagrams ∅, A1 , A2 , . . . , A|λ| = λ
(3.15)
where Ai is the shape formed by the boxes of T whose labels are at most i. For the SYT above, the corresponding chain is given by ∅,
,
,
,
,
,
,
,
(3.16)
Lemma 3.24 (Hook Length Formula). Given a Young diagram λ, the hook length formula f λ is fλ = Q
|λ|! b∈λ h(b)
(3.17)
where h(b) is the hook length of the box b. The hook length is equal to the number of boxes in the same row strictly to the right of b, plus the number of boxes in the same column strictly below b, plus one. λ [ Lemma 3.25 ([Sag01]). For any λ ∈ C[St], f counts the number of standard Young tableaux corresponding to λ. Equivalently, dim VSλ|λ| = f λ .
The Unitary Group. Definition 3.26 (Semi-Standard Young Tableau). Let λ = (λ1 ≥ λ2 ≥ · · · ≥ λN ) be a weakly decreasing sequence of integers, not necessarily nonnegative. Write λ(+) = (λ1 , . . . , λp ) for the positive entries of λ (so λp > 0 ≥ λp+1 ), and λ(−) = (λN +1−q , . . . , λN ) for the negative entries of λ (so λN −q ≥ 0 > λN +1−q ), and let µ = (µ1 ≥ · · · ≥ µq ), where µj := −λN +1−j , denote the partition formed from the negative entries of λ, reversed and negated. A semi-standard Young tableau (SSYT)37 of shape λ with entries in [N ] := {1, . . . , N } consists of: • a filling of the Young diagram of λ(+) (the positive tableau) with entries in [N ], weakly increasing along each row (left to right) and strictly increasing down each column (top to bottom); and • a filling of the Young diagram of µ (the negative tableau) with entries in [N ], weakly decreasing along each row (left to right) and strictly decreasing down each column (top to bottom), 37
Semi-standard Young tableaux are often defined only with positive rows and boxes, while tableaux with negative rows are called rational semistandard tableaux [Kin70, Ste87, Kwo08]. We generally allow negative rows, and specify explicitly when negative rows are not present. We will thus often drop the word “rational” and refer to both as simply semistandard Young tableau.
41
subject to the following compatibility condition. For x ∈ [N ], let r+ (x) denote the largest row index i ∈ {1, . . . , p} (rows of λ(+) numbered from the top) containing the entry x in the positive tableau, or r+ (x) := 0 if x does not appear there. Define r− (x) analogously, as the largest row index j ∈ {1, . . . , q} (rows of µ numbered from the top, or equivalently, rows of λ(−) ) containing x in the negative tableau, or 0 if x does not appear there. We require r+ (x) + r− (x) ≤ x
for all x ∈ [N ].
(3.18)
2 5 6 6 3 7 5
6 5 3 3 1 Figure 10: Example of a semistandard tableau with shape (4, 2, 1, 0, 0, −2, −3), where N = 7.
Let the complement of a negative column be a positive column containing all the entries of [N ] besides those in the original column (arranged in order). Then the condition in Equation (3.18) is equivalent to saying that shifting the tableau by one column (by converting the first negative column to its complement) produces a valid ordering in the resulting positive tableau.
2 5 6 6 3 7 5
2 2 5 6 6 3 3 7 4 5 6 7
Shift
6 5 3 3 1
6 3 3
Figure 11: Shifting the semistandard Young tableau by a column maintains a valid order in the positive tableau.
The Weyl Dimension Formula [Wey39] counts the number of semi-standard Young tableaux of a certain shape λ and thus gives the dimension of the corresponding irreducible representation. Lemma 3.27. Let λ be a Young diagram. The number of semi-standard Young tableaux of shape λ is N Y N Y (λi − i) − (λj − j) dim VUλ(N ) = j−i i=1 j=i+1
The Partition Algebra. The partition algebra Pt (N ) is semisimple whenever N > 2t − 2 [HJ20]. In this regime, the irreps of Pt (N ) are indexed by N -box Young diagrams such that all but at most 42
t boxes are in the first row [[HR05], Theorem 2.24b], i.e. P\ t (N ) = {λ : |λ| = N, λ0 ≥ N − t}
(3.19)
We will adopt the convention that when λ refers to an irrep of the partition algebra, the first row is ignored. With this convention, the irreps of the partition algebra are instead indexed by all Young diagrams with at most t boxes, i.e. P\ t (N ) = {λ : |λ| ≤ t}
(3.20)
With this convention, the dimension of an irrep λ ∈ P\ t (N ) is [HJ20] given as follows: Lemma 3.28. dim
VPλt (N )
=f
λ
t X t i i=|λ|
where f λ is the hook length formula inLemma 3.24, and
(3.21)
i
|λ|
t
is a Stirling number of the second kind.
i
Note that if |λ| = t, then dim VPλt (N ) = f λ .
We will sometimes say an irrep λ is a full box irrep of Pt (N ) if |λ| = t.
3.10
Clebsch-Gordan Coefficients in the Gelfand-Tsetlin Basis of Unitaries
Lemma 3.29 ([VK92]). Let G be the unitary group U (N ). Let X be a semi-standard Young tableau of shape λ which may have positive and/or negative rows, and let x be a Young tableau of shape µ = , the standard irrep of U (N ). We can write the Young tableau as a Gelfand-Tsetlin pattern, that is, a sequence of N shapes (X ≤ℓ )ℓ∈[N ] , where each X ≤ℓ is the shape of the X tableau when it is restricted to entries at most ℓ (and removing N − ℓ empty rows such that it has ℓ rows). For each shape X ≤ℓ , let Xk≤ℓ be the number of boxes on the k th row (which may be positive or negative). In the Gelfand-Tsetlin basis, the Clebsch-Gordan coefficient ⟨λ, µ, λ+ , r, X + | C |λ, µ, X, x⟩ for tensoring a single box Young tableau x has the following properties: 1. The transition from shape λ to λ+ has no multiplicity, so r is redundant. 2. It has non-zero value only when λ+ differs from λ by adding a single box (or removing a negative box) 3. It has non-zero value only when X + has the form X + = (X ≤1 , X ≤2 , . . . , X ≤x−1 , X ≤x , X ≤x+1 , . . . , X ≤N ) + (0, 0, . . . , 0, 2∆x , 2∆x+1 , . . . , 2∆N ) , where “+2∆z ” means “add a box to the ∆z th row” (or remove a negative box), for some (∆x ∈ [x], . . . , ∆N ∈ [N ]). That is, every shape starting with the xth one will have a net increase of one box. 4. In this case, the Clebsch-Gordan coefficients can be written as a product of reduced Wigner
43
coefficients, or scalar factors. Namely, x−1 Y
⟨λ, µ, λ+ , r, X + | C |λ, µ, X, x⟩ =
1 2
≤x Xk≤x−1 − X∆ + ∆x − k − 1 x
k=1 x Y
≤x Xk≤x − X∆ + ∆x − k x
k=1 k̸=∆x 1
z−1 Y
·
z Y
2 ≤z Xk≤z−1 − X∆ + ∆ − k − 1 z z
Y k̸=k=1 ∆z−1 z Y
z>x
≤z Xk≤z − X∆ + ∆z − k z
≤z−1 + ∆z−1 − k Xk≤z − X∆ z−1
1 2
k=1 k̸=∆z z−1 Y
(−1)∆z >∆z−1
≤z−1 + ∆z−1 − k − 1 Xk≤z−1 − X∆ z−1
k=1 k̸=∆z
k=1 k̸=∆z−1
Similarly, in the Gelfand-Tsetlin basis, the dual Clebsch-Gordan coefficients ⟨λ, µ, λ− , r, X − | dC |λ, µ, X, x⟩ = ⟨λ, µ̄, λ− , r, X − | C |λ, µ̄, X, x⟩ (where µ̄ is the dual of the standard representation) have the properties: 1. The transition from shape λ to λ− has no multiplicity. 2. It has non-zero value only when λ− differs from λ by removing a single box (or adding a negative box) 3. It has non-zero value only when X − has the form X − = (X ≤1 , X ≤2 , . . . , X ≤x−1 , X ≤x , X ≤x+1 , . . . , X ≤N ) − (0, 0, . . . , 0, 2∆x , 2∆x+1 , . . . , 2∆N ) , where “−2∆z ” means “remove a box from the ∆z th row” (or add a negative box), for some (∆x ∈ [x], . . . , ∆N ∈ [N ]). That is, every shape starting with the xth one will have a net decrease of one box. 4. In this case, as before, the Clebsch-Gordan coefficients can be written as a product of reduced Wigner coefficients, or scalar factors. Namely, x−1 Y
⟨λ, µ, λ− , r, X − | dC |λ, µ, X, x⟩ =
1 2
≤x Xk≤x−1 − X∆ + ∆x − k x
k=1 x Y
≤x Xk≤x − X∆ + ∆x − k x
k=1 k̸=∆x z−1 Y
·
1
≤z Xk≤z−1 − X∆ + ∆z − k z
Y k̸=k=1 ∆z−1 z>x
z Y k=1 k̸=∆z
≤z Xk≤z − X∆ + ∆z − k z
2
z Y k=1 k̸=∆z z−1 Y k=1 k̸=∆z−1
44
≤z−1 Xk≤z − X∆ + ∆z−1 − k + 1 z−1
1 2
(−1)∆z >∆z−1 ≤z−1 Xk≤z−1 − X∆ + ∆z−1 − k + 1 z−1
3.11
The Fourier Basis of Semisimple Algebras
Definition 3.30 (The Fourier Basis). Let A be a finite-dimensional semisimple algebra, i.e. f
A≃
M
End(V λ )
(3.22)
b λ∈A
A Fourier basis
n o λ Ei,j
λ,i,j
for A is the preimage of the natural matrix unit basis {|i⟩⟨j|λ }λ,i,j under
the isomorphism f . In general, the isomorphism in Eq. (3.22) is not unique, and so the Fourier basis is only defined relative to f . Moreover, the matrix unit basis {|i⟩⟨j|λ }λ,i,j implicitly assumes a choice of basis for each irrep space V λ .38 n o k,λ Lemma 3.31 ([FND26]). Let Ak be a finite-dimensional semisimple algebra, and let Ei,j bk λ∈A
λ ) i,j∈B(VA k
be a Fourier basis. Then, we have that ∗ k,λ k,λ 1 1. [FND26, Lemma 2.13b]: = dim(V Ei,j λ ) Ej,i , where ∗ denotes the dual basis element Ak
(Definition 3.17). T k,λ k,λ 2. [FND26, Section 4.5.2]: S Ei,j = S Ej,i , where S(·) denotes the Schur representation (Definition 3.16). k,λ k,µ k,λ 3. [FND26, Lemma 2.13a]: Ei,j Eℓ,m = δλµ δjℓ Ei,m .
3.12
Ratios of Irrep Dimensions for the Partition and Symmetric Group Algebras
Lemma 3.32. Consider the (SN , Pt (N ))-Schur duality, where t2 ≤ N/4 (in this range, Pt (N ) is always semisimple). For any Young diagram λ with a full number of boxes |λ| = t, 2 dim VPλt (N ) t! t = t 1±O , (3.23) (N −t,λ) N N dim V SN
where (N − t, λ) is the Young diagram with an extra first row of N − t boxes. Similarly, for the (U (N ), C[St ])-Schur duality, we have that for all irreps,39 2 λ dim VC[S t! t t] = t 1±O N N dim V λ
(3.24)
U (N )
38
In algorithmic representation theory, a standard choice of basis for each irrep space is a subalgebra adapted basis [DR90, MRR03, BCH05, MRW16, FND26], which is constructed according to the branching rules when restricting an irrep of A to an irrep of a subalgebra B. We will not require this assumption. 39 Note that in this case, all irreps correspond to Young diagrams with a full number of boxes (|λ| = t ∀λ).
45
Proof. When |λ| = t, we have that (N −t,λ) dim VSN =Q
(i,j)∈λ hλ (i, j) ·
N! QN −t i=1
dim VPλt (N ) = dim VSλt = f λ = Q
(N − t − i + 1 + λ′i )
t! , (i,j)∈λ hλ (i, j)
,
(Lemma 3.25)
(Lemma 3.28, Lemma 3.25)
Y N +j−i dim VUλ(N ) = . hλ (i, j)
(Lemma 3.27)
(i,j)∈λ
where λ′i is the i’th column length of λ. Therefore, the irrep dimension ratio for the full box irreps of the (SN , Pt (N )) duality is Q −t ′ dim VPλt (N ) t! · N i=1 (N − t − i + 1 + λi ) = (3.25) (N −t,λ) N! dim V SN
Q −t ′ t! · (N − t)! · N i=1 (N − t − i + 1 + λi ) = Q −t N! · N i=1 (N − t − i + 1) N −t Y N − t − i + 1 + λ′ 1 i = N · N − t − i + 1 t i=1 t Y 1 N − t − i + 1 + λ′i = N · N −t−i+1 t i=1 t t 1 = N · 1 ± O N t 2 1 t = N · 1 ± O N t 2 t! t = t · 1±O N N
(3.26) (3.27) (λ′i = 0 for i > t) (λ′i ≤ |λ|) (t2 = O(N )) (3.28)
For the (U (N ), C[St ]) duality, dim VSλt t! =Q (i,j)∈λ (N + j − i) dim VUλ(N ) 2 t! t = t · 1±O N N
4
(3.29)
(|j − i| < |λ|)
The Tableau Recording Oracle
Let G be a compact Lie group and let ρ : G → U (N ) be a finite-dimensional unitary representation of G. We wish to give an efficient simulation of query access to ρ(g) for g sampled from the Haar measure of G (where g is re-used for all queries). In fact, we wish to simulate (controlled) access to all of ρ(g), ρ(g)† , ρ(g)∗ , and ρ(g)⊤ . 46
4.1
The Uncompressed Representation Oracle
We first consider the following purification of the above process: • The adversary’s register is V = CN , containing the input on which they wish to evaluate ρ(g). • The recording register is the Hilbert space L2 (G) (which may be countably infinite-dimensional), initialized to the Haar measure dg = |1⟩ ∈ L2 (G) using the constant f (g) = 1 function. • A query is represented by the unitary Z Qρ |x⟩ ⊗ |f ⟩ = f (g) · ρ(g) |x⟩ ⊗ |g⟩ dg.
(4.1)
G
Since each ρ(g) is a unitary, this is in fact a norm-preserving transformation. We also use the following notation to denote Qρ : Z Qρ = ρ(g) ⊗ |g⟩⟨g| dg. (4.2) G
In fact, using Qρ , we can also easily describe a process that has query access to ρ(g), ρ(g)† , ρ(g)∗ , and ρ(g)⊤ :40 • Controlled access to ρ(g)† is simulated by (controlled) IV ⊗ Inv Qρ IV ⊗ Inv , • Controlled access to ρ(g)∗ is simulated by (controlled) IV ⊗ Conj Qρ IV ⊗ Conj , • Controlled access to ρ(g)⊤ is simulated by (controlled) IV ⊗ Transpose Qρ IV ⊗ Transpose . In this section, our goal is to give an equivalent simulation of this oracle using the ClebschGordan To do this, we must first decompose ρ into irreducible representations, i.e., L transform. µ ⊗ V µ , where each µ ∈ G b is an irreducible representation that appears in V with V ≃ M µ G µ multiplicity dim(M ). We represent vectors |ψ⟩ ∈ V using the basis |µ⟩ ⊗ |m⟩ ⊗ |x⟩ for |m⟩ ∈ M µ and |x⟩ ∈ VGµ . In this basis, we can re-write Qρ as Z X X Qρ = |µ⟩⟨µ| ⊗ IMµ ⊗ ρµ (g) ⊗ |g⟩⟨g| dg = |µ⟩⟨µ| ⊗ I ⊗ Qρµ . (4.3) µ
4.2
G
µ
The Tableau Recording Oracle
The uncompressed recording oracle uses an extremely large, potentially even infinite-dimensional, Hilbert space in its purification, and is thus certainly not efficient in general. However, it turns out that in the Fourier basis (that is, considering the image of L2 (G) under the Fourier transform F ) we get a recording oracle that is efficient whenever the Clebsch–Gordan transform C is efficient! Indeed, when zero queries have been made, the recording register is in the trivial irrep state F · |1⟩ = |λ = triv, X = 1, Y = 1⟩, because |1⟩ ∈ L2 (G) is the unique normalized state that is invariant under G-translation. Formally, we define the tableau recording oracle QTab [GY25] as follows. ρ 40
See Section 3.3.1 for the definitions of Inv, Conj, and Transpose.
47
• As before, the adversary’s register contains linear combinations of |µ⟩ ⊗ |m⟩ ⊗ |x⟩ for |m⟩ ∈ M µ and |x⟩ ∈ VGµ . • The recording register now contains the following sub-registers: b of an irreducible representation ρλ . While there are – A register containing a label λ ∈ G infinitely many such λ, it turns out that after t queries to the tableau recording oracle, at most N t such λ are “reachable,” resulting in a finite-dimensional Hilbert space after any finite number of queries, which can be encoded in at most t log(N ) qubits. – Two registers X and Y containing elements of Vλ and Vλ∗ controlled on |λ⟩. We also non-canonically identify Vλ∗ with Vλ by choosing a fixed basis of Vλ with corresponding dual basis of Vλ∗ . Vλ has dimension at most N t for any λ reachable after t queries, and can also therefore be encoded in at most t log(N ) qubits. • The update rule is given by the composition of the following two maps (see Figure 12): – First, given |µ, m, x⟩ ⊗ |λ, X, Y ⟩, apply C |λ, µ, X, x⟩. This results in a superposition of states of the form |λ, µ, λ+ , r, X + ⟩ (see Definition 3.19). – Then, on the registers containing λ+ , µ, λ, r, Y , apply dC † , the inverse of the dual Clebsch– Gordan transform. This results in a superposition of states of the form |λ+ , µ, Y + , y⟩. – The registers containing |µ, m, y⟩ are returned to the adversary, while the registers containing |λ+ , X + , Y + ⟩ are the updated state of the recording oracle.
|λ⟩
|λ+ ⟩
|X⟩
|X + ⟩
|Y ⟩
|Y + ⟩
λ+ C
dC†
r
X+
|µ⟩
|µ⟩
|x⟩
|y⟩
Figure 12: A single query can be decomposed into a Clebsch–Gordan transformation followed by an inverse dual-Clebsch–Gordan operation, though not on the same registers. The adversary’s multiplicity register is not shown since it is not touched by the update.
4.2.1
Equivalence of the uncompressed and tableau recording oracles
Having defined our two recording oracles, we are ready to state the main result of this section.
48
L Theorem 4.1 (Clebsch–Gordan Updates for Tableau Recordings). Let F : L2 (G) → λ Vλ ⊗ Vλ∗ denote the Fourier transform. Then, the uncompressed representation oracle is isometric to the tableau recording oracle via the map F : in particular, (I ⊗ F ) · Qρ · (I ⊗ F )−1 is equal to the tableau recording oracle update rule of a Clebsch–Gordan transform followed by an inverse dual Clebsch–Gordan transform. This theorem is similar to the main result of [GY25], but additionally proves that the Fourier transform is an explicit Uhlmann transformation relating the tableau oracle to the uncompressed oracle. Proof. To show this, we expand out µ, m, y, λ+ , X + , Y + (I ⊗ F ) · Qρ · (I ⊗ F )† |µ, m, x, λ, X, Y ⟩
(4.4)
using the following expressions: †
(I ⊗ F ) |µ, x, λ, X, Y ⟩ = |µ, x⟩ ⊗
†
+
+
(I ⊗ F ) µ, y, λ , X , Y
+
= |µ, y⟩ ⊗
! Z q λ dim(VG ) ⟨Y | ρλ (g) |X⟩ · |g⟩
Z q + λ dim(VG )
(4.5)
! Y
+
ρλ+ (g) X
+
· |g⟩ .
Plugging in the definition of Q, these imply that Z (4.4) = ⟨µ, m, y| |µ, m⟩⟨µ, m| ⊗ ρµ (g) |µ, m, x⟩
(4.6)
(4.7)
G
·
! q + + + λ λ d(VG ) · d(VG ) Y ρλ+ (g) X ⟨Y | ρλ (g) |X⟩ dg
Z q + = d(VGλ ) · d(VGλ )
Y + ρλ+ (g) X + ⟨y| ρµ (g) |x⟩ ⟨Y | ρλ (g) |X⟩ dg | {z } G (∗)
49
(4.8) (4.9)
Let us expand out (∗) = ⟨λ, Y, µ, y| |λ⟩⟨λ| ⊗ ρλ (g) ⊗ |µ⟩⟨µ| ⊗ ρµ (g) |λ, X, µ, x⟩ ! † † = ⟨λ, µ, Y, y| C · C |λ⟩⟨λ| ⊗ |µ⟩⟨µ| ⊗ ρλ (g) ⊗ ρµ (g) C · C |λ, µ, X, x⟩
(4.10) (4.11)
! †
= ⟨λ, µ, Y, y| C ·
X
|λ⟩⟨λ| ⊗ |µ⟩⟨µ| ⊗
#
#
|r⟩⟨r| ⊗ |λ ⟩⟨λ | ⊗ ρλ# (g)
· C |λ, µ, X, x⟩
# λ# ,r∈[mλ λ,µ ]
(4.12) = ⟨λ, µ, Y, y| C † ·
X
|λ⟩⟨λ| ⊗ |µ⟩⟨µ| ⊗
|r⟩⟨r| ⊗ |λ# ⟩⟨λ# |
(4.13)
# λ# ,r∈[mλ λ,µ ]
! X
⊗
#
#
#
#
|Y ⟩⟨Y | ρλ# (g) |X ⟩⟨X |
· C |λ, µ, X, x⟩
(4.14)
X # ,Y #
X
=
⟨λ, µ, Y, y| C † |λ, µ, λ# , r, Y # ⟩ · ⟨λ, µ, λ# , r, X # | C |λ, µ, X, x⟩ · ⟨Y # | ρλ# (g) |X # ⟩
λ# ,X # ,Y # , #
r∈[mλ λ,µ ]
(4.15) Plugging this back into (4.9), we have s X d(VGλ ) (4.4) = ⟨λ, µ, Y, y| C † |λ, µ, λ# , r, Y # ⟩ ⟨λ, µ, λ# , r, X # | C |λ, µ, X, x⟩ + λ d(VG ) # # # λ ,X ,Y
(4.16)
,
#
r∈[mλ λ,µ ] + d(VGλ ) ·
·
!
Z Y
+
ρλ+ (g) X
+
#
#
⟨Y | ρλ# (g) |X ⟩ dg
(4.17)
G
| s =
d(VGλ ) + d(VGλ )
X
{z
1 if (λ+ ,X + ,Y + )=(λ# ,X # ,Y # ), else 0
}
⟨λ, µ, Y, y| C † |λ, µ, λ+ , r, Y + ⟩ ⟨λ, µ, λ+ , r, X + | C |λ, µ, X, x⟩ .
(4.18)
+ r∈[mλ λ,µ ]
Now, we invoke the dagger of Lemma 3.21 to obtain X
(4.4) =
⟨λ+ , µ, Y + , y| dC † |λ+ , µ, λ, r, Y ⟩ ⟨λ, µ, λ+ , r, X + | C |λ, µ, X, x⟩ .
(4.19)
r∈[mλ+ ,λ,µ ]
Finally, we observe that these matrix entries correspond to the composition of the Clebsch– Gordan and inverse dual Clebsch–Gordan unitaries applied to the appropriate sub-registers indicated below:
C=
X
⟨λ, µ, λ+ , r, X + | C |λ, µ, X, x⟩ · |λ, µ, λ+ , r, X + ⟩⟨λ, µ, X, x|
λ,λ+ ,µ,r,X,X + ,x
50
(4.20)
X
dC † =
⟨λ+ , µ, Y + , y| dC † λ+ , µ, λ, r, Y · λ+ , µ, Y + , y λ+ , µ, λ, r, Y .
(4.21)
λ,λ+ ,µ,r,Y,Y + ,y
This completes the derivation of the Clebsch–Gordan update rule. 4.2.2
Other query types
The derived update rule implies that we can implement compressed conjugate, transpose, and inverse queries with the (linear41 ) isometries defined below † , • I ⊗ F IV ⊗ Conj I ⊗ F † · QTab · I ⊗ F I ⊗ Conj I ⊗ F V ρ •
I⊗F
IV ⊗ Transpose
•
I⊗F
IV ⊗ Inv
† , I ⊗ F † · QTab · I ⊗ F I ⊗ Transpose I ⊗ F V ρ
I ⊗ F † · QTab · I ⊗ F IV ⊗ Inv I ⊗ F † . ρ
Using the three identities from Section 3.3.1, we can see that • I ⊗ F IV ⊗ Conj I ⊗ F † performs the map X λ,X,Y
•
I⊗F
X
αλ,X,Y |λ, X, Y ⟩ 7→
λ,X,Y
I ⊗ F † performs the map
X
αλ,X,Y |λ, X, Y ⟩ 7→
IV ⊗ Transpose
λ,X,Y
•
I⊗F
IV ⊗ Inv
αλ,X,Y |λ∗ , X, Y ⟩ .
X
αλ,X,Y |λ, Y, X⟩ .
λ,X,Y
I ⊗ F † performs the map X
αλ,X,Y |λ, X, Y ⟩ 7→
λ,X,Y
X
αλ,X,Y |λ∗ , Y, X⟩ .
λ,X,Y
Thus, we conclude that of QTab conjugated • Conjugate queries can be implemented using the complex conjugate QTab ρ ρ ∗ by the linear isometry |λ, X, Y ⟩ 7→ |λ , X, Y ⟩. (λ∗)
(λ) X
Y
3 3 4 4 5
,
4 3 5 2 2 1
4 3 6 4 3 1
X 2 2 5 3 5
Y
1 2 2 5 3 4
λ ↔ λ∗
,
5 4 4 3 3
1 3 4 6 3 4
X
(λ∗) Y
1 2 2 5 3 x 4
QTab ρ
5 3 5 2 2
+
,
5 4 4 3 3
5 3 5 2 2
(λ)
+
1 y 3 6 3 4 4
X+ 3 3 4 4 5
λ ↔ λ∗
,
4 x 3 5 2 2 1
Figure 13: Example basis vectors in a complex conjugate query for the unitary group. 41
as opposed to anti-linear (or conjugate linear)
51
Y+
4 4 3 6 3 y 1
2 2 5 3 5
• Transpose queries can be implemented using QTab conjugated by the unitary |λ, X, Y ⟩ 7→ ρ |λ, Y, X⟩ (λ) X
(λ) Y
3 3 4 4 5
2 2 5 3 5
,
4 3 5 2 2 1
Y 2 2 5 3 5
X↔Y
4 3 6 4 3 1
(λ) Y+
X 3 3 4 4 5
,
4 3 6 4 3 1
2 2 5 3 x 5
QTab ρ
4 3 5 2 2 1
(λ) X+ y 3 3 4 4 5
,
4 3 6 4 3 1
X+ X +↔ Y +
4 3 5 2 2 1
Y+
y 3 3 4 4 5
2 2 5 3 x 5
,
4 3 5 2 2 1
4 3 6 4 3 1
Figure 14: Example basis vectors in a transpose query for the unitary group.
conjugated by the linear isometry |λ, X, Y ⟩ 7→ • Inverse queries can be implemented using QTab ρ ∗ |λ , Y, X⟩. (λ∗)
(λ) X
Y
3 3 4 4 5
2 2 5 3 5
,
4 3 5 2 2 1
4 3 6 4 3 1
λ ↔ λ∗ X↔Y
(λ∗)
Y
X
Y
1 3 4 6 3 4
1 2 2 5 3 4
1 3 4 6 3 x 4
,
5 3 5 2 2
+
QTab ρ
5 4 4 3 3
X ,
5 3 5 2 2
5 4 4 3 3
(λ)
+
1 2 2 y 3 4 5
X+ λ ↔ λ∗ X +↔ Y +
Y+
3 3 4 4 5
,
5 4 3 y 2 2 1
2 2 5 3 5
4 x 3 6 3 3 1
Figure 15: Example basis vectors in an inverse query for the unitary group.
