\documentclass[11pt]{article}

\usepackage{latexsym}
\usepackage{amsmath}
\usepackage{amssymb}
\usepackage{amsthm}
\usepackage{hyperref}
\usepackage{algorithmic}
\usepackage{algorithm}
\usepackage{complexity}
\usepackage{graphicx}

\newcommand{\handout}[5]{
  \noindent
  \begin{center}
    \framebox[\textwidth]{
      \vbox{
        \hbox to \textwidth { {\bf Algebra and Computation } \hfill Course Instructor: #2 }
        \vspace{4mm}
        \hbox to \textwidth { {\Large \hfill #5  \hfill} }
        \vspace{2mm}
        \hbox to \textwidth { {\em #3 \hfill #4} }
      }
    }
  \end{center}
  \vspace*{4mm}
}

\newcommand{\lecture}[4]{\handout{#1}{#2}{Lecturer: #3}{Scribe: #4}{Lecture #1}}

\newtheorem{theorem}{Theorem}
\newtheorem{theorem*}{Theorem}
\newtheorem{corollary}[theorem]{Corollary}
\newtheorem{lemma}[theorem]{Lemma}
\newtheorem{observation}[theorem]{Observation}
\newtheorem{proposition}[theorem]{Proposition}
\newtheorem{definition}[theorem]{Definition}
\newtheorem{claim}[theorem]{Claim}
\newtheorem{fact}[]{Fact}
\newtheorem{subclaim}[theorem]{Subclaim}

% my custom commands
\newcommand{\inparen}[1]{\left(#1\right)}             %\inparen{x+y}  is (x+y)
\newcommand{\inbrace}[1]{\left\{#1\right\}}           %\inbrace{x+y}  is {x+y}
\newcommand{\insquar}[1]{\left[#1\right]}             %\insquar{x+y}  is [x+y]
\newcommand{\inangle}[1]{\left\langle#1\right\rangle} %\inangle{A}    is <A>
\newcommand{\abs}[1]{\left|#1\right|}                 %\abs{x}        is |x|
\newcommand{\norm}[1]{\left\Vert#1\right\Vert}        %\norm{x}       is ||x||
\newcommand{\union}{\cup}
\newcommand{\Union}{\bigcup}
\newcommand{\intersection}{\cap}
\newcommand{\super}[2]{#1^{\inparen{#2}}}             %\super{G}{i-1} is G^{(i-1)}
\newcommand{\setdef}[2]{\inbrace{{#1}\ : \ {#2}}}
\newcommand{\inv}[1]{#1^{-1}}
\newcommand{\inrpdt}[2]{\left\langle{#1},{#2}\right\rangle}%\inrpdt{x}{y} is <x,y>.
\newcommand{\pderiv}[2]{\frac{\partial #1}{\partial #2}}
% Commands specific to this file
% TODO: Find the right way to typeset group index
\DeclareMathOperator{\Sym}{Sym}
\newcommand{\gpidx}[2]{\insquar{#1 : #2}}             %\gpidx{H}{K}   is [H : K]
\newcommand{\gpigs}[2]{\gpidx{\super{G}{#1}}{\super{G}{#2}}} %Group index of g super ...
\newcommand{\llhd}{\!\!\lhd\!\!\lhd}
\newcommand{\roundoff}[1]{\left\lfloor #1 \right\rceil}


% \newcommand{\ceil}[1]{\lceil #1 \rceil}
\newcommand{\floor}[1]{\left\lfloor #1 \right\rfloor}
\newcommand{\F}{\mathbb{F}}
\newcommand{\N}{\mathbb{N}}
\newcommand{\Q}{\mathbb{Q}}
\newcommand{\Z}{\mathbb{Z}}


%for algorithms
\renewcommand{\algorithmicrequire}{\textbf{Input:}}

% Problems we look at
\newcommand{\GIso}{\lang{Graph\text{-}Iso}} %Without \text, ugly minus instead of hyphen.
\newcommand{\GAut}{\lang{Graph\text{-}Aut}}
\newcommand{\SStab}{\lang{Set\text{-}Stab}}

%for Quantum computing
\newcommand{\q}[1]{\left|#1\right\rangle}

\begin{document}

\lecture{23: Shor's Algorithm for Integer Factoring}{V. Arvind}{V. Arvind}{Ramprasad Saptharishi}

\section{Overview}

In this lecture we shall see Shor's algorithm for order finding, and
therefore for integer factoring. 

