How post-quantum algorithms work

Classical information

Classical states

Suppose we have a physical system $X$ that stores information. In the classical model, the system has a finite set of possible classical states. Call that set $\Sigma$ .

At any given moment, $X$ is in exactly one of those states. If the current state is written as $x(t)$ , then $x(t)\in\Sigma$ .

Bit

\Sigma=\{0,1\}

The system is either 0 or 1, never both.

Dice

\Sigma=\{1,2,3,4,5,6\}

The upward face can be only one value at a time.

Probabilistic states

When we are uncertain about which state $X$ is in, we describe our knowledge using a probabilistic state. A probability $\Pr(x=a)\geq 0$ is assigned to each $a\in\Sigma$ , and all probabilities together sum to 1.

0

1

\Pr(x{=}0)=\tfrac{3}{4} \qquad \Pr(x{=}1)=\tfrac{1}{4}

Probability vectors

The same distribution can be written as a probability vector - a column of numbers, one per state in $\Sigma$ , in a fixed order:

\begin{pmatrix}\tfrac{3}{4}\\[4pt]\tfrac{1}{4}\end{pmatrix}\begin{matrix}\leftarrow\;\Pr(x{=}0)\text{, the probability the system is in state }0\\[4pt]\leftarrow\;\Pr(x{=}1)\text{, the probability the system is in state }1\end{matrix}

Dirac notation

The same probability vector can be written with Dirac notation. Suppose the elements of the state set are ordered as $\Sigma=(a_1,\ldots,a_{|\Sigma|})$ . For any state $a\in\Sigma$ , $\lvert a\rangle$ is the column vector having a 1 in the entry corresponding to $a$ in that ordering, with 0 for all other entries.

Standard basis vectors:

\lvert 0\rangle=\begin{pmatrix}1\\0\end{pmatrix}\qquad \lvert 1\rangle=\begin{pmatrix}0\\1\end{pmatrix}

Any vector is then a combination of standard basis vectors. In our example, $\tfrac{3}{4}$ is the probability of $\lvert 0\rangle$ and $\tfrac{1}{4}$ is the probability of $\lvert 1\rangle$ :

\begin{pmatrix}\tfrac{3}{4}\\[4pt]\tfrac{1}{4}\end{pmatrix}=\tfrac{3}{4}\lvert 0\rangle+\tfrac{1}{4}\lvert 1\rangle

These notation versions all describe the same distribution. The probability statements, the column vector, and the Dirac notation are just different tools for writing the same information, each useful in a different setting.

Deterministic operations

A deterministic operation has no chance involved: each input state has exactly one output state. We can write it as a function from the state set to itself:

f:\Sigma\to\Sigma,\qquad a\mapsto f(a)

In Dirac notation, each state $a$ is represented by a basis vector $\lvert a\rangle$ . The operation becomes a matrix $M_f$ that acts on those basis vectors:

M_f\lvert a\rangle=\lvert f(a)\rangle\qquad\text{for every }a\in\Sigma

feed in the basis vector $\lvert a\rangle$ for state $a$
get out the basis vector $\lvert f(a)\rangle$ for state $f(a)$

The matrix entries are defined by:

(M_f)_{b,a}=\begin{cases}1,&b=f(a)\\0,&b\neq f(a)\end{cases}

This says:

column $a$ describes what happens to input state $a$
the only $1$ in that column appears in the row for the output state $f(a)$
all other entries are 0

For example, if $\Sigma=\{0,1,2\}$ and $f(0)=1,\ f(1)=1,\ f(2)=0$ , then the operation always sends, with no uncertainty involved:

$0\mapsto1$
$1\mapsto1$
$2\mapsto0$

This function can be represented by the matrix $M_f$ . Its columns are the possible input states, and its rows are the possible output states. For each input $a$ , column $a$ contains a single $1$ in row $f(a)$ , with every other entry equal to $0$ :

M_f =

\begin{pmatrix}0&0&1\\1&1&0\\0&0&0\end{pmatrix}

input 0

←

input 1

←

input 2

←

←row 0: output slot for state 0

←row 1: output slot for state 1

←row 2: output slot for state 2

Matrix-vector updates

Instead of tracking individual state transitions, we can apply the matrix to the entire probability distribution at once. If $v$ is the current probability vector, the updated distribution is:

v'=M_fv

Consider a probability distribution where input 0 has probability $\tfrac{1}{2}$ , input 1 has probability $\tfrac{1}{3}$ , and input 2 has probability $\tfrac{1}{6}$ . The vector $v$ represents this distribution. When $M_f$ is applied, the probability associated with input 2 moves to output 0, the probabilities of inputs 0 and 1 are merged at output 1, and output 2 receives no probability mass:

v=\begin{pmatrix}\tfrac{1}{2}\\[4pt]\tfrac{1}{3}\\[4pt]\tfrac{1}{6}\end{pmatrix}\qquad M_fv= \begin{pmatrix} 0&0&1\\ 1&1&0\\ 0&0&0 \end{pmatrix} \begin{pmatrix} \tfrac{1}{2}\\[4pt] \tfrac{1}{3}\\[4pt] \tfrac{1}{6} \end{pmatrix} = \begin{pmatrix} \tfrac{1}{6}\\[4pt] \tfrac{1}{2}+\tfrac{1}{3}\\[4pt] 0 \end{pmatrix} = \begin{pmatrix} \tfrac{1}{6}\\[4pt] \tfrac{5}{6}\\[4pt] 0 \end{pmatrix}

We could update the probabilities by following each input separately and moving its probability mass to the corresponding output. The matrix $M_f$ packages all of these transfers into a single matrix-vector multiplication, producing the updated probability distribution in one step.

One-bit matrices

For a single bit $\Sigma=\{0,1\}$ , there are four possible deterministic operations:

Set to 0

0,1\mapsto0

M_0=\begin{pmatrix}1&1\\0&0\end{pmatrix}

Identity

0\mapsto0,\quad1\mapsto1

I=\begin{pmatrix}1&0\\0&1\end{pmatrix}

NOT / bit flip

0\mapsto1,\quad1\mapsto0

X=\begin{pmatrix}0&1\\1&0\end{pmatrix}

Set to 1

0,1\mapsto1

M_1=\begin{pmatrix}0&0\\1&1\end{pmatrix}

Bras and inner products

In Dirac notation, column vectors are called kets and are written as $\lvert 0\rangle$ and $\lvert 1\rangle$ . Their row-vector counterparts are called bras and are written with the bracket facing the opposite direction:

\langle\text{bra}\mid\text{ket}\rangle\qquad \langle 0\rvert=\begin{pmatrix}1&0\end{pmatrix}\qquad \langle 1\rvert=\begin{pmatrix}0&1\end{pmatrix}

Multiplying a row vector by a column vector produces a single number. This operation is called the inner product, or dot product. It measures how much two vectors overlap:

\begin{pmatrix}r_1&r_2&\cdots&r_n\end{pmatrix}\begin{pmatrix}c_1\\c_2\\\vdots\\c_n\end{pmatrix}=r_1c_1+r_2c_2+\cdots+r_nc_n=\sum_{i=1}^{n}r_ic_i

For basis states, kets and bras contain a single 1 and zeros everywhere else. If we multiply matching states, the 1s line up. If we multiply different states, the 1s occur in different positions, so every term in the sum is zero:

\langle 0\vert0\rangle=\begin{pmatrix}1&0\end{pmatrix}\begin{pmatrix}1\\0\end{pmatrix}=1\cdot1+0\cdot0=1\qquad \langle 0\vert1\rangle=\begin{pmatrix}1&0\end{pmatrix}\begin{pmatrix}0\\1\end{pmatrix}=1\cdot0+0\cdot1=0

So multiplying a bra by a ket, denoted as $\langle a\vert b\rangle$ , acts like an equality test: it returns 1 when the states are the same and 0 when they are different:

\langle a\vert b\rangle=\begin{cases}1,&a=b\\0,&a\neq b\end{cases}

Ket-bra products

If row-by-column multiplication gives a single number, then column-by-row multiplication gives a matrix. This operation is called an outer product:

\begin{pmatrix}c_1\\c_2\\\vdots\\c_m\end{pmatrix}\begin{pmatrix}r_1&r_2&\cdots&r_n\end{pmatrix} = \begin{pmatrix} c_1r_1&c_1r_2&\cdots&c_1r_n\\ c_2r_1&c_2r_2&\cdots&c_2r_n\\ \vdots&\vdots&\ddots&\vdots\\ c_mr_1&c_mr_2&\cdots&c_mr_n \end{pmatrix}

For one-bit basis states, a ket-bra product creates a matrix with a single 1 and zeros everywhere else:

\lvert0\rangle\langle0\rvert= \begin{pmatrix}1\\0\end{pmatrix}\begin{pmatrix}1&0\end{pmatrix} = \begin{pmatrix}1&0\\0&0\end{pmatrix} \qquad \lvert0\rangle\langle1\rvert= \begin{pmatrix}1\\0\end{pmatrix}\begin{pmatrix}0&1\end{pmatrix} = \begin{pmatrix}0&1\\0&0\end{pmatrix}

Suppose we are given a deterministic operation $f:\Sigma\to\Sigma$ where, for each state $b\in\Sigma$ , the function specifies an output state $f(b)$ , representing this individual rule $b\mapsto f(b)$ with the ket-bra operator $\lvert f(b)\rangle\langle b\rvert$ , where the bra $\langle b\rvert$ identifies the input state $\lvert b\rangle$ while the ket $\lvert f(b)\rangle$ specifies the state that should be produced, so that adding one such term for every possible input state yields a matrix that implements the entire deterministic operation:

M_f=\sum_{b\in\Sigma}\lvert f(b)\rangle\langle b\rvert

For the function $f(0)=1,\ f(1)=1,\ f(2)=0$ , the deterministic rules are $0\mapsto1,\ 1\mapsto1,\ 2\mapsto0$ , and each rule contributes one ket-bra term: the rule $0\mapsto1$ becomes $\lvert1\rangle\langle0\rvert$ , the rule $1\mapsto1$ becomes $\lvert1\rangle\langle1\rvert$ , and the rule $2\mapsto0$ becomes $\lvert0\rangle\langle2\rvert$ — note that while we are used to reading input on the left and output on the right, in ket-bra notation the output comes first: $\lvert1\rangle\langle0\rvert$ means "produce $\lvert1\rangle$ when you see $\lvert0\rangle$ ."

Adding these terms gives:

M_f=\lvert1\rangle\langle0\rvert+\lvert1\rangle\langle1\rvert+\lvert0\rangle\langle2\rvert

Applying it to the basis state $\lvert2\rangle$ , the first two inner products vanish and only the matching term survives:

M_f\lvert2\rangle=\lvert1\rangle\underbrace{\langle0\vert2\rangle}_{0}+\lvert1\rangle\underbrace{\langle1\vert2\rangle}_{0}+\lvert0\rangle\underbrace{\langle2\vert2\rangle}_{1}=\lvert0\rangle

Each of the three ket-bra terms in $M_f$ is an ordinary matrix:

\lvert1\rangle\langle0\rvert= \begin{pmatrix}0&0&0\\1&0&0\\0&0&0\end{pmatrix} \qquad \lvert1\rangle\langle1\rvert= \begin{pmatrix}0&0&0\\0&1&0\\0&0&0\end{pmatrix} \qquad \lvert0\rangle\langle2\rvert= \begin{pmatrix}0&0&1\\0&0&0\\0&0&0\end{pmatrix}

Adding them together gives exactly the deterministic-operation matrix constructed earlier:

M_f= \begin{pmatrix}0&0&0\\1&0&0\\0&0&0\end{pmatrix} + \begin{pmatrix}0&0&0\\0&1&0\\0&0&0\end{pmatrix} + \begin{pmatrix}0&0&1\\0&0&0\\0&0&0\end{pmatrix} = \begin{pmatrix}0&0&1\\1&1&0\\0&0&0\end{pmatrix}

The action of this matrix becomes clear when it is applied to a basis state $\lvert a\rangle$ . In each term, the inner product $\langle b\vert a\rangle$ acts as an equality test: it equals 1 when $b=a$ and 0 otherwise. As a result, every term in the sum vanishes except the one corresponding to $b=a$ , leaving:

M_f\lvert a\rangle= \left(\sum_{b\in\Sigma}\lvert f(b)\rangle\langle b\rvert\right)\lvert a\rangle =\sum_{b\in\Sigma}\lvert f(b)\rangle\langle b\vert a\rangle =\lvert f(a)\rangle

Thus the matrix sends each basis state $\lvert a\rangle$ to the state specified by the function, $\lvert f(a)\rangle$ .

Probabilistic operations

A deterministic operation maps each input state to exactly one output state. A probabilistic operation is more general: each input state produces a probability distribution over output states. The operation is described by a matrix $M$ where entry $M_{b,a}$ gives the probability that input state $a$ produces output state $b$ .

For $M$ to represent a valid probabilistic operation, two conditions must hold. All entries must be nonnegative real numbers:

M_{b,a}\geq 0\qquad\text{for all }a,b\in\Sigma

And the entries in each column must sum to 1 — each column is a probability vector describing the output distribution for one input state:

\sum_{b\in\Sigma}M_{b,a}=1\qquad\text{for all }a\in\Sigma

A matrix satisfying both conditions is called a stochastic matrix. Every deterministic-operation matrix is a special case: its columns each contain a single 1 and zeros elsewhere, which is a valid probability vector.

Composing operations

When two operations are applied in sequence — first $M_1$ , then $M_2$ — the result is $M_2(M_1 v)$ . Because matrix multiplication is associative, this equals $(M_2 M_1)v$ : the composition is itself a matrix, and the product of two stochastic matrices is stochastic.

M_2(M_1 v)=(M_2 M_1)v

Matrix multiplication is not commutative, however: $M_2 M_1$ and $M_1 M_2$ generally produce different results. The order in which operations are applied matters.

Using the one-bit matrices introduced earlier, we can see this directly. Applying $M_0$ (set to 0) and then $X$ (NOT) always produces 1 — equivalent to $M_1$ . Doing the same two operations in the opposite order always produces 0 — equivalent to $M_0$ itself:

X M_0=\begin{pmatrix}0&1\\1&0\end{pmatrix}\begin{pmatrix}1&1\\0&0\end{pmatrix}=\begin{pmatrix}0&0\\1&1\end{pmatrix}=M_1

M_0 X=\begin{pmatrix}1&1\\0&0\end{pmatrix}\begin{pmatrix}0&1\\1&0\end{pmatrix}=\begin{pmatrix}1&1\\0&0\end{pmatrix}=M_0

Quantum information

Two levels of description

Quantum information can be described at two levels of generality. The simplified picture — kets and unitary matrices — is enough for pure states and reversible operations. The general picture adds density matrices and a broader class of measurements and operations, covering mixed states, noise, and measurement.

	Simplified	General
Quantum states	Kets — state vectors	Density matrices
Operations	Unitary matrices	More general class of measurements and operations

Quantum states

A quantum state of a system is represented by a column vector whose indices are placed in correspondence with the classical states of that system:

\lvert\psi\rangle=\begin{pmatrix}\alpha_1\\\vdots\\\alpha_n\end{pmatrix}

A valid quantum state vector must satisfy two conditions:

Entries are complex numbers — amplitudes, not probabilities: $\alpha_k\in\mathbb{C}$
The sum of squared absolute values of the entries equals 1: $\sum_{k=1}^{n}|\alpha_k|^2=1$

The second condition uses the Euclidean norm — the generalisation of vector length to complex numbers:

\|\psi\|=\sqrt{\sum_{k=1}^{n}|\alpha_k|^2}

Real vector

v=\begin{pmatrix}3\\4\end{pmatrix}

\|v\|=\sqrt{3^2+4^2}=\sqrt{25}=5

\begin{aligned}\|v\|&=\sqrt{3^2+4^2}\\&=\sqrt{25}=5\end{aligned}

Complex vector

v=\begin{pmatrix}\tfrac{3}{\sqrt{2}}\\[4pt]\tfrac{i}{\sqrt{2}}\end{pmatrix}

\|v\|=\sqrt{\left|\tfrac{3}{\sqrt{2}}\right|^2+\left|\tfrac{i}{\sqrt{2}}\right|^2}=\sqrt{\tfrac{9}{2}+\tfrac{1}{2}}=\sqrt{5}

Quantum state vectors are unit vectors — $\|\psi\|=1$ . The amplitudes encode probability amplitudes: the probability of observing the system in classical state $k$ is $|\alpha_k|^2$ .

Qubit states

A qubit is a quantum system whose classical state set is $\Sigma=\{0,1\}$ , so its state vector has two entries. The basis states $\lvert0\rangle$ and $\lvert1\rangle$ look like ordinary integer vectors, but their entries are complex numbers that happen to have zero imaginary part:

\lvert0\rangle=\begin{pmatrix}1\\0\end{pmatrix}\qquad\lvert1\rangle=\begin{pmatrix}0\\1\end{pmatrix}

A general qubit state is any normalised complex combination of these two basis states:

\lvert\psi\rangle=\alpha\lvert0\rangle+\beta\lvert1\rangle,\qquad\alpha,\beta\in\mathbb{C},\qquad|\alpha|^2+|\beta|^2=1

Two particularly important named states are the plus and minus states. They assign equal probability to the basis states $\lvert0\rangle$ and $\lvert1\rangle$ — 50% and 50% — but differ in the relative sign between their amplitudes:

\lvert+\rangle=\tfrac{1}{\sqrt{2}}\lvert0\rangle+\tfrac{1}{\sqrt{2}}\lvert1\rangle\qquad\lvert-\rangle=\tfrac{1}{\sqrt{2}}\lvert0\rangle-\tfrac{1}{\sqrt{2}}\lvert1\rangle

Most qubit states have no special name. Any normalised choice of $\alpha$ and $\beta$ is valid — for example:

\lvert\phi\rangle=\tfrac{1+2i}{3}\lvert0\rangle-\tfrac{2}{3}\lvert1\rangle\qquad\left|\tfrac{1+2i}{3}\right|^2+\left|\tfrac{2}{3}\right|^2=\tfrac{5}{9}+\tfrac{4}{9}=1\checkmark

Conjugate transpose

Every ket $\lvert\psi\rangle$ has a corresponding bra $\langle\psi\rvert$ obtained by the conjugate transpose — written with a $†$ (dagger):

\langle\psi\rvert=\lvert\psi\rangle^\dagger

Two steps: transpose the column vector into a row, then replace each entry with its complex conjugate — $a+bi\;\mapsto\;a-bi$ . For the qubit state $\lvert\phi\rangle=\tfrac{1+2i}{3}\lvert0\rangle-\tfrac{2}{3}\lvert1\rangle$ :

\langle\phi\rvert=\lvert\phi\rangle^\dagger=\frac{1-2i}{3}\langle0\rvert-\frac{2}{3}\langle1\rvert

The real amplitude $-\tfrac{2}{3}$ is unchanged — conjugating a real number leaves it the same. Only the complex entry $\tfrac{1+2i}{3}$ flips its imaginary part to give $\tfrac{1-2i}{3}$ .

Why do we conjugate?

A complex number is not just a number—it can also be viewed as a point (or vector) in the complex plane.

z = x + iy

Its length is simply the Euclidean distance from the origin:

\lvert z\rvert=\sqrt{x^2+y^2}

The challenge is to compute this length using only complex arithmetic. Notice what happens if we multiply $z$ by its conjugate:

\overline{z}\,z=(x-iy)(x+iy)=x^2\,\textcolor{#dc2626}{\cancel{+\,ixy}}\,\textcolor{#dc2626}{\cancel{-\,ixy}}\,+y^2=x^2+y^2

The imaginary terms cancel, leaving exactly the square of the Euclidean length:

\overline{z}\,z=\left(\sqrt{x^2+y^2}\right)^2=\lvert z\rvert^2

z = 1.20 + 0.60i

z = 1.20 − 0.60i

zz= (1.20)² + (0.60)²= 1.44 + 0.36= 1.80 (real)

|z| = √1.80 = 1.34

Drag z around the plane. Its conjugate z is the mirror image across the real axis, and the product zz always lands on the real axis at |z|².

This is why the complex conjugate appears. It isn't an arbitrary rule—it is the operation that recovers the ordinary Euclidean length of a complex number.

The inner product extends this same idea to vectors by applying the conjugate transpose to every amplitude:

\langle\psi\vert\psi\rangle=\sum_{k}\overline{\alpha_k}\,\alpha_k=\sum_{k}\lvert\alpha_k\rvert^2

Measurements

Measuring a quantum state extracts classical information from it. In a standard basis measurement, the possible outcomes are the classical states — the same states that label the entries of the state vector. For a state $\lvert\psi\rangle=\sum_{a\in\Sigma}\alpha_a\lvert a\rangle$ , the probability of obtaining outcome $a$ is the squared absolute value of the corresponding amplitude:

\Pr(\text{outcome}=a)=|\alpha_a|^2

For example, measuring the state $\lvert{+}\rangle=\tfrac{1}{\sqrt{2}}\lvert0\rangle+\tfrac{1}{\sqrt{2}}\lvert1\rangle$ gives each outcome with equal probability:

\Pr(\text{outcome}=0)=\left|\tfrac{1}{\sqrt{2}}\right|^2=\tfrac{1}{2}\qquad\Pr(\text{outcome}=1)=\left|\tfrac{1}{\sqrt{2}}\right|^2=\tfrac{1}{2}

For the state with complex amplitudes:

\lvert\psi\rangle=\frac{1+2i}{3}\lvert0\rangle-\frac{2}{3}\lvert1\rangle

\Pr(\text{outcome}=0)=\left|\frac{1+2i}{3}\right|^2=\frac{1^2+2^2}{9}=\frac{5}{9}\qquad\Pr(\text{outcome}=1)=\left|\frac{2}{3}\right|^2=\frac{4}{9}

Measurement also changes the state. Once outcome $a$ is observed, the quantum state collapses to the corresponding basis state $\lvert a\rangle$ . A second measurement on the collapsed state will always return the same outcome — this is called the collapse of the quantum state.

The same logic applies to ordinary probability. Flip a coin and let it land face-up on the table. Before you look, each side has probability $\tfrac{1}{2}$ . The moment you look, the uncertainty is gone — the coin is showing heads, and re-checking it a second or third time still shows heads with certainty. What changes is not the coin but your state of knowledge about it. Quantum collapse works the same way from the outside: once you have a measurement result, subsequent measurements on that same state are no longer uncertain.

After the measurement, regardless of the pre-measurement state, the system is in a definite classical state $\lvert0\rangle$ or $\lvert1\rangle$ . This places a fundamental limit on how much classical information can be extracted from a quantum state in a single measurement.

Unitary operations

Quantum operations are represented by unitary matrices — a different constraint from the stochastic matrices of classical probabilistic operations. A square matrix $U$ is unitary if its conjugate transpose is also its inverse:

U^\dagger U = I = UU^\dagger

This has two equivalent restatements:

The inverse is simply the conjugate transpose — $U^{-1}=U^\dagger$ — so inverting a unitary is cheap.
Unitary matrices preserve the Euclidean norm: $\|U\lvert\psi\rangle\|=\|\lvert\psi\rangle\|$ .

To see why the norm is preserved, first notice that for any column vector, multiplying it by its own conjugate transpose gives the squared norm — the conjugates pair with each entry to produce $\bar\alpha_k\alpha_k=|\alpha_k|^2$ :

v^\dagger v=\begin{pmatrix}\bar\alpha_1&\cdots&\bar\alpha_n\end{pmatrix}\begin{pmatrix}\alpha_1\\\vdots\\\alpha_n\end{pmatrix}=|\alpha_1|^2+\cdots+|\alpha_n|^2=\|v\|^2

Or, in Dirac notation:

\langle\psi\vert\psi\rangle=\bar\alpha_1\alpha_1+\cdots+\bar\alpha_n\alpha_n=|\alpha_1|^2+\cdots+|\alpha_n|^2=\|\lvert\psi\rangle\|^2

Since $v^\dagger v=\|v\|^2$ holds for any vector, we can apply it to $v=U\lvert\psi\rangle$ . The rule $(AB)^\dagger=B^\dagger A^\dagger$ says the conjugate transpose of a product reverses the order — so:

(U\lvert\psi\rangle)^\dagger=\lvert\psi\rangle^\dagger U^\dagger=\langle\psi\rvert U^\dagger

Substituting into $v^\dagger v$ and applying $U^\dagger U=I$ :

\|U\lvert\psi\rangle\|^2=\langle\psi\rvert U^\dagger U\lvert\psi\rangle=\langle\psi\rvert I\lvert\psi\rangle=\langle\psi\vert\psi\rangle=\|\lvert\psi\rangle\|^2

Taking square roots gives $\|U\lvert\psi\rangle\|=\|\lvert\psi\rangle\|$ . As a numeric check, applying $\sigma_x$ to the familiar state:

\lvert\phi\rangle=\tfrac{1+2i}{3}\lvert0\rangle-\tfrac{2}{3}\lvert1\rangle

It simply swaps the two entries:

\sigma_x\lvert\phi\rangle=\begin{pmatrix}0&1\\1&0\end{pmatrix}\begin{pmatrix}\tfrac{1+2i}{3}\\[4pt]-\tfrac{2}{3}\end{pmatrix}=\begin{pmatrix}-\tfrac{2}{3}\\[4pt]\tfrac{1+2i}{3}\end{pmatrix}

\|\lvert\phi\rangle\|=\sqrt{\tfrac{5}{9}+\tfrac{4}{9}}=1\qquad\|\sigma_x\lvert\phi\rangle\|=\sqrt{\tfrac{4}{9}+\tfrac{5}{9}}=1

Geometrically, a unitary transformation is the complex-number analogue of a rotation: it changes the direction of the vector, but never its length. Since quantum state vectors are unit vectors, a unitary operation always maps valid quantum states to valid quantum states — it can never take a state outside the unit sphere.

To check if a matrix is unitary, multiply it by its conjugate transpose and see if the result is the identity.

For $\sigma_x$ , which is real and symmetric so $\sigma_x^\dagger=\sigma_x$ :

\sigma_x^\dagger\sigma_x=\begin{pmatrix}0&1\\1&0\end{pmatrix}\begin{pmatrix}0&1\\1&0\end{pmatrix}=\begin{pmatrix}1&0\\0&1\end{pmatrix}=I\checkmark

\begin{aligned} \sigma_x^\dagger\sigma_x &=\begin{pmatrix}0&1\\1&0\end{pmatrix}\begin{pmatrix}0&1\\1&0\end{pmatrix}\\ &=\begin{pmatrix}1&0\\0&1\end{pmatrix}=I\checkmark \end{aligned}

Qubit unitary operations

1. Pauli operations

The four Pauli matrices are the most common single-qubit unitary operations:

Identity

I=\begin{pmatrix}1&0\\0&1\end{pmatrix}

Bit flip

\sigma_x=\begin{pmatrix}0&1\\1&0\end{pmatrix}

Phase + bit flip

\sigma_y=\begin{pmatrix}0&-i\\i&0\end{pmatrix}

Phase flip

\sigma_z=\begin{pmatrix}1&0\\0&-1\end{pmatrix}

The Pauli matrices also happen to be Hermitian — a matrix is Hermitian if it equals its own conjugate transpose, $M^\dagger=M$ . For a real symmetric matrix this just means symmetry across the diagonal. For a complex matrix, entries are mirrored across the diagonal and conjugated.

2. Hadamard

The Hadamard gate H, named after the French mathematician Jacques Hadamard, is one of the most important quantum gates. It acts as a bridge between two ways of describing a qubit:

The computational basis: $\lvert0\rangle$ and $\lvert1\rangle$
The superposition basis: $\lvert+\rangle$ and $\lvert-\rangle$

H=\begin{pmatrix}\tfrac{1}{\sqrt{2}}&\tfrac{1}{\sqrt{2}}\\[6pt]\tfrac{1}{\sqrt{2}}&-\tfrac{1}{\sqrt{2}}\end{pmatrix}=\frac{1}{\sqrt{2}}\begin{pmatrix}1&1\\1&-1\end{pmatrix}

From 0, 1 to +, -:

H\lvert0\rangle=\begin{pmatrix}\tfrac{1}{\sqrt{2}}&\tfrac{1}{\sqrt{2}}\\[6pt]\tfrac{1}{\sqrt{2}}&-\tfrac{1}{\sqrt{2}}\end{pmatrix}\begin{pmatrix}1\\0\end{pmatrix}=\begin{pmatrix}\tfrac{1}{\sqrt{2}}\\[6pt]\tfrac{1}{\sqrt{2}}\end{pmatrix}=\lvert+\rangle

H\lvert1\rangle=\begin{pmatrix}\tfrac{1}{\sqrt{2}}&\tfrac{1}{\sqrt{2}}\\[6pt]\tfrac{1}{\sqrt{2}}&-\tfrac{1}{\sqrt{2}}\end{pmatrix}\begin{pmatrix}0\\1\end{pmatrix}=\begin{pmatrix}\tfrac{1}{\sqrt{2}}\\[6pt]-\tfrac{1}{\sqrt{2}}\end{pmatrix}=\lvert-\rangle

From +, - back to 0, 1:

H\lvert+\rangle=\begin{pmatrix}\tfrac{1}{\sqrt{2}}&\tfrac{1}{\sqrt{2}}\\[6pt]\tfrac{1}{\sqrt{2}}&-\tfrac{1}{\sqrt{2}}\end{pmatrix}\begin{pmatrix}\tfrac{1}{\sqrt{2}}\\[6pt]\tfrac{1}{\sqrt{2}}\end{pmatrix}=\begin{pmatrix}1\\0\end{pmatrix}=\lvert0\rangle

H\lvert-\rangle=\begin{pmatrix}\tfrac{1}{\sqrt{2}}&\tfrac{1}{\sqrt{2}}\\[6pt]\tfrac{1}{\sqrt{2}}&-\tfrac{1}{\sqrt{2}}\end{pmatrix}\begin{pmatrix}\tfrac{1}{\sqrt{2}}\\[6pt]-\tfrac{1}{\sqrt{2}}\end{pmatrix}=\begin{pmatrix}0\\1\end{pmatrix}=\lvert1\rangle

Applying a Hadamard gate transforms a computational basis state into an equal superposition of $\lvert0\rangle$ and $\lvert1\rangle$ , meaning that a measurement would find each outcome with equal probability:

H\lvert0\rangle=\lvert+\rangle=\frac{\lvert0\rangle+\lvert1\rangle}{\sqrt{2}},\qquad H\lvert1\rangle=\lvert-\rangle=\frac{\lvert0\rangle-\lvert1\rangle}{\sqrt{2}}

You can think of the Hadamard gate as a quantum "basis changer" that lets us move between definite states and equal-probability superpositions, making it a fundamental building block of many quantum algorithms.

3. Phase gates

Phase gates leave $\lvert0\rangle$ unchanged and rotate $\lvert1\rangle$ by a complex phase. They do not change measurement probabilities on their own, but they shift the relative phase between amplitudes, which affects how states interfere in a larger circuit.

The general phase rotation gate $R_\phi$ applies a phase $e^{i\phi}$ to $\lvert1\rangle$ while leaving $\lvert0\rangle$ alone. $\phi$ is a real number, making $i\phi$ always purely imaginary. This means $e^{i\phi}$ always lies on the complex unit circle — $|e^{i\phi}|=1$ — so it is a pure phase that rotates without scaling:

R_\phi=\begin{pmatrix}1&0\\0&e^{i\phi}\end{pmatrix}

Two standard choices give the S gate and the T gate:

S=R_{\pi/2}=\begin{pmatrix}1&0\\0&i\end{pmatrix}\qquad T=R_{\pi/4}=\begin{pmatrix}1&0\\0&e^{i\pi/4}\end{pmatrix}

S applies a quarter-turn phase (90°) and satisfies $S^2=Z$ , where Z is the Pauli phase-flip gate from section 1: $Z=\begin{pmatrix}1&0\\0&-1\end{pmatrix}$ . T applies an eighth-turn phase (45°) and satisfies $T^2=S$ and $T^4=Z$ . Together with H, T generates a gate set that can approximate any single-qubit unitary to arbitrary precision.

Applied to the basis states:

S\lvert0\rangle=\lvert0\rangle,\quad S\lvert1\rangle=i\lvert1\rangle

T\lvert0\rangle=\lvert0\rangle,\quad T\lvert1\rangle=e^{i\pi/4}\lvert1\rangle

Composing unitary operations

Gates compose by matrix multiplication. In the product the rightmost matrix acts first — the state travels right to left through the sequence:

\lvert\psi_\text{out}\rangle=\overset{(3)}{U_3}\;\overset{(2)}{U_2}\;\overset{(1)}{U_1}\lvert\psi_\text{in}\rangle

For example, in $\textcolor{#2563eb}{H}\textcolor{#d97706}{S}\textcolor{#7c3aed}{H}$ the rightmost gate (purple H) acts first, then S, then the leftmost H (blue). Expanding step by step:

\textcolor{#2563eb}{H}\textcolor{#d97706}{S}\textcolor{#7c3aed}{H}=\textcolor{#2563eb}{\begin{pmatrix}\tfrac{1}{\sqrt{2}}&\tfrac{1}{\sqrt{2}}\\[4pt]\tfrac{1}{\sqrt{2}}&-\tfrac{1}{\sqrt{2}}\end{pmatrix}}\textcolor{#d97706}{\begin{pmatrix}1&0\\0&i\end{pmatrix}}\textcolor{#7c3aed}{\begin{pmatrix}\tfrac{1}{\sqrt{2}}&\tfrac{1}{\sqrt{2}}\\[4pt]\tfrac{1}{\sqrt{2}}&-\tfrac{1}{\sqrt{2}}\end{pmatrix}}=\textcolor{#2563eb}{\begin{pmatrix}\tfrac{1}{\sqrt{2}}&\tfrac{1}{\sqrt{2}}\\[4pt]\tfrac{1}{\sqrt{2}}&-\tfrac{1}{\sqrt{2}}\end{pmatrix}}\begin{pmatrix}\tfrac{1}{\sqrt{2}}&\tfrac{1}{\sqrt{2}}\\[4pt]\tfrac{i}{\sqrt{2}}&-\tfrac{i}{\sqrt{2}}\end{pmatrix}=\frac{1}{2}\begin{pmatrix}1+i&1-i\\1-i&1+i\end{pmatrix}=\sqrt{X}

This matrix is called the square root of NOT (written $\sqrt{X}$ ), because applying it twice gives the Pauli X (NOT) gate. To see why, insert $HH=I$ in the middle and use $S^2=Z$ :

(HSH)^2=HS\underbrace{HH}_{I}SH=HS^2H=HZH=X

In ordinary arithmetic, squaring something makes it "more of the same" — you would never expect a number squared to flip a sign. But unitary matrices can have complex eigenvalues such as $i$ , and $i^2=-1$ introduces the sign change that turns a partial rotation into a full logical inversion. This is one of the ways quantum gates behave fundamentally differently from classical boolean operations.

As another example, consider HTH. T is a rotation around the Z axis by $\pi/4$ . Placing H on both sides redirects that same rotation onto the X axis:

HTH=\frac{1}{2}\begin{pmatrix}1+e^{i\pi/4}&1-e^{i\pi/4}\\1-e^{i\pi/4}&1+e^{i\pi/4}\end{pmatrix}=e^{i\pi/8}\begin{pmatrix}\cos\tfrac{\pi}{8}&-i\sin\tfrac{\pi}{8}\\-i\sin\tfrac{\pi}{8}&\cos\tfrac{\pi}{8}\end{pmatrix}=e^{i\pi/8}R_x\!\left(\tfrac{\pi}{4}\right)

So T and HTH are rotations around two non-parallel axes — Z and X — each by $\pi/4$ . Combining rotations around any two non-parallel axes generates all rotations of the sphere, so any single-qubit unitary can be reached by some finite sequence of T and HTH to any desired precision.

Multiple systems: classical

Classical states

Suppose we have two systems:

$X$ with classical state set $\Sigma$ .
$Y$ with classical state set $\Gamma$ .

Together they form a compound system, written $(X,Y)$ or simply $XY$ . At any moment the compound system is in exactly one state - a pair $(a,b)$ where $a\in\Sigma$ is the state of $X$ and $b\in\Gamma$ is the state of $Y$ .

The full set of possible states of $XY$ is the Cartesian product:

\Sigma\times\Gamma=\{(a,b):a\in\Sigma,\,b\in\Gamma\}

For example, if both $X$ and $Y$ are bits so $\Sigma=\Gamma=\{0,1\}$ , the compound system has four possible states:

\Sigma\times\Gamma=\{(0,0),(0,1),(1,0),(1,1)\}

General formula: if we combine $n$ classical systems with state sets $\Sigma_1,\ldots,\Sigma_n$ , their compound state set is:

\Sigma_1\times\cdots\times\Sigma_n=\{(a_1,\ldots,a_n):a_i\in\Sigma_i\text{ for }i=1,\ldots,n\}

Convention notes

When we list a Cartesian product, we usually use lexicographic order: compare the first coordinate, then the second, and so on.
This assumes each state set already has an order. For bits, we use $0<1$ .
Significance decreases from left to right: the leftmost coordinate is the most significant, and the rightmost coordinate changes fastest.

Example: for three bits, $\Sigma_1=\Sigma_2=\Sigma_3=\{0,1\}$ . In lexicographic order:

\Sigma_1\times\Sigma_2\times\Sigma_3=\{(0,0,0),(0,0,1),(0,1,0),(0,1,1),(1,0,0),(1,0,1),(1,1,0),(1,1,1)\}

Probabilistic states

For a compound classical system, a probabilistic state assigns one probability to each state in the Cartesian product. If $x$ is the current state of $X$ and $y$ is the current state of $Y$ , then:

\Pr\bigl((x,y)=(a,b)\bigr)\geq 0\quad\text{for all }(a,b)\in\Sigma\times\Gamma,\qquad\sum_{(a,b)\in\Sigma\times\Gamma}\Pr\bigl((x,y)=(a,b)\bigr)=1

For example, for the system of two bits, where $\Sigma=\Gamma=\{0,1\}$ and the possible compound states are $(0,0),(0,1),(1,0),(1,1)$ , one of multiple possible probabilistic states can be:

\begin{aligned} \Pr\bigl((x,y)=(0,0)\bigr)&=\tfrac{1}{2}\\[4pt] \Pr\bigl((x,y)=(0,1)\bigr)&=0\\[4pt] \Pr\bigl((x,y)=(1,0)\bigr)&=0\\[4pt] \Pr\bigl((x,y)=(1,1)\bigr)&=\tfrac{1}{2} \end{aligned}

The two-bit system is equally likely to be in state $(0,0)$ or state $(1,1)$ , and has probability zero of being in the other two states. In vector form (using lexicographic order):

u=\begin{pmatrix} \tfrac{1}{2}\\[4pt] 0\\[4pt] 0\\[4pt] \tfrac{1}{2} \end{pmatrix} \begin{matrix} \leftarrow\;\text{probability associated with state }00\\[4pt] \leftarrow\;\text{probability associated with state }01\\[4pt] \leftarrow\;\text{probability associated with state }10\\[4pt] \leftarrow\;\text{probability associated with state }11 \end{matrix}

For another two-bit system, the probability state might look like:

v=\begin{pmatrix} \tfrac{1}{4}\\[4pt] \tfrac{1}{4}\\[4pt] \tfrac{1}{4}\\[4pt] \tfrac{1}{4} \end{pmatrix} \begin{matrix} \leftarrow\;\text{probability associated with state }00\\[4pt] \leftarrow\;\text{probability associated with state }01\\[4pt] \leftarrow\;\text{probability associated with state }10\\[4pt] \leftarrow\;\text{probability associated with state }11 \end{matrix}

For a given probabilistic state of $(X,Y)$ , we say $X$ and $Y$ are independent if $\Pr\bigl((x,y)=(a,b)\bigr)=\Pr(x=a)\,\Pr(y=b)$ for all $a\in\Sigma$ and $b\in\Gamma$ .

Let's check $u$ and $v$ against this rule — by looking for a contradiction.

u — suppose the rule holds:

u=\begin{pmatrix}\tfrac{1}{2}\\[4pt]0\\[4pt]0\\[4pt]\tfrac{1}{2}\end{pmatrix}\begin{array}{l}\leftarrow\text{ ① }\Pr(x{=}0)>0\\[4pt]\leftarrow\text{ ③ }=0,\text{ so }\Pr(x{=}0){=}0\text{ or }\Pr(y{=}1){=}0\text{ — contradicts ①② ✗}\\[4pt]\phantom{\leftarrow}\\[4pt]\leftarrow\text{ ② }\Pr(y{=}1)>0\end{array}

Contradiction — $X$ and $Y$ are not independent under $u$ .

v — no contradiction arises:

v=\begin{pmatrix}\tfrac{1}{4}\\[4pt]\tfrac{1}{4}\\[4pt]\tfrac{1}{4}\\[4pt]\tfrac{1}{4}\end{pmatrix}\begin{matrix}\leftarrow\;\tfrac{1}{4}=\tfrac{1}{2}\cdot\tfrac{1}{2}=\Pr(x{=}0)\,\Pr(y{=}0)\;\checkmark\\[4pt]\leftarrow\;\tfrac{1}{4}=\tfrac{1}{2}\cdot\tfrac{1}{2}=\Pr(x{=}0)\,\Pr(y{=}1)\;\checkmark\\[4pt]\leftarrow\;\tfrac{1}{4}=\tfrac{1}{2}\cdot\tfrac{1}{2}=\Pr(x{=}1)\,\Pr(y{=}0)\;\checkmark\\[4pt]\leftarrow\;\tfrac{1}{4}=\tfrac{1}{2}\cdot\tfrac{1}{2}=\Pr(x{=}1)\,\Pr(y{=}1)\;\checkmark\end{matrix}

$X$ and $Y$ are independent under $v$ .

Correlation is, in a sense, a lack of independence: when two systems are not independent, the state of one carries information about the state of the other.

Dirac notation

The same rule for independence can be written in Dirac notation. Suppose that a probabilistic state of $(X,Y)$ is expressed as a vector:

|\pi\rangle=\sum_{(a,b)\in\Sigma\times\Gamma}p_{ab}\,|ab\rangle

The systems $X$ and $Y$ are independent if there exist probability vectors

|\phi\rangle=\sum_{a\in\Sigma}q_a\,|a\rangle\quad\text{and}\quad|\psi\rangle=\sum_{b\in\Gamma}r_b\,|b\rangle

such that $p_{ab}=q_a r_b$ for all $a\in\Sigma$ and $b\in\Gamma$ .

$|\pi\rangle$ — the probabilistic state of the compound system $(X,Y)$
$p_{ab}$ — the probability assigned to outcome $(a,b)$
$|ab\rangle$ — a basis vector labelling the outcome $X{=}a,\,Y{=}b$ for $X,Y\in\{0,1\}$ these are the four standard basis vectors:

|00\rangle=\begin{pmatrix}1\\0\\0\\0\end{pmatrix},\quad|01\rangle=\begin{pmatrix}0\\1\\0\\0\end{pmatrix},\quad|10\rangle=\begin{pmatrix}0\\0\\1\\0\end{pmatrix},\quad|11\rangle=\begin{pmatrix}0\\0\\0\\1\end{pmatrix}

Returning to $u$ and $v$ from the earlier example. For $u$ , its column vector alongside its $|\pi\rangle$ expansion:

u=\begin{pmatrix}\textcolor{blue}{\tfrac{1}{2}}\\[4pt]0\\[4pt]0\\[4pt]\textcolor{orange}{\tfrac{1}{2}}\end{pmatrix}\qquad|\pi\rangle=\textcolor{blue}{\tfrac{1}{2}}\,|00\rangle+0\cdot|01\rangle+0\cdot|10\rangle+\textcolor{orange}{\tfrac{1}{2}}\,|11\rangle

For $v$ , its column vector alongside its $|\pi\rangle$ expansion:

v=\begin{pmatrix}\tfrac{1}{4}\\[4pt]\tfrac{1}{4}\\[4pt]\tfrac{1}{4}\\[4pt]\tfrac{1}{4}\end{pmatrix}\qquad|\pi\rangle=\tfrac{1}{4}\,|00\rangle+\tfrac{1}{4}\,|01\rangle+\tfrac{1}{4}\,|10\rangle+\tfrac{1}{4}\,|11\rangle

Since $X$ and $Y$ are independent under $v$ , there exist probability vectors $|\phi\rangle$ and $|\psi\rangle$ such that each coefficient in $|\pi\rangle$ is a product of one factor from each:

|\phi\rangle=\textcolor{blue}{\tfrac{1}{2}}\,|0\rangle+\textcolor{teal}{\tfrac{1}{2}}\,|1\rangle\qquad|\psi\rangle=\textcolor{orange}{\tfrac{1}{2}}\,|0\rangle+\textcolor{violet}{\tfrac{1}{2}}\,|1\rangle

|\pi\rangle=\textcolor{blue}{\tfrac{1}{2}}\cdot\textcolor{orange}{\tfrac{1}{2}}\,|00\rangle+\textcolor{blue}{\tfrac{1}{2}}\cdot\textcolor{violet}{\tfrac{1}{2}}\,|01\rangle+\textcolor{teal}{\tfrac{1}{2}}\cdot\textcolor{orange}{\tfrac{1}{2}}\,|10\rangle+\textcolor{teal}{\tfrac{1}{2}}\cdot\textcolor{violet}{\tfrac{1}{2}}\,|11\rangle

Tensor products of vectors

When working with multiple systems, we need a way to combine their vector spaces into a larger one. The mathematical operation that does this is the tensor product.

Given two vectors, $|\phi\rangle$ and $|\psi\rangle$ , their tensor product, written $|\phi\rangle\otimes|\psi\rangle$ , represents the combined state of both systems. Every basis state of the first vector is paired with every basis state of the second, and the corresponding coefficients are multiplied.

|\phi\rangle=\sum_{a\in\Sigma}\alpha_a\,|a\rangle\quad\text{and}\quad|\psi\rangle=\sum_{b\in\Gamma}\beta_b\,|b\rangle

|\phi\rangle\otimes|\psi\rangle=\sum_{(a,b)\in\Sigma\times\Gamma}\alpha_a\beta_b\,|ab\rangle

$|\phi\rangle$ — probability vector for system $X$ , with coefficients $\alpha_a$
$|\psi\rangle$ — probability vector for system $Y$ , with coefficients $\beta_b$
$\alpha_a\beta_b$ — coefficient of the compound basis state $|ab\rangle$ in $|\phi\rangle\otimes|\psi\rangle$
$\Sigma\times\Gamma$ — the Cartesian product of the two state sets; the sum runs over all possible pairs $(a,b)$

Inner product form

Equivalently, the vector $|\pi\rangle=|\phi\rangle\otimes|\psi\rangle$ is defined by this condition:

\langle ab|\pi\rangle=\langle a|\phi\rangle\langle b|\psi\rangle\qquad(\text{for all }a\in\Sigma\text{ and }b\in\Gamma)

\langle a|\phi\rangle=\alpha_a\qquad\langle b|\psi\rangle=\beta_b

For example, suppose

|\pi\rangle=0.3\,|00\rangle+\textcolor{teal}{0.4}\,|01\rangle+0.1\,|10\rangle+0.2\,|11\rangle

Then $\langle \textcolor{teal}{01}|\pi\rangle=\textcolor{teal}{0.4}$ . It is just extracting one coefficient.

Now suppose

|\phi\rangle=\textcolor{blue}{\tfrac{1}{\sqrt{2}}}\,|0\rangle+\tfrac{1}{\sqrt{2}}\,|1\rangle\qquad\text{and}\qquad|\psi\rangle=\tfrac{3}{5}\,|0\rangle+\textcolor{orange}{\tfrac{4}{5}}\,|1\rangle

Then:

\langle \textcolor{blue}{0}|\phi\rangle=\textcolor{blue}{\tfrac{1}{\sqrt{2}}},\qquad\langle \textcolor{orange}{1}|\psi\rangle=\textcolor{orange}{\tfrac{4}{5}}

Therefore:

\langle \textcolor{blue}{0}\textcolor{orange}{1}|\pi\rangle=\langle \textcolor{blue}{0}|\phi\rangle\langle \textcolor{orange}{1}|\psi\rangle=\textcolor{blue}{\tfrac{1}{\sqrt{2}}}\cdot\textcolor{orange}{\tfrac{4}{5}}

The amplitude of the combined outcome $01$ equals the product of the amplitudes of the individual outcomes $0$ and $1$ .

Column vector form

The tensor product can be viewed as a "multiply every entry by every entry" operation. Each coefficient of the first vector is paired with every coefficient of the second, producing a larger vector that represents all possible combinations of the two systems. As a result, dimensions multiply: if $|\phi\rangle$ has $m$ entries and $|\psi\rangle$ has $k$ entries, then $|\phi\rangle\otimes|\psi\rangle$ has $m\cdot k$ entries.

\begin{pmatrix}\alpha_1\\\vdots\\\alpha_m\end{pmatrix}\otimes\begin{pmatrix}\beta_1\\\vdots\\\beta_k\end{pmatrix}=\begin{pmatrix}\alpha_1\beta_1\\\vdots\\\alpha_1\beta_k\\\alpha_2\beta_1\\\vdots\\\alpha_2\beta_k\\\vdots\\\alpha_m\beta_1\\\vdots\\\alpha_m\beta_k\end{pmatrix}

Tensor product of standard basis vectors

The tensor product of two standard basis vectors is often written by simply combining their labels into a single basis label. Thus, instead of writing $|a\rangle\otimes|b\rangle$ , we commonly write $|ab\rangle$ , which can be viewed as shorthand for the basis vector indexed by the pair $(a,b)$ . More explicitly, one could write $|(a,b)\rangle$ , but in practice the parentheses are usually omitted and the notation $|a,b\rangle$ is preferred. This follows a common mathematical convention of removing symbols that do not add information or eliminate ambiguity. From a mathematician's perspective, once the structure is understood, the parentheses are carrying no real content and can be safely discarded. Of course, for anyone still getting comfortable with Dirac notation, the more explicit form $|(a,b)\rangle$ can be a useful stepping stone — it makes the two-label structure impossible to miss, and once that structure feels natural, dropping the parentheses costs nothing.

For example, for two-bit systems where $\Sigma=\Gamma=\{0,1\}$ , each of the four standard basis vectors of the compound system arises as a tensor product:

|0\rangle\otimes|0\rangle=|00\rangle,\quad|0\rangle\otimes|1\rangle=|01\rangle,\quad|1\rangle\otimes|0\rangle=|10\rangle,\quad|1\rangle\otimes|1\rangle=|11\rangle

To see this concretely, take $|0\rangle\otimes|1\rangle$ and apply the column-vector rule — multiply every entry of the first vector by every entry of the second:

|0\rangle\otimes|1\rangle=\begin{pmatrix}1\\0\end{pmatrix}\otimes\begin{pmatrix}0\\1\end{pmatrix}=\begin{pmatrix}1\cdot0\\1\cdot1\\0\cdot0\\0\cdot1\end{pmatrix}=\begin{pmatrix}0\\1\\0\\0\end{pmatrix}=|01\rangle

The result is exactly the standard basis vector $|01\rangle$ — confirming that the label shorthand and the column-vector computation agree.

Properties of tensor product

The tensor product is bilinear — it preserves the familiar rules of linearity in both of its arguments. You can distribute over addition and pull out scalar factors from either side independently.

First argument

(|\phi_1\rangle+|\phi_2\rangle)\otimes|\psi\rangle=|\phi_1\rangle\otimes|\psi\rangle+|\phi_2\rangle\otimes|\psi\rangle

(c\,|\phi\rangle)\otimes|\psi\rangle=c\,(|\phi\rangle\otimes|\psi\rangle)

(|0\rangle+|1\rangle)\otimes|0\rangle=\begin{pmatrix}1\\1\end{pmatrix}\otimes\begin{pmatrix}1\\0\end{pmatrix}=\begin{pmatrix}1\\0\\1\\0\end{pmatrix}=|00\rangle+|10\rangle

For scalar multiplication, take $c=3$ , $|\phi\rangle=|0\rangle$ , $|\psi\rangle=|1\rangle$ :

(3\,|0\rangle)\otimes|1\rangle=\begin{pmatrix}3\\0\end{pmatrix}\otimes\begin{pmatrix}0\\1\end{pmatrix}=\begin{pmatrix}0\\3\\0\\0\end{pmatrix}=3\,|01\rangle

Second argument

|\phi\rangle\otimes(|\psi_1\rangle+|\psi_2\rangle)=|\phi\rangle\otimes|\psi_1\rangle+|\phi\rangle\otimes|\psi_2\rangle

|\phi\rangle\otimes(c\,|\psi\rangle)=c\,(|\phi\rangle\otimes|\psi\rangle)

|1\rangle\otimes(|0\rangle+|1\rangle)=\begin{pmatrix}0\\1\end{pmatrix}\otimes\begin{pmatrix}1\\1\end{pmatrix}=\begin{pmatrix}0\\0\\1\\1\end{pmatrix}=|10\rangle+|11\rangle

For scalar multiplication, take $c=2$ , $|\phi\rangle=|0\rangle$ , $|\psi\rangle=|1\rangle$ :

|0\rangle\otimes(2\,|1\rangle)=\begin{pmatrix}1\\0\end{pmatrix}\otimes\begin{pmatrix}0\\2\end{pmatrix}=\begin{pmatrix}0\\2\\0\\0\end{pmatrix}=2\,|01\rangle

Multiple systems (multilinearity)

The bra $\langle a_1\cdots a_n|$ is shorthand for $\langle a_1|\otimes\langle a_2|\otimes\cdots\otimes\langle a_n|$ (tensor symbols are omitted for concise notation), so $\langle a_1\cdots a_n|\psi\rangle$ means applying that product bra to the tensor-product state. The equation says the larger inner product splits into matching ordinary overlaps:

(\langle a_1|\otimes\cdots\otimes\langle a_n|)(|\phi_1\rangle\otimes\cdots\otimes|\phi_n\rangle)=\langle a_1|\phi_1\rangle\cdots\langle a_n|\phi_n\rangle

For example, take $n=3$ with $|\phi_1\rangle=|0\rangle,\ |\phi_2\rangle=\tfrac{3}{5}\,|0\rangle+\tfrac{4}{5}\,|1\rangle,\ |\phi_3\rangle=|1\rangle$ and let $|\psi\rangle=|\phi_1\rangle\otimes|\phi_2\rangle\otimes|\phi_3\rangle$ . To read off the amplitude of the specific outcome $(a_1,a_2,a_3)=(0,1,1)$ , apply the formula directly — no need to expand the full tensor product first:

\langle \textcolor{blue}{0}\textcolor{violet}{1}\textcolor{orange}{1}|\psi\rangle=\textcolor{blue}{\langle 0|\phi_1\rangle}\cdot\textcolor{violet}{\langle 1|\phi_2\rangle}\cdot\textcolor{orange}{\langle 1|\phi_3\rangle}=\textcolor{blue}{\langle 0|0\rangle}\cdot\textcolor{violet}{\langle 1|\bigl(\tfrac{3}{5}|0\rangle+\tfrac{4}{5}|1\rangle\bigr)}\cdot\textcolor{orange}{\langle 1|1\rangle}=\textcolor{blue}{1}\cdot\textcolor{violet}{\tfrac{4}{5}}\cdot\textcolor{orange}{1}=\tfrac{4}{5}

The same value can be found by expanding the tensor product first, but that is a bit more work because we build the combined state and then apply the bra:

\begin{aligned}|\psi\rangle&=|0\rangle\otimes\bigl(\tfrac{3}{5}|0\rangle+\tfrac{4}{5}|1\rangle\bigr)\otimes|1\rangle=\textcolor{teal}{\tfrac{3}{5}}\,|001\rangle+\textcolor{violet}{\tfrac{4}{5}}\,|011\rangle\\\langle \textcolor{blue}{0}\textcolor{violet}{1}\textcolor{orange}{1}|\psi\rangle&=\langle \textcolor{blue}{0}\textcolor{violet}{1}\textcolor{orange}{1}|\bigl(\textcolor{teal}{\tfrac{3}{5}}\,|001\rangle+\textcolor{violet}{\tfrac{4}{5}}\,|011\rangle\bigr)=\textcolor{teal}{\tfrac{3}{5}}\cdot0+\textcolor{violet}{\tfrac{4}{5}}\cdot1=\tfrac{4}{5}\end{aligned}

Any other outcome follows the same pattern. For instance, $(a_1,a_2,a_3)=(0,0,1)$ :

\langle 001|\psi\rangle=\langle 0|\phi_1\rangle\cdot\langle 0|\phi_2\rangle\cdot\langle 1|\phi_3\rangle=1\cdot\tfrac{3}{5}\cdot1=\tfrac{3}{5}

The direct formula is the cleanest way to get one amplitude, but the recursive view is useful when we want the whole combined vector. It peels off the last factor:

|\phi_1\rangle\otimes\cdots\otimes|\phi_n\rangle=\bigl(|\phi_1\rangle\otimes\cdots\otimes|\phi_{n-1}\rangle\bigr)\otimes|\phi_n\rangle

Using the same example, keep the two coefficients from $|\phi_2\rangle$ visible while peeling off $|\phi_3\rangle=|1\rangle$ :

\begin{aligned} |\psi\rangle &=\bigl(|\phi_1\rangle\otimes|\phi_2\rangle\bigr)\otimes\textcolor{orange}{|\phi_3\rangle}\\ &=\left(\begin{pmatrix}1\\0\end{pmatrix}\otimes\begin{pmatrix}\textcolor{teal}{\tfrac{3}{5}}\\\textcolor{violet}{\tfrac{4}{5}}\end{pmatrix}\right)\otimes\textcolor{orange}{\begin{pmatrix}0\\1\end{pmatrix}}\\ &=\begin{pmatrix}\textcolor{teal}{\tfrac{3}{5}}\\\textcolor{violet}{\tfrac{4}{5}}\\0\\0\end{pmatrix}\otimes\textcolor{orange}{\begin{pmatrix}0\\1\end{pmatrix}}\\ &=\begin{pmatrix}0\\\textcolor{teal}{\tfrac{3}{5}}\\0\\\textcolor{violet}{\tfrac{4}{5}}\\0\\0\\0\\0\end{pmatrix}\\ &=\textcolor{teal}{\tfrac{3}{5}}\,|001\rangle+\textcolor{violet}{\tfrac{4}{5}}\,|011\rangle \end{aligned}

Measurement of probabilistic states

Consider the compound system $(X,Y)$ in the probabilistic state: $\tfrac{1}{2}|00\rangle+\tfrac{1}{2}|11\rangle$

Measuring all systems

Measuring the entire compound system at once is equivalent to measuring each subsystem independently — provided all systems are measured. The measurement produces a single combined outcome drawn from the joint probability distribution.