Thus, given any polynomial-size circuit for QTab and efficient isomorphisms between Vλ∗ and Vλ∗ , ρ we have corresponding polynomial-size circuits for these other query types. 4.2.3
Efficient Implementation for the Unitary Group
We now show how to efficiently implement the update rule, QTab ρ , in Theorem 4.1 for the case of Haar random unitaries, G = U (N ). The Clebsch–Gordan transform for unitaries was shown to have an efficient algorithm in [BCH05, Har05, BFG+ 25], and this algorithm was extended to the mixed unitary case, in which ρ(U ) could be either the standard irrep or the dual irrep, by [Ngu23, FTH23, GBO23]. For the case of the irrep λ consisting of a tableau containing at most t boxes (either positive or negative), and the oracle representation being a single-box irrep (either the standard or dual irrep), they show how to implement the Clebsch–Gordan transform with error at most ε in time poly(log(N ), t, log 1ε ). We show here that the Clebsch–Gordan transform implemented by these algorithms, or any similar algorithm that works in the Gelfand-Tsetlin basis, implies a corresponding dual Clebsch–Gordan algorithm with the same complexity which satisfies Lemma 3.21 and can be used in Theorem 4.1. Definition 4.2 (Signed Flipping of a Young Tableau). For every basis state |X⟩ given by a semistandard Young tableau X (allowing negative boxes), let Flip |X⟩ be the operation that, up to a ±1
52
sign, flips the Young tableau X by rotating it 180 degrees, for example, sending X
X 1 2 2 5 3 4
3 3 4 4 5 Flip
5 4 4 3 3
(4.22)
4 3 5 2 2 1
with a phase of (−1)N t+p wherePp is the total parity (even or odd) of all the entries in the tableau. (N −xi ) (Equivalently, the phase is (−1) xi ∈X where the sum runs over all the entries in the boxes of the tableau.) For instance, in the example in Equation (4.22) above, there are 6 odd entries (namely 1, 5, 3, 5, 3, and 3), so the sum is even, and t = 11 is odd, so in this case we would apply a −1 phase whenever N is odd. When working with a semi-standard Young tableau X, we always apply a sign when flipping. Therefore, when clear from context, we refer to the signed flipping of a tableau as simply the “flipping operation”. Lemma 4.3. Let G = U (N ), and let µ = be the standard irrep of U (N ). The dual Clebsch– Gordan transform implied by Lemma 3.29 is equivalent to applying the signed flip of Definition 4.2 to the Young tableau X (and a corresponding unsigned flip to corresponding shape λ), applying the standard Clebsch–Gordan transform of Lemma 3.29, and then (signed) flipping it back. That is, we have that ⟨λ, µ, λ− , X − | dC |λ, µ, X, x⟩ = ⟨λ, µ, λ− , X − | Flip · C · Flip |λ, µ, X, x⟩ .
(4.23)
Where the Flip applies to the X register, and also flips λ and λ− (without sign) accordingly. This means that every efficient algorithm for the Clebsch–Gordan transform implies a corresponding efficient dual Clebsch–Gordan transform algorithm where we Flip, apply Clebsch–Gordan, and then Flip back. Proof. We can show that the reduced Wigner coefficients, or scalar factors, of Lemma 3.29 match up term by term (up to a ±1 phase, which we will handle separately). Let Z = X be the unsigned 42 ≤z flip of X. Then Zk≤z = −Xz−k+1 (a positive row turns into a negative row and vice versa, and the row counting is reversed to go from z down to 1 rather than 1 to z). We can see in Lemma 3.29 that the Clebsch–Gordan scalar factors for Z are zero in the same places as for the dual Clebsch–Gordan, so it suffices to consider nonzero scalar factors. 42
We are starting with the unsigned flip, which we then use to compute the necessary sign. This is the only time we take the flip to be unsigned.
53
First scalar factor. The first scalar factor of the Clebsch–Gordan coefficient of adding (0, 0, . . . , 0, 2∆x , 2∆x+1 , . . . , 2∆N ) to Z is x−1 Y
1 2
≤x Zk≤x−1 − Z∆ + ∆x − k − 1 x
k=1 x Y
(4.24) ≤x Zk≤x − Z∆ + ∆x − k x
k=1 k̸=∆x x−1 Y
1 2
≤x−1 ≤x −Xx−k + Xx−∆ + ∆x − k − 1 x +1
= k=1x Y
(4.25)
≤x ≤x −Xx−k+1 + Xx−∆ + ∆x − k x +1
k=1 k̸=∆x x−1 Y
=
1 2
≤x −Xk≤x−1 + Xx−∆ + ∆x − x + k − 1 x +1
k=1 x Y
≤x −Xk≤x + Xx−∆ + ∆ − x + k − 1 x +1 x
k=1 x−k+1̸=∆x
(by re-indexing k → x − k in numerator and k → x − k + 1 in denominator) x−1 Y
=
1 2
≤x Xk≤x−1 − Xx−∆ + (x − ∆x + 1) − k x +1
k=1 x Y
.
≤x Xk≤x − Xx−∆ + (x − ∆x + 1) − k x +1
(4.26)
k=1 k̸=(x−∆x +1)
When we now relabel ∆x → (x − ∆x + 1) (since each row of the Gelfand-Tsetlin pattern is reversed when we apply the flipping operation), we can see that this becomes identical to the first scalar factor , 2 , of the dual Clebsch–Gordan coefficient of subtracting (0, 0, . . . , 0, 2 x−∆x +1 (x+1)−∆(x+1) +1 ) from X. ...,2 N −∆N +1
54
Remaining scalar factors. A similar argument holds for the other scalar factors. For the Clebsch–Gordan coefficient of adding (0, 0, . . . , 0, 2∆x , 2∆x+1 , . . . , 2∆N ) to the tableau Z = X, they are z−1 Y
1
k=1 k̸=∆(z−1) z Y
≤z Zk≤z−1 − Z∆ + ∆z − k − 1 z
≤z + ∆z − k Zk≤z − Z∆ z
2
z Y k=1 k̸=∆z z−1 Y
k=1 k̸=∆z
1 2
≤z−1 Zk≤z − Z∆ + ∆(z−1) − k (z−1)
(−1)
∆z >∆(z−1)
≤z−1 Zk≤z−1 − Z∆ + ∆ − k − 1 (z−1) (z−1)
k=1 k̸=∆(z−1)
(4.27) z−1 Y
=
k=1 k̸=∆(z−1) z Y
≤z−1 ≤z −Xz−k + Xz−∆ + ∆z − k − 1 z +1
≤z ≤z −Xz−k+1 + Xz−∆ + ∆z − k z +1
1 2
z Y
1 2
≤z ≤z−1 −Xz−k+1 + Xz−∆ + ∆(z−1) − k (z−1)
k=1 k̸=∆z z−1 Y
k=1 k̸=∆z
∆z >∆(z−1)
(−1) ≤z−1 ≤z−1 −Xz−k + Xz−∆ + ∆(z−1) − k − 1 (z−1)
k=1 k̸=∆(z−1)
(4.28) z−1 Y
=
≤z −Xk≤z−1 + Xz−∆ + ∆z − z + k − 1 z +1
k=1 z−k̸=∆(z−1) z Y
1 2
z Y
1 2
≤z−1 −Xk≤z + Xz−∆ + ∆ − z + k − 1 (z−1) (z−1)
k=1 z−k+1̸=∆z z−1 Y
≤z −Xk≤z + Xz−∆ + ∆ − z + k − 1 z z +1
∆z >∆(z−1)
(−1)
≤z−1 −Xk≤z−1 + Xz−∆ + ∆(z−1) − z + k − 1 (z−1)
k=1 z−k+1̸=∆z
k=1 z−k̸=∆(z−1)
(4.29) z−1 Y
=
≤z Xk≤z−1 − Xz−∆ + (z − ∆z + 1) − k z +1
k=1 k̸=z−∆(z−1) z Y
≤z Xk≤z − Xz−∆ + (z − ∆z + 1) − k z +1
k=1 k̸=z−∆z +1
1 2
z Y
1 2
≤z−1 Xk≤z − Xz−∆ + (z − ∆(z−1) ) − k + 1 (z−1)
k=1 k̸=z−∆z +1 z−1 Y
∆z >∆(z−1)
(−1)
≤z−1 Xk≤z−1 − Xz−∆ + (z − ∆(z−1) ) − k + 1 (z−1)
k=1 z−k̸=∆(z−1)
(4.30) As before, we now relabel ∆z → (z − ∆z + 1) and ∆z−1 → (z − ∆z−1 ), and, up to a ±1 phase, it becomes identical to the corresponding scalar factor of the dual Clebsch–Gordan coefficient of , 2 , . . . , 2 ) from X. subtracting (0, . . . , 2 x−∆x +1
N −∆N +1
(x+1)−∆(x+1) +1
It now remains to handle the sign. For each scalar factor besides the first (which does not come with a sign), the attached sign (after relabeling ∆z → (z − ∆z + 1) and ∆z−1 → (z − ∆z−1 )) is (−1)(z−∆z +1)>(z−∆(z−1) ) = (−1)∆z <(∆(z−1) +1) = (−1)∆z ≤∆(z−1) for the (unsigned) flipped Clebsch– Gordan, but (−1)∆z >∆(z−1) for the dual Clebsch–Gordan coefficient. Since the conditions ∆z ≤ ∆(z−1) and ∆z > ∆(z−1) are mutually exclusive, they always disagree, meaning that the scalar factor for our unsigned flipped Clebsch–Gordan always has the wrong sign. The product of the scalar factors that makes up the Clebsch–Gordan coefficient has N − x such 55
.
scalar factors, which means that we are off byPa phase of (−1)N −x = (−1)N +x . This is exactly the (N −xi ) sign that we get by applying a phase of (−1) xi ∈X both times that we flip. The phase from each value xi in the tableau that is not added/removed will cancel between the flip before and after the Clebsch–Gordan transform. The only phase remaining will be from the entries that are added or removed in between. The Clebsch–Gordan transform of inserting x either adds a positive box containing x, removes a negative box containing x, or replaces a negative box containing x with y and adds positive box containing y. In any of these cases, when performing the signed flip before and after the Clebsch–Gordan transform, the resulting phase is (−1)N −x as desired, completing the proof. Claim 4.4. Let C be the Clebsch–Gordan transform implied by Lemma 3.29, and let dC be the corresponding dual Clebsch–Gordan transform, given by applying C on the flipped tableau as in Lemma 4.3. Then C and dC satisfy Lemma 3.21. Namely, v u u dim V λ U (N ) u ⟨λ, λ+ , X + | C |λ, X, x⟩ (4.31) ⟨λ+ , λ, X| dC |λ+ , X + , x⟩ = t + λ dim VU (N ) This implies that an efficient algorithm for C alone is enough to give an efficient perfect update algorithm for the tableau recording oracle for random unitaries. Proof. We first observe that each Clebsch–Gordan coefficient and its dual Clebsch–Gordan coefficient are non-zero on the same support. Where they are both non-zero, we proceed by computing the ratio ⟨λ, λ+ , X + | C |λ, X, x⟩ ⟨λ+ , λ, X| dC |λ+ , X + , x⟩
(4.32)
by evaluating the ratios of each scalar factor individually. First scalar factor. The ratio of the first scalar factors of the two Clebsch–Gordan coefficients is x−1 Y
1 2
≤x Xk≤x−1 − X∆ + ∆ − k − 1 x x ≤x Xk≤x − X∆ + ∆x − k x
=
1 2
(4.33)
(X + )≤x−1 − (X + )≤x ∆x + ∆ x − k k
k=1 k̸=∆x x−1 Y
+ ≤x (X + )≤x k − (X )∆x + ∆x − k
k=1 k̸=∆x x−1 Y
k=1 x Y
x Y
k=1 1 2
≤x Xk≤x−1 − X∆ + ∆x − k − 1 x
k=1 x Y k=1 k̸=∆x
≤x Xk≤x − X∆ + ∆x − k x
x Y
k=1 k̸=∆x x−1 Y
≤x Xk≤x − X∆ + ∆x − k − 1 x
≤x Xk≤x−1 − X∆ + ∆ − k − 1 x x
k=1
56
1 2
(4.34)
x Y
1
2 ≤x + ∆ − k − 1 Xk≤x − X∆ x x
k=1 k̸=∆x x Y
=
(4.35)
≤x Xk≤x − X∆ + ∆x − k x
k=1 k̸=∆x 1 2
≤x x Y Xk≤x − X∆ + ∆x − k − 1 x
=
k=1 k̸=∆x
Remaining scalar factors. coefficients are z−1 Y
(4.36)
≤x Xk≤x − X∆ + ∆x − k x
The ratios of the remaining scalar factors of the two Clebsch–Gordan 1
z Y
2 ≤z Xk≤z−1 − X∆ + ∆ − k − 1 z z
k=1 k̸=∆z−1 z Y
≤z Xk≤z − X∆ + ∆z − k z
≤z−1 Xk≤z − X∆ + ∆z−1 − k z−1
k=1 k̸=∆z z−1 Y
1 2
(−1)∆z >∆z−1
≤z−1 Xk≤z−1 − X∆ + ∆z−1 − k − 1 z−1
k=1 k̸=∆z
k=1 k̸=∆z−1
(4.37) z Y
·
k=1 k̸=∆z z−1 Y
+ ≤z (X + )≤z k − (X )∆z + ∆z − k
1 2
(X + )≤z−1 − (X + )≤z ∆z + ∆ z − k k
1
z−1 Y
(X + )k≤z−1 − (X + )≤z−1 ∆z−1 + ∆z−1 − k + 1
k=1 k̸=∆z−1 z Y
2 (−1)∆z >∆z−1
+ ≤z−1 (X + )≤z k − (X )∆z−1 + ∆z−1 − k + 1
k=1 k̸=∆z
k=1 k̸=∆z−1
(4.38) z−1 Y
=
≤z Xk≤z−1 − X∆ + ∆z − k − 1 z
k=1 k̸=∆z−1 z Y
≤z Xk≤z − X∆ + ∆z − k z
1 2
·
k=1 k̸=∆z z−1 Y k=1 k̸=∆z−1
≤z Xk≤z − X∆ + ∆z − k − 1 z
≤z−1 Xk≤z − X∆ + ∆z−1 − k z−1
k=1 k̸=∆z z−1 Y
(4.39)
≤z−1 Xk≤z−1 − X∆ + ∆z−1 − k − 1 z−1
k=1 k̸=∆z z Y
z Y
1 2
k=1 k̸=∆z−1 1 2
≤z Xk≤z−1 − X∆ + ∆z − k − 1 z
z−1 Y
1
≤z−1 Xk≤z−1 − X∆ + ∆z−1 − k z−1
k=1 k̸=∆z−1 z Y k=1 k̸=∆z
57
2 (4.40)
≤z−1 Xk≤z − X∆ + ∆z−1 − k z−1
z Y
=
1
≤z Xk≤z − X∆ + ∆z − k − 1 z
k=1 k̸=∆z z Y
z−1 Y
2
≤z−1 + ∆z−1 − k Xk≤z−1 − X∆ z−1
≤z + ∆z − k Xk≤z − X∆ z
z−1 Y
(4.41)
≤z−1 + ∆ − k − 1 Xk≤z−1 − X∆ z−1 z−1
k=1 k̸=∆z−1 1 2
1 2
≤z z Y Xk≤z − X∆ + ∆z − k − 1
z−1 Y
z
≤z Xk≤z − X∆ + ∆z − k z
k=1 k̸=∆z
1 2
k=1 k̸=∆z−1
k=1 k̸=∆z
=
k=1 k̸=∆z−1
≤z−1 + ∆z−1 − k Xk≤z−1 − X∆ z−1 ≤z−1 ≤z−1 Xk − X∆z−1 + ∆z−1 − k − 1
(4.42)
Putting them together. We now combine these to get the ratio of the Clebsch–Gordan coefficients as the product of the ratios of the scalar factors: ⟨λ, λ+ , X + | C |λ, X, x⟩ ⟨λ+ , λ, X| dC |λ+ , X + , x⟩
(4.43) 1 2
=
≤x x Y Xk≤x − X∆ + ∆x − k − 1 x
k=1 k̸=∆x
(4.44)
≤x Xk≤x − X∆ + ∆x − k x 1 2
·
≤z z Y Xk≤z − X∆ + ∆z − k − 1
N Y
z
z=x+1
k=1 k̸=∆z
≤z Xk≤z − X∆ + ∆z − k z
1 2
z−1 Y k=1 k̸=∆z−1
≤z−1 Xk≤z−1 − X∆ + ∆z−1 − k z−1 ≤z−1 Xk≤z−1 − X∆ + ∆z−1 − k − 1 z−1
(4.45)
This is a telescoping product, since in each factor of the outside product, the second part cancels with the first part of the previous factor, ultimately giving 1 2
=
≤N N Y Xk≤N − X∆ + ∆N − k − 1 N k=1 k̸=∆N
(4.46)
≤N Xk≤N − X∆ + ∆N − k N 1 2
=
N Y λk − (λ∆N + 1) + ∆N − k λ k − λ ∆N + ∆ N − k
(4.47)
k=1 k̸=∆N
1 2
=
N + Y λ+ k − λ∆N + ∆N − k k=1 k̸=∆N
(4.48)
λk − λ∆N + ∆N − k 1 2
=
N + Y (λ+ k − k) − (λ∆N − ∆N ) k=1 k̸=∆N
(4.49)
(λk − k) − (λ∆N − ∆N )
58
1 2
=
∆Y N −1 i=1
1 2 + (λ+ i − i) − (λ∆N − ∆N )
(λi − i) − (λ∆N − ∆N )
+ (λ+ ∆N − ∆N ) − (λj − j)
N Y j=∆N +1
(λ∆N − ∆N ) − (λj − j)
1 2
+ Y (λ+ i − i) − (λj − j)
·
i<j i̸=∆N j̸=∆N
|
(λi − i) − (λj − j) {z
}
=1 since λ and λ+ only differ on row ∆N
(4.50) =
+ N N Y Y (λ+ i − i) − (λj − j) i=1 j=i+1
1 2
(4.51)
(λi − i) − (λj − j)
+ 1 2 dim VUλ(N ) . = dim VUλ(N )
5
The Path Recording Oracle
The tableau-recording oracle gives an exact simulation of queries to a Haar-random group representation by storing the purification in the Fourier basis of L2 (G). Unfortunately, the tableau-recording oracle can be challenging to interpret operationally: from the contents of the tableau register, it can be difficult to characterize in simple terms what information about the queried representation has been learned or fixed by the algorithm. The goal of this section is to construct an equivalent recording in a path basis. Informally, after t queries, we would like the recording register to store a superposition of Feynman path information |x1 , . . . , xt , y1 , . . . , yt ⟩. For a fixed group element g, this path corresponds to the matrix element t Y ⟨yi |ρ(g)|xi ⟩ = ⟨y1 , . . . , yt |ρ(g)⊗t |x1 , . . . , xt ⟩, i=1
and indeed, a non-adaptive algorithm that queries the uncompressed oracle Qρ on inputs |x1 , . . . , xt ⟩ would result in the state Z X |y1 , . . . , yt ⟩ ⊗ ⟨⃗y | ρ⊗t |⃗x⟩ · |g⟩ dg. G
y1 ,...,yt
How does this compare with recording the path |⃗x, ⃗y ⟩? To make this precise, we introduce the matrix element map ⊗t Θt : V ⊗t ⊗ V −→ L2 (G) defined as
Z Θt |⃗x, ⃗y ⟩ :=
⟨⃗y |ρ(g)⊗t |⃗x⟩|g⟩ dg,
(5.1)
G
so that Q⊗t x⟩ = ρ |⃗
X
|⃗y ⟩ ⊗ Θt (|⃗x⟩ |⃗y ⟩).
(5.2)
⃗ y ∈B(V )
Using this, we can see that for any particular representation ρ, path states contain some redundancies. Let At = EndG (V ⊗t )
59
be the commutant algebra of the tensor-power representation. As discussed in the technical overview, since every A ∈ At commutes with ρ(g)⊗t , the matrix-element map satisfies Θt (A ⊗ I) = Θt (I ⊗ AT ). Therefore, it should be the case that (A ⊗ I) |ψ⟩ = (I ⊗ AT ) |ψ⟩ on valid path-recording states. This identification is implemented by the commutant EPR projector ΩAt . Furthermore, path states may require different relative normalizations. These factors are encoded in the reweighting operator ΛAt defined later. With these ingredients, the path-recording update has the following form: append a new inputoutput pair (xt , yt ), project the recording register onto the commutant-EPR subspace ΩAt , and apply an appropriate Schur-Weyl subspace reweighting. The remainder of this section defines these operators precisely, proves that the resulting path-recording oracle is isometric to the tableau recording oracle, gives an interpretation of ΩAt in terms of the algebra At (when it is semisimple), and derives forms of the update that are useful for adaptive query algorithms.
5.1
Defining the Path Recording Oracle
Let ρ : G → U (V ) be a finite-dimensional unitary representation of a compact Lie group G. Fix an orthonormal basis B(V ) = {|x⟩} of V . We use the same ket notation |y⟩ for the corresponding conjugate basis of V , specifying registers when needed. For each t, let M Schurt : V ⊗t −→ VGλ ⊗ VAλt λ
be the generalized Schur transform for V ⊗t , so that ρ⊗t (g) =
M
ρλ (g) ⊗ IV λ . At
λ
Define the ordered path space Patht := V ⊗t ⊗ V
⊗t
.
A path basis vector is written |⃗x, ⃗y ⟩ := |x1 , . . . , xt ⟩ ⊗ |y1 , . . . , yt ⟩ . Note that |y1 , . . . , yt ⟩ implicitly corresponds to the dual basis element |y1∗ , . . . , yt∗ ⟩ ∈ V define the append map App(t) x,y : Patht −→ Patht+1
⊗t
. Next, we
by App(t) x, ⃗y ⟩ = |x1 , . . . , xt , x⟩ ⊗ |y1 , . . . , yt , y⟩ . x,y |⃗
(5.3)
Equivalently, App(t) x,y = I ⊗ |x, y⟩ . We relate the path space V ⊗t ⊗ V Schur transform
⊗t
to the (Fourier/tableau) compressed oracle via the double
Schurt ⊗ Schurt : V ⊗t ⊗ V
⊗t
−→
M λ,λ′
60
′ ′ VGλ ⊗ VAλt ⊗ VGλ ⊗ VAλt .
We write double-Schur basis vectors as |λ, X, T ⟩ ⊗ λ′ , Y, R , where X ∈ B(VGλ ),
′
Y ∈ B(VGλ ),
T ∈ B(VAλt ),
′
R ∈ B(VAλt ).
This is again shorthand for the vector |λ, X, T ⟩ ⊗ |λ′ , Y, R⟩. b λ,t be the projector in the Schur basis onto block λ, that is, onto V λ ⊗ V λ . We then define Let Π G At its path basis version as b λ,t · Schurt . Πλ,t := Schur†t · Π (5.4) b ⊗2 to denote Π b λ,t ⊗ Π b ⊗2 , which is the projector in the In a slight abuse of notation, we use Π λ,t λ,t double-Schur basis onto the (λ, λ) block VGλ ⊗ VAλt ⊗ VGλ ⊗ VAλt . Equivalently, ( b ⊗2 (|λ1 , X, T ⟩ ⊗ |λ2 , Y, R⟩) = |λ, X, T ⟩ ⊗ |λ, Y, R⟩ , λ1 = λ2 = λ, Π λ,t 0, otherwise. The corresponding path basis projector is then † ⊤ b ⊗2 Πλ,t Schurt ⊗ Schurt . Π⊗2 λ,t := Schurt ⊗ Schurt For each λ, define the normalized EPR state on the pair of At -registers by E X 1 EPRλAt := q |T ⟩ ⊗ |T ⟩ . dim(VAλt ) T ∈B(V λ ) At
b At Let Π ̸ λ′ , and on EPR,t be the double-Schur-basis projector that acts as zero on blocks λ = the λ = λ′ block projects the two At -registers onto EPRλAt while acting as identity on the two G-registers. Equivalently, X δT,R |λ, X, S⟩ ⊗ |λ, Y, S⟩ , λ = λ′ , λ dim(V ) ′ b At At S∈B(V λ ) Π = EPR,t |λ, X, T ⟩ ⊗ λ , Y, R At 0, λ ̸= λ′ . Via the double Schur transform, this induces the following projector on the path space. b At ΩAt := Schur†t ⊗ Schur⊤ Π t EPR,t Schurt ⊗ Schurt . Finally, define the subspace-reweighting operator s X dim(VAλ ) t Wt := Π⊗2 . λ ) λ,t dim(V G λ
(5.5)
(5.6)
This operator reweights each double-Schur subspace with matching irrep label λ on the two sides. 61
On the equal-irrep subspace Πdiag,t :=
X
Π⊗2 λ,t ,
λ
the inverse reweighting is s Wt+ :=
X λ
dim(VGλ ) ⊗2 Π . dim(VAλt ) λ,t
(5.7)
Thus Wt+ Wt = Wt Wt+ = Πdiag,t . Since ΩAt ⪯ Πdiag,t , this is a valid inverse restricted to the legal path subspace.
5.2
Path Recording Theorem Statement
With these definitions set up, we are ready to state and analyze our path recording oracle. Definition 5.1 (Path Recording Oracle). The path recording oracle is defined to be the following L linear operator. The input space of the operator is V ⊗ t Patht . On subspace V ⊗ Patht , the operator is defined as QPath ρ,t+1 =
X
+ |y⟩⟨x| ⊗ Wt+1 · ΩAt+1 · App(t) x,y ·Wt · ΩAt ,
(5.8)
x,y∈B(V )
which outputs an element of V ⊗ Patht+1 . When restricted to the legal path-recording subspace ΩAt , the operator is given by X + QPath = |y⟩⟨x| ⊗ Wt+1 ΩAt+1 App(t) ρ,t+1 x,y Wt .