\section{The First Steps}

We are given a number $a\in \Z_N^\star$ and we need to find the $r =
ord_N(a).$

Pick an $L$ such that $N^2 \leq 2^L\leq 2N^2$ and let $q = 2^L.$ Hence
the group $\Z_q$ is the set of all $L$-bit binary strings. As in the
Simon's problem, prepare the uniform superposition using the hadamard
transform. 
$$
\q{\psi} = \frac{1}{\sqrt{q}}\sum_{x=0}^{q-1}\q{x}
$$

And we shall assume that our function $f:x\mapsto a^x \pmod{n}$ is
given as a unitary tranform where $U_f(x,y) = (x,y\oplus f(x)).$ Thus
applying this matrix to the uniform superposition padded with $0$s, we
get:
$$
\frac{1}{\sqrt{q}}\sum_{x=0}^{q-1}\q{x}\q{0^L} \longrightarrow \frac{1}{\sqrt{q}}\sum_{x=0}^{q-1}\q{x}\q{f(x)}
$$
Now measuring the second register would give us some $a^l\pmod{N}$ for
some least $l.$ And hence, the current state would then be:
$$
\frac{1}{\sqrt{A+1}}\sum_{j=0}^{A}\q{l+jr}\quad,\quad A = \floor{\frac{q-l-1}{r}}
$$

Our job is to retrieve the $r$ and hence we need to get rid of the
$l.$ This is where the fourier tranform comes in.

\subsection{Fourier Tranform over $\Z_q$}

The fourier transform over $\Z_q$ is the following map:
$$
F_q:\q{y} \rightarrow \frac{1}{\sqrt{q}}\sum_{c=0}^{q-1} e^{\frac{2\pi i}{q}yc}\q{c}
$$

Shor showed that there exists a polynomial sized quantum circuit for
the fourier tranform. For the moment, let us take it for granted that
there does exists a polynomial sized quantum circuit though we shall
prove it later in the lecture. 

The quantum state that we are in is
$$
\frac{1}{\sqrt{A+1}}\sum_{j=0}^{A}\q{l+jr}
$$
Applying the fourier tranform to this, we have:
$$
\frac{1}{\sqrt{q(A+1)}}\sum_{j=0}^{A}\sum_{c=0}^{q-1}e^{\frac{2\pi
    i}{2^L}(l+jr)c}\q{c} = \frac{1}{\sqrt{q(A+1)}}\sum_{c=0}^{q-1}\alpha_c \q{c}
$$

\subsection*{The Easy case: $r\mid q$}

Since $r$ divides $q$ and we chose the least $l$ it follows that $A =
\frac{q}{r} - 1.$ Therefore,
$$
\alpha_c = e^{\frac{2\pi i}{q}cl}\sum_{j=0}^A \inparen{e^{2\pi i\frac{cr}{q}}}^j
$$
Suppose $q\nmid cr$ then $\omega = e^{2\pi i\frac{c}{q/r}} \neq 1$ is
a $q/r$-th root of unity. Therefore, 
$$\alpha_c = e^{\frac{2\pi i}{q}cl} \inparen{\sum_{j=0}^{\frac{q}{r}-1} \omega^j}
= 0$$

Since the probability amplitude is $0$ for the case when $q \nmid cr$,
measuring $c$ will give us a number that is a multiple of
$\frac{q}{r}$ with uniform probability. 

Hence we now will have a fraction $\frac{\lambda q}{r}.$ How do we
recover $r$ from this? Suppose $\lambda$ was coprime to $r$, we know
$\frac{c}{q} = \frac{\lambda}{r}$. Since $\frac{\lambda}{r}$ is in its
reduced form, just take $\frac{c}{q}$ and get it to the reduced
form; the denominator would then give us the $r.$

How do we make sure that we get a fraction such that $\lambda$ and $r$
are coprime? With good probability we will. The probability that this
happens is $\frac{\phi(r)}{r} > \frac{1}{\log n}.$ Hence we are safe. 

\subsection*{The general case:$r \nmid q$}

For any $c$ in the domain, 
\begin{eqnarray*}
 \Pr[c\text{ is measured}] & = &  \frac{1}{q(A+1)}\abs{\sum_{j=0}^A
   e^{2\pi i\frac{c(l+rj)}{q}}}^2 \\
 & = & \frac{1}{q(A+1)}\abs{\sum_{j=1}^A e^{2\pi i j \inparen{cr\bmod{q}}}}^2
\end{eqnarray*}

Let the event $E = \setdef{c}{\frac{-r}{2} \leq cr\bmod{q} \leq
  \frac{r}{2}}.$ To analyse the probability that this event will
happen, for every $0\leq \lambda \leq r$ look at the interval $\insquar{\lambda
q - \frac{r}{2},\lambda q + \frac{r}{2}}$. This interval will contain
a multiple of $r.$ There is a possibility of both end points of this
interval being multiples of $r$. But the following argument shows that
this is not possible.
\begin{eqnarray*}
  cr & = & \lambda q - \frac{r}{2}\\
  (c+1)r & = & \lambda q + \frac{r}{2}\\
  \implies (2c + 1)r & = & 2\lambda q\\
\end{eqnarray*}
but the last line would force $r\geq 2q$ which is absurd by the choice
of $q.$