For this state the two possible combined outcomes are $|00\rangle$ and $|11\rangle$ , each with probability $\tfrac{1}{2}$ . Each individual measurement still happens according to those probabilities, but the whole state is measured together — producing exactly one combined result at a time: either $|00\rangle$ or $|11\rangle$ .

Measuring some systems

Suppose only a subset of systems is measured — for example, only $X$ from $(X,Y)$ . Then, to find the probability that $X$ equals some value $a$ , add up probabilities of all outcomes where $X=a$ :

\Pr(X=a)=\sum_{b\in\Gamma}\Pr\bigl((X,Y)=(a,b)\bigr)

For the probabilistic state $\tfrac{1}{2}|00\rangle+\tfrac{1}{2}|11\rangle$ , the table below expands the Dirac notation into the four possible joint outcomes of $(X,Y)$ and their probabilities.

Joint probability table for measuring X from the compound system X Y
X	Y	Pr
0	0	$\tfrac{1}{2}$
0	1	$0$
1	0	$0$
1	1	$\tfrac{1}{2}$

\Pr(X=0)=\Pr\bigl((X,Y)=(0,0)\bigr)+\Pr\bigl((X,Y)=(0,1)\bigr)=\tfrac{1}{2}+0=\tfrac{1}{2}

\Pr(X=1)=\Pr\bigl((X,Y)=(1,0)\bigr)+\Pr\bigl((X,Y)=(1,1)\bigr)=0+\tfrac{1}{2}=\tfrac{1}{2}

But what happens to our knowledge of $Y$ ?

After measuring $X$ and getting result $a$ , there can still be uncertainty about the state of $Y$ . If we already measured $X$ and got $a$ , what is the probability that $Y=b$ ?

\Pr(Y=b\mid X=a)= \begin{aligned} &\frac{\Pr\bigl((X,Y)=(a,b)\bigr)}{\Pr(X=a)} \quad \begin{array}{l} \leftarrow\;\text{Probability that both }X=a\text{ and }Y=b\text{ happen}\\[-1pt] \leftarrow\;\text{Probability that }X=a\text{ happened} \end{array} \end{aligned}

Think of the division as rescaling the probabilities so they add up to $1$ again after we focus on only one situation. For example, once we learn that $X=1$ , we ignore all outcomes where $X=0$ . The probabilities of the remaining outcomes no longer add up to $1$ , because part of the original probability space was removed.

To turn the remaining outcomes into a valid probability distribution again, we divide each remaining probability by the total probability of $X=1$ . This process is called normalization. So the division means: out of the world where $X=1$ happened, how likely is each remaining outcome?

If we measured $X=0$

\begin{aligned} \Pr(Y=0\mid X=0)&=\frac{\Pr\bigl((X,Y)=(0,0)\bigr)}{\Pr(X=0)}=\frac{\tfrac{1}{2}}{\tfrac{1}{2}}=1\\ \Pr(Y=1\mid X=0)&=\frac{\Pr\bigl((X,Y)=(0,1)\bigr)}{\Pr(X=0)}=\frac{0}{\tfrac{1}{2}}=0 \end{aligned}

If we measured $X=1$

\begin{aligned} \Pr(Y=0\mid X=1)&=\frac{\Pr\bigl((X,Y)=(1,0)\bigr)}{\Pr(X=1)}=\frac{0}{\tfrac{1}{2}}=0\\ \Pr(Y=1\mid X=1)&=\frac{\Pr\bigl((X,Y)=(1,1)\bigr)}{\Pr(X=1)}=\frac{\tfrac{1}{2}}{\tfrac{1}{2}}=1 \end{aligned}

Measuring one system, in Dirac notation

Everything above can be expressed directly on the state vector:

\sum_{(a,b)\in\Sigma\times\Gamma}p_{ab}\,|ab\rangle=\sum_{(a,b)\in\Sigma\times\Gamma}p_{ab}\,|a\rangle\otimes|b\rangle=\sum_{a\in\Sigma}|a\rangle\otimes\Bigl(\sum_{b\in\Gamma}p_{ab}\,|b\rangle\Bigr)

Reading the chain left to right:

$\sum_{(a,b)\in\Sigma\times\Gamma}p_{ab}\,|ab\rangle$ — a general probabilistic state of $(X,Y)$ : the sum over all possible joint outcomes $(a,b)$ , each weighted by its probability $p_{ab}$ .
$\sum p_{ab}\,|a\rangle\otimes|b\rangle$ — split every compound basis state into a tensor product, $|ab\rangle=|a\rangle\otimes|b\rangle$ , separating the $X$ part from the $Y$ part.
$\sum_{a\in\Sigma}|a\rangle\otimes\bigl(\sum_{b\in\Gamma}p_{ab}\,|b\rangle\bigr)$
— use bilinearity to pull the shared $|a\rangle$ out of the inner sum. This groups the terms by the value of $X$ : one branch per value $a$ , with all of $Y$ 's weight collected inside the parentheses.

For example, for the probabilistic state $\tfrac{1}{2}|00\rangle+\tfrac{1}{2}|11\rangle$ , we can split the compound state $|00\rangle$ into $|0\rangle\otimes|0\rangle$ , and $|11\rangle$ into $|1\rangle\otimes|1\rangle$ , and group by $X$ :

\tfrac{1}{2}|00\rangle+\tfrac{1}{2}|11\rangle=\tfrac{1}{2}\bigl(|0\rangle\otimes|0\rangle\bigr)+\tfrac{1}{2}\bigl(|1\rangle\otimes|1\rangle\bigr)=

|0\rangle

↑if X=|0⟩

\otimes

\bigl(\tfrac{1}{2}|0\rangle\bigr)

↑Y has this distribution

+

|1\rangle

↑if X=|1⟩

\otimes

\bigl(\tfrac{1}{2}|1\rangle\bigr)

↑Y has this distribution

To get the probability of measuring $X=a$ , add the probabilities of all states that start with $a$ :

\Pr(X=a)=\sum_{b\in\Gamma}p_{ab}

Where:

$p_{ab}$ — the probability of the joint outcome $(a,b)$ . The first index $a$ is the value of $X$ , the second index $b$ is the value of $Y$ — so $p_{01}$ means $\Pr\bigl((X,Y)=(0,1)\bigr)$ .
$\sum_{b\in\Gamma}$ — keep $X$ fixed at $a$ and sweep over every possible $Y$ ; that is, add up every outcome that starts with $a$ .

After measuring $X=a$ , all branches with other values of $X$ disappear. The remaining state of $Y$ is the surviving branch, divided by its total weight so the coefficients add back up to $1$ :

\frac{\sum_{b\in\Gamma}p_{ab}\,|b\rangle}{\Pr(X=a)}\qquad\text{where}\qquad\Pr(X=a)=\sum_{c\in\Gamma}p_{ac}

The index in the normalizing sum is just a dummy variable: writing $c$ instead of $b$ avoids clashing with the $b$ in the numerator, but both range over all of $\Gamma$ . What it really collects is every outcome whose first coordinate is $a$ .

Example

Take the probabilistic state of $(X,Y)$ :

\tfrac{1}{12}\,|00\rangle+\tfrac{1}{4}\,|01\rangle+\tfrac{1}{3}\,|10\rangle+\tfrac{1}{3}\,|11\rangle

We measure only $X$ (the first bit). Grouping by $X$ as above:

|0\rangle\otimes\Bigl(\tfrac{1}{12}\,|0\rangle+\tfrac{1}{4}\,|1\rangle\Bigr)+|1\rangle\otimes\Bigl(\tfrac{1}{3}\,|0\rangle+\tfrac{1}{3}\,|1\rangle\Bigr)

If we measured $X=0$

\Pr(X=0)=\tfrac{1}{12}+\tfrac{1}{4}=\tfrac{1}{3}

The probabilistic state of $Y$ becomes (normalize by $\tfrac{1}{3}$ ):

\frac{\tfrac{1}{12}\,|0\rangle+\tfrac{1}{4}\,|1\rangle}{\tfrac{1}{3}}=\tfrac{1}{4}\,|0\rangle+\tfrac{3}{4}\,|1\rangle

If we measured $X=1$

\Pr(X=1)=\tfrac{1}{3}+\tfrac{1}{3}=\tfrac{2}{3}

The probabilistic state of $Y$ becomes (normalize by $\tfrac{2}{3}$ ):

\frac{\tfrac{1}{3}\,|0\rangle+\tfrac{1}{3}\,|1\rangle}{\tfrac{2}{3}}=\tfrac{1}{2}\,|0\rangle+\tfrac{1}{2}\,|1\rangle

Measuring some: Y

Just like we grouped by $X$ , we can apply the same principle and group by $Y$ — regroup the same sum by $|b\rangle$ instead of $|a\rangle$ :

\sum_{(a,b)\in\Sigma\times\Gamma}p_{ab}\,|ab\rangle=\sum_{(a,b)\in\Sigma\times\Gamma}p_{ab}\,|a\rangle\otimes|b\rangle=\sum_{b\in\Gamma}

\Bigl(\sum_{a\in\Sigma}p_{ab}\,|a\rangle\Bigr)

↑X has this distribution

\otimes

|b\rangle

↑if Y=b

To get the probability of measuring $Y=b$ , add the probabilities of all states that end with $b$ :

\Pr(Y=b)=\sum_{a\in\Sigma}p_{ab}

After measuring $Y=b$ , all branches with other values of $Y$ disappear, and the remaining state of $X$ is that branch normalized by its total weight:

\frac{\sum_{a\in\Sigma}p_{ab}\,|a\rangle}{\Pr(Y=b)}\qquad\text{where}\qquad\Pr(Y=b)=\sum_{c\in\Sigma}p_{cb}

Example

Take the same state, but this time measure only $Y$ (the second bit):

\tfrac{1}{12}\,|00\rangle+\tfrac{1}{4}\,|01\rangle+\tfrac{1}{3}\,|10\rangle+\tfrac{1}{3}\,|11\rangle

Grouping by $Y$ this time:

\Bigl(\tfrac{1}{12}\,|0\rangle+\tfrac{1}{3}\,|1\rangle\Bigr)\otimes|0\rangle+\Bigl(\tfrac{1}{4}\,|0\rangle+\tfrac{1}{3}\,|1\rangle\Bigr)\otimes|1\rangle

If we measured $Y=0$

\Pr(Y=0)=\tfrac{1}{12}+\tfrac{1}{3}=\tfrac{5}{12}

The probabilistic state of $X$ becomes (normalize by $\tfrac{5}{12}$ ):

\frac{\tfrac{1}{12}\,|0\rangle+\tfrac{1}{3}\,|1\rangle}{\tfrac{5}{12}}=\tfrac{1}{5}\,|0\rangle+\tfrac{4}{5}\,|1\rangle

If we measured $Y=1$

\Pr(Y=1)=\tfrac{1}{4}+\tfrac{1}{3}=\tfrac{7}{12}

The probabilistic state of $X$ becomes (normalize by $\tfrac{7}{12}$ ):

\frac{\tfrac{1}{4}\,|0\rangle+\tfrac{1}{3}\,|1\rangle}{\tfrac{7}{12}}=\tfrac{3}{7}\,|0\rangle+\tfrac{4}{7}\,|1\rangle

Note: for classical, probabilistic systems these conditional probabilities are easier to handle with simple conditional-probability tables. But later, with quantum states, those simple tables stop working — so Dirac notation it is (I am starting to get used to it, but I understand the struggle, deeply!).

Operations on probabilistic states

Probabilistic operations on compound systems, just like for individual systems, are represented by stochastic matrices. But this time the matrices have rows and columns corresponding to the Cartesian product of the individual systems' classical state sets.

A deterministic example: controlled-NOT

Take a controlled-NOT operation on two bits $(X,Y)$ :

if $x=1$ ⇒ apply NOT to $y$ ;
if $x=0$ ⇒ do nothing.

Here $X$ is the control bit and $Y$ is the target bit. It is deterministic — each input state maps to exactly one output state:

Input → output

\begin{aligned}|00\rangle&\mapsto|00\rangle\\|01\rangle&\mapsto|01\rangle\\|10\rangle&\mapsto|11\rangle\\|11\rangle&\mapsto|10\rangle\end{aligned}

Matrix representation

M=\begin{pmatrix}1&0&0&0\\0&1&0&0\\0&0&0&1\\0&0&1&0\end{pmatrix}

For example, applying the matrix operation to $|10\rangle$ flips the target, giving $|11\rangle$ :

M\,|10\rangle=\begin{pmatrix}1&0&0&0\\0&1&0&0\\0&0&0&1\\0&0&1&0\end{pmatrix}\begin{pmatrix}0\\0\\1\\0\end{pmatrix}=\begin{pmatrix}0\\0\\0\\1\end{pmatrix}=|11\rangle

Nothing special is going on — the operation is just a matrix acting on the probability vector.

A probabilistic example

A probabilistic operation makes a random choice. For example:

with probability $\tfrac{1}{2}$ ⇒ set $y=x$ ;
with probability $\tfrac{1}{2}$ ⇒ set $x=y$ .

Each branch is itself a deterministic stochastic matrix. Take the input $|10\rangle$ to see how both behave:

Set $y=x$

\begin{pmatrix}1&1&0&0\\0&0&0&0\\0&0&0&0\\0&0&1&1\end{pmatrix}\begin{pmatrix}0\\0\\1\\0\end{pmatrix}=\begin{pmatrix}0\\0\\0\\1\end{pmatrix}=|11\rangle

Set $x=y$

\begin{pmatrix}1&0&1&0\\0&0&0&0\\0&0&0&0\\0&1&0&1\end{pmatrix}\begin{pmatrix}0\\0\\1\\0\end{pmatrix}=\begin{pmatrix}1\\0\\0\\0\end{pmatrix}=|00\rangle

The overall probabilistic operation is the average of these two matrices, weighted by the probabilities $\tfrac{1}{2}$ :

\begin{pmatrix}1&\tfrac12&\tfrac12&0\\0&0&0&0\\0&0&0&0\\0&\tfrac12&\tfrac12&1\end{pmatrix}=\tfrac12\begin{pmatrix}1&1&0&0\\0&0&0&0\\0&0&0&0\\0&0&1&1\end{pmatrix}+\tfrac12\begin{pmatrix}1&0&1&0\\0&0&0&0\\0&0&0&0\\0&1&0&1\end{pmatrix}

The resulting matrix does not describe one concrete execution — it describes the distribution over outcomes after the random choice.

Simultaneous operations on a compound system

Suppose instead that two probabilistic operations act on separate systems — $M$ on $X$ and $N$ on $Y$ , each its own stochastic matrix on its own probability vector. If we perform both at the same time, how do we describe their combined effect on the $(X,Y)$ compound system?

Tensor product of matrices

Performing $M$ on $X$ and $N$ on $Y$ simultaneously is described by a single matrix on the compound system — the tensor product $M\otimes N$ . Writing each operation in Dirac notation,

M=\sum_{a,b\in\Sigma}\alpha_{ab}\,|a\rangle\langle b|\qquad N=\sum_{c,d\in\Gamma}\beta_{cd}\,|c\rangle\langle d|

the tensor product pairs every term of one with every term of the other, multiplying their coefficients:

M\otimes N=\sum_{a,b\in\Sigma}\;\sum_{c,d\in\Gamma}\alpha_{ab}\,\beta_{cd}\,|ac\rangle\langle bd|

$\alpha_{ab}$ — the entry of $M$ in row $a$ , column $b$
$\beta_{cd}$ — the entry of $N$ in row $c$ , column $d$
$|ac\rangle\langle bd|$ — the compound outer product, using the identity
$|a\rangle\langle b|\otimes|c\rangle\langle d|=|ac\rangle\langle bd|$

Example: bit‑flip $\otimes$ identity

First rewrite each in Dirac notation by reading off its entries: the entry in row $a$ , column $b$ is the coefficient of $|a\rangle\langle b|$ :

$M$ — bit‑flip on $X$

M=\begin{pmatrix}\textcolor{blue}{0}&\textcolor{orange}{1}\\[2pt]\textcolor{teal}{1}&\textcolor{violet}{0}\end{pmatrix}\qquad\begin{array}{l}\textcolor{blue}{\alpha_{00}=0}\;\longrightarrow\;\textcolor{blue}{0\,|0\rangle\langle 0|}\\[4pt]\textcolor{orange}{\alpha_{01}=1}\;\longrightarrow\;\textcolor{orange}{1\,|0\rangle\langle 1|}\\[4pt]\textcolor{teal}{\alpha_{10}=1}\;\longrightarrow\;\textcolor{teal}{1\,|1\rangle\langle 0|}\\[4pt]\textcolor{violet}{\alpha_{11}=0}\;\longrightarrow\;\textcolor{violet}{0\,|1\rangle\langle 1|}\end{array}

Written out and simplified:

M=\textcolor{blue}{0}\,|0\rangle\langle 0|+\textcolor{orange}{1}\,|0\rangle\langle 1|+\textcolor{teal}{1}\,|1\rangle\langle 0|+\textcolor{violet}{0}\,|1\rangle\langle 1|=\textcolor{orange}{|0\rangle\langle 1|}+\textcolor{teal}{|1\rangle\langle 0|}

$N$ — identity on $Y$

N=\begin{pmatrix}\textcolor{#dc2626}{1}&\textcolor{#15803d}{0}\\[2pt]\textcolor{#b45309}{0}&\textcolor{#db2777}{1}\end{pmatrix}\qquad\begin{array}{l}\textcolor{#dc2626}{\beta_{00}=1}\;\longrightarrow\;\textcolor{#dc2626}{1\,|0\rangle\langle 0|}\\[4pt]\textcolor{#15803d}{\beta_{01}=0}\;\longrightarrow\;\textcolor{#15803d}{0\,|0\rangle\langle 1|}\\[4pt]\textcolor{#b45309}{\beta_{10}=0}\;\longrightarrow\;\textcolor{#b45309}{0\,|1\rangle\langle 0|}\\[4pt]\textcolor{#db2777}{\beta_{11}=1}\;\longrightarrow\;\textcolor{#db2777}{1\,|1\rangle\langle 1|}\end{array}

Written out and simplified:

N=\textcolor{#dc2626}{1}\,|0\rangle\langle 0|+\textcolor{#15803d}{0}\,|0\rangle\langle 1|+\textcolor{#b45309}{0}\,|1\rangle\langle 0|+\textcolor{#db2777}{1}\,|1\rangle\langle 1|=\textcolor{#dc2626}{|0\rangle\langle 0|}+\textcolor{#db2777}{|1\rangle\langle 1|}

Method 1 — Kronecker blocks

Replace each entry of $M$ with the block $M_{ij}\,N$ :

M\otimes N=\begin{pmatrix}\textcolor{blue}{0}&\textcolor{orange}{1}\\\textcolor{teal}{1}&\textcolor{violet}{0}\end{pmatrix}\otimes\begin{pmatrix}1&0\\0&1\end{pmatrix}=\begin{pmatrix}\textcolor{blue}{0\cdot N}&\textcolor{orange}{1\cdot N}\\\textcolor{teal}{1\cdot N}&\textcolor{violet}{0\cdot N}\end{pmatrix}=

\begin{pmatrix}0&0&1&0\\0&0&0&1\\1&0&0&0\\0&1&0&0\end{pmatrix}

Method 2 — Dirac expansion

Distribute (bilinearity), collapse each term with the identity, then keep the equality chain going by turning each outer product into its matrix:

|a\rangle\langle b|\otimes|c\rangle\langle d|=|ac\rangle\langle bd|

\begin{aligned} M\otimes N &=\bigl(|0\rangle\langle 1|+|1\rangle\langle 0|\bigr)\otimes\bigl(|0\rangle\langle 0|+|1\rangle\langle 1|\bigr)\\[4pt] &=|0\rangle\langle 1|\otimes|0\rangle\langle 0|+|0\rangle\langle 1|\otimes|1\rangle\langle 1|+|1\rangle\langle 0|\otimes|0\rangle\langle 0|+|1\rangle\langle 0|\otimes|1\rangle\langle 1|\\[4pt] &=|00\rangle\langle 10|+|01\rangle\langle 11|+|10\rangle\langle 00|+|11\rangle\langle 01|\\[4pt] &=\begin{pmatrix}0&0&1&0\\0&0&0&0\\0&0&0&0\\0&0&0&0\end{pmatrix}+\begin{pmatrix}0&0&0&0\\0&0&0&1\\0&0&0&0\\0&0&0&0\end{pmatrix}+\begin{pmatrix}0&0&0&0\\0&0&0&0\\1&0&0&0\\0&0&0&0\end{pmatrix}+\begin{pmatrix}0&0&0&0\\0&0&0&0\\0&0&0&0\\0&1&0&0\end{pmatrix}\\[4pt] &=\begin{pmatrix}0&0&1&0\\0&0&0&1\\1&0&0&0\\0&1&0&0\end{pmatrix} \end{aligned}

Key idea of Dirac notation

A sandwich $\langle a|M|b\rangle$ is just the single entry of $M$ at row $a$ , column $b$ . The bra $\langle a|$ is the unit row vector that picks out row $a$ , and the ket $|b\rangle$ is the unit column vector that picks out column $b$ — multiplying them on either side of $M$ collapses the whole matrix down to one number. Indices count from $0$ , so $\langle 0|M|0\rangle$ is the top-left entry:

M=\begin{pmatrix}\textcolor{#0369a1}{1}&2\\3&4\end{pmatrix}\qquad\langle 0|M|0\rangle=\underbrace{\begin{pmatrix}1&0\end{pmatrix}}_{\langle 0|}\begin{pmatrix}1&2\\3&4\end{pmatrix}\underbrace{\begin{pmatrix}1\\0\end{pmatrix}}_{|0\rangle}=\textcolor{#0369a1}{1}

Equivalent entry rule

Equivalently, the tensor product is the matrix whose compound entry is found by multiplying the matching entry from $M$ with the matching entry from $N$ :

\langle ac|M\otimes N|bd\rangle=\langle a|M|b\rangle\,\langle c|N|d\rangle\qquad\text{for all }a,b\in\Sigma\text{ and }c,d\in\Gamma

Read $\langle ac|M\otimes N|bd\rangle$ from right to left: $|bd\rangle$ is the starting column, $M\otimes N$ is the matrix you apply, and $\langle ac|$ is the output row you read. For example, let's calculate $\langle 10|M\otimes N|00\rangle$ . Start with the input column $|00\rangle$ , apply $M\otimes N$ , then read the value in the output row $\langle 10|$ — the result is $1$ .
columns in $|bd\rangle$
$|00\rangle$
$|01\rangle$
$|10\rangle$
$|11\rangle$
$\downarrow$
$M\otimes N=$
$\langle 00|$
$\langle 01|$
$\langle 10|$
$\langle 11|$
0
0
1
0
0
0
0
1
1
0
0
0
0
1
0
0
$\leftarrow$ rows out $\langle ac|=\langle 10|$
$\langle 10|M\otimes N|00\rangle=1$
The right side asks the same question one system at a time: $\langle a|M|b\rangle$ asks how much $M$ sends $|b\rangle$ to $|a\rangle$ , and $\langle c|N|d\rangle$ asks how much $N$ sends $|d\rangle$ to $|c\rangle$ . For the same example, look up each factor in its own matrix — $\langle 1|M|0\rangle$ is the entry of $M$ in row $\langle 1|$ , column $|0\rangle$ , and $\langle 0|N|0\rangle$ likewise for $N$ — then multiply them:
$M=$
$|0\rangle$
$|1\rangle$
$\langle 0|$
$\langle 1|$
0
1
1
0
$N=$
$|0\rangle$
$|1\rangle$
$\langle 0|$
$\langle 1|$
1
0
0
1
$\langle 1|M|0\rangle\cdot\langle 0|N|0\rangle=1\cdot 1=1$
In this example, $M$ flips the first bit and $N$ leaves the second unchanged, so $M\otimes N$ sends $|00\rangle$ straight to $|10\rangle$ . The resulting $1$ is the amplitude of that transition: it says all of the input lands on $|10\rangle$ and none on any other basis state — the mapping is exact and deterministic (a coefficient of $0$ would mean $|00\rangle$ never reaches $|10\rangle$ ).

Why the entry rule holds

We want the entry of $M\otimes N$ at row $\langle ac|$ and column $|bd\rangle$ . The rule says: take the matching entry from $M$ , take the matching entry from $N$ , then multiply them.

\langle ac|M\otimes N|bd\rangle=\langle a|M|b\rangle\,\langle c|N|d\rangle

Derivation

\langle ac|M\otimes N|bd\rangle

The compound entry we want.

=\langle ac|\left(\sum_{i,j\in\Sigma}\alpha_{ij}|i\rangle\langle j|\right)\otimes\left(\sum_{k,l\in\Gamma}\beta_{kl}|k\rangle\langle l|\right)|bd\rangle

Write $M$ and $N$ as sums of weighted outer products.

=\sum_{i,j\in\Sigma}\sum_{k,l\in\Gamma}\alpha_{ij}\beta_{kl}\,\langle ac|ik\rangle\,\langle jl|bd\rangle

=\sum_{i,j\in\Sigma}\sum_{k,l\in\Gamma}\alpha_{ij}\beta_{kl}\,\langle a|i\rangle\,\langle c|k\rangle\,\langle j|b\rangle\,\langle l|d\rangle

Each compound overlap breaks into one bracket per system.

=\sum_{i,j\in\Sigma}\sum_{k,l\in\Gamma}\alpha_{ij}\beta_{kl}\,\delta_{ai}\delta_{ck}\delta_{jb}\delta_{ld}

Those brackets vanish unless $i=a$ , $j=b$ , $k=c$ , $l=d$ .

=\alpha_{ab}\beta_{cd}

Only that single term survives the double sum.

=\langle a|M|b\rangle\,\langle c|N|d\rangle

Exactly the per-system entry rule we set out to prove.

Selector picture

Focus on the $\alpha_{ij}$ part first. The two brackets are two tests on the same cell:

$\langle a|i\rangle$ asks: is this cell in row $i=a$ ?
$\langle j|b\rangle$ asks: is this cell in column $j=b$ ?

A cell must pass both tests. If it fails either one, it gets multiplied by $0$ .

\alpha_{ij}\langle a|i\rangle\langle j|b\rangle= \begin{cases} \alpha_{ab},&i=a\text{ and }j=b\\ 0,&\text{otherwise} \end{cases}

The $\beta_{kl}$ part does the same thing with $k=c$ and $l=d$ , so it leaves $\beta_{cd}$ .

Example: $a=1$ , $b=1$

j=0

j=1

j=2

i=0

\alpha_{00}

\alpha_{01}

\alpha_{02}

i=1

\alpha_{10}

\alpha_{11}

\alpha_{12}

i=2

\alpha_{20}

\alpha_{21}

\alpha_{22}

Pale cells pass one test but fail the other. The highlighted cell passes both, so it is the only one left.

Equivalent action on product states

Equivalently, $M\otimes N$ is the unique matrix that satisfies the equation for all vectors $|\varphi\rangle$ and $|\psi\rangle$ :

(M\otimes N)\,\bigl(|\varphi\rangle\otimes|\psi\rangle\bigr)=\bigl(M|\varphi\rangle\bigr)\otimes\bigl(N|\psi\rangle\bigr)

The tensor product is defined by one rule: apply $M$ to the first subsystem and $N$ to the second. Because every state can be built from basis states by adding them together, and linear maps preserve addition, this rule completely determines the full matrix.

Explicit formula

Collecting the entry rule into a single matrix gives the explicit form of the tensor product. Each entry is the product $\alpha_{ab}\,\beta_{cd}=\langle ac|M\otimes N|bd\rangle$ , so for $M$ with entries up to $\alpha_{mm}$ and $N$ with entries up to $\beta_{nn}$ :

M\otimes N=\begin{pmatrix}\alpha_{00}&\cdots&\alpha_{0m}\\\vdots&\ddots&\vdots\\\alpha_{m0}&\cdots&\alpha_{mm}\end{pmatrix}\otimes\begin{pmatrix}\beta_{00}&\cdots&\beta_{0n}\\\vdots&\ddots&\vdots\\\beta_{n0}&\cdots&\beta_{nn}\end{pmatrix}=\begin{pmatrix}\alpha_{00}\beta_{00}&\cdots&\alpha_{00}\beta_{0n}&\cdots&\alpha_{0m}\beta_{00}&\cdots&\alpha_{0m}\beta_{0n}\\[2pt]\vdots&\ddots&\vdots&&\vdots&\ddots&\vdots\\[2pt]\alpha_{00}\beta_{n0}&\cdots&\alpha_{00}\beta_{nn}&\cdots&\alpha_{0m}\beta_{n0}&\cdots&\alpha_{0m}\beta_{nn}\\[2pt]\vdots&&\vdots&\ddots&\vdots&&\vdots\\[2pt]\alpha_{m0}\beta_{00}&\cdots&\alpha_{m0}\beta_{0n}&\cdots&\alpha_{mm}\beta_{00}&\cdots&\alpha_{mm}\beta_{0n}\\[2pt]\vdots&\ddots&\vdots&&\vdots&\ddots&\vdots\\[2pt]\alpha_{m0}\beta_{n0}&\cdots&\alpha_{m0}\beta_{nn}&\cdots&\alpha_{mm}\beta_{n0}&\cdots&\alpha_{mm}\beta_{nn}\end{pmatrix}

Three or more matrices

Nothing about the entry rule was special to two systems. For $n$ factors $M_1\otimes\cdots\otimes M_n$ , a compound entry still splits into one bracket per system — each $M_k$ is asked the same question about its own bits in isolation, and the answers multiply:

\langle a_1\cdots a_n|\,M_1\otimes\cdots\otimes M_n\,|b_1\cdots b_n\rangle=\langle a_1|M_1|b_1\rangle\;\langle a_2|M_2|b_2\rangle\cdots\langle a_n|M_n|b_n\rangle

The product also stays compatible with ordinary matrix multiplication. Running one stack of operators after another is the same as multiplying the matrices system by system (the mixed‑product property):

\bigl(M_1\otimes\cdots\otimes M_n\bigr)\bigl(N_1\otimes\cdots\otimes N_n\bigr)=\bigl(M_1N_1\bigr)\otimes\cdots\otimes\bigl(M_nN_n\bigr)

Multiple systems: quantum

Quantum states

A quantum state of several systems is represented by a column vector whose indices correspond to the Cartesian product of the individual systems' classical state sets — exactly the same index set as the compound classical system, now carrying complex amplitudes instead of probabilities.

For two systems $X$ with state set $\Sigma$ and $Y$ with state set $\Gamma$ , the entries are indexed by $\Sigma\times\Gamma$ . If both are bits, the four indices are:

\{0,1\}\times\{0,1\}=\{00,\,01,\,10,\,11\}

So a quantum state of the two-bit system $XY$ is a four-entry column vector. Written as a combination of the standard basis states $|00\rangle,|01\rangle,|10\rangle,|11\rangle$ :

|\psi\rangle=\alpha_{00}\,|00\rangle+\alpha_{01}\,|01\rangle+\alpha_{10}\,|10\rangle+\alpha_{11}\,|11\rangle=\begin{pmatrix}\alpha_{00}\\\alpha_{01}\\\alpha_{10}\\\alpha_{11}\end{pmatrix}

As with a single system, the amplitudes are complex numbers and the vector is a unit vector: the squared absolute values sum to one, and $|\alpha_{ab}|^2$ is the probability of measuring the pair $(a,b)$ .

\sum_{(a,b)\in\Sigma\times\Gamma}|\alpha_{ab}|^2=1

Definite (basis) state

|10\rangle=\begin{pmatrix}0\\0\\1\\0\end{pmatrix}

$X$ is certainly $|1\rangle$ and $Y$ is certainly $|0\rangle$ .

Equal superposition

|\psi\rangle=\tfrac{1}{2}\bigl(|00\rangle+|01\rangle+|10\rangle+|11\rangle\bigr)=\tfrac{1}{2}\begin{pmatrix}1\\1\\1\\1\end{pmatrix}

All four outcomes are equally likely, each with probability $\bigl(\tfrac{1}{2}\bigr)^2=\tfrac{1}{4}$ .

Biased superposition

|\psi\rangle=\tfrac{1}{\sqrt{2}}\,|00\rangle+\tfrac{1}{2}\,|01\rangle+\tfrac{1}{2}\,|11\rangle=\begin{pmatrix}\tfrac{1}{\sqrt{2}}\\[4pt]\tfrac{1}{2}\\[4pt]0\\[4pt]\tfrac{1}{2}\end{pmatrix}

Still a unit vector: $\tfrac{1}{2}+\tfrac{1}{4}+\tfrac{1}{4}=1$ .

Entangled (Bell) state

|\phi^{+}\rangle=\tfrac{1}{\sqrt{2}}\bigl(|00\rangle+|11\rangle\bigr)=\tfrac{1}{\sqrt{2}}\begin{pmatrix}1\\0\\0\\1\end{pmatrix}

Measuring gives $|00\rangle$ or $|11\rangle$ with equal probability and never $|01\rangle$ or $|10\rangle$ , so the two bits always come out the same. Unlike the states above, it cannot be factored into a separate state for each bit — no $|\psi_X\rangle\otimes|\psi_Y\rangle$ equals $|\phi^{+}\rangle$ . That inseparability is what entanglement means.

In general, combining $n$ systems with state sets $\Sigma_1,\ldots,\Sigma_n$ gives a state vector indexed by $\Sigma_1\times\cdots\times\Sigma_n$ , so its dimension is the product $|\Sigma_1|\cdots|\Sigma_n|$ of the individual sizes — for $n$ qubits, $2^n$ amplitudes.

Tensor products of states

The previous states described one compound system directly. We can also build a compound state by combining states of the parts: the tensor product of two quantum state vectors is again a quantum state vector.

Let $|\phi\rangle$ be a state of system $X$ and $|\psi\rangle$ a state of system $Y$ . Their tensor product is a state of the joint system $(X,Y)$ :

|\phi\rangle\otimes|\psi\rangle

States of this form are called product states. They describe the two systems acting independently — each part has its own well-defined state, with no correlation between them. (Entangled states like $|\phi^{+}\rangle$ cannot be written this way.)

More generally, if $|\psi_1\rangle,\ldots,|\psi_n\rangle$ are states of systems $X_1,\ldots,X_n$ , then their tensor product is a product state of the whole compound system $(X_1,\ldots,X_n)$ :

|\psi_1\rangle\otimes\cdots\otimes|\psi_n\rangle

Example: a state that is not a product state

|\psi\rangle=\tfrac{1}{\sqrt{2}}\,|00\rangle+\tfrac{1}{\sqrt{2}}\,|11\rangle

It is a valid quantum state — a unit vector, since the squared amplitudes sum to one:

\left|\tfrac{1}{\sqrt{2}}\right|^2+\left|\tfrac{1}{\sqrt{2}}\right|^2=\tfrac{1}{2}+\tfrac{1}{2}=1

The Bell basis

The state from the previous example, $|\phi^{+}\rangle$ , is one of four Bell states. Each differs only by which basis pairs are combined and by a sign, and together they form the Bell basis — an orthonormal basis of the two-qubit space made entirely of maximally entangled states.

|\phi^{+}\rangle=\tfrac{1}{\sqrt{2}}\,|00\rangle+\tfrac{1}{\sqrt{2}}\,|11\rangle

|\phi^{-}\rangle=\tfrac{1}{\sqrt{2}}\,|00\rangle-\tfrac{1}{\sqrt{2}}\,|11\rangle

|\psi^{+}\rangle=\tfrac{1}{\sqrt{2}}\,|01\rangle+\tfrac{1}{\sqrt{2}}\,|10\rangle

|\psi^{-}\rangle=\tfrac{1}{\sqrt{2}}\,|01\rangle-\tfrac{1}{\sqrt{2}}\,|10\rangle

None of the four can be written as a tensor product $|\phi\rangle\otimes|\psi\rangle$ , so each is entangled. Because they are orthonormal, any two-qubit state can be expressed as a combination of these four.

Three-qubit states

Entanglement is not limited to pairs. Two famous three-qubit states show different ways three systems can be correlated — both are unit vectors and neither is a product state.

GHZ state

|\mathrm{GHZ}\rangle=\tfrac{1}{\sqrt{2}}\,|000\rangle+\tfrac{1}{\sqrt{2}}\,|111\rangle

All three qubits are either $|0\rangle$ or all $|1\rangle$ . Measuring any one qubit instantly fixes the other two — the three-qubit analogue of the Bell state $|\phi^{+}\rangle$ .

W state

|\mathrm{W}\rangle=\tfrac{1}{\sqrt{3}}\,|001\rangle+\tfrac{1}{\sqrt{3}}\,|010\rangle+\tfrac{1}{\sqrt{3}}\,|100\rangle

Exactly one qubit is $|1\rangle$ and its position is in superposition. Each squared amplitude is $\bigl(\tfrac{1}{\sqrt{3}}\bigr)^2=\tfrac{1}{3}$ , and the three sum to one.

Measurements

Measuring a compound quantum system works exactly like measuring a single one — provided every system is measured. A standard basis measurement of the whole system returns one combined classical outcome, drawn from the squared amplitudes just as in the single-system case.

If $|\psi\rangle$ is a quantum state of a system $(X_1,\ldots,X_n)$ and all systems are measured, then each $n$ -tuple

(a_1,\ldots,a_n)\in\Sigma_1\times\cdots\times\Sigma_n

(or string $a_1\cdots a_n$ ) is obtained with probability equal to the squared absolute value of its amplitude:

\Pr(\text{outcome}=a_1\cdots a_n)=\bigl|\langle a_1\cdots a_n|\psi\rangle\bigr|^2

The inner product $\langle a_1\cdots a_n|\psi\rangle$ simply picks out the amplitude sitting in front of the basis state $|a_1\cdots a_n\rangle$ — the entry of the state vector indexed by that outcome.

Example 1

Measuring both qubits of the Bell state $|\phi^{+}\rangle=\tfrac{1}{\sqrt{2}}\,|00\rangle+\tfrac{1}{\sqrt{2}}\,|11\rangle$ gives $00$ or $11$ only — the two qubits always agree:

\Pr(00)=\left|\tfrac{1}{\sqrt{2}}\right|^2=\tfrac{1}{2}\qquad\Pr(11)=\left|\tfrac{1}{\sqrt{2}}\right|^2=\tfrac{1}{2}\qquad\Pr(01)=\Pr(10)=0

Example 2

Subsystems need not be qubits and amplitudes may be complex. For the pair $(X,Y)$ in the state $\tfrac{3}{5}\,|0\rangle|{\textcolor{#dc2626}{\heartsuit}}\rangle-\tfrac{4i}{5}\,|1\rangle|{\spadesuit}\rangle$ :

\Pr(0,\textcolor{#dc2626}{\heartsuit})=\left|\tfrac{3}{5}\right|^2=\tfrac{9}{25}\qquad\Pr(1,\spadesuit)=\left|-\tfrac{4i}{5}\right|^2=\tfrac{16}{25}

The two add to $1$ , and the $i$ drops out under $|\cdot|^2$ — only amplitude magnitudes matter.

Measuring some systems

What if two systems $(X,Y)$ share a quantum state but we measure only $X$ and leave $Y$ alone? Write the joint state in the usual form:

|\psi\rangle=\sum_{(a,b)\in\Sigma\times\Gamma}\alpha_{ab}\,|ab\rangle

If both were measured, outcome $(a,b)$ would appear with probability $|\langle ab|\psi\rangle|^2=|\alpha_{ab}|^2$ . Measuring only $X$ must give the same probability for $X=a$ as summing over every $Y$ outcome:

\Pr(X=a)=\sum_{b\in\Gamma}|\langle ab|\psi\rangle|^2=\sum_{b\in\Gamma}|\alpha_{ab}|^2

Just as in the probabilistic setting, the state of $Y$ changes as a result. The branch with $X=a$ survives and must be renormalized back to a unit vector — but because these are amplitudes, not probabilities, we divide by the square root of $\Pr(X=a)$ :

|\psi_Y\rangle=\frac{\sum_{b\in\Gamma}\alpha_{ab}\,|b\rangle}{\sqrt{\Pr(X=a)}}=\frac{\sum_{b\in\Gamma}\alpha_{ab}\,|b\rangle}{\sqrt{\sum_{c\in\Gamma}|\alpha_{ac}|^2}}

That square-root normalization is the one real difference from the classical case — otherwise partial measurement collapses a quantum compound system exactly the way it collapses a probabilistic one.

Example 3

Suppose $(X,Y)$ is in the state below and we measure only $X$ :

|\psi\rangle=\tfrac{1}{\sqrt{2}}\,|00\rangle+\tfrac{1}{2}\,|01\rangle+\tfrac{i}{2\sqrt{2}}\,|10\rangle-\tfrac{1}{2\sqrt{2}}\,|11\rangle

We begin by writing it grouped by $X$ , factoring each term into $|a\rangle\otimes|b\rangle$ :

|\psi\rangle=|0\rangle\otimes\Bigl(\tfrac{1}{\sqrt{2}}\,|0\rangle+\tfrac{1}{2}\,|1\rangle\Bigr)+|1\rangle\otimes\Bigl(\tfrac{i}{2\sqrt{2}}\,|0\rangle-\tfrac{1}{2\sqrt{2}}\,|1\rangle\Bigr)

The probability of each outcome is the squared norm of its branch. Recall the norm $\|\cdot\|$ is a vector's length, so the squared norm is just the sum of the squared amplitude magnitudes:

\Bigl\|\sum_b \gamma_b\,|b\rangle\Bigr\|^2=\sum_b |\gamma_b|^2

Then keep the surviving branch and divide by $\sqrt{\Pr(X=a)}$ so it is a unit vector again.

Outcome $X=0$

\Pr(X=0)=\Bigl\|\tfrac{1}{\sqrt{2}}|0\rangle+\tfrac{1}{2}|1\rangle\Bigr\|^2=\tfrac{1}{2}+\tfrac{1}{4}=\tfrac{3}{4}

Divide the $X=0$ branch by $\sqrt{\tfrac{3}{4}}=\tfrac{\sqrt{3}}{2}$ :

|0\rangle\otimes\frac{\tfrac{1}{\sqrt{2}}|0\rangle+\tfrac{1}{2}|1\rangle}{\sqrt{3/4}}=|0\rangle\otimes\Bigl(\sqrt{\tfrac{2}{3}}\,|0\rangle+\tfrac{1}{\sqrt{3}}\,|1\rangle\Bigr)

Outcome $X=1$

\Pr(X=1)=\Bigl\|\tfrac{i}{2\sqrt{2}}|0\rangle-\tfrac{1}{2\sqrt{2}}|1\rangle\Bigr\|^2=\tfrac{1}{8}+\tfrac{1}{8}=\tfrac{1}{4}

Divide the $X=1$ branch by $\sqrt{\tfrac{1}{4}}=\tfrac{1}{2}$ :

|1\rangle\otimes\frac{\tfrac{i}{2\sqrt{2}}|0\rangle-\tfrac{1}{2\sqrt{2}}|1\rangle}{\sqrt{1/4}}=|1\rangle\otimes\Bigl(\tfrac{i}{\sqrt{2}}\,|0\rangle-\tfrac{1}{\sqrt{2}}\,|1\rangle\Bigr)

Each squared amplitude in the post-measurement state now sums back to $1$ : for $X=0$ , $\tfrac{2}{3}+\tfrac{1}{3}=1$ ; for $X=1$ , $\tfrac{1}{2}+\tfrac{1}{2}=1$ — measuring $X$ has left $Y$ in a valid quantum state.

Measuring some: Y

The same works the other way round. Take the same state but measure only $Y$ , grouping each term by $Y$ instead:

|\psi\rangle=\Bigl(\tfrac{1}{\sqrt{2}}\,|0\rangle+\tfrac{i}{2\sqrt{2}}\,|1\rangle\Bigr)\otimes|0\rangle+\Bigl(\tfrac{1}{2}\,|0\rangle-\tfrac{1}{2\sqrt{2}}\,|1\rangle\Bigr)\otimes|1\rangle

Now each branch carries the amplitudes of $X$ . The same squared-norm rule gives the outcome probabilities, and the surviving branch is divided by $\sqrt{\Pr(Y=b)}$ :

Outcome $Y=0$

\Pr(Y=0)=\Bigl\|\tfrac{1}{\sqrt{2}}|0\rangle+\tfrac{i}{2\sqrt{2}}|1\rangle\Bigr\|^2=\tfrac{1}{2}+\tfrac{1}{8}=\tfrac{5}{8}

Divide the $Y=0$ branch by $\sqrt{\tfrac{5}{8}}$ :

\frac{\tfrac{1}{\sqrt{2}}|0\rangle+\tfrac{i}{2\sqrt{2}}|1\rangle}{\sqrt{5/8}}\otimes|0\rangle=\Bigl(\sqrt{\tfrac{4}{5}}\,|0\rangle+\tfrac{i}{\sqrt{5}}\,|1\rangle\Bigr)\otimes|0\rangle

Outcome $Y=1$

\Pr(Y=1)=\Bigl\|\tfrac{1}{2}|0\rangle-\tfrac{1}{2\sqrt{2}}|1\rangle\Bigr\|^2=\tfrac{1}{4}+\tfrac{1}{8}=\tfrac{3}{8}

Divide the $Y=1$ branch by $\sqrt{\tfrac{3}{8}}$ :

\frac{\tfrac{1}{2}|0\rangle-\tfrac{1}{2\sqrt{2}}|1\rangle}{\sqrt{3/8}}\otimes|1\rangle=\Bigl(\sqrt{\tfrac{2}{3}}\,|0\rangle-\tfrac{1}{\sqrt{3}}\,|1\rangle\Bigr)\otimes|1\rangle

As before the two probabilities add to $\tfrac{5}{8}+\tfrac{3}{8}=1$ , and each collapsed $X$ state is a unit vector again.

Example 4 — three qubits

Nothing changes with more systems. Take the W state of $(X,Y,Z)$ and measure only the first qubit $X$ , grouping the rest as $|x\rangle\otimes|yz\rangle$ :

|\mathrm{W}\rangle=\tfrac{1}{\sqrt{3}}\bigl(|001\rangle+|010\rangle+|100\rangle\bigr)=|0\rangle\otimes\tfrac{1}{\sqrt{3}}\bigl(|01\rangle+|10\rangle\bigr)+|1\rangle\otimes\tfrac{1}{\sqrt{3}}|00\rangle

Outcome $X=0$

\Pr(X=0)=\Bigl\|\tfrac{1}{\sqrt{3}}|01\rangle+\tfrac{1}{\sqrt{3}}|10\rangle\Bigr\|^2=\tfrac{1}{3}+\tfrac{1}{3}=\tfrac{2}{3}

Divide the branch by $\sqrt{\tfrac{2}{3}}$ — and $(Y,Z)$ is left in the Bell state $|\psi^{+}\rangle$ :

\frac{\tfrac{1}{\sqrt{3}}|01\rangle+\tfrac{1}{\sqrt{3}}|10\rangle}{\sqrt{2/3}}=\tfrac{1}{\sqrt{2}}\bigl(|01\rangle+|10\rangle\bigr)

Outcome $X=1$

\Pr(X=1)=\Bigl\|\tfrac{1}{\sqrt{3}}|00\rangle\Bigr\|^2=\tfrac{1}{3}

Divide the branch by $\sqrt{\tfrac{1}{3}}$ — and $(Y,Z)$ is left in the definite state $|00\rangle$ :

\frac{\tfrac{1}{\sqrt{3}}|00\rangle}{\sqrt{1/3}}=|00\rangle

This shows the robustness of the W state mentioned earlier: with probability $\tfrac{2}{3}$ losing one qubit still leaves the other two entangled — whereas a GHZ state would collapse to a fully definite $|00\rangle$ or $|11\rangle$ on either outcome.

Key idea: no matter how many systems there are, we can always regroup the state into the part being measured and the part left unmeasured — one $\otimes$ branch per outcome of the measured part. Each outcome's probability is the squared norm of its branch, and the unmeasured part is left in that branch, renormalized by $\sqrt{\Pr(\text{outcome})}$ . The split into “measured” vs. “unmeasured” is all that matters — the same recipe handles any subset of any number of systems.

Unitary operations

Just like for a single system, a quantum operation on a compound system is represented by a unitary matrix — but now its rows and columns are indexed by the Cartesian product of the individual classical state sets, the same index set as the compound state vector it acts on.

For instance, if $X$ has state set $\{1,2,3\}$ and $Y$ has state set $\{0,1\}$ , the compound system has $3\times 2=6$ classical states, so an operation on $(X,Y)$ is a $6\times 6$ unitary matrix:

U=\begin{pmatrix} \tfrac{1}{2} & \tfrac{1}{2} & \tfrac{1}{2} & 0 & 0 & \tfrac{1}{2}\\[2pt] \tfrac{1}{2} & \tfrac{i}{2} & -\tfrac{1}{2} & 0 & 0 & -\tfrac{i}{2}\\[2pt] \tfrac{1}{2} & -\tfrac{1}{2} & \tfrac{1}{2} & 0 & 0 & -\tfrac{1}{2}\\[2pt] 0 & 0 & 0 & \tfrac{1}{\sqrt{2}} & \tfrac{1}{\sqrt{2}} & 0\\[2pt] \tfrac{1}{2} & -\tfrac{i}{2} & -\tfrac{1}{2} & 0 & 0 & \tfrac{i}{2}\\[2pt] 0 & 0 & 0 & -\tfrac{1}{\sqrt{2}} & \tfrac{1}{\sqrt{2}} & 0 \end{pmatrix}

Independent operations: tensor product

The general matrix above can entangle the systems it acts on. But often each system is acted on independently — a separate gate on each, with no interaction between them. Just as the tensor product combined separate states into one compound vector, it combines these separate operations into one compound unitary. If $X_1,\ldots,X_n$ carry the operations $U_1,\ldots,U_n$ , the combined action on $(X_1,\ldots,X_n)$ is their tensor product:

U_1\otimes\cdots\otimes U_n

Read it slot by slot: the matrix in each position is the operation that system experiences on its own. A tensor product of unitaries is again unitary, so independent operations always assemble into a single valid operation on the whole compound system.

The most common case is acting on just one part and leaving the rest alone — and doing nothing is itself a unitary, the identity matrix $I$ . For instance, applying the Hadamard gate $H$ to the first qubit while leaving the second untouched is $H\otimes I$ , which passes the second qubit through unchanged:

H\otimes I=\begin{pmatrix}\tfrac{1}{\sqrt{2}}&\tfrac{1}{\sqrt{2}}\\[4pt]\tfrac{1}{\sqrt{2}}&-\tfrac{1}{\sqrt{2}}\end{pmatrix}\otimes\begin{pmatrix}1&0\\0&1\end{pmatrix}=\begin{pmatrix}\tfrac{1}{\sqrt{2}}&0&\tfrac{1}{\sqrt{2}}&0\\[4pt]0&\tfrac{1}{\sqrt{2}}&0&\tfrac{1}{\sqrt{2}}\\[4pt]\tfrac{1}{\sqrt{2}}&0&-\tfrac{1}{\sqrt{2}}&0\\[4pt]0&\tfrac{1}{\sqrt{2}}&0&-\tfrac{1}{\sqrt{2}}\end{pmatrix}

Swapping the order applies $H$ to the second qubit instead — now $H$ appears as two identical blocks along the diagonal:

I\otimes H=\begin{pmatrix}1&0\\0&1\end{pmatrix}\otimes\begin{pmatrix}\tfrac{1}{\sqrt{2}}&\tfrac{1}{\sqrt{2}}\\[4pt]\tfrac{1}{\sqrt{2}}&-\tfrac{1}{\sqrt{2}}\end{pmatrix}=\begin{pmatrix}\tfrac{1}{\sqrt{2}}&\tfrac{1}{\sqrt{2}}&0&0\\[4pt]\tfrac{1}{\sqrt{2}}&-\tfrac{1}{\sqrt{2}}&0&0\\[4pt]0&0&\tfrac{1}{\sqrt{2}}&\tfrac{1}{\sqrt{2}}\\[4pt]0&0&\tfrac{1}{\sqrt{2}}&-\tfrac{1}{\sqrt{2}}\end{pmatrix}

Operations that aren't tensor products: SWAP

A tensor product describes systems acted on independently, but not every unitary on a compound system factors that way. The standard example is the SWAP operation, which exchanges the contents of two systems $X$ and $Y$ sharing the same classical state set $\Sigma$ :

\mathrm{SWAP}\bigl(|\varphi\rangle\otimes|\psi\rangle\bigr)=|\psi\rangle\otimes|\varphi\rangle

To build that operation, consider one possible input basis state $|a,b\rangle$ . The bra $\langle a,b|$ recognizes that input, while the ket $|b,a\rangle$ supplies its swapped output. Their outer product therefore handles one input, and summing over every possible pair handles them all:

\mathrm{SWAP}=\sum_{a,b\in\Sigma}|b,a\rangle\langle a,b|=\sum_{a,b\in\Sigma}|b\rangle\langle a|\otimes|a\rangle\langle b|

For example, let's consider a simple system of two qubits. Each qubit has basis-state set $\Sigma=\{0,1\}$ , so both $a$ and $b$ can be either 0 or 1. Writing out all four possible pairs in the sum gives:

\mathrm{SWAP}=\underbrace{|0\rangle\langle0|\otimes|0\rangle\langle0|}_{(a,b)=(0,0)}+\underbrace{|1\rangle\langle0|\otimes|0\rangle\langle1|}_{(a,b)=(0,1)}+\underbrace{|0\rangle\langle1|\otimes|1\rangle\langle0|}_{(a,b)=(1,0)}+\underbrace{|1\rangle\langle1|\otimes|1\rangle\langle1|}_{(a,b)=(1,1)}

=\left[\begin{pmatrix}1\\0\end{pmatrix}\begin{pmatrix}1&0\end{pmatrix}\right]\otimes\left[\begin{pmatrix}1\\0\end{pmatrix}\begin{pmatrix}1&0\end{pmatrix}\right]+\left[\begin{pmatrix}0\\1\end{pmatrix}\begin{pmatrix}1&0\end{pmatrix}\right]\otimes\left[\begin{pmatrix}1\\0\end{pmatrix}\begin{pmatrix}0&1\end{pmatrix}\right]+\left[\begin{pmatrix}1\\0\end{pmatrix}\begin{pmatrix}0&1\end{pmatrix}\right]\otimes\left[\begin{pmatrix}0\\1\end{pmatrix}\begin{pmatrix}1&0\end{pmatrix}\right]+\left[\begin{pmatrix}0\\1\end{pmatrix}\begin{pmatrix}0&1\end{pmatrix}\right]\otimes\left[\begin{pmatrix}0\\1\end{pmatrix}\begin{pmatrix}0&1\end{pmatrix}\right]

=\begin{pmatrix}1&0\\0&0\end{pmatrix}\otimes\begin{pmatrix}1&0\\0&0\end{pmatrix}+\begin{pmatrix}0&0\\1&0\end{pmatrix}\otimes\begin{pmatrix}0&1\\0&0\end{pmatrix}+\begin{pmatrix}0&1\\0&0\end{pmatrix}\otimes\begin{pmatrix}0&0\\1&0\end{pmatrix}+\begin{pmatrix}0&0\\0&1\end{pmatrix}\otimes\begin{pmatrix}0&0\\0&1\end{pmatrix}

=\begin{pmatrix}1&0&0&0\\0&0&0&0\\0&0&0&0\\0&0&0&0\end{pmatrix}+\begin{pmatrix}0&0&0&0\\0&0&0&0\\0&1&0&0\\0&0&0&0\end{pmatrix}+\begin{pmatrix}0&0&0&0\\0&0&1&0\\0&0&0&0\\0&0&0&0\end{pmatrix}+\begin{pmatrix}0&0&0&0\\0&0&0&0\\0&0&0&0\\0&0&0&1\end{pmatrix}

=\begin{pmatrix}1&0&0&0\\0&0&1&0\\0&1&0&0\\0&0&0&1\end{pmatrix}

To apply SWAP, multiply its matrix by the compound state vector. For example, the basis state $|01\rangle$ is the second standard basis vector, so the multiplication moves its 1 into the position for $|10\rangle$ :

\mathrm{SWAP}|01\rangle=\begin{pmatrix}1&0&0&0\\0&0&1&0\\0&1&0&0\\0&0&0&1\end{pmatrix}\begin{pmatrix}0\\1\\0\\0\end{pmatrix}=\begin{pmatrix}0\\0\\1\\0\end{pmatrix}=|10\rangle

Controlled operations

Suppose that $X$ is a qubit and $Y$ is an arbitrary quantum system. A controlled- $U$ operation uses $X$ as a switch for a unitary operation $U$ on $Y$ . When the control is $|0\rangle$ , the target system is left unchanged; when the control is $|1\rangle$ , the operation $U$ is applied to it.

The projectors $|0\rangle\langle0|$ and $|1\rangle\langle1|$ select those two branches, giving the following operation on the pair $(X,Y)$ :

\operatorname{controlled}\text{-}U=|0\rangle\langle0|\otimes I_Y+|1\rangle\langle1|\otimes U=\begin{pmatrix}I_Y&0\\0&U\end{pmatrix}

The matrix $\begin{pmatrix}I_Y&0\\0&U\end{pmatrix}$ is a block matrix, not an ordinary 2 × 2 matrix. If $Y$ has $d$ basis states, then $I_Y$ , $U$ , and each zero are all $d\times d$ blocks. The complete controlled- $U$ matrix is therefore $2d\times2d$ . In particular, if $Y$ is a qubit, the blocks are $2\times2$ and the full matrix is $4\times4$ .