(5.9)
x,y∈B(V )
Remark 5.2 (Equivalent definition). Another definition of the path recording oracle is the following: X + QPath |y⟩⟨x| ⊗ ΛAt+1 · ΩAt+1 · App(t) (5.10) ρ,t+1 = x,y ·ΛAt · ΩAt , x,y∈B(V )
where
s ΛAt =
X λ
dim(VAλt ) · Π ⊗ I λ,t dim(VGλ )
(5.11)
and Λ+ At is inverse to ΛAt on Im(Schurt ). This is equivalent because ΩAt in particular projects onto Πdiag,t , on which ΛAt and Wt are equivalent (as are their pseudoinverses). We will prove that QPath ρ,t+1 is equivalent to Qρ on an appropriate subspace of legal “reachable” states. Let n o b t := Irr(ρ⊗t ) = λ ∈ G b : dim(VAλ ) > 0 G t be the set of irreps appearing in the Schur–Weyl decomposition of V ⊗t , and let M Tabt := VGλ ⊗ VGλ bt λ∈G
be the t-query reachable tableau space. 62
Theorem 5.3 (Correctness of the path-recording oracle). There is a sequence of partial isometries L λ Ut : λ VGλ ⊗ V G → Patht such that the following holds. For every t, QPath ρ,t+1 · (IV ⊗ Ut · F ) = (IV ⊗ Ut+1 · F ) · Qρ ,
(5.12)
when inputs are restricted to V ⊗ F −1 (Tabt ). Therefore, for every t-query quantum algorithm A whose query register is V , for all input states |ψ⟩, we have that Path AQρ (|ψ⟩) ≃ AQρ (|ψ⟩) via a fixed partial isometry Ut · F on the recording register. Setup.
With this notation, the path-recording update is given by X + QPath |y⟩⟨x| ⊗ Wt+1 ΩAt+1 App(t) ρ,t+1 = x,y Wt ΩAt . x,y∈B(V )
We will prove QPath ρ,t+1 (IV ⊗ Ut F ) = (IV ⊗ Ut+1 F )Qρ on the appropriately restricted input states.
5.3
Defining the partial isometry Ut
To begin proving Theorem 5.3, we first define the partial isometries M Ut : VGλ ⊗ VGλ −→ Patht . λ λ
For every irrep λ, we write the basis states of VGλ ⊗ V G as |λ, X, Y ⟩. With this setup, we have that M ′ ′ Im Schurt ⊗ Schurt = VGλ ⊗ VAλt ⊗ VGλ ⊗ VAλt . bt λ,λ′ ∈G
Since Schurt ⊗ Schurt is an isometry, we thus conclude that † † Schurt ⊗Schurt Schurt ⊗Schurt = IPatht , Schurt ⊗Schurt Schurt ⊗Schurt = ΠIm(Schurt ⊗Schurt ) . Next, we define the At EPR isometry M M M λ λ ′ ′ Et : VGλ ⊗ V G −→ VGλ ⊗ VAλt ⊗ VGλ ⊗ VAλt ⊂ VG ⊗ VAλt ⊗ VGλ ⊗ VAλt λ
λ,λ′
λ
by X 1 |λ, X, R⟩ ⊗ |λ, Y, R⟩ , Et |λ, X, Y ⟩ := q dim(VAλt ) R∈B(V λ )
bt λ∈G
At
and Et |λ, X, Y ⟩ = 0 otherwise. Since this operation is simply tensoring with a normalized EPR state on the two At -registers, Et is an isometry when restricted to Tabt . Moreover, by construction, Im(Et ) ⊂ Im(Schurt ⊗ Schurt ) 63
The adjoint of Et is given on double-Schur basis states by 1 |λ, X, Y ⟩ , q † λ ) ′ dim(V Et |λ, X, T ⟩ ⊗ λ , Y, R = At 0,
b t and T = R, λ = λ′ ∈ G otherwise.
With these definitions, it follows directly that Et† Et = ΠTabt ,
b At . Et Et† = Π EPR,t
Finally, we are ready to define the operators Ut := Schur†t ⊗ Schur⊤ Et . t To understand the domain and image on which Ut is an isometry, we calculate Ut† Ut = Et† ΠIm(Schurt ⊗Schurt ) Et = Et† Et = ΠTabt , while Ut Ut† = (Schurt ⊗ Schurt )† Et Et† (Schurt ⊗ Schurt ) b At (Schurt ⊗ Schurt ) = (Schurt ⊗ Schurt )† Π EPR,t
= ΩAt , where the last equation holds by definition of ΩAt . Thus, we have proved the following fact. Claim 5.4. Ut is an isometry between Tabt and the legal path subspace Im(ΩAt ) ⊂ Patht . As a result, we see that Ut · F is an isometry between F −1 (Tabt ) and Im(ΩAt ). We next give a characterization of the subspace F −1 (Tabt ).
5.4
Path Matrix Elements
To properly understand Ut , we consider the matrix element map Θt : Patht −→ L2 (G) defined as
Z Θt |⃗x, ⃗y ⟩ :=
⟨⃗y | ρ⊗t (g) |⃗x⟩ |g⟩ dg.
(5.13)
G
We make the following claims about the map Θt . Lemma 5.5. Im(F · Θt · ΩAt ) = Im(F · Θt ) = Tabt . Moreover, as operators defined on Patht , Ut · F · Θt = Wt ΩAt .
(5.14)
Proof. We first prove that Tabt ⊂ Im(F · Θt · ΩAt ). To prove this, let |λ, X, Y ⟩ ∈ Tabt be a tableau basis vector. Let |T ⟩ ∈ VAλt be an arbitrary basis state, which we also identify with a basis state in
64
λ
V At . Then, we observe that
†
⊤
Θt Schur |λ, X, T ⟩ ⊗ Schur |λ, Y, T ⟩
Z
⟨λ, Y, T | Schur · ρ⊗t (g) · Schur† |λ, X, T ⟩ · |g⟩ dg
= ZG
⟨λ, Y, T | ρλ (g) |λ, X, T ⟩ · |g⟩ dg
=
(5.15)
G
1 =q · F −1 |λ, X, Y ⟩ . λ dim(VG )
(5.16)
λ
Since this holds for every basis state |T ⟩, we can initialize the VAλt ⊗ V At to be an EPR state (instead of a fixed basis vector) and also conclude that F −1 |λ, X, Y ⟩ ∈ Im(Θt ΩAt ). Next, we prove that Im(F · Θt ) ⊂ Tabt as well as Eq. (5.14). It suffices to prove both of these claims on basis vectors |⃗x, ⃗y ⟩ ∈ Patht . Expand the Schur transform as X λ,X,T Schurt |⃗x⟩ = S⃗x |λ, X, T ⟩ , λ,X,T
where X ∈ B(VGλ ),
T ∈ B(VAλt ).
Since Schur-Weyl duality exactly tells us that the representation ρ⊗t decomposes as M ρ⊗t (g) = ρλ (g) ⊗ IV λ , At
λ
we have that S⃗yλ,Y,T S⃗xλ,X,T ⟨Y | ρλ (g) |X⟩ .
X
⟨⃗y | ρ⊗t (g) |⃗x⟩ =
λ,X,Y,T
Therefore, by the definition of the Fourier transform, X S⃗yλ,Y,T S⃗xλ,X,T q F Θt |⃗x, ⃗y ⟩ = |λ, X, Y ⟩ . dim(VGλ ) λ,X,Y,T Since the coefficient of |λ, X, Y ⟩ is nonzero only if both |λ, X, T ⟩ and |λ, Y, T ⟩ are in the image of the Schur transform for some T , this tells us that F Θt |⃗x, ⃗y ⟩ ∈ Tabt . Next, applying Ut = (Schur†t ⊗ Schur⊤ t )Et gives Ut F Θt |⃗x, ⃗y ⟩ =
S⃗yλ,Y,T S⃗xλ,X,T
X q λ,X,Y,T,R
dim(VGλ ) dim(VAλt )
Schur†t ⊗ Schur⊤ (|λ, X, R⟩ ⊗ |λ, Y, R⟩) . t
On the other hand, ′
S⃗xλ,X,T S⃗yλ ,Y,R |λ, X, T ⟩ ⊗ λ′ , Y, R .
X
Schurt ⊗ Schurt |⃗x, ⃗y ⟩ =
λ,λ′ ,X,Y,T,R
Projecting onto the EPR subspace gives ΩAt |⃗x, ⃗y ⟩ =
Schur†t ⊗ Schur⊤ t
X
S⃗xλ,X,T S⃗yλ,Y,T
λ,X,Y,T,R
dim(VAλt )
65
|λ, X, R⟩ ⊗ |λ, Y, R⟩ .
(5.17)
The operator Wt multiplies the λ-subspace by s dim(VAλt ) dim(VGλ )
.
Hence Wt ΩAt |⃗x, ⃗y ⟩ =
S⃗yλ,Y,T S⃗xλ,X,T q Schur†t ⊗ Schur⊤ (|λ, X, R⟩ ⊗ |λ, Y, R⟩) . t λ ) dim(V λ ) dim(V λ,X,Y,T,R G At X
(5.18)
We conclude that Ut F Θt |⃗x, ⃗y ⟩ = Wt ΩAt |⃗x, ⃗y ⟩ , as desired.
5.5
Proof of Theorem 5.3
To prove Theorem 5.3, we derive an expression that is simultaneously equal to both (IV ⊗ Ut+1 F )Qρ and QPath ρ,t+1 (IV ⊗ Ut F ). Beginning with the former, we claim the following operator identity holds on inputs |x⟩ ⊗ |⃗x⟩ |⃗y ⟩. Claim 5.6. X
Qρ · (|x⟩ ⊗ Θt ) =
|y⟩ ⊗ Θt+1 App(t) x,y .
(5.19)
y
To see this, we simply observe that the left-hand side is equal to
Z
Qρ |x⟩ ⊗
⊗t
⟨⃗y | ρ (g) |⃗x⟩ |g⟩ dg
=
G
Z
X
|y⟩ ⊗
y∈B(V )
⟨y| ρ(g) |x⟩ ⟨⃗y | ρ⊗t (g) |⃗x⟩ |g⟩ dg.
G
and the second tensor factor exactly contains the |⃗x, x, ⃗y , y⟩ matrix element function. Applying IV ⊗ Ut+1 F to the recording register and invoking Eq. (5.14), we see that X (IV ⊗ Ut+1 F )Qρ (|x⟩ ⊗ Θt ) = |y⟩ ⊗ Ut+1 F Θt+1 App(t) x,y y
=
X
|y⟩ ⊗ Wt+1 ΩAt+1 App(t) x,y .
y
Next, for every x ∈ V , we calculate (again invoking Eq. (5.14)) Path QPath ρ,t+1 (IV ⊗ Ut F ) (|x⟩ ⊗ Θt ) = Qρ,t+1 (|x⟩ ⊗ Wt ΩAt ) X + = |y⟩ ⊗ Wt+1 ΩAt+1 App(t) x,y Wt ΩAt Wt ΩAt
(5.20) (5.21)
y
=
X
|y⟩ ⊗ Wt+1 ΩAt+1 App(t) x,y ΩAt ,
y
where the last equation holds because ΩAt and Wt+ commute and Wt+ Wt ΩAt = ΩAt . 66
(5.22)
Inserting an additional ΩAt on the right, we conclude that QPath ρ,t+1 (IV ⊗ Ut F )(IV ⊗ Θt ΩAt ) = (IV ⊗ Ut+1 F )Qρ (IV ⊗ Θt ΩAt ), and thus QPath ρ,t+1 (IV ⊗ Ut F ) = (IV ⊗ Ut+1 F )Qρ when restricted to inputs in V ⊗Im(Θt ΩAt ) = V ⊗F −1 (Tabt ), which is the first claim of Theorem 5.3. Quantum query algorithms. To obtain the second claim of Theorem 5.3, we note that all recording states obtainable by making t queries to Qρ lie in F −1 (Tabt ). Lemma 5.7 (Reachable states are in Im(Θt )). Fix any adaptive quantum algorithm whose query register is V and queries Qρ . Then, its recording register always remains in Im(Θt ) = F −1 (Tabt ). Proof. This follows immediately from Eq. (5.19) and an induction on t. Finally, we observe that in this context, the one-query identity implies the t-query statement by induction. In particular, suppose that immediately before the (t + 1)-st query, the path-recorded simulation state is obtained from the uncompressed representation oracle by applying I ⊗ Ut F to the recording register. The adversary’s next local unitary commutes with the recording-register isometry. The next oracle call is handled by the identity QPath ρ,t+1 (IV ⊗ Ut F ) = (IV ⊗ Ut+1 F )Qρ . Therefore the invariant is preserved with t + 1 in place of t. Starting from the trivial depth-0 recording register, induction over the t queries gives Path
AQρ (|ψ⟩) ≃ AQρ
(|ψ⟩)
via the final isometry Ut F . This proves the second claim of Theorem 5.3.
5.6
Transpose queries
The same argument also gives a path-recording update for transpose queries. Here transpose is taken with respect to the fixed basis B(V ). Theorem 5.8 (Transpose path-recording update). Let Qρ⊤ denote the purified oracle which applies ρ(g)⊤ to the adversary’s query register: Z Z Qρ⊤ |x⟩ ⊗ f (g)|g⟩ dg = f (g) ρ(g)⊤ |x⟩ ⊗ |g⟩ dg. G
G
Then, for every x ∈ B(V ), Qρ⊤ · (|x⟩ ⊗ Θt ) =
X
|y⟩ ⊗ Θt+1 App(t) y,x .
y∈B(V )
Consequently, if we define QPath,⊤ ρ,t+1 :=
X
+ |y⟩⟨x| ⊗ Wt+1 ΩAt+1 App(t) y,x Wt ΩAt ,
x,y∈B(V )
67
then QPath,⊤ ρ,t+1 · (IV ⊗ Ut F ) = (IV ⊗ Ut+1 F ) · Qρ⊤ on inputs restricted to V ⊗ F −1 (Tabt ). Proof. First we prove the matrix-element identity. By definition, Z Θt |⃗x, ⃗y ⟩ = ⟨⃗y |ρ(g)⊗t |⃗x⟩|g⟩ dg. G
Therefore Z
X
Qρ⊤ (|x⟩ ⊗ Θt |⃗x, ⃗y ⟩) =
|y⟩ ⊗
y∈B(V )
Z
X
=
|y⟩ ⊗
X
(5.23)
⟨x|ρ(g)|y⟩⟨⃗y |ρ(g)⊗t |⃗x⟩|g⟩ dg
(5.24)
G
y∈B(V )
=
⟨y|ρ(g)⊤ |x⟩⟨⃗y |ρ(g)⊗t |⃗x⟩|g⟩ dg
G
|y⟩ ⊗ Θt+1 App(t) x, ⃗y ⟩. y,x |⃗
(5.25)
y∈B(V )
Thus a transpose query appends the reversed pair (y, x). We now prove the path-recording identity. By Eq. (5.14), Ut F Θt = Wt ΩAt , Ut+1 F Θt+1 = Wt+1 ΩAt+1 . Applying IV ⊗ Ut+1 F to the transpose matrix-element identity gives X (IV ⊗ Ut+1 F )Qρ⊤ (|x⟩ ⊗ Θt ) = |y⟩ ⊗ Wt+1 ΩAt+1 App(t) y,x . y
On the other hand, Path,⊤ Qρ,t+1 (|x⟩ ⊗ Wt ΩAt ) =
X
=
X
+ |y⟩ ⊗ Wt+1 ΩAt+1 App(t) y,x Wt ΩAt Wt ΩAt
(5.26)
|y⟩ ⊗ Wt+1 ΩAt+1 App(t) y,x ΩAt ,
(5.27)
y
y
using Wt+ Wt ΩAt = ΩAt . Therefore the two expressions agree when restricted to inputs in V ⊗ Im(Θt ΩAt ) = V ⊗ F −1 (Tabt ), which proves the theorem. Thus arbitrary adaptive algorithms making forward and transpose queries are simulated by (t) (t) using Appx,y for a forward query and Appy,x for a transpose query.
5.7
Schur Orthogonality for the Commutant Algebras
Our next step is to interpret the commutant EPR projector ΩAt . To do this, we first show that whenever the commutant algebra is semisimple, it satisfies the Schur orthogonality relations for the matrix elements of its simple modules.
68
Theorem 5.9 (Schur Orthogonality). Let A be a semisimple algebra, and let B(A) be a basis for A. For a ∈ A, let tr(a) be the trace of the regular representation of A. For each a ∈ A, let a∗ be its dual element under this trace. Let λ, µ ∈ Λ(A) be the labels of two simple modules, VAλ and VAµ , of A. Let |a⟩ , |b⟩ ∈ B(VAλ ) and |c⟩ , |d⟩ ∈ B(VAµ ). Then43 X 1 ⟨a| ρλ (σ) |b⟩ ⟨c| ρµ (σ ∗ ) |d⟩ = δλµ δad δbc (5.28) dim(VAλ ) σ∈B(A)
Proof. Consider the matrix X
Tbc :=
ρλ (σ) · |b⟩⟨c| · ρµ (σ ∗ ).
σ∈B(A)
Our goal is to show that ( Tbc =
1 λ ) IV λ dim(VA A
if λ = µ and b = c,
0
otherwise.
If we can show this, then X
⟨a| ρλ (σ) |b⟩ ⟨c| ρµ (σ ∗ ) |d⟩ = ⟨a| Tbc |d⟩
σ∈B(A) 1 1 1 is equal to dim(V λ ⟨a| IMλ |d⟩ = dim(V λ ) ⟨a|d⟩ = dim(V λ ) δad if λ = µ and b = c and is equal to 0 A) A A otherwise. This gives the desired equality. To prove this, we observe that by [HR05, Proposition 5.2(b)], applied with M = VAµ , N = VAλ , and ϕ = |b⟩⟨c|, the map Tb,c is a A-module homomorphism, meaning that for every a ∈ A,
Tbc ρµ (a) = ρλ (a)Tbc . We now consider two cases. Case 1: λ ̸= µ.
If λ ̸= µ, Schur’s lemma ([HR05, Proposition 5.3(2)]) states that Tbc = 0.
Case 2: λ = µ. In this case, Schur’s lemma ([HR05, Proposition 5.3(1)]) states that Tbc = α · IV λ A for some α ∈ C. Taking the (linear algebraic) trace of both sides, we have that tr(Tbc ) = α · dim(VAλ ), from which we see that α = tr(Tbc )/ dim(VAλ ). It therefore suffices to compute the trace of Tbc . To compute this, we write X tr(Tbc ) = tr(ρλ (σ) · |b⟩⟨c| · ρλ (σ ∗ )) σ∈B(A)
=
X
tr(|b⟩⟨c| · ρλ (σ ∗ ) · ρλ (σ))
σ∈B(A)
= tr|b⟩⟨c| · ρλ
X
σ∗σ
σ∈B(A)
= tr(|b⟩⟨c|) = δbc , 43
Note that compared with the Schur orthogonality theorem for irrep matrix elements of groups, the second matrix element is transposed rather than complex conjugated. As we mention below in Remark 5.10, this is because for groups, σ ∗ is proportional to its inverse, which of course conjugate-transposes the irrep.
69
where we have invoked the identity
∗ σ∈B(A) σ σ = 1 [HR05, Proof of Theorem 5.8].
P
An alternative proof of Theorem 5.9 also appears in [FND26, Corollary 2.12]. Remark 5.10. Note that this generalizes the Schur orthogonality for groups, which states that X 1 −1 1 X 1 ⟨a| ρλ (g) |b⟩ ⟨c| ρµ δλµ δad δbc ⟨a| ρλ (g) |b⟩ ⟨d| ρµ (g) |c⟩ = g |d⟩ = |G| |G| dim(VAλ ) g∈G g∈B(C[G])
(5.29) 1 −1 since note that whenever A is a group algebra C[G], then we have that, g ∗ = |G| g 1 −1 |G| tr h g = δhg ).
5.8
∀g ∈ G (since
Interpretation of the Commutant EPR projector
Lemma 5.11. Let ρ : G → End(V ) be a representation, and consider the tensor product representation ρ⊗t on V ⊗t . Let At denote a semisimple algebra that is isomorphic to the commutant algebra EndG (V ⊗t ); for any a ∈ At , let S(a) ∈ EndG (V ⊗t ) denote its action. Finally, let Schur be the corresponding generalized Schur transform. Let VAλt and VGλ be the corresponding simple At -modules and G-representations with bases B(VAλt ) and B(VGλ ) implied by the Schur transform. Then, X ΩAt = S(σ) ⊗ S(σ ∗ )T . (5.30) σ∈B(At )
Proof. We calculate X Schur ⊗ Schur S(σ) ⊗ S(σ ∗ )T Schur† ⊗ SchurT
(5.31)
σ∈B(At )
=
X
|λ, µ⟩⟨λ, µ| ⊗
X
ρλ (σ) ⊗ ρµ (σ ∗ )T ⊗ IV λ ⊗ IV µ G
(definition of Schur transform (Definition 3.22)) X |a⟩⟨b| ⊗ |d⟩⟨c| ⊗ IV λ ⊗V µ · ⟨a| ρλ (σ) |b⟩ · ⟨d| ρµ (σ ∗ )T |c⟩
=
X
G
σ∈B(At )
bt λ,µ,∈A
|λ, µ⟩⟨λ, µ| ⊗
X
G
λ ) |a⟩,|b⟩|c⟩,|d⟩,∈B(VA
bt λ,µ,∈A
G
σ∈B(At )
t
P ( a |a⟩⟨a| = I) =
X bt λ,µ,∈A
|λ, µ⟩⟨λ, µ| ⊗
X
|a⟩⟨b| ⊗ |d⟩⟨c| ⊗ IV λ ⊗ IV µ · G
λ ) |a⟩,|b⟩|c⟩,|d⟩,∈B(VA
G
1 δλµ δad δbc dim(Vλ )
t
(Theorem 5.9)
70
=
X bt λ∈A
1 |λ, λ⟩⟨λ, λ| ⊗ λ dim(VAt )
X
=
bt λ∈A λ ) |a⟩,|b⟩∈B(VA
X
|a⟩⟨b| ⊗ |a⟩⟨b| ⊗ IV λ ⊗ IV µ G
G
(5.32)
λ ) |a⟩,|b⟩∈B(VA t
1 |λ, λ⟩⟨λ, λ| ⊗ |a, a⟩⟨b, b| ⊗ IV λ ⊗ IV µ G G dim(VAλt )
(5.33)
t
= Schur ⊗ Schur ΩAt Schur† ⊗ SchurT Example 5.12 (Group Algebra Commutant EPR Projector). In the case of At = C[H] for some 1 finite group H, we have that [h]∗ = |H| [h−1 ] for all h ∈ H (Example 3.18); since S([h−1 ])T = S([h]) for all h, this means that the commutant EPR projector formula simplifies to ΩC[H] =
1 X S([h]) ⊗ S([h]). |H| h∈H
This further simplifies to ΩC[H] =
1 X S([h]) ⊗ S([h]) |H| h∈H
whenever the Schur representation S(·) has real entries, such as in the case of H = St .
5.9
Adaptive Queries to the Update Rule
In this section, we derive an equivalent form for the general update rule in Section 5.1, which we will use for the main argument in Section 7.5. Specifically, we are interested in analyzing (potentially adaptive) quantum query algorithms that have oracle access to one of two different isometries: • The path basis update QPath , or ρ • QPath · C, which applies QPath after first applying a unitary C to the adversary’s query register. ρ ρ We will use A, B, and R to denote the query, workspace, and database registers as defined in Definition 3.5. We will also subdivide R as R = (R0 , R1 = (RX,1 , RY,1 ), R2 = (RX,2 , RY,2 ), . . . , Rt = (RX,t , RY,t ))
(5.34)
where Ri denotes the register to which the update operator adds the ith query, and RX,i and RY,i denote the registers for recording the input and output for the i’th query. We also write RX := (RX,1 , RX,2 , . . . RX,t ) and RY := (RY,1 , RY,2 , . . . RY,t ). We will also use R0 to denote register containing the initial database, before making any queries (which we will assume to be properly formatted as a list of pairs of registers like the rest of R). Most often, we will take R0 to be the 0 empty (0 qubit) register (with associated Hilbert space C2 = C). We write such an empty register as |∅⟩R . However it can be non-empty if, for example, we are not starting with a clean slate and a previous algorithm has already made queries. We will also write R≤i := (R0 , R1 , . . . , Ri ). We will use Ai to denote the commutant algebra of the k’th tensor product of the group representation, where k = |R≤i | = i + |R0 | (the size of R0 being the number of pairs in the initial database). When the database is empty, then this is the commutant algebra of the trivial representation of the group, which is simply the one-dimensional algebra C.
71
Notation for the Update Rule. We will frequently drop the subscript t from the Schur transform Schurt when the tensor power is unambiguous. For ease of working with the update rule from Section 5.1, we will write it in terms of the following operators: Let Πλ,i := Schur† |λ⟩⟨λ| ⊗ IV λ ⊗ IV λ Schur ⊗ IV ⊗t , (5.35) Ai G s dim(VAλi ) −1 := := Λλ,i := βλ,i Πλ,i , Λ+ β Π , where β , (5.36) λ,i λ,i λ,i λ,i dim(VGλ ) X X := ΛAi := Λλ,i , Λ+ Λ+ (5.37) Ai λ,i bi λ∈A
bi λ∈A
ΩAi := Schur ⊗ Schur
†
T
X
bi λ∈A λ ) |a⟩,|b⟩∈B(VA
1 ⊗2 |λ, λ⟩⟨λ, λ| ⊗ |a, a⟩⟨b, b| ⊗ IV λ Schur ⊗ Schur λ G dim(VAi )
i
(5.38) =
X
S(σ) ⊗ S(σ ∗ )T .
(by Lemma 5.11, where S is the Schur representation)
σ∈B(Ai )
AppA Ri :=
X
(|y⟩⟨x|)A ⊗ |x, y⟩Ri
(5.39)
x,y∈[N ]
When the database register is of size i − 1, we can write the path recording update rule (Remark 5.2), when restricted to input databases in Im(ΩAi−1 ), as + QPath = V := Λ Ω App Λ (5.40) Ai Ai ρ Ai−1 R≤i
R≤i
A Ri
R≤i−1
Rewriting the Update Operator for Adaptive Queries. Lemma 5.13 (Telescoping product of irrep ratio reweighting). Let V be the isometry defined in Eq. (5.40), and define the reduced update operator (which without the rescaling is not an isometry) to be Ve := ΩAi App (5.41) R≤i ARi X = |yi ⟩⟨xi |A ⊗ ΩAi IR<i ⊗ |xi , yi ⟩Ri . (5.42) xi ,yi ∈[N ]
whenever the database register R is of size i − 1. Let Advt be any t-query algorithm with workspace register A, ancilla register B, and that makes queries to the update rule V on workspace register A and database register R. Then e AdvVt = ΛAt AdvVt Λ+ (5.43) A0 R≤t
R0
In other words, if we make t queries to the path recording oracle, then this is the same as if we were to apply the path recording update rule without the reweighting, and then apply a reweighting just once at the end.44 44
As described in Remark 5.19, when beginning with an empty database, the first reweighting operator always occurs on the one-dimensional irreps corresponding to |λ| = 0, and is thus just the identity operator.