Thus $|E| \geq r$ since there are $r$ possible $\lambda$'s. 
We now have
\begin{eqnarray*}
  \abs{cr - \lambda q}&\leq & \frac{r}{2}\\
  \abs{\frac{c}{q} - \frac{\lambda}{r}} & \leq & \frac{1}{2q} \leq \frac{1}{2N^2}
\end{eqnarray*}

The following theorem then show how to recover $r$ from this. 
\begin{theorem}
  For any $\sigma \in \Q$, if $\abs{\sigma - \frac{a}{b}} \leq
  \frac{1}{2b^2}$ then $\frac{a}{b}$ is one of the
  covergents\footnote{truncation of continued fractions} of $\sigma.$
\end{theorem}

Thus all we need to do is get $\frac{c}{q}$, look at all its
convergents and one of them will be $\frac{\lambda}{r}.$ As in the
earlier case, the probability that $\frac{\lambda}{r}$ will be in its
reduced form will happen with good probability and thus the
denominator of the fraction is the order of $a.$ 

Hence we just need to show that event $E$ will happen with good
probability. 

\subsection{Bounding probability of event $E$}

{\em Needs to be done, didn't take good notes here.}

\section{Quantum Circuit for Fourier Transform}

We want a circuit that transforms $\q{y}$ to
$\frac{1}{\sqrt{q}}\sum_{c=0}^{q-1} e^{\frac{2\pi i}{q}cy}\q{c}.$ Fix
a $c$ and lets its binary representation be $c_0c_1\cdots c_{L-1}$ and
that of $y$ be $y_0y_1 \cdots y_{L-1}.$ 

\begin{eqnarray*}
  e^{\frac{2\pi i}{2^L}cy}\q{c} & = & e^{\frac{2\pi
      i}{2^L}y(2^{L-1}c_0 + \cdots +
    c_{L-1})}\q{c_0}\q{c_1}\cdots\q{c_{L-1}}\\
  & = & \inparen{e^{2\pi i \frac{y}{2^L}(2^{L-1}c_0)}\q{c_0}}\otimes
  \inparen{e^{2\pi i \frac{y}{2^L}(2^{L-2}c_1)}\q{c_1}} \otimes\cdots
  \otimes \inparen{e^{2\pi i \frac{y}{2^L}(c_{L-1})}\q{c_{L-1}}} \\
  & = & \inparen{e^{2\pi i (0.y_{L-1})c_0}\q{c_0}}\otimes\inparen{e^{2\pi
      i (0.y_{L-2}y_{L-1})c_1}\q{c_1}}\otimes\cdots \otimes \inparen{e^{2\pi i (0.y)c_{L-1}}\q{c_{L-1}}}
\end{eqnarray*}

Thus, summing over the possible bits for each $c_i$ we get the
following tensor product.
$$
\sum_{c=0}^{q-1}e^{\frac{2\pi i}{q}yc} = \inparen{\frac{\q{0} +
    e^{2\pi i(0.y_{L-1})}\q{1}}{\sqrt{2}}}\otimes\inparen{\frac{\q{0} +
    e^{2\pi i(0.y_{L-2}y_{L-1})}\q{1}}{\sqrt{2}}}\otimes\cdots \inparen{\frac{\q{0} +
    e^{2\pi i(0.y)}\q{1}}{\sqrt{2}}}
$$

Define the following rotation gates:
$$
R_k = \inparen{\begin{array}{cc} 1 & 0 \\ 1 & e^{\frac{2\pi i}{2^k}}\end{array}}
$$
and its controlled version $CR_k = I\otimes R_k,$ that takes in an
extra bit and does the rotation only if that bit was $1.$ Our circuit
will use the hadamard gates and these controlled rotation gates. For
sake of notation $CR_k(x,y)$ will apply the rotation on $x$ with $y$
as the control bit. 

Let us look at $\inparen{\frac{\q{0} + e^{2\pi
      i(0.y_my_{m+1}\cdots y_{L-1})}\q{1}}{\sqrt{2}}}.$ Applying a
hadamard transform on $\q{y_m}$ would give us $\inparen{\frac{\q{0}+
    e^{2\pi i(0.y_m)}}{\sqrt{2}}}.$ Now there is a smaller rotation
created by $y_{m+1}$ only if it is equal to one. But this just amounts
to rotating the present state by $2^{-(m+1)}$ controlled by $y_{m+1}.$
And so on.

\noindent
Writing it as an algorithm:
\begin{algorithmic}[1]
\FOR{$i=0$ to $L-1$}
\STATE $y_i = H_1(y_i)$
\STATE $j=2$
\WHILE{$(i+j-1\leq L-1)$}
\STATE $(y_i,y_{i+j-1}) = CR_j(y_i,y_{i+j-1})$
\ENDWHILE
\ENDFOR
\end{algorithmic}

(picture here would be much better)

\end{document}