Example: controlled-NOT

Let the target $Y$ also be a qubit and choose $U=\sigma_x$ . On one qubit, $\sigma_x$ flips the two basis states:

\sigma_x=\begin{pmatrix}0&1\\1&0\end{pmatrix},\qquad \sigma_x|0\rangle=|1\rangle,\qquad \sigma_x|1\rangle=|0\rangle

Now substitute $U=\sigma_x$ and $I_Y=I_2$ into the controlled- $U$ formula. The following equalities turn the general controlled operation into the controlled-NOT, or CNOT, gate:

\mathrm{CNOT}=|0\rangle\langle0|\otimes I_2+|1\rangle\langle1|\otimes\sigma_x

=\begin{pmatrix}1&0\\0&0\end{pmatrix}\otimes\begin{pmatrix}1&0\\0&1\end{pmatrix}+\begin{pmatrix}0&0\\0&1\end{pmatrix}\otimes\begin{pmatrix}0&1\\1&0\end{pmatrix}

=\begin{pmatrix}I_2&0\\0&\sigma_x\end{pmatrix}

=\begin{pmatrix}1&0&0&0\\0&1&0&0\\0&0&0&1\\0&0&1&0\end{pmatrix}

In this example, the first digit is the control and the second is the target. Therefore $|10\rangle$ means that the control is $|1\rangle$ and the target is $|0\rangle$ . A control value of 1 turns the operation on. The control stays at 1, while $\sigma_x$ flips the target from 0 to 1:

\mathrm{CNOT}|10\rangle=|1\rangle\otimes\sigma_x|0\rangle=|1\rangle\otimes|1\rangle=|11\rangle

\mathrm{CNOT}|10\rangle=\begin{pmatrix}1&0&0&0\\0&1&0&0\\0&0&0&1\\0&0&1&0\end{pmatrix}\underbrace{\begin{pmatrix}0\\0\\1\\0\end{pmatrix}}_{|10\rangle}=\underbrace{\begin{pmatrix}0\\0\\0\\1\end{pmatrix}}_{|11\rangle}

The control can be any qubit

The first qubit is the control above only because we chose it that way. A controlled operation can use any qubit as its control. If the second qubit controls an operation $U$ on the first, the projectors move to the second tensor factor:

C_U^{(2\to1)}=I_2\otimes|0\rangle\langle0|+U\otimes|1\rangle\langle1|

With that ordering, the second digit of $|a,b\rangle$ is the control, and the first digit is the target.

Example: Fredkin operation

A controlled-SWAP on three qubits swaps the last two qubits only when the first qubit is 1. This is called the Fredkin operation, or Fredkin gate:

\mathrm{Fredkin}=|0\rangle\langle0|\otimes I_4+|1\rangle\langle1|\otimes\mathrm{SWAP}=\begin{pmatrix}1&0&0&0&0&0&0&0\\0&1&0&0&0&0&0&0\\0&0&1&0&0&0&0&0\\0&0&0&1&0&0&0&0\\0&0&0&0&1&0&0&0\\0&0&0&0&0&0&1&0\\0&0&0&0&0&1&0&0\\0&0&0&0&0&0&0&1\end{pmatrix}

Example: Toffoli operation

A controlled-controlled-NOT on three qubits flips the third qubit only when both the first and second qubits are 1. This is called the Toffoli operation, or Toffoli gate:

\mathrm{Toffoli}=|0\rangle\langle0|\otimes I_2\otimes I_2+|1\rangle\langle1|\otimes\left(|0\rangle\langle0|\otimes I_2+|1\rangle\langle1|\otimes\sigma_x\right)=\begin{pmatrix}1&0&0&0&0&0&0&0\\0&1&0&0&0&0&0&0\\0&0&1&0&0&0&0&0\\0&0&0&1&0&0&0&0\\0&0&0&0&1&0&0&0\\0&0&0&0&0&1&0&0\\0&0&0&0&0&0&0&1\\0&0&0&0&0&0&1&0\end{pmatrix}

Quantum circuits

Circuits as models of computation

A circuit is a graphical model of computation. It describes how information moves through a computation and which operations are applied along the way.

Wires represent the paths along which values travel from one part of the computation to another. Gates receive one or more input values, perform an operation on them, and pass the resulting values along their outgoing wires.

Interactive Boolean circuit editor

Click X or Y to toggle it. Drag nodes to move them, drag square wire handles to reroute, and drag circular output ports onto input ports to connect. Drag an occupied input port to reconnect its wire. Right-click anywhere on the board for context-specific actions.

The quantum circuit model

In the quantum circuit model, wires represent qubits and gates represent both unitary operations and measurements.

The terminology comes from physical electrical circuits, where wires carry current and components act on it. Here, wires and gates describe information flow, not electricity. The circuits considered here are acyclic: information flows in one direction, conventionally from left to right. A wire never loops back to an earlier gate, so the gates define an unambiguous order of computation.

A one-qubit circuit

From left to right, qubit $X$ passes through $H,\ S,\ H,\ T$ . Operators act on a ket from the left, so the rightmost matrix in a product acts first. The output is therefore $|\psi_{\mathrm{out}}\rangle=THSH|\psi_{\mathrm{in}}\rangle$ : the combined operation is written $THSH$ , the reverse of the visual $HSHT$ order. Hover over or focus a gate to see its full operation.

X

The three gate matrices are:

H=\frac{1}{\sqrt{2}}\begin{pmatrix}1&1\\1&-1\end{pmatrix},\qquad S=\begin{pmatrix}1&0\\0&i\end{pmatrix},\qquad T=\begin{pmatrix}1&0\\0&e^{i\pi/4}\end{pmatrix}=\begin{pmatrix}1&0\\0&\tfrac{1+i}{\sqrt{2}}\end{pmatrix}

Multiply one step at a time, starting at the right:

SH=\begin{pmatrix}1&0\\0&i\end{pmatrix}\frac{1}{\sqrt{2}}\begin{pmatrix}1&1\\1&-1\end{pmatrix}=\frac{1}{\sqrt{2}}\begin{pmatrix}1&1\\i&-i\end{pmatrix}

HSH=H(SH)=\frac{1}{\sqrt{2}}\begin{pmatrix}1&1\\1&-1\end{pmatrix}\frac{1}{\sqrt{2}}\begin{pmatrix}1&1\\i&-i\end{pmatrix}=\frac{1}{2}\begin{pmatrix}1+i&1-i\\1-i&1+i\end{pmatrix}

THSH=T(HSH)=\begin{pmatrix}1&0\\0&\tfrac{1+i}{\sqrt{2}}\end{pmatrix}\frac{1}{2}\begin{pmatrix}1+i&1-i\\1-i&1+i\end{pmatrix}=\begin{pmatrix}\tfrac{1+i}{2}&\tfrac{1-i}{2}\\\tfrac{1}{\sqrt{2}}&\tfrac{i}{\sqrt{2}}\end{pmatrix}

A controlled-NOT circuit

The Hadamard gate first acts on the upper qubit $Y$ . The filled dot then makes $Y$ the CNOT control, while the circled plus marks $X$ as its target. If $Y=0$ , the target is unchanged; if $Y=1$ , the target is flipped.

YX

For the matrix calculation, use the register order $(X,Y)$ : $|00\rangle_{XY},|01\rangle_{XY},|10\rangle_{XY},|11\rangle_{XY}$ . The Hadamard acts on $Y$ , the second tensor factor, so its two-qubit matrix is $I_2\otimes H$ :

I_2\otimes H=\begin{pmatrix}1&0\\0&1\end{pmatrix}\otimes\frac{1}{\sqrt{2}}\begin{pmatrix}1&1\\1&-1\end{pmatrix}=\begin{pmatrix}\tfrac{1}{\sqrt{2}}&\tfrac{1}{\sqrt{2}}&0&0\\\tfrac{1}{\sqrt{2}}&-\tfrac{1}{\sqrt{2}}&0&0\\0&0&\tfrac{1}{\sqrt{2}}&\tfrac{1}{\sqrt{2}}\\0&0&\tfrac{1}{\sqrt{2}}&-\tfrac{1}{\sqrt{2}}\end{pmatrix}

With $Y$ as the control, CNOT exchanges $|01\rangle$ and $|11\rangle$ while leaving the other two basis states unchanged:

\mathrm{CNOT}_{Y\to X}=\begin{pmatrix}1&0&0&0\\0&0&0&1\\0&0&1&0\\0&1&0&0\end{pmatrix}

CNOT acts after the Hadamard, so it appears on the left in the product:

U=\mathrm{CNOT}_{Y\to X}(I_2\otimes H)=\begin{pmatrix}1&0&0&0\\0&0&0&1\\0&0&1&0\\0&1&0&0\end{pmatrix}\begin{pmatrix}\tfrac{1}{\sqrt{2}}&\tfrac{1}{\sqrt{2}}&0&0\\\tfrac{1}{\sqrt{2}}&-\tfrac{1}{\sqrt{2}}&0&0\\0&0&\tfrac{1}{\sqrt{2}}&\tfrac{1}{\sqrt{2}}\\0&0&\tfrac{1}{\sqrt{2}}&-\tfrac{1}{\sqrt{2}}\end{pmatrix}=\begin{pmatrix}\tfrac{1}{\sqrt{2}}&\tfrac{1}{\sqrt{2}}&0&0\\0&0&\tfrac{1}{\sqrt{2}}&-\tfrac{1}{\sqrt{2}}\\0&0&\tfrac{1}{\sqrt{2}}&\tfrac{1}{\sqrt{2}}\\\tfrac{1}{\sqrt{2}}&-\tfrac{1}{\sqrt{2}}&0&0\end{pmatrix}

Applying that matrix to $|00\rangle_{XY}$ gives the Bell state:

U|00\rangle_{XY}=\begin{pmatrix}\tfrac{1}{\sqrt{2}}&\tfrac{1}{\sqrt{2}}&0&0\\0&0&\tfrac{1}{\sqrt{2}}&-\tfrac{1}{\sqrt{2}}\\0&0&\tfrac{1}{\sqrt{2}}&\tfrac{1}{\sqrt{2}}\\\tfrac{1}{\sqrt{2}}&-\tfrac{1}{\sqrt{2}}&0&0\end{pmatrix}\begin{pmatrix}1\\0\\0\\0\end{pmatrix}=\begin{pmatrix}\tfrac{1}{\sqrt{2}}\\0\\0\\\tfrac{1}{\sqrt{2}}\end{pmatrix}=\frac{|00\rangle+|11\rangle}{\sqrt{2}}

For all four computational-basis inputs, the circuit produces the four Bell states below. The final minus sign is a global phase and does not affect measurement probabilities.

\begin{aligned}U|00\rangle_{XY}&=\frac{|00\rangle+|11\rangle}{\sqrt{2}}=|\phi^{+}\rangle,\\[6pt]U|01\rangle_{XY}&=\frac{|00\rangle-|11\rangle}{\sqrt{2}}=|\phi^{-}\rangle,\\[6pt]U|10\rangle_{XY}&=\frac{|01\rangle+|10\rangle}{\sqrt{2}}=|\psi^{+}\rangle,\\[6pt]U|11\rangle_{XY}&=\frac{-|01\rangle+|10\rangle}{\sqrt{2}}=-|\psi^{-}\rangle.\end{aligned}

Follow the state through the circuit

To find the output for one input, we do not need to multiply the full gate matrices. Instead, follow the state from left to right and update it at each gate; the slices below are labeled $|\pi_0\rangle,|\pi_1\rangle,|\pi_2\rangle$ .

|0\rangle

|0\rangle

|\pi_0\rangle

|\pi_1\rangle

|\pi_2\rangle

\begin{aligned}|\pi_0\rangle&=|0\rangle_X|0\rangle_Y=|00\rangle_{XY},\\[6pt]|\pi_1\rangle&=|0\rangle_X|+\rangle_Y=\frac{|00\rangle+|01\rangle}{\sqrt{2}},\\[6pt]|\pi_2\rangle&=\mathrm{CNOT}_{Y\to X}|\pi_1\rangle=\frac{|00\rangle+|11\rangle}{\sqrt{2}}=|\phi^+\rangle.\end{aligned}

Classical states in a quantum circuit

A measurement connects quantum and classical information: it collapses a qubit to $|0\rangle$ or $|1\rangle$ and writes the corresponding bit onto a double classical wire. Here the measurements store Y in B and X in A. Because the qubits are in $|\phi^+\rangle$ , the classical result is $(A,B)=(0,0)$ or $(1,1)$ , each with probability one half; those bits can then control later operations or be read as output.

YXBA

Quantum-circuits symbols

Single-qubit gates

Controlled-NOT (CNOT)

SWAP

Toffoli (CCNOT)

Fredkin (controlled-SWAP)

Arbitrary unitary U

Controlled-U

Quantum states and measurements

Inner products

Suppose that we have two kets $\lvert\psi\rangle$ and $\lvert\phi\rangle$ with complex amplitudes:

\lvert\psi\rangle=\begin{pmatrix}\alpha_1\\\vdots\\\alpha_n\end{pmatrix}\qquad\lvert\phi\rangle=\begin{pmatrix}\beta_1\\\vdots\\\beta_n\end{pmatrix}

To calculate the inner product of $\lvert\psi\rangle$ and $\lvert\phi\rangle$ , first turn $\lvert\psi\rangle$ into the bra $\langle\psi\rvert=\lvert\psi\rangle^\dagger$ — its conjugate transpose, whose entries are the complex conjugates $\overline{\alpha_i}$ — then multiply it by $\lvert\phi\rangle$ to get a single number:

\langle\psi\vert\phi\rangle=\begin{pmatrix}\overline{\alpha_1}&\cdots&\overline{\alpha_n}\end{pmatrix}\begin{pmatrix}\beta_1\\\vdots\\\beta_n\end{pmatrix}=\overline{\alpha_1}\beta_1+\cdots+\overline{\alpha_n}\beta_n

For example, take the two qubit states:

\lvert\psi\rangle=\begin{pmatrix}\tfrac{1}{\sqrt{2}}\\[4pt]\tfrac{i}{\sqrt{2}}\end{pmatrix}\qquad\lvert\phi\rangle=\begin{pmatrix}\tfrac{1}{\sqrt{2}}\\[4pt]\tfrac{1}{\sqrt{2}}\end{pmatrix}

Conjugating the amplitudes of $\lvert\psi\rangle$ flips the $i$ to $-i$ :

\langle\psi\vert\phi\rangle=\begin{pmatrix}\tfrac{1}{\sqrt{2}}&-\tfrac{i}{\sqrt{2}}\end{pmatrix}\begin{pmatrix}\tfrac{1}{\sqrt{2}}\\[2pt]\tfrac{1}{\sqrt{2}}\end{pmatrix}=\tfrac{1}{\sqrt{2}}\cdot\tfrac{1}{\sqrt{2}}-\tfrac{i}{\sqrt{2}}\cdot\tfrac{1}{\sqrt{2}}=\frac{1-i}{2}

Alternatively, suppose the same vectors are written as sums over a basis $\Sigma$ :

\lvert\psi\rangle=\sum_{a\in\Sigma}\alpha_a\lvert a\rangle\qquad\lvert\phi\rangle=\sum_{b\in\Sigma}\beta_b\lvert b\rangle

This gives the same formula as before, just in a different format. Expanding the product term by term, each $\langle a\vert b\rangle$ is $1$ when $a=b$ and $0$ otherwise, so only the matching terms survive:

\begin{aligned}\langle\psi\vert\phi\rangle&=\left(\sum_{a\in\Sigma}\overline{\alpha_a}\langle a\rvert\right)\left(\sum_{b\in\Sigma}\beta_b\lvert b\rangle\right)\\[2pt]&=\sum_{a\in\Sigma}\sum_{b\in\Sigma}\overline{\alpha_a}\beta_b\langle a\vert b\rangle\\[2pt]&=\sum_{a\in\Sigma}\overline{\alpha_a}\beta_a\end{aligned}

Our example states in this form, over the basis $\Sigma=\{0,1\}$ :

\lvert\psi\rangle=\tfrac{1}{\sqrt{2}}\lvert0\rangle+\tfrac{i}{\sqrt{2}}\lvert1\rangle\qquad\lvert\phi\rangle=\tfrac{1}{\sqrt{2}}\lvert0\rangle+\tfrac{1}{\sqrt{2}}\lvert1\rangle

Substituting our values into the formula, we get (the $\langle 0\vert 1\rangle$ and $\langle 1\vert 0\rangle$ terms are $0$ , so they cancel):

\begin{aligned}\langle\psi\vert\phi\rangle&=\left(\tfrac{1}{\sqrt{2}}\langle 0\rvert-\tfrac{i}{\sqrt{2}}\langle 1\rvert\right)\left(\tfrac{1}{\sqrt{2}}\lvert 0\rangle+\tfrac{1}{\sqrt{2}}\lvert 1\rangle\right)\\[4pt]&=\tfrac{1}{2}\langle 0\vert 0\rangle+\cancel{\tfrac{1}{2}\langle 0\vert 1\rangle}-\cancel{\tfrac{i}{2}\langle 1\vert 0\rangle}-\tfrac{i}{2}\langle 1\vert 1\rangle\\[4pt]&=\tfrac{1}{2}-\tfrac{i}{2}=\frac{1-i}{2}\end{aligned}

Inner product as an angle

When the amplitudes are all real, the conjugation does nothing ( $\overline{\alpha}=\alpha$ ), and the inner product has a clean geometric meaning: for two unit vectors it equals the cosine of the angle between them.

\langle\psi\vert\phi\rangle=\alpha_0\beta_0+\alpha_1\beta_1=\cos\theta

|ψ⟩ = 1/√2|0⟩ − 1/√2|1⟩

|ϕ⟩ = 1/2|0⟩ + √3/2|1⟩

θ = 105°

⟨ψ|ϕ⟩ = cos θ = -0.26

Drag either tip around the circle to see how cos changes value

This geometric interpretation only works when all amplitudes are real. With complex amplitudes, the inner product becomes a complex number, so it no longer represents the cosine of an ordinary angle. The quantity that remains physically meaningful is its magnitude, $\lvert\langle\psi\vert\phi\rangle\rvert$ , which determines measurement probabilities.

Inner product as an angle in multidimensional space

The idea of the inner product as an angle for real amplitudes generalizes to any number of dimensions: for real unit vectors the inner product is still the cosine of the angle between them — it just lives on a higher-dimensional sphere. Below is the three-dimensional case (a qutrit with real amplitudes, basis $\lvert0\rangle,\lvert1\rangle,\lvert2\rangle$ ):

\langle\psi\vert\phi\rangle=\alpha_0\beta_0+\alpha_1\beta_1+\alpha_2\beta_2=\cos\theta

|ψ⟩ = 1/√2|0⟩ + 0|1⟩ + 1/√2|2⟩

|ϕ⟩ = 0|0⟩ + 1/√2|1⟩ + 1/√2|2⟩

θ = 60°

⟨ψ|ϕ⟩ = cos θ = 0.50

Drag a tip to move it on the sphere; drag the background to rotate the view.

Properties of the inner product

Relationship to the Euclidean norm

Take the inner product of a vector $\lvert\psi\rangle=\sum_{a\in\Sigma}\alpha_a\lvert a\rangle$ with itself. Each conjugate pair collapses to a squared magnitude, $\overline{\alpha_a}\alpha_a=\lvert\alpha_a\rvert^2$ , so the result is the sum of squared amplitudes — exactly the squared Euclidean length of the vector:

\langle\psi\vert\psi\rangle=\sum_{a\in\Sigma}\overline{\alpha_a}\alpha_a=\sum_{a\in\Sigma}\lvert\alpha_a\rvert^2=\bigl\lVert\,\lvert\psi\rangle\,\bigr\rVert^2

When a state is normalized (that is, it represents a valid quantum state), its inner product with itself equals $1$ . Equivalently, its Euclidean norm equals $1$ . For example, for the vector $\lvert\psi\rangle=\tfrac{1}{\sqrt{2}}\lvert0\rangle+\tfrac{i}{\sqrt{2}}\lvert1\rangle$ :

\langle\psi\vert\psi\rangle=\left\lvert\tfrac{1}{\sqrt{2}}\right\rvert^2+\left\lvert\tfrac{i}{\sqrt{2}}\right\rvert^2=\tfrac{1}{2}+\tfrac{1}{2}=1

More generally, the Euclidean norm of any vector is the square root of its inner product with itself:

\bigl\lVert\,\lvert\psi\rangle\,\bigr\rVert=\sqrt{\langle\psi\vert\psi\rangle}

Conjugate symmetry

Swapping the order of the two vectors conjugates a different set of amplitudes. For $\lvert\psi\rangle=\sum_{a\in\Sigma}\alpha_a\lvert a\rangle$ and $\lvert\phi\rangle=\sum_{a\in\Sigma}\beta_a\lvert a\rangle$ , the two orderings are

\langle\psi\vert\phi\rangle=\sum_{a\in\Sigma}\overline{\alpha_a}\beta_a\qquad\text{and}\qquad\langle\phi\vert\psi\rangle=\sum_{a\in\Sigma}\overline{\beta_a}\alpha_a,

which differ only in which factor carries the bar. In fact the two are complex conjugates of each other:

\overline{\langle\psi\vert\phi\rangle}=\langle\phi\vert\psi\rangle.

Why. Conjugate $\langle\psi\vert\phi\rangle$ , pulling the bar inside the sum and onto each factor:

\overline{\langle\psi\vert\phi\rangle}=\overline{\sum_{a\in\Sigma}\overline{\alpha_a}\beta_a}=\sum_{a\in\Sigma}\overline{\overline{\alpha_a}\beta_a}=\sum_{a\in\Sigma}\alpha_a\overline{\beta_a}.

Because complex multiplication is commutative, $\alpha_a\overline{\beta_a}=\overline{\beta_a}\alpha_a$ , the final summand is exactly that of $\langle\phi\vert\psi\rangle$ , which proves the identity.

Example. Take the two states

\lvert\psi\rangle=\tfrac{1}{\sqrt{2}}\lvert0\rangle+\tfrac{i}{\sqrt{2}}\lvert1\rangle\qquad\lvert\phi\rangle=\tfrac{1}{\sqrt{2}}\lvert0\rangle+\tfrac{1}{\sqrt{2}}\lvert1\rangle

Computing both orderings yields a conjugate pair:

\langle\psi\vert\phi\rangle=\tfrac{1}{\sqrt{2}}\cdot\tfrac{1}{\sqrt{2}}-\tfrac{i}{\sqrt{2}}\cdot\tfrac{1}{\sqrt{2}}=\frac{1-i}{2}

\langle\phi\vert\psi\rangle=\tfrac{1}{\sqrt{2}}\cdot\tfrac{1}{\sqrt{2}}+\tfrac{1}{\sqrt{2}}\cdot\tfrac{i}{\sqrt{2}}=\frac{1+i}{2}=\overline{\left(\tfrac{1-i}{2}\right)}.

Linearity in the second argument

Suppose that $\lvert\psi\rangle$ , $\lvert\phi_1\rangle$ , and $\lvert\phi_2\rangle$ are vectors and $\alpha_1$ and $\alpha_2$ are complex numbers. If we define a new vector

\lvert\phi\rangle=\alpha_1\lvert\phi_1\rangle+\alpha_2\lvert\phi_2\rangle,

then the inner product distributes over the combination, with each coefficient pulled out in front:

\langle\psi\vert\phi\rangle=\langle\psi\vert\bigl(\alpha_1\lvert\phi_1\rangle+\alpha_2\lvert\phi_2\rangle\bigr)=\alpha_1\langle\psi\vert\phi_1\rangle+\alpha_2\langle\psi\vert\phi_2\rangle.

Conjugate linearity in the first argument

Suppose that $\lvert\psi_1\rangle$ , $\lvert\psi_2\rangle$ , and $\lvert\phi\rangle$ are vectors and $\beta_1$ and $\beta_2$ are complex numbers. If we define a new vector

\lvert\psi\rangle=\beta_1\lvert\psi_1\rangle+\beta_2\lvert\psi_2\rangle,

then the inner product is again linear in each term — but forming the bra $\langle\psi\vert$ conjugates every coefficient as it comes out in front:

\langle\psi\vert\phi\rangle=\bigl(\overline{\beta_1}\langle\psi_1\vert+\overline{\beta_2}\langle\psi_2\vert\bigr)\lvert\phi\rangle=\overline{\beta_1}\langle\psi_1\vert\phi\rangle+\overline{\beta_2}\langle\psi_2\vert\phi\rangle.

The Cauchy–Schwarz inequality

For every choice of vectors $\lvert\psi\rangle$ and $\lvert\phi\rangle$ , the magnitude of the inner product can never be larger than the product of the vectors' lengths:

\bigl\lvert\langle\psi\vert\phi\rangle\bigr\rvert\le\bigl\lVert\,\lvert\psi\rangle\,\bigr\rVert\;\bigl\lVert\,\lvert\phi\rangle\,\bigr\rVert.

In other words, the overlap between two vectors cannot exceed what their lengths allow.

Equality, $\bigl\lvert\langle\psi\vert\phi\rangle\bigr\rvert=\bigl\lVert\,\lvert\psi\rangle\,\bigr\rVert\;\bigl\lVert\,\lvert\phi\rangle\,\bigr\rVert$ , holds only when the two vectors are linearly dependent — that is, one is simply a scalar multiple of the other.

Orthogonality and orthonormality

Two vectors $\lvert\psi\rangle$ and $\lvert\phi\rangle$ are orthogonal if their inner product is zero:

\langle\psi\vert\phi\rangle=0.

An orthogonal set $\{\lvert\psi_1\rangle,\dots,\lvert\psi_m\rangle\}$ is one in which every pair is orthogonal:

\langle\psi_j\vert\psi_k\rangle=0\qquad(\text{for all }j\neq k).

An orthonormal set $\{\lvert\psi_1\rangle,\dots,\lvert\psi_m\rangle\}$ is an orthogonal set of unit vectors — each pair is orthogonal and each vector has length one:

\langle\psi_j\vert\psi_k\rangle=\begin{cases}1 & j=k\\[2pt]0 & j\neq k\end{cases}\qquad(\text{for all }j,k).

An orthonormal basis $\{\lvert\psi_1\rangle,\dots,\lvert\psi_m\rangle\}$ is a set of orthonormal vectors that spans the entire vector space. This means every vector in the space can be written as a linear combination of the basis vectors.

Constructing basis sets

The key idea is that any orthonormal set can always be extended into an orthonormal basis. Suppose that $\{\lvert\psi_1\rangle,\dots,\lvert\psi_m\rangle\}$ is an orthonormal set of vectors in an $n$ -dimensional space. Because orthonormal sets are always linearly independent, these vectors span a subspace of dimension $m\leq n$ .

If $m<n$ , then there must exist additional vectors $\lvert\psi_{m+1}\rangle,\dots,\lvert\psi_n\rangle$ so that $\{\lvert\psi_1\rangle,\dots,\lvert\psi_n\rangle\}$ forms an orthonormal basis.

The Gram–Schmidt orthogonalization process can be used to construct these extra vectors. It repeatedly subtracts a vector's projections onto the existing basis vectors, leaving an orthogonal remainder that is then normalized to get the missing basis vectors.

Two dependent vectors — the span is only a line.

Independent vectors span the whole plane.

Orthonormal basis — vectors perpendicular and have unit length.

Orthonormal bases and unitary matrices

A unitary matrix is just a matrix whose columns are an orthonormal basis. More precisely, a square matrix $U$ is unitary if and only if its columns form an orthonormal basis — and equivalently, if and only if its rows do. These conditions are equivalent:

$U^\dagger U=I=UU^\dagger$ ( $U$ is unitary).
The columns of $U$ form an orthonormal basis.
The rows of $U$ form an orthonormal basis.

To see why, write the columns of $U$ as vectors and take the conjugate transpose, which turns each column ket into the corresponding row bra. Multiplying $U^\dagger U$ then gives, in row $j$ and column $k$ , the inner product $\langle\psi_j\vert\psi_k\rangle$ :

U=\left[\begin{array}{cccc}\textcolor{#0284c7}{\rvert}&\textcolor{#7c3aed}{\rvert}& &\textcolor{#db2777}{\rvert}\\[1pt]\textcolor{#0284c7}{\lvert\psi_1\rangle}&\textcolor{#7c3aed}{\lvert\psi_2\rangle}&\cdots&\textcolor{#db2777}{\lvert\psi_n\rangle}\\[1pt]\textcolor{#0284c7}{\rvert}&\textcolor{#7c3aed}{\rvert}& &\textcolor{#db2777}{\rvert}\end{array}\right]\qquad U^\dagger=\left[\begin{array}{ccc}\textcolor{#0284c7}{\rule[0.45ex]{1.3em}{0.5pt}}&\textcolor{#0284c7}{\langle\psi_1\rvert}&\textcolor{#0284c7}{\rule[0.45ex]{1.3em}{0.5pt}}\\[4pt]\textcolor{#7c3aed}{\rule[0.45ex]{1.3em}{0.5pt}}&\textcolor{#7c3aed}{\langle\psi_2\rvert}&\textcolor{#7c3aed}{\rule[0.45ex]{1.3em}{0.5pt}}\\[4pt]&\vdots&\\[4pt]\textcolor{#db2777}{\rule[0.45ex]{1.3em}{0.5pt}}&\textcolor{#db2777}{\langle\psi_n\rvert}&\textcolor{#db2777}{\rule[0.45ex]{1.3em}{0.5pt}}\end{array}\right]\qquad (U^\dagger U)_{jk}=\langle\psi_j\vert\psi_k\rangle

For example, suppose two columns of the unitary matrix are the vectors $\lvert\psi_j\rangle$ and $\lvert\psi_k\rangle$ below. Taking the conjugate transpose of the first turns it into its bra (row) form $\langle\psi_j\rvert$ , and the inner product $\langle\psi_j\vert\psi_k\rangle$ is exactly the dot product of the two columns, with complex conjugation applied to the first vector:

\lvert\psi_j\rangle=\begin{pmatrix}a_1\\ a_2\\ \vdots\\ a_n\end{pmatrix},\quad\lvert\psi_k\rangle=\begin{pmatrix}b_1\\ b_2\\ \vdots\\ b_n\end{pmatrix}\qquad\langle\psi_j\rvert=(\overline{a_1},\dots,\overline{a_n})\qquad\langle\psi_j\vert\psi_k\rangle=\overline{a_1}\,b_1+\cdots+\overline{a_n}\,b_n

There are two important cases:

If $j=k$ ,
$\langle\psi_j\vert\psi_j\rangle=|a_1|^2+|a_2|^2+\cdots+|a_n|^2=\lVert\psi_j\rVert^2.$
So the diagonal entries of $U^\dagger U$ are the squared lengths of the columns.
If $j\neq k$ , then $\langle\psi_j\vert\psi_k\rangle$ measures how closely the two vectors point in the same direction.
For real vectors, $\langle\psi_j\vert\psi_k\rangle=\lVert\psi_j\rVert\,\lVert\psi_k\rVert\cos\theta$ , where $\theta$ is the angle between the vectors. Thus, the inner product measures their overlap:
- large magnitude means they point in similar directions,
- zero means they are perpendicular (orthogonal).

Therefore $U^\dagger U$ is the matrix of all pairwise inner products between the columns of $U$ — each diagonal entry a squared length, each off-diagonal entry the overlap between two different columns:

U^\dagger U=\begin{pmatrix}\textcolor{#0d9488}{\langle\psi_1\vert\psi_1\rangle}&\textcolor{#d97706}{\langle\psi_1\vert\psi_2\rangle}&\cdots&\textcolor{#d97706}{\langle\psi_1\vert\psi_n\rangle}\\[2pt]\textcolor{#d97706}{\langle\psi_2\vert\psi_1\rangle}&\textcolor{#0d9488}{\langle\psi_2\vert\psi_2\rangle}&\cdots&\textcolor{#d97706}{\langle\psi_2\vert\psi_n\rangle}\\[2pt]\vdots&\vdots&\ddots&\vdots\\[2pt]\textcolor{#d97706}{\langle\psi_n\vert\psi_1\rangle}&\textcolor{#d97706}{\langle\psi_n\vert\psi_2\rangle}&\cdots&\textcolor{#0d9488}{\langle\psi_n\vert\psi_n\rangle}\end{pmatrix}

If $U$ is unitary, then $U^\dagger U=I$ , and matching the entries of these two matrices gives

every diagonal entry equals $1$ : $\langle\psi_i\vert\psi_i\rangle=1$ , so every column has unit length;
every off-diagonal entry equals $0$ : $\langle\psi_i\vert\psi_j\rangle=0\ (i\neq j)$ , so every pair of distinct columns is orthogonal.

So, for a unitary matrix, its columns form an orthonormal set, and since there are exactly $n$ columns in an $n$ -dimensional space, an orthonormal set of $n$ vectors is automatically an orthonormal basis.

Applying the same argument to $UU^\dagger=I$ shows that the rows are also an orthonormal basis.

Projections

A square matrix $\Pi$ is called a projection if it satisfies two properties:

$\Pi=\Pi^\dagger$ (it is Hermitian);
$\Pi^2=\Pi$ (it is idempotent).

Example: a single unit vector

For example, if $\lvert\psi\rangle$ is a unit vector, then its outer product with itself is a projection:

\Pi=\lvert\psi\rangle\langle\psi\rvert.

To confirm this, we check the two defining properties in turn.

Hermitian — taking the conjugate transpose reverses the order of a product and daggers each factor, $(AB)^\dagger=B^\dagger A^\dagger$ . Since $(\lvert\psi\rangle)^\dagger=\langle\psi\rvert$ and $(\langle\psi\rvert)^\dagger=\lvert\psi\rangle$ , the two factors swap back into their original places:
$\Pi^\dagger=(\lvert\psi\rangle\langle\psi\rvert)^\dagger=(\langle\psi\rvert)^\dagger(\lvert\psi\rangle)^\dagger=\lvert\psi\rangle\langle\psi\rvert=\Pi.$
Idempotent — applying $\Pi$ twice leaves the inner product $\langle\psi\vert\psi\rangle$ in the middle, and because $\lvert\psi\rangle$ is a unit vector that factor equals $\langle\psi\vert\psi\rangle=1$ , so the product collapses back to a single copy:
$\Pi^2=(\lvert\psi\rangle\langle\psi\rvert)^2=\lvert\psi\rangle\langle\psi\vert\psi\rangle\langle\psi\rvert=\lvert\psi\rangle\langle\psi\rvert=\Pi.$

Both properties hold, so $\Pi=\lvert\psi\rangle\langle\psi\rvert$ is indeed a projection.

Visual demo: projecting onto the line

With a single unit vector $\lvert\psi\rangle$ , the projection operator $\Pi=\lvert\psi\rangle\langle\psi\rvert$ takes any vector $\lvert v\rangle$ and projects it onto the line spanned by $\lvert\psi\rangle$ . The projection is $\Pi\lvert v\rangle=\lvert\psi\rangle\langle\psi\vert v\rangle$ , where $\langle\psi\vert v\rangle$ is the scalar giving the component of $\lvert v\rangle$ along $\lvert\psi\rangle$ . Thus $\Pi\lvert v\rangle$ always lies on the line, while the remaining vector $\lvert v\rangle-\Pi\lvert v\rangle$ is perpendicular to it. Applying the projection a second time changes nothing, because $\Pi\lvert v\rangle$ is already on the line, so $\Pi^2=\Pi$ .

ψ = (0.94, 0.34)

v = (1.55, 1.35)

⟨ψ|v⟩ = 1.92

Πv = ⟨ψ|v⟩·ψ = (1.80, 0.66)

Drag v (violet) or rotate ψ (blue). Πv is the foot of the perpendicular — the closest point on the line.

Generalization: an orthonormal set

This generalizes from a single vector to any orthonormal set. If $\{\lvert\psi_1\rangle,\dots,\lvert\psi_m\rangle\}$ is orthonormal, then the sum of their outer products is again a projection:

\Pi=\sum_{k=1}^{m}\lvert\psi_k\rangle\langle\psi_k\rvert.

The same two checks go through, now using orthonormality $\langle\psi_j\vert\psi_k\rangle=\delta_{jk}$ (equal to $1$ when $j=k$ and $0$ otherwise).

Hermitian — the dagger passes through the sum and daggers each term, and every term $\lvert\psi_k\rangle\langle\psi_k\rvert$ is Hermitian by the argument above:
$\Pi^\dagger=\Bigl(\sum_{k=1}^{m}\lvert\psi_k\rangle\langle\psi_k\rvert\Bigr)^\dagger=\sum_{k=1}^{m}(\lvert\psi_k\rangle\langle\psi_k\rvert)^\dagger=\sum_{k=1}^{m}\lvert\psi_k\rangle\langle\psi_k\rvert=\Pi.$
Idempotent — multiplying the two sums gives a double sum whose inner factor is $\langle\psi_j\vert\psi_k\rangle$ . Orthonormality removes every cross term ( $j\neq k$ ) and leaves $1$ on the diagonal ( $j=k$ ), collapsing the double sum back to a single one:
$\Pi^2=\sum_{j=1}^{m}\sum_{k=1}^{m}\lvert\psi_j\rangle\langle\psi_j\vert\psi_k\rangle\langle\psi_k\rvert=\sum_{k=1}^{m}\lvert\psi_k\rangle\langle\psi_k\rvert=\Pi.$

So any sum of outer products over an orthonormal set is a projection — geometrically, it projects onto the subspace those vectors span.

Projective measurements

A collection of projections $\{\Pi_1,\dots,\Pi_m\}$ that satisfies $\Pi_1+\dots+\Pi_m=I$ describes a projective measurement.

When such a measurement is performed on a system in the state $\lvert\psi\rangle$ , two things happen:

The outcome $k\in\{1,\dots,m\}$ of the measurement is chosen randomly:
$\begin{aligned}\Pr(\text{outcome is }k)&=\bigl\lVert\Pi_k\lvert\psi\rangle\bigr\rVert^2\\&=\langle\Pi_k\psi\vert\Pi_k\psi\rangle\\&=\langle\psi\rvert\Pi_k^\dagger\Pi_k\lvert\psi\rangle\\&=\langle\psi\rvert\Pi_k\Pi_k\lvert\psi\rangle\\&=\langle\psi\rvert\Pi_k\lvert\psi\rangle.\end{aligned}$
The two forms $\lVert\Pi_k\lvert\psi\rangle\rVert^2$ and $\langle\psi\rvert\Pi_k\lvert\psi\rangle$ are mathematically identical. The first makes the geometry — the squared projection length — much more obvious, while the second connects naturally to the general framework of expectation values.
The state of the system becomes
$\dfrac{\Pi_k\lvert\psi\rangle}{\lVert\Pi_k\lvert\psi\rangle\rVert}.$

The outcomes need not be labelled $1,\dots,m$ . We are free to name them however is convenient — letters $a,b,c,\dots$ , or any index set $\Gamma$ , so that a family $\{\Pi_a:a\in\Gamma\}$ with $\sum_{a\in\Gamma}\Pi_a=I$ describes a projective measurement with outcomes in $\Gamma$ . The rules are exactly the same.

Visual demo: measuring a qutrit in the standard basis

Take the three rank-one projections $\Pi_k=\lvert k\rangle\langle k\rvert$ onto the basis axes $\lvert0\rangle,\lvert1\rangle,\lvert2\rangle$ . They add up to the identity, $\Pi_0+\Pi_1+\Pi_2=I$ , so they form a projective measurement:

\Pi_0+\Pi_1+\Pi_2=\begin{pmatrix}1&0&0\\0&0&0\\0&0&0\end{pmatrix}+\begin{pmatrix}0&0&0\\0&1&0\\0&0&0\end{pmatrix}+\begin{pmatrix}0&0&0\\0&0&0\\0&0&1\end{pmatrix}=\begin{pmatrix}1&0&0\\0&1&0\\0&0&1\end{pmatrix}=I.

If outcome $k$ occurs, the state $\lvert\psi\rangle$ is projected onto the corresponding subspace, and the probability $p_k=\langle\psi\rvert\Pi_k\lvert\psi\rangle=\lvert\alpha_k\rvert^2$ is the squared length of the projected vector — so the squared projection lengths (the probabilities) always sum to 1.

‖Π₀|ψ⟩‖

0.59² = 0.35

‖Π₁|ψ⟩‖

0.46² = 0.21

‖Π₂|ψ⟩‖

0.66² = 0.43

‖Π₀|ψ⟩‖² + ‖Π₁|ψ⟩‖² + ‖Π₂|ψ⟩‖² = 1.00

|ψ⟩ = 0.59|0⟩ + 0.46|1⟩ + 0.66|2⟩

Press Measure to sample an outcome. Drag the dark handle to move the state; drag the background to rotate the view.

Measuring one subsystem

Suppose we have two systems, $X$ and $Y$ , but we only measure $X$ in the standard basis. We don't need a new mathematical procedure for measuring composite systems — just use the projectors.

\{\textcolor{#2563eb}{\lvert a\rangle\langle a\rvert\otimes I_Y}:a\in\Sigma\}

Each projector acts on the pair $(X,Y)$ in two independent steps:

$\textcolor{#2563eb}{\lvert a\rangle\langle a\rvert}$ checks whether $X=a$ — it keeps the part of the state carrying that outcome and discards the rest.
$\textcolor{#2563eb}{I_Y}$ does nothing to $Y$ — the second system is left exactly as it was.

Since these projectors sum to the identity, they form a valid projective measurement:

\sum_{a\in\Sigma}\textcolor{#2563eb}{\bigl(\lvert a\rangle\langle a\rvert\otimes I_Y\bigr)}=\Bigl(\sum_{a\in\Sigma}\lvert a\rangle\langle a\rvert\Bigr)\otimes I_Y=I_X\otimes I_Y=I.

The projective measurement rules apply as before:

\Pr(\text{outcome is }a)=\bigl\lVert\textcolor{#2563eb}{\Pi_a}\lvert\psi\rangle\bigr\rVert^2=\bigl\lVert\textcolor{#2563eb}{(\lvert a\rangle\langle a\rvert\otimes I_Y)}\lvert\psi\rangle\bigr\rVert^2,

and after observing outcome $a$ , the state of $(X,Y)$ becomes

\lvert\psi\rangle\;\longrightarrow\;\dfrac{\textcolor{#2563eb}{\Pi_a}\lvert\psi\rangle}{\bigl\lVert\textcolor{#2563eb}{\Pi_a}\lvert\psi\rangle\bigr\rVert}=\dfrac{\textcolor{#2563eb}{(\lvert a\rangle\langle a\rvert\otimes I_Y)}\lvert\psi\rangle}{\bigl\lVert\textcolor{#2563eb}{(\lvert a\rangle\langle a\rvert\otimes I_Y)}\lvert\psi\rangle\bigr\rVert}.

Example — subsystem measurement by projection

For example, suppose $(X,Y)$ is a pair of qubits in the state below, written so that each term is grouped by $X$ :

\lvert\psi\rangle=\textcolor{#AB6108}{\lvert0\rangle}\otimes\textcolor{#0A74A9}{\Bigl(\tfrac{1}{\sqrt{2}}\,\lvert0\rangle+\tfrac{1}{2}\,\lvert1\rangle\Bigr)}+\textcolor{#AB6108}{\lvert1\rangle}\otimes\textcolor{#0A74A9}{\Bigl(\tfrac{i}{2\sqrt{2}}\,\lvert0\rangle-\tfrac{1}{2\sqrt{2}}\,\lvert1\rangle\Bigr)}

Outcome $a=0$

The projector for this outcome is

\textcolor{#2563eb}{\Pi_0}=\textcolor{#2563eb}{\lvert0\rangle\langle0\rvert\otimes I_Y}.

Apply it to the full state and expand. Each factor is handled separately, so the $\textcolor{#AB6108}{X}$ kets meet $\textcolor{#2563eb}{\langle0\rvert}$ while the identity $\textcolor{#2563eb}{I_Y}$ leaves the $\textcolor{#0A74A9}{Y}$ part unchanged:

\begin{aligned}\textcolor{#2563eb}{\Pi_0}\lvert\psi\rangle&=\textcolor{#2563eb}{\bigl(\lvert0\rangle\langle0\rvert\otimes I_Y\bigr)}\Bigl[\textcolor{#AB6108}{\lvert0\rangle}\otimes\textcolor{#0A74A9}{\bigl(\tfrac{1}{\sqrt{2}}\lvert0\rangle+\tfrac{1}{2}\lvert1\rangle\bigr)}+\textcolor{#AB6108}{\lvert1\rangle}\otimes\textcolor{#0A74A9}{\bigl(\tfrac{i}{2\sqrt{2}}\lvert0\rangle-\tfrac{1}{2\sqrt{2}}\lvert1\rangle\bigr)}\Bigr]\\[6pt]&=\Bigl(\textcolor{#2563eb}{\lvert0\rangle}\underbrace{\textcolor{#2563eb}{\langle0\vert}\textcolor{#AB6108}{0\rangle}}_{\textcolor{#16a34a}{=\,1}}\Bigr)\otimes\underbrace{\textcolor{#2563eb}{I_Y}}_{\text{no effect}}\textcolor{#0A74A9}{\bigl(\tfrac{1}{\sqrt{2}}\lvert0\rangle+\tfrac{1}{2}\lvert1\rangle\bigr)}+\Bigl(\textcolor{#2563eb}{\lvert0\rangle}\underbrace{\textcolor{#2563eb}{\langle0\vert}\textcolor{#AB6108}{1\rangle}}_{\textcolor{#dc2626}{=\,0}}\Bigr)\otimes\underbrace{\textcolor{#2563eb}{I_Y}}_{\text{no effect}}\textcolor{#0A74A9}{\bigl(\tfrac{i}{2\sqrt{2}}\lvert0\rangle-\tfrac{1}{2\sqrt{2}}\lvert1\rangle\bigr)}\\[6pt]&=\textcolor{#2563eb}{\lvert0\rangle}\otimes\textcolor{#0A74A9}{\bigl(\tfrac{1}{\sqrt{2}}\lvert0\rangle+\tfrac{1}{2}\lvert1\rangle\bigr)}.\end{aligned}

The probability is the squared norm of what survived — the sum of its squared amplitude magnitudes:

\bigl\lVert\textcolor{#2563eb}{\Pi_0}\lvert\psi\rangle\bigr\rVert^2=\left|\tfrac{1}{\sqrt{2}}\right|^2+\left|\tfrac{1}{2}\right|^2=\tfrac{1}{2}+\tfrac{1}{4}=\tfrac{3}{4}

The survivor is not a unit vector, so divide it by its norm $\sqrt{\tfrac{3}{4}}=\tfrac{\sqrt{3}}{2}$ :

\frac{\lvert0\rangle\otimes\Bigl(\tfrac{1}{\sqrt{2}}\lvert0\rangle+\tfrac{1}{2}\lvert1\rangle\Bigr)}{\sqrt{3/4}}=\lvert0\rangle\otimes\Bigl(\sqrt{\tfrac{2}{3}}\,\lvert0\rangle+\tfrac{1}{\sqrt{3}}\,\lvert1\rangle\Bigr)

Outcome $a=1$

The other projector does the mirror image: now $\textcolor{#2563eb}{\langle1\rvert}$ keeps the $\lvert1\rangle$ branch and discards the $\lvert0\rangle$ one:

\textcolor{#2563eb}{(\lvert1\rangle\langle1\rvert\otimes I_Y)}\lvert\psi\rangle=\lvert1\rangle\otimes\Bigl(\tfrac{i}{2\sqrt{2}}\lvert0\rangle-\tfrac{1}{2\sqrt{2}}\lvert1\rangle\Bigr)

Its squared norm is the remaining probability. The $i$ drops out under $\lvert\cdot\rvert^2$ — only magnitudes matter:

\bigl\lVert\textcolor{#2563eb}{(\lvert1\rangle\langle1\rvert\otimes I_Y)}\lvert\psi\rangle\bigr\rVert^2=\left|\tfrac{i}{2\sqrt{2}}\right|^2+\left|-\tfrac{1}{2\sqrt{2}}\right|^2=\tfrac{1}{8}+\tfrac{1}{8}=\tfrac{1}{4}

Divide by the norm $\sqrt{\tfrac{1}{4}}=\tfrac{1}{2}$ as before:

\frac{\lvert1\rangle\otimes\Bigl(\tfrac{i}{2\sqrt{2}}\lvert0\rangle-\tfrac{1}{2\sqrt{2}}\lvert1\rangle\Bigr)}{\sqrt{1/4}}=\lvert1\rangle\otimes\Bigl(\tfrac{i}{\sqrt{2}}\,\lvert0\rangle-\tfrac{1}{\sqrt{2}}\,\lvert1\rangle\Bigr)

Implementing projective measurements

So far the projectors have been pure mathematics. Hardware offers only two things: unitary operations and standard basis measurements. That is already enough — any projective measurement can be assembled out of those two.

The trick is to bring in one extra system alongside the one being measured, with a classical state for each possible outcome. A single unitary then files each outcome into its own branch: the extra system carries the outcome's label, and travelling alongside it is the matching projected state of the measured system. Reading the extra system in the standard basis picks one branch — with exactly the probability the projection rule demands — and leaves the measured system in that branch's projected, renormalised state. No projector is ever built as hardware; the projections emerge from the branch structure.

Below, that idea runs on a pair of systems $X$ and $Y$ . The bottom wire is the extra qubit — the only thing ever read.

XY

\lvert0\rangle

The first Hadamard splits the extra qubit into two branches. The controlled-SWAP exchanges $X$ and $Y$ on one branch only, so the two branches now hold the state seen from two different angles. The second Hadamard makes them interfere, which sorts the state into a part unchanged by the exchange and a part that the exchange reverses — and those two parts are precisely the projections. Measuring the extra qubit says which one you landed in, and turns it into a classical bit.

Three gates and a single qubit read out: an abstract pair of projections has become something a machine actually does.

Limitations of quantum measurements

Irrelevance of global phases

Quantum amplitudes are complex numbers, so each one carries both a magnitude and a phase. Phases show up in two different ways:

A global phase multiplies every amplitude in a state by the same unit-modulus factor $e^{i\theta}$ .
A relative phase changes the phase difference between the amplitudes within a superposition.

The distinction is fundamental. A global phase rotates the entire state vector by the same amount, leaving the relationships between its amplitudes unchanged. A relative phase changes those relationships and therefore affects interference.

A scalar factor in a global phase must preserve the norm, so $\lvert\alpha\rvert=1$ . That condition is met exactly by the complex numbers of the form $\alpha=e^{i\theta}$ for some real $\theta$ : every such number sits on the unit circle of the complex plane, and every unit-modulus number can be written this way. Two state vectors therefore differ by a global phase when $\lvert\phi\rangle=e^{i\theta}\lvert\psi\rangle$ — every amplitude is multiplied by the same unit-modulus factor $e^{i\theta}$ .

For example, the two amplitudes of $\lvert\psi\rangle=\alpha_0\lvert0\rangle+\alpha_1\lvert1\rangle$ are drawn as arrows on the complex plane. Their lengths are the magnitudes, their angles the phases.

Drag global phase — every bar holds still, so the state is physically unchanged. Drag relative phase — the standard basis still won't move, but the ± measurement swings: the relative phase is observable. The amplitude split resizes the arrows and shifts the standard-basis odds.

Global phase (both arrows)0°

Relative phase (α₁ only)90°

Amplitude split (|α₀| vs |α₁|)0.71 · 0.71

Probability of each outcome if we measure $\lvert\psi\rangle$ in that basis:

Standard basis $\{\lvert0\rangle,\lvert1\rangle\}$

P(0)=\lvert\langle0\vert\psi\rangle\rvert^2

50%

P(1)=\lvert\langle1\vert\psi\rangle\rvert^2

50%

Hadamard basis $\{\lvert+\rangle,\lvert-\rangle\}$

P(+)=\lvert\langle+\vert\psi\rangle\rvert^2

50%

P(-)=\lvert\langle-\vert\psi\rangle\rvert^2

50%

Mathematically, two state vectors differ by a global phase if $\lvert\phi\rangle=e^{i\theta}\lvert\psi\rangle$ .

Standard-basis measurement. The probability of outcome $a$ is the squared magnitude of the amplitude $\langle a\vert\phi\rangle$ . Substituting $\lvert\phi\rangle=e^{i\theta}\lvert\psi\rangle$ , the phase factors out and its magnitude $\lvert e^{i\theta}\rvert^2=1$ disappears:

\bigl\lvert\langle a\vert\phi\rangle\bigr\rvert^2=\bigl\lvert e^{i\theta}\,\langle a\vert\psi\rangle\bigr\rvert^2=\lvert e^{i\theta}\rvert^2\,\bigl\lvert\langle a\vert\psi\rangle\bigr\rvert^2=\bigl\lvert\langle a\vert\psi\rangle\bigr\rvert^2.

Projective measurement. The same cancellation holds for any projective measurement $\{\Pi_1,\dots,\Pi_m\}$ . Each outcome probability is the squared norm $\lVert\Pi_k\lvert\phi\rangle\rVert^2$ , and pulling the scalar $e^{i\theta}$ out of the norm leaves the factor $\lvert e^{i\theta}\rvert^2=1$ again:

\bigl\lVert\Pi_k\lvert\phi\rangle\bigr\rVert^2=\bigl\lVert e^{i\theta}\,\Pi_k\lvert\psi\rangle\bigr\rVert^2=\lvert e^{i\theta}\rvert^2\,\bigl\lVert\Pi_k\lvert\psi\rangle\bigr\rVert^2=\bigl\lVert\Pi_k\lvert\psi\rangle\bigr\rVert^2.

Therefore all measurements produce exactly the same statistics for $\lvert\psi\rangle$ and $e^{i\theta}\lvert\psi\rangle$ . States that differ by a global phase are considered equivalent — they represent the same physical state. A relative phase, by contrast, changes the interference between amplitudes and is observable, as the demo above shows.

A note on representation. This global phase is a degeneracy of the state-vector picture: the same physical state maps to a whole circle of vectors $\{e^{i\theta}\lvert\psi\rangle\}$ that are all indistinguishable. It is an artifact of describing states at this simplified level of generality (it's called “simplified,” though personally I cried at the word “simple”).

The more general formalism uses density matrices: a state vector $\lvert\psi\rangle$ is replaced by the operator $\rho=\lvert\psi\rangle\langle\psi\rvert$ . Here the global phase cancels automatically, since $\bigl(e^{i\theta}\lvert\psi\rangle\bigr)\bigl(e^{i\theta}\lvert\psi\rangle\bigr)^{\dagger}=e^{i\theta}e^{-i\theta}\,\lvert\psi\rangle\langle\psi\rvert=\rho$ , so equivalent states share exactly one density matrix and the redundancy disappears. Density matrices also describe mixed states (classical uncertainty over several vectors), which no single state vector can capture.

No-cloning theorem

Copying classical information is trivial — you read a bit and write it down twice. It is natural to ask whether a quantum computer can do the same for an unknown state $\lvert\psi\rangle$ , producing two identical copies of it. The no-cloning theorem says this is impossible: no single unitary can duplicate an arbitrary unknown quantum state, which is exactly why quantum information cannot simply be copied and why quantum key distribution is secure.

Formally, let $X$ and $Y$ both have the classical state set $\{0,\dots,d-1\}$ with $d\ge 2$ . A cloner would be a unitary $U$ on the pair $(X, Y)$ that takes the state in $X$ with a blank $\lvert0\rangle$ in $Y$ and writes a copy into $Y$ . The theorem states no such $U$ exists:

\forall\,\lvert\psi\rangle:\quad U\bigl(\lvert\psi\rangle\otimes\lvert0\rangle\bigr)=\lvert\psi\rangle\otimes\lvert\psi\rangle.

Drawn as a circuit, this cloner would feed $\lvert\psi\rangle$ and a blank register $\lvert0\cdots0\rangle$ into $U$ and read out two copies — the box below that cannot exist for every input:

\lvert0\cdots0\rangle

\lvert\psi\rangle

\lvert\psi\rangle

\lvert\psi\rangle

U

No such U exists

Why no such U can exist

Suppose there existed a unitary operator $U$ that could perfectly clone any quantum state. For every state $\textcolor{#2563eb}{\lvert\psi\rangle}$ , it would satisfy $U\bigl(\textcolor{#2563eb}{\lvert\psi\rangle}\otimes\lvert0\rangle\bigr)=\textcolor{#2563eb}{\lvert\psi\rangle}\otimes\textcolor{#2563eb}{\lvert\psi\rangle}$ , where $\lvert0\rangle$ is a blank qubit that receives the copy.

Applying $U$ to basis states results in: $U\bigl(\textcolor{#2563eb}{\lvert0\rangle}\lvert0\rangle\bigr)=\textcolor{#2563eb}{\lvert0\rangle}\textcolor{#2563eb}{\lvert0\rangle},\quad U\bigl(\textcolor{#2563eb}{\lvert1\rangle}\lvert0\rangle\bigr)=\textcolor{#2563eb}{\lvert1\rangle}\textcolor{#2563eb}{\lvert1\rangle}.$

But now consider a plus (superposition) state $\lvert+\rangle=\dfrac{\lvert0\rangle+\lvert1\rangle}{\sqrt2}$ . Because every quantum gate is linear, the cloning operation must satisfy:

\begin{aligned} U\bigl(\lvert+\rangle\lvert0\rangle\bigr) &=U\!\left(\dfrac{\lvert0\rangle+\lvert1\rangle}{\sqrt2}\otimes\lvert0\rangle\right)\\[4pt] &=\dfrac{1}{\sqrt2}\,U\bigl(\textcolor{#2563eb}{\lvert0\rangle}\lvert0\rangle\bigr)+\dfrac{1}{\sqrt2}\,U\bigl(\textcolor{#2563eb}{\lvert1\rangle}\lvert0\rangle\bigr)\\[4pt] &=\dfrac{1}{\sqrt2}\,\textcolor{#2563eb}{\lvert0\rangle}\textcolor{#2563eb}{\lvert0\rangle}+\dfrac{1}{\sqrt2}\,\textcolor{#2563eb}{\lvert1\rangle}\textcolor{#2563eb}{\lvert1\rangle}\\[4pt] &=\dfrac{\lvert00\rangle+\lvert11\rangle}{\sqrt2}. \end{aligned}

But if $U$ were truly a cloning machine, the output should instead be

U\bigl(\textcolor{#2563eb}{\lvert+\rangle}\lvert0\rangle\bigr)=\textcolor{#2563eb}{\lvert+\rangle}\textcolor{#2563eb}{\lvert+\rangle}.

This expands to

\lvert+\rangle\lvert+\rangle=\left(\dfrac{\lvert0\rangle+\lvert1\rangle}{\sqrt2}\right)\otimes\left(\dfrac{\lvert0\rangle+\lvert1\rangle}{\sqrt2}\right)=\dfrac{\lvert00\rangle+\lvert01\rangle+\lvert10\rangle+\lvert11\rangle}{2}.

These two states are different:

\dfrac{\lvert00\rangle+\lvert11\rangle}{\sqrt2}\;\neq\;\dfrac{\lvert00\rangle+\lvert01\rangle+\lvert10\rangle+\lvert11\rangle}{2}.

The contradiction arises because linearity forces one output, while perfect cloning requires another. Therefore, no unitary operation can perfectly clone an arbitrary unknown quantum state.