72
Proof. Let (A1 )AB , . . . , (At )AB be the unitaries that Adv applies in between queries. We can write AdvVt =
=
(5.44)
t Y
(VAR · Ai AB ) i=1 t Y ΛAi
R≤i
i=1
=
t Y
ΩAi
bi λ+ ∈A
ARi
βλ+ ,i Πλ+ ,i i
i
i=1 λ1 ,...,λt + λ+ 1 ,...,λt bi−1 , λ+ ∈A bi λi ∈ A i
X
=
βλ+ ,t
t Y
t
=
ΩAi
Λ+ Ai−1
R≤i
ΩAi
βλ−1 Πλi+1 ,i i+1 ,i
R≤i−1
Ai AB
(by the definition of V )
−1 βλ,i−1 Πλ,i−1
Ai AB
X ARi
t Y
i=1 λ1 ,...,λt + λ+ 1 ,...,λt bi−1 , λ+ ∈A bi λi ∈A
R≤i
App
R≤i
R≤i
i=1
λ1 ,...,λt + λ+ 1 ,...,λt + b b λi ∈Ai−1 , λi ∈Ai
X
bi−1 λ∈A
R≤i t Y
X
App
R≤i
X βλ+ ,i Πλ+ ,i
i=1
=
(5.45)
App
ARi
βλ+ ,i Πλ+ ,i i
R≤i−1
(by the definition of ΛAi ) −1 βλi ,i−1 Πλi ,i−1 Ai AB (5.46) R≤i−1
R≤i
i
ΩAi
R≤i
App
ARi
Ai AB
βλ−1 Πλ1 ,0 1 ,0
(by moving each βλ−1 Πλi ,i−1 to the previous factor in the product45 ) i ,i−1 ! βλ+ ,i βλ+ ,t i Πλi+1 ,i R Πλ+ ,i ΩAi Ai AB (Πλ1 ,0 )R0 t App ≤i i βλi+1 ,i βλ1 ,0 R≤i R≤i ARi
i
(5.47) t Y
X
=
i=1 λ1 ,...,λt + λ+ 1 ,...,λt bi−1 , λ+ ∈A bi λi ∈A
βλ+ ,i i
βλi+1 ,i
δλi+1 , λ+ Πλ+ ,i i
i
R≤i
ΩAi
R≤i
App
!
ARi
Ai AB
(Πλ1 ,0 )R0
βλ+ ,t t
βλ1 ,0
i
since Πλi+1 Πλ+ = δλi+1 ,λ+ Πλ+ i
t Y
X
=
Πλ+ ,i i
+ i=1 λ1 ,λ+ 1 ,...,λt + b0 , λ ∈A bi λ1 ∈ A i
t Y X = Πλ+ ,i i i=1
b λ+ i ∈Ai
=
b λ+ t ∈At
R≤i
ΩAi
R≤i
App
i
βλ+ ,t Ai AB (Πλ1 ,0 )R0 t βλ1 ,0 ARi
i
(5.48)
ΩAi
R≤i
t Y
βλ+ ,t Πλ+ ,t t
X App Ai AB Πλ1 ,0 ARi
b0 λ1 ∈ A
R≤i
X
t
R≤t
i=1
ΩAi
R≤i
(Using that
App
P
ARi
t
(5.49)
βλ1 ,0
R0
Ai AB
βλ+ ,t
X b0 λ1 ∈A
βλ−1 Πλ1 ,0 1 ,0 R0
λ Πλ = I in all except the last factor of the product)
73
R0
= ΛAt
AdvVt
e
R≤t
Λ+ A0
(by the definitions of ΛAi , Ve )
R0
Lemma 5.14. The same holds for queries to V · C for any unitary C ∈ U (N ) acting on the A register. That is, e AdvVt ·C = ΛAt AdvVt ·C Λ+ . (5.50) A0 R≤t
R0
The proof is the same as that of Lemma 5.13 above, but where each Ai AB has an extra C attached to the left. Lemma 5.15 (Ricochet Property of the Append Operator). For any N -dimensional unitary C ∈ U (N ), AppA Ri · CA = CRX,i · AppA Ri (5.51) Proof. AppA Ri · CA =
X
|y⟩⟨x|A CA ⊗ |x, y⟩Ri
(Definition of AppA Ri )
x,y∈[N ]
X
=
|y⟩A ⟨x|C|z⟩ ⟨z|A ⊗ |x, y⟩Ri
(
P
z |z⟩⟨z| = I)
x,y,z∈[N ]
=
X
|y⟩⟨z|A ⊗
y,z∈[N ]
=
X
|y⟩⟨z|A ⊗
X
⟨x|C|z⟩ |x, y⟩Ri
(5.52)
|x⟩RX,i ⟨x|C|z⟩ |y⟩RY,i
(5.53)
x∈[N ]
y,z∈[N ]
=
X X x∈[N ]
|y⟩⟨z|A ⊗ C |z⟩RX,i ⊗ |y⟩RY,i
(
P
x |x⟩⟨x| = I)
y,z∈[N ]
= CRX,i · AppA Ri Lemma 5.16 (Alternate Form of AdvVt ·C ). e
e AdvVt ·C =
t Y
! (ΩAi )R≤i
· C ⊗t R · AdvApp t X
(5.54)
i=1
In other words, the following process is identical to querying Ve · C: during each query, only the App operator is applied. Then, after all queries have been made, C ⊗t is applied to RX , the input half of the database in the oracle register, and then for every i ∈ [t], ΩAi is applied to the first i registers of R. Proof. AdvVt ·C = e
t Y
VeA R · CA · Ai AB
(5.55)
i=1
=
t Y
(ΩAi )R≤i · AppA Ri ·CA · Ai AB
i=1 45
For convenience of not having to write the last t’th factor separately, we take λt+1 := λ+ t .
74
(Definition of Ve )
=
t Y
(ΩAi )R≤i · CRX,i · AppA Ri ·Ai AB
(Lemma 5.15)
i=1
Next, notice that for all j < i, AppA Ri ·Ai AB commutes with both CRX,j and ΩAj R , since the ≤j former acts only on the A, B, and Ri registers, while both of the latter operators act only on (R1 . . . Rj ). Therefore, we can commute them all past: =
=
t Y
t Y (ΩAi )R≤i · CRX,i · AppA Ri ·Ai AB
i=1
i=1
t Y
t Y
! (ΩAi )R≤i
·
! CRX,i
·
t Y
AppA Ri ·Ai AB
(5.56)
i=1
=
i=1 i=1 (CRX,i similarly commutes with ΩAj R , for all j < i) ≤j ! t Y (ΩAi )R≤i · C ⊗t · AdvApp t RX
i=1
Lemma 5.17. t Y
(ΩAk )R≤k = ΩAt
(5.57)
k=1
Proof. For each k, write Sk : Ak → End(V ⊗k ) for the Schur representation action of Ak on the first k path registers. When k ≤ t, we view ΩAk as an operator on R≤t by tensoring with I on the later registers Rk+1 , . . . , Rt . We first recall the subspace onto which ΩAk projects. Namely, ΩAk is the orthogonal projector onto the subspace of states |ψ⟩ satisfying Sk (a) X |ψ⟩ = Sk (a)T Y |ψ⟩ ∀a ∈ Ak . ≤k
≤k
Here the X≤k registers are identified with V ⊗k , whereas the Y≤k registers are identified with V using the conjugate basis labeled by the same basis elements. ⊗k To see the characterization, pass to the double Schur basis for V ⊗k ⊗ V . In this basis, ⊗k ∼ M V ⊗k ⊗ V VGλ ⊗ VAλk ⊗ VGµ ⊗ VAµk . =
⊗k
,
λ,µ
The algebra Ak acts on the X half by Sk (a) =
M
IV λ ⊗ ρλ (a), G
λ
and the transposed action on the Y half is Sk (a)T =
M
IV µ ⊗ ρµ (a)T . G
µ
Taking a to be central idempotents of Ak first forces any state satisfying the displayed relations to have support only on the (λ, λ) blocks. On such a block, after treating the two G-registers as spectators, the relations become ρλ (a) ⊗ I |ψλ,λ ⟩ = I ⊗ ρλ (a)T |ψλ,λ ⟩ ∀a ∈ Ak . 75
Since ρλ (Ak ) = End(VAλk ), this is equivalent to (M ⊗ I) |ψλ,λ ⟩ = (I ⊗ M T ) |ψλ,λ ⟩
∀M ∈ End(VAλk ).
The solutions are precisely arbitrary states on the two G-registers tensored with the EPR state on the two commutant registers, E X 1 |T ⟩ ⊗ |T ⟩ , EPRλAk := q dim(VAλk ) T ∈B(V λ ) Ak
where the second |T ⟩ denotes the corresponding conjugate-basis vector in VAλk . This is exactly the image of ΩAk by definition. The lemma now follows from the fact that the ΩAk are all orthogonal projectors onto subspaces that form a linear chain. This is because the commutant algebras satisfy S(Ak ) ⊂ S(At ) for all k ≤ t, so the constraints Sk (a) X |ψ⟩ = Sk (a)T Y |ψ⟩ ∀a ∈ Ak ≤k
≤k
are contained within the corresponding set of constraints for At . This implies that ΩAt ΩAk = ΩAt for all k ≤ t, which proves the lemma. Combining Lemmas 5.14, 5.16 and 5.17, we obtain an equivalent expanded form for an adversary querying V · C: Corollary 5.18. AdvVt ·C =
|
ΛAt
{z
R≤t
· ΩAt
} |
ReweightEnd
{z
R≤t
· C ⊗t
} |
Symmetrize
{z
C ⊗t
RX
· AdvApp · t
} | {z } Append
|
Λ+ A0
{z
R0
(5.58)
}
ReweightStart
Both reweighting steps, as well as the Symmetrize step, depend on the group G (in particular, they depend on the commutant algebra of its tensor power representation), while C ⊗t and Append are independent of the group and its representation. When we start with R0 containing the empty database, this simplifies further, since initial reweighting step disappears: Remark 5.19. When R contains the empty database, |∅⟩, then Λ+ A0 |∅⟩R = |∅⟩R . Proof. Since the database register R is empty, it corresponds to the 1-dimensional space (CN )⊗0 = C, on which G acts via the trivial irrep (ρ⊗0 = 1), and its commutant A0 = C is a simple module (its only irrep is the one that acts via scalar multiplication). Since the irreps are both 1-dimensional, the ratio βλ is 1, and the rescaling has no effect.
76
6
Approximation and Specialization to Specific Groups
Our general update rule can recover an interpretable recording oracle for any group representation. To demonstrate its generality, in this section, we show how it recovers existing recording oracles, including Zhandry’s original recording oracle for functions [Zha19] and Ma and Huang’s pathrecording oracle [MH25] for unitaries as special cases. For the latter, since the path recording oracle of [MH25] is only approximate, we describe two explicit approximations that relate our path-recording oracle to theirs. We also analyze the unitary Haar cipher model, in which unitaries U1 , . . . ,P UK are each chosen i.i.d. from the Haar measure on U (N ) and queried in a controlled manner as k∈[K] |k⟩⟨k| ⊗ Uk .
6.1
The Unitary Path-Recording Oracle of [MH25]
We will use the following lemma from [MH25]: Lemma 6.1 ([MH25, Lemma 2.2]). Let ρST be a density matrix on registers S, T and let ΠT be a projector that acts on register T. Then ∥TrT (ρST ) − TrT (ΠT ρST ΠT )∥1 = 1 − Tr(ΠT ρST ). 6.1.1
(6.1)
The Distinct Subspace
Definition 6.2. For 1 ≤ t ≤ N , define [N ]tdist := {(x1 , . . . , xt ) ∈ [N ]t : all xi ’s distinct}
(6.2)
as the set of all distinct ordered t-tuples over [N ]. Definition 6.3. The distinct subspace DistN,t ⊆ (CN )⊗t is defined as the span of all distinct strings, i.e. DistN,t := span{|x⟩ : x ∈ [N ]tdist } (6.3) 6.1.2
The [MH25] oracle
The [MH25] path-recording oracle acts on an adversary input register A and recording register RM H whose basis consists of sets of input-output pairs {(x1 , y1 ), . . . , (xt , yt )} with the property that (y1 , . . . , yt ) are distinct. To compare this with our compressed oracle, we consider the following simple isometry mapping RM H to our recording space R: √ 1 X |{(x1 , y1 ), . . . , (xt , yt )}⟩ 7→ √ xπ−1 (1) , . . . , xπ−1 (t) , yπ−1 (1) , . . . , yπ−1 (t) = t!·ΩSt |x1 , . . . , xt , y1 , . . . , yt ⟩ . t! π∈St Via this isometry, we identify the Ma-Huang path recording update with the following update rule √ X t |yt ⟩A ⊗ |x1 , . . . , xt , y1 , . . . , yt ⟩ |xt ⟩A ⊗ |x1 , . . . , xt−1 , y1 , . . . , yt−1 ⟩ 7→ ΩSt · √ N − t + 1 y ∈{y / ,...,y } t
t−1
(6.4)
√
=√
1
t · ΩSt · ΠDist AppAR . R RY N −t+1
(6.5)
Thus, the statement that the Ma-Huang oracle is indistinguishable from our oracle amounts to two informal statements: 77
• The application of ΠDist is approximately the identity map, and • The overall effect of inverse subspace reweighting Λ+ St−1 and reweighting ΛSt is approximately q t constant, with a scalar factor of N −t+1 . Next, we will give a formal justification for the approximate equivalence of VM H and VU (N ) for t-query quantum algorithms. 6.1.3
Proof of approximate equivalence
Using the fact that (ΠDist )RY,≤t commutes with ΩSt , we can then express the isometry implemented by a t-query adaptive adversary AdvVM H as t √ Y √ t!
1 · ΠDist · ΩSt · AdvApp t R RY N −i+1 i=1 1 · ΩSt · AdvApp . = q · ΠDist t RY R N
AdvVt M H =
(6.6) (6.7)
t
On the other hand, our own path-recording oracle implements V Advt U (N ) = ΛSt · ΩSt · AdvApp · Λ+ t S0 R R R0 App = ΛSt · ΩSt · Advt . R
(6.8) (6.9)
R
To compare these, define the quantum states E AdvVt M H = AdvVt M H |0⟩AB |∅⟩R ,
E V V Advt U (N ) = Advt U (N ) |0⟩AB |∅⟩R .
We wish to derive the fact that h ED i h ED i V V TrR AdvVt M H AdvVt M H − TrR Advt U (N ) Advt U (N )
2 t ≤O N 1
We prove this via the following sequence of steps. First, we show that 2 E 2 t VU (N ) ≥1−O (ΠDist )RY Advt . N
(6.10)
(6.11)
(6.12)
Then, by Lemma 6.1, we have that ≤O
2 t (6.13) N
2 t ≤O N 1
(6.14)
i h ED i h ED V V V V TrR (ΠDist )RY Advt U (N ) Advt U (N ) (ΠDist )RY − TrR Advt U (N ) Advt U (N )
1
Finally, we prove that (ΠDist )RY
V Advt U (N )
ED
V Advt U (N )
(ΠDist )RY −
78
AdvVt M H
ED
AdvVt M H
For the remainder of this subsection, write ΠYDist := ΠDistN,t R ,
ΠYDist,t−1 := ΠDistN,t−1 R
Y
Y,<t
,
αt := q
1 N t
.
We also abbreviate the append-only state by |ψt ⟩ := AdvApp |0⟩AB |∅⟩R . t With this notation, Eq. (6.6) says AdvVt M H
E
= αt · ΠYDist · ΩSt |ψt ⟩ .
while Eq. (6.9) says E V Advt U (N ) = ΛSt · ΩSt |ψt ⟩ . Lemma 6.4 (Analyzing ΠYDist |ψt ⟩). For every non-identity π ∈ St , ⟨ψt | ΠYDist S(π) ⊗ S(π) ΠYDist |ψt ⟩ = 0. Moreover, N . t
⟨ψt | ΠYDist |ψt ⟩ = t! Consequently, 2 ΩSt ΠYDist |ψt ⟩ =
N 1 = 2. t αt
Proof. We prove the first two claims by induction on t. The case t = 1 is trivial (there are no non-identity permutations and ΠYDist = I). For the inductive step, we write |ψt ⟩ = AppARt · (At )AB · |ψ⟩t−1 = AppARt |ψtpre ⟩ . Moreover, since ΠYDist = ΠYDist · ΠYDist,t−1 and ΠYDist,t−1 commutes with AppARt , we have that ΠYDist |ψt ⟩ = ΠYDist · AppARt · ΠYDist,t−1 |ψtpre ⟩ . We now write explicitly in the standard basis X ΠYDist,t−1 |ψtpre ⟩ = |xt ⟩A ϕx1:t ,y1:t−1 B |x1 , . . . xt−1 , y1 , . . . , yt−1 ⟩R<t . x1 ,...,xt distinct y1 ,...,yt−1
On this state, the effect of ΠYDist · AppARt is appending with respect to an (unnormalized) EPR state over yt ∈ / {y1 , . . . , yt−1 } (controlled on {y1 , . . . , yt−1 }), which tells us that X ΠYDist |ψt ⟩ = |yt ⟩A ϕx1:t ,y1:t−1 B |x1 , . . . xt , y1 , . . . , yt ⟩R≤t . x1 ,...,xt distinct y1 ,...,yt
Given that ΠYDist,t−1 also commutes with (At )AB , this immediately tells us that ΠYDist |ψt ⟩
2
= (N − t + 1) ΠYDist,t−1 |ψt−1 ⟩ 79
2
,
completing the second part of the induction. For the first part, we have that X |yt ⟩A ϕx1:t ,y1:t−1 B xπ−1 (1) , . . . xπ−1 (t) , yπ−1 (1) , . . . , yπ−1 (t) R S(π)⊗S(π) ΠYDist |ψt ⟩ =
≤t
x1 ,...,xt distinct y1 ,...,yt
.
Now, suppose that π(t) ̸= t. Then, the inner product of these two states is zero because a nonzero term in the expansion of this inner product would require terms yt = yt′ on the A register but also yt = yπ′ −1 (t) on the RY,t register. On the other hand, suppose that π(t) = t and identify π as a non-identity element of St−1 ; in particular, S(π) commutes with AppARt · (At )AB . Then, we write ⟨ψt | ΠYDist S(π)⊗S(π) ΠYDist |ψt ⟩ = ⟨ψtpre | ΠYDist,t−1 App†A,Rt ΠYDist AppA,Rt ΠYDist,t−1 S(π)⊗S(π) |ψtpre ⟩ Next, we make use of the identity ΠYDist,t−1 App†A,Rt ΠYDist AppA,Rt ΠYDist,t−1 = (N − t + 1)ΠYDist,t−1 , which again holds because the effect of ΠYDist AppA,Rt on the image of ΠYDist,t−1 is to append an un-normalized EPR state over yt ∈ / {y1 , . . . , yt−1 }: X ΠYDist AppA,Rt ΠYDist,t−1 = |yt ⟩⟨xt |A ⊗ |x1 , . . . , xt , y1 , . . . , yt ⟩⟨x1 , . . . , xt−1 , y1 , . . . , yt−1 | . x1 ,...xt distinct y1 ,...,yt
The claimed identity follows from this by a direct computation. We conclude that ⟨ψt | ΠYDist S(π) ⊗ S(π) ΠYDist |ψt ⟩ = (N − t + 1) ⟨ψtpre | ΠYDist,t−1 S(π) ⊗ S(π) |ψtpre ⟩ = (N − t + 1) ⟨ψt−1 | ΠYDist,t−1 (A†t )AB S(π) ⊗ S(π) (At )AB ΠYDist,t−1 |ψt−1 ⟩ = (N − t + 1) ⟨ψt−1 | ΠYDist,t−1 S(π) ⊗ S(π) ΠYDist,t−1 |ψt−1 ⟩ . This completes the induction. Finally, using ΩSt =
1 X S(π) ⊗ S(π), t! π∈St
the cross terms below vanish and so 1 2 ΩSt ΠYDist |ψt ⟩ =
t!
2 ΠYDist |ψt ⟩ =
N . t
Lemma 6.5 (Reweighting is approximately scalar). Assume t2 = O(N ). Then 2 t . ∥ΛSt − αt I∥ ≤ αt · O N Equivalently, αt2
2 2 t t † 2 1−O I ⪯ ΛSt ΛSt ⪯ αt 1 + O I. N N 80
(6.15)
Proof. We equivalently calculate Nt X 2 Nt † βλ,t Πλ,t − I Λ ΛS − I = t! St t t!
(6.16)
bt λ∈S
=
X
Nt 2 β − 1 Πλ,t t! λ,t
(6.17)
bt λ∈S
Nt 2 βλ,t − 1 bt t! λ∈S 2 t ≤O . N ≤ max
(6.18) (Lemma 3.32)
Lemma 6.6 (The exact unitary recording is almost distinct on RY ). 2 E 2 t V ΠYDist Advt U (N ) ≥1−O . N Proof. We have that E V ΠYDist Advt U (N ) = ΛSt ΩSt ΠYDist |ψt ⟩ . By Lemma 6.5, Λ†St ΛSt ⪰ αt2
2 t 1−O I, N
and by Lemma 6.4, ΩSt ΠYDist |ψt ⟩
2
=
1 . αt2
Together, these prove the lemma. Theorem 6.7. For any t-query adversary with t2 = O(N ), ED ED V V AdvVt M H AdvVt M H − ΠYDist Advt U (N ) Advt U (N ) ΠYDist
2 t . ≤O N 1
Proof. We write E E V ΠYDist Advt U (N ) − AdvVt M H = (ΛSt − αt I) ΩSt ΠYDist |ψt ⟩ . By Lemmas 6.4 and 6.5, ΠYDist
V Advt U (N )
E
−
AdvVt M H
E
2 2 t 1 t ≤ αt · O · =O . N αt N
Therefore, AdvVt M H
ED
V
AdvVt M H − ΠYDist Advt U (N ) E E V ≤2 · ΠYDist Advt U (N ) − AdvVt M H 2 t ≤O . N
81
ED
V
Advt U (N ) ΠYDist
1
(6.19) (6.20) (6.21)
This completes the full comparison between the [MH25] path-recording oracle and our exact unitary path recording oracle.
6.2
The Unitary Haar Cipher
We now consider the case of the unitary Haar cipher, which consists of a collection of keyed unitaries U1 , . . . , UK , each sampled independently from the Haar measure on U (N ). The group is therefore G = U (N )K , and the representation is its block-diagonal embedding: X ρ(U1 , . . . , UK ) = |k⟩⟨k| ⊗ Uk . (6.22) k∈[K]
This is the idealization of a pseudorandom unitary, in which the unitary for each key is chosen independently from the Haar measure. As the reader might rightfully guess, we can get a recording oracle for the unitary Haar cipher by simply maintaining K different recordings of each of the K underlying unitaries. And in fact, we can compress it to size that grows only with the number of queries by only explicitly recording the keys whose individual recording has a non-zero number of entries. This is in fact the correct intuition, and for practical purposes, it might suffice to stop there. But the beauty of our framework is that it eliminates the guesswork. We can in fact just blindly take the representation above and plug it into our framework to recover this outcome. For this, we must first consider the commutant algebra of the tensor power of the representation in Equation (6.22). It turns out to be the Schur representation of the diagram algebra that comes out of the wreath product ZK ≀ St of the cyclic group mod K and the symmetric group. Definition 6.8. The K-colored permutation group is the wreath product ZK ≀ St . That is, it is the group whose group elements (f, π) ∈ ZK ≀ St are parameterized by • a “function” f ∈ ZtK (we often write group elements of ZtK as functions f : [t] → ZK , or as vectors f⃗ = (f (1), . . . , f (t))), and • a permutation π ∈ St , with a group operation that is given by entry-wise addition in ZtK , composing permutations in St , and permuting a function f ∈ ZtK by a permutation π ∈ St whenever they commute past each other. Specifically, ZK ≀ St = (f, π) f ∈ ZtK , π ∈ St , (f1 , π1 ) · (f2 , π2 ) = f1 + π1 (f2 ), π1 ◦ π2 (6.23) This group is also often called • the K-phased permutation group, since the ZK can be viewed as phases that come from K’th roots of unity, • the monomial unitary group with modulus K, or • the complex reflection group G(K, 1, t). When specializing to K = 2, it is also known as the hyperoctahedral group. Note that when it is clear from context we will often write the group elements (f, eSt ) and (eZtK , π) more simply as f and π, respectively,46 so that we can write any group element (f, π) as a product f π, or equivalently, as π f ′ , for f ′ = π −1 (f ). 46
eSt and eZt are the identity elements of the respective groups. K
82
The defining representation of the colored permutation group is often taken to be as permutation matrices with nonzero entries taken from the K’th roots of unity. We can also view group elements as colored permutation diagrams, where each strand has an attached “color” in ZK :
(6.24) f1
f2
f3
f4
f5
f6
Figure 16: Colored permutation diagram on 6 elements with colors f1 , . . . , f6 ∈ ZK attached to the strands.
Diagram multiplication occurs by concatenation of the underlying permutations and summing (mod K) the colors along each merged strand. We will be interested here in the Schur representation of ZK ≀ St on (CKN )⊗t , which generalizes fi k i the Schur representation of St (Definition 3.16) by adding a phase of ωK whenever a register containing |ki , xi ⟩ passes through a strand with color fi . For example, S
f1
f2
f3
f5
f4
f6
X f k +···+f k E 6 6 (k ,x ),(k ,x ),(k ,x ),(k ,x ),(k ,x ),(k ,x ) = 2 2 4 4 6 6 1 1 5 5 3 3 . (6.25) ωK1 1 D ⃗k∈[K]6 ⃗ x∈[N ]6
(k1 ,x1 ),(k2 ,x2 ),(k3 ,x3 ),(k4 ,x4 ),(k5 ,x5 ),(k6 ,x6 )
Formally, X f⃗ · ⃗k S π f := (kπ−1 (1) , xπ−1 (1) ), . . . , (kπ−1 (t) , xπ−1 (t) ) (k1 , x1 ), . . . , (kt , xt ) ωK
(6.26)
⃗k∈[K]t ⃗ x∈[N ]t
The colored permutation algebra is the group algebra C[ZK ≀ St ], which is the diagram algebra spanned by colored permutation diagrams. ⃗ )⊗t (see Equation (6.22)) is the Schur representation of the Lemma 6.9. The commutant of ρ(U colored permutation algebra C[ZK ≀ St ]. ⃗ )⊗t . Proof. First, we show that S(π f ) commutes with ρ(U ⃗ )⊗t = S(π) S(f ) ρ(U ⃗ )⊗t S(π f ) ρ(U X f⃗ · ⃗k X = S(π) ωK |⃗k⟩⟨⃗k| ⊗ I |⃗k⟩⟨⃗k| ⊗ Uk1 ⊗ · · · ⊗ Ukt ⃗k∈[K]t
(6.28)
⃗k∈[K]t
= S(π)
(6.27)
X
⃗ ⃗
f ·k ⃗ ⃗ ωK |k⟩⟨k| ⊗ Uk1 ⊗ · · · ⊗ Ukt
(6.29)
⃗k∈[K]t
= S(π)
X
|⃗k⟩⟨⃗k| ⊗ Uk1 ⊗ · · · ⊗ Ukt
⃗k∈[K]t
X
⃗k∈[K]t
83
f⃗ · ⃗k ⃗ ⃗ ωK |k⟩⟨k| ⊗ I
(6.30)
⃗ )⊗t S(f ) = S(π) ρ(U ⃗ )⊗t S(π) S(f ) = ρ(U
(6.31) (6.32)
This shows that C[ZK ≀ St ] is contained in the commutant. ⃗ )⊗t must have the form It now remains to prove that every operator that commutes with ρ(U S(a) for some a ∈ C[ZK ≀ St ]. Let T ∈ End((CKN )⊗t ) be a generic operator on this space, and let’s ⃗ )⊗t for all tuples of unitaries U ⃗ ∈ U (N )K . We first write T in terms say that it commutes with ρ(U of its blocks as X T = |⃗ p⟩⟨⃗q| ⊗ Tp⃗,⃗q (6.33) p ⃗, q⃗∈[K]t
where the |⃗ p⟩⟨⃗q| acts on all the control (or key) registers, and each Tp⃗,⃗q ∈ End((CN )⊗t ) acts on the rest of the registers (where each of the unitaries Uki acts). ⃗ , we have [ρ(U ⃗ )⊗t , T ] = ρ(U ⃗ )⊗t T − T ρ(U ⃗ )⊗t = 0. For brevity, we write We know that for all U U⃗k := Uk1 ⊗ · · · ⊗ Ukt . The commutator is then ⃗ )⊗t T − T ρ(U ⃗ )⊗t ρ(U (6.34) X X X X = |⃗k⟩⟨⃗k| ⊗ U⃗k |⃗ p⟩⟨⃗q| ⊗ Tp⃗,⃗q − |⃗ p⟩⟨⃗q| ⊗ Tp⃗,⃗q |⃗k⟩⟨⃗k| ⊗ U⃗k p ⃗, q⃗∈[K]t
⃗k∈[K]t
p ⃗, q⃗∈[K]t
⃗k∈[K]t
(6.35) =
X
= =
X
|⃗ p⟩⟨⃗q| ⊗ Up⃗ · Tp⃗,⃗q −
p ⃗, q⃗∈[K]t
X
|⃗ p⟩⟨⃗q| · |⃗k⟩⟨⃗k| ⊗ Tp⃗,⃗q · U⃗k
(6.36)
⃗k, p ⃗, q⃗∈[K]t
X
|⃗k⟩⟨⃗k| · |⃗ p⟩⟨⃗q| ⊗ U⃗k · Tp⃗,⃗q −
⃗k, p ⃗, q⃗∈[K]t
X
|⃗ p⟩⟨⃗q| ⊗ Tp⃗,⃗q · Uq⃗
(6.37)
p ⃗, q⃗∈[K]t
|⃗ p⟩⟨⃗q| ⊗ Up⃗ · Tp⃗,⃗q − Tp⃗,⃗q · Uq⃗ .
(6.38)
p ⃗, q⃗∈[K]t
Now, if this operator is 0, then it must be 0 on each block. That is, for every p⃗, ⃗q ∈ [K]t (and every ⃗ ), we have that Up⃗ · Tp⃗,⃗q − Tp⃗,⃗q · Uq⃗ = 0. U ⃗ ∈ U (N )K , it must also hold for the case where each unitary is simply Since this holds for all U i θ k Uk = e I. In this case, we have that P
P
Up⃗ · Tp⃗,⃗q − Tp⃗,⃗q · Uq⃗ = ei j∈[t] θpj Tp⃗,⃗q − ei j∈[t] θqj Tp⃗,⃗q P P = ei j∈[t] θpj − ei j∈[t] θqj Tp⃗,⃗q .
(6.39) (6.40)
Therefore, Tp⃗, q⃗ must be 0 unless p⃗ is a permutation of ⃗q (that is, they have the same entries in a different order). It must also hold when all the unitaries are identical (that is Uk = U for all k). In this case, we have Up⃗ · Tp⃗,⃗q − Tp⃗,⃗q · Uq⃗ = U ⊗t · Tp⃗,⃗q − Tp⃗,⃗q · U ⊗t , and thus from classical Schur-Weyl duality, we P know that the blocks of T must be in the span of the permutations: Tp⃗,⃗q = π∈St cpπ⃗,⃗q S(π), for some coefficients cpπ⃗,⃗q.
84
Now for the full group U (N )K , we have that X Up⃗ · Tp⃗,⃗q − Tp⃗,⃗q · Uq⃗ = cpπ⃗,⃗q Up⃗ · S(π) − S(π) · Uq⃗
(6.41)
π∈St
X
=
cpπ⃗,⃗q S(π) · Uπ−1 (⃗p) − S(π) · Uq⃗
(6.42)
π∈St
X
=
cpπ⃗,⃗q S(π) Uπ−1 (⃗p) − Uq⃗ .
(6.43)
π∈St
since the S(π) operators are linearly independent, it must hold that for all π ∈ St , cpπ⃗,⃗q Uπ−1 (⃗p) − Uq⃗ = 0. So cpπ⃗,⃗q = 0 unless p⃗ = π(⃗q). We thus have that X
T =
q ),⃗ q cπ(⃗ |π(⃗q)⟩⟨⃗q| ⊗ S(π) π
(6.44)
q ),⃗ q cπ(⃗ S(π) (|⃗q⟩⟨⃗q| ⊗ I) , π
(6.45)
q⃗∈[K]t π∈St
X
=
q⃗∈[K]t π∈St
where in the first line, S(π) acts on only the second register, while in the second line S(π) acts on both registers together. Thus, T is in the span of operators of the form Mπ,⃗q := S(π) (|⃗q⟩⟨⃗q| ⊗ I). It thus remains to show that Mπ,⃗q is in the span of S(πf ) for (π, f ) ∈ ZK ≀ St . To this end, observe that X X 1 −f⃗·⃗ q f⃗·⃗ r |⃗q⟩⟨⃗q| ⊗ I = t ωK ωK |⃗r⟩⟨⃗r| ⊗ I (6.46) K t t f⃗∈ZK
⃗ r∈ZK
1 X −f⃗·⃗q ωK S(f ) . = t K t
(6.47)
f⃗∈ZK
Thus T is in the span of S(πf ), which completes the proof. Lemma 6.10. The irreps of both the group G = U (N )K and the commutant algebra C[ZK ≀ St ] are (1) , λ(2) , . . . , λ(K) , where each λ(i) ∈ S \ bt ∩ U parameterized by K-tuples of Young diagrams, λ (N ), i P and i∈[K] ti = t. Furthermore, the dimensions of the irreps are as follows: Since the group U (N )K is a direct product, its irreps are also direct products of irreps of U (N ), and so the dimension of an irrep ⃗λ := λ(1) , λ(2) , . . . , λ(K) is the product of the individual dimensions (i) Y ⃗ dim VUλ(N )K = dim VUλ(N ) . (6.48) i∈[K]
Similarly, the dimension of the corresponding irrep of ZK ≀ St is [Str24, Mac98] ⃗ dim VZλK ≀St = Q
t!
Y
i∈[K] (ti !) i∈[K]
(i) =Q dim VSλt i
85
t!
Y
i∈[K] (ti !) i∈[K]
fλ
(i)
.
(6.49)
Therefore, the irrep ratios are (i) ⃗ dim VZλK ≀St dim VSλt Y t! i =Q (i) ⃗λ i∈[K] (ti !) i∈[K] dim V λ dim VU (N )K U (N ) 2 Y ti ! ti t! 1 ± O =Q ti N N (t !) i∈[K] i i∈[K] 2 t! t = t 1±O N N
(6.50)
(Lemma 3.32)
(
2 i ti ≤ (
P
2 2 i ti ) = t )
P
Note that since the colored permutation algebra is a group algebra, its dual basis (Example 3.18) is proportional to the inverse of each group element: [π f ]∗ = 6.2.1
1 [f −1 π −1 ] . t! K t
(6.51)
Recording Oracle for the Unitary Haar Cipher
We will use the following notation for the registers: Let the adversary’s query register be split as A := (Ak , Au ), corresponding respectively to the key/control register, P and the register on which the ⃗ unitary Uk acts. That is, the query representation acts as ρ(U ) = k∈[K] |k⟩⟨k|Ak ⊗ (Uk )Au . Similarly, let the purification register R of the recording be split into t registers R1 , . . . , Rt , and let each Ri contain a 4-tuple (RXk ,i , RXu ,i , RYk ,i , RYu ,i ), with RX,i := (RXk ,i , RXu ,i ), and RY,i := (RYk ,i , RYu ,i ). Let RXk := (RXk ,1 , . . . , RXk ,t ) RXu := (RXu ,1 , . . . , RXu ,t ), and so forth. We have from Equation (5.40) that the path recording update rule for the unitary Haar cipher, G = U (N )K , has the form VU (N )K := ΛZK ≀Si ΩZK ≀Si App Λ+ , (6.52) ZK ≀Si−1 R≤i
R≤i
A Ri
R≤i−1
and from Corollary 5.18 that a t-query adaptive algorithm Advt querying VU (N )K has the form47 V
K
Advt U (N )
= ΛZK ≀St · ΩZK ≀St · AdvApp . t R
R
(6.53)
To understand the path recording oracle for the unitary Haar cipher, we therefore only need to look at the form of ΛZK ≀St and ΩZK ≀St . Lemma 6.11 (Factoring Ω along the wreath product). ΩZK ≀St = ΩSt ΩZtK
(6.54)
S πf = S π S f ,
(6.55)
Proof. We have that
47
when starting with an empty recording. Otherwise, we of course also have an additional rescaling of Λ+ ZK ≀S|R | 0
at the beginning.
86
R0
and S (π f )∗
T
T 1 S f −1 π −1 t t! K T 1 = S π −1 S f −1 t t! K T T 1 S π −1 S f −1 = t t! K 1 = S (π) S (f ) , t! K t
(by Equation (6.51))
=
(6.56) (6.57) (since S(π) is real, and S(f ) is diagonal)
and therefore X
ΩZK ≀St =
S(πf ) ⊗ S((πf )∗ )T
(Lemma 5.11)
πf ∈ZK ≀St
=
1 t! K t
=
X
S π S f ⊗ S (π) S (f )
(6.58)
! X 1 X 1 S π ⊗ S (π) t S f ⊗ S (f ) t! K t
(6.59)
πf ∈ZK ≀St
π∈St
f ∈ZK
= ΩSt ΩZtK Note that the same argument also shows that ΩZK ≀St = ΩZtK ΩSt (just write the elements of ZK ≀ St as f ′ π instead of πf ), implying that ΩZtK and ΩSt commute. Lemma 6.12.
ΩZtK
RXk ,RXu ,RYk ,RYu
=
ΠXk =Yk
RXk ,RYk
(6.60)
where ΠXk =Yk is the projector onto the registers RXk and RYk being equal in the standard basis. Proof. ΩZtK =
1 X S f ⊗ S (f ) Kt t
(6.61)
f ∈ZK
=
ED X −f⃗ · ⃗k′ 1 X X f⃗ · ⃗k ⃗ ED⃗ ⃗k ′ , ⃗y ⃗k ′ , ⃗y k, ⃗ x k, ⃗ x ⊗ ω ω K K Kt RXk ,RXu RYk ,RYu t t t
(6.62)
k⃗′ ∈[K] ⃗ y ∈[N ]t
f ∈ZK ⃗k∈[K] ⃗ x∈[N ]t
ED ED X f⃗ · (⃗k−⃗k′ ) 1 ⃗k ′ , ⃗y ⃗k ′ , ⃗y ⃗k, ⃗x ⃗k, ⃗x = ω ⊗ K Kt RXk ,RXu RYk ,RYu ⃗k,k⃗′ ∈[K]t f ∈ZtK {z } ⃗ x,⃗ y ∈[N ]t | X
(6.63)
δ⃗k,⃗k′
=
ED ⃗k, ⃗x ⃗k, ⃗x
X ⃗k∈[K]t ⃗ x,⃗ y ∈[N ]t
=
X ⃗k∈[K]t
⃗k, ⃗k,
ED ⃗k, ⃗k,
RXk ,RXu
RXk ,RYk
⊗ ⃗k, ⃗y
ED ⃗k, ⃗y
⊗ IRXu ,RYu
87
RYk ,RYu
(6.64)
We see, therefore, that ΩZtK plays the role of ensuring that the control register remains the same before and after the query, and moreover, that the same key is recorded in both the RX and the RY halves of the recording. That is, the recording will always have pairs of the form (ki , xi , ki , yi ). Specifically, by the following lemma, we have that when the R register is already correctly formatted in a state of this form, the update rule without the rescaling proceeds by appending a new tuple of the form (ki , xi , ki , yi ), and symmetrizing over all permutations with the existing tuples. Lemma 6.13.
ΩZK ≀Si
R≤i
App
= ΩSi
A Ri
R≤i
App(Xk =Yk )
A Ri
ΠXk =Yk
R≤i−1
(6.65)
where X
|k, y⟩⟨k, x|A ⊗ |k, x, k, y⟩Ri
(6.66)
= ΩSi ΠXk =Yk App A Ri R≤i R≤i A Ri = ΩSi ΠXk =Yk ΠXk =Yk App R≤i Ri R≤i−1 A Ri = ΩSi ΠXk =Yk App ΠXk =Yk R≤i Ri A Ri R≤i−1
(6.67)
App(Xk =Yk ) :=
k∈[K], x,y∈[N ]
Proof. ΩZK ≀Si
R≤i
App
= ΩSi
(6.68) (6.69)
X R≤i ′
k ′ , y k, x A ⊗ ΠXk =Yk k, x, k ′ , y R ΠXk =Yk i R≤i−1
k,k ∈[K] x,y∈[N ]
(6.70) = ΩSi
X ΠX =Y |k, y⟩⟨k, x| ⊗ |k, x, k, y⟩ k k A Ri R≤i R≤i−1
(6.71)
k∈[K] x,y∈[N ]
= ΩSi
R≤i
App(Xk =Yk )
A Ri
ΠXk =Yk
R≤i−1
Corollary 6.14. Assuming we start with a validly formatted recording register, we can write the path recording update rule for the unitary Haar cipher as + VU (N )K = ΛZK ≀Si ΩSi App(Xk =Yk ) ΛZK ≀Si−1 , (6.72) R≤i
R≤i
A Ri
R≤i−1
and we can write a t-query adaptive algorithm Advt querying VU (N )K starting with an empty recording as App(X =Y ) V K k k Advt U (N ) = ΛZK ≀St · ΩSt · Advt . (6.73) R
R
Thus, we have that up to the reweighting operator ΛZK ≀St (which for the sake of simplicity, we
can safely set aside, as it is O
t2 N
-close to a scalar multiple of the identity, see Lemma 6.1048 ), our
48
A more careful treatment can show that even the ΛZK ≀St operator can be properly decomposed, and it is therefore not necessary to incur any error in transforming this path recording to a K-tuple of individual path recordings. Since this is slightly more involved and offers little additional clarity or intuition at this point, we will not do so here. However, we do work this out explicitly in the special case of diagonal unitaries (N = 1) below.
88
recording oracle is encoding multiset states of the form |{(k1 , x1 , y1 ), (k2 , x2 , y2 ), . . . , (kt , xt , yt )}⟩ := ΩSt |(k1 , x1 , k1 , y1 ), (k2 , x2 , k2 , y2 ), . . . , (kt , xt , kt , yt )⟩ , (6.74) and each i’th query adds (ki , xi , yi ) to the set (by appending (App) and then reshuffling the order (ΩSt )). We can, of course, alternatively associate each such multiset state with a K-tuple (R1 , . . . , RK ) of multisets of the form Rk = {(xi , yi ) | ki = k}, where the k’th multiset in the K-tuple contains the (x, y) pairs corresponding to querying the k’th unitary. 6.2.2
Diagonal Unitaries
Specializing further, we can take N = 1, to get the group U (1)K of K-dimensional diagonal unitaries (the K-torus). In this case, each Uk in Equation (6.22) is simply a unit-norm complex phase, and xi and yi are 0-qubit registers, and therefore disappear from the update rule, dropping out of Equation (6.74) to give recording states of the form |{k1 , k2 , . . . , kt }⟩ :∝ ΩSt |(k1 , k1 ), (k2 , k2 ), . . . , (kt , kt )⟩ .
(6.75)
⃗ )⊗t is still a representation of C[ZK ≀ St ], but it is no longer Furthermore, the commutant of ρ(U a faithful representation: as noted in Lemma 6.10 since t > N = 1, the irreps ⃗λ that survive are those where each λ(i) indexes an irrep of U (1). That is, we have that each λ(i) is a Young diagram with a single row. Let At be this quotient algebra, that is At := C[ZK ≀ St ]/ ker(S) (where S(·) is the Schur representation of ZK ≀ St , see Equation (6.26)). Lemma 6.15. Let (1)K be the group of K dimensional diagonal unitaries, with representation P G = U−iθ ρ(θ1 , . . . , θK ) = k∈[K] e k |k⟩⟨k|. Then the path recording update rule for this group simplifies to a multiset insertion X VU (1)K = |k⟩⟨k|A ⊗ |R ⊎ {k}⟩⟨R |R (6.76) k∈[K] R multiset from [K]
on multiset states of the form |{k1 , k2 , . . . , kt }⟩ := √t! Q 1
i∈[K] (ti !)
P
π∈St |π(k1 , k2 , . . . , kt )⟩, where ti is
the number of times i appears in the multiset.49 Proof. We start with the recording oracle for U (N )K from Corollary 6.14, specialized to the case where N = 1: VU (1)K = ΛAi ΩSi App(Xk =Yk ) Λ+ , (6.77) Ai−1 R≤i
R≤i
A Ri
R≤i−1
Note that the purification register here contains both an RX = (RX1 , . . . , RXt ) and a corresponding RY = (RY1 , . . . , RYt ). But we know by Corollary 6.14 that RX and RY will contain identical strings (recall that we have thrown out the part of R that was not identical when we took N = 1). So of course, there is redundancy. We can therefore write the update rule here as if it were acting on just a single purification register R = (R1 , . . . , Rt ) containing a string of t k-values, These are off by a simple relabeling on the purification register, so this distinction will not matter, but it will simplify notation, so we will write it here as if it were a single register R = (R1 , . . . , Rt ). We thus 49
Note that when the multiset contains collisions/repeats, different permutations can give the same basis string, and so the prefactor provides the proper normalization to make this a normalized state.
89
P P App(Xk =Yk ) = k∈[K] |k⟩⟨k|A ⊗ |k, k⟩RXi RY i with App = k∈[K] |k⟩⟨k|A ⊗ |k⟩Ri A Ri P A Ri and write ΩSt as t!1 π∈St S(π). Now, we argue about the reweighting operators ΛAi and Λ+ Ai−1 : Consider the irrep ratios in Lemma 6.10. The group U (1) is Abelian, which implies that all the irreps in the denominator of Equation (6.50) have dimension 1, and furthermore, the irreps of U (1) are parameterized by Young diagrams of a single-row, which means that each λ(i) in the numerator is the trivial irrep of the corresponding symmetric group Sti , all of which have dimension 1. We thus have that the irrep ratios simplify to Q t! (ti !) , where ti is the size of λ(i) , or the number of times that i appears in replace
i∈[K]
the recording register. Therefore, the reweighting operator (for this case when N = 1) produces a type-dependent scalar: sQ s X X t! i∈[K] (ti !) Q Π(t1 ,...,tK ) , (6.78) ΛAt = Π(t1 ,...,tK ) , and Λ+ At−1 = t! i∈[K] (ti !) (t1 ,...,tK )
(t1 ,...,tK )
where Π(t1 ,...,tK ) is the projector onto strings with a type of the form (t1 , . . . , tK ). We thus have that s X t! 1 X Q ΛAt ΩSt = S(π) Π(t1 ,...,tK ) · t! i∈[K] (ti !) π∈St (t1 ,...,tK ) s X t! 1 X Q = · S(π) Π(t1 ,...,tK ) t! i∈[K] (ti !) π∈St
(t1 ,...,tK )
(Π(t1 ,...,tK ) is invariant under permutations) X S(π) Π(t1 ,...,tK ) (6.80)
1 q Q t! i∈[K] (ti !) π∈St (t1 ,...,tK ) X = |{k1 , k2 , . . . , kt }⟩⟨k1 , k2 , . . . , kt | X
=
(6.79)
(6.81)
k1 ,k2 ,...,kt ∈[K]
X
=:
|{⃗k}⟩⟨⃗k| .
(6.82)
⃗k∈[K]t
So this is the normalized symmetrization operator. Similarly, we have that sQ X X 1 i∈[K] (ti !) ΩSt−1 Λ+ S(π) Π(t1 ,...,tK ) At−1 = (t − 1)! (t − 1)! π∈St−1 (t1 ,...,tK ) sQ X X 1 i∈[K] (ti !) = · Π(t1 ,...,tK ) S(π) (t − 1)! (t − 1)!
(6.83)
π∈St−1
(t1 ,...,tK )
(Π(t1 ,...,tK ) is invariant under permutations) Q =
X (t1 ,...,tK )
=
i∈[K] (ti !)
s
1 Q
Π(t1 ,...,tK ) S(π) (t − 1)! i∈[K] (ti !) π∈St−1 ⃗ Q (k) i∈[K] ti ! |k1 , k2 , . . . , kt ⟩⟨{k1 , k2 , . . . , kt }| (t − 1)!
(t − 1)!
X k1 ,k2 ,...,kt ∈[K]
X
90
(6.84)
(6.85)
Q =:
X
⃗ (k) i∈[K] ti ! (t − 1)!
⃗k∈[K]t
|⃗k⟩⟨{⃗k}| .
(6.86)
(⃗k) where we take ti ! to be the number of times that a value i ∈ [K] appears inside ⃗k. We now combine everything to get the result: VU (1)K = ΛAi ΩSi App Λ+ (6.87) Ai−1 R≤i R≤i A Ri R≤i−1 = ΛAi ΩSi ΩSi−1 App Λ+ (by Lemma 5.17) Ai−1 R≤i R≤i R≤i−1 A Ri R≤i−1 = ΛAi ΩSi App ΩSi−1 Λ+ Ai−1 R≤i
R≤i
A Ri
R≤i−1
R≤i−1
(ΩSi−1 and App act on different registers)
X ⃗ ⃗ = ΛAi ΩSi |k⟩⟨k|A ⊗ |k, k⟩R≤i ⟨k |R≤i−1 ΩSi−1 Λ+ Ai−1 R≤i R≤i R≤i−1 R≤i−1
k∈[K] ⃗k∈[K]i−1
A Ri
(definition of App) =
X
|{⃗k ′ }⟩⟨⃗k ′ |
⃗k′ ∈[K]i−1
R≤i
Q
⃗ ′′ (k ) ! i∈[K] ti
X X |k⟩⟨k|A ⊗ |⃗k, k⟩R≤i ⟨⃗k |R≤i−1 (t − 1)! ′′ i−1
|⃗k ′′ ⟩⟨{⃗k ′′ }|
⃗k ∈[K]
k∈[K] ⃗k∈[K]i−1
R≤i−1
A Ri
(by Equations (6.82) and (6.86)) Q =
X k∈[K] ⃗k∈[K]i−1
=
X
⃗ (k) i∈[K] ti ! (t − 1)!
|k⟩⟨k|A ⊗ |{⃗k} ⊎ {k}⟩R≤i ⟨{⃗k}|R≤i−1
(6.88)
|k⟩⟨k|A ⊗ |R ⊎ {k}⟩R≤i ⟨R |R≤i−1
(6.89)
k∈[K] R multiset from [K] (t−1)! distinct (⃗ k) i∈[K] ti !
Where the last equality follows since each multiset R = {⃗k} corresponds to Q strings. This completes the proof.
We can see, therefore, that the path recording oracle for U (1)K is simply keeping a running total that keeps track of how many times each key k has been queried. This is, of course, the recording oracle of Zhandry [Zha19] for the case of queries to a Haar random diagonal unitary (that is, a function f : [K] → U (1)).
6.3
Zhandry’s Compressed Phase Oracle
We can, of course, specialize this further to random Boolean functions, f : {0, 1}n → {0, 1}. Without loss of generality, we can view these functions as being applied in the phase: X ρ(f ) = (−1)f (x) |x⟩⟨x| . (6.90) x∈{0,1}n
91
n The group of such Boolean functions is thus G = ZN 2 (again, taking N = 2 ), with the group operation given by an XOR on the truth tables, and a representation as diagonal unitaries with ±1 values.
Lemma 6.16. Let G = ZN 2 be the group of Boolean functions, with the representation in Equation (6.90) above. Then the path recording update rule for this group simplifies to a set insertion mod 2 (that is, add to the set if it does not yet appear, and remove it if it does): X VZN = |x⟩⟨x|A ⊗ |R ⊕ {x}⟩⟨R |R . (6.91) 2
x∈[N ] R⊆[N ]
This is the compressed oracle of [Zha19] for Boolean functions applied in the phase. We remark that Zhandry’s compressed oracle can also be derived from the tableau-recording oracle: since all irreducible representations of a finite Abelian group are one-dimensional (i.e., characters of the group), the relevant Clebsch-Gordan transforms all simplify to scalars. Nevertheless, we prove Lemma 6.16 to demonstrate how the path-recording oracle can be used to derive a wide variety of existing compressed oracles, and to improve our general-purpose understanding of the path-recording oracle. Proof. We can easily compute the commutant of ρ(f )⊗t as follows. Let f⃗ be the bit string encoding of f as (f (1), f (2), . . . , f (N )) ∈ {0, 1}N , and similarly let m2 (x) ∈ {0, 1}N be the one-hot encoding of x ∈ [N ]. Then f (x) = f⃗ · m2 (x). We write X ρ(f )⊗t = (−1)f (x1 ) ⊕ ··· ⊕ f (xt ) |x1 , . . . , xt ⟩⟨x1 , . . . , xt | (6.92) x1 ,...,xt ∈[N ]
=
X
⃗
(−1)f · (m2 (x1 ) ⊕ ··· ⊕ m2 (xt )) |x1 , . . . , xt ⟩⟨x1 , . . . , xt |
(6.93)
x1 ,...,xt ∈[N ]
=
X
⃗
(−1)f · (m2 (x)) |x⟩⟨x| .