Remarks

Approximate forms of the cloning theorem are known.
Copying a standard basis state is possible — the no-cloning theorem does not contradict this.
For example, a $\mathrm{CNOT}$ controlled by a basis value $\lvert a\rangle$ copies it into a blank $\lvert0\rangle$ , giving $\lvert a\rangle\lvert a\rangle$ :
$\lvert0\rangle$ $\lvert a\rangle$ $\lvert a\rangle$ $\lvert a\rangle$
Cloning a probabilistic state (classically) is also impossible.
Perfect clones are possible if they are all encrypted. A 2026 protocol, encrypted cloning, deterministically produces any number of perfect copies of an unknown state — as long as the copies are simultaneously locked with a single-use quantum decryption key. Decrypting one clone consumes the key and renders every other clone indecipherable, so no two usable copies ever coexist and the theorem still holds. The real constraint is not the copying, but that the decryption mechanism must be single-use. The payoff is redundancy, like keeping backups: you hold many encrypted copies and recover the original from any one that survives. It has been demonstrated on IBM Heron-R2 hardware with up to 154 qubits (Yamaguchi et al., 2026).

Discriminating non-orthogonal states

It is not possible to perfectly discriminate two non-orthogonal quantum states. Equivalently, if we can discriminate two quantum states perfectly, then they must be orthogonal.

Two states $\lvert\psi\rangle$ and $\lvert\phi\rangle$ can be discriminated perfectly if there is a unitary operation $U$ that works like this:

\lvert\pi_0\rangle

0

U\bigl(\lvert0\cdots0\rangle\lvert\psi\rangle\bigr)=\lvert\pi_0\rangle\lvert0\rangle

\lvert\pi_1\rangle

1

U\bigl(\lvert0\cdots0\rangle\lvert\phi\rangle\bigr)=\lvert\pi_1\rangle\lvert1\rangle

Suppose a unitary operator $U$ perfectly distinguishes two states $\lvert\psi\rangle$ and $\lvert\phi\rangle$ . By definition,

\begin{aligned} U\bigl(\lvert0\cdots0\rangle\lvert\psi\rangle\bigr)&=\lvert\pi_0\rangle\lvert0\rangle,\\[4pt] U\bigl(\lvert0\cdots0\rangle\lvert\phi\rangle\bigr)&=\lvert\pi_1\rangle\lvert1\rangle, \end{aligned}

where the final qubit stores the measurement result and the remaining qubits $\lvert\pi_0\rangle$ and $\lvert\pi_1\rangle$ represent arbitrary ancilla states.

The overlap of two states is their inner product $\langle a\vert b\rangle$ — a number that measures how similar they are. It is $1$ for identical states and $0$ for orthogonal (perfectly distinguishable) ones.

Now take two states $\lvert a\rangle$ and $\lvert b\rangle$ and apply $U$ to each. To form the overlap of the outputs, the first ket $U\lvert a\rangle$ becomes a bra by taking its conjugate transpose, which flips $U$ into $U^\dagger$ :

\langle Ua\vert Ub\rangle=\langle a\rvert\,U^\dagger U\,\lvert b\rangle=\langle a\rvert\,I\,\lvert b\rangle=\langle a\vert b\rangle,

where the middle $U^\dagger U$ collapses to the identity $I$ because $U$ is unitary. So passing both states through the same $U$ leaves their overlap unchanged — the input overlap equals the output overlap.

For the discriminating unitary, the two input vectors are $\lvert0\cdots0\rangle\lvert\psi\rangle$ and $\lvert0\cdots0\rangle\lvert\phi\rangle$ . Their overlap factorizes across the ancilla and state registers, and because the ancilla register is the same in both inputs $\langle0\cdots0\vert0\cdots0\rangle=1$ :

\bigl(\langle0\cdots0\rvert\langle\psi\rvert\bigr)\bigl(\lvert0\cdots0\rangle\lvert\phi\rangle\bigr)=\langle0\cdots0\vert0\cdots0\rangle\cdot\langle\psi\vert\phi\rangle=\langle\psi\vert\phi\rangle.

The output overlap factorizes the same way. The measurement outcomes are different, so $\langle0\vert1\rangle=0$ , and the whole overlap collapses to zero:

\bigl(\langle\pi_0\rvert\langle0\rvert\bigr)\bigl(\lvert\pi_1\rangle\lvert1\rangle\bigr)=\langle\pi_0\vert\pi_1\rangle\,\langle0\vert1\rangle=\langle\pi_0\vert\pi_1\rangle\cdot0=0.

Equating the input and output overlaps, and recalling the output overlap is zero, gives

\boxed{\;\langle\psi\vert\phi\rangle=0.\;}

In other words, perfect discrimination is possible only for orthogonal quantum states.

The demo illustrates this result visually. Drag either state to change their overlap $\langle\psi\vert\phi\rangle$ . As the overlap decreases, the states become easier to distinguish. When $\langle\psi\vert\phi\rangle=0$ , they are orthogonal and can be distinguished perfectly.

θ = 60°

⟨ψ|ϕ⟩ = cos θ = 0.50

best distinguishing probability0.93

0.5 · coin flip1.0 · perfect

Non-orthogonal — the overlap is nonzero, so no measurement can tell the two apart with certainty. Drag the arrows 90° apart.

Entanglement

Two qubits are entangled when their joint state cannot be written as $|a\rangle\otimes|b\rangle$ . Measure both systems several times and compare the results: the separable state behaves like two independent coin flips, while the entangled Bell state always produces matching outcomes.

Separable

|{+}\rangle\otimes|{+}\rangle=\tfrac12|00\rangle+\tfrac12|01\rangle+\tfrac12|10\rangle+\tfrac12|11\rangle

✗ Different

|00⟩

0.00

|01⟩

0.00

|10⟩

0.00

|11⟩

0.00

CorrelationIndependent • 0%

Entangled

|\phi^{+}\rangle=\tfrac{1}{\sqrt2}|00\rangle+\tfrac{1}{\sqrt2}|11\rangle

✗ Different

|00⟩

0.00

|01⟩

0.00

|10⟩

0.00

|11⟩

0.00

CorrelationPerfectly correlated • 0%

0 measurements

These correlations are stronger than anything independent classical systems can share, so entanglement is treated as a resource. One maximally entangled pair $|\phi^{+}\rangle$ is one unit of it — an e-bit.

Quantum teleportation

Quantum teleportation is a protocol that allows a sender to send quantum information to a receiver using only entanglement and classical communication to accomplish that transmission.

Setup

Alice holds a qubit $Q$ in an unknown state $|\psi\rangle$ that she wants to transfer to Bob.
Alice and Bob share an entangled pair (an e-bit) in the state $|\phi^{+}\rangle$ . Alice holds qubit $A$ , and Bob holds qubit $B$ . How or when they established this shared entanglement—for example, during an earlier meeting—is irrelevant to the protocol.
Alice can communicate with Bob only by sending classical bits.
An unknown quantum state cannot be completely described by classical bits, so classical communication alone is insufficient.
Because of the no-cloning theorem, once the protocol is complete and Bob's qubit is in state $|\psi\rangle$ , Alice no longer has a copy of that quantum state.

|\psi\rangle

QABAliceBob

|\psi\rangle

Protocol

1Alice performs a controlled-NOT operation, where $Q$ is the control and $A$ is the target.
2Alice performs a Hadamard operation on $Q$ .
3Alice measures $A$ and $Q$ , obtaining binary outcomes $m_A$ and $m_Q$ , respectively.
4Alice sends $m_A$ and $m_Q$ to Bob.
5
Bob performs these two steps on qubit $B$ :
- If $m_A = 1$ , Bob applies an $X$ operation.
- If $m_Q = 1$ , Bob applies a $Z$ operation.

Superdense coding

Superdense coding is a protocol that allows a sender to transmit two classical bits to a receiver by sending only a single qubit, using one shared e-bit of entanglement to accomplish that transmission.

Scenario

Alice has two classical bits $(a,b)$ that she wishes to transmit to Bob.
Alice is able to send only a $single\ qubit$ to Bob.
Alice and Bob already share an entangled pair (an e-bit) in the state $|\phi^{+}\rangle$ .
Without the e-bit the task would be impossible: by Holevo's theorem, two classical bits cannot be reliably transmitted by a single qubit alone.

baAliceBob

ba

Protocol

1Alice applies $X^{a}Z^{b}$ to her qubit — an $X$ when $a=1$ and a $Z$ when $b=1$ .
2Alice sends her qubit to Bob.
3Bob applies a controlled-NOT, with the qubit received from Alice as the control and his own qubit as the target.
4Bob applies a Hadamard to the qubit received from Alice.
5Bob measures both qubits, reading off $a$ and $b$ .

CHSH game

A nonlocal game is a mathematical and physical framework modeling two or more cooperating players who try to win a game against a referee. The defining rule is that once the game begins, players cannot communicate.

Set-up

The players Alice and Bob cooperate as a team against a referee.
The referee runs the game: it sends each player a question and checks their answers against a fixed rule.
Alice and Bob may prepare a strategy together beforehand — including sharing entanglement.
But once the game starts they are forbidden from communicating: neither learns the other's question or answer.

Alice

Bob

Referee

x

a

b

y

One round

The referee asks. The referee picks two questions using randomness and sends one to each player — $x$ to Alice and $y$ to Bob. Each player sees only their own question.

The CHSH referee

The CHSH game is one example of a nonlocal game, in which the referee follows these rules. Questions and answers are all bits $x,y,a,b \in \{0,1\}$ , the questions $x$ and $y$ are chosen uniformly at random, and the team wins exactly when $a \oplus b = x \wedge y$ .

$(x,y)$	$x \wedge y$	Winning condition
(0,0)	0	$a = b$
(0,1)	0	$a = b$
(1,0)	0	$a = b$
(1,1)	1	$a \neq b$

CHSH — Deterministic strategy

Program Alice and Bob before the game begins. For each possible question, choose the answer they will always give. Once the game starts, they cannot communicate or change their strategy. Can you find a strategy that wins all four rounds?

Strategy

Alice

If asked

x=0

, answer

If asked

x=1

, answer

Bob

If asked

y=0

, answer

If asked

y=1

, answer

CHSH game results

(0,0)

x \wedge y

= 0need

a = b

a=0, b=0→

a = b

✓ Win

(0,1)

x \wedge y

= 0need

a = b

a=0, b=0→

a = b

✓ Win

(1,0)

x \wedge y

= 0need

a = b

a=0, b=0→

a = b

✓ Win

(1,1)

x \wedge y

= 1need

a \neq b

a=0, b=0→

a = b

✗ Lose

3 / 4 Wins

75%

🏆 This is the best possible deterministic strategy.

CHSH — Probabilistic strategy

Now let Alice and Bob answer at random. For each question, set how often they reply with a 1. The game is unchanged — only the strategy is now a coin flip. Can randomness push them past 75%?

Strategy

Alice

P(a{=}1 \mid x{=}0)

50%

P(a{=}1 \mid x{=}1)

50%

Bob

P(b{=}1 \mid y{=}0)

50%

P(b{=}1 \mid y{=}1)

50%

CHSH game results

0 wins2,000 losses

Only a few thousand rounds, so the result is noisy — a lucky sample can drift above or below the true rate. Re-run it a few times to see it bounce around the expected value.

0.0%

win rate over 2,000 rounds

expected 50.0% · best possible 75%

CHSH — Quantum strategy

Now Alice and Bob share an entangled pair prepared before the game. Each question picks a measurement angle instead of a fixed answer. Same game, same rule — but can entanglement beat the classical 75% ceiling?

Measurements are angles

Measuring a qubit is not simply reading a fixed bit — the player first chooses a direction to measure along. That choice is an angle $\theta$ : outcome 0 corresponds to the direction $|\psi_\theta\rangle$ , and outcome 1 to the perpendicular direction $|\psi_{\theta+\pi/2}\rangle$ . The measurement asks: which of these two is the qubit closer to?

Measurement basis

|\psi_\theta\rangle = \cos(\theta)\,|0\rangle + \sin(\theta)\,|1\rangle

\angle\,\theta = 67.5^\circ

\cos\theta = 0.383

\sin\theta = 0.924

Common angles and their exact trigonometric values
θ	deg	cos θ	sin θ
$0$	0°	$1$	$0$
$\tfrac{\pi}{8}$	22.5°	$\tfrac{\sqrt{2+\sqrt{2}}}{2}$	$\tfrac{\sqrt{2-\sqrt{2}}}{2}$
$\tfrac{\pi}{4}$	45°	$\tfrac{1}{\sqrt{2}}$	$\tfrac{1}{\sqrt{2}}$
$\tfrac{3\pi}{8}$	67.5°	$\tfrac{\sqrt{2-\sqrt{2}}}{2}$	$\tfrac{\sqrt{2+\sqrt{2}}}{2}$
$\tfrac{\pi}{2}$	90°	$0$	$1$

So how does the angle determine the probability?

The qubit is also represented by a direction on the same circle. Suppose it points at angle $\varphi$ , so its state is $|\psi_\varphi\rangle$ .

A measurement compares the qubit's direction with the measurement direction $\theta$ . The closer they are, the more likely the measurement returns outcome 0. If they point in exactly the same direction, the result is always 0. If they are perpendicular, outcome 0 is impossible.

Quantum mechanics quantifies this “closeness” using the inner product (also called the overlap). For a qubit pointing at angle $\varphi$ and a measurement at angle $\theta$ , the overlap between the qubit state $|\psi_\varphi\rangle$ and the measurement direction $|\psi_\theta\rangle$ is

\langle \psi_\theta | \psi_\varphi \rangle = \cos(\theta - \varphi).

The probability of obtaining a measurement outcome is the square of the overlap with the corresponding measurement direction. Since outcome 0 corresponds to $|\psi_\theta\rangle$ ,

\Pr[\text{outcome }0] = \big|\langle \psi_\theta | \psi_\varphi \rangle\big|^2 = \cos^2(\theta - \varphi).

Likewise, outcome 1 corresponds to the perpendicular direction $|\psi_{\theta+\pi/2}\rangle$ , so

\Pr[\text{outcome }1] = \sin^2(\theta - \varphi).

The simplest choice is $\theta = 0^\circ$ , where the measurement direction lines up with the horizontal axis. In this case,

|\psi_0\rangle = |0\rangle, \qquad |\psi_{\pi/2}\rangle = |1\rangle.

So the two measurement outcomes are simply the familiar states $|0\rangle$ and $|1\rangle$ . This is called the standard (or computational, $Z$ ) basis. Measuring in this basis is the familiar question: “Is the qubit 0 or 1?”

Of course, nothing requires us to measure in this basis. We can rotate the measurement direction to any angle, creating a different pair of measurement states. A few of these angles are used so often that they have their own names. Each basis is simply a different measurement angle — choose one below, or drag the arrows to rotate the measurement basis and watch the outcome probabilities change while the qubit itself stays fixed.

\theta = 0^\circ

standard basis

outcome 0 · cos²(θ−φ)33%

outcome 1 · sin²(θ−φ)67%

From one qubit to an entangled pair

So far we've measured a single qubit. Now imagine Alice and Bob each receive one qubit from a shared entangled pair prepared before the game.

Just as before, each player independently chooses a measurement angle — Alice uses $\alpha$ , Bob uses $\beta$ . Each individual measurement still looks completely random: Alice sees 0 or 1 with equal probability, and so does Bob.

The surprise is that their outcomes are correlated. The probability that they obtain the same result depends only on the angle between their measurements:

\Pr[\text{Alice} = \text{Bob}] = \cos^2(\alpha - \beta).

Just like for a single qubit, only the difference between the two angles matters — not their absolute positions.

If $\alpha = \beta$ , Alice and Bob always obtain the same result.
If the measurement directions are $90^\circ$ apart, they always obtain opposite results.
Between these extremes, the probability changes smoothly as the angle changes.

α = 0°β = 30°|α−β| = 30.0°

same outcome · cos²(α−β)75%

different · sin²(α−β)25%

The CHSH game circuit

Alice and Bob begin with the shared Bell state $|\phi^{+}\rangle$ . Their CHSH questions don't determine the answers — they determine which measurement basis each player uses. In the circuit below, question $x$ selects Alice's rotation and question $y$ selects Bob's. After applying these rotations, both qubits are measured in the standard basis.

|\phi^{+}\rangle

y

x

BobAlice

b

a

Strategy

Alice

angle Alice measures at for each question x

question

x = 0

→

A_0

0°

question

x = 1

→

A_1

45°

Bob

angle Bob measures at for each question y

question

y = 0

→

B_0

22.5°

question

y = 1

→

B_1

157.5°

CHSH game results

0 wins2,000 losses

0.0%

win rate over 2,000 rounds

expected 85.4% · maximum 85.36% (Tsirelson bound)

⚛️ Optimal — this reaches the Tsirelson bound, the quantum maximum.

Query-model algorithms

Two models of computation

Quantum algorithms are often analyzed in the query model, which differs from the ordinary computational model only in how the input is accessed.

Standard model

The algorithm receives the entire input.

inputx

algorithm

output

Query model

The algorithm can only interrogate a black box.

oraclef

query i

answer f(i)

algorithm

output

In the standard model, the complete input $x$ is available from the start. The algorithm may read any part of it whenever it likes, perform arbitrary computations, and eventually produce an output. Cost: the total number of elementary computational steps.

In the query model, the function $f$ is hidden inside a black box called an oracle. The algorithm never sees the function directly. Instead, it repeatedly asks questions of the form “what is $f(i)$ ?”, receives the answer, performs arbitrary computation, and decides which query to ask next. Cost: the number of oracle queries.

The query model isolates the cost of obtaining information from the cost of computation itself. This makes it possible to compare classical and quantum algorithms in a clean and mathematically precise way.

Examples of query problems

In the query model, the input is not a string—it is an unknown function $f$ . The algorithm cannot inspect the function directly. It can only ask questions like “ $\text{what is } f(x)\text{?}$ ” for inputs $x$ of its choice.

Hidden function

Flip the values below to change the hidden function $f$ .

x

000

001

010

011

100

101

110

111

f(x)

Each problem asks a different question about the same hidden function. The answer updates automatically as you change the function.

OR

Input:: $f : \Sigma^n \to \Sigma$
Output:: $1$ if there exists a string $x \in \Sigma^n$ for which $f(x) = 1$
$0$ if there is no such string

Does any input satisfy $f(x) = 1$ ?

Yes

Parity

Input:: $f : \Sigma^n \to \Sigma$
Output:: $0$ if $f(x) = 1$ for an even number of strings $x \in \Sigma^n$
$1$ if $f(x) = 1$ for an odd number of strings $x \in \Sigma^n$

Is the number of inputs with $f(x) = 1$ even or odd?

Odd

Minimum

Input:: $f : \Sigma^n \to \Sigma^m$
Output:: The string $y \in \{ f(x) : x \in \Sigma^n \}$ that comes first in the lexicographic ordering of $\Sigma^m$

Which output value comes first in lexicographic order?

$0$

Unique search

Input:: $f : \Sigma^n \to \Sigma$
Promise:: Exactly one input $z$ satisfies $f(z) = 1$ ; all other inputs satisfy $f(x) = 0$
Output:: $z$

If exactly one input satisfies $f(x) = 1$ , which input is it?

$101$

Query gates

In a circuit model, access to the hidden function is represented by a query gate (or oracle gate). It behaves like an ordinary component, but its behavior is fixed by the unknown $f$ : given $x$ on its input wires it outputs $f(x)$ . The function is supplied by the problem instance, not the algorithm, and each use counts as one query.

Query gates can be combined with ordinary logic gates just like any other circuit component. The circuit below solves the Parity query problem for a function with two possible inputs, $0$ and $1$ . It queries $f(0)$ and $f(1)$ , then outputs $1$ exactly when one of the two values is $1$ and the other is $0$ (odd parity).

0

1

Why study hidden functions?

Admittedly this model looks a bit weird at first — why lock the input inside a box and count questions instead of simply reading it? But many computational tasks — from searching a database to testing a physical device — can only access information by asking questions. The query model captures exactly this situation by treating the input as an unknown function that can only be queried.

Quantum query gates

Classical query gates output the value $f(x)$ directly. That is convenient for classical circuits, but it cannot be used in quantum circuits.

The reason is that quantum gates must be unitary (and therefore reversible). A gate that simply replaces its input with $f(x)$ is generally not reversible, since many different inputs may produce the same output.

So for the quantum circuit model we choose a different definition that is always unitary. The query gate $U_f$ for any function $f : \Sigma^n \to \Sigma^m$ is defined, for all $x \in \Sigma^n$ and $y \in \Sigma^m$ , by its action on basis states:

U_f\bigl(\lvert y\rangle\lvert x\rangle\bigr)=\lvert y\oplus f(x)\rangle\lvert x\rangle

In circuit form, $U_f$ leaves the top register holding $x$ and writes $f(x)$ into the bottom register by XOR. Notice that the function value is added into the second register rather than replacing it — this small change makes the operation reversible for every possible function $f$ :

\lvert x\rangle

\lvert x\rangle

\lvert y\rangle

\lvert y\oplus f(x)\rangle

Starting the bottom register at $\lvert 0^m\rangle$ makes the gate output $f(x)$ directly, since $0^m \oplus f(x) = f(x)$ .

\lvert x\rangle

\lvert x\rangle

\lvert 0^m\rangle

\lvert f(x)\rangle

The extra register may seem unnecessary at first, but it is what makes the oracle useful:

it keeps $U_f$ unitary and reversible for every $f$ ;
it lets the oracle act on a superposition of many inputs at once;
and it preserves the phases that quantum algorithms exploit through interference.

Deutsch’s problem

Deutsch’s problem asks whether a function is constant or balanced. The function takes one bit as input and returns one bit as output, so there are only four possible functions.

Deutsch’s problem

Input:: $f : \Sigma \to \Sigma$
Output:: $0$ if $f$ is constant, $1$ if $f$ is balanced

Build a function

Flip the two outputs to define a function $f$ . There are exactly four possible functions. Try to discover them all.

a

0

1

f(a)

Found 0 of 4 possible functions of the form $f : \Sigma \to \Sigma$ :

f_1

Not found

$a$	$f_1(a)$
$0$	?
$1$	?

f_2

Not found

$a$	$f_2(a)$
$0$	?
$1$	?

f_3

Not found

$a$	$f_3(a)$
$0$	?
$1$	?

f_4

Not found

$a$	$f_4(a)$
$0$	?
$1$	?

The classical approach

A classical algorithm must evaluate both possible inputs: after seeing only one value, you still cannot distinguish a constant function from a balanced one.

Deterministic classical cost: 2 queries

Deutsch’s algorithm

Deutsch’s algorithm solves the same problem using only one query. It prepares two qubits, performs a single query to the oracle $U_f$ , applies one more Hadamard gate, and measures the first qubit — the measurement directly reveals $f(0) \oplus f(1)$ , which is:

$0$ for constant functions
$1$ for balanced functions

\textcolor{#6d28d9}{\lvert 0\rangle}

\textcolor{#b45309}{\lvert 1\rangle}

\begin{cases}0 & \text{if } f \text{ is constant}\\[2pt] 1 & \text{if } f \text{ is balanced}\end{cases}

Step through the circuit

1Prepare the two qubits in $\lvert 0\rangle\lvert 1\rangle$ .
2Apply a Hadamard to each qubit.
3Apply the query gate $U_f$ — the single query.
4Apply a Hadamard to the top qubit.
5Measure the top qubit to read $f(0) \oplus f(1)$ .

The Deutsch–Jozsa circuit

Deutsch’s algorithm works only for the simplest case: a function $f : \Sigma \to \Sigma$ , which maps a single input bit to a single output bit. The Deutsch–Jozsa algorithm generalizes this idea to functions of the form $f : \Sigma^n \to \Sigma$ for any $n \geq 1$ , allowing the input to consist of any number of bits.

\lvert 0\rangle

\lvert 0\rangle

\lvert 0\rangle

\lvert 1\rangle

y \in \Sigma^n

The purpose of the circuit is not to compute $f(x)$ , but to extract information about the function $f$ as a whole. After one query, measuring the $n$ query qubits produces a bit string $y \in \Sigma^n$ . The meaning of this string depends on the query problem: once we specify what property of $f$ we want to determine, we can interpret $y$ according to an appropriate decision rule.

The Deutsch–Jozsa problem

The Deutsch–Jozsa problem generalizes Deutsch’s problem: for an input function $f : \Sigma^n \to \Sigma$ , the task is to output $0$ if $f$ is constant and $1$ if $f$ is balanced.

The Deutsch–Jozsa problem

Input:: $f : \Sigma^n \to \Sigma$ for some $n \geq 1$
Promise:: $f$ is either constant or balanced
Output:: $0$ if $f$ is constant, $1$ if $f$ is balanced

For $n = 1$ these are the only two possibilities, so this is exactly Deutsch’s problem. When $n \geq 2$ , however, some functions $f : \Sigma^n \to \Sigma$ are neither constant nor balanced.

Build a function

Flip the four outputs to define any function $f : \Sigma^2 \to \Sigma$ and see which family it falls into.

x

00

01

10

11

f(x)

$1$ of the four inputs map to $1$ — neither all of them nor half of them — so this function is neither constant nor balanced.

Input functions that are neither constant nor balanced are “don’t care” inputs. The promise excludes them, so on such a function an algorithm may output anything without being considered wrong.

The Hadamard transform

The Hadamard gate acts on the computational basis states like this:

H|0\rangle = \frac{1}{\sqrt{2}}\big(|0\rangle + |1\rangle\big),\qquad H|1\rangle = \frac{1}{\sqrt{2}}\big(|0\rangle - |1\rangle\big).

The only difference between these two equations is the sign of the $|1\rangle$ term. The factor $(-1)^a$ captures this perfectly: it equals $1$ when $a = 0$ and $-1$ when $a = 1$ . So we can combine both cases into a single expression:

H|a\rangle = \frac{1}{\sqrt{2}}\big(|0\rangle + (-1)^{a}|1\rangle\big),\qquad a \in \Sigma.

Notice that the only difference between the two terms is their phase. The $|0\rangle$ term always has a positive sign, while the sign of the $|1\rangle$ term depends on the input bit $a$ . We can capture both cases with the exponent $ab$ , where $b$ labels the basis state in the sum:

for $b = 0$ , we have $ab = 0$ , so $(-1)^{ab} = 1$ , giving the positive sign of $|0\rangle$ ;
for $b = 1$ , we have $ab = a$ , so $(-1)^{ab} = (-1)^a$ , giving the correct sign of $|1\rangle$ .

Therefore, both terms can be written as a single summation:

H|a\rangle = \frac{1}{\sqrt{2}}\sum_{b \in \{0,1\}}(-1)^{ab}|b\rangle.

From one Hadamard to many

The one-qubit Hadamard identity extends naturally to a register of $n$ qubits. Take an $n$ -bit input string whose bits $x_i$ all lie in $\Sigma = \{0, 1\}$ , and write the basis state it labels:

x = x_{n-1}\cdots x_1 x_0, \qquad |x_{n-1}\cdots x_1 x_0\rangle.

Applying a Hadamard gate to every qubit means applying $H$ independently to each bit:

H^{\otimes n}|x_{n-1}\cdots x_1 x_0\rangle = \big(H|x_{n-1}\rangle\big) \otimes \cdots \otimes \big(H|x_0\rangle\big).

Every qubit now becomes a superposition of $|0\rangle$ and $|1\rangle$ . In the one-qubit formula the summation index was called $b$ , but here we need one such index per qubit, so we rename it to $y_i$ for the $i$ -th qubit. So the one-qubit identity, with $a$ renamed to $x_i$ and $b$ renamed to $y_i$ , reads:

H|x_i\rangle = \frac{1}{\sqrt{2}}\sum_{y_i \in \Sigma}(-1)^{x_i y_i}|y_i\rangle.

Now substitute the one-qubit identity for each factor $H|x_i\rangle$ in the tensor product, using a separate index $y_i$ for each qubit:

\textcolor{#0f766e}{\big(H|x_{n-1}\rangle\big)} \otimes \cdots \otimes \textcolor{#be185d}{\big(H|x_0\rangle\big)}

= \textcolor{#0f766e}{\left(\frac{1}{\sqrt{2}}\sum_{y_{n-1} \in \Sigma}(-1)^{x_{n-1}y_{n-1}}|y_{n-1}\rangle\right)} \otimes \cdots \otimes \textcolor{#be185d}{\left(\frac{1}{\sqrt{2}}\sum_{y_{0} \in \Sigma}(-1)^{x_{0}y_{0}}|y_{0}\rangle\right)}

= \frac{1}{\sqrt{2^{n}}}\sum_{\textcolor{#0f766e}{y_{n-1}} \in \Sigma}\cdots\sum_{\textcolor{#be185d}{y_{0}} \in \Sigma}\textcolor{#0f766e}{(-1)^{x_{n-1}y_{n-1}}}\cdots\textcolor{#be185d}{(-1)^{x_{0}y_{0}}}\,\big(\textcolor{#0f766e}{|y_{n-1}\rangle}\otimes\cdots\otimes\textcolor{#be185d}{|y_{0}\rangle}\big)

= \frac{1}{\sqrt{2^{n}}}\sum_{\textcolor{#0f766e}{y_{n-1}} \in \Sigma}\cdots\sum_{\textcolor{#be185d}{y_{0}} \in \Sigma}(-1)^{\textcolor{#0f766e}{x_{n-1}y_{n-1}}+\cdots+\textcolor{#be185d}{x_{0}y_{0}}}\,|\textcolor{#0f766e}{y_{n-1}}\cdots\textcolor{#be185d}{y_{0}}\rangle

= \frac{1}{\sqrt{2^{n}}}\sum_{y \in \Sigma^{n}}(-1)^{\textcolor{#0f766e}{x_{n-1}y_{n-1}}+\cdots+\textcolor{#be185d}{x_{0}y_{0}}}\,|\textcolor{#0f766e}{y_{n-1}}\cdots\textcolor{#be185d}{y_{0}}\rangle

= \frac{1}{\sqrt{2^{n}}}\sum_{y \in \Sigma^{n}}(-1)^{x\cdot y}|y\rangle

By the multilinearity of the tensor product, the tensor product distributes over the sums, producing one term for every $n$ -bit string $y$ . The phase factors multiply together, so their exponents add. Thus $H^{\otimes n}$ maps $|x\rangle$ to an equal superposition of all basis states $|y\rangle$ , differing only in their phases.

Walking through the circuit

Let’s follow the state as it passes through each stage of the Deutsch–Jozsa circuit.

\lvert 0\rangle

\lvert 0\rangle

\lvert 0\rangle

\lvert 1\rangle

y \in \Sigma^n

Step through the circuit

1Prepare the $n$ query qubits in $|0\rangle$ and the target qubit in $|1\rangle$ .
2Apply a Hadamard to every qubit.
3Apply the query gate $U_f$ — the single query.
4Apply a Hadamard to each of the $n$ query qubits.
5Measure the query register to get $y \in \Sigma^n$ .

The Bernstein–Vazirani problem

Imagine that someone secretly chooses an $n$ -bit string $s$ .

You cannot see $s$ directly. Instead, you may query a function $f$ . For any input $x$ , the function looks only at the positions where the secret string has a $1$ . It counts how many of those positions also contain a $1$ in $x$ , and returns:

$1$ if the count is odd,
$0$ if the count is even.

Bernstein–Vazirani problem

Input:: $f : \Sigma^n \to \Sigma$
Promise:: there exists a binary string $s = s_{n-1}\cdots s_0$ for which $f(x) = s \cdot x$ for all $x \in \Sigma^n$
Output:: the string $s$

What does $s \cdot x$ mean?

The binary dot product works in two steps.

Compare the corresponding bits of $s$ and $x$ .
Count only the positions where both bits are $1$ . If this count is odd, the answer is $1$ ; if it is even, the answer is $0$ .

For example, compare the two strings bit by bit. Only the columns where both bits are $1$ contribute to the dot product. Click any bit to change it.

s

x

s_i x_i

1

0

0

1

0

1

\begin{aligned} f(110101) &= \textcolor{#0369a1}{(1\cdot1)}\oplus\textcolor{#94a3b8}{(0\cdot1)}\oplus\textcolor{#94a3b8}{(1\cdot0)}\oplus\textcolor{#0369a1}{(1\cdot1)}\oplus\textcolor{#94a3b8}{(0\cdot0)}\oplus\textcolor{#0369a1}{(1\cdot1)}\\ &= \textcolor{#0369a1}{1}\oplus\textcolor{#94a3b8}{0}\oplus\textcolor{#94a3b8}{0}\oplus\textcolor{#0369a1}{1}\oplus\textcolor{#94a3b8}{0}\oplus\textcolor{#0369a1}{1}\\ &= 1 \end{aligned}

Mathematically, this is written as follows, where multiplication is ordinary binary multiplication ( $1\cdot1 = 1$ , otherwise $0$ ), and $\oplus$ denotes XOR:

s\cdot x = s_{n-1}x_{n-1}\oplus\cdots\oplus s_0x_0.

The quantum algorithm

Unlike Deutsch’s and Deutsch–Jozsa’s problems, where the goal is to learn one property of the function, the Bernstein–Vazirani problem asks for the entire hidden string $s$ .

Surprisingly, the quantum algorithm requires no new circuit. It uses exactly the same circuit as Deutsch–Jozsa:

$n$ query qubits initialized to $|0\rangle$ ,
one target qubit initialized to $|1\rangle$ ,
Hadamard gates before and after a single query to the oracle $U_f$ .

The only difference is the promise on the function. Because $f(x) = s\cdot x$ , the measurement no longer reveals whether the function is constant or balanced — it reveals the hidden string $s$ itself.

\lvert 0\rangle

\lvert 0\rangle

\lvert 0\rangle

\lvert 1\rangle

s

Step through the circuit

The first three stages are identical to those of the Deutsch–Jozsa algorithm. Since we’ve already derived them, we’ll begin at the state $|\pi_3\rangle$ , where the new promise on $f$ finally changes the outcome.

1Prepare the $n$ query qubits in $|0\rangle$ and the target qubit in $|1\rangle$ .
2Apply a Hadamard to every qubit.
3Apply the query gate $U_f$ — the single query.
4Apply a Hadamard to each of the $n$ query qubits.
5Measure the query register to read $y = s$ .

Simon’s problem

As in Bernstein–Vazirani, someone secretly chooses an $n$ -bit string $s$ , and the task is to recover it. What changes is how the function hides it.

The function $f$ no longer returns a single bit but a whole string, and no individual value $f(x)$ tells you anything about $s$ . Instead, $s$ is written into the pattern of collisions: $f$ gives the same answer on two different inputs exactly when those inputs differ by $s$ .

Simon’s problem

Input:: $f : \Sigma^n \to \Sigma^m$
Promise:: there exists a string $s \in \Sigma^n$ such that
$\big[f(x) = f(y)\big]\iff\big[(x = y)\ \text{ or }\ (x\oplus s = y)\big]$
for all $x, y \in \Sigma^n$
Output:: the string $s$

The promise says that $x$ and $y$ collide only in the two ways it lists: either they are the same input, or one is the other shifted by $s$ . Which of those matters depends on whether $s$ is the all-zero string.

Case 1: $s = 0^n$

Shifting by $s$ changes nothing, since $x \oplus 0^n = x$ , so both branches of the promise say the same thing and the condition simplifies to

\big[f(x) = f(y)\big]\iff\big[x = y\big]

This is exactly the definition of one-to-one. On three bits, all eight inputs have different outputs, so a query never repeats a value.

x

f(x)

000

101

001

010

010

111

011

001

100

110

101

011

110

100

111

000

Case 2: $s \neq 0^n$

Now $x \oplus s$ is a genuinely different input from $x$ , and the promise forces the two to agree:

f(x) = f(x\oplus s)

Every input is paired with exactly one partner, and the promise also rules out any other coincidence, so different pairs must have different outputs. The function is therefore two-to-one. With $s = 110$ , the eight inputs collapse onto four outputs:

x,\ x \oplus s

f(x)

000,\ 110

101

001,\ 111

010

010,\ 100

111

011,\ 101

001

Nothing in a single answer points at $s$ . It shows up only once two inputs are found to share an output, and then $s = x \oplus (x \oplus s)$ .

The two cases are what makes the problem hard classically. Learning $s$ means finding a collision, and a classical algorithm has no way to force one: it can only keep querying inputs and comparing the answers it has already seen.

Simon’s algorithm

Simon’s algorithm consists of running the following circuit several times, followed by a post-processing step. The circuit is the familiar shape — Hadamards, one query, Hadamards, measurement — with two changes forced by the new function:

the workspace is now $m$ qubits rather than one, since $f$ returns a string of $m$ bits;
those qubits start in $|0\rangle$ and carry no gates at all — not even a Hadamard.

\textcolor{#6d28d9}{\lvert 0\rangle}

\textcolor{#6d28d9}{\lvert 0\rangle}

\textcolor{#6d28d9}{\lvert 0\rangle}

\textcolor{#b45309}{\lvert 0\rangle}

\textcolor{#b45309}{\lvert 0\rangle}

\textcolor{#b45309}{\lvert 0\rangle}

y \in \Sigma^n

Step through the circuit

1Prepare the $n$ query qubits and the $m$ workspace qubits in $|0\rangle$ .
2Apply a Hadamard to each query qubit.
3Apply the query gate $U_f$ — the single query.
4Apply a Hadamard to each query qubit again.
5Measure the query register to read $y \in \Sigma^n$ .
6Repeat steps 1–5, then solve the collected equations $y\cdot s=0$ for $s$ — the one step that is classical, not the circuit.

Up to this point the practical value of these algorithms is thin, and the accounting is generous. The speedup is counted in oracle queries while everything around the query is assumed free. Someone still has to build the gate for $f$ , which can easily cost more than the queries it saves. The promise has to hold, and rejecting a function that fails it is roughly the problem you started with. Measurements come back noisy and runs have to be repeated. And all of it takes far more thought than the same job written in ordinary 0-1 bits.

Whether that changes further on, we will see. It is too early for disappointment either way. The road so far is a sequence of historical milestones, each adding a piece of the knowledge the later algorithms are built from:

Deutsch showed quantum computation could outperform classical in principle: one query instead of two.
Deutsch–Jozsa demonstrated an exponential separation in the query model, under a promise, and only against classical algorithms that must be exactly right every time.
Bernstein–Vazirani found a separation that randomness cannot close, and applied recursively, a superpolynomial one.
Simon introduced hidden-period techniques, and gave the first exponential separation against randomized classical algorithms.

All four are statements about the query model, where the only cost counted is the number of calls to the oracle, and where the function comes with a promise attached. Neither assumption holds outside it, and nothing here proves quantum computers are faster on ordinary inputs. The machinery does carry over though. Superposition, phase kickback and interference reappear in algorithms that are handed no black box at all. Whether that finally repays the trouble is an open question at this point.

The cost of classical algorithms

Measuring cost

In the query model there was exactly one thing to count. Outside it there is no oracle to call, so before any classical and quantum algorithm can be compared on a real problem, we need a yardstick that works for both.

An abstract view of computation

Whatever the computational model, the input and output are binary strings.

inputx

computation

outputy

The middle box could be a Turing machine, a Boolean circuit, a quantum circuit or a Python program. Only the computation changes. Inputs and outputs remain binary strings, and numbers, vectors, matrices, graphs, or molecules all enter the computation through an appropriate binary encoding.

Input length

There is rarely a single standard encoding. We choose one, and the details matter less than they seem: converting between any two reasonable encodings adds only a small overhead. What the choice does determine is the input length: the number of bits in the encoded input. For a nonnegative integer written in binary,

\lg(N)=\begin{cases}1, & N = 0,\\[2pt]1+\lfloor\log_2 N\rfloor, & N \geq 1.\end{cases}

number	binary encoding	length
0	0	1
5	101	3
12	1100	4
1 000 000	11110100001001000000	20
a 617-digit RSA modulus	1011…0111	2048

This is the key idea. The input length grows logarithmically with the number it represents. A 2048-bit input therefore describes a number close to $2^{2048}$ . An algorithm that tests every divisor up to $\sqrt{N}$ performs about $2^{n/2}$ operations on an $n$ -bit input. It may look efficient when measured against $N$ , but it is exponential when measured against the true input size $n$ .

Elementary operations

The cost of a circuit is measured by the number of elementary gate applications it performs. Which gates are considered elementary is a modeling choice: we first fix a gate set, and each application of a gate from that set counts as one computational step. The set does not have to be minimal—some gates may themselves be implementable using other gates in the same set.

ANDORNOTFANOUT

We count FANOUT as a gate. It is often treated as free, but making it explicit highlights an important contrast: classical circuits can copy bits freely, whereas quantum circuits cannot.

X

Y

Z

H

S

S^\dagger

T

T^\dagger

CNOTmeasurement

This gate set is universal: any unitary operation can be approximated to arbitrary accuracy using only these gates.

Size and depth

The size of a circuit is the total number of gates in it. Its depth is the largest number of gates on any path from an input wire to an output wire. Size corresponds to sequential running time, while depth corresponds to parallel running time.

Cost as a function of input length

A circuit has a fixed number of input wires, so it accepts inputs of only one length, and its cost is simply its size, $\mathrm{cost}(C)=\mathrm{size}(C)$ . An algorithm, however, must work for inputs of arbitrary length. It is therefore represented by a family of circuits $\{C_1, C_2, \ldots\}$ , where $C_n$ handles $n$ -bit inputs. The cost of the algorithm is then the size of the circuit for each input length:

t(n)=\mathrm{size}(C_n).

For example, a classical factoring algorithm is a family of Boolean circuits, while a quantum factoring algorithm is a family of quantum circuits. Both solve the same problem on $n$ -bit inputs, differing only in the gate set they use.

This lets us compare algorithms by how $t(n)$ grows with the input length. An algorithm is considered efficient if $t(n)$ is bounded by a polynomial in $n$ .

Cost analysis: integer addition

Now that cost is defined as a function of the input length, we can work through a complete example. The simplest one is integer addition: given two integers $N$ and $M$ , compute their sum $N + M$ . Both inputs are provided in binary.

The algorithm itself is familiar from elementary school. What changes is the model of computation. Instead of describing the sequence of arithmetic steps, we must build the algorithm as a Boolean circuit from elementary gates and determine its cost. Later, we will construct the same algorithm on a quantum circuit and compare how the resource requirements differ.

The algorithm

Binary addition follows the same schoolbook procedure as decimal addition. Starting with the least significant bit, each column adds the two input bits together with the carry from the previous column, producing a sum bit and a new carry for the next column.

The important observation is that every column performs exactly the same computation. It receives three input bits—the operand bits $x_i$ and $y_i$ , and the incoming carry $c_i$ —and produces two output bits: the sum $s_i$ and the outgoing carry $c_{i+1}$ .

bit 7bit 6bit 5bit 4bit 3bit 2bit 1bit 0carries11111000

N = 156

+\; M = 107

N + M = 263

100000111

Building the Boolean circuit

The addition algorithm consists of one operation repeated for every bit position. We therefore start by building a circuit for a single column. Once that building block is complete, the full adder is obtained simply by connecting copies of it together.

Half adder

Every column of the addition except the least significant one—bit $0$ , where there is nothing to carry from—must also handle an incoming carry. Starting from a half adder, we add a second half adder to incorporate the carry, then combine the two possible carry outputs with an OR gate. The result is a full adder, implementing the three-input, two-output function performed by every column.

Full adder

Half adder

The complete adder is built by repeating the same full adder circuit, with the carry propagating from one bit to the next.

Half adder

Full adder

Count the gates

An $n$ -bit adder is one half adder and $n-1$ full adders, so

t(n)=10+21(n-1)=21n-11.

Whether that constant comes out as 21, or 31, or something else again depends on the gate set and on how the XOR is expanded, and it is not what we are after. What the construction establishes is that there exists a family $\{C_1, C_2, \ldots\}$ of Boolean circuits, where $C_n$ adds two $n$ -bit nonnegative integers together, such that $\mathrm{size}(C_n) = O(n)$ .

Asymptotic notation

The exact number of gates depends on implementation details such as the gate set or the choice of intermediate operations. These differences affect only constant factors, while the overall growth of the algorithm stays the same. Asymptotic notation describes that growth by ignoring constant multipliers and lower-order terms.

The most commonly used notation is Big O, which gives an upper bound on the growth rate of a function. For two functions $g(n)$ and $h(n)$ , we write that $g(n) = O(h(n))$ if there exists a positive real number $c > 0$ and a positive integer $n_0$ such that $g(n) \leq c \cdot h(n)$ for all $n \geq n_0$ .

cost (time)input length n

Growth classes

Examples

Polynomial, Subexponential, and Exponential Growth

These three names describe how an algorithm's cost grows with the input size. The chart shades these regions on its log scale.

Polynomial — $O(n^{b})$ for a fixed $b>0$ . This is the usual boundary for what we call efficient.

Subexponential — $2^{o(n)}$ : the exponent grows more slowly than $n$ . A stricter definition requires $O(2^{n^{\varepsilon}})$ for every $\varepsilon>0$ . The number field sieve is subexponential under the first definition, but not under this stricter one.

Exponential — $2^{\Theta(n)}$ : the exponent grows linearly with $n$ . In particular, an algorithm that is not subexponential is not automatically exponential. There is a gap between the two classes.

The exponential-time hypothesis (ETH) conjectures that NP-complete problems have no subexponential-time algorithms.

Cost analysis: integer multiplication

The next example is one step up from addition: given two integers $N$ and $M$ , compute their product $N \cdot M$ . Both inputs are again provided in binary. As with addition, the algorithm itself is familiar. The task is to express it as a Boolean circuit and determine how its cost grows with the input length.

The algorithm

Binary long multiplication follows the same procedure as decimal long multiplication. For each bit of $M$ , we form a partial product by either copying $N$ or producing a row of zeros, depending on whether that bit is $1$ or $0$ . Each partial product is then shifted according to the position of the corresponding bit of $M$ . Adding all of these shifted rows gives the final product.

bit 7bit 6bit 5bit 4bit 3bit 2bit 1bit 0

N = 13

\times\; M = 11

M_0\,{=}\,1:\ N \ll 0

1101

M_1\,{=}\,1:\ N \ll 1

1101

M_2\,{=}\,0

0000

M_3\,{=}\,1:\ N \ll 3

1101

N \cdot M = 143

10001111

The key observation is that every bit of every partial product depends on exactly two input bits: one bit from $N$ and one bit from $M$ . This gives us a simple building block for the first stage of the circuit.

Building the Boolean circuit

For a pair of bits $N_i$ and $M_j$ , the corresponding partial-product bit is $1$ exactly when both bits are $1$ . This is precisely the function computed by an AND gate.

Partial-product bit

We therefore obtain all partial products by arranging these AND gates in a grid. For two $n$ -bit inputs, there is one gate for every pair $(i, j)$ , giving an $n \times n$ array and therefore $n^2$ AND gates.

Partial-product array

This produces the partial products, but they still have to be added together. Here we can reuse the $n$ -bit adder from the previous example. The shifted partial products are added one after another, requiring $n - 1$ such additions.

0 0 0 0 1 1 0 1

0 0 0 1 1 0 1 0

n-bit adder #1

0 0 1 0 0 1 1 1

0 0 0 0 0 0 0 0

n-bit adder #2

0 0 1 0 0 1 1 1

0 1 1 0 1 0 0 0

n-bit adder #3

1 0 0 0 1 1 1 1

Count the gates

Counting the two stages: the array contributes $n^2$ AND gates, and the summation contributes $n - 1$ adders of $O(n)$ gates each. The total is

t(n)=\underbrace{n^2}_{\text{partial products}}+\underbrace{(n-1)\cdot O(n)}_{\text{summation}}=O(n^2).

So there is a family $\{C_1, C_2, \ldots\}$ of Boolean circuits, where $C_n$ multiplies two $n$ -bit nonnegative integers, with $\mathrm{size}(C_n) = O(n^2)$ . By the standard multiplication algorithm, there are Boolean circuits of size $O(n^2)$ for multiplying $n$ -bit integers.

More generally, the same array argument with an $n \times m$ grid gives circuits of size $O(nm)$ for multiplying an $n$ -bit integer by an $m$ -bit integer.

Faster multiplication: convolution and the Fourier transform

Schoolbook multiplication costs $O(n^2)$ , and for a long time that was taken to be optimal. In 1960, Karatsuba showed that it was not, using divide and conquer to reduce multiplication to a smaller number of multiplications.

The same search for structure leads further: the pairwise products of schoolbook multiplication form a convolution, and the Fourier transform provides a way to compute that convolution efficiently.

Multiplying in blocks

An $n$ -bit integer can be split into $k$ blocks of $b$ bits, with each block treated as a single digit in base $B = 2^b$ . Thus $k = \lceil n/b \rceil$ , $N = (a_0, a_1, \ldots, a_{k-1})$ and $M = (c_0, c_1, \ldots, c_{k-1})$ .

Block widthb = 2 bits

8

bits →

4

blocks of

2

B = 2^{2} = 4

a_i, c_j \in \{0, 1, 2, 3\}

$N$

a₀1a₁2a₂1a₃3

N = (3121)_{4} = 217

$M$

c₀2c₁1c₂3c₃2

M = (2312)_{4} = 182

Schoolbook multiplication of these block digits forms every product $a_i c_j$ , giving $k^2$ block products. This is not a saving by itself: larger blocks give fewer products, but each product is a multiplication of wider numbers.

c₀ = 2c₁ = 1c₂ = 3c₃ = 2

a₀ = 1a₀c₀2a₀c₁1a₀c₂3a₀c₃2

a₁ = 2a₁c₀4a₁c₁2a₁c₂6a₁c₃4

a₂ = 1a₂c₀2a₂c₁1a₂c₂3a₂c₃2

a₃ = 3a₃c₀6a₃c₁3a₃c₂9a₃c₃6

The reason for changing to blocks is that they make the structure of the product visible. A cell of the array represents $(a_i B^{\,i})(c_j B^{\,j}) = a_i c_j \, B^{\,i+j}$ . Summing over all cells therefore gives $N \cdot M = \big(\textstyle\sum_i a_i B^{\,i}\big)\big(\sum_j c_j B^{\,j}\big) = \sum_i \sum_j a_i c_j \, B^{\,i+j}$ . The index sum $i+j$ determines where each product contributes: cells with the same index sum multiply the same power of $B$ , so their products can be added together.

Given this structure, the question is therefore how to combine the $k^2$ products more efficiently, rather than compute and handle each one separately.

Convolution

From the product table above, we already know that products with the same index sum $i+j$ belong together. Let $d_l = \sum_{i+j=l} a_i c_j$ . Then the product can be written as $N M = \sum_l d_l B^{\,l}$ . The sequence $(d_0, d_1, \ldots, d_{2k-2})$ is the convolution of the block sequences $(a_0, a_1, \ldots, a_{k-1})$ and $(c_0, c_1, \ldots, c_{k-1})$ .

So the $k^2$ cells of the multiplication array collapse into just $2k-1$ diagonal sums:

d₀ · B⁰ = 2 · 12

d₁ · B¹ = 5 · 420

d₂ · B² = 7 · 16112

d₃ · B³ = 15 · 64960

d₄ · B⁴ = 10 · 2562560

d₅ · B⁵ = 11 · 102411264

d₆ · B⁶ = 6 · 409624576

N × M = 217 × 18239494

Calculating convolution

The same sum can be pictured two ways: as a diagonal in the product table above, or by sliding the reversed $M$ blocks under the $N$ blocks.

a₀1a₁2a₂1a₃3

c₃2c₂3c₁1c₀2

2

d₀ = a₀c₀ = 2

Nothing has become faster yet. The same $k^2$ pairwise products still appear in the definition of the convolution.

But we have changed what we are trying to compute. Schoolbook multiplication computes every $a_i c_j$ and immediately assigns it to a diagonal. The individual products are discarded after contributing to their diagonal sum. The result we actually need is only $d_0, d_1, \ldots, d_{2k-2}$ .

So the problem can now be stated precisely: can we compute all the convolution coefficients $d_l$ without computing all $k^2$ products $a_i c_j$ individually? That is the problem the Fourier transform will solve.

Another way to compute convolution

So far, the coefficients $d_0, d_1, \ldots, d_{2k-2}$ have been a sequence of numbers attached to powers of the base in $NM = \sum_l d_l B^{\,l}$ . Instead of fixing the base at $B$ , leave it as a variable: the same structure becomes a polynomial, which for the blocks above is $2 + 5x + 7x^{2} + 15x^{3} + 10x^{4} + 11x^{5} + 6x^{6}$ .

At the same time, the two multiplicands can be written as polynomials too— $N(x) = \sum_i a_i x^i$ and $M(x) = \sum_j c_j x^j$ . Multiplying them gives $D(x) = N(x)\,M(x) = \sum_l d_l x^l$ . So the coefficients of $D(x)$ are exactly the convolution coefficients we want: we have simply turned the two input sequences into polynomials and the convolution into their product.

Now comes the useful part: a polynomial can be represented in another way—not by its coefficients, but by its values at enough distinct points. A degree- $d$ polynomial is completely determined by $d+1$ such values. In this representation, multiplication becomes much simpler. At every point $D(x) = N(x)\,M(x)$ , so we can evaluate $N$ and $M$ , multiply the corresponding values, and obtain the values of $D$ . There are no cross terms: just one ordinary multiplication per point.

Since $D$ has degree $2k-2$ , $2k-1$ values are enough to recover all its coefficients. The strategy is therefore:

Blocks of Na₀, a₁, …

Blocks of Mc₀, c₁, …

evaluate

pointwise ×

interpolate

Convolutiond₀, d₁, …

at x₀

N(x₀)−0.49

M(x₀)2.05

N(x₀) × M(x₀) = D(x₀)−1

Points → recovered coefficients of D(x)

2, 5, 7, 15, 10, 11, 6

We have recovered all the convolution coefficients—but we have not made the computation faster yet. Evaluating the polynomials and interpolating the result still costs $O(k^2)$ when done naively. The key question is therefore not whether this representation works, but whether we can choose the evaluation points so that the evaluations themselves can be computed efficiently—that is where the Fourier transform enters.

Choosing the evaluation points

We want evaluation points where one evaluation can reuse work from another. A natural pair to try is $x$ and $-x$ .

The two points differ only in the sign of $x$ . To make that useful, sort the coefficients of $N$ by whether their position is even or odd. Call the two halves $N_{\mathrm{e}}$ and $N_{\mathrm{o}}$ ; both are polynomials in $x^2$ , and $N(x) = N_{\mathrm{e}}(x^2) + x\,N_{\mathrm{o}}(x^2)$ —for example, $N(x) = 1 + 2x + x^{2} + 3x^{3} = (1 + x^{2}) + x(2 + 3x^{2})$ . Now the advantage is visible: replacing $x$ by $-x$ leaves $x^2$ unchanged, so the even half stays the same while the odd half changes sign, $N(-x) = N_{\mathrm{e}}(x^2) - x\,N_{\mathrm{o}}(x^2)$ .

Thus both $N(x)$ and $N(-x)$ can be calculated from the same two quantities, $N_{\mathrm{e}}(x^2)$ and $N_{\mathrm{o}}(x^2)$ . Once these are known, the two results require only one multiplication and two additions: form $x \cdot N_{\mathrm{o}}(x^2)$ once, then add it to and subtract it from $N_{\mathrm{e}}(x^2)$ . The important part is that $N_{\mathrm{e}}$ and $N_{\mathrm{o}}$ each have half as many coefficients as $N$ . The same rule therefore applies to them, and to their halves in turn—each split naming its pieces by the choices that made them, so that $N_{\mathrm{oe}}$ is the even half of $N$ ’s odd half. Repeating this keeps halving the size of the problem.

The caveat is that we have only used the $(x, -x)$ pairing once. To keep saving work, the points left after that first split must themselves form $(x, -x)$ pairs, so that the same idea can be applied again. Real numbers do not work. Once we square them, all points become nonnegative, so the pairing is lost. We therefore move to the complex plane.

The roots of unity have exactly the structure we need: $\omega_j = e^{2\pi i j/k}$ , $j = 0, \ldots, k-1$ . They are evenly spaced around the unit circle. Each point has an opposite partner, $\omega_{j+k/2} = -\omega_j$ , and squaring sends each pair to the same point. The resulting points are again evenly spaced, so the pairing survives and the process can repeat: $k \rightarrow k/2 \rightarrow k/4 \rightarrow \cdots \rightarrow 1$ .

u = x²v = u²q = v²

8

From coefficients to values at the roots of unity

We have now split the polynomials down to their individual coefficients. The next step is to reverse the process: combine the pieces back up to obtain the values of $N$ and $M$ at the chosen roots of unity. These values are exactly what we need to multiply the polynomials pointwise.

1. Split down to individual coefficients

We apply the same recursive split to both $N(x)$ and $M(x)$ , until every branch contains a single coefficient.

For $N(x)$ , the leaves are $\color{#b9785c}{a_{0}=1},\color{#b9785c}{a_{1}=2},\color{#b9785c}{a_{2}=1},\color{#b9785c}{a_{3}=3}$ , and $\color{#5f8f7f}{a_{4}},\color{#5f8f7f}{a_{5}},\color{#5f8f7f}{a_{6}},\color{#5f8f7f}{a_{7}}=0$ .

For $M(x)$ , following the same process as with $N(x)$ , we obtain $\color{#b9785c}{c_{0}=2},\color{#b9785c}{c_{1}=1},\color{#b9785c}{c_{2}=3},\color{#b9785c}{c_{3}=2}$ , and $\color{#5f8f7f}{c_{4}},\color{#5f8f7f}{c_{5}},\color{#5f8f7f}{c_{6}},\color{#5f8f7f}{c_{7}}=0$ .

These $a_k$ and $c_k$ are now the individual coefficients that we recombine upward.

The coefficients themselves have not changed. They are still the original coefficients of the two polynomials. What has changed is how they are organized. At each split, we separate even and odd powers, and the resulting branches record these choices. The tree makes this recursive structure explicit. We can then reverse the same structure to combine the coefficients and evaluate the polynomials at all the roots of unity.

2. Recombine upward

Reverse the same tree. At each level, combine the even and odd pieces until we have evaluated both polynomials at all $8$ chosen roots of unity:

\{a_k\}\xrightarrow{\text{combine upward}}\{N(\omega_j)\},\qquad \{c_k\}\xrightarrow{\text{combine upward}}\{M(\omega_j)\}.

At each point $\omega_j$ , multiply the two values:

D(\omega_j)=N(\omega_j)M(\omega_j).