(6.94)
x∈[N ]t
where x := (x1 , . . . , xt ), and m2 (x) := m2 (x1 ) ⊕ · · · ⊕ m2 (xt ) is the count mod 2 of x. By extending it linearly, we can view the tensor power representation ρ(f )⊗t as a representation N N of P the corresponding group algebra C[Z2 ]: For each algebra element a ∈ C[Z2 ], where a = f ∈ZN af f , we have that 2
R(a) :=
X
af ρ(f )⊗t .
(6.95)
f ∈ZN 2
Now consider the Fourier basis of the group algebra: 1 X f⃗ · µ ⃗ µ̂ := N (−1) f . 2 µ∈ZN N f ∈Z2
(6.96)
2
The representations R(µ̂) of the Fourier basis form another basis for the span of the tensor power
92
operators. We can compute that R(µ̂) =
1 X ⃗ (−1)f · µ⃗ ρ(f )⊗t 2N N
(6.97)
1 X ⃗ (−1)f · (⃗µ ⊕ m2 (x)) |x⟩⟨x| 2N N
(6.98)
f ∈Z2
=
f ∈Z2 x∈[N ]t
X
=
|x⟩⟨x|
(6.99)
x∈[N ]t m2 (x)=⃗ µ
Note that m2 (x) always has Hamming weight at most t, so this is 0 whenever µ has Hamming weight larger than t. Otherwise, if |µ| ≤ t we interpret µ as a subset of [N ] and observe that R(µ̂) is a projector onto strings x1 , . . . , xt such that each x ∈ µ appears an odd number of times in the string and each x ∈ / µ appears an even number (potentially zero times). Note further that the subspaces corresponding to these projectors are mutually orthogonal: R(µ̂)R(ν̂) = δµν R(µ̂). Their commutant At is therefore the algebra of operators that preserve these subspaces, and is spanned by operators of the form n o µ := |a⟩⟨b| m2 (a) = m2 (b) = µ Ea,b (6.100) t a,b∈[N ] , µ⊆[N ],
This basis of the commutant algebra already presents it as a direct sum of matrix algebras. That is, this is the Fourier basis of the algebra. We can thus directly see that the irreps of this algebra are parameterized by µ ⊆ [N ] such that |µ| ≤ t, and furthermore, that the dimension of irrep µ is the total number of ways to choose a ∈ [N ]t such that m2 (a) = µ: dim(VAµt ) =
X t1 ,...,tN ≥0 ti odd P iff i∈µ i ti =t
X
=
⃗t∈ZN , | ⃗t |=t ≥0 µ ⃗ =⃗t mod 2
By Lemma 3.31, Item 1, we have that S
µ Ea,b
t! t1 ! . . . tN !
(6.101)
t! . t1 ! . . . tN !
(6.102)
∗ T
µ 1 = dim(V µ S E a,b . ) At
We thus have that the reweighting and symmetrization operators have the following form:
ΩAt =
X
1 µ µ µ S Ea,b ⊗ S Ea,b dim(VAt ) t
(6.103)
µ⊆[N ], a,b∈[N ] m2 (a)=m2 (b)=µ
=
1
X dim a,b∈[N ]t m2 (a)=m2 (b)
m (a)
VAt2
93
|a⟩⟨b| ⊗ |a⟩⟨b| ,
(6.104)
and as before, since we now have that the two registers are always equal in the standard basis, we will abuse notation and write it as if it were a single register ΩAt =
1
X dim a,b∈[N ]t m2 (a)=m2 (b)
v X u u dim(VAµt ) t ΛAt = Πµ dim(VZµN ) µ⊆[N ] 2 X q = dim(VAµt ) Πµ
m (a)
VAt2
|a⟩⟨b| .
Λ+ At =
v u dim(VZµN ) X u t 2
Πµ
(6.106)
1 q Πµ dim(VAµt ) µ⊆[N ]
(6.107)
dim(VAµt )
µ⊆[N ]
=
µ⊆[N ]
(6.105)
X
P where Πµ := x∈[N ]t , m2 (x)=⃗µ |x⟩⟨x| are the projectors from Equation (6.99), and the second line follows since ZN 2 is an Abelian group, so its irreps are all 1-dimensional. For x ∈ [N ]t , let {x}mod 2 ⊆ [N ] be the set corresponding to m2 (x). That is, it is the set of values appearing an odd number of times in x. Let 1 |{x}mod 2 ⟩ := r m (a) dim VAt2
X
|y⟩
(6.108)
y∈[N ]t m2 (y)=m2 (x)
be the uniform superposition over strings of the same parity. We then have that r X 1 m (a) |a⟩⟨b| ΛAt ΩAt = dim VAt2 m2 (a) dim V t a,b∈[N ] At
(6.109)
m2 (a)=m2 (b)
X
=
a,b∈[N ]t m2 (a)=m2 (b)
X
=
1 r |a⟩⟨b| m (a) dim VAt2
|{x}mod 2 ⟩⟨x| ,
(6.110)
(6.111)
x∈[N ]t
and similarly, X
ΩAt−1 Λ+ At−1 =
a,b∈[N ]t−1 m2 (a)=m2 (b)
1
X
=
x∈[N ]t−1
Let dx :=
1 1 |a⟩⟨b| r m2 (a) m2 (a) dim V At−1 dim VAt−1
dim
m2 (x) VAt−1
|x⟩⟨{x}mod 2 | .
(6.112)
(6.113)
1 for brevity. As before, we now combine these to conclude: m (x) dim VA 2 t−1
VZN = ΛAi 2
R≤i
ΩAi
R≤i
App
A Ri
Λ+ Ai−1
R≤i−1
94
(6.114)
App Λ+ = ΛAi ΩAi ΩAi−1 Ai−1 R≤i R≤i R≤i−1 A Ri R≤i−1 + = ΛAi ΩAi App ΩAi−1 ΛAi−1 R≤i
R≤i
A Ri
R≤i−1
(by Lemma 5.17)
R≤i−1
(ΩAi−1 and App act on different registers)
X |x⟩⟨x|A ⊗ |x, x⟩R≤i ⟨x |R≤i−1 ΩAi−1 = ΛAi ΩAi Λ+ Ai−1 R≤i R≤i R≤i−1 R≤i−1
x∈[N ] x∈[N ]i−1
A Ri
(definition of App) =
X
|{x′ }mod 2 ⟩⟨x′ |
x′ ∈[N ]i−1
R≤i
X X 1 |x′′ ⟩⟨{x′′ }mod 2 | |x⟩⟨x|A ⊗ |x, x⟩R≤i ⟨x |R≤i−1 ′′ d ′′ i−1 x x∈[N ] x∈[N ]i−1
x ∈[N ]
R≤i−1
A Ri
(by Equations (6.111) and (6.113)) =
X x∈[N ] x∈[N ]i−1
=
X
1 |x⟩⟨x|A ⊗ |{x}mod 2 ⊕ {x}⟩R≤i ⟨{x}|R≤i−1 dx
(6.115)
|x⟩⟨x|A ⊗ |R ⊕ {x}⟩R≤i ⟨R |R≤i−1
(6.116)
x∈[N ] R⊆[N ]
Where the last equality follows since each multiset R = {x}mod 2 corresponds to dx distinct strings. This completes the proof. It turns out that there is another characterization of this commutant algebra in terms of colored even-partition diagrams. Definition 6.17 (Colored Even-Partition Algebra). The even-partition algebra is the algebra of partition diagrams in which every component has even number of vertices. This is equivalent to the Tanabe algebra Tt (N, 2) [Tan97]. The ZN -colored even-partition algebra is the algebra that has a basis of even-partition diagrams with each component assigned a color in ZN (see Figure 17 for an example of such a colored diagram).50 Diagram multiplication accumulates the colors of each of the components that get merged together.
f4 f2
(6.117)
f3
f1
Figure 17: Colored even-partition diagram on 8 elements with colors f1 , f2 , f3 , f4 ∈ ZK attached to the four components. 50
This diagram algebra is closely related to the G-colored partition algebras studied by [Blo03].
95
The Schur representation on (CN )⊗t differs from that of the partition algebra by attaching a fi x i phase of ωN to the sum over xi of a component of color fi (similar to Schur representation of ZK ≀ St on (CKN )⊗t ). For example, f4
S
f2
f3
f1
=
X
f1 x1 +···+f4 x4 x ,x ,x ,x ,x ,x ,x ,x 1 2 3 3 3 2 4 4 ωK . D E
x1 ,x2 ,x3 ,x4 ∈[N ]
(6.118)
x2 ,x1 ,x3 ,x2 ,x3 ,x2 ,x3 ,x2
Lemma 6.18. The commutant algebra of ρ(f )⊗t is isomorphic to the colored even-partition algebra. Proof sketch. This comes from simply performing a change of basis on the basis of Equation (6.100) in much the same way as in Equation (6.46).
7
PC is a Pseudorandom Unitary
In this section, we prove that any algorithm making t queries cannot distinguish a Haar-random unitary from a random Clifford circuit (or arbitrary 2-design) composed with a random permutation √ with advantage better than O(t2 /N ). Throughout this section, we assume t ≤ c N for a sufficiently small absolute constant c > 0. In particular, this guarantees that the partition algebra Pt (N ) is semisimple and all O(t2 /N ) error terms below are smaller than an absolute constant. Path In order to prove this, we carefully analyze the path-recording oracles QPath U (N ) , QSN for the defining representation of U (N ) and the in-place representation of SN . In particular, we prove that they are close in trace distance on the distinct, nonplussed subspace DNP (Definition 7.5), and prove that a random 2-design C causes almost all of the recording state to land in DNP. Proving the first of these statements, in turn, requires two main steps: an analysis of the dual elements of permutations [π]∗ ∈ Pt (N ) within the partition algebra, and an analysis of λ-irrep dimensions in (U (N ), St ) and (SN , Pt (N )) Schur-Weyl duality.
7.1 7.1.1
The Distinct, Nonplussed Subspace Preliminaries
Lemma 7.1 ([MPSY24, MH25]). Let C be any unitary 2-design on CN . Then, h i t(t − 1) EC Tr ΠDistN,t C ⊗t ρ(C † )⊗t ≥ 1 − N +1
(7.1)
Definition 7.2. Let |+⟩ denote the uniform superposition on the standard basis of CN , and define W = I − |+⟩⟨+|, i.e. the projector away from |+⟩. For a system of t registers, the nonplussed subspace 51 NoPlusN,t = W ⊗t is obtained by projecting away the uniform superposition on each register. An orthonormal basis for NoPlusN,t is given by 1 X ⟨⃗x,⃗y⟩ ωN |⃗x⟩ (7.2) N t/2 t ⃗ x∈[N ]
51
(y1 ,...,yt )∈(ZN \{0})t
In other words, we are completely unfazed by states in this subspace.
96
Another basis for NoPlusN,t that will often be convenient for us (but not orthonormal) is given by ( t O
) |1⟩ − |xi ⟩
(7.3)
i=1
(x1 ,...,xt )∈([N ]\{1})
t
Note that, while not orthonormal, these basis states are linearly independent, since only the state corresponding to ⃗x has support on |⃗x⟩. Lemma 7.3. Let C be sampled from any unitary 1-design on CN . Then, h i t EC Tr ΠNoPlusN,t C ⊗t ρ(C † )⊗t ≥ 1 − N
(7.4)
Proof. Since {|+⟩⟨+|i }ti=1 are commuting projectors, we can use the operator form of the union bound: Lemma 7.4 ([KOMW19]). Let ρ be a density operator, and let Π1 , . . . , Πm be commuting orthogonal projectors. Then m X 1 − Tr (Πm · · · Π1 ρΠ1 · · · Πm ) ≤ Tr ((I − Πi )ρ) . (7.5) i=1
which implies that W ⊗t = (I − |+⟩⟨+|)⊗t ⪰ I −
t X
|+⟩⟨+|
(7.6)
i=1
Therefore, t X Tr ΠNoPlusN,t C ⊗t ρ(C † )⊗t ≥ 1 − Tr |+⟩⟨+|i C ⊗t ρ(C † )⊗t
(7.7)
i=1
h
=⇒ EC Tr ΠNoPlusN,t C
⊗t
† ⊗t
ρ(C )
i
≥1−
t X
h i ⊗t † ⊗t EC Tr |+⟩⟨+|i C ρ(C )
(7.8)
i=1
Now, consider the summand on the right hand side. By the cyclic property of trace and linearity of expectation, the summand on the right hand side is equivalent to Tr EC [(C † )⊗t |+⟩⟨+|i C ⊗t ρ] = Tr EC [(C † |+⟩⟨+| C)i ]ρ (7.9) For any 1-design, EC [C † σC] = Tr(σ) N I. Since σ = |+⟩⟨+| has trace 1, Eq. (7.9) simplifies to Tr(ρ)/N = 1/N . Plugging this into the summand in Eq. (7.8) completes the proof. Definition 7.5. The distinct nonplussed subspace DNPN,t := DistN,t ∩ NoPlusN,t is the intersection of the distinct and nonplussed subspaces. 2 t Lemma 7.6. The distinct nonplussed subspace DNPN,t has dimension N t 1 − O N . In partic 2 t ular, this means that the fully mixed state has probability at least 1 − O N of being in the distinct nonplussed subspace.
97
Proof. We can take the following to be a partial and non-orthogonal basis for the distinct nonplussed subspace: ( t ) O S= |i⟩ − |xi ⟩ (7.10) (x1 ,...,xt )∈([N ]\{1,...,t})tdist
i=1
As in Equation (7.3), these basis states are linearly independent (though not orthogonal) because only the state corresponding to ⃗x has support on |⃗x⟩. Furthermore, S is contained in the distinct nonplussed subspace: Fix |ψ⟩ ∈ S. Clearly, |ψ⟩ ∈ DistN,t , since all t registers are supported on pairwise disjoint sets of computational basis vectors. Moreover, W (|i⟩ − |xi ⟩) = |i⟩ − |xi ⟩ + (⟨+|i⟩ − ⟨+|xi ⟩) |+⟩ 1 1 |+⟩ = |i⟩ − |xi ⟩ + √ − √ N N = |i⟩ − |xi ⟩ =⇒ W
⊗t
|ψ⟩ = |ψ⟩
(7.11) (7.12) (7.13) (7.14)
and so |ψ⟩ ∈ NoPlusN,t as well. So the size of S is a lower bound on the dimension of the distinct nonplussed subspace. This gives us that dim(DNPN,t ) ≥ |S| = (N − t)(N − t − 1) . . . (N − 2t + 1) 2 t ≥ Nt 1 − O . N 7.1.2
(7.15)
Unitary 2-designs and the Distinct Nonplussed Subspace
In this section, we will show that applying a unitary 2-design with high probability maps an arbitrary state ρ ∈ (CN )⊗t to a state that has high overlap with the distinct nonplussed subspace. More precisely, we will prove the following theorem: Theorem 7.7. Let ΠDNPN,t be the projection onto the distinct nonplussed subspace, and C be any unitary 2-design on CN . Then, 2 h i t ⊗t † ⊗t EC Tr ΠDNPN,t C ρ(C ) ≥1−O (7.16) N for any state ρ ∈ (CN )⊗t . To prove Theorem 7.7, we first collect some facts about projectors: Lemma 7.8 ([Gao15]). Let ρ be a density operator, and let Π1 , . . . , Πm be orthogonal projectors. Then m X 1 − Tr (Πm · · · Π1 ρΠ1 · · · Πm ) ≤ 4 Tr ((I − Πi )ρ) . (7.17) i=1
Equivalently, Tr (Πm · · · Π1 ρΠ1 · · · Πm ) ≥ 1 − 4
m X i=1
98
Tr ((I − Πi )ρ) .
(7.18)
Definition 7.9. Assume that A and B are subspaces of CN , and let C := A ∩ B be the intersection. The Friedrichs angle c(A, B) is defined as c(A, B) :=
|⟨x|y⟩|
sup
(7.19)
|x⟩∈A∩C ⊥ |y⟩∈B∩C ⊥ ∥|x⟩∥=∥|y⟩∥=1
Informally, the Friedrichs angle is the highest overlap between two unit vectors in A and B, excluding the intersection. For example, when ΠA and ΠB are commuting projectors, c(A, B) = 0. Notice that since |y⟩ ∈ B ∩ C ⊥ , ∥ΠA |y⟩∥ = sup |⟨a|y⟩| =
sup
|⟨a|y⟩|
(7.20)
|⟨y|ΠA |y⟩|
(7.21)
|a⟩∈A∩C ⊥ ∥|a⟩∥=1
|a⟩∈A ∥|a⟩∥=1
=⇒ ∥ΠA |B∩C ⊥∥2 = =
sup |y⟩∈B∩C ⊥ ∥|y⟩∥=1
sup
|⟨y|x⟩⟨x|y⟩| = c(A, B)2
(7.22)
|x⟩∈A∩C ⊥ |y⟩∈B∩C ⊥ ∥|x⟩∥=∥|y⟩∥=1
We make use of two more characterizations of c(A, B). First, Claim 7.10. c(A, B) is the largest singular value of ΠA ΠB aside from 1. Proof. Since A decomposes into C ⊕ (A ∩ C ⊥ ), we have that ΠA ΠB = ΠC ΠB + ΠA∩C ⊥ ΠB = ΠC + ΠA∩C ⊥ ΠB . Moreover, decomposing B = C ⊕ (B ∩ C ⊥ ), we can write ΠA ΠB = ΠC + ΠA∩C ⊥ ΠC + ΠA∩C ⊥ ΠB∩C ⊥ = ΠC + ΠA∩C ⊥ ΠB∩C ⊥ . Thus, ΠA ΠB block-diagonalizes according to the (C, A∩C ⊥ ), (C, B∩C ⊥ ) vector space decompositions. c(A, B) is defined to be the top singular value of the (A ∩ C ⊥ , B ∩ C ⊥ ) block, so this proves the claim. Kayalar and Weinert proved that the Friedrichs angle captures the difference between first projecting onto A, then projecting onto B, as opposed to a single projection onto A ∩ B: Theorem 7.11 ([KW89]). ||ΠA ΠB − ΠA∩B || = c(A, B).
(7.23)
From Theorem 7.11, we can derive a related bound which will be useful in our setting: Lemma 7.12. ∥ΠB ΠA ΠB − ΠA∩B ∥ ≤ c(A, B)2
99
(7.24)
Proof. ∥ΠB ΠA ΠB − ΠA∩B ∥ = ∥ΠB ΠA ΠA ΠB − ΠA∩B ∥
(since Π2A = ΠA )
= ∥ΠB ΠA ΠA ΠB − ΠA∩B − ΠA∩B + ΠA∩B ∥
(7.25)
= ∥ΠB ΠA ΠA ΠB − ΠB ΠA ΠA∩B − ΠA∩B ΠA ΠB + ΠA∩B ∥ (since ΠA ΠA∩B = ΠA∩B ) = ∥(ΠB ΠA − ΠA∩B )(ΠA ΠB − ΠA∩B )∥
(7.26)
≤ ∥ΠB ΠA − ΠA∩B ∥ ∥ΠA ΠB − ΠA∩B ∥
(submultiplicativity)
= ∥ΠA ΠB − ΠA∩B ∥2
(7.27)
2
≤ c(A, B)
(Theorem 7.11)
Corollary 7.13. |Tr(ΠA ΠB ρΠB ΠA ) − Tr(ΠA∩B ρΠA∩B )| ≤ c(A, B)2 .
(7.28)
Proof. |Tr(ΠA ΠB ρΠB ΠA ) − Tr(ΠA∩B ρΠA∩B )| = |Tr(ΠB ΠA ΠA ΠB ρ) − Tr(ΠA∩B ΠA∩B ρ)| = |Tr(ΠB ΠA ΠB ρ) − Tr(ΠA∩B ρ)| = Tr (ΠB ΠA ΠB − ΠA∩B )ρ ≤ ||ΠB ΠA ΠB − ΠA∩B || ∥ρ∥1 = ||ΠB ΠA ΠB − ΠA∩B || 2
= c(A, B)
(7.29) (7.30) (7.31)
(Hölder’s inequality) (∥ρ∥1 = 1) (Lemma 7.12)
Finally, we will make use of one more fact about the Friedrichs angle: Lemma 7.14. ΠA ΠB + ΠB ΠA ⪰ −c(A, B) ΠA + ΠB Proof. By Jordan’s lemma, ΠA and ΠB are simultaneously block-diagonalizable into one- and two-dimensional subspaces where on the two dimensional subspaces we have 1 0 cos2 θ cos θ sin θ ΠA = , ΠB = 0 0 cos θ sin θ sin2 θ for some angle 0 < θ < π2 . The one-dimensional subspaces together span A ∩ B, A⊥ ∩ B, A ∩ B ⊥ , and A⊥ ∩ B ⊥ . Thus, in this language, the Friedrichs angle is given by c(A, B) = max cos(θ), where the maximum is taken over two-dimensional Jordan blocks. But on any fixed Jordan block, one can see that (1 + cos(θ))2 sin θ(1 + cos(θ)) ΠA ΠB + ΠB ΠA + cos(θ)(ΠA + ΠB ) = cos(θ) · ⪰ 0, sin θ(1 + cos(θ)) sin2 θ which proves the claim. 100
Our first goal will be to show that c(DistN,t , NoPlusN,t )2 is small when t ≪ N : Lemma 7.15. c(DistN,t , NoPlusN,t )2 ≤
t(t − 1) . N −t+1
Proof. Define the averaging operator Ai as follows: X 1 |x1 , . . . , xi−1 , a, xi+1 , . . . , xt ⟩ if ⃗x ∈ [N ]tdist , N − t + 1 Ai |⃗x⟩ = a∈{x / j : j̸=i} |⃗x⟩ , otherwise.
(7.32)
(7.33)
From the definition, it is clear that Ai is an orthogonal projector, whose normalized +1 eigenvectors within the distinct subspace are given by X 1 √ |z1 , . . . , zi−1 , a, zi+1 , . . . , zt ⟩ , ⃗z = (z1 , . . . , zi−1 , zi+1 , . . . , zt ) ∈ [N ]t−1 dist (7.34) N − t + 1 a∈{z / : j̸=i} j
and a (overcomplete) basis for ker Ai (which is within the distinct subspace) is given by 1 √ (|z1 , . . . , zi−1 , a, zi+1 . . . , zt ⟩ − |z1 , . . . , zi−1 , b, zi+1 . . . , zt ⟩), a ̸= b 2
(7.35)
We will be interested in the (Hermitian, PSD) operator X A= Ai . i
We first show that the kernel of A is exactly the intersection DistN,t ∩ NoPlusN,t : Claim 7.16. DistN,t ∩ NoPlusN,t =
t \
ker Ai = ker A
(7.36)
i=1
T Proof. We know that ti=1 ker Ai = ker A because the Ai are allTPSD. For the main claim, by definition of NoPlusN,t , NoPlusN,t = ti=1 Im W (i) . So it is sufficient for us to show that for each i, ker Ai = Dist ∩ Im W (i) (7.37) For the forward inclusion, it is clear by definition of Ai that ker Ai ⊆ Dist. Moreover, for any state |ϕ⟩ in Eq. (7.35), Tr[t]\i (|ϕ⟩⟨ϕ|) = √12 (|a⟩ − |b⟩) is orthogonal to |+⟩, and therefore in Im W . Thus ker Ai ⊆ Dist ∩ Im W (i) .
(7.38)
Conversely, if |ψ⟩ ∈ / ker Ai , then either |ψ⟩ has support on a non-distinct t-tuple (in which case |ψ⟩ ∈ / Dist), or has support on a basis state |ϕ⟩ in Eq. (7.34), which satisfies X 1 Tr[t]\i (|ϕ⟩⟨ϕ|) = √ |a⟩ (7.39) N − t + 1 a∈{z / : j̸=i} j
which has nonzero overlap with |+⟩ ∈ ker W . Hence, |ϕ⟩ ∈ / Im W (i) , and so |ψ⟩ ∈ / ker Ai =⇒ |ψ⟩ ∈ / Dist ∩ Im W (i) .
101
(7.40)
Next, we calculate the pairwise Friedrichs angles c(Im(Ai ), Im(Aj )) for i ̸= j. 1 Claim 7.17. c(Im(Ai ), Im(Aj )) ≤ N −t+1 for all i < j.
/ {i, j}. Proof. The projections Ai and Aj are simultaneously block-diagonal in the coordinates ℓ ∈ Thus, it suffices to prove the claim restricting to states of the O |xℓ ⟩ ⊗ ψx̸=i,j ℓ∈{i,j} /
where ψx̸=i,j is on the ith and jth registers. Restricted to these states and looking only at registers i and j, Im(Ai ) is spanned by states of the form E X 1 ψx(i)j = √ x′i |xj ⟩ N − t + 1 x′ ∈{x / } i
ℓ ℓ̸=i
for all xj ∈ / {xℓ }ℓ∈{i,j} , while Im(Aj ) is similarly spanned by / E =√ ψx(j) i
X 1 N − t + 1 x′ ∈{x / } j
|xi ⟩ x′j
ℓ ℓ̸=j
D E (j) (i) ψ ψ for all xi ∈ / {xℓ }ℓ∈{i,j} . The corresponding Gram matrix of all such inner products is x x / i j given by 1 JN −t+2 − IN −t+2 , N −t+1 where J denotes an all ones matrix, as the diagonal terms are indeed zero while the off-diagonal 1 terms are N −t+1 . By Claim 7.10, the c(Im(Ai ), Im(Aj )) is the largest singular value of this matrix 1 aside from 1. Because J has rank 1, all remaining singular values of the Gram matrix are N −t+1 , so the claim follows. In order to finish proving Lemma 7.15, we will need to establish one more key claim. Claim 7.18. A ⪰ (1 − N t−1 −t+1 )(I − Πker(A) ). Proof. By Claim 7.17 and Lemma 7.14, we have that Ai Aj + Aj Ai ⪰ −
1 Ai + Aj N −t+1
for all i ̸= j. Thus, we can calculate A2 = A +
X (Ai Aj + Aj Ai )
(7.41)
i<j
⪰A−
X 1 (Ai + Aj ) N −t+1
(7.42)
t−1 )A. N −t+1
(7.43)
i<j
= (1 −
Since A is Hermitian PSD, this means that all nonzero eigenvalues of A are at least (1 − N t−1 −t+1 ) and so t−1 A ⪰ (1 − )(I − Πker A ). N −t+1 102
We are finally ready to prove Lemma 7.15. Fix any |ψ⟩ ∈ NoPlusN,t ∩ (DNPN,t )⊥ , and define |ϕ⟩ := ΠDistN,t |ψ⟩ and |η⟩ := (I−ΠDistN,t ) |ψ⟩. By Eq. (7.22), bounding c(DistN,t , NoPlusN,t )2 reduces to bounding t
t
N −t+1 X N −t+1 X ⟨ϕ|Ai |ϕ⟩ = ∥Ai |ϕ⟩∥2 N − 2t + 2 N − 2t + 2 i=1 i=1 (7.44) where the second equality holds because |ϕ⟩ is orthogonal to DNPN,t : for any |γ⟩ ∈ DNPN,t , ⟨ψ|ΠDistN,t |ψ⟩ = ⟨ϕ|ϕ⟩ = ⟨ϕ|I − ΠDNPN,t |ϕ⟩ ≤
⟨γ|ϕ⟩ = ⟨γ|ΠDistN,t |ψ⟩ = ⟨γ|ψ⟩ = 0
(7.45)
Now, we turn to bounding ∥Ai |ϕ⟩∥2 . For any ⃗z ∈ [N ]t−1 and a ∈ [N ], let α⃗z,a be the coefficient of |z1 , . . . , zi−1 , a, zi+1 , . . . , zt ⟩ when expanding |ψ⟩ in the computational basis. Since |ψ⟩ ∈ NoPlusN,t , X X X α⃗z,a = 0 =⇒ − α⃗z,a = α⃗z,a (7.46) a∈[N ]
a∈{z / j :j̸=i}
a∈{zj :j̸=i}
But then, Ai |ϕ⟩ = Ai ΠDistN,t |ψ⟩ X X = Ai
(7.47) α⃗z,a |z1 , . . . , zi−1 , a, zi+1 , . . . , zt ⟩
(7.48)
X
(7.49)
a∈{z / j :j̸=i} ⃗ z ∈[N ]t−1 dist
=
1 N −t+1
=−
X
X
α⃗z,a |z1 , . . . , zi−1 , b, zi+1 , . . . , zt ⟩
b∈{z / j :j̸=i} a∈{z / j :j̸=i} ⃗ z ∈[N ]t−1 dist
1 N −t+1
X
X
X
α⃗z,a |z1 , . . . , zi−1 , b, zi+1 , . . . , zt ⟩
(7.50)
b∈{z / j :j̸=i} a∈{zj :j̸=i} ⃗ z ∈[N ]t−1 dist 2
1 =⇒ ∥Ai |ϕ⟩∥2 = (N − t + 1)2
X
X
X
b∈{z / j :j̸=i} ⃗ z ∈[N ]t−1 dist
α⃗z,a
(7.51)
a∈{zj :j̸=i} 2
1 = N −t+1 ≤
≤
t−1 N −t+1
X
X
⃗ z ∈[N ]t−1 dist
a∈{zj :j̸=i}
X
X
α⃗z,a α⃗z,a
(7.52) 2
(7.53)
a∈{zj :j̸=i} ⃗ z ∈[N ]t−1 dist
t−1 t−1 ∥|η⟩∥2 = 1 − ∥|ϕ⟩∥2 N −t+1 N −t+1
(7.54)
On the first line we expanded out the definition of |ϕ⟩, and on the second line we expanded out the application of Ai . On the third line, we plug in Eq. (7.46), the fourth is by the definition of the Euclidean norm, and the fifth uses that |{zj : j ̸= i}| = t − 1. The sixth line follows by an application of Cauchy Schwarz, and on the last line, we use that the remaining sum is over non-distinct basis states and is therefore bounded by ∥|η⟩∥2 = 1 − ∥|ϕ⟩∥2 .
103
We therefore conclude that t
∥|ϕ⟩∥2 ≤
N −t+1 X ∥Ai |ϕ⟩∥2 N − 2t + 2
(by Equation (7.44))
t(t − 1) (1 − ∥|ϕ⟩∥2 ) N − 2t + 2
(by Equation (7.54))
i=1
≤ Rearranging gives
∥|ϕ⟩∥2 ≤
t(t − 1) t(t − 1) ≤ . N − 2t + 2 + t(t − 1) N −t+1
Since this holds for every |ψ⟩ in the optimization in Eq. (7.22), this gives the claimed bound, which completes the proof of Lemma 7.15. We can now prove Theorem 7.7: Proof of Theorem 7.7. First, i h EC Tr ΠDNPN,t C ⊗t ρ(C † )⊗t i h = EC Tr ΠDNPN,t C ⊗t ρ(C † )⊗t ΠDNPN,t h i ≥ EC Tr ΠDistN,t ΠNoPlusN,t C ⊗t ρ(C † )⊗t ΠNoPlusN,t ΠDistN,t − c(DistN,t , NoPlusN,t )2
(7.55) (7.56)
(by Corollary 7.13) i h t(t − 1) ≥ EC Tr ΠDistN,t ΠNoPlusN,t C ⊗t ρ(C † )⊗t ΠNoPlusN,t ΠDistN,t − (by Lemma 7.15) N −t+1 h i (7.57) ≥ 1 − 4 · EC Tr (I − ΠDistN,t )C ⊗t ρ(C † )⊗t h i t(t − 1) − 4 · EC Tr (I − ΠNoPlusN,t )C ⊗t ρ(C † )⊗t − (by Lemma 7.8) N −t+1 i h (7.58) = 1 − 4 1 − EC Tr ΠDistN,t C ⊗t ρ(C † )⊗t i h t(t − 1) − − 4 1 − EC Tr ΠNoPlusN,t C ⊗t ρ(C † )⊗t (since Tr C ⊗t ρ(C † )⊗t = 1) N −t+1 4t(t − 1) 4t t(t − 1) ≥1− − − (by Lemmas 7.1 and 7.3) N +1 N N −t+1 6t2 (7.59) ≥1− N −t+1 which is 1 − O(t2 /N ).
7.2
The Action of the Partition Algebra on the Distinct Nonplussed Subspace
Lemma 7.19. Let D ∈ B(Pt (N )) be a partition diagram, and let S(·) denote the Schur representation (Definition 3.16) of Pt (N ). Then S(D) ΠDNPN,t = 0 if and only if D is not a permutation diagram. Proof. The “only if” direction is straightforward, since S(D) is unitary if D is a permutation. For the “if” direction, assuming that D is not a permutation diagram, there are one of two possible cases to consider: a) D has a connected component with at least two vertices in the input row, and/or 104
b) D has a singleton in the input row. This is because if no two input vertices are in the same connected component, and every input vertex is propagating (no singletons), then the input vertices must each connect to a distinct output vertex, producing a permutation. First, assume that D has a connected component C1 containing two input vertices iin and jin . By definition of the Schur representation, all summands in Eq. (3.10) will have ⟨yi | = ⟨yj |, which implies that S(D) |⃗z⟩ = 0 unless zi = zj . Therefore, S(D) |ψ⟩ = 0 for all |ψ⟩ ∈ DistN,t . Next, assume that D has a singleton iin in the input row. Again using Eq. (3.10), this implies that S(D) factors as V ⊗ ⟨+|i , where V : (CN )⊗t−1 → (CN )⊗t . V ⊗ ⟨+|i annihilates all states that are orthogonal to |+⟩i , including all states of the form |ψ⟩ ⊗ (|1⟩ − |zt ⟩) (Eq. (7.3)). Therefore, S(D) |ψ⟩ = 0 for all |ψ⟩ ∈ NoPlusN,t . Combining the two cases, it follows that S(D) ΠDNPN,t = 0
(7.60)
Lemma 7.20. SchurPt (N ) maps the distinct nonplussed subspace DNPN,t to the subspace spanned by (SN , Pt (N ))-Schur basis states |λ, X, Y ⟩ with |λ| = t. In order to prove Lemma 7.20, we first show that an irrep of Pt (N ) which annihilates all non-permutation diagrams must correspond to a full-box irrep, i.e. |λ| = t: Lemma 7.21. Let J ⊴ Pt (N ) be the two-sided ideal spanned by all non-permutation diagrams in B(Pt (N )).52 Then, ρλ (J) = 0 if and only if |λ| = t. Proof. The “if” direction follows from [FND26] Theorem 4.17, which proves that if |λ| = t, then ρλ (D) = 0 for all diagrams D with fewer than t propagating components.53 The only diagrams in B(Pt (N )) with t propagating components are permutation diagrams, which implies that ρλ (j) = 0 for all j ∈ J. To prove the reverse direction, note that there is a bijection between the irreps of Pt (N )/J and the irreps of Pt (N ) which annihilate J ([EH18], Lemma 2.37, Lemma 3.5): {λ : λ ∈ P\ t (N ),
ρλ (j) = 0 for all j ∈ J}
⇐⇒
{λ′ : λ′ ∈ Pt\ (N )/J}
(7.61)
Since Pt (N )/J ≃ C[St ] ([HR05], Equation 2.11), the number of irreducible representations of Pt (N ) which annihilate J is equal to the number of irreducible representations of C[St ]. These are indexed by partitions of t. Since the t-box irreducible representations of Pt (N ) already annihilate J, it follows that no other irreducible representation of Pt (N ) (with |λ| < t) can annihilate J. Proof of Lemma 7.20. We begin with the forward direction, and let j ∈ J, where J is defined as in Lemma 7.21. For any |ψ⟩ ∈ (CN )⊗t , we can write the state S(j) |ψ⟩ in the (SN , Pt (N ))-Schur basis as follows: 52 53
That J is in fact a two-sided ideal is a consequence of [HR05], Equation 1.3. A connected component is propagating if it intersects both the input and output rows of the diagram.
105
|ψ⟩ =
X
αλ,X,Y |λ, X, Y ⟩
(7.62)
αλ,X,Y |λ, X⟩ ⊗ ρλ (j) |Y ⟩
(7.63)
λ∈P\ t (N ), (N −|λ|,λ) X∈B(VS ), N
Y ∈B(VPλ (N ) ) t
=⇒ S(j) |ψ⟩ =
X λ∈P\ t (N ), (N −|λ|,λ) X∈B(VS ), N
Y ∈B(VPλ (N ) ) t
Next, fix some λ with |λ| < t. By Lemma 7.21, there is some k ∈ J such that ρλ (k) ̸= 0. Therefore, ρλ (J) is a non-zero ideal of ρλ (A). But since λ is an irrep, ρλ (A) is a simple algebra, which has no non-zero proper ideals. Therefore, ρλ (J) = ρλ (A), and so there exists jλ ∈ J such that ρλ (jλ ) = ρλ (1) = IV λ , where 1 is the identity diagram in A. Pt (N )
Setting j = jλ in Eq. (7.63) implies that the coefficient on |λ, X, Y ⟩ in S(jλ ) |ψ⟩ equal to αλ,X,Y . But, if |ψ⟩ ∈ DNPN,t , then Lemma 7.19 implies that S(jλ ) |ψ⟩ = 0, so αλ,X,Y = 0. Since λ was chosen arbitrarily among all irreps with fewer than t boxes, it follows that in the (SN , Pt (N ))-Schur basis, |ψ⟩ is supported entirely on full-box irreps. For the reverse direction, assume that in the (SN , Pt (N ))-Schur basis, |ψ⟩ is supported entirely on states |λ, X, Y ⟩ with |λ| = t. By Lemma 7.21, ρλ (J) = 0, and so the block-diagonal decomposition on the right hand side of Eq. (7.63) implies that S(j) |ψ⟩ = 0 for all j ∈ J. In particular, S(Bij ) |ψ⟩ = 0, where Bij is the diagram with a single block containing the input and output vertices in columns i and j, with all other blocks propagating vertically along a single column. From Definition 3.16, it follows S(Bij ) is the equality projector between registers i and j, and therefore ∀i, j, S(Bij ) |ψ⟩ = 0 =⇒ |ψ⟩ ∈ DistN,t .
(7.64)
Similarly, we also have that S(Pi ) |ψ⟩ = 0, where Pi is the diagram containing singleton in the ith column, again all other blocks propagating vertically along a single column. In this case, S(Pi ) is proportional to the projector onto I ⊗ |+⟩i , and so ∀i, S(Pi ) |ψ⟩ = 0 =⇒ |ψ⟩ ∈ NoPlusN,t
(7.65)
Combining the equations above, we conclude that |ψ⟩ ∈ DistN,t ∩ NoPlusN,t = DNPN,t . 7.2.1
The Dual of a Permutation Element
Next, we prove a lemma which relates the dual of a permutation π ∈ C[St ] with the dual of the same permutation, but in the partition algebra Pt (N ): Lemma 7.22. For any π ∈ B(C[St ]), let π ∗Pt (N ) denote the dual element of π with respect to Pt (N ), and let π ∗C[St ] denote the dual element of π with respect to C[St ]. For any σ ∈ B(C[St ]), ⟨π ∗C[St ] , σ⟩2 = ⟨π ∗Pt (N ) , σ⟩2
(7.66)
Equivalently, the expansions of π ∗C[St ] and π ∗Pt (N ) in the basis B(Pt (N )) agree on all permutations σ ∈ B(C[St ]). (Consequently, among all elements of St only π −1 appears in this expansion. )
106
Proof. Since C[St ] is a group algebra, π ∗C[St ] = π −1 /|St |. So, it suffices to show that ⟨π ∗Pt (N ) , σ⟩2 =
δπ−1 ,σ δπ−1 ,σ = |St | t!
(7.67)
As in Lemma 7.20, we let J ⊴ Pt (N ) be the two-sided ideal spanned by all non-permutation diagrams, so that we have the canonical quotient map q : Pt (N ) −→ Pt (N )/J,
(7.68)
a 7−→ a + J.
Moreover, since Pt (N ) is semisimple, there exists a central idempotent54 e such that [Lam01]: Pt (N ) ≃ ePt (N ) ⊕ J
(7.69)
Therefore, ePt (N ) ≃ Pt (N )/J, with one possible isomorphism given by restricting the quotient map in Eq. (7.68): ∼ qe : ePt (N ) − → Pt (N )/J, (7.70) ea 7−→ ea + J. By definition, qe (e) = qe (e · 1) = e + J. Moreover, e is a unit in ePt (N ), so e also maps to 1 + J, where 1 is the identity permutation. Therefore, 1 + J = e + J, which implies that e = 1 + j for some j ∈ J. Using that e = 1 + j, we now show that π ∗Pt (N ) = π −1 e/t!: 1 ⟨D, π −1 e⟩regPt (N ) t! X 1 ⟨E, Dπ −1 e · E⟩2 = t!
⟨D, π ∗Pt (N ) ⟩regPt (N ) =
(7.71) (Definition of ⟨·, ·⟩regPt (N ) )
E∈B(Pt (N ))
1 = t!
X
⟨E, eDπ −1 E⟩2
E∈B(Pt (N ))
1 = · δD∈B(C[St ]) t! = =
(e is central in Pt (N ))
1 ·δ t! D∈B(C[St ]) 1 ·δ t! D∈B(C[St ])
X
⟨σ, eDπ −1 σ⟩2
(ePt (N ) ∩ J = {0}, Eq. (7.69))
σ∈B(C[St ])
X
⟨σ, (1 + j)Dπ −1 σ⟩2
(7.72)
σ∈B(C[St ])
X
⟨σ, Dπ −1 σ⟩2
(⟨σ, k⟩ = 0 for all k ∈ J)
σ∈B(C[St ])
1 ·δ · (δD,π · t!) t! D∈B(C[St ]) = δD,π =
54
(Eq. (3.12)) (7.73)
A central idempotent e ∈ A is an element satisfying ea = ae for all a ∈ A, and e2 = e. If a semisimple algebra A decomposed into a direct sum I ⊕ J of two ideals, then both I and J must be of the form eA for some central idempotent e. See the discussion at the start of Chapter 22 in [Lam01].
107
Finally, since π ∗Pt (N ) = π −1 e/t!, 1 −1 ⟨π e, σ⟩2 t! 1 = ⟨π −1 (1 + j), σ⟩2 t! 1 = ⟨π −1 , σ⟩2 t! 1 = · δπ−1 ,σ t!
⟨π ∗Pt (N ) , σ⟩2 =
(7.74) (7.75) (⟨σ, k⟩ = 0 for all k ∈ J) (7.76)
This matches Eq. (7.67), concluding the proof.
7.3
Additional Properties of the Update Operators
We give some useful properties of the update operators in the path-recording basis of Section 5. Lemma 7.23 (ΛSt commutes with permutation-respecting maps on RX or RY ). Let MRX be a linear transformation such that M · S(π) = S(π) · M for every permutation π ∈ St . Then, MRX ⊗ IRY commutes with ΛSt . This applies to M ∈ {ΠDist , ΠNoPlus , ΠDNP , ΠFDist NoPlus } (the latter is defined below). The analogous statement holds for MRY . Proof. By Theorem 3.11, we know that M (as an operator on (CN )⊗t ) is in the span of {U ⊗t }U ∈U (N ) . As a result, in the Schur basis, M is block-diagonal with respect to the irrep VUλ(N ) ⊗ VAλt . Since ΛSt is block-diagonal on the |λ⟩ ⊗ |λ′ ⟩ irrep spaces and acts as a scalar on each of them, we conclude that ΛSt commutes with MRX ⊗ I and I ⊗ MRY . Y X Y Lemma 7.24 (ΛPt (N ) commutes with ΠX DNP and ΠDNP ). ΛPt (N ) commutes with ΠDNP and ΠDNP .
Proof. For ΠX DNP , this follows directly from the fact that ΠDNP projects, in the (SN , Pt (N ))-Schur basis, onto irrep spaces with |λ| = t (Lemma 7.20). ΠYDNP and ΛPt (N ) act on disjoint registers. q Lemma 7.25 (ΛPt (N ) is approximately Nt!t I on full-box irreps). t! Nt
2 2 t! t t X,Y X,Y † X,Y 1−O · ΠDNP ⪯ ΠDNP ΛPt (N ) ΛPt (N ) ΠDNP ⪯ t 1 + O · ΠX,Y DNP N N N
(7.77)
Proof. We have Nt X Nt † 2 Λ Λ ΠDNP − ΠDNP = βλ,t Πλ,t ΠDNP − ΠDNP t! Pt (N ) Pt (N ) t! λ∈Pbt (N ) =
X Nt X 2 Πλ,t βλ,t Πλ,t − t! λ∈Pbt (N ) |λ|=t
=
X Nt 2 β − 1 Πλ,t t! λ,t λ∈Pbt (N ) |λ|=t
108
(7.78)
(Lemma 7.20)
λ∈Pbt (N ) |λ|=t
(7.79)
Nt 2 βλ,t − 1 λ∈Pbt (N ) t!
≤ max
(7.80)
|λ|=t
2 t ≤O . N
(Lemma 3.32)
Lemma 7.26 (ΩAt on the Distinct Nonplussed Subspace). Let ΠX ΠYDNP := ΠDNPN,t R , DNP := ΠDNPN,t R , X
Y
X Y ΠX,Y DNP := ΠDNP ΠDNP .
Let ΩPt (N ) denote the commutant EPR projector for the partition algebra Pt (N ), and let ΩSt := ΩC[St ] denote the commutant EPR projector for the symmetric group algebra. Then: [ΠX DNP , ΩPt (N ) ] = 0,
[ΠYDNP , ΩPt (N ) ] = 0,
(7.81)
[ΠX DNP , ΩSt ] = 0,
[ΠYDNP , ΩSt ] = 0,
(7.82)
and X,Y ΩSt ΠX,Y DNP = ΩPt (N ) ΠDNP .
Proof. We prove the three identities in order. First, let Π|λ|=t :=
X
(7.83)
Πλ
λ∈P\ t (N ) |λ|=t
be the projector onto the full-box irreps in the (SN , Pt (N ))-Schur decomposition of (CN )⊗t . By Lemma 7.20, Π|λ|=t = ΠDNPN,t . Thus ΠX DNP = (Π|λ|=t )RX ,
ΠYDNP = (Π|λ|=t )RY .
In the double Schur basis, ΩPt (N ) is block-diagonal with respect to the irrep labels (λ, λ′ ). Since (Π|λ|=t )RX and (Π|λ|=t )RY are just projections onto a subset of these blocks, we immediately obtain that they commute with ΩPt (N ) . Second, the symmetric-group commutant EPR projector (Example 5.12) has the form ΩSt =
1 X S(π)RX ⊗ S(π)RY , t! π∈St
For every π ∈ St , the operator S(π) only permutes the t tensor factors. The subspace DistN,t is invariant under tensor-factor permutations, and NoPlusN,t = (I − |+⟩⟨+|)⊗t is also invariant under tensor-factor permutations. Hence DNPN,t = DistN,t ∩ NoPlusN,t 109
is invariant under every S(π). Therefore ∀π ∈ St .
S(π)ΠDNPN,t = ΠDNPN,t S(π)
Commuting term by term in the displayed formula for ΩSt , we obtain [ΠX DNP , ΩSt ] = 0,
[ΠYDNP , ΩSt ] = 0.
For the third claim, we have the following calculation
(t) ΩPt (N ) · ΠX,Y DNP R X = S(D) ⊗ S(D∗Pt (N ) )T · ΠX,Y DNP
(7.84) (Lemma 5.11)
D∈B(Pt (N ))
! =
X
· ΠX,Y DNP
S(π) ⊗ S([π]∗Pt (N ) )T
(Lemma 7.19)
π∈St
P Next, we expand [π]∗Pt (N ) in the basis of Pt (N ) as E∈B(Pt (N )) απ,E E: X X S(π) ⊗ απ,E S(E)T · ΠX,Y DNP π∈St
(7.85)
E∈B(Pt (N ))
X
=
απ,π′ S(π ′ )T · ΠX,Y DNP
X
S(π) ⊗
(Lemma 7.19)
π ′ ∈C[St ]
π∈St
! X
=
S(π) ⊗ S([π]
· ΠX,Y DNP
∗C[St ] T
)
(Lemma 7.22)
π∈St
(t)
= ΩC[St ]
7.4
R
· ΠX,Y DNP .
Updates in the Distinct Nonplussed Subspace
Let VSN and VU (N ) be the update operators when G = SN or U (N ), respectively. In this case, the commutant algebra At is equal to respectively either Pt (N ) or C[St ], so Corollary 5.18 becomes VS
Advt N
·C
= ΛPt (N ) · ΩPt (N ) · C ⊗t R
|
{z
ΛC[St ]
R
} |
V
Advt U (N )
·C
=
|
R
} |
{z
R
} |
VS
·C
{z
} | {z } |
C ⊗t
· ΩC[St ] · C ⊗t
{z
ReweightEnd
{z
Symmetrize
ReweightEnd
RX
} |
{z
C ⊗t
Symmetrize
+ · AdvApp · Λ t P0 (N ) Append
RX
{z
(7.86)
}
ReweightStart
+ · AdvApp · Λ t P0 (N )
} | {z } | Append
R0
{z
R0
(7.87)
}
ReweightStart
Let Advt N V
Advt U (N )
VS
·C
E
:= Advt N
E ·C
:= Advt U (N )
V
110
(|0⟩AB ⊗ |∅⟩R )
·C
(|0⟩AB ⊗ |∅⟩R )
(7.88) (7.89)
V
·C
Lemma 7.27. We can rearrange the terms in Advt U (N ) so that C ⊗t appears at the end, as V ·C + · ΛC[St ] · ΩC[St ] · AdvApp · Λ (7.90) Advt U (N ) = C ⊗t t C[S0 ] R RX R R 0 V Advt U (N ) = C ⊗t (7.91) RX
Proof. To see this, it suffices to show that C ⊗t commutes with both ΩC[St ] and ΛC[St ] . This is clear when viewing the three operators in the Schur basis. All three are controlled by the irrep label, and C ⊗t acts only on the unitary (group) register, while ΩC[St ] acts only on the commutant register, and ΛC[St ] is proportional to the identity within each block. Lemma 7.28 (Analyzing ΠYDist AdvApp |0⟩). Let t |ψt ⟩ABR := AdvApp |0⟩ t be the unnormalized append-only state,55 and let DtY := (ΠDistN,t )RY . For every non-identity π ∈ St , ⟨ψt | DtY S(π) ⊗ S(π) DtY |ψt ⟩ = 0. Also, ⟨ψt | DtY |ψt ⟩ = N t ·
2 t Y i−1 t t 1− =N · 1−O . N N i=1
Proof. We prove the claim by induction on t. The case t = 1 is trivial (there are no non-identity permutations and D1Y = I). For the inductive step, we write |ψt ⟩ = AppARt · (At )AB · |ψ⟩t−1 = AppARt |ψtpre ⟩ . Y Y Moreover, since DtY = DtY · Dt−1 and Dt−1 commutes with AppARt , we have that Y DtY |ψt ⟩ = DtY · AppARt · Dt−1 |ψtpre ⟩ .
We now write explicitly in the standard basis X Y Dt−1 |ψtpre ⟩ = |xt ⟩A ϕx1:t ,y1:t−1 B |x1 , . . . xt−1 , y1 , . . . , yt−1 ⟩R<t . x1 ,...,xt distinct y1 ,...,yt−1
On this state, the effect of DtY · AppARt is appending with respect to an (unnormalized) EPR state over yt ∈ / {y1 , . . . , yt−1 } (controlled on {y1 , . . . , yt−1 }), which tells us that X DtY |ψt ⟩ = |yt ⟩A ϕx1:t ,y1:t−1 B |x1 , . . . xt , y1 , . . . , yt ⟩R≤t . x1 ,...,xt distinct y1 ,...,yt
55
For brevity, we will write |0⟩ to represent |0⟩AB |∅⟩R .
111
Y Given that Dt−1 also commutes with (At )AB , this immediately tells us that
DtY |ψt ⟩
2
Y |ψt−1 ⟩ = N − (t − 1) Dt−1
2
,
completing the first part of the induction. For the second part, we have that X |yt ⟩A ϕx1:t ,y1:t−1 B xπ−1 (1) , . . . xπ−1 (t) , yπ−1 (1) , . . . , yπ−1 (t) R S(π)⊗S(π) DtY |ψt ⟩ = x1 ,...,xt distinct y1 ,...,yt
≤t
.