Point	$N(\omega_j)$	$M(\omega_j)$	$D(\omega_j)$
$\omega_{0}=1$	$7$	$8$	$56$
$\omega_{1}=0.707+0.707i$	$0.293+4.536i$	$1.293+5.121i$	$-22.849+7.364i$
$\omega_{2}=i$	$-i$	$-1-i$	$-1+i$
$\omega_{3}=-0.707+0.707i$	$1.707+2.536i$	$2.707-0.879i$	$6.849+5.364i$
$\omega_{4}=-1$	$-3$	$2$	$-6$
$\omega_{5}=-0.707-0.707i$	$1.707-2.536i$	$2.707+0.879i$	$6.849-5.364i$
$\omega_{6}=-i$	$i$	$-1+i$	$-1-i$
$\omega_{7}=0.707-0.707i$	$0.293-4.536i$	$1.293-5.121i$	$-22.849-7.364i$

3. Interpolate

The $8$ values $D(\omega_j)$ determine the degree- $6$ product uniquely. Interpolating them gives

\boxed{D(x)=2 + 5x + 7x^{2} + 15x^{3} + 10x^{4} + 11x^{5} + 6x^{6}}.

So we have multiplied the two polynomials without forming all $k^2$ coefficient products.

The complete process is:

\{a_k\},\{c_k\}\xrightarrow{\text{evaluate}}\{N(\omega_j)\},\{M(\omega_j)\}\xrightarrow{\text{multiply}}\{D(\omega_j)\}\xrightarrow{\text{interpolate}}D(x).

But there is still one important question: how did we evaluate the polynomials at all those roots of unity efficiently?

Naming the operation: DFT and FFT

The operation we have just performed—taking the coefficients of a polynomial and evaluating it at the roots of unity—is the Discrete Fourier Transform (DFT). For $N(x)$ , the DFT takes $a_0,a_1,\ldots,a_{k-1}$ and produces $N(\omega_0),N(\omega_1),\ldots,N(\omega_{k-1})$ .

The recursive even/odd splitting above is what makes this evaluation fast. Recall that $N(x)=N_{\mathrm{e}}(x^2)+xN_{\mathrm{o}}(x^2)$ while $N(-x)=N_{\mathrm{e}}(x^2)-xN_{\mathrm{o}}(x^2)$ . We evaluate the smaller polynomials $N_{\mathrm{e}}$ and $N_{\mathrm{o}}$ once; if their values are $u$ and $v$ , the paired results are $u+xv$ and $u-xv$ . This combination is one butterfly.

Because the roots of unity are paired as $\omega$ and $-\omega$ , squaring them gives the points needed by the smaller transforms. The same split therefore repeats, $8 \rightarrow 4 \rightarrow 2 \rightarrow 1$ . The recursion does not merely divide the problem into smaller pieces: each smaller problem has exactly the same structure as the original one.

The Fast Fourier Transform (FFT) is this recursive algorithm for computing the DFT efficiently.

\boxed{\text{DFT}=\text{what we compute}}

\boxed{\text{FFT}=\text{how we compute it quickly}}

At each level, the butterflies combine the results of the two half-size transforms. There are $O(k)$ butterfly operations per level and $\log_2 k$ levels, giving $T(k)=2T(k/2)+O(k)=O(k\log k)$ . The same applies to $M(x)$ , so we can write the complete multiplication algorithm compactly as

\boxed{\operatorname{FFT}(N),\operatorname{FFT}(M)\;\longrightarrow\;\text{pointwise multiplication}\;\longrightarrow\;\text{inverse FFT}}

The inverse transform takes the values $D(\omega_j)$ back to the coefficients $d_0,d_1,\ldots,d_{2k-2}$ , which are exactly the convolution coefficients we wanted. Thus the Fourier transform turns convolution into pointwise multiplication, $\operatorname{DFT}(a*c)=\operatorname{DFT}(a)\odot\operatorname{DFT}(c).$ The $k^2$ pairwise products have been replaced by two fast transforms, $k$ pointwise products, and one inverse transform.

The Schönhage–Strassen algorithm

The Fourier transform gave us a fast way to multiply polynomials. But originally we set out to multiply integers, and for them there are still open questions:

Can the transform be made exact? The roots of unity it evaluates at are complex numbers, and their coordinates are irrational, so complex arithmetic is only ever approximate—but a product of integers has to come out exactly.
Can the leftover multiplications be removed? The $k$ pointwise products are still multiplications of integers. The transform has shrunk their operands—to about $n/k$ bits each—but has not made them go away.

And the Schönhage–Strassen algorithm closes both.

The first fix is to change where the arithmetic happens. Instead of the complex plane, run the transform inside modular arithmetic—the integers modulo $2^m + 1$ . There $2^m \equiv -1$ , so $2^{2m} \equiv 1$ . The number $2$ therefore behaves as a $2m$ -th root of unity: its powers close into a cycle, with the opposite points satisfying $2^{j+m} \equiv -2^{j}$ .

exponent

2^{0} \equiv 1 \pmod{2^{4}+1}

The highlighted $\pm$ pair, opposite on the ring:

2^{0} = 1

2^{4} = 16 \equiv -1

Square both. Since $2^{8}\equiv 1$ , the extra factor drops and they meet:

(2^{0})^2 = 2^{0} \equiv 1

(2^{4})^2 = 2^{8} \equiv 2^{0} \equiv 1

Both land on the same point, $2^{0}\equiv 1$ —just as $\omega$ and $-\omega$ square to $\omega^{2}$ . That collapse halves the points, and the transform recurses on what remains.

This change solves two problems at once. The transform is now exact, because nothing is represented by an approximate complex number. And every root of unity is a power of $2$ , so multiplying by one is just a shift of the bits, with the part that runs off the top folded back with a minus sign. The transform therefore needs only additions and shifts, and costs $O(n \lg n)$ bit operations.

The second fix is to recurse. Each of the $k$ pointwise products is a multiplication of much smaller integers—the very problem we began with, in miniature. So we solve those products using the same algorithm. This recursion is the heart of Schönhage–Strassen.

To analyze the cost, one free parameter remains: how many blocks should we use? Cutting an $n$ -bit integer into $k$ blocks gives blocks of about $n/k$ bits, and the transform turns the multiplication into $k$ pointwise multiplications of numbers that size. There is a trade-off: fewer blocks mean larger pointwise multiplications, more blocks mean a longer transform. Balancing the two costs gives $k \approx \sqrt{n}$ , so each block has about $n/k \approx \sqrt{n}$ bits. At one level of the algorithm we therefore have:

an $n$ -bit integer split into about $\sqrt{n}$ blocks of about $\sqrt{n}$ bits each;
two forward transforms and one inverse transform, costing $O(n \lg n)$ additions and shifts;
about $\sqrt{n}$ pointwise multiplications;
each pointwise multiplication multiplying two $\sqrt{n}$ -bit numbers, producing a result of about $2\sqrt{n}$ bits.

That last point is crucial. The recursive problems are multiplications of roughly $2\sqrt{n}$ -bit numbers, and there are about $\sqrt{n}$ of them, so the recursive part contains $\sqrt{n} \cdot 2\sqrt{n} = 2n$ bits in total—only a constant factor more than the $n$ input bits. This gives the recurrence

t(n)=O(n\lg n)+\sqrt{n}\,t(2\sqrt{n}),

where the first term is the work done by the transforms and the second is the cost of the $\sqrt{n}$ recursive multiplications. Now look at what happens as we recurse: each level square-roots the operand size, $n \to \sqrt{n} \to \sqrt{\sqrt{n}} \to \cdots$ . At first this may look as though the recursive work should become dramatically smaller, but there are more and more subproblems at each level, and the number of bits across all of them grows by the same factor that the logarithm of their size shrinks. So, up to constant factors, each level still costs $O(n \lg n)$ :

Level	Operand size	Bits in total	Transform work
0	$n$	$n$	$n\lg n$
1	$2\sqrt{n}$	$2n$	$2n\cdot\tfrac{1}{2}\lg n=n\lg n$
2	$\approx 2\sqrt{\sqrt{n}}$	$4n$	$4n\cdot\tfrac{1}{4}\lg n=n\lg n$
r	$\approx 2n^{1/2^{r}}$	$2^{r}n$	$2^{r}n\cdot\tfrac{\lg n}{2^{r}}=n\lg n$

The only thing left to determine is how many levels there are. Taking a square root halves the exponent, so after $r$ levels the operands are about $n^{1/2^{r}}$ bits wide, and we stop when that reaches constant size. Taking logarithms, the condition reads $\lg n / 2^{r} = O(1)$ , or $2^{r} = \Theta(\lg n)$ , so $r = O(\lg\lg n)$ . Each of those levels costs $O(n \lg n)$ , giving

O(n\lg n)\times O(\lg\lg n)=\boxed{t(n)=O(n\lg n\lg\lg n)}

That is where the second logarithm comes from: the transform itself costs only $O(n \lg n)$ bit operations, and the extra $\lg\lg n$ is the price of repeating that work over $O(\lg\lg n)$ levels of recursion.

For the small example above, all of this machinery is obviously overkill. Splitting, padding, transforming, and rebuilding the result carry their own overhead. The advantage appears only for sufficiently large inputs, when replacing $k^2$ pairwise block products with $O(k\lg k)$ transform work saves more than that setup costs.

Beyond Schönhage–Strassen

Schönhage–Strassen remained the asymptotically fastest known integer multiplication algorithm for decades. In 2019, Harvey and van der Hoeven presented Integer multiplication in time O(n log n), an algorithm of complexity $O(n \lg(n))$ , which is conjectured to be optimal up to constant factors.

Cost analysis: integer division

Given two integers $N$ and $M$ , integer division computes a quotient $Q$ and a remainder $R$ such that $N = QM + R$ with $0 \le R < M$ . As before, the inputs are given in binary. But division differs from addition and multiplication in an important way: it must make a decision at each step. Given the current partial remainder, it has to determine whether $M$ fits and, depending on the answer, either subtract $M$ or leave the remainder unchanged.

A Boolean circuit cannot branch on this decision. Instead, it has to implement the decision itself using logic gates. This makes the cost of division more interesting to analyze than the straightforward bit-by-bit operations we have seen so far.

The algorithm

Decimal long division is awkward because, at each step, we must determine the next quotient digit from several possibilities. In binary, that choice disappears: the next quotient bit can only be $0$ or $1$ . So each step reduces to a single question: does the divisor fit into the current partial remainder?

The algorithm—shift and subtract—processes the bits of $N$ from most significant to least significant. Start with $R = 0$ . At each step, bring in the next input bit $N_i$ by shifting the current remainder left by one position, $R' = 2R + N_i$ , then compare $R'$ with $M$ :

if $R' \ge M$ , subtract $M$ and set the quotient bit to $1$ ;
if $R' < M$ , keep $R'$ unchanged and set the quotient bit to $0$ .

The updated value becomes the remainder for the next step.

N = 217M = 11

00010011Q = 19

11<1011→q₇ =0

1111<1011→q₆ =0

110110<1011→q₅ =0

11011101≥1011→q₄ =1

−1011

0010

0010100101<1011→q₃ =0

0101001010<1011→q₂ =0

1010010100≥1011→q₁ =1

−1011

01001

1001110011≥1011→q₀ =1

−1011

R = 801000

After all bits have been processed, the quotient bits form $Q$ , and the final value of $R$ is the remainder.

The important point for the cost analysis is that $R'$ never becomes arbitrarily large. Since $R < M$ , we have $R' = 2R + N_i < 2M$ , so $R'$ needs at most one bit more than $M$ . The numbers involved therefore stay within essentially the same width throughout the algorithm.

Building the Boolean circuit

Every step performs the same computation, so we only need to design one circuit and then repeat it once for each bit of $N$ . At each step, the circuit must do two things: compute $R' - M$ , and decide whether to keep that result or keep $R'$ instead.

The subtraction can reuse the adder from the addition example. Using two’s complement, $R' - M = R' + \overline{M} + 1$ , so we invert every bit of $M$ and set the adder’s carry-in to $1$ . Its carry-out gives the quotient bit $q_i$ : it is $1$ when the subtraction can be kept, and $0$ when we must keep the original remainder.

We still need to implement this choice:

R = \begin{cases} R' - M, & q_i = 1,\\ R', & q_i = 0.\end{cases}

A circuit cannot skip the subtraction when $q_i = 0$ ; it computes $R' - M$ in every case and then uses $q_i$ to choose which result to keep. For each bit, a small multiplexer selects between the two candidate results, $R_j = \big(q_i \land (R' - M)_j\big) \lor \big(\overline{q_i} \land R'_j\big)$ . When $q_i = 1$ the first term passes the subtraction result through; when $q_i = 0$ the second passes the original $R'$ through. The same selection circuit is applied independently to every bit.

One-bit multiplexer

The multiplexer uses a constant number of gates per bit, so for $n$ -bit numbers it contributes $O(n)$ gates. Together with the $O(n)$ -gate subtractor, one division step therefore still uses only $O(n)$ gates.

0 1 1 0 1

Division step

subtract R′ − M

select on qᵢ

0 0 0 1 0

This one step is the whole algorithm. We repeat the same circuit once per bit of $N$ , passing the remainder from one step to the next and collecting the quotient bits as they are produced—just as the adder was built by repeating a full-adder stage.

n-bit divider

step: bit 7

step: bit 6

step: bit 5

step: bit 0

Count the gates

The algorithm performs one division step for each of the $n$ bits of $N$ . Each step processes $n$ bits and uses $O(n)$ gates: $O(n)$ for the subtraction and $O(n)$ for the bit-by-bit selection. Repeating this step $n$ times gives

t(n)=n\cdot\big(\underbrace{O(n)}_{\text{subtract}}+\underbrace{O(n)}_{\text{select}}\big)=O(n^2).

So there is a family $\{C_1, C_2, \ldots\}$ of Boolean circuits, where $C_n$ divides one $n$ -bit nonnegative integer by another and returns both the quotient and the remainder, with $\mathrm{size}(C_n) = O(n^2)$ . Counting the two widths separately, as in the figures above, an $n$ -bit dividend and an $m$ -bit divisor give $n$ steps of $O(m)$ gates, hence circuits of size $O(nm)$ .

A faster algorithm

Schoolbook division has the same $O(n^2)$ cost as schoolbook multiplication. But division does not fundamentally require repeated subtraction: it can be reduced to multiplication. The key is the reciprocal of the divisor. Since $N/M = N \cdot (1/M)$ , we can divide by $M$ by first computing $1/M$ , then multiplying by $N$ ; a final correction recovers the exact quotient and remainder.

To compute $1/M$ efficiently, we use Newton’s method, $x_{k+1} = x_k(2 - M x_k)$ , whose approximation $x_k$ to $1/M$ roughly doubles its number of correct bits each iteration. Since the precision grows as the approximation improves, the resulting costs form a geometric series, $\mathrm{M}(n) + \mathrm{M}(n/2) + \mathrm{M}(n/4) + \cdots = O(\mathrm{M}(n))$ , where $\mathrm{M}(n)$ is the cost of multiplying two $n$ -bit integers.

Thus division can be performed in $O(\mathrm{M}(n))$ bit operations: asymptotically, division costs no more than multiplication. Any fast multiplication algorithm therefore gives a fast division algorithm— Schönhage–Strassen multiplication brings division to $O(n \lg n \lg\lg n)$ , and the more recent Harvey–van der Hoeven algorithm improves it to $O(n \lg n)$ .

Cost analysis: greatest common divisor

Given two nonnegative integers $a$ and $b$ , their greatest common divisor $\gcd(a, b)$ is the largest integer that divides both. The classic method for finding the gcd is the Euclidean algorithm. It repeatedly replaces $(a, b) \longrightarrow (b,\, a \bmod b)$ until the remainder becomes $0$ . The last nonzero remainder is the gcd.

Two things determine the cost: the cost of one division and the number of divisions. Each Euclidean step computes a remainder $a \bmod b$ , using the division circuit from the previous section, and a division of two $n$ -bit numbers costs $O(n^2)$ gates. A simple analysis would say that the algorithm takes $O(n)$ divisions, giving $O(n) \cdot O(n^2) = O(n^3)$ . It does indeed take only $O(n)$ steps: every two steps, the current remainder is at most half the value from two steps earlier, so the numbers lose at least one bit every two steps. But $O(n^3)$ is too loose. Not every division is an $n$ -bit division. As the numbers get smaller, later divisions become cheaper, so we need to account for the size of each quotient.

Suppose the $i$ -th division has quotient $q_i$ , and let $d_i$ be the number of bits in that quotient. Schoolbook division performs one compare-and-subtract operation for each quotient bit, and each such operation costs $O(n)$ gates, so the $i$ -th division costs $O(d_i\, n)$ and the whole run costs $\sum_i O(d_i\, n) = O(n \sum_i d_i)$ . The key question is therefore: how large can the total number of quotient bits $\sum_i d_i$ be?

Bounding the total quotient size

Let the sequence of values produced by the Euclidean algorithm be $a_0 = a$ , $a_1 = b$ , $a_2, \ldots, a_k$ , where the $i$ -th division is $a_{i-1} = q_i a_i + a_{i+1}$ and $a_{i+1}$ is the remainder. Since the remainder is nonnegative, the right-hand side is at least $q_i a_i$ on its own, so $a_{i-1} \ge q_i a_i$ : each step shrinks the current value by at least a factor of $q_i$ . Applying this inequality repeatedly gives

a_0 \ge q_1 a_1 \ge q_1 q_2\, a_2 \ge \cdots \ge q_1 q_2 \cdots q_k\, a_k.

The last nonzero value $a_k$ is the gcd, so $a_k \ge 1$ and the right-hand side is at least the product of the quotients alone: $q_1 q_2 \cdots q_k \le a_0$ . This is the crucial bound—although there may be many divisions, their quotients cannot all be large, because their product is limited by the original input. Taking logarithms converts that product into a sum:

\sum_i \log_2 q_i = \log_2 (q_1 q_2 \cdots q_k) \le \log_2 a_0 < n,

the last step because $a_0$ has $n$ bits, so $a_0 < 2^n$ . Now relate this to the actual number of quotient bits. A number with $d_i$ bits sits between the two neighbouring powers of two, $2^{d_i - 1} \le q_i < 2^{d_i}$ , and taking logarithms of the left inequality gives $d_i - 1 \le \log_2 q_i$ , which means $d_i \le \log_2 q_i + 1$ . The $+1$ is the rounding up to a whole number of bits, and each division pays it once.

Summing over the divisions, $\sum_i d_i \le \sum_i \log_2 q_i + \sum_i 1$ . The first sum is less than $n$ , and there are only $O(n)$ Euclidean divisions, so the second contributes another $O(n)$ , giving $\sum_i d_i = O(n)$ . So although the algorithm may perform $O(n)$ divisions, the total number of quotient bits across all those divisions is only $O(n)$ . The total cost is therefore

\sum_i O(d_i\, n) = O\!\Big(n \sum_i d_i\Big) = \boxed{O(n^2)}.

Thus, with schoolbook division, the Euclidean algorithm costs $O(n^2)$ gates. This is the same asymptotic cost as a single $n$ -bit multiplication or division using schoolbook arithmetic. With faster multiplication and division algorithms, a recursive version of the Euclidean algorithm can be implemented in $O(\mathrm{M}(n)\log n)$ bit operations, where $\mathrm{M}(n)$ is the cost of multiplying two $n$ -bit integers—a count of bit operations rather than of circuit gates.

Cost analysis: modular exponentiation

Modular exponentiation computes $a^b \bmod N$ for nonnegative integers $a$ , $b$ and a modulus $N \ge 2$ , each at most $n$ bits long. It is the core operation of RSA and Diffie–Hellman. The question here is not just how to compute it, but how the cost grows with $n$ .

Multiplying by $a$ repeatedly is inefficient for two reasons. It takes about $b$ multiplications, and an $n$ -bit exponent can be as large as $2^n - 1$ , making the number of multiplications exponential in the input length. It also constructs the full integer $a^b$ , whose intermediate values can grow exponentially large — even though the final result modulo $N$ is smaller than $N$ . An efficient algorithm must avoid both problems.

The efficient method is square-and-multiply. Instead of multiplying by $a$ once for every unit in $b$ , we use the binary representation of $b$ to build the required power by repeated squaring. Writing the exponent as $b = \sum_{k=0}^{n-1} b_k 2^k$ with $b_k \in \{0, 1\}$ gives

a^b = a^{\sum_k b_k 2^k} = \prod_{k\,:\,b_k=1} a^{2^k}.

The powers $a,\; a^2,\; a^4,\; a^8,\; \ldots$ are each obtained by squaring the previous one, so generating all $n$ of them takes $n-1$ squarings. We then multiply together only the powers corresponding to the $1$ -bits of $b$ , requiring at most another $n-1$ multiplications.

Crucially, we reduce modulo $N$ after every multiplication. Every intermediate value therefore stays below $N$ , so we never construct the enormous integer $a^b$ . The entire computation uses at most $2n-2$ modular multiplications, giving a total of $O(n)$ modular multiplications.

Cost of one modular multiplication

A modular multiplication takes two values, multiplies them, and then reduces the product modulo $N$ . Because $(x\,y) \bmod N = ((x \bmod N)\,(y \bmod N)) \bmod N$ , we can reduce after each multiplication and never need to store values larger than $N - 1$ . Since $N$ is represented using at most $n$ bits, each value involved in a modular multiplication has at most $n$ bits.

Multiplying two $n$ -bit values produces a product of at most $2n$ bits. From the multiplication circuit above, this costs $O(n^2)$ gates. We then reduce the $2n$ -bit product modulo $N$ , and the division circuit also costs $O(n^2)$ gates. Therefore one modular multiplication costs $O(n^2) + O(n^2) = O(n^2)$ gates.

Total cost

Square-and-multiply uses $O(n)$ modular multiplications, and each modular multiplication costs $O(n^2)$ gates. Therefore $t(n) = O(n) \cdot O(n^2) = O(n^3)$ .

Thus there is a family of Boolean circuits $C_1, C_2, \ldots$ such that $C_n$ computes $a^b \bmod N$ for inputs of at most $n$ bits, with $\mathrm{size}(C_n) = O(n^3)$ . In other words, modular exponentiation can be implemented by a family of polynomial-size Boolean circuits.

The $O(n^3)$ bound uses the basic $O(n^2)$ multiplication and division circuits described above. Replacing them with faster algorithms improves the bit-operation cost to $O(n\,\mathrm{M}(n))$ , where $\mathrm{M}(n)$ is the cost of multiplying two $n$ -bit integers.

Cost analysis: integer factorization

Given an integer $N\ge2$ , integer factorization finds its prime factorization: the unique representation $N=p_1^{e_1}p_2^{e_2}\cdots p_k^{e_k}$ , where the $p_i$ are distinct primes and the $e_i$ are positive integers. Here $N$ is given in binary using $n$ bits, and we ask the same question as in the previous blocks: how does the work required to recover the answer grow with the input length $n$ ?

For the arithmetic problems considered so far, we could construct Boolean circuits whose size grows polynomially with $n$ : $O(n)$ , $O(n^2)$ , or $O(n^3)$ , depending on the operation. But for factorization no polynomial-size circuit family is known so far—perhaps there is one, but we do not know.

The practical difficulty is illustrated by the RSA Factoring Challenge. One of its targets, RSA-1024, was a 1,024-bit number with a US$100,000 prize. The challenge ended in 2007 with RSA-1024 still unfactored, and the remaining prizes were withdrawn. The largest RSA challenge number that has been factored is RSA-250, an 829-bit number factored in February 2020 using the general number field sieve. The computation required roughly 2,700 CPU core-years.

Trial division

The simplest approach is trial division: test possible divisors one at a time. If $N=uv$ is composite and both $u$ and $v$ were greater than $\sqrt N$ , then their product would be greater than $N$ , which is impossible. So every composite $N$ has at least one factor $u\le\sqrt N$ . We therefore only need to test prime candidates $d\le\sqrt N$ . For each candidate, compute $N\bmod d$ : a remainder of $0$ means that $d$ is a factor. Divide it out and repeat the process on the quotient until the remaining factor is prime.

N =

\sqrt{899}\approx30.0

The worst case for trial division is an input with no small factor. Since an $n$ -bit input satisfies $N<2^n$ , we have $\sqrt N<2^{n/2}$ . Trial division may therefore need to test up to $O(2^{n/2})$ candidate divisors. Each test uses the $O(n^2)$ -gate division circuit built above, giving

t(n)=\underbrace{O(2^{n/2})}_{\text{candidate divisors}}\cdot\underbrace{O(n^2)}_{\text{division test}}=\boxed{O(n^2 2^{n/2})}.

Testing only prime candidates reduces the number of tests: the number of primes below $2^{n/2}$ is about $\tfrac{2^{n/2}}{(n/2)\ln 2}$ . So restricting the search to primes saves roughly a factor of $n$ , but the exponential term $2^{n/2}$ remains. Trial division is therefore still exponential in the input length.

A congruence of squares

Trial division looks for a factor directly: try $2$ , then $3$ , then $5$ , and so on. For a hard case—a large integer with no unusually small factor—general-purpose factoring methods take a different approach. Instead of searching for a divisor, they construct a relation from which a divisor can be extracted.

That relation is a congruence of squares. Suppose we find two numbers $x$ and $y$ such that $x^2\equiv y^2\pmod N$ . In other words, $x^2$ and $y^2$ leave the same remainder when divided by $N$ . Therefore, $N\mid(x^2-y^2)=(x-y)(x+y)$ .

So $N$ divides the product of $x-y$ and $x+y$ . If $N$ is composite, its factors can be distributed between these two terms, and we can often recover one of them by computing $\gcd(x-y,N)$ .

For example, take

N =

503^2\equiv168^2\equiv218\pmod{737}

different as ordinary integers, equal after reduction

503^2-168^2=(503-168)(503+168)=335\cdot671

so the difference is a multiple of 737

\gcd(335,737)=67

and the gcd with 737 pulls one factor out of the product

737=67\cdot11

a factor, found without dividing by anything

The gcd itself is cheap: the above costs $O(n^2)$ gates. The difficult part is finding the pair $x,y$ in the first place.

The quadratic sieve

We want to find $x^2\equiv y^2\pmod N$ . The quadratic sieve approaches this indirectly. Instead of trying to find $y$ directly, it looks for many values of $x^2\bmod N$ that factor completely into small primes. These are called smooth values. Once enough smooth values have been collected, we can combine them so that their product becomes a perfect square. That gives us the second square.

The list of small primes is called the factor base, and every value that factors completely over it is kept as a relation.

The table's parity column records whether the exponent of each factor-base prime is odd or even. With factor base $\{2,3,5,7\}$ , for example, $224=2^5\cdot7$ has odd exponents for $2$ and $7$ , and even exponents for $3$ and $5$ , so its parity vector is $(1,0,0,1)$ . Parity is all we keep, because a number is a perfect square exactly when every exponent in its factorization is even — whether an exponent is $2$ or $6$ makes no difference to that question.

Parity rows add the way values multiply. Multiplying two values adds their exponents, so it adds their parity bits mod 2, one prime at a time: $(1,0,0,1)+(1,0,0,1)=(0,0,0,0)$ . A prime used an odd number of times in each of the two values is used an even number of times in their product, so the two $1$ s cancel. A set of rows adding to all zeros is therefore a set whose values multiply to a perfect square, and finding such a set is the only thing the parity column is for.

Both halves of the congruence come out of that one set. Multiplying the chosen values of $x$ gives the left-hand root; squaring it replaces each one by its residue from the table, so $x^2$ is congruent to the product of those residues — the product just shown to be a square. The right-hand root $y$ is that square's root, and nothing has to search for it: halving every exponent in the factorization writes it down directly, which is possible only because the parities were all even. Reduce $y$ mod $N$ and $x^2\equiv y^2\pmod N$ is in hand, with the gcds left to finish.

N =

\sqrt{737}\approx27.1

factor base

\{2,3,5,7\}

$x$	$x^2\bmod N$	factors into	parity

28	47	$47$	×
29	104	$2^{3}\cdot13$	×
30	163	$163$	×
31	224	$2^{5}\cdot7$	click (1,0,0,1)
32	287	$7\cdot41$	×
33	352	$2^{5}\cdot11$	×
34	419	$419$	×
35	488	$2^{3}\cdot61$	×
36	559	$559$	×
37	632	$2^{3}\cdot79$	×
38	707	$7\cdot101$	×
39	47	$47$	×
40	126	$2\cdot3^{2}\cdot7$	click (1,0,0,1)
41	207	$3^{2}\cdot23$	×
42	290	$2\cdot5\cdot29$	×
43	375	$3\cdot5^{3}$	click (0,1,1,0)
44	462	$2\cdot3\cdot7\cdot11$	×
45	551	$551$	×
46	642	$2\cdot3\cdot107$	×
47	735	$3\cdot5\cdot7^{2}$	click (0,1,1,0)
48	93	$3\cdot31$	×
49	190	$2\cdot5\cdot19$	×
50	289	$289$	×
51	390	$2\cdot3\cdot5\cdot13$	×
52	493	$493$	×
53	598	$2\cdot299$	×
54	705	$3\cdot5\cdot47$	×
55	77	$7\cdot11$	×
56	188	$2^{2}\cdot47$	×
57	301	$7\cdot43$	×
58	416	$2^{5}\cdot13$	×
59	533	$533$	×
60	652	$2^{2}\cdot163$	×
61	36	$2^{2}\cdot3^{2}$	click (0,0,0,0)

The demo keeps the numbers small enough to show the bookkeeping: candidate values, smooth relations, parity rows, and the final gcds. A real quadratic sieve uses the same logic at a scale where hand-picking rows is impossible. It locates smooth values with an actual sieve—the operation the algorithm is named for—and then uses linear algebra over $\mathbb F_2$ to find a set of relation rows whose parity sum is zero.

Note the tradeoff: a larger factor base makes smooth values easier to find, since more primes can divide them. But it also makes each parity row wider, increasing the size of the linear system and the number of relations needed before a dependency is guaranteed. The running time therefore depends on choosing a factor-base size that balances the cost of finding relations against the cost of solving the resulting linear system.

The general number field sieve

The general number field sieve (GNFS) improves on the quadratic sieve by changing how its smooth relations are constructed. In the quadratic sieve, we look for smooth values among $x^2\bmod N$ , which are roughly as large as $N$ . As $N$ grows, smooth values become increasingly rare.

GNFS takes a different route: instead of searching for smooth values of roughly size $N$ , it constructs smaller values and looks for pairs that are smooth. That makes smooth relations much easier to find, and is the key reason GNFS can handle much larger integers.

The search begins by choosing a polynomial $f$ of degree $d$ with a root $m$ modulo $N$ , so that $f(m)\equiv0\pmod N$ . Instead of testing single values of $x$ , GNFS tests coprime pairs of integers $(a,b)$ : it searches over a finite range, sweeping the integer grid within it and keeping the pairs for which $\gcd(a,b)=1$ . From each pair, it constructs two integers: $a-bm$ on the ordinary integer side, and $b^{d}f(a/b)$ on the number-field side. These are the two values we test for smoothness. If both factor completely over their respective factor bases, the pair gives a smooth relation and is kept.

Choosing $f$ may look like the difficult part, but constructing a suitable polynomial is surprisingly straightforward. Fix a degree $d$ , choose $m=\lfloor N^{1/d}\rfloor$ , and write $N$ in base $m$ . Use those base- $m$ digits as the coefficients of $f$ . Then, by construction, $f(m)=N$ , so in particular $f(m)\equiv0\pmod N$ . That is exactly the property GNFS needs.

N =

degree3

factor base

\{2,3,5,7\}

m=\lfloor \sqrt[3]{737}\rfloor=9

The only choices are the degree and the factor base. The degree determines m, and m determines the coefficients.

737=\textcolor{#4338ca}{1}\cdot9^{3}+\textcolor{#0369a1}{8}

f(x)=\textcolor{#4338ca}{1}\cdot x^{3}+\textcolor{#0369a1}{8}

Polynomial form of the line above, with x in place of m.

f(9)=737\equiv0\pmod{737}

This is why we constructed f this way: m = 9 is a root of f modulo N, which links the two sides of the GNFS construction.

shares a factor, repeats a smaller pairnot yet reachedtested, a side left a prime outside the baseboth values factor over the base: a relation

One thing to notice is that GNFS is not necessarily faster than the quadratic sieve on small numbers. It does more work per relation, but that extra cost is offset by its better asymptotic scaling as $N$ grows. Only for sufficiently large $N$ does GNFS become the faster method.

The cost of GNFS

Almost all of the work in GNFS goes into two jobs. The first is collecting relations: sweep the grid of candidate pairs $(a,b)$ , test the two values each pair produces, and keep the pairs where both factor completely over the factor bases. The second is the linear algebra: take the relations that survived and find a set of parity rows summing to zero, which is what turns a pile of relations into a congruence of squares. Neither job can be skipped — the first produces the raw material and the second extracts an answer from it — so the running time is the sum of the two.

Both jobs are governed by one number: the smoothness bound $B$ , the largest prime allowed in the factor bases. $B$ is the knob we can turn, and it pulls the two jobs in opposite directions. Turn it up and each value has more primes available to factor into, so relations become easier to find; but the factor bases grow with it, and every extra prime is another column in the matrix the second job has to solve.

How many primes is that? There are about $B/\ln B$ primes below $B$ . The logarithm moves that count by far less than the choice of $B$ itself does, so from here on we drop it and speak of about $B$ factor-base primes.

Each surviving relation becomes one row of the relation matrix, recording which factor-base primes occur an odd number of times, and each factor-base prime is one column. A set of rows summing to zero is guaranteed once there are more rows than columns, so with about $B$ columns GNFS needs about $B$ relations, plus a small surplus so that the dependency it finds is a usable one. That is where the first job's target comes from: not as many relations as possible, but about $B$ of them.

What one relation costs depends on how often a candidate turns out to be smooth. Write $V$ for the size of the values being tested and set $u=\frac{\ln V}{\ln B}$ . This $u$ measures the tested value against the smoothness bound: it is roughly how many factors of size $B$ it takes to build a number of size $V$ . When $u$ is small the value is barely larger than the primes allowed to divide it, and smoothness is common. When $u$ is large the value has to be assembled out of many small primes at once, which is rare.

For a random integer of size $V$ , the Dickman function puts the chance of being $B$ -smooth at about $u^{-u}$ . Turn that probability into work: one success in every $u^{u}$ candidates means about $u^{u}$ candidates tested per relation kept, and about $B\,u^{u}$ candidates tested to collect the $B$ relations we need. This step is heuristic. The values GNFS tests come out of a polynomial and are not random integers, but they behave closely enough to random ones for the estimate to hold up in practice.

The second job works on what the first produced: about $B$ relations, so about $B$ rows, against about $B$ factor-base primes, so about $B$ columns — a matrix roughly $B\times B$ . It is a sparse one, since a single relation is divisible by only a handful of factor-base primes and almost every entry in its row is zero. Sparse methods exploit that and cost roughly $B^{2}$ , instead of the $B^{3}$ that ordinary elimination would spend on a dense matrix of that size. Real implementations are more delicate; $B^{2}$ is the simplified model we carry through the argument. The two costs together are

t(B)\approx\underbrace{B\,u^{u}}_{\text{finding the relations}}+\underbrace{B^{2}}_{\text{processing them}},\qquad u=\frac{\ln V}{\ln B}.

Everything that follows is an argument about how to choose $B$ in that one equation. Push $B$ down and $B^{2}$ becomes negligible, but $u$ grows and $u^{u}$ grows much faster still: smooth values turn rare and the sieve spends a long time looking for them. Push $B$ up and relations arrive quickly, but the matrix that has to absorb them grows quadratically.

smoothness bound B	finding relations	linear algebra
small	expensive — smooth values are rare	cheap — few columns to solve
large	cheap — smooth values are common	expensive — many columns to solve
balanced	the two costs meet, and the total is as small as it gets

Neither extreme is where the total is smallest. The best $B$ is the one where the two terms are of comparable size, because on either side of that point every saving in one job is paid for by the other.

Locating that point is awkward with the notation we have, because neither term is polynomial in the input length nor exponential in it. Costs in that gap are usually written in L-notation, as $L_N[\alpha,c]$ , and only two things about it matter here: the exponent $\alpha$ says where in the gap a cost falls, running from polynomial at $\alpha=0$ to exponential at $\alpha=1$ , and the constant $c$ refines the estimate within a scale.

Now measure both costs on that scale. Suppose the values that must be smooth have size $V=L_N[\alpha,\cdot]$ , and choose a factor base $B=L_N[\beta,\cdot]$ . An $L$ -value is an exponential, so taking logarithms leaves $\ln V$ and $\ln B$ as products of powers of $\ln N$ and $\ln\ln N$ , and in their ratio the exponents subtract:

u=\frac{\ln V}{\ln B}\approx c\left(\frac{\ln N}{\ln\ln N}\right)^{\alpha-\beta}.

That subtraction drives the rest. Since $\ln u\approx(\alpha-\beta)\ln\ln N$ , the search cost $u^{u}=e^{u\ln u}$ has an exponent proportional to $(\ln N)^{\alpha-\beta}(\ln\ln N)^{1-(\alpha-\beta)}$ , which is exactly the shape of $L_N[\alpha-\beta,\cdot]$ . The leading factor $B$ contributes only $L_N[\beta,\cdot]$ , no larger than the search term at the balance point we are heading for, so it leaves the scale alone. On the other side, squaring $B$ doubles a constant but does not touch the exponent, so the linear algebra stays at $L_N[\beta,\cdot]$ . The mapping worth remembering is that the size of the numbers being smoothed contributes $\alpha$ , the size of the factor base contributes $\beta$ , and the search pays the difference between them:

t\approx\underbrace{L_N[\alpha-\beta,\cdot]}_{\text{finding the relations}}+\underbrace{L_N[\beta,\cdot]}_{\text{processing them}}.

A sum of two $L$ -terms is set by the larger exponent; the smaller one is swallowed by the slack the notation already carries. So if $\alpha-\beta>\beta$ , the cost is relation collection and the matrix was free; if $\beta>\alpha-\beta$ , the cost is linear algebra and the relations were free. From either side, moving $\beta$ toward the other case lowers the total, until the two exponents meet:

\alpha-\beta=\beta\quad\Longrightarrow\quad\beta=\frac{\alpha}{2}.

Once $\alpha$ is known, the best factor base is the one that splits that exponent evenly between the two jobs. Nothing in the argument is specific to GNFS: it holds for any method that collects smooth relations and then solves for a dependency among them.

Take the quadratic sieve first. It smooths values of $x^{2}\bmod N$ , which are about as large as $N$ itself, and $N=L_N[1,1]$ , so $\alpha=1$ . Balancing gives $\beta=\frac12$ , and a running time of $L_N[\frac12,1]$ .

GNFS changes one thing about that calculation: the values it tests are not of size $N$ . With the degree chosen as $d\approx\sqrt[3]{\frac{3\ln N}{\ln\ln N}}$ , the pair of values $a-bm$ and $b^{d}f(a/b)$ that must both be smooth are heuristically of size $L_N[\frac23,\cdot]$ , so $\alpha=\frac23$ . The same balancing gives $\beta=\frac13$ :

\underbrace{\alpha=1\;\Rightarrow\;\beta=\tfrac12\;\Rightarrow\;L_N[\tfrac12,\cdot]}_{\text{quadratic sieve}}\qquad\underbrace{\alpha=\tfrac23\;\Rightarrow\;\beta=\tfrac13\;\Rightarrow\;L_N[\tfrac13,\cdot]}_{\text{number field sieve}}

The distance between $\frac12$ and $\frac13$ is the whole of the improvement, and it is worth being exact about where it comes from. GNFS does not test smoothness any faster than the quadratic sieve does. It wins because its polynomial construction hands it much smaller numbers to make smooth. That lowers $\alpha$ , and every exponent in the analysis is downstream of $\alpha$ .

What the balancing argument gives is the shape of the complexity: which power of $\ln N$ appears, and why it is $\frac13$ rather than $\frac12$ . The constant in front takes a longer optimization, one that tunes the degree $d$ and the smoothness bound $B$ together rather than one after the other, since $d$ is what sets the size of the values and therefore the rate at which they are smooth. It selects

B=L_N\!\left[\tfrac13,\sqrt[3]{\tfrac89}\right]\quad\Longrightarrow\quad\underbrace{B^{2}}_{\text{linear algebra}}=L_N\!\left[\tfrac13,2\sqrt[3]{\tfrac89}\right]=L_N\!\left[\tfrac13,\sqrt[3]{\tfrac{64}{9}}\right].

Squaring $B$ doubles its constant, and $2\sqrt[3]{8/9}$ is $\sqrt[3]{64/9}$ : the familiar constant arrives out of the linear algebra. Relation collection is tuned to cost the same — the balancing argument again, this time with the constants kept — so the total carries that constant too:

t(N)=\underbrace{\exp\!\left(\left(\sqrt[3]{\tfrac{64}{9}}+o(1)\right)(\ln N)^{\tfrac13}(\ln\ln N)^{\tfrac23}\right)}_{\text{heuristic expected time},\ \sqrt[3]{\tfrac{64}{9}}\approx1.923}.

In terms of bits, with $n=\log_2 N$ , we have $\ln N=n\ln2$ and $\ln\ln N=\Theta(\log n)$ , so the exponent is $\Theta(n^{1/3}(\log n)^{2/3})$ and

t(n)=\boxed{2^{O(n^{\frac13}(\log n)^{\frac23})}}.

Read that exponent both ways. It grows with $n$ , so the cost is not polynomial in the input length. But it grows like $n^{1/3}$ rather than like $n$ , which leaves it far below the $2^{n/2}$ of trial division. Between the two is what subexponential means, and it is where the best factoring algorithms known today live.

So the fastest known way to factor large integers today is GNFS, with a cost of $2^{O(n^{1/3}(\log n)^{2/3})}$ . There might be a faster classical algorithm: no polynomial-time method is known, but factoring has never been shown to be NP-complete either, so as of today this has been neither proved nor disproved. But a faster quantum algorithm is already known—we come to it later.

Classical circuits as quantum circuits

Classical and quantum computation have been treated separately so far. In practice, quantum algorithms routinely need ordinary classical computation inside a larger quantum circuit: adding two integers, evaluating a function, checking a condition. So can a classical algorithm be run on a quantum computer?

Yes. Any Boolean circuit of size $t$ can be implemented with $O(t)$ quantum gates.

The purpose is compatibility rather than speed. A classical computation run this way is no faster than before, but it now runs coherently: it behaves correctly when its input is part of a superposition, and it leaves its output in a register the rest of the quantum algorithm can use.

Toffoli gates

Classical gates such as AND and OR destroy information. AND takes two input bits and returns one, so its four possible inputs collapse onto two possible outputs: a $0$ at the output could have come from any of $00$ , $01$ or $10$ , and there is no way to tell which. That is the one obstacle here, because every quantum gate is unitary and therefore reversible. A Boolean circuit has to be rebuilt out of reversible gates before a quantum computer can run it, and the gate that does that work is the Toffoli gate.

Recall that a is a controlled-controlled-NOT: it flips its target qubit only when both control qubits are $1$ .

\mathrm{Toffoli}\,\lvert a\rangle\lvert b\rangle\lvert c\rangle=\lvert a\rangle\lvert b\rangle\lvert c\oplus ab\rangle

in				out
$a$	$b$	$c$	$ab$	$a$	$b$	$c \oplus ab$
0	0	0	0	0	0	0
0	0	1	0	0	0	1
0	1	0	0	0	1	0
0	1	1	0	0	1	1
1	0	0	0	1	0	0
1	0	1	0	1	0	1
1	1	0	1	1	1	1
1	1	1	1	1	1	0

\lvert a\rangle

\lvert b\rangle

\lvert c\rangle

\lvert a\rangle

\lvert b\rangle

\lvert c\oplus ab\rangle

Toffoli from elementary gates

The has no three-qubit gate, so one Toffoli gate has to be built from several elementary gates. The circuit below uses 15 elementary gates: two Hadamards, six CNOTs, and seven $T$ or $T^\dagger$ gates. The decomposition is exact — these 15 gates reproduce the Toffoli operation exactly, not approximately.

This illustrates the main cost of translating classical computation into quantum computation. A single classical operation such as AND can correspond to a whole collection of elementary quantum gates. But the number of gates needed is a fixed constant: one Toffoli costs 15 elementary gates, or simply $O(1)$ . So a classical circuit with $t$ gates can still be implemented with $O(t)$ elementary quantum gates. The translation introduces overhead, but only a constant-factor overhead.

\lvert a\rangle

\lvert b\rangle

\lvert c\rangle

\lvert a\rangle

\lvert b\rangle

\lvert c\oplus ab\rangle

Simulating Boolean gates

Now that we can build a Toffoli gate from elementary quantum gates, we can use it to reproduce . The key idea is simple: because quantum gates must be reversible, a Boolean operation is computed into an additional qubit rather than replacing its inputs. With the target initialized to $\lvert 0\rangle$ , the quantum circuit can therefore reproduce the same Boolean function on computational-basis states.

NOT

\lvert a\rangle

\lvert \neg a\rangle

Nothing to do: NOT is already reversible, and the Pauli-X gate implements exactly the same operation on the two basis states.

FANOUT

\lvert a\rangle

\lvert 0\rangle

\lvert a\rangle

\lvert a\rangle

A CNOT with a fresh qubit as its target implements FANOUT on basis states: it copies the input bit to the fresh qubit. This does not violate the no-cloning theorem, because it does not copy an arbitrary quantum state.

AND

\lvert a\rangle

\lvert b\rangle

\lvert 0\rangle

\lvert a\rangle

\lvert b\rangle

\lvert a\wedge b\rangle

A Toffoli gate with a fresh target qubit computes $ab$ into it: starting from $0$ , the target ends as $ab$ , which is exactly $a \land b$ for bits $a, b \in \lbrace 0, 1 \rbrace$ .

OR

\lvert a\rangle

\lvert b\rangle

\lvert 0\rangle

\lvert \neg a\rangle

\lvert \neg b\rangle

\lvert a\vee b\rangle

By De Morgan’s law an OR is an AND with everything flipped: flip both inputs, AND them with a Toffoli, then flip the result. The two inputs are left flipped on the way out.

So every Boolean gate can be replaced by $O(1)$ quantum gates, using at most one workspace qubit initialized to $\lvert 0\rangle$ . A Boolean circuit with $t$ gates therefore becomes a quantum circuit with $O(t)$ gates and $O(t)$ qubits.

But there is a catch: the quantum version is reversible, so it cannot simply discard the inputs or intermediate values the way a classical circuit does. Instead, they remain in the circuit, leaving behind workspace that must eventually be cleaned up.

Simulating Boolean circuits

Now take a whole circuit rather than one gate. Suppose $C$ is a Boolean circuit of size $t$ computing a function $f : \Sigma^n \to \Sigma^m$ :

x

f(x)

Replace each Boolean gate by its quantum simulation, adding a fresh $\lvert 0\rangle$ qubit whenever needed. The resulting quantum circuit $R$ uses $O(t)$ gates and acts on $n + k$ qubits, where the workspace $k = O(t)$ . For a basis-state input $x$ , the desired $m$ -bit output appears in the first $m$ qubits, but the remaining qubits contain leftover intermediate values:

R\bigl(\lvert x\rangle\lvert 0^k\rangle\bigr)=\lvert f(x)\rangle\lvert g(x)\rangle.

Here $g(x)$ is the garbage produced by making the computation reversible.

\lvert x\rangle

\lvert 0^k\rangle

\lvert f(x)\rangle

\lvert g(x)\rangle

Clearing the garbage

The garbage is more than wasted space: if it remains entangled with the result, it can interfere with the quantum algorithm and spoil the interference patterns we rely on. The simple solution is to uncompute it. Because $R$ is made entirely of reversible quantum gates, we can run it backwards using its inverse $R^\dagger$ , at the same $O(t)$ cost. This lets us compute the result, use it where needed, and then erase the unwanted intermediate values without erasing the result itself.

The key is that $R$ is deterministic: once we have computed $f(x)$ , we can copy that classical result before undoing the computation. We therefore add a fresh $m$ -qubit register $\lvert y\rangle$ , initially $\lvert 0^m\rangle$ , and use $m$ CNOTs to copy the answer into it between $R$ and $R^\dagger$ . This is the same FANOUT trick as before: the result wires hold basis-state bits, so copying them does not violate the no-cloning theorem. Then $R^\dagger$ erases the workspace while leaving the copied result untouched.

\lvert x\rangle

\lvert 0^k\rangle

\lvert y\rangle

\lvert x\rangle

\lvert 0^k\rangle

\lvert y\oplus f(x)\rangle

Constructing the query gate

Combine the three circuit segments — the computation of $f(x)$ , the XOR of $f(x)$ into the target register, and the uncomputation of the workspace — and call the resulting circuit $Q$ . Its cost is

O(t)+m+O(t)=O(t),

since the computation and uncomputation each cost $O(t)$ , while the $m$ -gate target update is absorbed into $O(t)$ .

More importantly, the workspace register is returned to $\lvert 0^k\rangle$ after the uncomputation. Thus the complete circuit acts as

\lvert x\rangle\lvert 0^k\rangle\lvert y\rangle\;\longmapsto\;\lvert x\rangle\lvert 0^k\rangle\lvert y\oplus f(x)\rangle.

\lvert x\rangle

\lvert 0^k\rangle

\lvert y\rangle

\lvert x\rangle

\lvert 0^k\rangle

\lvert y\oplus f(x)\rangle

Because the workspace starts and ends in the fixed state $\lvert 0^k\rangle$ , it can be ignored when describing the action of the circuit on the input and target registers. The remaining transformation is exactly the quantum query gate $U_f$ for the function computed by the original Boolean circuit.

In other words, the query-model oracle does not have to be treated as an abstract black box: given a classical circuit for $f$ , we can construct its quantum query gate using $O(t)$ gates, only a constant-factor overhead compared with the original circuit.

Phase estimation and factoring

A quantum state can sometimes pick up a phase when a unitary operation is applied to it. That phase is , but it contains useful information about the operation. Phase estimation is a procedure for extracting that hidden phase.

The spectral theorem

A useful way to understand a matrix is to look for directions that it does not mix with other directions. These are its eigenvectors: if $M\lvert\psi\rangle = \lambda\lvert\psi\rangle$ , then applying $M$ to $\lvert\psi\rangle$ does not turn $\lvert\psi\rangle$ into a different direction, it only multiplies it by the number $\lambda$ .

\lambda=3

\lambda=2

knocked off its span

\begin{pmatrix}3&1\\0&2\end{pmatrix}

Apply the matrix100%

Try a direction58°

Eigenvector $(1,0)$ with eigenvalue $\lambda=3$ . It keeps its own line.
Eigenvector $(-1,1)$ with eigenvalue $\lambda=2$ . It keeps its own line.
Any other direction is not an eigenvector: drag the slider and it leaves its dashed line.

For a general matrix, there may not be enough eigenvectors to form a basis. And even when there are enough, they need not be perpendicular to one another. Either way, they are not necessarily convenient as coordinates for the whole space.

The spectral theorem identifies a class of matrices whose eigenvectors can be chosen to form an . This gives us a particularly useful coordinate system: the matrix acts on each direction independently, multiplying it by that direction’s own eigenvalue.

Eigenvalue λ₁1.45

Eigenvalue λ₂0.55

$\lvert\psi_1\rangle$ and $\lvert\psi_2\rangle$ stay on their own lines. Their eigenvalues only change their lengths.
Any other vector has components along both eigendirections. Since those components are stretched by different amounts, the vector changes direction as well as length.
The dashed circle represents all unit vectors. Under $M$ , these vectors map to the solid ellipse, whose axes lie along the two eigendirections.

The eigenvalues here are real, so they stretch or shrink the eigenvector directions. A unitary matrix preserves lengths, so its eigenvalues have magnitude 1: in the complex plane, they rotate each direction by a phase instead of changing its length. That phase is what this chapter is after — and it is the one part a real two-dimensional picture cannot show.

The spectral decomposition

A matrix $M$ is normal when it commutes with its :

MM^\dagger=M^\dagger M.

The spectral theorem says that every normal $N \times N$ matrix has an orthonormal basis of eigenvectors $\{\lvert\psi_1\rangle, \ldots, \lvert\psi_N\rangle\}$ , together with phases , with corresponding complex eigenvalues $\lambda_1, \ldots, \lambda_N$ , such that

M=\sum_{k=1}^{N}\lambda_k\lvert\psi_k\rangle\langle\psi_k\rvert.

Each basis vector satisfies

M\lvert\psi_k\rangle=\lambda_k\lvert\psi_k\rangle.

Writing a matrix in this form is called its spectral decomposition. It says that the entire matrix is determined by an orthonormal set of directions and one complex number for each direction, specifying what $M$ does along it.

Special case: unitary matrices

A unitary matrix satisfies $U^\dagger U = I = UU^\dagger$ , so it is normal and the spectral theorem applies. What unitarity adds is a constraint on the eigenvalues. A unitary operation preserves norms, so if $U\lvert\psi_k\rangle = \lambda_k\lvert\psi_k\rangle$ , then the output must have the same length as the input. This forces $|\lambda_k| = 1$ .

A complex number of modulus one does not change a vector’s length. It only contributes a phase: a rotation in the complex plane. Every such number can be written as $e^{2\pi i\theta}$ for exactly one $\theta \in [0, 1)$ .

So suppose $U$ is an $N \times N$ unitary matrix. There exists an orthonormal basis $\{\lvert\psi_1\rangle, \ldots, \lvert\psi_N\rangle\}$ , together with phases

\lambda_1=e^{2\pi i\theta_1},\ldots,\lambda_N=e^{2\pi i\theta_N},

such that

U=\sum_{k=1}^{N}\lambda_k\lvert\psi_k\rangle\langle\psi_k\rvert.

Each vector $\lvert\psi_k\rangle$ is an eigenvector of $U$ with eigenvalue $\lambda_k$ :

U\lvert\psi_k\rangle=\lambda_k\lvert\psi_k\rangle=e^{2\pi i\theta_k}\lvert\psi_k\rangle.

For a unitary matrix, the spectral decomposition therefore reduces the action of the entire matrix to a collection of phases. Each eigenvector defines an independent direction, and along that direction the matrix does nothing more than multiply by $e^{2\pi i\theta_k}$ . The magnitude is fixed at one, so the only information left in each eigenvalue is its phase $\theta_k$ .

The phase estimation problem

In the phase estimation problem, we are given two things:

A description of a quantum circuit on $n$ qubits implementing a unitary operation $U$ .
An $n$ -qubit quantum state $\lvert\psi\rangle$ .

We are promised that $\lvert\psi\rangle$ is an eigenvector of $U$ . By the spectral theorem, its eigenvalue has the form $e^{2\pi i\theta}$ for a unique $\theta \in [0, 1)$ . The goal is to approximate this phase $\theta$ , where

U\lvert\psi\rangle=e^{2\pi i\theta}\lvert\psi\rangle.

The important point is that the eigenvector is given as a quantum state, not as a classical description. We cannot simply read $\theta$ from the circuit, nor can we measure $\lvert\psi\rangle$ to reveal which eigenvector it is. The phase must be extracted by interacting with the state through controlled applications of $U$ .

The phase estimate

The phase $\theta$ is a real number, but a quantum measurement can return only finitely many classical bits. We therefore choose a precision $m$ : the algorithm will return $m$ bits that specify one of $2^m$ possible approximations to $\theta$ .

For example, with $m = 3$ , the possible answers are the eight equally spaced points $0, \tfrac{1}{8}, \tfrac{2}{8}, \ldots, \tfrac{7}{8}$ .

If the true phase is $\theta = 0.310$ , the closest grid point is $\tfrac{2}{8} = 0.250$ , so the three-bit answer is $010$ , representing the approximation $0.250$ . In general, the answer has the form $\theta \approx \tfrac{y}{2^m}$ for $y \in \{0, 1, \ldots, 2^m - 1\}$ , and the binary representation of $y$ is the $m$ -bit output.

There is one important detail: these points lie on a circle, not on a line. The phases $0$ and $1$ represent the same point, because $e^{2\pi i\cdot 0} = e^{2\pi i\cdot 1} = 1$ . So the approximation is understood modulo one. A phase close to $1$ can therefore be approximated by a value close to $0$ when the shortest distance around the circle crosses the boundary.

1

i

-1

-i

2\pi\theta

Phase θ0.310

Precision m3 bits

Angle

2\pi\theta

111.6°

Grid points

2^{3} = 8

Nearest estimate

\tfrac{2}{8} = 0.250

Phase error0.060

Angular error21.6°

Phase kickback: making the phase observable

Applying $U$ to $\lvert\psi\rangle$ multiplies the state by $e^{2\pi i\theta}$ and changes nothing else, so measuring the resulting state cannot reveal $\theta$ . Phase kickback turns this invisible phase into an observable relative phase: instead of applying $U$ directly, we apply it conditionally on an extra qubit, transferring the phase $e^{2\pi i\theta}$ to the control qubit.

Creating an observable phase

A controlled- $U$ uses an extra qubit to decide whether $U$ is applied: one branch does nothing, while the other applies $U$ to the register. If the control is in a definite state $\lvert 0\rangle$ or $\lvert 1\rangle$ this does not help, because only one branch ever exists and the phase remains global.

The key is to put the control into a superposition. Both branches are then present at once: one where $U$ is applied and one where it is not. Since $\lvert\psi\rangle$ is an eigenvector, it picks up $e^{2\pi i\theta}$ and nothing else, and only in the branch where $U$ acts, so the phase becomes a relative phase between the two branches. A second Hadamard makes those branches interfere, converting the relative phase into measurement probabilities on the control qubit. The register itself is never measured. Everything we learn about $\theta$ comes from the control.

\lvert 0\rangle

\lvert\psi\rangle

Step through the circuit

1Prepare the register in $\lvert\psi\rangle$ and the control qubit in $\lvert 0\rangle$ .
2Apply a Hadamard to the control qubit.
3Apply controlled- $U$ .
4Apply a Hadamard to the control qubit again.
5Measure the control qubit. The register is never measured.

p_0

p_1

\theta

Phase θ0.310

p_0=\cos^2(\pi\theta)

0.316

p_1=\sin^2(\pi\theta)

0.684

What can we learn from one measurement?

The measurement does tell us something about $\theta$ : the probabilities change as the phase changes. For example, phases near $0$ tend to produce $\lvert 0\rangle$ , while phases near $\tfrac{1}{2}$ tend to produce $\lvert 1\rangle$ .

But this is not enough to determine the phase. The same measurement statistics can arise from different phases: $\theta$ and $1-\theta$ are indistinguishable. The probabilities also change very little near $0$ and $\tfrac{1}{2}$ , so this measurement gives poor precision there.

So one controlled- $U$ lets us learn something about the phase, but not enough to identify it. To estimate $\theta$ accurately, we need a way to make the measurement more sensitive to different parts of the phase.

Running controlled-U twice

The first experiment was not sensitive enough to distinguish all phases. A natural idea is therefore to apply $U$ more than once. If one application gives the phase $\theta$ , then two applications give twice the phase:

U^{2}\lvert\psi\rangle=e^{2\pi i(2\theta)}\lvert\psi\rangle.

So if we put two controlled- $U$ gates on the same control qubit, we get the same experiment as before, but with the phase doubled. This changes how the measurement probabilities respond to $\theta$ , giving us information that the single- $U$ experiment could not provide.

\lvert 0\rangle

\lvert\psi\rangle

p_0

p_1

\theta

Phase θ0.310

p_0=\cos^2(2\pi\theta)

0.136

p_1=\sin^2(2\pi\theta)

0.864

More sensitivity, more ambiguity

Doubling the phase makes the probabilities change twice as quickly as $\theta$ changes. Phases that were hard to distinguish before can now produce noticeably different probabilities, so the measurement becomes more sensitive to the phase.

But the doubled phase is still read modulo one. In particular, $2\theta$ and $2\theta+1$ represent the same phase, so $\theta$ and $\theta+\tfrac{1}{2}$ produce identical statistics. The original reflection symmetry, $\theta\leftrightarrow 1-\theta$ , remains as well. We have therefore gained sensitivity, but also introduced more possible phases that give the same measurement statistics.

This is the central tension in phase estimation: using more applications of $U$ gives finer information about the phase, but also creates more ambiguity about which phase produced it. The solution will be to use several powers of $U$ together, so that the ambiguities from one measurement are resolved by the others.

What do we gain by using both experiments?

We now have two experiments with complementary strengths. One application of $U$ covers the whole range of $\theta$ , but resolves it coarsely. Two applications make the probabilities change twice as quickly, but introduce additional ambiguities. It is natural to ask whether the information from the two experiments can be put together to get a better estimate.

The register itself is not the obstacle. Because $\lvert\psi\rangle$ is an eigenvector, each experiment leaves it unchanged and separates it from the control qubit. Measuring the control therefore does not disturb $\lvert\psi\rangle$ , so the experiment can be repeated with the same state.

The difficulty is that measurement throws away most of the information available before measurement. Just before measurement, the control qubit has amplitudes whose relative phase depends on $\theta$ . Measurement turns those amplitudes into a single classical bit, $0$ or $1$ . To learn the corresponding probabilities accurately, we need many repetitions.

So if we run the $U$ and $U^{2}$ experiments separately, we end up with two collections of classical measurement results. We can estimate two probabilities and try to use them together, but each estimate is noisy and each experiment has its own ambiguities.

This raises the next question: can we arrange the experiments so that their phase information is combined before measurement, rather than after?

Two control qubits

Rather than running the two experiments one after another, we can give each of them its own control qubit and run them in a single circuit. The upper control drives one application of $U$ , and the lower control drives two.

one U

two U

\textcolor{#6d28d9}{\lvert 0\rangle}

\textcolor{#b45309}{\lvert 0\rangle}

\lvert\psi\rangle

a_0

a_1

Step through the circuit

1Prepare the register in $\lvert\psi\rangle$ and both control qubits in $\lvert 0\rangle$ .
2Apply a Hadamard to each control qubit.
3Apply controlled- $U$ once, controlled by $a_0$ .
4Apply controlled- $U$ twice, both controlled by $a_1$ .

Can we distinguish the phases?

The two controls now carry the control factor of $\lvert\pi_3\rangle$ : $\frac{1}{2}\sum\limits_{x=0}^{3}e^{2\pi ix\theta}\lvert x\rangle$ .

In general, $\theta$ need not be restricted to a few special values. But to make the problem concrete, let us first pretend that we are promised $\theta=\frac{y}{4}$ for some $y\in\{0,1,2,3\}$ . This gives us a smaller problem: can we work out which of these four possible values of $\theta$ we have?

Each possibility gives a different two-qubit state: $\lvert\phi_{y}\rangle=\frac{1}{2}\sum\limits_{x=0}^{3}e^{2\pi i\frac{xy}{4}}\lvert x\rangle$ . Explicitly,

\lvert\phi_{0}\rangle=\frac{1}{2}\lvert 0\rangle+\frac{1}{2}\lvert 1\rangle+\frac{1}{2}\lvert 2\rangle+\frac{1}{2}\lvert 3\rangle

\lvert\phi_{1}\rangle=\frac{1}{2}\lvert 0\rangle+\frac{i}{2}\lvert 1\rangle-\frac{1}{2}\lvert 2\rangle-\frac{i}{2}\lvert 3\rangle

\lvert\phi_{2}\rangle=\frac{1}{2}\lvert 0\rangle-\frac{1}{2}\lvert 1\rangle+\frac{1}{2}\lvert 2\rangle-\frac{1}{2}\lvert 3\rangle

\lvert\phi_{3}\rangle=\frac{1}{2}\lvert 0\rangle-\frac{i}{2}\lvert 1\rangle-\frac{1}{2}\lvert 2\rangle+\frac{i}{2}\lvert 3\rangle

Our goal is now clear: determine which of the four states $\lvert\phi_{0}\rangle,\ldots,\lvert\phi_{3}\rangle$ the controls are in. If we can identify the state, we immediately know $y$ , and therefore the original phase $\theta=\frac{y}{4}$ . And conveniently, notice that all four states are , so they can be distinguished perfectly by a : $\{\lvert\phi_{0}\rangle\langle\phi_{0}\rvert,\ \lvert\phi_{1}\rangle\langle\phi_{1}\rvert,\ \lvert\phi_{2}\rangle\langle\phi_{2}\rvert,\ \lvert\phi_{3}\rangle\langle\phi_{3}\rvert\}$ .

Knowing that the four states can be distinguished does not yet give us a way to read out which one we have. We need to change the basis back to the computational basis. Let $V$ be the unitary whose columns are $\lvert\phi_{0}\rangle$ , $\lvert\phi_{1}\rangle$ , $\lvert\phi_{2}\rangle$ , and $\lvert\phi_{3}\rangle$ . By construction, $V\lvert y\rangle=\lvert\phi_{y}\rangle$ for every $y\in\{0,1,2,3\}$ . In this case,

V=\frac{1}{2}\begin{pmatrix}1&1&1&1\\1&i&-1&-i\\1&-1&1&-1\\1&-i&-1&i\end{pmatrix}

This matrix is the in four dimensions. As a quantum operation, it is called the quantum Fourier transform, or $\mathrm{QFT}_4$ .

Now apply the inverse transformation. It takes each of our four states back to the corresponding computational-basis state: $V^\dagger\lvert\phi_{y}\rangle=\lvert y\rangle$ .

So instead of building a special measurement for the four $\lvert\phi_{y}\rangle$ states, we can simply apply $V^\dagger$ and then measure the qubits in the computational basis. The measurement gives us $y$ , and therefore the phase $\theta=\frac{y}{4}$ .

\textcolor{#6d28d9}{\lvert 0\rangle}

\textcolor{#b45309}{\lvert 0\rangle}

\lvert\psi\rangle

At the four promised phases, each curve reaches exactly $1$ at its own quarter and $0$ at the others, so the measurement is certain. Between those phases, the peaks spread out: the outcome is no longer certain, but the nearest quarter remains the most likely.

y=0

y=1

y=2

y=3

\theta

Phase θ0.310

\Pr[\,y=0\,]

0.043

\Pr[\,y=1\,]

0.834

\Pr[\,y=2\,]

0.093

\Pr[\,y=3\,]

0.030

The quantum Fourier transform

The key idea is to build states whose amplitudes all have the same magnitude but differ in phase.

For example, suppose there are four computational-basis states, labelled $x=0,1,2,3$ . The phase can stay constant, or advance by a quarter, half, or three quarters of a full turn each time $x$ increases.

Complex phase

$x$ $y$ rows are the frequency y, columns the position x	0	1	2	3
0
1
2
3

Frequency

y

1

Position

x

1

e^{2\pi i\cdot\frac{(1)(1)}{4}}=i

As $x$ increases, the phase can advance at different rates. Each rate produces a different pattern, corresponding to a different discrete frequency.

The quantum Fourier transform is the change of basis from the computational-basis states to these frequency patterns. It is the quantum counterpart of the , with the normalization factor $\tfrac{1}{\sqrt{N}}$ that makes the frequency patterns orthonormal and the transformation unitary.

For a positive integer $N$ , the quantum Fourier transform $\mathrm{QFT}_N$ is the $N\times N$ unitary defined by

\mathrm{QFT}_N=\frac{1}{\sqrt{N}}\sum_{x=0}^{N-1}\sum_{y=0}^{N-1}e^{2\pi i\frac{xy}{N}}\lvert x\rangle\langle y\rvert

Equivalently, its action on a computational-basis state is

\mathrm{QFT}_N\lvert y\rangle=\frac{1}{\sqrt{N}}\sum_{x=0}^{N-1}e^{2\pi i\frac{xy}{N}}\lvert x\rangle

The second form is often easier to read. Start with the basis state $\lvert y\rangle$ . The transform produces a superposition of all the output basis states $\lvert x\rangle$ . Every output basis state has the same amplitude magnitude, $\tfrac{1}{\sqrt{N}}$ . What changes with $x$ is the phase $e^{2\pi ixy/N}$ .

The phase factor is determined by the product $xy$ . For a fixed input $y$ , increasing $x$ makes the phase advance in equal steps, and the value of $y$ determines how large those steps are. For example, $y=0$ gives no phase change. $y=1$ advances by one step around the circle — a quarter-turn in the four-state example above. $y=2$ advances twice as far at each step, and so on. Each input basis state $\lvert y\rangle$ is therefore mapped to a different phase pattern.

For an $n$ -qubit register, $N=2^{n}$ , because that is the number of computational-basis states available. The definition itself does not require $N$ to be a power of two — that restriction comes from applying the transform to a register of whole qubits.

Examples at different sizes

Since $e^{2\pi i\cdot N/N}=1$ , only $xy \bmod N$ matters. So, no matter how large $N$ becomes, the entries use only $N$ distinct phases, $e^{2\pi ik/N}$ for $k=0,\ldots,N-1$ . Let’s look at a few examples, starting with the smallest transform.

Size

N

1

There is one basis state and one phase: $1$ .

\mathrm{QFT}_{1}=\begin{pmatrix}1\end{pmatrix}

Shorthand notation for phase

The same phases keep appearing in every transform. Instead of writing the exponential each time, name the first phase: $\omega_N=e^{2\pi i/N}$ . Then every phase is a power of it: $\omega_N^{k}=e^{2\pi ik/N},\qquad\omega_N^{N}=1$ .

On the unit circle, $\omega_N$ is one step of $2\pi/N$ . Its powers take successive steps around the circle: $1,\,\omega_N,\,\omega_N^{2},\,\ldots,\,\omega_N^{N}=1$ . The $N$ distinct powers are the .

A column of the transform follows the same walk. Fixing $y$ , its exponents are $0,\,y,\,2y,\,3y,\ldots$ , so each row advances by $y$ steps around the circle.

Powers of ω

\mathrm{QFT}_{4}=\frac{1}{2}\begin{pmatrix}1&\textcolor{#0284c7}{1}&1&1\\1&\textcolor{#0284c7}{\omega}&\omega^{2}&\omega^{3}\\1&\textcolor{#0284c7}{\omega^{2}}&1&\omega^{2}\\1&\textcolor{#0284c7}{\omega^{3}}&\omega^{2}&\omega\end{pmatrix}

\omega=\omega_{4}=e^{2\pi i/4}

Size

N

4

Column

y

1

Row

x

1

\omega^{(1)(1)}

Where the arrow lands is a pair of coordinates, written down by Euler’s formula: $\omega_N=e^{2\pi i/N}=\cos\left(\tfrac{2\pi}{N}\right)+i\sin\left(\tfrac{2\pi}{N}\right)$ .

So naming $\omega_N$ collapses the definition to a sum of its powers, and the matrix to a table of them:

\begin{aligned}\mathrm{QFT}_N&=\frac{1}{\sqrt{N}}\sum_{x=0}^{N-1}\sum_{y=0}^{N-1}\omega_N^{xy}\lvert x\rangle\langle y\rvert\\[6pt]\mathrm{QFT}_N\lvert y\rangle&=\frac{1}{\sqrt{N}}\sum_{x=0}^{N-1}\omega_N^{xy}\lvert x\rangle\\[12pt]\mathrm{QFT}_N&=\frac{1}{\sqrt{N}}\begin{pmatrix}1&1&1&\cdots&1\\1&\omega_N&\omega_N^{2}&\cdots&\omega_N^{N-1}\\1&\omega_N^{2}&\omega_N^{4}&\cdots&\omega_N^{2(N-1)}\\\vdots&\vdots&\vdots&\ddots&\vdots\\1&\omega_N^{N-1}&\omega_N^{2(N-1)}&\cdots&\omega_N^{(N-1)^{2}}\end{pmatrix}\end{aligned}

Turning phase back into a number

Undoing the transform conjugates every phase, so the inverse is the same matrix with the sign of the exponent reversed:

(\mathrm{QFT}_N^\dagger)_{x,y}=\frac{1}{\sqrt{N}}\,\omega_N^{-xy}=\frac{1}{\sqrt{N}}e^{-2\pi ixy/N}

This is the direction used in phase estimation. The controlled- $U$ gates leave the control register in one of the phase patterns above — a Fourier-basis state, not a computational-basis state. That is why measuring the controls directly tells us so little.

$\mathrm{QFT}_N^\dagger$ maps that phase pattern back to the computational basis: $\mathrm{QFT}_N^\dagger\,\mathrm{QFT}_N\lvert y\rangle=\lvert y\rangle$ . After that, an ordinary measurement reveals $y$ .

Circuits for the QFT

When $N=2^{n}$ , the QFT acts on $n$ qubits. Its phase pattern has a simple, repeating structure that we can use: each qubit contributes one level of the pattern, with smaller phase rotations appearing as we move along the qubits. This lets us build the QFT efficiently as a ladder of single-qubit gates and controlled phase rotations, rather than treating every basis state separately.

For a computational-basis input $\lvert y\rangle$ , the output can be written as a tensor product of $n$ single-qubit states:

\mathrm{QFT}_{2^{n}}\lvert y\rangle=\bigotimes_{j=1}^{n}\frac{1}{\sqrt{2}}\left(\lvert 0\rangle+e^{2\pi iy/2^{\,n+1-j}}\lvert 1\rangle\right)

The tensor-product symbol $\otimes$ means that we combine these single-qubit states into the full $n$ -qubit state. Every factor has the same form, $\tfrac{1}{\sqrt{2}}\left(\lvert 0\rangle+e^{i\varphi}\lvert 1\rangle\right)$ , where $\varphi$ is the phase for that qubit. The $\lvert 0\rangle$ term carries no explicit phase because $1=e^{i0}$ , so it is the phase reference. The $\lvert 1\rangle$ term carries the relative phase $e^{i\varphi}$ .

So each output qubit is an equal superposition of $\lvert 0\rangle$ and $\lvert 1\rangle$ , with a phase that depends on $y$ and on which qubit we are looking at. The phases differ by powers of two, giving the QFT its characteristic phase pattern.

Building blocks

The output qubits are not entangled with one another, so we can build the state one qubit at a time.

The Hadamard gate creates the equal superposition $\tfrac{1}{\sqrt{2}}\left(\lvert 0\rangle+\lvert 1\rangle\right)$ , which is the basic form of each single-qubit factor above.

A controlled-phase gate adds a phase only to the $\lvert 11\rangle$ state:

\alpha

\mathrm{CP}(\alpha)=\begin{pmatrix}1&0&0&0\\0&1&0&0\\0&0&1&0\\0&0&0&e^{i\alpha}\end{pmatrix}

The gate is symmetric: it does not matter which qubit is considered the control and which is the target. Both qubits simply need to be $\lvert 1\rangle$ for the phase to be applied. This is why its circuit symbol has two identical dots rather than a separate control and target.

The circuit pattern

The circuit is built from one short pattern repeated across the wires. Each wire gets a Hadamard followed by controlled-phase gates connecting it to the wires below. The phase angles decrease by powers of two: the largest angle, $\pi/2$ , connects the wire being worked on to the bottom wire, then $\pi/4$ , $\pi/8$ , and so on as the connections move upward.

The resulting phase factors appear on the output wires in reverse order. The final swaps reverse the wire order and put them back into the intended positions.

In the picture, the part of the circuit not yet drawn out is folded into a single $\mathrm{QFT}$ box on the left. Unfolding that box reveals another copy of the same pattern.

Qubits

n

5 (N = 32)

Unfoldings1

Cost analysis

Let $s_n$ denote the number of gates we need for $n$ qubits. For $n=1$ , a single Hadamard gate is required. For $n\ge 2$ , these are the gates required:

$s_{n-1}$ gates for the QFT on $n-1$ qubits
$n-1$ controlled-phase gates
$n-1$ swap gates
1 Hadamard gate

s_n=\begin{cases}1 & n=1\\[2pt] s_{n-1}+2n-1 & n\ge 2\end{cases}

This is a recurrence relation with a :

s_n=\sum_{k=1}^{n}(2k-1)=n^{2}

So cost is $n^{2}$ gates for a transform on $N=2^{n}$ amplitudes — quadratic in the number of qubits, for a matrix with $N^{2}$ entries in it.

The swap gates can be reduced. Taken together, they simply reverse the order of the wires, so we need only $\lfloor n/2\rfloor$ swaps if we perform that reversal directly. We can also omit them entirely if we are willing to relabel the wires.

The QFT can also be approximated with fewer gates and lower depth. Its phase angles shrink geometrically: $\pi/2$ , $\pi/4$ , $\pi/8$ , and so on. Once the rotations become small enough, dropping them has little effect while reducing the cost of the circuit.

The inverse QFT

Phase estimation runs this circuit backwards. Reversing the order of the gates and changing every phase angle $\alpha$ to $-\alpha$ gives $\mathrm{QFT}_N^\dagger$ at the same cost.

This is the circuit that turns the phase pattern left behind by the controlled- $U$ gates back into the computational basis, where a measurement can read the encoded number.

Phase estimation with $m$ control qubits

The two-control circuit generalises to $m$ control qubits without changing its basic shape. Each control applies a different power of $U$ , so the control register accumulates a phase pattern determined by $\theta$ . With $m$ controls, this pattern contains $m$ bits of phase information. It has exactly the form produced by $\mathrm{QFT}_{2^{m}}$ from the corresponding basis state, so we apply $\mathrm{QFT}_{2^{m}}^\dagger$ and measure the controls to recover those bits.

\textcolor{#ffffff}{U}

\textcolor{#ffffff}{U^{2}}

\textcolor{#ffffff}{U^{2^{m-1}}}

\textcolor{#ffffff}{\mathrm{QFT}^{\dagger}_{2^{m}}}

\textcolor{#6d28d9}{\lvert 0^{m}\rangle}

\lvert\psi\rangle

The eigenstate $\lvert\psi\rangle$ is unchanged by every controlled power of $U$ , because $\lvert\psi\rangle$ is an eigenvector of $U$ and therefore of every power of it. All the phase information is stored in the control register. Just before measurement, the full state is

\displaystyle\lvert\pi\rangle=\lvert\psi\rangle\otimes\frac{1}{2^{m}}\sum_{y=0}^{2^{m}-1}\sum_{x=0}^{2^{m}-1}e^{2\pi ix(\theta-y/2^{m})}\lvert y\rangle

So the probability of reading $y$ is

\displaystyle p_y=\left\lvert\frac{1}{2^{m}}\sum_{x=0}^{2^{m}-1}e^{2\pi ix(\theta-y/2^{m})}\right\rvert^{2}

Accuracy of a single run

The probability $p_y$ of measuring the control register in $\lvert y\rangle$ depends only on the distance between $\theta$ and the corresponding grid point $y/2^{m}$ . If $\theta=y/2^{m}$ , every term in the sum is $1$ , so $p_y=1$ . Otherwise the terms do not line up perfectly, and $p_y$ is smaller.

The possible estimates $y/2^{m}$ are spaced by $2^{-m}$ . The nearest grid point is therefore at most half a step from $\theta$ , $\lvert\theta-y/2^{m}\rvert\le 2^{-(m+1)}$ . For phase differences this small, the probability formula above gives $p_y\ge 4/\pi^{2}\approx 0.405$ .

Conversely, if a grid point is at least one full step from $\theta$ , $\lvert\theta-y/2^{m}\rvert\ge 2^{-m}$ , the same probability formula gives $p_y\le 1/4$ .

Thus the nearest grid point has at least a $40.5\%$ chance of appearing in one run, while any grid point at least one full step away has probability at most $25\%$ .

\tfrac{4}{\pi^{2}}

\tfrac{1}{4}

\theta

Control qubits

m

3 (2^m = 8)

Phase θ0.310

\text{nearest }y

2

\lvert\theta-y/2^{m}\rvert

0.0600

2^{-(m+1)}

0.0625

\Pr[\,y\,]

0.443

A single run therefore favors the best approximation but does not guarantee it. Repeating the procedure and taking the mode of the outcomes makes that approximation increasingly likely. The eigenvector $\lvert\psi\rangle$ is unchanged, so it can be reused for every run.

Alternative phase-estimation methods

Standard phase estimation estimates the phase $\theta$ using controlled applications of $U$ . Other approaches use different combinations of quantum resources and classical processing:

Iterative phase estimation extracts the phase bits one at a time, reusing a single control qubit instead of keeping $m$ control qubits at once.
Kitaev’s phase estimation uses a single control qubit and estimates the phase from interference measurements involving different powers of $U$ .
Maximum-likelihood and Bayesian methods repeat controlled- $U^{k}$ experiments and use classical statistical inference to estimate $\theta$ .

These approaches trade off the same basic resources: control qubits, applications of $U$ , and classical post-processing.

The order-finding problem: using phase estimation

When working modulo $N$ , we only need $N$ possible values, represented by the integers from $0$ to $N-1$ . We denote this set by $\mathbb{Z}_N=\{0,1,\ldots,N-1\}$ . Thus $\mathbb{Z}_1=\{0\}$ , $\mathbb{Z}_2=\{0,1\}$ , $\mathbb{Z}_3=\{0,1,2\}$ , and so on.

The elements $a \in \mathbb{Z}_N$ that satisfy $\gcd(a, N) = 1$ have an important property: they have a multiplicative inverse modulo $N$ . We collect all of them into the set $\mathbb{Z}_N^{*}=\{a\in\mathbb{Z}_N:\gcd(a,N)=1\}$ . For $N = 21$ , for example, twelve of the twenty-one elements are invertible: $\mathbb{Z}_{21}^{*}=\{1,2,4,5,8,10,11,13,16,17,19,20\}$ .

The connection with the greatest common divisor follows from the Euclidean algorithm. If $\gcd(a, N) = 1$ , it gives integers $x$ and $y$ such that $ax + Ny = 1$ . Reducing modulo $N$ gives $ax = 1$ , so $x$ is a multiplicative inverse of $a$ . Conversely, if $a$ has an inverse modulo $N$ , then $\gcd(a, N)$ must be $1$ .

Now take any $a \in \mathbb{Z}_N^{*}$ and repeatedly multiply by $a$ , producing the powers $a,\ a^{2},\ a^{3},\ldots$ Every one of them is invertible too: if $x$ is the inverse of $a$ , then $x^{k}$ is the inverse of $a^{k}$ . So all the powers lie in $\mathbb{Z}_N^{*}$ , and that set is finite, so they cannot all be different. Two of them must be equal: $a^{i} \equiv a^{j} \pmod{N}$ for some $i < j$ . Multiplying both sides by the inverse of $a^{i}$ cancels it and leaves $a^{j-i} \equiv 1 \pmod{N}$ , where $j - i$ is positive. So some positive power of $a$ returns to $1$ .

So, the smallest positive exponent $r$ for which $a^{r} \equiv 1 \pmod{N}$ is called the order of $a$ in $\mathbb{Z}_N^{*}$ .

For elements outside $\mathbb{Z}_N^{*}$ no such exponent exists: if $d = \gcd(a, N) > 1$ , then $d$ divides both $a^{r}$ and $N$ , so $a^{r} \equiv 1 \pmod{N}$ would force $d$ to divide $1$ , which is impossible.

Modulus N21

a

2

\gcd(a, N)

1

Size of

\mathbb{Z}_N^{*}

12

Powers of $2$ modulo $21$

2

2^{1}

4

2^{2}

8

2^{3}

16

2^{4}

11

2^{5}

1

2^{6}

back to

2^{1}

r = 6

The problem

We are given two positive integers $a$ and $N$ , with the promise that $\gcd(a, N) = 1$ . The task is to find the order of $a$ : the smallest positive integer $r$ such that $a^{r} \equiv 1 \pmod{N}$ . The two numbers $a$ and $N$ are all we are given. In particular, no factorization of $N$ is provided.

Both numbers are written in binary, so the input length is $n = O(\log N)$ bits. Computing a single power $a^{k} \bmod N$ is efficient: does it using $O(n^3)$ gates. The difficulty is that the order can be almost as large as $N$ . Checking the powers one at a time can therefore require $\Omega(N)$ steps, which is exponential in the input length $n$ .

The table below runs that scan for $a = 2$ . Each modulus is about ten times the one above it, and so is the time.

$N$	order $r$	time
9,610,721	—	—
40,670,489	—	—
207,335,717	—	—
4,043,918,803	—	—

Scan to measure multiplication speed and estimate the cost at different sizes.

No efficient classical algorithm for order-finding is known. This is significant because order-finding is closely related to integer factorization. In fact, an efficient order-finding algorithm can be used to efficiently, so factorization can be reduced to order-finding.

Multiplication as a unitary operation

We know what we want to find: the length $r$ of the cycle that repeated multiplication by $a$ modulo $N$ runs through. The idea is to turn that repeated multiplication into an operation a quantum computer can apply to a state. For a given element $a \in \mathbb{Z}_N^{*}$ , define the operation as $M_{a}\lvert x\rangle=\lvert ax \bmod N\rangle$ for each $x \in \mathbb{Z}_N$ .

Because $a$ has a multiplicative inverse modulo $N$ , multiplication by $a$ is a bijection on $\mathbb{Z}_N$ : every state has exactly one image, and every state has exactly one preimage. In other words, multiplication by $a$ simply permutes the elements of $\mathbb{Z}_N$ .

A permutation of the computational basis states is represented by a unitary matrix. This is why $M_{a}$ is a valid quantum operation.

If $d = \gcd(a, N) > 1$ , this breaks down. Every product $ax \bmod N$ is divisible by $d$ , so the map can reach only a subset of the states. Multiple inputs therefore collide at the same output, while other states are never reached. The map is no longer a permutation, and its matrix is not unitary.

M_a\text{ on }\mathbb{Z}_8

a=

\gcd(a,8)=1

input

\lvert x\rangle

output

\lvert ax\bmod 8\rangle

0

1

2

3

4

5

6

7

M_{3}\lvert 1\rangle=\lvert 3\rangle

input

output

0123456701·······1···1····2······1·3·1······4····1···5·······16··1·····7·····1··

A permutation can be decomposed into cycles: starting from any state, repeatedly applying $M_{a}$ eventually returns to that state. For multiplication by $a$ , these cycles are determined by the repeated powers of $a$ modulo $N$ .

For example, take $N = 8$ and $a = 3$ . The state $\lvert 0\rangle$ remains fixed, while starting from $\lvert 1\rangle$ , repeated application of $M_{3}$ gives $\lvert 1\rangle\to\lvert 3\rangle\to\lvert 1\rangle$ . The cycle therefore has length $2$ . Equivalently, $3^{2} \equiv 1 \pmod{8}$ , and no smaller positive power gives $1$ , so the order of $3$ modulo $8$ is $r = 2$ .

The remaining states form cycles of their own: $\lvert 2\rangle\to\lvert 6\rangle\to\lvert 2\rangle$ and $\lvert 5\rangle\to\lvert 7\rangle\to\lvert 5\rangle$ , while $\lvert 4\rangle$ is fixed. Together, these cycles make up the full permutation implemented by $M_{3}$ .

This is the key connection: the order we want is encoded as the length of a cycle in the permutation $M_{a}$ . The remaining challenge is to extract that cycle length from the unitary using quantum phase estimation.

From the cycle to eigenvalues

At this point the order $r$ is hidden as the number of positions in a cycle. Phase estimation does not measure that cycle length directly. It measures an eigenphase, so the goal is to encode the cycle length $r$ into an eigenphase of the form $j/r$ .

The cycle containing $\lvert 1\rangle$ consists of the states $\lvert 1\rangle, \lvert a\rangle, \ldots, \lvert a^{r-1}\rangle$ . On this part of the state space, $M_{a}$ has one simple action: move everything one position forward, wrapping the last position back to the first:

\lvert 1\rangle\xrightarrow{M_{a}}\lvert a\rangle\xrightarrow{M_{a}}\lvert a^{2}\rangle\xrightarrow{M_{a}}\cdots\xrightarrow{M_{a}}\lvert a^{r-1}\rangle\xrightarrow{M_{a}}\lvert 1\rangle

A basis state does not have the property we need. For example, $M_{a}\lvert 1\rangle=\lvert a\rangle$ , so applying $M_{a}$ changes it into a different basis state. Instead, consider a superposition of the states in the cycle. With the right pattern of phases, the shift preserves this superposition and changes only its overall phase. Such a state is an eigenvector, and the corresponding phase change is its eigenvalue.

Begin with $\lvert\psi_0\rangle$ , the equal superposition of all positions in the cycle, with every amplitude having the same phase:

\lvert\psi_{0}\rangle=\frac{1}{\sqrt{r}}\left(\lvert 1\rangle+\lvert a\rangle+\cdots+\lvert a^{r-1}\rangle\right)

Applying $M_{a}$ moves every term one position forward. The last state wraps back to $\lvert 1\rangle$ , so the same $r$ terms appear again, only in a different order. The state is therefore unchanged: its eigenvalue is $1$ , corresponding to eigenphase $\theta_0=0$ . This is a valid eigenvector, but its phase contains no information about $r$ .

\begin{aligned} M_{a}\lvert\psi_{0}\rangle&=\frac{1}{\sqrt{r}}\left(\lvert a\rangle+\lvert a^{2}\rangle+\cdots+\lvert a^{r}\rangle\right)\\[4pt] &=\frac{1}{\sqrt{r}}\left(\lvert a\rangle+\cdots+\lvert a^{r-1}\rangle+\lvert 1\rangle\right)=\lvert\psi_{0}\rangle \end{aligned}

We need eigenvectors with nonzero eigenphases. The simplest way to get one is to let the amplitudes acquire a phase difference from one position to the next. Because the cycle contains $r$ positions, this phase difference must fit consistently when the cycle closes: after $r$ steps, the phase must return to its starting value. A natural choice is therefore $1/r$ of a full turn per step. Writing this phase step as $\omega_{r}=e^{2\pi i/r}$ , we have $\omega_r^{r}=1$ .

Now look at $\lvert\psi_1\rangle$ . We assign successive positions phases that differ by $1/r$ of a turn, so position $k$ carries the factor $\omega_r^{-k}$ (the minus sign is a convention):

\lvert\psi_{1}\rangle=\frac{1}{\sqrt{r}}\left(\lvert 1\rangle+\omega_{r}^{-1}\lvert a\rangle+\cdots+\omega_{r}^{-(r-1)}\lvert a^{r-1}\rangle\right)

Applying $M_{a}$ shifts every position forward by one step. The phase pattern shifts with the states, and when the last term wraps back to $\lvert 1\rangle$ , its phase factor becomes $\omega_r^{-(r-1)}=\omega_r$ . Rearranging the terms shows that every amplitude has acquired the same extra factor $\omega_r$ . The phase pattern is therefore unchanged, while the whole state gains the eigenphase $\theta_1=1/r$ .

\begin{aligned} M_{a}\lvert\psi_{1}\rangle&=\frac{1}{\sqrt{r}}\left(\lvert a\rangle+\omega_{r}^{-1}\lvert a^{2}\rangle+\cdots+\omega_{r}^{-(r-1)}\lvert a^{r}\rangle\right)\\[4pt] &=\frac{1}{\sqrt{r}}\left(\omega_{r}\lvert 1\rangle+\lvert a\rangle+\omega_{r}^{-1}\lvert a^{2}\rangle+\cdots+\omega_{r}^{-(r-2)}\lvert a^{r-1}\rangle\right)\\[4pt] &=\omega_{r}\cdot\frac{1}{\sqrt{r}}\left(\lvert 1\rangle+\omega_{r}^{-1}\lvert a\rangle+\omega_{r}^{-2}\lvert a^{2}\rangle+\cdots+\omega_{r}^{-(r-1)}\lvert a^{r-1}\rangle\right)\\[4pt] &=\omega_{r}\lvert\psi_{1}\rangle \end{aligned}

By the same logic, we can choose different phase steps to obtain a whole family of eigenvectors. The state $\lvert\psi_j\rangle$ is an equal superposition of all $r$ basis states in the cycle through $\lvert 1\rangle$ , with only their phases differing. Each component has magnitude $1/\sqrt r$ . The label $j$ determines the phase difference between neighbouring positions: the phase advances by $j/r$ of a turn from one position to the next. Thus, the component on $\lvert a^k\rangle$ carries the phase factor $\omega_r^{-jk}=e^{-2\pi i jk/r}$ :

\lvert\psi_{j}\rangle=\frac{1}{\sqrt{r}}\sum_{k=0}^{r-1}\omega_{r}^{-jk}\lvert a^{k}\rangle\qquad\text{for }j\in\{0,1,\ldots,r-1\}

Every state in this family is an eigenvector of $M_{a}$ , with eigenvalue $\omega_r^{\,j}=e^{2\pi i j/r}$ .

M_a\lvert\psi_j\rangle=\omega_r^{\,j}\lvert\psi_j\rangle

Note that there are different ways to choose the phase pattern and construct eigenvectors. For this problem, however, these particular eigenvectors are useful because their eigenphases are $\theta_j=j/r$ , so the unknown cycle length $r$ appears directly in the denominator.

The phase pattern of an eigenstate

cycle length

r =

phase step

j =

\lvert 1\rangle

\lvert a\rangle

\lvert a^{2}\rangle

\lvert a^{3}\rangle

\lvert a^{4}\rangle

0°

288°

216°

144°

72°

\lvert\psi_{1}\rangle=\frac{1}{\sqrt{5}}\left(\lvert 1\rangle+\omega_{5}^{-1}\lvert a\rangle+\omega_{5}^{-2}\lvert a^{2}\rangle+\omega_{5}^{-3}\lvert a^{3}\rangle+\omega_{5}^{-4}\lvert a^{4}\rangle\right)

\theta_{1}=\frac{j}{r}=\frac{1}{5}\text{ turn}

The phase pattern is what makes these states useful for phase estimation. Under every controlled power of $M_{a}$ , an eigenvector remains the same target state while its phase accumulates in the control register.

From eigenphase to order

Among the eigenvectors $\lvert\psi_{j}\rangle$ above, start with $j = 0$ . Its eigenphase is $0$ , which carries no information about the unknown order $r$ . The next choice, $j = 1$ , is exactly what we need: its eigenphase is $1/r$ , putting the unknown order directly in the denominator:

M_{a}\lvert\psi_{1}\rangle=\omega_{r}\lvert\psi_{1}\rangle=e^{2\pi i\frac{1}{r}}\lvert\psi_{1}\rangle

This gives us a direct route from phase estimation to the order. If we can prepare $\lvert\psi_{1}\rangle$ , phase estimation gives an estimate of its eigenphase, which in this case is $1/r$ . We can then invert that estimate to obtain $r$ .

Perform phase estimation on $\lvert\psi_{1}\rangle$ using a quantum circuit implementing $M_{a}$ , with $m$ control qubits. The controlled powers of $M_{a}$ accumulate the phase $e^{2\pi i\frac{k}{r}}$ in the control register. The inverse QFT converts this accumulated phase into an estimate of the eigenphase. Measuring the control register gives an integer $y$ . Dividing by $2^{m}$ turns that $m$ -bit readout into a phase estimate $y/2^{m}$ in $[0,1)$ . And since the eigenphase is $1/r$ , $y/2^{m}\approx 1/r$ .
Recover the order by inverting the phase estimate and rounding it to the nearest integer: $r\approx\operatorname{round}\!\left(\frac{2^{m}}{y}\right)=\left\lfloor\frac{2^{m}}{y}+\frac{1}{2}\right\rfloor$ .

How accurate does the phase estimate need to be?

The estimate of $1/r$ must be accurate enough to distinguish it from the phase corresponding to any other possible order $r'$ . Since both $r$ and $r'$ are smaller than $N$ , the smallest possible separation between two such phases is $\lvert 1/r-1/r'\rvert=\lvert r'-r\rvert/(rr')>1/N^{2}$ .

Therefore, if the phase estimate is within half of this minimum separation from the true phase, it cannot be mistaken for the phase of a different possible order. In other words, it is enough to have $\lvert y/2^{m}-1/r\rvert\le 1/(2N^{2})$ .

With $m$ control qubits, the phase-estimation grid has spacing $1/2^{m}$ , so the nearest grid point is at most $1/2^{m+1}$ away from the true phase. Choosing $m = 2\lceil\lg N\rceil + 1$ makes this error at most $1/(4N^{2})$ , comfortably within the required precision. Thus $O(\log N)$ control qubits are enough.

A single run produces the nearest grid point with probability at least $4/\pi^{2}$ , about 40%. Repeating the procedure independently increases the probability of obtaining the correct phase. After $k$ runs, the probability that at least one run produces the nearest grid point is at least $1-(1-4/\pi^{2})^{k}$ , so a constant number of repetitions gives any fixed desired success probability, while $O(\log(1/\varepsilon))$ repetitions give failure probability at most $\varepsilon$ .

So, we choose enough qubits so that the useful region around the true phase is narrow enough to identify $r$ . And adding more qubits makes the grid finer and the phase estimate more precise, while repetitions can further boost the probability of obtaining a sufficiently accurate estimate.

When the eigenphase is a random fraction

The previous procedure assumed that we could start with $\lvert\psi_{1}\rangle$ , whose eigenphase is $1/r$ . But there is nothing special about $j = 1$ : suppose instead that we are given $\lvert\psi_{j}\rangle$ for a random choice of $j \in \{0,\ldots,r-1\}$ . Its eigenphase is $j/r$ , so phase estimation now returns that fraction rather than $1/r$ :

M_{a}\lvert\psi_{j}\rangle=\omega_{r}^{\,j}\lvert\psi_{j}\rangle=e^{2\pi i\frac{j}{r}}\lvert\psi_{j}\rangle

We can estimate $j/r$ as follows:

Perform phase estimation on the state $\lvert\psi_{j}\rangle$ using a quantum circuit implementing $M_{a}$ , with $m$ control qubits. The outcome is an integer $y$ such that $y/2^{m}$ approximates $j/r$ .
Find the fraction $u/v$ in lowest terms, with $u, v \in \{0,\ldots,N-1\}$ and $v \neq 0$ , that is closest to $y/2^{m}$ . The continued fraction algorithm finds this fraction efficiently.

The same precision bound is enough. Two distinct fractions with denominators below $N$ are more than $1/N^{2}$ apart, so an estimate within half that gap identifies $j/r$ uniquely:

\left\lvert\frac{y}{2^{m}}-\frac{j}{r}\right\rvert\le\frac{1}{2N^{2}}\quad\Longrightarrow\quad\frac{u}{v}=\frac{j}{r}

Thus the same choice $m = 2\lceil\lg N\rceil + 1$ makes the correct fraction likely to be recovered.

There is one complication: continued fractions return the fraction in lowest terms. Suppose, for example, that the true eigenphase is $j/r = 2/6$ . The algorithm sees only the value $1/3$ , so it returns $u/v = 1/3$ rather than $2/6$ . In general, if $j$ and $r$ share a common factor, the denominator returned is only $v = r/\gcd(j,r)$ , a proper divisor of $r$ . A single run therefore may not reveal the order.

Repeating the procedure solves this problem. Each run gives a denominator $r/\gcd(j,r)$ for an independently chosen $j$ . Taking the least common multiple of the denominators observed across several runs recovers $r$ with high probability.

The continued fraction algorithm

At this point, phase estimation has given us an integer measurement outcome $y\in\{0,1,\ldots,2^{m}-1\}$ . We turn it into a number in $[0,1)$ by dividing by $2^{m}$ : $x=y/2^{m}$ . The value $x$ is our estimate of the eigenphase $j/r$ . The denominator $2^{m}$ is determined entirely by the number of control qubits, so it tells us nothing about the unknown order $r$ .

What we want is a fraction $u/v$ that is close to $x$ , with a denominator $v < N$ . This bound comes from the problem itself: the order satisfies $r < N$ . If the phase estimate satisfies $\lvert y/2^{m}-j/r\rvert\le 1/(2N^{2})$ , then $x$ is close enough to the true eigenphase that this reduced fraction is uniquely determined among fractions with denominators below $N$ .

This is where continued fractions enter. Starting from $x$ , the continued fraction algorithm repeatedly divides with remainder. These divisions produce a sequence of integers $a_{0}, a_{1}, a_{2},\ldots$ called the continued-fraction terms. From these terms we construct fractions $p_{0}/q_{0},\ p_{1}/q_{1},\ p_{2}/q_{2},\ldots$ called the convergents. Each convergent is a rational approximation to $x$ . As we move through the sequence, the approximations become better while their denominators grow.

Outcome

y

341

Precision

m

11

Bound

N

21

Each Euclidean division adds one term to the continued fraction, and each term builds the next convergent from the two before it. The last convergent with denominator below N is the fraction u/v.
Euclidean division	term	$p_i=a_i\,p_{i-1}+p_{i-2}$	$q_i=a_i\,q_{i-1}+q_{i-2}$	test
$341=0\cdot2048+341$	$a_{0}=0$	$0$	$1$	$q_i<N$
$2048=6\cdot341+2$	$a_{1}=6$	$1$	$6$	$q_i<N$ kept
$341=170\cdot2+1$	$a_{2}=170$	$170$	$1021$	$q_i\ge N$ stop

phase estimate

x=\frac{y}{2^{m}}=\frac{341}{2048}

≈ 0.16650

recovered fraction

\frac{u}{v}=\frac{1}{6}

≈ 0.16667

distance $\le 1/(2N^{2})$

\left\lvert x-\frac{u}{v}\right\rvert

≈ 0.00016 ≤ 0.00113

The state we can prepare

So far, the procedure was described as if we had to start with a particular eigenvector such as $\lvert\psi_{1}\rangle$ . But preparing $\lvert\psi_{1}\rangle$ , or any other $\lvert\psi_{j}\rangle$ , would require knowing the order $r$ in advance — exactly what we are trying to find.

Fortunately, we can start with a state we already know how to prepare: $\lvert 1\rangle$ . On the cycle containing $\lvert 1\rangle$ , this basis state is an equal superposition of all $r$ eigenvectors: $\lvert 1\rangle=(1/\sqrt r)\sum_{j=0}^{r-1}\lvert\psi_j\rangle$ .

To see this, substitute the definition of $\lvert\psi_j\rangle$ : $(1/\sqrt r)\sum_{j=0}^{r-1}\lvert\psi_j\rangle=(1/r)\sum_{j=0}^{r-1}\sum_{k=0}^{r-1}\omega_r^{-jk}\lvert a^{k}\rangle$ .

For $k=0$ , every phase factor is $1$ , so the sum over $j$ gives $r$ . For every $k\neq 0$ , the factors $1,\omega_r^{-k},\omega_r^{-2k},\ldots,\omega_r^{-(r-1)k}$ run through all $r$ th roots of unity and sum to zero. All terms with $k\neq 0$ therefore cancel, leaving only the $k=0$ term: $(1/r)\,r\lvert 1\rangle=\lvert 1\rangle$ .

This is exactly what we need. Starting with $\lvert 1\rangle$ means that phase estimation runs simultaneously on all the eigenvectors $\lvert\psi_{j}\rangle$ . Each one contributes its own eigenphase $\theta_j=j/r$ , and the measurement selects one of these phases.

The important point is that we do not need to know which $j$ was selected. Whatever phase we obtain has the form $j/r$ , so the continued fraction step can recover its reduced denominator. Repeating the procedure with fresh copies of $\lvert 1\rangle$ gives several such denominators, whose least common multiple reveals the unknown order $r$ with high probability.

Implementation

Every piece is now in place. We know a state we can prepare, $\lvert 1\rangle$ , and an operation $M_{a}$ whose eigenphases are the fractions $j/r$ . We also know how to read one of those fractions off the control register. Putting them together gives the circuit that finds the order of $a \in \mathbb{Z}_N^{*}$ .

\textcolor{#ffffff}{M_{a}}

\textcolor{#ffffff}{M_{a}^{2}}

\textcolor{#ffffff}{M_{a}^{2^{m-1}}}

\textcolor{#ffffff}{\mathrm{QFT}^{\dagger}_{2^{m}}}

\textcolor{#6d28d9}{\lvert 0^{m}\rangle}

\lvert\psi\rangle

What does one run cost? Write $n$ for the number of bits of $N$ . The control register holds $m = 2\lceil\lg N\rceil + 1 = O(n)$ qubits, so the circuit opens with $O(n)$ Hadamard gates and closes with an inverse Fourier transform over $2^{m}$ , which costs $O(n^{2})$ gates.

The controlled unitaries are the expensive part, and they are cheaper than they look. Nothing forces us to apply $M_{a}$ repeatedly: both $a$ and $N$ are known in advance, so each power $b = a^{k} \bmod N$ for $k = 1, 2, 4, 8, \ldots, 2^{m-1}$ can be worked out classically by before the circuit is built. What the circuit runs is then a single multiplication $M_{b} = M_{a}^{k}$ , at cost $O(n^{2})$ . With $O(n)$ of them, the controlled unitaries cost $O(n^{3})$ , and that dominates the total: the whole circuit runs in $O(n^{3})$ gates.

This is the payoff of the whole construction. Searching for the order classically means walking through the powers of $a$ one at a time, and the order can be almost as large as $N$ , so the walk can run to $\Omega(N) = \Omega(2^{n})$ steps — exponential in the input length. The circuit above answers the same question with a number of gates that grows like $n^{3}$ .

Factoring through order-finding

Order-finding may seem far removed from factoring: it tells us about the exponents that make powers of $a$ repeat, not about the divisors of $N$ . The key idea is that this periodicity contains exactly the information we need. From the order $r$ of a suitable $a$ modulo $N$ , a few lines of classical arithmetic can reveal a non-trivial factor of $N$ .

The reduction works under a few conditions. We take $N$ to be odd and composite, and choose $a$ so that $\gcd(a,N)=1$ . For such an $N$ , the standard analysis guarantees that a randomly chosen $a$ produces useful factors with probability at least $1/2$ . If an attempt fails, we simply choose another $a$ and repeat.

So, before running order-finding, we deal with the easy cases classically. If $N$ is even, we immediately have the factor $2$ . If $N$ is prime, there is nothing to factor. Classical Miller–Rabin and AKS primality tests can detect this efficiently. And if $N$ is a perfect power $N=p^{k}$ , taking successive roots hands us $p$ directly. What is left is an odd composite that is not a prime power, and that is the only case the quantum procedure is needed for.

How a repeating power reveals a factor

Suppose the order $r$ we get back is even. Then $r/2$ is a whole number, so we may halve the exponent and set $x=a^{r/2}\bmod N$ . Squaring $x$ puts the exponent back to $r$ , and $a^{r}\equiv1$ by definition of the order. So the halved power is a square root of $1$ modulo $N$ :

x=a^{r/2}\bmod N,\qquad x^{2}\equiv1\pmod N,\qquad N\mid(x-1)(x+1)

The last step is where the factor comes from. Saying that $x$ squares to $1$ is the same as saying that $N$ divides $x^2-1$ , and a difference of squares splits that quantity into the two brackets $x-1$ and $x+1$ . So $N$ divides a product of two numbers that differ by only $2$ — and that is a sharp constraint on where the prime factors of $N$ can be hiding.

Because $N$ is odd, no prime of $N$ can divide two numbers that differ by $2$ , so each prime power making up $N$ has to sit entirely in one bracket or the other. If they all sit in the same bracket, that bracket is a multiple of $N$ and we learn nothing. But if they are shared between the two, then $\gcd(x-1,N)$ picks up precisely the parts on the left and $\gcd(x+1,N)$ precisely the parts on the right. Both are proper factors of $N$ , and Euclid’s algorithm produces them in a moment.

Modulus N21

a

2

r

6

x=a^{r/2}

8

x=2^{3}=8

x^2\equiv1\pmod{21}

\gcd(x-1,21)=7

\gcd(x+1,21)=3

21=7\times3

Putting it all together

We now have all the pieces of Shor’s algorithm. The full run makes one thing especially clear: almost all of the work is classical. Choosing $a$ , checking the conditions, , and are all classical operations. The only quantum step is finding the order $r$ — the crucial part that makes the whole approach useful.

Modulus N21

1
Draw $a$ at random from $\{2,\ldots,N-1\}$
a = 4
2
Take $d=\gcd(a,N)$
quantum step 3
Find the order $r$ : the least $r>0$ with $a^{r}\equiv1\pmod N$
4
Check the parity of $r$
5
Halve the exponent: $x=a^{r/2}\bmod N$
6
Take $\gcd(x-1,N)$ and $\gcd(x+1,N)$

Candidates for a

splits

N

shares a factorredraw

Grover's algorithm

Unstructured search

Let $\Sigma = \{0, 1\}$ denote the binary alphabet. Suppose we are given a function we can compute efficiently, $f : \Sigma^n \to \Sigma$ , and our goal is to find a solution: a binary string $x \in \Sigma^n$ for which $f(x) = 1$ .

Search

Input:: $f : \Sigma^n \to \Sigma$
Output:: A string $x \in \Sigma^n$ satisfying $f(x) = 1$ , or “no solution” if no such string exists

This is unstructured search because $f$ is arbitrary. There is no promise attached to it, so there is no structure to exploit—no ordering, periodicity, or gradient to follow. Learning that $f(x) = 0$ for one string rules out that string but tells us nothing about any other.

A PIN that opens a lock is easy to check, but a failed attempt gives no clue about the next one. The same pattern appears whenever we have a cheap way to test a candidate but no useful information about where to look next. In every case, $f$ is the cheap checker, and Search asks us to find something it accepts.

Unique search

Input:: $f : \Sigma^n \to \Sigma$
Promise:: There is exactly one string $z \in \Sigma^n$ for which $f(z) = 1$
Output:: $z$

Hereafter, let $N = 2^n$ denote the number of strings in $\Sigma^n$ , so that we can express costs in terms of the size of the search space rather than the number of bits. It is also useful to name the two sets into which the strings are divided: $A_1 = \{x \in \Sigma^n : f(x) = 1\}$ and $A_0 = \{x \in \Sigma^n : f(x) = 0\}$ . Let $s = \lvert A_1\rvert$ be the number of solutions. Search asks us to produce an element of $A_1$ , while Unique search is the special case $s = 1$ .

By iterating through all $x \in \Sigma^n$ and evaluating $f$ on each one, we can solve Search with $N$ queries, and no deterministic algorithm can guarantee a solution with fewer. Probabilistic algorithms can do slightly better on average by stopping as soon as a solution is found, but they still require a number of queries that is linear in $N$ .

Search by hand

Number of solutions

Queries used0Classical average33Grover6

Grover’s algorithm is a quantum algorithm for Search requiring $O(\sqrt{N})$ queries. Compared with Shor’s exponential speedup, a quadratic saving sounds modest, and it is. Whether it offers a practical advantage is a separate question. But Grover is still important: it applies to completely unstructured search, with no promise or hidden structure, and its quadratic speedup is the largest possible in the query model.

Phase query gates

So far, queries have been made through the , which writes the answer into a workspace qubit: $U_f\bigl(\lvert a\rangle\lvert x\rangle\bigr)=\lvert a\oplus f(x)\rangle\lvert x\rangle$ .

Grover’s algorithm is easier to describe using a second form of query, which records the answer as a phase rather than in a qubit. For a function $f : \Sigma^n \to \Sigma$ , the phase query gate $Z_f$ is the $n$ -qubit operation defined by $Z_f\lvert x\rangle=(-1)^{f(x)}\lvert x\rangle$ for every $x \in \Sigma^n$ .

This is the first of the two phase gates Grover’s algorithm needs: it marks the solutions by reversing their sign, and leaves every non-solution exactly as it was. A measurement cannot see that mark directly—a sign is not a probability—which is why the rest of the algorithm is needed. A single query marks every solution at once, and Grover’s algorithm is the machinery that turns those marks into amplitude a measurement can find.

Each gate from the other

\lvert x\rangle

(-1)^{f(x)}\lvert x\rangle

\lvert -\rangle

\lvert -\rangle

Z_f

The phase query is not a different oracle. It is the same $U_f$ query used with the workspace qubit prepared in $\lvert -\rangle$ . In that case, the workspace qubit returns to $\lvert -\rangle$ , while the value of $f(x)$ appears as a phase on $\lvert x\rangle$ (phase kickback): $U_f\bigl(\lvert -\rangle\lvert x\rangle\bigr)=(-1)^{f(x)}\lvert -\rangle\lvert x\rangle$ .

The construction runs in the other direction too, so an algorithm counted in $Z_f$ queries and one counted in $U_f$ queries are counted on the same scale.

The second phase gate is not a query to the problem’s function $f$ . It is a fixed operation that we can build directly into the circuit, based on the simple, known function $\mathrm{OR} : \Sigma^n \to \Sigma$ defined by

\mathrm{OR}(x)=\begin{cases}0,&x=0^n\\[2pt]1,&x\neq 0^n.\end{cases}

Its phase query gate is

Z_{\mathrm{OR}}\lvert x\rangle=\begin{cases}\lvert x\rangle,&x=0^n\\[2pt]-\lvert x\rangle,&x\neq 0^n.\end{cases}

Unlike $Z_f$ , which queries the unknown $f$ , $Z_{\mathrm{OR}}$ is a fixed, known operation that does not depend on the search problem. Its circuit can be built once and for all as an $(n-1)$ -fold controlled- $Z$ gate with $X$ gates before and after it. It provides the fixed reflection used in each Grover iteration, adding gates but no queries. Thus, only $Z_f$ counts toward the query count.

\lvert x_1\rangle

\lvert x_2\rangle

\lvert x_n\rangle

Z_{\mathrm{OR}}

Grover’s algorithm

Grover’s algorithm repeatedly applies one fixed Grover operation:

G=H^{\otimes n}\,Z_{\mathrm{OR}}\,H^{\otimes n}\,Z_f

Each application consists of a phase query $Z_f$ , followed by a fixed sequence of gates that amplifies the amplitudes of the solutions. Only $Z_f$ depends on the unknown function $f$ and therefore counts as a query, so with the other three gates fixed, $t$ iterations use exactly $t$ queries.

The operation is applied to the uniform superposition, where $N = 2^n$ :

\lvert u\rangle=H^{\otimes n}\lvert 0^n\rangle=\frac{1}{\sqrt N}\sum_{x\in\Sigma^n}\lvert x\rangle

Before any amplification, every string has the same probability of being measured. If there are $s$ solutions, a measurement finds one with probability $s/N$ —the quantum equivalent of one blind guess.

Grover’s algorithm uses the repeated application of $G$ to move probability amplitude from non-solutions to solutions. After the right number of iterations, no more and no less, measuring the register is much more likely to produce a solution. The walkthrough below runs the circuit one stage at a time, with the state after each stage and the picture that goes with it.

\lvert 0^n\rangle

x \in \Sigma^n

Step through the circuit

1Prepare. Start the $n$ qubits in $\lvert 0^n\rangle$ and apply a Hadamard to each, producing the uniform superposition $\lvert u\rangle$ .
2Iterate. Apply the Grover operation $G$ exactly $t$ times.
3Measure. Measure all $n$ qubits in the standard basis and return the resulting string. One classical evaluation of $f$ checks whether it is a solution.

Cost analysis

Two quantities determine the cost of Grover’s algorithm: the number of iterations and the success probability after those iterations. For $s$ solutions among $N$ possible strings, the optimal iteration count is approximately $t\approx\tfrac{\pi}{4\theta}-\tfrac12$ , with success probability close to $1$ when the solutions are sparse.

The iteration count is where the speedup appears. Since $\sin\theta=\sqrt{s/N}$ , for small $\theta$ we have $\theta\approx\sqrt{s/N}$ . Therefore, $t\approx\tfrac{\pi}{4}\sqrt{N/s}=O\bigl(\sqrt{N/s}\bigr)$ . Each Grover iteration uses one query to $f$ , so the same expression gives the query complexity.

For Unique search, $s=1$ , so Grover’s algorithm needs approximately $\tfrac{\pi}{4}\sqrt{N}$ queries. The corresponding success probability is very high: the failure probability is about $1/N$ .

A classical search needs $N/2$ queries on average, so Grover’s algorithm reduces the number of queries from $O(N)$ to $O(\sqrt{N})$ .

Search space $N$	Classical, on average	Grover iterations
$2^{10}$	$512$	$25$
$2^{20}$	$524,288$	$804$
$2^{40}$	$5.5 \times 10^{11}$	$823,550$
$2^{80}$	$6.0 \times 10^{23}$	$8.6 \times 10^{11}$

The rotation picture also explains an important limitation. The success probability is periodic in the iteration count: stopping too early leaves probability on the non-solution side, while continuing past the optimum rotates the state away from the solution direction again. Unlike classical search, where checking more candidates cannot reduce your chances, running more Grover iterations can make the result worse.

The number of solutions also changes the rotation speed. More solutions make $\theta$ larger, so each iteration rotates farther and fewer iterations are needed. The $\sqrt{N/s}$ dependence captures this directly: increasing the number of solutions makes the search easier.

There is one extreme case to handle separately. If more than half of the strings are solutions, then $\theta>\pi/4$ . The usual iteration formula gives zero iterations, which is reasonable: if most strings are solutions, simply choosing a string at random already succeeds with probability greater than one half.

The useful regime for Grover’s speedup is therefore the sparse-search regime, where $s\ll N$ . There, the algorithm reduces the query complexity from classical $O(N/s)$ to $O(\sqrt{N/s})$ .

A natural question is whether a cleverer quantum algorithm could do better than Grover’s quadratic speedup. For unstructured search, the answer is no. Bennett, Bernstein, Brassard and Vazirani proved that every quantum algorithm solving Search with a black-box $f$ requires $\Omega(\sqrt N)$ queries.