Now, suppose that π(t) ̸= t. Then, the inner product of these two states is zero because a nonzero term in the expansion of this inner product would require terms yt = yt′ for the A register but also yπ−1 (t) = yπ′ −1 (t) for the RY,t register. On the other hand, suppose that π(t) = t and identify π as an element of St−1 ; in particular, S(π) commutes with AppARt · (At )AB . Then, we write Y Y ⟨ψt | DtY S(π) ⊗ S(π) DtY |ψt ⟩ = ⟨ψtpre | Dt−1 App†A,Rt DtY AppA,Rt Dt−1 S(π) ⊗ S(π) |ψtpre ⟩ Next, we make use of the identity Y Y Y Dt−1 App†A,Rt DtY AppA,Rt Dt−1 = (N − t + 1)Dt−1 , Y which again holds because the effect of DtY AppA,Rt on the image of Dt−1 is to append an unnormalized EPR state over yt ∈ / {y1 , . . . , yt−1 }: X Y DtY AppA,Rt Dt−1 = |yt ⟩⟨xt |A ⊗ |x1 , . . . , xt , y1 , . . . , yt ⟩⟨x1 , . . . , xt−1 , y1 , . . . , yt−1 | . x1 ,...xt distinct y1 ,...,yt
The claimed identity follows from this by a direct computation. We conclude that Y ⟨ψt | DtY S(π) ⊗ S(π) DtY |ψt ⟩ = (N − t + 1) ⟨ψtpre | Dt−1 S(π) ⊗ S(π) |ψtpre ⟩ Y Y = (N − t + 1) ⟨ψt−1 | Dt−1 (A†t )AB S(π) ⊗ S(π) (At )AB Dt−1 |ψt−1 ⟩ Y Y = (N − t + 1) ⟨ψt−1 | Dt−1 S(π) ⊗ S(π) Dt−1 |ψt−1 ⟩ . This completes the induction. In order to argue about ΠNoPlus , we pass to a “smaller” projection, X ΠFDist := |b y1 , . . . , ybt ⟩⟨b y1 , . . . , ybt | NoPlus RY
(7.92)
yb1 ,...,b yt distinct and ̸=0
= FN⊗t · (I − |0⟩⟨0|)⊗t · ΠYDist · (FN† )⊗t ,
(7.93)
−yz N z∈ZN ωN |z⟩ denotes the yth ZN Fourier basis element of C and FN denotes the ZN quantum Fourier transform. In other words, ΠFDist NoPlus projects, in the ZN Fourier basis, onto
where |b y ⟩ := √1N
P
distinct tuples of nonzero basis states.
112
App Lemma 7.29 (Analyzing ΠFDist |0⟩). Let NoPlus Advt
|ψt ⟩ABR := AdvApp |0⟩ t be the unnormalized append-only state, and let DtY := (ΠFDist NoPlus )RY . For every non-identity π ∈ St , ⟨ψt | DtY S(π) ⊗ S(π) DtY |ψt ⟩ = 0. Also, ⟨ψt | DtY |ψt ⟩ = N t ·
2 t Y t i t =N · 1−O . 1− N N i=1
Proof sketch. The proof is extremely similar to that of Lemma 7.28, again proceeding by induction on t. The case t = 1 is again trivial. For the inductive step, we use the same decomposition |ψt ⟩ = AppARt · (At )AB · |ψ⟩t−1 = AppARt |ψtpre ⟩ and equation Y DtY |ψt ⟩ = DtY · AppARt · Dt−1 |ψtpre ⟩ . Y |ψ pre ⟩ with R in the Fourier basis: Next, we write Dt−1 Y t X Y Dt−1 |ψtpre ⟩ = |xt ⟩A ϕx1:t ,y1:t−1 B |x1 , . . . xt−1 , yb1 , . . . , ybt−1 ⟩R<t . x1 ,...,xt distinct y1 ,...,yt−1 ̸=0
On this state, the effect of DtY · AppARt is appending with respect to an (unnormalized) Fourier basis EPR state X d − yt |ybt ⟩ yt ∈{0, / y1 , ..., yt−1 }
over yt ∈ / {0, y1 , . . . , yt−1 } (controlled on {y1 , . . . , yt−1 }), which tells us that X d DtY |ψt ⟩ = − yt A ϕx1:t ,y1:t−1 B |x1 , . . . xt , yb1 , . . . , ybt ⟩R≤t . x1 ,...,xt distinct y1 ,...,yt ̸=0
This again completes the inductive norm calculation. In addition, an identical argument now shows that ⟨ψt | DtY S(π) ⊗ S(π) DtY |ψt ⟩ = 0 whenever π(t) ̸= t. On the other hand, if π(t) = t, then an entirely analogous argument shows that Y Y ⟨ψt | DtY S(π) ⊗ S(π) DtY |ψt ⟩ = (N − t) ⟨ψt−1 | Dt−1 S(π) ⊗ S(π) Dt−1 |ψt−1 ⟩ (the only difference is that the factor (N − t) replaces (N − t + 1), from ruling out 0 in addition to y1 , . . . , yt−1 ), completing the induction. Lemma 7.30. Let ΠDNPN,t be the orthogonal projector onto the distinct nonplussed subspace (Definition 7.5). Then 2 E 2 t VU (N ) Y ΠDNP Advt ≥1−O (7.94) N 113
Proof. By Corollary 7.13 and Lemma 7.15, we have that ΠYDNP
V Advt U (N )
E
2
≥
ΠYDist · ΠYNoPlus
V Advt U (N )
E
2
2 t −O N
Thus, by the quantum union bound (Lemma 7.8), it suffices to prove the lemma statement for ΠYDist and ΠYNoPlus rather than ΠYDNP . For ΠYDist , we begin by writing E V ΠYDist Advt U (N ) = ΠYDist · ΛSt · ΩSt · AdvApp |0⟩ (7.95) t = ΛSt · ΩSt · ΠYDist · AdvApp |0⟩ . t
(by Lemmas 7.23 and 7.26)
Now, by Lemma 7.28, we have that ΩSt · ΠYDist · AdvApp |0⟩ t
1 (t!)2
2
=
X
(S(π) ⊗ S(π)) · ΠYDist · AdvApp |0⟩ t
2
(definition of ΩSt )
π∈St
2 1 Y ΠDist · AdvApp |0⟩ (by the first part of Lemma 7.28) = t t! t2 Nt 1−O . (by the second part of Lemma 7.28) ≥ t! N 2 t Finally, we know from Lemma 6.5 that Λ2St ⪰ Nt!t 1 − O N · I, so we conclude that V
ΠYDist Advt U (N )
E 2
2
|0⟩ = ΛSt · ΩSt · ΠYDist · AdvApp t t2 2 t! |0⟩ ≥ t 1−O ΩSt · ΠYDist · AdvApp t N 2 N t ≥1−O . N
(7.96) (7.97) (7.98)
Next, to handle ΠNoPlus , we use the fact that V
ΠNoPlus Advt U (N )
E
2
V
U (N ) ≥ ΠFDist NoPlus Advt
E
2
.
(7.99)
An identical argument to the above then proves that V
U (N ) ΠFDist NoPlus Advt
E
2
≥1−O
t2 N
.
(7.100)
This completes the proof. Lemma 7.31. Let C be sampled from a unitary 2-design D, and let ΠDNPN,t be the orthogonal projector onto the distinct nonplussed subspace (Definition 7.5). Then 2 h ED i t VU (N ) · C VU (N ) · C X,Y (7.101) E Tr ΠDNP Advt Advt ≥1−O C←D N Y Proof. By a union bound, it suffices to prove the same statement for ΠX DNP and ΠDNP separately. For ΠX DNP this follows directly from Lemma 7.27 and Theorem 7.7.
114
For ΠYDNP , we begin with Lemma 7.27, which tells us that E 2 E V V ·C = E ΠYDNP CR⊗tX Advt U (N ) E ΠYDNP Advt U (N ) C C E V = E CR⊗tX ΠYDNP Advt U (N ) C E 2 V , = ΠYDNP Advt U (N )
2
(7.102) 2
(7.103) (7.104)
as CR⊗tX is unitary and commutes with ΠYDNP . The conclusion now follows from Lemma 7.30. Lemma 7.32. Let C be sampled from a unitary 2-design D, and let ΠX,Y DNP be the distinct nonplussed subspace projector. Then 2 h ED i t VSN · C VSN · C X,Y E Tr ΠDNP Advt Advt ≥1−O (7.105) C←D N Proof. VS
N E ΠX,Y DNP Advt
·C
E 2
App ⊗t |0⟩ = E ΠX,Y DNP · ΛPt (N ) · ΩPt (N ) · CRX · Advt
2
(7.106)
C
C
App ⊗t |0⟩ = E ΛPt (N ) · ΠX,Y DNP · ΩPt (N ) · CRX · Advt
2
(Lemma 7.24)
C
2
= E ΛPt (N ) · ΠX,Y · ΩSt · CR⊗tX · AdvApp |0⟩ (Lemma 7.26) t DNP C 2 2 t · ΩSt · CR⊗tX · AdvApp |0⟩ 1−O ≥ E ΛSt · ΠX,Y t DNP C N (Lemmas 6.5 and 7.25) 2 2 t App ⊗t · Adv |0⟩ = E ΠX,Y · Λ · Ω · C 1 − O (Lemma 7.23) St St t DNP RX C N 2 E 2 t VU (N ) · C X,Y 1−O = E ΠDNP Advt (7.107) C N 2 t ≥1−O (Lemma 7.31) N Corollary 7.33. Using Lemmas 6.1, 7.31 and 7.32 we get the following trace distance bounds: 2 ED ED t VU (N ) · C VU (N ) · C VU (N ) · C VU (N ) · C X,Y X,Y Advt Advt TrR E Advt − TrR E ΠDNP Advt ΠDNP ≤O C←D C←D N 1 (7.108) TrR
7.5
E
C←D
VS
Advt N
·C
ED
VS
Advt N
·C
− TrR
VS
N E ΠX,Y DNP Advt
C←D
·C
ED
VS
Advt N
·C
ΠX,Y DNP
2 t N (7.109)
≤O 1
Putting it Together
Finally, we compare the cases G = U (N ) and G = SN of Corollary 5.18, and show that the G-dependent steps are close in expectation whenever C is sampled from a unitary 2-design. This implies that queries to P C for a random permutation matrix P ∈ SN are (nearly) indistinguishable from queries to U C = U ′ for a Haar random unitary U ∈ U (N ), leading to the conclusion that P C is a pseudorandom unitary for any pseudorandom permutation P and any unitary 2-design C. 115
Theorem 7.34. h E
P ←SN C←D
|AdvPt · C ⟩⟨AdvPt · C |
i
−
h E
U ←U (N )
U |AdvU t ⟩⟨Advt |
2 t ≤O N
i
(7.110)
1
Proof. By the correctness of the path-recording oracles, we know that for every C, ED h i V ·C V ·C Advt U (N ) TrR Advt U (N ) = E AdvtU ·C AdvtU ·C = E AdvU AdvU t t U ←U (N )
U ←U (N )
(7.111)
and ED h i VS · C VS · C Advt N TrR Advt N =
E
P ←SN
AdvPt ·C AdvPt ·C .
(7.112)
Therefore, by Corollary 7.33, it suffices to prove that ED ED VSN · C VSN · C VU (N ) · C VU (N ) · C X,Y X,Y X,Y TrR E ΠX,Y Adv Adv Π − Tr E Π Adv Adv Π R t t t t DNP DNP DNP DNP C←D
C←D
1
(7.113) In fact, we prove the following stronger statement: for every fixed C, we have that
ΠX,Y DNP
VS · C Advt N
ED
VS · C Advt N
X,Y ΠX,Y DNP − ΠDNP
V ·C Advt U (N )
ED
V ·C Advt U (N )
ΠX,Y DNP
2 t ≤O N 1 (7.114)
To see this, we make use of the standard manipulation VS
N ΠX,Y DNP |Advt
·C
VS
·C
V
X,Y U (N ) ⟩⟨Advt N | ΠX,Y DNP − ΠDNP |Advt E E VSN · C VU (N ) · C X,Y − Π Adv ≤2 · ΠX,Y Adv t t DNP DNP
·C
V
⟩⟨Advt U (N )
·C
| ΠX,Y DNP
1
(7.115)
Now, given that our starting state is empty, we can write (for both V = VU (N ) and V = VSN ) AdvVt ·C = ΛAt · ΩAt · C ⊗t · AdvApp · |0⟩ . (7.116) t R≤t
Letting |ψ⟩ = C ⊗t
·C
E
VS
N ΠX,Y DNP Advt
RX
R≤t
RX
· AdvApp · |0⟩, we have t V
U (N ) − ΠX,Y DNP Advt
·C
E
= ΠX,Y Λ Ω − Λ Ω St St |ψ⟩ Pt (N ) Pt (N ) DNP X,Y = ΛPt (N ) ΠX,Y Ω − Λ Π Ω St DNP St |ψ⟩ DNP Pt (N ) = ΛPt (N ) − ΛSt ΠX,Y DNP ΩSt |ψ⟩ E VU (N ) · C + = ΛPt (N ) − ΛSt ΠX,Y Λ Adv t DNP St + ≤ ΛPt (N ) − ΛSt ΠX,Y DNP · ΛSt .
116
≤O
(7.117) (7.118) (7.119) (7.120) (7.121)
2 t N
By Lemmas 6.5 and 7.25, on the full-box/DNP blocks the squared reweighting matrices Λ†Pt (N ) ΛPt (N ) and Λ†C[St ] ΛC[St ] differ by a multiplicative 1 + O(t2 /N ). Taking square roots preserves this error up to constants, so it follows that r t2 t! X,Y ΛPt (N ) − ΛSt ΠDNP ≤ · O . (7.122) Nt N Similarly, by Lemma 6.5 we have that r Λ+ St
≤
t2 Nt · 1+O . t! N
(7.123)
This completes the proof of the theorem. The following corollary formalizes Theorems 1.6 and 1.7 to conclude that Pk · C is either a pseudorandom unitary or a t-design, if Pk is instantiated with respectively either a pseudorandom permutation or a 2t-wise independent permutation. Corollary 7.35. Suppose that Pk is a (t, ε)-secure in-place post-quantum PRP, meaning that for all polynomial-time t-query quantum algorithms Adv, we have that AdvPk ≈ε AdvP for a uniformly random permutation unitary P . Moreover, let C ← D be a unitary sampled from an exact unitary 2-design. Then, Pk · C is a (t, ε + O(t2 /N ))-secure PRU. Moreover, if Pk is secure against inefficient Adv, so is Pk · C. Proof. This immediately follows from Theorem 7.34 and a hybrid argument switching Pk to a uniformly random P .
Acknowledgements The authors thank Henry Yuen, John Bostanci, Quynh Nguyen, Natalie Parham, Angelos Pelecanos, Mark Zhandry, Joe Carolan, and Takashi Yamakawa for helpful discussions. This work was done in part while AL and BN were visiting the Simons Institute for the Theory of Computing, where BN was supported by NSF QLCI Grant No. 2016245. BN acknowledges the following funding sources: AFOSR award FA9550-23-1-0363, NSF awards CCF-2530159, CCF2144219, and CCF-2329939, and the Sloan Foundation. AL was supported in part by NSF CAREER award CNS-2541300 and an E. Lawrence Keyes, Jr./Emerson Electric Co. Faculty Award. J.W. was supported by the NSF CAREER award CCF-233971 and a fellowship from the Sloan Foundation.
References [AAB+ 19]
Frank Arute, Kunal Arya, Ryan Babbush, Dave Bacon, Joseph C Bardin, Rami Barends, Rupak Biswas, Sergio Boixo, Fernando GSL Brandao, David A Buell, et al. Quantum supremacy using a programmable superconducting processor. Nature, 574(7779):505– 510, 2019.
[ABGL25a] Prabhanjan Ananth, John Bostanci, Aditya Gulati, and Yao-Ting Lin. Pseudorandom unitaries in the haar random oracle model. In Yael Tauman Kalai and Seny F. Kamara, editors, CRYPTO 2025, Part II, volume 16001 of LNCS, pages 301–333. Springer, Cham, August 2025. 117
[ABGL25b] Prabhanjan Ananth, John Bostanci, Aditya Gulati, and Yao-Ting Lin. Pseudorandomness in the (inverseless) haar random oracle model. In Serge Fehr and Pierre-Alain Fouque, editors, EUROCRYPT 2025, Part VII, volume 15607 of LNCS, pages 138–166. Springer, Cham, May 2025. [AGL25]
Prabhanjan Ananth, Aditya Gulati, and Yao-Ting Lin. On the limitations of pseudorandom unitaries - or: Cryptographic applications of LOCC indistinguishability of identical versus independent haar unitaries. In Benny Applebaum and Huijia (Rachel) Lin, editors, TCC 2025, Part III, volume 16270 of LNCS, pages 69–103. Springer, Cham, December 2025.
[BBBV97]
Charles H Bennett, Ethan Bernstein, Gilles Brassard, and Umesh Vazirani. Strengths and weaknesses of quantum computing. SIAM journal on Computing, 26(5):1510–1523, 1997.
[BCH05]
Dave Bacon, Isaac Chuang, and Aram Harrow. The quantum Schur transform: I. efficient qudit circuits. In Proceedings of the 18th Annual ACM-SIAM Symposium on Discrete Algorithms, 2005.
[BFG+ 25]
Adam Burchardt, Jiani Fei, Dmitry Grinko, Martin Larocca, Maris Ozols, Sydney Timmerman, and Vladyslav Visnevskyi. High-dimensional quantum schur transforms, 2025.
[BG26]
James Bartusek and Eli Goldin. Unclonable encryption in the haar random oracle model. arXiv preprint arXiv:2603.11437, 2026.
[Blo03]
Matthew Bloss. G-colored partition algebras as centralizer algebras of wreath products. Journal of algebra, 265(2):690–710, 2003.
[BR93]
Mihir Bellare and Phillip Rogaway. Random oracles are practical: A paradigm for designing efficient protocols. In Dorothy E. Denning, Raymond Pyle, Ravi Ganesan, Ravi S. Sandhu, and Victoria Ashby, editors, ACM CCS 93, pages 62–73. ACM Press, November 1993.
[Bra37]
Richard Brauer. On algebras which are connected with the semisimple continuous groups. Annals of Mathematics, 38(4):857–872, 1937.
[Car26]
Joseph Carolan. Compressed permutation oracles. In Proceedings of the 58th Annual ACM Symposium on Theory of Computing, STOC ’26, page 150–161, New York, NY, USA, 2026. Association for Computing Machinery.
[CFHL21]
Kai-Min Chung, Serge Fehr, Yu-Hsuan Huang, and Tai-Ning Liao. On the compressedoracle technique, and post-quantum security of proofs of sequential work. In Anne Canteaut and François-Xavier Standaert, editors, EUROCRYPT 2021, Part II, volume 12697 of LNCS, pages 598–629. Springer, Cham, October 2021.
[DR90]
Persi Diaconis and Daniel Rockmore. Efficient computation of the fourier transform on finite groups. Journal of the American Mathematical Society, 3(2):297–332, 1990.
[EH18]
Karin Erdmann and Thorsten Holm. Algebras and Representation Theory. Springer Undergraduate Mathematics Series. Springer, 2018.
118
[FND26]
Ben Foxman, Barak Nehoran, and Yongshan Ding. Efficient quantum fourier transforms for semisimple algebras, 2026.
[FTH23]
Jiani Fei, Sydney Timmerman, and Patrick Hayden. Efficient quantum algorithm for port-based teleportation, 2023.
[Gao15]
Jingliang Gao. Quantum union bounds for sequential projective measurements. Physical Review A, 92(5):052331, 2015.
[GBO23]
Dmitry Grinko, Adam Burchardt, and Maris Ozols. Gelfand-tsetlin basis for partially transposed permutations, with applications to quantum information. arXiv preprint arXiv:2310.02252, 2023.
[GW09]
Roe Goodman and Nolan R Wallach. Symmetry, representations, and invariants, volume 255. Springer, 2009.
[GY25]
Dmitry Grinko and Satoshi Yoshida. Quantum simulation of random unitaries from clebsch-gordan transforms. arXiv preprint arXiv:2509.26623, 2025.
[Hal13]
Brian C Hall. Lie groups, lie algebras, and representations. In Quantum Theory for Mathematicians, pages 333–366. Springer, 2013.
[Har05]
Aram Harrow. Applications of coherent classical communication and the Schur transform to quantum information theory. PhD thesis, Massachusetts Institute of Technology, 2005.
[HJ20]
Tom Halverson and Theodore N Jacobson. Set-partition tableaux and representations of diagram algebras. Algebraic Combinatorics, 3(2):509–538, 2020.
[HLS24]
Yassine Hamoudi, Qipeng Liu, and Makrand Sinha. The NISQ complexity of collision finding. In Marc Joye and Gregor Leander, editors, EUROCRYPT 2024, Part IV, volume 14654 of LNCS, pages 3–32. Springer, Cham, May 2024.
[HR05]
Tom Halverson and Arun Ram. Partition algebras. European Journal of Combinatorics, 26(6):869–921, 2005.
[HY25]
Minki Hhan and Shogo Yamada. Pseudorandom function-like states from common haar unitary. In Benny Applebaum and Huijia (Rachel) Lin, editors, TCC 2025, Part III, volume 16270 of LNCS, pages 134–165. Springer, Cham, December 2025.
[JZ25]
Stacey Jeffery and Sebastian Zur. The compressed oracle is a worthy (multiplicative) adversary. arXiv preprint arXiv:2509.07876, 2025.
[Kin70]
Ronald C King. Generalized young tableaux and the general linear group. Journal of Mathematical Physics, 11(1):280–293, 1970.
[KOMW19] Samad Khabbazi Oskouei, Stefano Mancini, and Mark M. Wilde. Union bound for quantum information processing. Proceedings of the Royal Society A: Mathematical, Physical and Engineering Sciences, 475(2221):20180612, January 2019. [Kro19]
Hari Krovi. An efficient high dimensional quantum schur transform. Quantum, 3:122, 2019.
119
[KS08]
Tali Kaufman and Madhu Sudan. Algebraic property testing: the role of invariance. In Proceedings of the 40th Annual ACM Symposium on Theory of Computing, pages 403–412, 2008.
[KW89]
Selahattin Kayalar and Howard L. Weinert. Oblique projections: formulas, algorithms, and error bounds. Math. Control Signals Systems, 2(1):33–45, 1989.
[Kwo08]
Jae-Hoon Kwon. Rational semistandard tableaux and character formula for the lie superalgebra glˆ∞—∞. Advances in Mathematics, 217(2):713–739, 2008.
[Lam01]
T. Y. Lam. A First Course in Noncommutative Rings, volume 131 of Graduate Texts in Mathematics. Springer, New York, 2 edition, 2001.
[LR88]
Michael Luby and Charles Rackoff. How to construct pseudorandom permutations from pseudorandom functions. SIAM journal on computing, 17(2):373–386, 1988.
[LZ19a]
Qipeng Liu and Mark Zhandry. On finding quantum multi-collisions. In Yuval Ishai and Vincent Rijmen, editors, EUROCRYPT 2019, Part III, volume 11478 of LNCS, pages 189–218. Springer, Cham, May 2019.
[LZ19b]
Qipeng Liu and Mark Zhandry. Revisiting post-quantum Fiat-Shamir. In Alexandra Boldyreva and Daniele Micciancio, editors, CRYPTO 2019, Part II, volume 11693 of LNCS, pages 326–355. Springer, Cham, August 2019.
[Mac98]
Ian Grant Macdonald. Symmetric functions and Hall polynomials. Oxford university press, 1998.
[Mar96]
Paul Martin. The structure of the partition algebras. Journal of Algebra, 183(2):319–358, 1996.
[MH25]
Fermi Ma and Hsin-Yuan Huang. How to construct random unitaries. In Michal Koucký and Nikhil Bansal, editors, 57th ACM STOC, pages 806–809. ACM Press, June 2025.
[MMW25]
Christian Majenz, Giulio Malavolta, and Michael Walter. Permutation superposition oracles for quantum query lower bounds. In Michal Koucký and Nikhil Bansal, editors, 57th ACM STOC, pages 1508–1519. ACM Press, June 2025.
[MPSY24]
Tony Metger, Alexander Poremba, Makrand Sinha, and Henry Yuen. Simple constructions of linear-depth t-designs and pseudorandom unitaries. In 65th FOCS, pages 485–492. IEEE Computer Society Press, October 2024.
[MRR03]
Cristopher Moore, Daniel Rockmore, and Alexander Russell. Generic quantum fourier transforms, 2003.
[MRW16]
David Maslen, Daniel N. Rockmore, and Sarah Wolff. The efficient computation of fourier transforms on semisimple algebras, 2016.
[MU17]
Michael Mitzenmacher and Eli Upfal. Probability and computing: Randomization and probabilistic techniques in algorithms and data analysis. Cambridge university press, 2017.
[Ngu23]
Quynh T Nguyen. The mixed schur transform: efficient quantum circuit and applications. arXiv preprint arXiv:2310.01613, 2023. 120
[PCX25]
Tianci Peng, Shujiao Cao, and Rui Xue. On quantum query complexities of collisionfinding in non-uniform random functions. In Goichiro Hanaoka and Bo-Yin Yang, editors, ASIACRYPT 2025, Part VIII, volume 16252 of LNCS, pages 193–223. Springer, Singapore, December 2025.
[Ros21]
Ansis Rosmanis. Tight bounds for inverting permutations via compressed oracle arguments. arXiv preprint arXiv:2103.08975, 2021.
[Sag01]
Bruce E Sagan. The symmetric group: representations, combinatorial algorithms, and symmetric functions. Springer, 2001.
[Sch27]
Issai Schur. über die rationalen darstellungen der allgemeinen linearen gruppe. Sitzungsberichte der Preussischen Akademie der Wissenschaften zu Berlin, PhysikalischMathematische Klasse, pages 58–75, 1927.
[SML+ 25]
Thomas Schuster, Fermi Ma, Alex Lombardi, Fernando Brandao, and Hsin-Yuan Huang. Strong random unitaries and fast scrambling. arXiv preprint arXiv:2509.26310, 2025.
[Ste87]
John R Stembridge. Rational tableaux and the tensor algebra of gln. Journal of Combinatorial Theory, Series A, 46(1):79–120, 1987.
[Str24]
Eugene Strahov. Generalized regular representations of big wreath products, 2024.
[Tan97]
Kenichiro Tanabe. On the centralizer algebra of the unitary reflection group g (m, p, n). Nagoya mathematical journal, 148:113–126, 1997.
[TW25]
Ewin Tang and John Wright. Amplitude amplification and estimation require inverses. arXiv preprint arXiv:2507.23787, 2025.
[Unr23]
Dominique Unruh. Towards compressed permutation oracles. In Jian Guo and Ron Steinfeld, editors, ASIACRYPT 2023, Part IV, volume 14441 of LNCS, pages 369–400. Springer, Singapore, December 2023.
[VK92]
Naum Vilenkin and Anatoli Klimyk. Representation of Lie Groups and Special Functions. Volume 3: Classical and Quantum Groups and Special Functions. Springer, 1992.
[Wey39]
Hermann Weyl. The Classical Groups: Their Invariants and Representations. Princeton Mathematical Series. Princeton University Press, Princeton, NJ, 1939.
[Zha12]
Mark Zhandry. How to construct quantum random functions. In 53rd FOCS, pages 679–687. IEEE Computer Society Press, October 2012.
[Zha19]
Mark Zhandry. How to record quantum queries, and applications to quantum indifferentiability. In Alexandra Boldyreva and Daniele Micciancio, editors, CRYPTO 2019, Part II, volume 11693 of LNCS, pages 239–268. Springer, Cham, August 2019.
[Zha25]
Mark Zhandry. How to model unitary oracles. In Yael Tauman Kalai and Seny F. Kamara, editors, CRYPTO 2025, Part II, volume 16001 of LNCS, pages 237–268. Springer, Cham, August 2025.
121