This matches Grover’s $O(\sqrt N)$ query complexity up to a constant factor, so Grover’s algorithm is optimal. The constant $\pi/4$ in the unique-search case is optimal as well.

Unknown number of solutions

The optimal iteration count depends on $s$ , the number of solutions, but $s$ is not always given to the algorithm. Fortunately, a measured candidate is easy to verify: evaluate $f(x)$ classically. A failed attempt therefore does not produce a wrong answer—it only means we need to try again.

Instead of choosing one precise iteration count, we can choose the count at random and repeat. With an appropriate randomized schedule, the algorithm finds a solution in $O\bigl(\sqrt{N/s}\bigr)$ queries when solutions exist, and $O(\sqrt{N})$ queries when there are none.

A poorly chosen iteration count can waste a single attempt because the state may have rotated past the solution direction. Randomizing the count prevents the algorithm from repeatedly getting stuck at the wrong point in the rotation. The lack of knowledge about $s$ therefore costs only a constant factor, not the quadratic speedup.

Qubits nN = 1,024

Solutions s (hidden)1

1
Draw $t$ at random from $\{1,\ldots,\lfloor\pi\sqrt{N}/4\rfloor\}$
2
Run $t$ Grover iterations on $\lvert u\rangle$
3
Measure all $n$ qubits, giving a string $x$
4
Check $f(x)$ classically: accept it or draw again

\lvert A_0\rangle

\lvert A_1\rangle

Iteration counts tried

Start searching to draw an iteration count and try it. The ceiling here is $\lfloor\pi\sqrt{N}/4\rfloor$ = 25.

Queries this run—

Knowing

s

, it would take25

Classical, on average513

The demo draws from a fixed ceiling, $\lfloor\pi\sqrt{N}/4\rfloor$ , which is generous whenever solutions turn out to be plentiful. A more sophisticated approach grows the ceiling instead: set $T=1$ , draw $t$ uniformly from $\{1,\ldots,T\}$ , and on a failure raise $T$ and try again—stopping when the classical check accepts a string, or reporting “no solution” once $T$ has climbed past $\sqrt{N}$ .

The rate of increase has to be carefully balanced. Raise $T$ too slowly and the run piles up long shots that were never likely to land, so the queries mount. Raise it too quickly and each attempt overshoots the count it was looking for, and the success probability drops. Growing by a fifth at a time, $T\leftarrow\lceil\tfrac54 T\rceil$ , works.

From query complexity to real cost

The $O(\sqrt N)$ bound counts only oracle queries. In practice, each query is a full reversible implementation of $f$ , and the Grover iterations must run sequentially for a deep, coherent computation. Classical search, by contrast, is easy to distribute across many machines.

So the quadratic speedup is real, given that someone eventually builds a large and stable enough quantum processor. Its cryptographic consequence is simple: Grover effectively halves the security exponent of symmetric key search and hash preimage search: $\text{AES-128}\to 2^{64},\quad\text{AES-256}\to 2^{128},\quad\text{SHA-256 preimage}\to 2^{128}.$

But a halved exponent is answered by a doubled key. Moving symmetric keys and hashes to the larger sizes restores the original margin exactly, and that is already the standing advice, so the practical significance of the speedup keeps shrinking.

Shor’s algorithm is the sharper threat. It exploits the structure underlying RSA and elliptic-curve cryptography and breaks them outright, where no key size helps. Even there, though, standardised replacements already exist—lattice-based ML-KEM and ML-DSA, hash-based SLH-DSA—and TLS 1.3 already ships hybrid key exchange. The risk table on the cryptography page sorts the primitives along exactly this line—broken by Shor, weakened by Grover, or believed resistant to both.

So for now, quantum algorithms are a great deal more interesting as research than as a practical threat. The theory is settled well ahead of the hardware, and the cryptography that would be affected mostly knows what to do about it already.

Density matrices

So far, we have described quantum systems with state vectors: $\lvert\psi\rangle$ for a qubit, and longer vectors for larger registers. But a state vector describes one definite state. What if we only have a probability distribution over states?

This happens in three common situations:

Randomness. A source might produce $\lvert 0\rangle$ or $\lvert +\rangle$ at random. This is not a superposition of the two—it is a classical random choice between them.
Noise. A real quantum device does not always produce the intended state. After a noisy operation, the system may be in different states with different probabilities.
Part of a compound system. If two qubits are entangled, the pair has a state vector, but an individual qubit generally does not have one of its own.

These look like different problems, but they have the same solution: instead of describing one state, we need an object that can describe a mixture of possible states.

That object is the density matrix.

It includes ordinary state vectors as a special case, while also describing classical randomness, noise, and the parts of entangled systems. It gives us one framework for describing quantum states, applying operations, combining systems, and predicting measurements.

Definition of density matrices

Suppose that $X$ is a system and $\Sigma$ is its classical state set. A density matrix describing a state of $X$ is a matrix with complex-number entries whose rows and columns correspond to the elements of $\Sigma$ . We typically write density matrices as $\rho$ , $\sigma$ , or $\xi$ .

The purpose of $\rho$ is to let us calculate probabilities of measurement outcomes. If $\lvert x\rangle$ is a classical state from $\Sigma$ , then the probability of obtaining that state when measuring in the classical basis is given by the corresponding diagonal entry $\Pr(x)=\langle x\rvert\rho\lvert x\rangle=\rho_{x,x}$ . Thus, the diagonal entries of $\rho$ give the probabilities of the classical states.

But we are not limited to measurements in the classical basis. For any unit vector $\lvert\psi\rangle$ , we can consider a measurement that asks whether the system is in the state $\lvert\psi\rangle$ . The probability of a “yes” outcome is

\Pr(\psi)=\langle\psi\rvert\rho\lvert\psi\rangle.

This is the same rule we already know for state vectors. If the system is in the state $\lvert\phi\rangle$ , its density matrix is $\rho=\lvert\phi\rangle\langle\phi\rvert$ . Substituting this into the measurement rule gives $\langle\psi\rvert\rho\lvert\psi\rangle=\langle\psi|\phi\rangle\langle\phi|\psi\rangle=\lvert\langle\psi|\phi\rangle\rvert^{2}$ , which is exactly the usual measurement probability for the state $\lvert\phi\rangle$ .

So $\langle\psi\rvert\rho\lvert\psi\rangle$ is simply the density-matrix version of the familiar probability formula. The bra $\langle\psi\rvert$ and ket $\lvert\psi\rangle$ select the part of $\rho$ relevant to the question “is the state $\lvert\psi\rangle$ ?” and reduce it to the single number that gives the probability of a “yes” outcome.

What is the probability that a measurement finds the system in the state $\lvert\psi\rangle$ ?

1

0

\langle\psi\rvert

the question

\tfrac12

\tfrac14

\tfrac14

\tfrac12

\rho

the state

1

0

\lvert\psi\rangle

the same question

=

\tfrac12

\Pr(\psi)

the chance of a “yes”

\langle0\rvert\rho\lvert0\rangle=\rho_{0,0}=\tfrac12

The off-diagonal entries encode coherence between the corresponding classical states. They affect measurements in superposition bases, as the demo shows.

Together, the entries must produce valid measurement probabilities: the probabilities of all possible outcomes must add up to one, and none can be negative. These requirements give us two mathematical conditions on $\rho$ : it must have trace one, and it must be positive semidefinite.

1. Unit trace

The trace of a square matrix is the sum of its diagonal entries.

\mathrm{Tr}\begin{pmatrix}\textcolor{#7c3aed}{A_{0,0}}&A_{0,1}&\cdots&A_{0,n-1}\\A_{1,0}&\textcolor{#7c3aed}{A_{1,1}}&\cdots&A_{1,n-1}\\\vdots&\vdots&\textcolor{#7c3aed}{\ddots}&\vdots\\A_{n-1,0}&A_{n-1,1}&\cdots&\textcolor{#7c3aed}{A_{n-1,n-1}}\end{pmatrix}=\textcolor{#7c3aed}{A_{0,0}}+\textcolor{#7c3aed}{A_{1,1}}+\cdots+\textcolor{#7c3aed}{A_{n-1,n-1}}

It reads only the diagonal and ignores all off-diagonal entries. The trace is also a linear function, meaning that $\mathrm{Tr}(\alpha A+\beta B)=\alpha\,\mathrm{Tr}(A)+\beta\,\mathrm{Tr}(B)$ .

For a density matrix, the diagonal entries are the probabilities of the classical states. Therefore, $\mathrm{Tr}(\rho)=1$ says exactly that those probabilities add up to one: $\Pr(0)+\Pr(1)+\cdots+\Pr(n-1)=1$ .

2. Positive semidefinite

Unit trace guarantees that the probabilities on the diagonal add up to one, but those are only the probabilities for measurements in the classical basis, and a quantum system can be measured in other directions too. For every unit vector $\lvert\psi\rangle$ the quantity $\langle\psi\rvert\rho\lvert\psi\rangle$ is a measurement probability, so it must never come out negative.

\langle\psi\rvert\rho\lvert\psi\rangle\geq 0\quad\text{for every }\lvert\psi\rangle.

A matrix satisfying this is called positive semidefinite, written $\rho\geq 0$ .

Notice that positive semidefinite does not mean that every entry of $\rho$ is nonnegative: the off-diagonal entries can be negative or complex, as the shading above already showed. What must be nonnegative is the number $\langle\psi\rvert\rho\lvert\psi\rangle$ for every possible $\lvert\psi\rangle$ . There are several equivalent ways to recognize this property, describing the same requirement from different viewpoints:

$\langle\psi|\rho|\psi\rangle\geq 0$ for every complex vector $\lvert\psi\rangle$ .This is the physical formulation: every measurement probability must be nonnegative.
$\rho$ is Hermitian, meaning that it equals its $\rho=\rho^\dagger$ , and all its eigenvalues are nonnegative.The second formulation is usually the most useful for calculations.An eigenvalue $\lambda$ of $\rho$ is a number for which there exists a nonzero vector $\lvert v\rangle$ satisfying $\rho\lvert v\rangle=\lambda\lvert v\rangle$ . If we choose $\lvert v\rangle$ to be normalized, multiplying the equation on the left by $\langle v\rvert$ gives $\langle v\rvert\rho\lvert v\rangle=\lambda$ .Eigenvalues are not just some of the possible values of $\langle\psi\rvert\rho\lvert\psi\rangle$ : for a Hermitian matrix, they determine its extreme values. The smallest eigenvalue is the minimum possible value of $\langle\psi\rvert\rho\lvert\psi\rangle$ , and the largest eigenvalue is the maximum possible value. Therefore, $\langle\psi\rvert\rho\lvert\psi\rangle$ can never be negative exactly when the smallest eigenvalue is nonnegative, which is equivalent to all eigenvalues being nonnegative.Hermiticity also guarantees that the eigenvalues are real. For a Hermitian matrix, $\langle v\rvert\rho\lvert v\rangle$ is always real, and for a normalized eigenvector $\langle v\rvert\rho\lvert v\rangle=\lambda$ . Therefore, every eigenvalue $\lambda$ is real.
There exists a matrix $M$ such that $\rho=M^\dagger M$ .The third formulation makes nonnegativity especially transparent: $\langle\psi\rvert\rho\lvert\psi\rangle=\langle\psi\rvert M^\dagger M\lvert\psi\rangle=\bigl\lVert M\lvert\psi\rangle\bigr\rVert^{2}\geq 0$ , because a squared length cannot be negative.

These are not three separate conditions. They are three equivalent ways of expressing the same requirement: $\rho$ must never predict a negative probability.

Testing positivity for a qubit

For a $2\times2$ density matrix, positivity can be checked particularly simply using its eigenvalues. First, however, we must check that $\rho$ is Hermitian, meaning $\rho=\rho^\dagger$ . This guarantees that its eigenvalues are real.

The eigenvalues are the roots of the characteristic equation $\det(\rho-\lambda I)=0$ , which for a $2\times2$ matrix becomes $\lambda^{2}-\mathrm{Tr}(\rho)\,\lambda+\det(\rho)=0$ . Therefore, the two eigenvalues satisfy $\lambda_{1}+\lambda_{2}=\mathrm{Tr}(\rho)=1$ and $\lambda_{1}\lambda_{2}=\det(\rho)$ .

Because the eigenvalues are real and their sum is positive, they cannot both be negative. Therefore, positivity can fail only when one eigenvalue is negative and the other is positive, which happens exactly when their product is negative. Hence, the eigenvalues are both nonnegative exactly when their product is nonnegative, so for a $2\times2$ density matrix $\rho\geq0\iff\det(\rho)\geq0$ , provided that $\rho$ is Hermitian and has trace $1$ .

Applying the two conditions of density matrices

Density matrices

Look-alikes

A=\begin{pmatrix}1&0\\0&0\end{pmatrix}

|0\rangle

|1\rangle

-|0\rangle

-|1\rangle

\lambda_{+}=1.00

\lambda_{-}=0.00

Direction θ30°

\langle\psi|A|\psi\rangle

0.75

$\mathrm{Tr}(A)=1+0=1$ Holds
$M=\left(\begin{smallmatrix}1&0\\0&0\end{smallmatrix}\right),\ \ M^\dagger=\left(\begin{smallmatrix}1&0\\0&0\end{smallmatrix}\right),\ \ M^\dagger M=A$ Holds
$\lambda_{\pm}=\tfrac12\pm\tfrac12=1,\,0$ Holds
$\min_\theta\,\langle\psi|A|\psi\rangle=0.00$ Holds

Constructing positive semidefinite matrices

The third formulation gives a direct way to construct a positive semidefinite matrix. Start with any matrix $M$ and form $A=M^\dagger M$ . By construction, $A$ is positive semidefinite, whatever $M$ is. This does not ensure trace one, so to obtain a density matrix, normalize $A$ by its trace.

Size of M

M=

M^\dagger M=\begin{pmatrix}172&34+169i&-6-71i\\34-169i&261&13-69i\\-6+71i&13+69i&231\end{pmatrix}

\mathrm{Tr}(M^\dagger M)=664

\rho=\dfrac{M^\dagger M}{664}

Connection to state vectors

Every state vector is already a density matrix in disguise. A quantum state vector $\lvert\psi\rangle$ is a column vector of Euclidean norm one, and the density matrix describing that same state is the column multiplied by its own conjugate transpose.

\rho=\lvert\psi\rangle\langle\psi\rvert.

States represented by density matrices of this form are called pure states. Written out with the amplitudes of $\lvert\psi\rangle$ , the product puts $\alpha_{j}\overline{\alpha_{k}}$ in row $j$ and column $k$ .

\lvert\psi\rangle=\begin{pmatrix}\alpha_{0}\\\alpha_{1}\\\vdots\\\alpha_{n-1}\end{pmatrix}\quad\Longrightarrow\quad\lvert\psi\rangle\langle\psi\rvert=\begin{pmatrix}\lvert\alpha_{0}\rvert^{2}&\alpha_{0}\overline{\alpha_{1}}&\cdots&\alpha_{0}\overline{\alpha_{n-1}}\\\alpha_{1}\overline{\alpha_{0}}&\lvert\alpha_{1}\rvert^{2}&\cdots&\alpha_{1}\overline{\alpha_{n-1}}\\\vdots&\vdots&\ddots&\vdots\\\alpha_{n-1}\overline{\alpha_{0}}&\alpha_{n-1}\overline{\alpha_{1}}&\cdots&\lvert\alpha_{n-1}\rvert^{2}\end{pmatrix}

The diagonal carries the squared amplitudes $\lvert\alpha_{j}\rvert^{2}$ , which are exactly the probabilities of the classical states, and the off-diagonal entries carry the relative phases between them.

\lvert0\rangle=\begin{pmatrix}1\\0\end{pmatrix}

\lvert0\rangle\langle0\rvert=\begin{pmatrix}1\\0\end{pmatrix}\begin{pmatrix}1&0\end{pmatrix}=\begin{pmatrix}1&0\\0&0\end{pmatrix}

A pure state also satisfies both conditions of the definition automatically. Its trace is $\lvert\alpha_{0}\rvert^{2}+\cdots+\lvert\alpha_{n-1}\rvert^{2}=1$ , which is what the norm of $\lvert\psi\rangle$ says, and it is positive semidefinite by the third formulation, taking $M=\langle\psi\rvert$ .

Global phase disappears

Remember that a state vector carries a , but this phase has no physical meaning: multiplying $\lvert\psi\rangle$ by $e^{i\theta}$ does not change the physical state. Thus, $\lvert\psi\rangle$ and $\lvert\phi\rangle=e^{i\theta}\lvert\psi\rangle$ represent the same state.

For a pure state, the density matrix is $\rho=\lvert\psi\rangle\langle\psi\rvert$ . If we use $\lvert\phi\rangle$ instead, the global phase cancels.

\lvert\phi\rangle\langle\phi\rvert=\bigl(e^{i\theta}\lvert\psi\rangle\bigr)\bigl(e^{i\theta}\lvert\psi\rangle\bigr)^{\dagger}=e^{i(\theta-\theta)}\lvert\psi\rangle\langle\psi\rvert=\lvert\psi\rangle\langle\psi\rvert.

So the global phase carried by state vectors is simply absent from their density matrices. Two state vectors give the same density matrix exactly when they differ only by a global phase.

Not every state is pure

The density matrices that can be written as $\lvert\psi\rangle\langle\psi\rvert$ describe exactly the states that can already be described by a state vector. But not every density matrix has this form. The others capture randomness, noise, and subsystems of entangled systems—things that a state vector alone cannot describe.

Probabilistic mixtures

A source prepares a qubit in the state $\lvert0\rangle$ half of the time and in the state $\lvert+\rangle$ the other half, then hands it over without saying which one it prepared. Nothing about the qubit is undecided, but our description of it is: we hold one of two definite states and we do not know which.

No state vector says that. Writing $\lvert0\rangle$ or $\lvert+\rangle$ claims knowledge we do not have, and a superposition of the two is a third definite state, prepared by nobody. What we can still do is predict measurements, because we know the recipe the source followed.

Ask any measurement question. It is answered half the time by a qubit in the state $\lvert0\rangle$ and half the time by one in the state $\lvert+\rangle$ , so its probability is the average of the two answers. In general, for a source preparing $\rho$ with probability $p$ and $\sigma$ with probability $1-p$ , every measurement obeys

\Pr(\psi)=p\,\langle\psi\rvert\rho\lvert\psi\rangle+(1-p)\,\langle\psi\rvert\sigma\lvert\psi\rangle=\langle\psi\rvert\bigl(p\rho+(1-p)\sigma\bigr)\lvert\psi\rangle,

where the second equality is just linearity: the sandwich $\langle\psi\rvert\,\cdot\,\lvert\psi\rangle$ passes through the weighted sum. Averaging the probabilities and averaging the matrices give the same predictions, so the single matrix $p\rho+(1-p)\sigma$ already describes the whole preparation.

The same argument runs with any number of choices. If a system is prepared in state $\rho_{k}$ with probability $p_{k}$ , the resulting state is the weighted sum of the $\rho_{k}$ , and when the preparations are state vectors $\lvert\psi_{k}\rangle$ , each contributes the density matrix it makes on its own.

\sum_{k=0}^{m-1}p_{k}\rho_{k}\qquad\text{and}\qquad\sum_{k=0}^{m-1}p_{k}\lvert\psi_{k}\rangle\langle\psi_{k}\rvert.

A weighted sum with nonnegative weights adding to one is a convex combination, so the key property is this: convex combinations of density matrices represent probabilistic mixtures of quantum states. The result is always a density matrix again. Its trace is the average of traces, which is one, and $\langle\psi\rvert\rho\lvert\psi\rangle$ is an average of nonnegative numbers, so it cannot be negative.

Prepared state

\tfrac{1}{2}\lvert0\rangle\langle0\rvert+\tfrac{1}{2}\lvert+\rangle\langle+\rvert=\begin{pmatrix}\tfrac{3}{4}&\tfrac{1}{4}\\\tfrac{1}{4}&\tfrac{1}{4}\end{pmatrix}

Probability of the first state1/2

Classical states are density matrices

Take a classical state $k$ of $\Sigma$ . Its vector representation is $\lvert k\rangle$ , and its density matrix is $\lvert k\rangle\langle k\rvert$ : a matrix with a single $1$ on the diagonal.

If a source prepares state $k$ with probability $p_{k}$ , the resulting density matrix is

\rho=\sum_{k=0}^{n-1}p_{k}\lvert k\rangle\langle k\rvert=\begin{pmatrix}p_{0}&0&\cdots&0\\0&p_{1}&\ddots&\vdots\\\vdots&\ddots&\ddots&0\\0&\cdots&0&p_{n-1}\end{pmatrix}.

Thus a classical probability distribution is exactly a diagonal density matrix. Classical probability sits inside the density-matrix formalism as the diagonal case, and the off-diagonal entries are what allow density matrices to represent genuinely quantum states.

The completely mixed state

The uniform classical distribution has a special name. If all $n$ classical states are equally likely, $p_{k}=1/n$ , the sum collapses to $\rho=\tfrac{1}{n}I$ . For a qubit prepared as $\lvert0\rangle$ or $\lvert1\rangle$ by a fair coin flip,

\tfrac12\lvert0\rangle\langle0\rvert+\tfrac12\lvert1\rangle\langle1\rvert=\tfrac12 I.

This is the completely mixed state. It represents complete uncertainty about the qubit: every measurement, in every basis, gives its two outcomes with equal probability. On the Bloch sphere, it is the centre—the point furthest from every pure state.

The preparation procedure need not use $\lvert0\rangle$ and $\lvert1\rangle$ . Flipping a fair coin between $\lvert+\rangle$ and $\lvert-\rangle$ gives the same density matrix, $\tfrac12\lvert+\rangle\langle+\rvert+\tfrac12\lvert-\rangle\langle-\rvert=\tfrac12 I$ .

The two procedures therefore produce exactly the same physical state. Since the density matrix determines every measurement probability, no experiment on the qubit can distinguish how it was prepared.

Mixing is not superposition

A probabilistic mixture of $\lvert0\rangle$ and $\lvert1\rangle$ is not the same as the superposition $\lvert+\rangle$ . The mixture has density matrix $\tfrac12 I$ , whereas the superposition has

\lvert+\rangle\langle+\rvert=\begin{pmatrix}\tfrac12&\tfrac12\\\tfrac12&\tfrac12\end{pmatrix}\neq\tfrac12 I.

Measuring both in the classical basis gives the same fifty-fifty outcomes, so that measurement alone cannot distinguish them. But measuring in the $\lvert+\rangle,\lvert-\rangle$ basis does: $\lvert+\rangle$ gives $\lvert+\rangle$ with certainty, while the completely mixed state gives each outcome with probability $1/2$ .

The difference is in the off-diagonal entries. A superposition has them, and the classical mixture does not.

One matrix, many preparations

The two preparations of $\tfrac12 I$ above are not a special coincidence. In general, a mixed density matrix can be written as a convex combination of pure states in many different ways. These different decompositions correspond to different preparation procedures, but they all represent the same physical state.

The density matrix does not record which procedure was used. It records exactly what can affect measurement outcomes—and nothing about the preparation history beyond that.

The spectral theorem for density matrices

The states that every normal matrix has an orthonormal basis of eigenvectors. A density matrix is Hermitian, and hence normal, so the theorem applies. Moreover, its eigenvalues are real, and positive semidefiniteness ensures that they are nonnegative. Thus, for an $n\times n$ positive semidefinite matrix $P$ , there is an orthonormal basis $\{\lvert\psi_{0}\rangle,\ldots,\lvert\psi_{n-1}\rangle\}$ and nonnegative real numbers $\lambda_{0},\ldots,\lambda_{n-1}$ such that

P=\sum_{k=0}^{n-1}\lambda_{k}\lvert\psi_{k}\rangle\langle\psi_{k}\rvert.

The decomposition above has an important interpretation. Each projector $\lvert\psi_{k}\rangle\langle\psi_{k}\rvert$ describes a pure state, so the density matrix is expressed as a weighted combination of pure states. We would therefore like to interpret the coefficients $\lambda_{k}$ as probabilities. To do so, we only need to check that they are nonnegative and sum to one.

We already know that $\lambda_{k}\geq 0$ because $\rho$ is positive semidefinite. It remains to check their sum. Each projector $\lvert\psi_{k}\rangle\langle\psi_{k}\rvert$ has trace one, so taking the trace of the spectral decomposition gives

\mathrm{Tr}(\rho)=\sum_{k}\lambda_{k}\,\mathrm{Tr}\bigl(\lvert\psi_{k}\rangle\langle\psi_{k}\rvert\bigr)=\sum_{k}\lambda_{k}.

Since a density matrix has trace one, $\sum_{k}\lambda_{k}=1$ . Thus the eigenvalues are nonnegative numbers summing to one, so they form a probability vector. Writing $p_{k}=\lambda_{k}$ , any $n\times n$ density matrix can therefore be written in terms of an orthonormal basis $\{\lvert\psi_{0}\rangle,\ldots,\lvert\psi_{n-1}\rangle\}$ and a probability vector $(p_{0},\ldots,p_{n-1})$ . This is the spectral decomposition of $\rho$ :

\rho=\sum_{k=0}^{n-1}p_{k}\lvert\psi_{k}\rangle\langle\psi_{k}\rvert.

Every density matrix is therefore a probabilistic mixture of orthogonal pure states, with its eigenvalues as the probabilities. A mixed state can have many different probabilistic preparations, but the spectral decomposition gives one that is determined by the density matrix itself: its eigenstates and their corresponding eigenvalues.

\tfrac12\lvert0\rangle\langle0\rvert+\tfrac12\lvert+\rangle\langle+\rvert=\begin{pmatrix}\tfrac34&\tfrac14\\\tfrac14&\tfrac14\end{pmatrix}

Orthogonal qubit states sit at opposite points of the Bloch sphere, so the spectral decomposition is the segment through the centre: the diameter that the point lies on. Any other preparation joins two states that are not orthogonal, along a chord that misses the centre.

Reading purity off the eigenvalues

The decomposition also settles when a state is pure. If some $p_{k}=1$ , all the other probabilities are zero, so the sum collapses to a single term $\lvert\psi_{k}\rangle\langle\psi_{k}\rvert$ , which is a pure state. On the Bloch sphere, this is a point on the surface. Otherwise, at least two probabilities are nonzero, so the state is a genuine mixture of orthogonal pure states. On the Bloch sphere, this lies inside the sphere.

The Bloch sphere

For a single qubit, a density matrix contains just three independent real numbers. Using them as coordinates turns each state into a point in the Bloch ball: pure states lie on its surface, the Bloch sphere, and mixed states lie inside. The picture lets us read the same state geometrically, while the matrix still tells us its measurement probabilities.

θ = 60°φ = 45°

Two angles locate a pure state: θ moves from pole to pole, and φ turns around the vertical axis.

Polar angle θ60°

Azimuth φ45°

The angle θ sets the sizes of the two amplitudes, while φ sets their relative phase:

\lvert\psi\rangle=\cos\frac{\textcolor{#d97706}{\theta}}2\lvert0\rangle+e^{i\textcolor{#0d9488}{\varphi}}\sin\frac{\textcolor{#d97706}{\theta}}2\lvert1\rangle

For the selected angles:

\begin{aligned}\lvert\psi\rangle&=\cos\left(\frac{60^\circ}{2}\right)\lvert0\rangle+e^{i\,45^\circ}\sin\left(\frac{60^\circ}{2}\right)\lvert1\rangle\\[4pt]&\approx0.87\lvert0\rangle+0.50e^{i\,45^\circ}\lvert1\rangle\end{aligned}

Why this works

Start with the density matrix of a single qubit. It is a $2\times2$ matrix, but its four entries cannot vary independently. Because it is Hermitian, the diagonal entries are real and the two off-diagonal entries are complex conjugates. Its trace is one, so choosing the first diagonal entry also fixes the second. We are therefore left with exactly three real numbers: one diagonal value, and the real and imaginary parts of an off-diagonal entry.

Call these three numbers $a$ , $b$ , and $c$ , with the signs arranged as follows:

\rho=\begin{pmatrix}a&b-ic\\b+ic&1-a\end{pmatrix}.

We now turn these three numbers into three coordinates. Shift and rescale them so that equal diagonal entries lie at height zero and the boundary of the allowed region will have radius one:

r=(r_x,r_y,r_z)=(2b,\,2c,\,2a-1).

We can recover every entry of $\rho$ from these three coordinates, so the point $r$ contains exactly the same information as the density matrix. The vertical coordinate $r_z$ records the difference between the two diagonal probabilities. The other two coordinates record the real and imaginary parts of the off-diagonal entry, including the phase information that the diagonal entries alone cannot describe.

Solving for $a$ , $b$ , and $c$ gives

\rho=\frac12\begin{pmatrix}1+r_z&r_x-ir_y\\r_x+ir_y&1-r_z\end{pmatrix}=\frac{I+r_x\sigma_x+r_y\sigma_y+r_z\sigma_z}{2}.

The expression on the right writes the same matrix in terms of the identity and the three Pauli matrices:

I=\begin{pmatrix}1&0\\0&1\end{pmatrix},\qquad\sigma_x=\begin{pmatrix}0&1\\1&0\end{pmatrix},\qquad\sigma_y=\begin{pmatrix}0&-i\\i&0\end{pmatrix},\qquad\sigma_z=\begin{pmatrix}1&0\\0&-1\end{pmatrix}.

Each matrix supplies one of the three patterns needed to describe $\rho$ : $\sigma_x$ changes the real off-diagonal part, $\sigma_y$ changes the imaginary part, and $\sigma_z$ changes the difference between the diagonal entries. Their coefficients are precisely the three coordinates of the point $r$ .

At this stage, we have mapped every qubit density matrix to a point in ordinary three-dimensional space. The remaining question is: which points are actually allowed?

The answer comes from the final condition on a density matrix: it must be positive semidefinite. The two eigenvalues of $\rho$ depend only on the distance $\lVert r\rVert$ from the origin:

\lambda_\pm=\frac{1\pm\lVert r\rVert}{2}.

Both eigenvalues must be nonnegative. If a point lies farther than one unit from the origin, then $\lambda_-$ becomes negative, so that point cannot represent a quantum state. Conversely, every point with $\lVert r\rVert\le1$ gives a positive semidefinite density matrix. The allowed states therefore fill exactly the unit ball.

The boundary has $\lVert r\rVert=1$ , so its eigenvalues are one and zero. A density matrix with these eigenvalues has rank one and describes a pure state. This is why the surface of the ball is called the Bloch sphere. Points inside the sphere represent mixed states.

At the centre, all three coordinates vanish, leaving $\rho=I/2$ : the completely mixed state. It gives equal probabilities for the two outcomes of every orthonormal measurement basis.

So far, we have described the entire Bloch ball using three coordinates. For a pure state, however, the point lies on the unit sphere, so only two angles are needed to locate it. These are the controls in the first view: $\theta$ measures the angle down from the $\lvert0\rangle$ pole, while $\varphi$ measures the turn around the vertical axis. The ranges $\theta\in[0,\pi]$ and $\varphi\in[0,2\pi)$ cover the whole sphere, and the corresponding state vector is

\lvert\psi\rangle=\cos\frac\theta2\lvert0\rangle+e^{i\varphi}\sin\frac\theta2\lvert1\rangle.

Its density matrix is the outer product $\lvert\psi\rangle\langle\psi\rvert$ :

\lvert\psi\rangle\langle\psi\rvert=\begin{pmatrix}\cos^2\frac\theta2&e^{-i\varphi}\cos\frac\theta2\sin\frac\theta2\\e^{i\varphi}\cos\frac\theta2\sin\frac\theta2&\sin^2\frac\theta2\end{pmatrix}.

Euler’s formula $e^{i\varphi}=\cos\varphi+i\sin\varphi$ and the half-angle identities

\cos^2\frac\theta2=\frac{1+\cos\theta}2,\qquad\sin^2\frac\theta2=\frac{1-\cos\theta}2,\qquad\cos\frac\theta2\sin\frac\theta2=\frac{\sin\theta}2

rewrite these entries in the Pauli form:

\lvert\psi\rangle\langle\psi\rvert=\frac{I+\sin\theta\cos\varphi\,\sigma_x+\sin\theta\sin\varphi\,\sigma_y+\cos\theta\,\sigma_z}2.

Reading off the coefficients gives the coordinates of the point:

r=(\sin\theta\cos\varphi,\,\sin\theta\sin\varphi,\,\cos\theta).

This is exactly the unit vector pointing in the direction specified by the two angles. The two descriptions therefore capture the same state from two complementary viewpoints: the angles specify where the point is on the sphere, while the coordinates give the coefficients of the Pauli matrices in its density matrix. A global phase does not change the outer product $\lvert\psi\rangle\langle\psi\rvert$ , so it does not change the point on the Bloch sphere either.

This complete description by a single three-dimensional ball is special to a single qubit. An $n$ -qubit density matrix has $4^n-1$ independent real parameters — already fifteen for two qubits. The allowed states therefore form a convex body in a $4^n-1$ -dimensional space, not a three-dimensional ball.

We can still draw the reduced state of each individual qubit as a point in its own Bloch ball, but those separate pictures do not capture everything about the joint state. In particular, they cannot represent all the correlations between the qubits.

Density matrices of multiple systems

Every density matrix so far has described one system, but nothing in the definition says how many systems that is. It asks for a square matrix whose rows and columns are indexed by the classical states of the system in question, with trace one and positive semidefinite. The only thing a system contributes to that is its set of classical states, so moving to several systems is a question of what to index by, not a new definition.

We answer it the way we did for state vectors. A pair $(\mathsf{X},\mathsf{Y})$ is treated as one compound system, whose classical states are the pairs $(a,b)$ in the Cartesian product $\Sigma\times\Gamma$ . That product is the new index set, rows and columns are labelled by its elements, and the two conditions are unchanged.

For two qubits that means a $4\times4$ matrix whose rows and columns are labelled $\lvert00\rangle,\lvert01\rangle,\lvert10\rangle,\lvert11\rangle$ in lexicographic order, exactly as for the state vectors. Everything we saw for a single system carries over unchanged: a pure state is still $\lvert\psi\rangle\langle\psi\rvert$ , mixtures are still convex combinations, and the spectral decomposition still applies.

The four Bell states are pure, so each one is the outer product of its own state vector. Writing them out makes it clear how their differences appear in the density matrix.

\lvert\phi^{+}\rangle\langle\phi^{+}\rvert=\begin{pmatrix}\textcolor{#7c3aed}{\tfrac12}&0&0&\textcolor{#d97706}{\tfrac12}\\0&\textcolor{#7c3aed}{0}&0&0\\0&0&\textcolor{#7c3aed}{0}&0\\\textcolor{#d97706}{\tfrac12}&0&0&\textcolor{#7c3aed}{\tfrac12}\end{pmatrix}\qquad\lvert\phi^{-}\rangle\langle\phi^{-}\rvert=\begin{pmatrix}\textcolor{#7c3aed}{\tfrac12}&0&0&\textcolor{#d97706}{-\tfrac12}\\0&\textcolor{#7c3aed}{0}&0&0\\0&0&\textcolor{#7c3aed}{0}&0\\\textcolor{#d97706}{-\tfrac12}&0&0&\textcolor{#7c3aed}{\tfrac12}\end{pmatrix}

\lvert\psi^{+}\rangle\langle\psi^{+}\rvert=\begin{pmatrix}\textcolor{#7c3aed}{0}&0&0&0\\0&\textcolor{#7c3aed}{\tfrac12}&\textcolor{#d97706}{\tfrac12}&0\\0&\textcolor{#d97706}{\tfrac12}&\textcolor{#7c3aed}{\tfrac12}&0\\0&0&0&\textcolor{#7c3aed}{0}\end{pmatrix}\qquad\lvert\psi^{-}\rangle\langle\psi^{-}\rvert=\begin{pmatrix}\textcolor{#7c3aed}{0}&0&0&0\\0&\textcolor{#7c3aed}{\tfrac12}&\textcolor{#d97706}{-\tfrac12}&0\\0&\textcolor{#d97706}{-\tfrac12}&\textcolor{#7c3aed}{\tfrac12}&0\\0&0&0&\textcolor{#7c3aed}{0}\end{pmatrix}

The two $\phi$ states have the same diagonal and differ only in the signs of the corner entries, and the same is true of the two $\psi$ states. Since the diagonal holds the probabilities of a standard-basis measurement, those measurements cannot distinguish the members of a pair. The signs that do distinguish them sit off the diagonal, in the entries that encode the coherence between the basis states. This is the distinction between a superposition and a mixture.

Independence is a tensor product

If $\mathsf{X}$ is prepared in the state $\rho$ and, independently, $\mathsf{Y}$ is prepared in the state $\sigma$ , then the pair is in the state $\rho\otimes\sigma$ . States of this form are called product states.

The same rule follows naturally from the definition of a density matrix. If $\lvert\psi\rangle$ and $\lvert\pi\rangle$ are prepared independently, the pair is $\lvert\psi\rangle\otimes\lvert\pi\rangle$ , whose density matrix is

\bigl(\lvert\psi\rangle\otimes\lvert\pi\rangle\bigr)\bigl(\langle\psi\rvert\otimes\langle\pi\rvert\bigr)=\bigl(\lvert\psi\rangle\langle\psi\rvert\bigr)\otimes\bigl(\lvert\pi\rangle\langle\pi\rvert\bigr)

For instance, suppose one qubit is prepared in the state $\lvert0\rangle$ and another comes from a completely noisy source. The first factor is pure and the second is completely mixed, so their joint state is

\lvert0\rangle\langle0\rvert\otimes\tfrac12 I=\lvert0\rangle\langle0\rvert\otimes\bigl(\tfrac12\lvert0\rangle\langle0\rvert+\tfrac12\lvert1\rangle\langle1\rvert\bigr)=\begin{pmatrix}\tfrac12&0&0&0\\0&\tfrac12&0&0\\0&0&0&0\\0&0&0&0\end{pmatrix}

Correlation between systems

A density matrix that cannot be written as a product state contains correlation between the two systems: learning something about one of them tells us something about the other. Correlation is not by itself a quantum phenomenon, and the simplest example is entirely classical. Alice and Bob share a uniform random bit, each holding a copy of it.

\tfrac12\,\lvert0\rangle\langle0\rvert\otimes\lvert0\rangle\langle0\rvert+\tfrac12\,\lvert1\rangle\langle1\rvert\otimes\lvert1\rangle\langle1\rvert=\begin{pmatrix}\tfrac12&0&0&0\\0&0&0&0\\0&0&0&0\\0&0&0&\tfrac12\end{pmatrix}

This is a mixture of two product states, but it is not itself a product state.

A product state is a joint state of the form $\rho\otimes\sigma$ , where $\rho$ describes the first system and $\sigma$ describes the second. It represents two systems whose joint probabilities factor into independent probabilities for the two systems. The diagonal of a product state contains the joint probabilities of the two standard-basis measurements. For a product $\rho\otimes\sigma$ of two qubit states, those entries are $\rho_{00}\sigma_{00},\ \rho_{00}\sigma_{11},\ \rho_{11}\sigma_{00},\ \rho_{11}\sigma_{11}$ .

Now look at the diagonal of the state above. The first entry is $\tfrac12$ , so both $\rho_{00}$ and $\sigma_{00}$ must be nonzero. The third entry is zero, so $\rho_{11}=0$ . But then the fourth entry, $\rho_{11}\sigma_{11}$ , must also be zero, whereas here it is $\tfrac12$ . This is a contradiction.

The argument only used the diagonal, so it rules out a product state for every density matrix with this diagonal. One such density matrix is $\lvert\phi^{+}\rangle\langle\phi^{+}\rvert$ . We already know that this state is not a product state, but now we can see why from the diagonal alone: its joint probabilities cannot be written as independent probabilities for the two qubits. The corner entries are not needed at all.

Recording which state was prepared

A classical label lets us keep a record of which state was prepared instead of averaging the possibilities into a single mixed state. Suppose a source chooses $k$ with probability $p_{k}$ and prepares the state $\rho_{k}$ . The probabilities satisfy $p_{k}\geq0$ and $\sum_{k=0}^{m-1}p_{k}=1$ , and all the density matrices $\rho_{k}$ have the same dimensions. If we record the value of $k$ in a classical register alongside the system, we obtain an ensemble: a collection of possible states together with the probabilities with which they are prepared.

\sum_{k=0}^{m-1}p_{k}\,\lvert k\rangle\langle k\rvert\otimes\rho_{k}

Here $\lvert k\rangle\langle k\rvert$ records the classical value $k$ , while $\rho_{k}$ is the state prepared when that value is chosen. The label therefore tells us which state was prepared, and the two are correlated: knowing $k$ tells us exactly which $\rho_{k}$ to expect.

If the label is discarded, only the system remains, and its state becomes the mixture $\sum_{k}p_{k}\rho_{k}$ .

Separable states vs entanglement

A state is separable if it can be written as a mixture of product states:

\rho=\sum_{k=0}^{m-1}p_{k}\,\rho_{k}\otimes\sigma_{k}

This has a simple preparation interpretation: choose $k$ with probability $p_{k}$ , then prepare $\rho_{k}$ on one side and $\sigma_{k}$ on the other. The two systems can therefore be correlated, but all their correlations come from a shared classical random choice.

A state that cannot be written in this form is entangled. For pure states, this reduces to the familiar distinction: a pure state is separable exactly when it is a product state. The difference matters for mixed states, where a mixture of product states can be correlated without being entangled.

The definition is simple to state but difficult to apply. To prove that a state is separable, it is enough to find one decomposition of this form. To prove that it is entangled, every such decomposition must be ruled out.

Reduced states and the partial trace

A system can also be part of a larger one. Alice and Bob share an e-bit: Alice holds $\mathsf{A}$ , Bob holds $\mathsf{B}$ , and the pair is in the state

\lvert\phi^{+}\rangle=\frac{1}{\sqrt2}\lvert00\rangle+\frac{1}{\sqrt2}\lvert11\rangle

Alice can hold her qubit, measure it, and operate on it without ever touching Bob’s, so she needs a description of her qubit on its own—a state that gives the probabilities of all measurements she can perform. A state vector describes the pair as a whole, but it cannot describe Alice’s qubit alone: because the pair is entangled, the joint state cannot be written as a tensor product of a state for $\mathsf{A}$ and a state for $\mathsf{B}$ . We therefore need a different kind of description for one part of an entangled system.

Suppose Bob measures his qubit in the standard basis. We already know what that does to an e-bit.

Outcome	Probability	Resulting state of $\mathsf{A}$
$0$	$\tfrac12$	$\lvert0\rangle$
$1$	$\tfrac12$	$\lvert1\rangle$

If Alice does not learn which outcome Bob obtained, her qubit is a probabilistic mixture of the two:

\tfrac12\lvert0\rangle\langle0\rvert+\tfrac12\lvert1\rangle\langle1\rvert=\tfrac12 I

Alice’s qubit is therefore in the completely mixed state. But this is not merely the state Alice would have after Bob happened to measure. Bob need not measure at all. Whatever Bob does to his qubit—or whether he does anything—cannot change the probabilities of Alice’s measurements. Otherwise, Alice could learn what Bob chose to do from her own measurement outcomes, allowing them to signal instantaneously at a distance.

So $\tfrac12 I$ is not a description of what happens after Bob measures. It is the description of Alice’s qubit itself. This is the reduced state of $\mathsf{A}$ . Imagining a measurement on $\mathsf{B}$ was only a way to derive it.

The reduced state in general

The e-bit example suggests a general strategy. To describe $\mathsf{A}$ alone, imagine measuring $\mathsf{B}$ in some basis, find the state that $\mathsf{A}$ would have for each possible outcome, and then average over those outcomes. We now carry out that construction for an arbitrary pure state $\lvert\psi\rangle$ of a pair $(\mathsf{A},\mathsf{B})$ .

Choose a basis $\{\lvert b\rangle\}$ for $\mathsf{B}$ , with classical state set $\Gamma$ . Grouping the terms of $\lvert\psi\rangle$ according to the state of $\mathsf{B}$ gives

\begin{aligned}\lvert\psi\rangle&=\sum_{b\in\Gamma}\lvert\phi_{b}\rangle\otimes\lvert b\rangle\\[6pt]\lvert\phi_{b}\rangle&=\bigl(I_{\mathsf{A}}\otimes\langle b\rvert\bigr)\lvert\psi\rangle\end{aligned}

The vectors $\lvert\phi_{b}\rangle$ are determined by the chosen basis and need not be normalised. This is useful because their squared lengths give the probabilities of the corresponding outcomes: measuring $\mathsf{B}$ in this basis gives $b$ with probability $\lVert\lvert\phi_{b}\rangle\rVert^{2}$ . When that probability is nonzero, the resulting state of $\mathsf{A}$ is the normalised vector $\lvert\phi_{b}\rangle/\lVert\lvert\phi_{b}\rangle\rVert$ .

To describe $\mathsf{A}$ without keeping track of which outcome occurred, we average these states using their probabilities. The normalisation factors cancel:

\sum_{b\,:\,\lVert\lvert\phi_{b}\rangle\rVert>0}\lVert\lvert\phi_{b}\rangle\rVert^{2}\cdot\frac{\lvert\phi_{b}\rangle\langle\phi_{b}\rvert}{\lVert\lvert\phi_{b}\rangle\rVert^{2}}=\sum_{b\in\Gamma}\lvert\phi_{b}\rangle\langle\phi_{b}\rvert

For an outcome with zero probability, $\lvert\phi_{b}\rangle=0$ , so its outer product contributes nothing. We can therefore include every basis state in the sum.

Substituting the definition of $\lvert\phi_{b}\rangle$ gives the reduced state directly in terms of the density matrix of the pair:

\rho_{\mathsf{A}}=\sum_{b\in\Gamma}\bigl(I_{\mathsf{A}}\otimes\langle b\rvert\bigr)\lvert\psi\rangle\langle\psi\rvert\bigl(I_{\mathsf{A}}\otimes\lvert b\rangle\bigr)

At this point, $\lvert\psi\rangle\langle\psi\rvert$ is the only thing that identifies the pair as being in a pure state. The same expression makes sense for an arbitrary density matrix $\rho$ , so this gives the general definition of the reduced state of $\mathsf{A}$ :

\rho_{\mathsf{A}}=\sum_{b\in\Gamma}\bigl(I_{\mathsf{A}}\otimes\langle b\rvert\bigr)\rho\bigl(I_{\mathsf{A}}\otimes\lvert b\rangle\bigr)

Exchanging the roles of the two systems gives the reduced state of $\mathsf{B}$ :

\rho_{\mathsf{B}}=\sum_{a\in\Sigma}\bigl(\langle a\rvert\otimes I_{\mathsf{B}}\bigr)\rho\bigl(\lvert a\rangle\otimes I_{\mathsf{B}}\bigr)

The partial trace

The formula for the reduced state has a name. To obtain the state of $\mathsf{A}$ alone, we discard $\mathsf{B}$ . This operation is called the partial trace over $\mathsf{B}$ and is written $\mathrm{Tr}_{\mathsf{B}}$ . Similarly, $\mathrm{Tr}_{\mathsf{A}}$ traces out $\mathsf{A}$ and leaves the state of $\mathsf{B}$ .

The reduced states are therefore:

\begin{aligned}\rho_{\mathsf{A}}&=\sum_{b\in\Gamma}\bigl(I_{\mathsf{A}}\otimes\langle b\rvert\bigr)\rho\bigl(I_{\mathsf{A}}\otimes\lvert b\rangle\bigr)=\mathrm{Tr}_{\mathsf{B}}(\rho)\\[6pt]\rho_{\mathsf{B}}&=\sum_{a\in\Sigma}\bigl(\langle a\rvert\otimes I_{\mathsf{B}}\bigr)\rho\bigl(\lvert a\rangle\otimes I_{\mathsf{B}}\bigr)=\mathrm{Tr}_{\mathsf{A}}(\rho)\end{aligned}

The name comes from what the operation does to tensor products. For square matrices $M$ and $N$ , the partial trace takes the ordinary trace of the factor being discarded and leaves the other factor unchanged:

\begin{aligned}\mathrm{Tr}_{\mathsf{A}}(M\otimes N)&=\mathrm{Tr}(M)\,N\\[6pt]\mathrm{Tr}_{\mathsf{B}}(M\otimes N)&=\mathrm{Tr}(N)\,M\end{aligned}

It is useful to see what the partial trace does to the entries of a density matrix. Write a two-qubit density matrix as four $2\times2$ blocks, one for each pair of basis states of $\mathsf{A}$ :

\rho=\begin{pmatrix}C_{00}&C_{01}\\C_{10}&C_{11}\end{pmatrix}

Then $\mathrm{Tr}_{\mathsf{A}}$ adds the two diagonal blocks, while $\mathrm{Tr}_{\mathsf{B}}$ takes the ordinary trace of each block:

\mathrm{Tr}_{\mathsf{A}}(\rho)=C_{00}+C_{11}

\mathrm{Tr}_{\mathsf{B}}(\rho)=\begin{pmatrix}\mathrm{Tr}(C_{00})&\mathrm{Tr}(C_{01})\\\mathrm{Tr}(C_{10})&\mathrm{Tr}(C_{11})\end{pmatrix}

For example, suppose the pair is prepared as $\lvert0\rangle\otimes\lvert0\rangle$ or $\lvert1\rangle\otimes\lvert+\rangle$ with equal probability:

\rho=\tfrac12\,\lvert0\rangle\langle0\rvert\otimes\lvert0\rangle\langle0\rvert+\tfrac12\,\lvert1\rangle\langle1\rvert\otimes\lvert+\rangle\langle+\rvert

Applying the partial trace to each term gives

\rho_{\mathsf{A}}=\tfrac12\lvert0\rangle\langle0\rvert+\tfrac12\lvert1\rangle\langle1\rvert=\tfrac12 I

\rho_{\mathsf{B}}=\tfrac12\lvert0\rangle\langle0\rvert+\tfrac12\lvert+\rangle\langle+\rvert

Tracing out multiple systems

The same idea works for any number of systems. We can divide a compound system into the part we keep and the part we discard, and then trace out whichever systems we do not need.

For a triple $(\mathsf{A},\mathsf{B},\mathsf{C})$ in the state $\rho$ , tracing out $\mathsf{B}$ leaves the state of $(\mathsf{A},\mathsf{C})$ :

\rho_{\mathsf{AC}}=\sum_{b\in\Gamma}\bigl(I_{\mathsf{A}}\otimes\langle b\rvert\otimes I_{\mathsf{C}}\bigr)\rho\bigl(I_{\mathsf{A}}\otimes\lvert b\rangle\otimes I_{\mathsf{C}}\bigr)

Tracing out both $\mathsf{A}$ and $\mathsf{B}$ leaves the state of $\mathsf{C}$ :

\rho_{\mathsf{C}}=\sum_{a\in\Sigma}\sum_{b\in\Gamma}\bigl(\langle a\rvert\otimes\langle b\rvert\otimes I_{\mathsf{C}}\bigr)\rho\bigl(\lvert a\rangle\otimes\lvert b\rangle\otimes I_{\mathsf{C}}\bigr)

Systems can also be traced out one at a time. Tracing out $\mathsf{B}$ and then $\mathsf{A}$ gives the same $\rho_{\mathsf{C}}$ as tracing out both together.

What information do reduced states lose?

The reduced states of a pair do not contain enough information to reconstruct the joint state. Two different joint states can give exactly the same state for $\mathsf{A}$ and exactly the same state for $\mathsf{B}$ . The difference can live entirely in the correlations between them.

Joint state

\lvert\phi^+\rangle=\frac{\lvert00\rangle+\lvert11\rangle}{\sqrt2}

Joint state of A and B

Basis: $\lvert00\rangle,\lvert01\rangle,\lvert10\rangle,\lvert11\rangle$

\rho_{\mathsf{AB}}=\begin{pmatrix}\textcolor{#7c3aed}{\tfrac12}&0&0&\textcolor{#7c3aed}{\tfrac12}\\0&0&0&0\\0&0&0&0\\\textcolor{#7c3aed}{\tfrac12}&0&0&\textcolor{#7c3aed}{\tfrac12}\end{pmatrix}

Standard-basis measurement

Reduced state of A

\rho_{\mathsf{A}}=\begin{pmatrix}\tfrac12&0\\0&\tfrac12\end{pmatrix}

Trace out B.

Reduced state of B

\rho_{\mathsf{B}}=\begin{pmatrix}\tfrac12&0\\0&\tfrac12\end{pmatrix}

Trace out A.

Quantum channels

So far, density matrices have been used to describe quantum states, while matrices such as $U$ have been used to describe unitary transformations of pure states. But a quantum system does not undergo only ideal unitary transformations. It can be measured, reset, sent through a noisy device, or interact with another system that is then discarded. A general framework is therefore needed to describe these processes.

That framework is provided by quantum channels. A quantum channel is a physical transformation that takes a quantum state as input and produces another quantum state as output. The name channel comes from viewing a quantum system as passing through a process: the input is the state before the process, and the output is the state afterwards.

Channels are usually denoted by capital Greek letters such as $\Phi$ , $\Psi$ , and $\Xi$ . If a channel $\Phi$ is applied to a system in the state $\rho$ , the resulting state is written $\Phi(\rho)$ .

What makes a mapping a channel

Not every mapping from matrices to matrices represents a physically possible transformation. Two requirements distinguish valid channels.

Channels are linear mappings. If a state is prepared as a mixture of two states, the channel must produce the same mixture of the two corresponding outputs:
$\Phi\bigl(p\rho+(1-p)\sigma\bigr)=p\,\Phi(\rho)+(1-p)\,\Phi(\sigma)$
Channels preserve density matrices, even as part of a larger system. Applying a channel to a density matrix must produce another density matrix. This must remain true when the input system is one part of a larger system, including when the two systems are entangled.

The second requirement is stronger than simply checking that $\Phi(\rho)$ is a density matrix for every density matrix $\rho$ . It is what allows the channel to act on a subsystem of a larger quantum system.

Input and output systems

Every channel $\Phi$ has an input system $\mathsf{X}$ and an output system $\mathsf{Y}$ . Conceptually, $\Phi$ transforms $\mathsf{X}$ into $\mathsf{Y}$ . The input is the system before the transformation, and the output is the system afterwards.

The input and output systems can also be the same. This is the case we encounter most often. Then $\Phi$ simply changes the state of a system, as a gate changes the state of the qubit it acts on.

Acting on part of a compound system

To see why the second requirement matters, suppose $\mathsf{Z}$ is an additional system with classical state set $\Gamma$ , and the pair $(\mathsf{Z},\mathsf{X})$ is in the state $\rho$ . Choose the basis $\{\lvert a\rangle:a\in\Gamma\}$ for $\mathsf{Z}$ . Every density matrix of the pair can then be written by grouping its entries according to the basis states of $\mathsf{Z}$ :

\rho=\sum_{a,b\in\Gamma}\lvert a\rangle\langle b\rvert\otimes\rho_{a,b}

The matrices $\rho_{a,b}$ are not generally density matrices themselves. They are simply the blocks of $\rho$ corresponding to the pair of basis states $a$ and $b$ of $\mathsf{Z}$ .

Now apply $\Phi$ to $\mathsf{X}$ alone. The system $\mathsf{Z}$ is left untouched, while $\mathsf{X}$ is transformed into $\mathsf{Y}$ . The resulting state of $(\mathsf{Z},\mathsf{Y})$ is

\sum_{a,b\in\Gamma}\lvert a\rangle\langle b\rvert\otimes\Phi(\rho_{a,b})

Nothing was done to $\mathsf{Z}$ , so the factors $\lvert a\rangle\langle b\rvert$ remain unchanged. By linearity, $\Phi$ acts separately on every block $\rho_{a,b}$ .

If $\Gamma=\{0,\ldots,m-1\}$ , we can see the same transformation as a statement about block matrices. Write $\rho$ as an $m\times m$ grid of blocks, one for each pair of basis states of $\mathsf{Z}$ . The channel is then applied to every block:

\rho=\begin{pmatrix}\rho_{0,0}&\cdots&\rho_{0,m-1}\\\vdots&\ddots&\vdots\\\rho_{m-1,0}&\cdots&\rho_{m-1,m-1}\end{pmatrix}\;\longmapsto\;\begin{pmatrix}\Phi(\rho_{0,0})&\cdots&\Phi(\rho_{0,m-1})\\\vdots&\ddots&\vdots\\\Phi(\rho_{m-1,0})&\cdots&\Phi(\rho_{m-1,m-1})\end{pmatrix}

For $\Phi$ to be a valid channel, the matrix on the right must be a density matrix for every choice of the system $\mathsf{Z}$ and every density matrix $\rho$ on the joint system $\mathsf{Z}\otimes\mathsf{X}$ .

Testing whether a mapping is a quantum channel

Valid channels

Invalid mappings

\Phi(A)=A^{\mathsf T}

One qubit on its own

|{+i}\rangle=\frac{|0\rangle+i|1\rangle}{\sqrt2}

\frac12\begin{pmatrix}1&-i\\i&1\end{pmatrix}\;\longmapsto\;\frac12\begin{pmatrix}1&i\\-i&1\end{pmatrix}

All ≥ 0Trace = 1

Half of an entangled pair

|\phi^+\rangle=\frac{|00\rangle+|11\rangle}{\sqrt2}

\frac12\begin{pmatrix}1&0&0&1\\0&0&0&0\\0&0&0&0\\1&0&0&1\end{pmatrix}\;\longmapsto\;\frac12\begin{pmatrix}1&0&0&0\\0&0&1&0\\0&1&0&0\\0&0&0&1\end{pmatrix}

Negative eigenvalueTrace = 1

Unitary channels

The familiar has a direct description in terms of density matrices. If $U$ is a unitary matrix acting on a system $\mathsf{X}$ , then $\lvert\psi\rangle\to U\lvert\psi\rangle$ becomes $\rho\to U\rho U^{\dagger}$ , so the corresponding channel is $\Phi(\rho)=U\rho U^{\dagger}$ .

Channels of this form are called unitary channels. They transform $\mathsf{X}$ into itself, so the input and output systems are the same. For a pure state $\rho=\lvert\psi\rangle\langle\psi\rvert$ , this gives $\Phi(\rho)=U\lvert\psi\rangle\langle\psi\rvert U^{\dagger}=\bigl(U\lvert\psi\rangle\bigr)\bigl(U\lvert\psi\rangle\bigr)^{\dagger}$ , exactly recovering the familiar transformation.

A unitary channel satisfies both requirements for a physical channel:

It is linear: if the input state is a mixture of two states, the output is the same mixture of the two outputs. In other words, applying the channel does not change the probabilities in the mixture. For a mixture $p\rho+(1-p)\sigma$ , the channel must act as $\Phi\bigl(p\rho+(1-p)\sigma\bigr)=p\,\Phi(\rho)+(1-p)\,\Phi(\sigma)$ .

For the unitary channel $\Phi(\rho)=U\rho U^{\dagger}$ , this follows directly:

\Phi\bigl(p\rho+(1-p)\sigma\bigr)=U\bigl(p\rho+(1-p)\sigma\bigr)U^{\dagger}=p\,U\rho U^{\dagger}+(1-p)\,U\sigma U^{\dagger}=p\,\Phi(\rho)+(1-p)\,\Phi(\sigma)

It is also completely positive. This means that the channel must remain valid when $\mathsf{X}$ is part of a larger system. Suppose $\mathsf{Z}$ is another system and the joint state of $(\mathsf{Z},\mathsf{X})$ is $\rho$ . Applying $\Phi$ to $\mathsf{X}$ alone gives $\bigl(I_{\mathsf{Z}}\otimes U\bigr)\rho\bigl(I_{\mathsf{Z}}\otimes U\bigr)^{\dagger}$ .

But $I_{\mathsf{Z}}\otimes U$ is itself unitary. So this is simply a unitary transformation of the joint state, which preserves the properties required of a density matrix: its trace remains one, and positive semidefiniteness is preserved. Therefore the result is a valid density matrix for every larger system $\mathsf{Z}$ and every joint state $\rho$ .

The simplest choice for $U$ is the identity matrix $I$ . We call the resulting channel the identity channel, $\mathrm{Id}(\rho)=\rho$ . It leaves the state unchanged.

Convex combinations of channels

Density matrices let us average states, and we can do the same with channels. Let $\Phi_{0}$ and $\Phi_{1}$ be channels from $\mathsf{X}$ to $\mathsf{Y}$ , and let $p\in[0,1]$ . If we choose $\Phi_{0}$ with probability $p$ and $\Phi_{1}$ with probability $1-p$ , the resulting channel is

\Psi=p\,\Phi_{0}+(1-p)\,\Phi_{1}

Applied to a state $\rho$ , this channel produces the corresponding mixture of the two outputs:

\Psi(\rho)=\bigl(p\,\Phi_{0}+(1-p)\,\Phi_{1}\bigr)(\rho)=p\,\Phi_{0}(\rho)+(1-p)\,\Phi_{1}(\rho)

More generally, if $\Phi_{0},\ldots,\Phi_{m-1}$ are channels and $(p_{0},\ldots,p_{m-1})$ is a probability vector, we can choose channel $\Phi_{k}$ with probability $p_{k}$ . Their convex combination is again a channel, and its action on a state $\rho$ is described by

\Psi=\sum_{k=0}^{m-1}p_{k}\Phi_{k}

\Psi(\rho)=\sum_{k=0}^{m-1}p_{k}\Phi_{k}(\rho)

It is linear because each $\Phi_{k}$ is linear. Its output is a probabilistic mixture of density matrices, so it is again a density matrix. The same reasoning applies when the channel acts on part of a larger system: each $\Phi_{k}$ produces a valid joint state, and their mixture is valid as well.

A random-operation channel in action

Input state

Choose between

One run · one pure output

Chance of applying Z50%

Choice unknown · average output

Distance from the center0.00

Maximally mixed

\Psi(\rho)=\textcolor{#0284c7}{\tfrac{1}{2}}\,\rho+\textcolor{#0f766e}{\tfrac{1}{2}}\,Z\rho Z^{\dagger}=\textcolor{#7c3aed}{\begin{pmatrix}\tfrac{1}{2}&0\\0&\tfrac{1}{2}\end{pmatrix}}

Common non-unitary quantum channels

Three channels appear often enough to have names of their own. They describe physical processes that cannot be represented by a unitary gate alone, including resetting a qubit and different forms of noise.

The qubit reset channel

The qubit reset channel discards the state a qubit is in and prepares $|0\rangle$ : $\Lambda(\rho)=\mathrm{Tr}(\rho)\,|0\rangle\langle0|$ .

Input state

The output is always |0⟩, whatever the input.

Resetting a qubit destroys entanglement

Every input ends at the same place, so the output contains no information about the input state. The fixed output is $|0\rangle\langle0|$ . To extend this idea from normalized states to arbitrary matrices, the channel is defined as $\Lambda(X)=\mathrm{Tr}(X)\,|0\rangle\langle0|$ .

For a density matrix, $\mathrm{Tr}(X)=1$ , so this simply gives $|0\rangle\langle0|$ . The trace factor is what makes the map linear on arbitrary matrices as well.

To see how the trace factor determines the action of the reset channel, look at the four basis operators. Since the trace is the sum of the diagonal entries, each diagonal projector has trace 1. The reset channel therefore maps both of them to the fixed state $|0\rangle\langle0|$ :

\begin{aligned}&|0\rangle\langle0|=\begin{pmatrix}1&0\\0&0\end{pmatrix},\qquad|1\rangle\langle1|=\begin{pmatrix}0&0\\0&1\end{pmatrix}\\[4pt]&\Lambda(|0\rangle\langle0|)=\Lambda(|1\rangle\langle1|)=|0\rangle\langle0|\end{aligned}

The off-diagonal operators have no diagonal entries, so their trace is 0. The reset channel therefore maps both of them to zero:

\begin{aligned}&|0\rangle\langle1|=\begin{pmatrix}0&1\\0&0\end{pmatrix},\qquad|1\rangle\langle0|=\begin{pmatrix}0&0\\1&0\end{pmatrix}\\[4pt]&\Lambda(|0\rangle\langle1|)=\Lambda(|1\rangle\langle0|)=0\end{aligned}

Now consider two qubits, A and B, with A first, in the Bell state:

|\phi^+\rangle=(|00\rangle+|11\rangle)/\sqrt2

Writing the Bell state as a density matrix gives four terms:

|\phi^+\rangle\langle\phi^+|=\tfrac12|0\rangle\langle0|\otimes|0\rangle\langle0|+\tfrac12|0\rangle\langle1|\otimes|0\rangle\langle1|+\tfrac12|1\rangle\langle0|\otimes|1\rangle\langle0|+\tfrac12|1\rangle\langle1|\otimes|1\rangle\langle1|

Now apply the reset channel to qubit A, leaving B unchanged. In each term, the channel therefore acts only on the first factor. The two off-diagonal terms disappear, while both diagonal terms acquire the same first factor, $|0\rangle\langle0|$ :

\begin{aligned}(\Lambda\otimes\mathrm{Id})(|\phi^+\rangle\langle\phi^+|)&=\tfrac12\Lambda(|0\rangle\langle0|)\otimes|0\rangle\langle0|+\tfrac12\Lambda(|0\rangle\langle1|)\otimes|0\rangle\langle1|+\tfrac12\Lambda(|1\rangle\langle0|)\otimes|1\rangle\langle0|+\tfrac12\Lambda(|1\rangle\langle1|)\otimes|1\rangle\langle1|\\&=\tfrac12|0\rangle\langle0|\otimes|0\rangle\langle0|+0+0+\tfrac12|0\rangle\langle0|\otimes|1\rangle\langle1|\\&=|0\rangle\langle0|\otimes\tfrac12\bigl(|0\rangle\langle0|+|1\rangle\langle1|\bigr)\\&=|0\rangle\langle0|\otimes\frac{I}{2}\end{aligned}

The reset channel breaks the entanglement between A and B: A is replaced by the fixed state $|0\rangle$ , while B is left in its original reduced state $I/2$ . The pair is no longer correlated—the output is simply the product state $|0\rangle\langle0|\otimes I/2$ .

The completely dephasing channel

The completely dephasing channel zeros out the off-diagonal matrix entries, keeping the chances of measuring 0 or 1 while erasing the phase coherence that lets those possibilities interfere:

\Delta\!\begin{pmatrix}\alpha_{00}&\alpha_{01}\\\alpha_{10}&\alpha_{11}\end{pmatrix}=\begin{pmatrix}\alpha_{00}&0\\0&\alpha_{11}\end{pmatrix}

Input state

Phase coherence0.80 → 0.00

Noise strength ε100%

No noiseComplete dephasing

The 0/1 probabilities stay fixed while phase coherence fades.

Dephasing destroys coherence but keeps correlation

Averaging the complete channel with the identity channel gives a partial one, applying $\Delta$ with probability $\varepsilon$ and leaving the state alone otherwise. It shrinks the off-diagonal entries by $1-\varepsilon$ rather than removing them, so $\varepsilon=0$ leaves the state unchanged and $\varepsilon=1$ is complete dephasing:

\begin{aligned}&\Delta_{\varepsilon}=(1-\varepsilon)\,\mathrm{Id}+\varepsilon\,\Delta\\[4pt]&\Delta_{\varepsilon}\!\begin{pmatrix}\alpha_{00}&\alpha_{01}\\\alpha_{10}&\alpha_{11}\end{pmatrix}=\begin{pmatrix}\alpha_{00}&(1-\varepsilon)\alpha_{01}\\(1-\varepsilon)\alpha_{10}&\alpha_{11}\end{pmatrix}\end{aligned}

The diagonal entries store the 0/1 probabilities, so they stay unchanged. The off-diagonal entries carry the coherence, measured by $2|\alpha_{01}|$ . The channel can also be written by what it does to the four basis operators: the diagonal projectors are left alone, and the off-diagonal operators are sent to zero:

\begin{aligned}&\Delta(|0\rangle\langle0|)=|0\rangle\langle0|,\qquad\Delta(|1\rangle\langle1|)=|1\rangle\langle1|\\[4pt]&\Delta(|0\rangle\langle1|)=\Delta(|1\rangle\langle0|)=0\end{aligned}

Now consider two qubits, A and B, with A first, in the Bell state $|\phi^+\rangle=(|00\rangle+|11\rangle)/\sqrt2$ , and apply the dephasing channel to A while leaving B unchanged. Expanding the pair into its four terms, the channel acts only on the first factor of each:

\begin{aligned}(\Delta\otimes\mathrm{Id})(|\phi^+\rangle\langle\phi^+|)&=\tfrac12\Delta(|0\rangle\langle0|)\otimes|0\rangle\langle0|+\tfrac12\Delta(|0\rangle\langle1|)\otimes|0\rangle\langle1|+\tfrac12\Delta(|1\rangle\langle0|)\otimes|1\rangle\langle0|+\tfrac12\Delta(|1\rangle\langle1|)\otimes|1\rangle\langle1|\\&=\tfrac12|0\rangle\langle0|\otimes|0\rangle\langle0|+0+0+\tfrac12|1\rangle\langle1|\otimes|1\rangle\langle1|\\&=\tfrac12|00\rangle\langle00|+\tfrac12|11\rangle\langle11|\end{aligned}

Unlike reset, dephasing keeps both diagonal projectors in place, and only the terms linking 00 with 11 disappear. The pair’s quantum coherence is gone, but its classical correlation survives: measurements of A and B in the 0/1 basis still always agree, so the output is an equal mixture of 00 and 11.

The completely depolarizing channel

The completely depolarizing channel erases all information about the input and always outputs the completely mixed state:

\Omega(\rho)=\mathrm{Tr}(\rho)\,\frac{I}{2}

Input state

Noise strength ε100%

No noiseComplete depolarizing

Every input reaches the center: 0 and 1 each have probability 50%.

Depolarizing is the extreme end of a family of noise channels

As with reset, the trace factor lets the channel act on arbitrary matrices, not just normalized states. The completely depolarizing channel is defined by $\Omega(X)=\mathrm{Tr}(X)\,I/2$ .

For a density matrix, $\mathrm{Tr}(X)=1$ , so every input is mapped to the same output, $\Omega(\rho)=I/2$ .

This is the completely mixed state: the center of the Bloch sphere, with no preferred direction. Every measurement basis therefore gives equal probabilities. This contrasts with reset, which always produces the pure state $|0\rangle\langle0|$ .

Complete depolarization is the extreme case. A weaker form of depolarization leaves the state unchanged with probability $1-\varepsilon$ and completely depolarizes it with probability $\varepsilon$ :

\begin{aligned}&\Omega_{\varepsilon}=(1-\varepsilon)\,\mathrm{Id}+\varepsilon\,\Omega\\[4pt]&\Omega_{\varepsilon}(\rho)=(1-\varepsilon)\rho+\varepsilon\frac{I}{2}\end{aligned}

At $\varepsilon=0$ , nothing changes. At $\varepsilon=1$ , every state is mapped to $I/2$ . For values in between, the Bloch vector keeps its direction but shrinks by the factor $1-\varepsilon$ .

Channel representations

How do we write a channel down?

A linear mapping from vectors to vectors is represented by a matrix, in the familiar way: the matrix multiplies a column vector and returns another one. Channels are linear as well, but they map matrices to matrices, so a matrix acting on a vector is the wrong shape to describe one.

Sometimes a simple formula expresses the action of a channel, such as $\Lambda(\rho)=\mathrm{Tr}(\rho)\,|0\rangle\langle0|$ for the qubit reset channel. That is not practical in general, so the question is how to express an arbitrary channel in mathematical terms.

Stinespring representations

Every channel can be implemented in the same three steps:

Form a compound system from the input system and an initialized workspace system.
Perform a unitary operation on the compound system.
Discard everything except the output system.

For a channel $\Phi$ from a system $\mathsf{X}$ to a system $\mathsf{Y}$ , this is a circuit on two wires, for a suitable choice of the workspace $\mathsf{W}$ and the discarded system $\mathsf{G}$ :

Such a description, consisting of the unitary operation together with a specification of the input and output systems, is a Stinespring representation of the channel. Nothing about the channel is left outside it: the randomness and the information loss both come from discarding $\mathsf{G}$ at the end.

For a channel from a system to itself, the picture is the same with $\mathsf{Y}=\mathsf{X}$ and $\mathsf{G}=\mathsf{W}$ : the workspace goes in initialized and comes back out to be thrown away.

Kraus representations

A Kraus representation describes a quantum channel using matrix multiplication and addition, making it especially convenient for calculations. In general, a channel can be written as

\Phi(\rho)=\sum_{k=0}^{N-1}A_{k}\,\rho\,A_{k}^{\dagger}

The matrices $A_{0},\ldots,A_{N-1}$ are called Kraus operators. They all have the same dimensions. If the channel maps an input system to an output system, each column of a Kraus operator corresponds to an input basis state, and each row corresponds to an output basis state. The operators therefore need not be square when the input and output systems have different dimensions.

The Kraus operators are not arbitrary. To ensure that the channel maps density matrices to density matrices, they must satisfy the completeness condition

\sum_{k=0}^{N-1}A_{k}^{\dagger}A_{k}=I

This condition guarantees that the trace of the density matrix is preserved.

Choi representations

The Choi representation packages a channel into a single matrix, called Choi matrix and denoted $J(\Phi)$ . If the input system has $n$ basis states and the output system has $m$ , then $J(\Phi)$ is an $(nm)\times(nm)$ matrix.

Let $\Phi$ be a channel from a system $\mathsf{X}$ to a system $\mathsf{Y}$ , and let $\Sigma$ be the set of basis states of $\mathsf{X}$ . The Choi matrix is defined by

J(\Phi)=\sum_{a,b\in\Sigma}\textcolor{#0284c7}{|a\rangle\langle b|}\otimes\textcolor{#7c3aed}{\Phi(|a\rangle\langle b|)}

Notice that only the second factor of each term passes through the channel. The first is the original basis operator, left exactly as it was, and it is there to say which input produced the output beside it. Each term is therefore a record of one input and what $\Phi$ did to it, and $J(\Phi)$ packs all $n^{2}$ of those records into a single matrix.

Taking $\Sigma=\{0,\ldots,n-1\}$ , the Choi matrix can therefore be viewed as an $n\times n$ block matrix:

J(\Phi)=\begin{pmatrix}\Phi(|0\rangle\langle0|)&\Phi(|0\rangle\langle1|)&\cdots&\Phi(|0\rangle\langle n-1|)\\\Phi(|1\rangle\langle0|)&\Phi(|1\rangle\langle1|)&\cdots&\Phi(|1\rangle\langle n-1|)\\\vdots&\vdots&\ddots&\vdots\\\Phi(|n-1\rangle\langle0|)&\Phi(|n-1\rangle\langle1|)&\cdots&\Phi(|n-1\rangle\langle n-1|)\end{pmatrix}

Because these basis operators span all matrices, the blocks of $J(\Phi)$ completely determine the channel. In other words, the representation is faithful:

J(\Phi)=J(\Psi)\iff\Phi=\Psi

The Choi matrix also turns the conditions for being a valid quantum channel into simple matrix conditions. A map is a quantum channel exactly when its Choi matrix is positive semidefinite, which expresses complete positivity, and has the correct partial trace, which is what preserves the trace of the state:

\begin{aligned}J(\Phi)&\ge0&&\quad\textcolor{#94a3b8}{\text{complete positivity}}\\[6pt]\mathrm{Tr}_{\mathsf{Y}}\bigl(J(\Phi)\bigr)&=I_{\mathsf{X}}&&\quad\textcolor{#94a3b8}{\text{trace preservation}}\end{aligned}

One important distinction is that $J(\Phi)$ is a representation of the channel, not the channel itself. An ordinary matrix such as $U$ acts directly on a state by matrix multiplication, for example $U\rho U^{\dagger}$ . The Choi matrix works differently: its blocks contain the outputs $\Phi(|a\rangle\langle b|)$ for all basis operators $|a\rangle\langle b|$ . In this sense, $J(\Phi)$ records how the channel acts rather than applying the channel to a state. Since those basis operators span all matrices, the complete action of $\Phi$ can be reconstructed from $J(\Phi)$ .

There is also a useful way to turn the Choi matrix into a quantum state. Divide it by the dimension of the input system, $n=|\Sigma|$ , to get $J(\Phi)/n$ . This is a density matrix, called the Choi state of $\Phi$ , and it has a direct physical interpretation. Take two copies of the input system, prepare them in the maximally entangled state, and write out its density matrix:

\begin{aligned}|\psi\rangle&=\frac{1}{\sqrt n}\sum_{a\in\Sigma}|a\rangle\otimes|a\rangle\\[6pt]|\psi\rangle\langle\psi|&=\frac1n\sum_{a,b\in\Sigma}|a\rangle\langle b|\otimes|a\rangle\langle b|\end{aligned}

Now apply the channel $\Phi$ to the second system, while leaving the first system unchanged. The identity channel $\mathrm{Id}$ represents doing nothing to the first system:

(\mathrm{Id}\otimes\Phi)(|\psi\rangle\langle\psi|)=\frac1n\sum_{a,b\in\Sigma}|a\rangle\langle b|\otimes\Phi(|a\rangle\langle b|)=\frac{J(\Phi)}{n}

Thus, the Choi state is exactly the state produced by applying $\Phi$ to one half of a maximally entangled pair. The Choi matrix is therefore not just an abstract way to represent the channel: after normalization, it describes the physical state that results from this experiment.

Channel examples in three representations

Channel

Action

\Delta(\rho)=|0\rangle\langle0|\rho|0\rangle\langle0|+|1\rangle\langle1|\rho|1\rangle\langle1|

Stinespring

Two circuits for it:

Copy the qubit into a fresh |0⟩ with a CNOT, then discard the copy.

Follow the matrices through

Write $\rho_{ab}=\langle a|\rho|b\rangle$ for the entries of the input state. The workspace starts in $|0\rangle$ , so the joint state entering the unitary is

\begin{aligned}\rho\otimes|0\rangle\langle0|&=\begin{pmatrix}\rho_{00}&\rho_{01}\\\rho_{10}&\rho_{11}\end{pmatrix}\otimes\begin{pmatrix}1&0\\0&0\end{pmatrix}\\[8pt]&=\begin{pmatrix}\rho_{00}\begin{pmatrix}1&0\\0&0\end{pmatrix}&\rho_{01}\begin{pmatrix}1&0\\0&0\end{pmatrix}\\[8pt]\rho_{10}\begin{pmatrix}1&0\\0&0\end{pmatrix}&\rho_{11}\begin{pmatrix}1&0\\0&0\end{pmatrix}\end{pmatrix}\\[8pt]&=\begin{pmatrix}\rho_{00}&0&\rho_{01}&0\\0&0&0&0\\\rho_{10}&0&\rho_{11}&0\\0&0&0&0\end{pmatrix}\end{aligned}

The controlled-NOT uses the input as its control and the workspace as its target. It leaves $|00\rangle$ and $|01\rangle$ unchanged, while swapping $|10\rangle$ with $|11\rangle$ . Since it only permutes basis states, multiplying on the left exchanges the last two rows of the joint state and multiplying on the right exchanges the last two columns. Between them they move the off-diagonal entries into different workspace sectors:

\begin{aligned}U(\rho\otimes|0\rangle\langle0|)U^{\dagger}&=\begin{pmatrix}1&0&0&0\\0&1&0&0\\0&0&0&1\\0&0&1&0\end{pmatrix}\begin{pmatrix}\rho_{00}&0&\rho_{01}&0\\0&0&0&0\\\rho_{10}&0&\rho_{11}&0\\0&0&0&0\end{pmatrix}\begin{pmatrix}1&0&0&0\\0&1&0&0\\0&0&0&1\\0&0&1&0\end{pmatrix}\\[8pt]&=\begin{pmatrix}\rho_{00}&0&\rho_{01}&0\\0&0&0&0\\0&0&0&0\\\rho_{10}&0&\rho_{11}&0\end{pmatrix}\begin{pmatrix}1&0&0&0\\0&1&0&0\\0&0&0&1\\0&0&1&0\end{pmatrix}\\[8pt]&=\begin{pmatrix}\rho_{00}&0&0&\rho_{01}\\0&0&0&0\\0&0&0&0\\\rho_{10}&0&0&\rho_{11}\end{pmatrix}\end{aligned}

\begin{aligned}&\phantom{{}+{}}\rho_{00}\,|0\rangle\langle0|\otimes|0\rangle\langle0|\\&+\rho_{01}\,|0\rangle\langle1|\otimes|0\rangle\langle1|\\&+\rho_{10}\,|1\rangle\langle0|\otimes|1\rangle\langle0|\\&+\rho_{11}\,|1\rangle\langle1|\otimes|1\rangle\langle1|\end{aligned}

\mathrm{Tr}_{\mathsf{G}}\bigl(U(\rho\otimes|0\rangle\langle0|)U^{\dagger}\bigr)=\rho_{00}\,|0\rangle\langle0|+\rho_{11}\,|1\rangle\langle1|=\Delta(\rho)

The workspace has therefore recorded which computational-basis state the input occupied. Discarding that workspace removes the corresponding off-diagonal terms while leaving the diagonal probabilities unchanged — exactly the action of the dephasing channel.

Kraus

Two sets of operators:

A_{0}=|0\rangle\langle0|=\begin{pmatrix}1&0\\0&0\end{pmatrix}

A_{1}=|1\rangle\langle1|=\begin{pmatrix}0&0\\0&1\end{pmatrix}

The two projectors onto the classical states.

Expand the Kraus sum

Take $A_{0}=|0\rangle\langle0|$ and $A_{1}=|1\rangle\langle1|$ , the two projectors onto the classical states. Each keeps one component of the input and returns it in the same direction, so the two terms in the Kraus sum are

\sum_{k=0}^{1}A_{k}\,\rho\,A_{k}^{\dagger}=|0\rangle\langle0|\rho|0\rangle\langle0|+|1\rangle\langle1|\rho|1\rangle\langle1|

Now use the inner products in the middle:

\begin{aligned}&=\langle0|\rho|0\rangle\,|0\rangle\langle0|+\langle1|\rho|1\rangle\,|1\rangle\langle1|\\[6pt]&=\Delta(\rho)\end{aligned}

The two coefficients are the diagonal entries of $\rho$ , so the probabilities of measuring 0 and 1 survive unchanged. Nothing in the sum carries the off-diagonal entries across, which is the coherence being lost. The completeness condition holds as well:

\begin{aligned}\sum_{k=0}^{1}A_{k}^{\dagger}A_{k}&=|0\rangle\langle0|0\rangle\langle0|+|1\rangle\langle1|1\rangle\langle1|\\[6pt]&=|0\rangle\langle0|+|1\rangle\langle1|\\[6pt]&=I\end{aligned}

Choi

J(\Phi)=\begin{pmatrix}1&0&0&0\\0&0&0&0\\0&0&0&0\\0&0&0&1\end{pmatrix}

Only the diagonal blocks survive, which is the coherence going away.

Build the Choi matrix

The sum runs over the four basis operators of a qubit. In each term, the first factor records the input operator, while the second is that operator after passing through the channel. Each term therefore pairs an input with its output:

\begin{aligned}J(\Delta)&=\sum_{a,b=0}^{1}\textcolor{#0284c7}{|a\rangle\langle b|}\otimes\textcolor{#7c3aed}{\Delta(|a\rangle\langle b|)}\\[6pt]&=\textcolor{#0284c7}{|0\rangle\langle0|}\otimes\textcolor{#7c3aed}{\Delta(|0\rangle\langle0|)}+\textcolor{#0284c7}{|0\rangle\langle1|}\otimes\textcolor{#7c3aed}{\Delta(|0\rangle\langle1|)}+\textcolor{#0284c7}{|1\rangle\langle0|}\otimes\textcolor{#7c3aed}{\Delta(|1\rangle\langle0|)}+\textcolor{#0284c7}{|1\rangle\langle1|}\otimes\textcolor{#7c3aed}{\Delta(|1\rangle\langle1|)}\end{aligned}

Dephasing leaves the two diagonal operators unchanged and sends the two off-diagonal operators to zero, so the middle two terms vanish and only two survive:

\begin{aligned}&=\textcolor{#0284c7}{|0\rangle\langle0|}\otimes\textcolor{#7c3aed}{|0\rangle\langle0|}+\textcolor{#0284c7}{|0\rangle\langle1|}\otimes\textcolor{#7c3aed}{0}+\textcolor{#0284c7}{|1\rangle\langle0|}\otimes\textcolor{#7c3aed}{0}+\textcolor{#0284c7}{|1\rangle\langle1|}\otimes\textcolor{#7c3aed}{|1\rangle\langle1|}\\[6pt]&=\textcolor{#0284c7}{|0\rangle\langle0|}\otimes\textcolor{#7c3aed}{|0\rangle\langle0|}+\textcolor{#0284c7}{|1\rangle\langle1|}\otimes\textcolor{#7c3aed}{|1\rangle\langle1|}\end{aligned}

As a block matrix, each block is the output of the channel on one basis operator:

\begin{aligned}J(\Delta)&=\begin{pmatrix}\Delta\begin{pmatrix}1&0\\0&0\end{pmatrix}&\Delta\begin{pmatrix}0&1\\0&0\end{pmatrix}\\[10pt]\Delta\begin{pmatrix}0&0\\1&0\end{pmatrix}&\Delta\begin{pmatrix}0&0\\0&1\end{pmatrix}\end{pmatrix}\\[10pt]&=\begin{pmatrix}1&0&0&0\\0&0&0&0\\0&0&0&0\\0&0&0&1\end{pmatrix}\end{aligned}

Both conditions from the Choi representation can now be read directly from this matrix. It is diagonal with non-negative entries, so it is positive semidefinite, and tracing out the output system returns the identity, so the channel is trace-preserving:

\mathrm{Tr}_{\mathsf{Y}}\bigl(J(\Delta)\bigr)=|0\rangle\langle0|+|1\rangle\langle1|=I

The three representations are equivalent

The three forms are different ways of describing the same quantum channel. This equivalence holds for any quantum channel: a channel written in one representation can always be transformed into either of the other two, and the transformations can be reversed. Thus, the choice of representation changes how the channel is expressed, but not the information it contains.

Definition → Choi representation

A channel satisfies the Choi conditions

Let $\Phi$ be a quantum channel acting on an $n$ -dimensional system. Its Choi matrix pairs each input basis operator with its output:

J(\Phi)=\sum_{a,b=0}^{n-1}\textcolor{#0284c7}{|a\rangle\langle b|}\otimes\textcolor{#7c3aed}{\Phi(|a\rangle\langle b|)}

To see what properties this matrix must have, take two copies of the system, $\mathsf{X}$ and $\mathsf{Y}$ , prepare them in the , and write out its density matrix:

\begin{aligned}|\Omega\rangle&=\frac{1}{\sqrt n}\sum_{a=0}^{n-1}|a\rangle_{\mathsf{X}}|a\rangle_{\mathsf{Y}}\\[6pt]|\Omega\rangle\langle\Omega|&=\frac1n\sum_{a,b=0}^{n-1}|a\rangle\langle b|_{\mathsf{X}}\otimes|a\rangle\langle b|_{\mathsf{Y}}\end{aligned}

Now apply $\Phi$ to $\mathsf{Y}$ while leaving $\mathsf{X}$ unchanged. The map $\mathrm{Id}\otimes\Phi$ is linear, so it acts on the terms of the sum one at a time, leaving every first factor alone and sending every second factor through the channel. What comes back is the normalized Choi state:

\begin{aligned}(\mathrm{Id}\otimes\Phi)(|\Omega\rangle\langle\Omega|)&=(\mathrm{Id}\otimes\Phi)\!\left(\frac1n\sum_{a,b=0}^{n-1}|a\rangle\langle b|_{\mathsf{X}}\otimes|a\rangle\langle b|_{\mathsf{Y}}\right)\\[6pt]&=\frac1n\sum_{a,b=0}^{n-1}\textcolor{#0284c7}{\mathrm{Id}(|a\rangle\langle b|_{\mathsf{X}})}\otimes\textcolor{#7c3aed}{\Phi(|a\rangle\langle b|_{\mathsf{Y}})}\\[6pt]&=\frac1n\sum_{a,b=0}^{n-1}\textcolor{#0284c7}{|a\rangle\langle b|_{\mathsf{X}}}\otimes\textcolor{#7c3aed}{\Phi(|a\rangle\langle b|_{\mathsf{Y}})}\\[6pt]&=\frac{J(\Phi)}{n}\end{aligned}

Because $\Phi$ is a quantum channel, this output must be a valid density matrix. In particular it must be positive semidefinite:

J(\Phi)\ge0

There is also a condition on the system $\mathsf{X}$ . The channel acts only on $\mathsf{Y}$ , so it cannot change the state of $\mathsf{X}$ , which was maximally mixed before the channel and stays that way after it. Multiplying by $n$ then clears the factor:

\begin{aligned}\mathrm{Tr}_{\mathsf{Y}}\bigl(|\Omega\rangle\langle\Omega|\bigr)&=\frac{I_{\mathsf{X}}}{n}\\[6pt]\mathrm{Tr}_{\mathsf{Y}}\!\left(\frac{J(\Phi)}{n}\right)&=\frac{I_{\mathsf{X}}}{n}\\[6pt]\mathrm{Tr}_{\mathsf{Y}}J(\Phi)&=I_{\mathsf{X}}\end{aligned}

Thus every quantum channel produces a Choi matrix satisfying the two conditions

J(\Phi)\ge0,\qquad\mathrm{Tr}_{\mathsf{Y}}J(\Phi)=I_{\mathsf{X}}

These conditions are also sufficient: any matrix satisfying them is the Choi matrix of a valid quantum channel.

Three representations are a lot of machinery for one channel, and at this point I’m not even sure the payoff is worth all the setup. For simple channels like reset, the original definition is often clearer.

The point is that each view is useful for a different purpose: Stinespring gives the physical picture, Kraus is convenient for calculations, and Choi turns the channel into a matrix. The useful part is knowing that the same channel can be viewed in whichever form makes a particular problem easier.

General measurements

Measurements are the interface between quantum and classical information. Performing a measurement extracts classical information from a quantum state and, in general, changes or destroys the system in the process.

Destructive measurements produce only a classical outcome. What happens to the system afterwards is not part of the description. This means that only the outcome probabilities need to be described, without specifying the state of the system after the measurement.

There are two equivalent ways to describe a destructive measurement, both of which will be useful below. The first is a collection of matrices, one for each measurement outcome. The second is a channel whose outputs are always classical states, represented by diagonal density matrices. The two descriptions contain exactly the same information, but each is convenient in a different setting: the matrices for calculating probabilities, and the channel when the measurement appears in a circuit alongside other operations.

Non-destructive measurements, where the system survives and its post-measurement state matters, do not require a separate theory: any such measurement can be described as a destructive measurement followed by a channel that prepares the resulting post-measurement state. It is therefore useful to get the destructive case right first, and to once it is in place.

Measurements as matrices

Start with the physical question: what information do we need to describe a destructive measurement? For each possible outcome $a$ , we need something that tells us how likely that outcome is for a given state $\rho$ . Let that something be a matrix $P_{a}$ , so that $\mathrm{Pr}(\text{outcome}=a)=\mathrm{Tr}(P_{a}\rho)$ .

The matrices must satisfy a few conditions for these numbers to be valid probabilities. They must give nonnegative values for every quantum state, and all the probabilities must add up to one.

Projective measurements

In a , each outcome $a$ is associated with a projection matrix $\Pi_{a}$ . The projector $\Pi_{a}$ selects the subspace corresponding to that outcome. Since the measurement must account for every possible outcome, the projectors form a complete decomposition of the identity:

\Pi_{0}+\cdots+\Pi_{m-1}=I_{\mathsf{X}}

For a pure state $\lvert\psi\rangle$ , the probability of obtaining outcome $a$ is the squared size of the component of $\lvert\psi\rangle$ in the corresponding subspace:

\mathrm{Pr}(\text{outcome}=a)=\bigl\lVert\Pi_{a}\lvert\psi\rangle\bigr\rVert^{2}=\langle\psi\rvert\Pi_{a}\lvert\psi\rangle

How does this number become a trace? Write $u=\Pi_a\lvert\psi\rangle$ , so the probability is $\langle\psi\rvert u$ . There are two ways to multiply this column and the row $\langle\psi\rvert$ . Row times column gives a single number, and column times row gives a matrix. Adding that matrix's diagonal gives the same number.

Row times column

\langle\psi\rvert u=

\underbrace{\begin{bmatrix}\overline{\psi_1}&\overline{\psi_2}\end{bmatrix}}_{1\times2}

\underbrace{\begin{bmatrix}u_1\\u_2\end{bmatrix}}_{2\times1}

\begin{aligned} \phantom{\langle\psi\rvert u}&=\textcolor{#0284c7}{\overline{\psi_1}u_1}+\textcolor{#4f46e5}{\overline{\psi_2}u_2}\\[2pt] &=\mathrm{Pr}(a) \end{aligned}

Column times row

u\langle\psi\rvert= \underbrace{\begin{bmatrix}u_1\\u_2\end{bmatrix}}_{2\times1} \underbrace{\begin{bmatrix}\overline{\psi_1}&\overline{\psi_2}\end{bmatrix}}_{1\times2}

\phantom{u\langle\psi\rvert}=

\begin{aligned} \mathrm{Tr}(u\langle\psi\rvert)&=\textcolor{#0284c7}{u_1\overline{\psi_1}}+\textcolor{#4f46e5}{u_2\overline{\psi_2}}\\[2pt] &=\mathrm{Pr}(a) \end{aligned}

The two sums agree because each entry is a scalar: $\overline{\psi_i}u_i=u_i\overline{\psi_i}$ . In any dimension, the same calculation reads:

\begin{aligned} \langle\psi\rvert u &=\sum_i\overline{\psi_i}u_i &&\textcolor{#64748b}{\text{row times column}}\\[4pt] &=\sum_i u_i\overline{\psi_i} &&\textcolor{#64748b}{\text{scalar factors commute}}\\[4pt] &=\sum_i\bigl(u\langle\psi\rvert\bigr)_{ii} &&\textcolor{#64748b}{\text{these are the diagonal entries}}\\[4pt] &=\mathrm{Tr}\bigl(u\langle\psi\rvert\bigr) &&\textcolor{#64748b}{\text{trace means sum the diagonal}} \end{aligned}

Substitute $u=\Pi_a\lvert\psi\rangle$ back in. The outer product $\lvert\psi\rangle\langle\psi\rvert$ is exactly the pure state's density matrix:

\begin{aligned} \mathrm{Pr}(\text{outcome}=a) &=\langle\psi\rvert\Pi_a\lvert\psi\rangle\\[4pt] &=\mathrm{Tr}\!\left(\Pi_a\underbrace{\lvert\psi\rangle\langle\psi\rvert}_{\rho}\right)\\[4pt] &=\mathrm{Tr}(\Pi_a\rho). \end{aligned}

This identity works for any matrix $A$ in place of $\Pi_a$ : the trace calculation did not use any special property of a projector.

This form immediately extends the rule from pure states to arbitrary density matrices. For a general state $\rho$ , a projective measurement therefore gives

\mathrm{Pr}(\text{outcome}=a)=\mathrm{Tr}(\Pi_{a}\rho)

At this point, the role of the projectors is clear: they specify the possible outcomes, while the trace expression gives their probabilities. The next step is to ask what happens if we keep this probability rule but no longer require the matrices associated with outcomes to be projections.

General measurements

We now keep the rule $\mathrm{Pr}(\text{outcome}=a)=\mathrm{Tr}(P_a\rho)$ , but allow $P_a$ to be more general than a projector. What conditions must these matrices satisfy to give valid probabilities for every state?

Each probability must be nonnegative. For a pure state, the identity we just derived gives
$\mathrm{Pr}(\text{outcome}=a)=\mathrm{Tr}\bigl(P_a\lvert\psi\rangle\langle\psi\rvert\bigr)=\langle\psi\rvert P_a\lvert\psi\rangle\geq0$
Requiring this value to be real and nonnegative for every normalized $\lvert\psi\rangle$ is exactly the condition that $P_a$ is positive semidefinite, written $P_a\geq0$ . Mixed states are weighted mixtures of pure states. By linearity of the trace, their probabilities are weighted averages of these nonnegative probabilities, so they are nonnegative too.
The probabilities must add up to one. Adding over all outcomes and using linearity again gives
$\sum_a\mathrm{Pr}(\text{outcome}=a)=\sum_a\mathrm{Tr}(P_a\rho)=\mathrm{Tr}\!\left(\left[\sum_a P_a\right]\rho\right)$
If the matrices sum to the identity, this becomes $\mathrm{Tr}(I_{\mathsf X}\rho)=\mathrm{Tr}(\rho)=1$ . Requiring the total to be one for every state also forces this condition: choosing any normalized eigenvector of $\sum_a P_a$ as the state makes the total equal to its eigenvalue. Every eigenvalue must therefore be one, so
$P_0+\cdots+P_{m-1}=I_{\mathsf X}$

A general measurement is therefore a collection of matrices $\{P_0,\ldots,P_{m-1}\}$ satisfying these two conditions, with outcome probabilities given by the same trace rule:

\begin{gathered} P_a\geq0\ \text{for every }a,\qquad \sum_a P_a=I_{\mathsf X}\\[6pt] \mathrm{Pr}(\text{outcome}=a)=\mathrm{Tr}(P_a\rho). \end{gathered}

Every projective measurement satisfies these conditions. The new possibilities come from allowing eigenvalues between zero and one, whereas a projector has only zero or one as eigenvalues. The upper bound follows because $I_{\mathsf X}-P_a=\sum_{b\ne a}P_b\geq0$ . For a state that is an eigenvector of $P_a$ , the probability of outcome $a$ is its eigenvalue, which can now lie strictly between zero and one.

A standard basis measurement

A standard basis measurement of a qubit is the collection $\{P_{0},P_{1}\}$ where

P_{0}=\lvert0\rangle\langle0\rvert=\begin{pmatrix}1&0\\0&0\end{pmatrix}\qquad P_{1}=\lvert1\rangle\langle1\rvert=\begin{pmatrix}0&0\\0&1\end{pmatrix}

Measuring a qubit in the state $\rho$ gives outcome probabilities that are just the diagonal entries of $\rho$ :

\begin{aligned}\mathrm{Pr}(\text{outcome}=0)&=\mathrm{Tr}(P_{0}\rho)=\mathrm{Tr}\bigl(\lvert0\rangle\langle0\rvert\rho\bigr)=\langle0\rvert\rho\lvert0\rangle\\[4pt]\mathrm{Pr}(\text{outcome}=1)&=\mathrm{Tr}(P_{1}\rho)=\mathrm{Tr}\bigl(\lvert1\rangle\langle1\rvert\rho\bigr)=\langle1\rvert\rho\lvert1\rangle\end{aligned}

State

Distance from the center1.00

\begin{aligned} \mathrm{Pr}(\text{outcome}=0) &=\mathrm{Tr}\left(\underbrace{\begin{pmatrix}1&0\\0&0\end{pmatrix}}_{P_0}\underbrace{\begin{pmatrix}1&0\\0&0\end{pmatrix}}_{\rho}\right)\\[6pt] &=\mathrm{Tr}\begin{pmatrix}\textcolor{#7c3aed}{1}&0\\0&\textcolor{#7c3aed}{0}\end{pmatrix}\\[6pt] &=\textcolor{#7c3aed}{1}+\textcolor{#7c3aed}{0}\approx\textcolor{#7c3aed}{1} \end{aligned}

Two outcomes without projections

The definition requires only positive semidefinite matrices that sum to the identity. It does not require the measurement operators to be projections. For example, consider

P_{0}=\begin{pmatrix}\tfrac23&\tfrac13\\[2pt]\tfrac13&\tfrac13\end{pmatrix}\qquad P_{1}=\begin{pmatrix}\tfrac13&-\tfrac13\\[2pt]-\tfrac13&\tfrac23\end{pmatrix}

They sum to the identity, and each has trace $1$ and determinant $\tfrac19$ , so both eigenvalues are positive and both matrices are positive semidefinite. Neither is a projection, since $P_{0}^{2}\neq P_{0}$ and $P_{1}^{2}\neq P_{1}$ .

For a qubit in the $\lvert+\rangle$ state, with $\lvert+\rangle\langle+\rvert=\begin{pmatrix}\tfrac12&\tfrac12\\[2pt]\tfrac12&\tfrac12\end{pmatrix}$ , the outcome probabilities add to $1$ even though neither measurement operator is a projection:

\begin{aligned}\mathrm{Pr}(\text{outcome}=0)&=\mathrm{Tr}\bigl(P_{0}\lvert+\rangle\langle+\rvert\bigr)=\mathrm{Tr}\left(\begin{pmatrix}\tfrac23&\tfrac13\\[2pt]\tfrac13&\tfrac13\end{pmatrix}\begin{pmatrix}\tfrac12&\tfrac12\\[2pt]\tfrac12&\tfrac12\end{pmatrix}\right)=\tfrac56\\[10pt]\mathrm{Pr}(\text{outcome}=1)&=\mathrm{Tr}\bigl(P_{1}\lvert+\rangle\langle+\rvert\bigr)=\mathrm{Tr}\left(\begin{pmatrix}\tfrac13&-\tfrac13\\[2pt]-\tfrac13&\tfrac23\end{pmatrix}\begin{pmatrix}\tfrac12&\tfrac12\\[2pt]\tfrac12&\tfrac12\end{pmatrix}\right)=\tfrac16\end{aligned}

On the Bloch sphere, the two directions are still opposite, but even perfect alignment with one direction cannot make the corresponding outcome 100% certain.

State

Distance from the center1.00

\begin{aligned} \mathrm{Pr}(\text{outcome}=0) &=\mathrm{Tr}\left(\underbrace{\begin{pmatrix}0.667&0.333\\0.333&0.333\end{pmatrix}}_{P_0}\underbrace{\begin{pmatrix}1&0\\0&0\end{pmatrix}}_{\rho}\right)\\[6pt] &=\mathrm{Tr}\begin{pmatrix}\textcolor{#7c3aed}{0.667}&0\\0.333&\textcolor{#7c3aed}{0}\end{pmatrix}\\[6pt] &=\textcolor{#7c3aed}{0.667}+\textcolor{#7c3aed}{0}\approx\textcolor{#7c3aed}{0.667} \end{aligned}

Four outcomes from a single qubit

The tetrahedral states are four qubit states whose Bloch vectors are arranged symmetrically in three dimensions. On the Bloch sphere, the four vectors point toward the corners of a regular tetrahedron, giving these states their name.

\begin{aligned}\lvert\phi_{0}\rangle&=\lvert0\rangle\\[4pt]\lvert\phi_{1}\rangle&=\tfrac{1}{\sqrt3}\lvert0\rangle+\sqrt{\tfrac23}\,\lvert1\rangle\\[4pt]\lvert\phi_{2}\rangle&=\tfrac{1}{\sqrt3}\lvert0\rangle+\sqrt{\tfrac23}\,e^{2\pi i/3}\lvert1\rangle\\[4pt]\lvert\phi_{3}\rangle&=\tfrac{1}{\sqrt3}\lvert0\rangle+\sqrt{\tfrac23}\,e^{-2\pi i/3}\lvert1\rangle\end{aligned}

A measurement $\{P_{0},P_{1},P_{2},P_{3}\}$ can be defined from them by halving each projection:

P_{0}=\frac{\lvert\phi_{0}\rangle\langle\phi_{0}\rvert}{2}\quad P_{1}=\frac{\lvert\phi_{1}\rangle\langle\phi_{1}\rvert}{2}\quad P_{2}=\frac{\lvert\phi_{2}\rangle\langle\phi_{2}\rvert}{2}\quad P_{3}=\frac{\lvert\phi_{3}\rangle\langle\phi_{3}\rvert}{2}

Each is positive semidefinite because it is a projection scaled by a positive number, and the four operators sum to the identity because the four tetrahedral directions cancel out. A two-dimensional system can therefore have four measurement outcomes, something that a projective measurement cannot provide. The trade-off is that the outcomes are no longer perfectly distinguishable. If the four preparations are equally likely beforehand, observing outcome $a$ makes $\lvert\phi_{a}\rangle$ the most likely preparation, but it does not prove that it was the one prepared.

State

Distance from the center1.00

\begin{aligned} \mathrm{Pr}(\text{outcome}=0) &=\mathrm{Tr}\left(\underbrace{\begin{pmatrix}0.5&0\\0&0\end{pmatrix}}_{P_0}\underbrace{\begin{pmatrix}1&0\\0&0\end{pmatrix}}_{\rho}\right)\\[6pt] &=\mathrm{Tr}\begin{pmatrix}\textcolor{#7c3aed}{0.5}&0\\0&\textcolor{#7c3aed}{0}\end{pmatrix}\\[6pt] &=\textcolor{#7c3aed}{0.5}+\textcolor{#7c3aed}{0}\approx\textcolor{#7c3aed}{0.5} \end{aligned}

Measurements as channels

Classical probabilistic states are represented by diagonal density matrices, with the probabilities along the diagonal. That is the key idea behind the second description: a measurement is a channel whose output is always a classical state.

Any general measurement can therefore be described by a channel $\Phi$ . The input system $\mathsf{X}$ is the system being measured, and the output system $\mathsf{Y}$ is classical, with states corresponding to the possible measurement outcomes $\{0,\ldots,m-1\}$ . For every input state $\rho$ of $\mathsf{X}$ , the output $\Phi(\rho)$ is a diagonal density matrix whose diagonal entries are the outcome probabilities.

The completely dephasing channel $\Delta$ describes a standard basis measurement of a qubit:

\Delta(\rho)=\langle0\rvert\rho\lvert0\rangle\,\lvert0\rangle\langle0\rvert+\langle1\rvert\rho\lvert1\rangle\,\lvert1\rangle\langle1\rvert

The channel keeps the diagonal entries of $\rho$ and erases everything else. The result contains the two outcome probabilities, but no information about the coherence between them. The same channel also describes dephasing noise, which is what happens when the environment effectively measures a system in the standard basis without the outcome being read.

Equivalence to the matrix description

A channel $\Phi$ from $\mathsf{X}$ to $\mathsf{Y}$ has diagonal output for every input state if and only if there is a $\{P_{0},\ldots,P_{m-1}\}$ for which:

\Phi(\rho)=\sum_{a=0}^{m-1}\mathrm{Tr}(P_{a}\rho)\,\lvert a\rangle\langle a\rvert

One direction is immediate. Given the measurement matrices, the formula defines a channel whose output is diagonal by construction.

For the other direction, suppose $\Phi(\rho)$ is always diagonal. Its $a$ -th diagonal entry, $\langle a\rvert\Phi(\rho)\lvert a\rangle$ , is a linear function of $\rho$ , because $\Phi$ is linear. Any linear function of a matrix can be written as a trace against a fixed matrix, so there is a matrix $P_{a}$ for which:

\langle a\rvert\Phi(\rho)\lvert a\rangle=\mathrm{Tr}(P_{a}\rho)

The required properties of the $P_{a}$ then follow from the corresponding properties of the channel. Since $\Phi(\rho)$ is a density matrix, its diagonal entries are nonnegative for every density matrix $\rho$ , which means that each $P_{a}$ is positive semidefinite. Those entries also sum to one for every $\rho$ :

\sum_{a=0}^{m-1}\mathrm{Tr}(P_{a}\rho)=1

A single matrix has that trace against every density matrix only if it is the identity, so the measurement matrices must add up to it:

P_{0}+\cdots+P_{m-1}=I_{\mathsf{X}}

So the two descriptions contain exactly the same information. The matrices are convenient when the goal is to calculate an outcome probability. The channel is convenient when the measurement needs to appear in a circuit alongside other operations, since it composes with them like any other channel.

Partial measurements

A measurement channel replaces a system with a classical record of its outcome. Suppose now that the measured system $\mathsf{X}$ is only half of a pair $(\mathsf{X},\mathsf{Z})$ held in the joint state $\rho$ , and that the measurement $\{P_0,\ldots,P_{m-1}\}$ acts on $\mathsf{X}$ alone. Nothing touches $\mathsf{Z}$ .

(\mathsf{X},\mathsf{Z})\xrightarrow{\ \Phi\otimes\mathrm{Id}_{\mathsf{Z}}\ }(\mathsf{Y},\mathsf{Z})

The setup

Only the upper half of the pair enters the meter. Its outcome leaves on the double wire as the classical register Y, and Z runs past untouched.

Two questions follow: which outcome $a$ appears, and once $a$ appears, what state is $\mathsf{Z}$ in?

What is the probability of each outcome

The first question depends only on the measured system $\mathsf{X}$ . Its , $\rho_{\mathsf{X}}=\mathrm{Tr}_{\mathsf{Z}}(\rho)$ , contains everything needed to determine the probabilities of the measurement outcomes:

p_a=\mathrm{Tr}\bigl(P_a\,\textcolor{#0284c7}{\rho_{\mathsf{X}}}\bigr)

\phantom{p_a}=\mathrm{Tr}\bigl((P_a\otimes I_{\mathsf{Z}})\rho\bigr)

Where the probability comes from

\rho

joint state of the pair

trace out Z

\textcolor{#0284c7}{\rho_{\mathsf{X}}}

local state of the measured system

measure with $P_a$

\textcolor{#0284c7}{p_a}

probability of outcome a

The two expressions describe the same calculation in two equivalent ways. Either first reduce the joint state to $\mathsf{X}$ and then measure it, or evaluate the measurement directly on the pair while leaving $\mathsf{Z}$ untouched. In both cases, the measurement acts only on $\mathsf{X}$ .

Taking $\mathsf{X}$ and $\mathsf{Z}$ to be qubits shows what that first step does. Cut $\rho$ into four $2\times2$ blocks, one for each pair of basis states of $\mathsf{X}$ , and the partial trace acts on each block separately.

\rho=\left(\begin{array}{cc|cc} \rho_{00}&\rho_{01}&\rho_{02}&\rho_{03}\\\rho_{10}&\rho_{11}&\rho_{12}&\rho_{13}\\\hline\rho_{20}&\rho_{21}&\rho_{22}&\rho_{23}\\\rho_{30}&\rho_{31}&\rho_{32}&\rho_{33} \end{array}\right) =\begin{pmatrix}C_{00}&C_{01}\\ C_{10}&C_{11}\end{pmatrix}

Tracing out Z

\mathrm{Tr}_{\mathsf{Z}}

\textcolor{#0284c7}{\rho_{\mathsf{X}}}=\mathrm{Tr}_{\mathsf{Z}}(\rho)=\begin{pmatrix} \mathrm{Tr}(C_{00})&\mathrm{Tr}(C_{01})\\ \mathrm{Tr}(C_{10})&\mathrm{Tr}(C_{11})\end{pmatrix}

So, the reduced state $\rho_{\mathsf{X}}$ keeps one number from each block and drops everything else inside it. That is enough for the outcome probabilities. But $\rho_{\mathsf{X}}$ cannot tell us what state $\mathsf{Z}$ is left in. That depends on the correlations between $\mathsf{X}$ and $\mathsf{Z}$ , which are part of the joint state $\rho$ and are lost when $\mathsf{Z}$ is traced out. To answer the second question, we therefore need the joint state again.

The state Z, conditioned on the outcome a

The second question depends on the whole joint state $\rho$ . When $\mathsf{X}$ is measured and outcome $a$ occurs, the pair is projected onto the corresponding subspace of $\mathsf{X}$ , and what remains is the state that $\mathsf{Z}$ is left in:

\sigma_a=\mathrm{Tr}_{\mathsf{X}}\bigl((P_a\otimes I_{\mathsf{Z}})\,\rho\bigr) \qquad \rho_{\mathsf{Z}\mid a}=\frac{\sigma_a}{p_a}

The first expression is the unnormalized conditional state: a positive operator on $\mathsf{Z}$ whose trace is exactly the probability of the outcome, $\mathrm{Tr}(\sigma_a)=p_a$ . Dividing by $p_a$ renormalizes it to a proper state. This is the same calculation as before, run in reverse — instead of tracing out $\mathsf{Z}$ to ask what we will see, we trace out $\mathsf{X}$ to ask what is left behind.

The two trace operations do different jobs, and keeping them apart is the whole point:

Where the conditional state comes from

\rho

joint state of the pair

\textcolor{#0284c7}{P_a\otimes I_{\mathsf{Z}}}

project X onto outcome a, leave Z untouched

\textcolor{#059669}{\sigma_a}

unnormalized state of Z (trace = p_a)

$\div\,p_a$

\textcolor{#c2410c}{\rho_{\mathsf{Z}\mid a}}

the state Z is left in, given outcome a

Taking $\mathsf{X}$ and $\mathsf{Z}$ to be qubits shows what this projection does to the block structure. The projector $P_a$ selects one row and one column of the block matrix, the part of $\rho$ where $\mathsf{X}$ sits in outcome $a$ , and the partial trace over $\mathsf{X}$ then collapses the selected blocks onto $\mathsf{Z}$ .

Writing the blocks of $\rho$ as $C_{ij}$ as before, take the simplest case of a standard basis measurement on $\mathsf{X}$ , with $P_0=\lvert0\rangle\langle0\rvert$ and $P_1=\lvert1\rangle\langle1\rvert$ :

Outcome 0

\begin{aligned} \sigma_0&=\mathrm{Tr}_{\mathsf{X}}\bigl((P_0\otimes I_{\mathsf{Z}})\,\rho\bigr)=\textcolor{#059669}{C_{00}}\\ \rho_{\mathsf{Z}\mid 0}&=\frac{C_{00}}{\mathrm{Tr}(C_{00})} \end{aligned}

Outcome 1

\begin{aligned} \sigma_1&=\mathrm{Tr}_{\mathsf{X}}\bigl((P_1\otimes I_{\mathsf{Z}})\,\rho\bigr)=\textcolor{#059669}{C_{11}}\\ \rho_{\mathsf{Z}\mid 1}&=\frac{C_{11}}{\mathrm{Tr}(C_{11})} \end{aligned}

In the block picture, measuring $\mathsf{X}$ and conditioning on outcome $a$ keeps the diagonal block $C_{aa}$ intact, everything inside it and not just its trace, and discards the other three. That is precisely the information $\rho_{\mathsf{X}}$ threw away. The off-diagonal blocks $C_{01}$ and $C_{10}$ and the rival outcome’s block $C_{11}$ all contained correlation between $\mathsf{X}$ and $\mathsf{Z}$ , but only $C_{aa}$ describes $\mathsf{Z}$ in the branch where the outcome actually happened.

So the reduced state $\rho_{\mathsf{X}}$ and the conditional state $\rho_{\mathsf{Z}\mid a}$ are complementary reductions of the same joint state: one averages over $\mathsf{Z}$ to predict the outcome, the other conditions on the outcome to describe what remains. Neither can be obtained from the other, because each retains exactly the information the other discards. Together they answer the two questions, but only $\rho$ contains both answers at once.

Naimark’s theorem

So far, a measurement has been specified by its matrices, with the outcome probabilities obtained from a trace. That tells us what the measurement does, but not how to implement it as a circuit.

Naimark’s theorem gives such an implementation. Any $\{P_0,\ldots,P_{m-1}\}$ on $\mathsf{X}$ can be realized by adding an initialized workspace, applying one unitary operation to the combined system, and then measuring the workspace in the standard basis.

XYY

This is the measurement counterpart of a . The same kind of workspace is introduced in the state $\lvert0\rangle$ , and the same single unitary acts on the combined system. The difference is in the final step: for a channel the workspace is discarded, and for a measurement it is measured.

The proof is constructive. We choose the part of $U$ that the initial state can actually reach, show that this part is compatible with a unitary, and then check that the resulting circuit has the required outcome probabilities.

The square root of a positive semidefinite matrix

The construction relies on one fact about positive semidefinite matrices. Every positive semidefinite matrix $P$ has a unique positive semidefinite square root, written $\sqrt{P}$ and characterized by $\bigl(\sqrt{P}\bigr)^{2}=P$ .

Take a spectral decomposition of $P$ :

P=\sum_{k=0}^{n-1}\lambda_k\lvert\psi_k\rangle\langle\psi_k\rvert

Then $\sqrt{P}$ is obtained by replacing each eigenvalue with its square root:

\sqrt{P}=\sum_{k=0}^{n-1}\sqrt{\lambda_k}\lvert\psi_k\rangle\langle\psi_k\rvert

The eigenvalues $\lambda_k$ are nonnegative, so their square roots are real. The eigenvectors stay the same, and only the eigenvalues change.

Because every measurement matrix $P_a$ is positive semidefinite, each one has such a square root $\sqrt{P_a}$ .

Choosing the unitary

Naimark’s construction uses a unitary on the system $\mathsf{X}$ and an auxiliary workspace $\mathsf{Y}$ to implement the measurement. Arrange the combined system in the order $(\mathsf{Y},\mathsf{X})$ , so the matrix is divided into blocks according to $\mathsf{Y}$ , with each block containing the action on $\mathsf{X}$ .

We want $U$ to transform the initial state $\lvert0\rangle_{\mathsf{Y}}\otimes\rho_{\mathsf{X}}$ so that the different measurement outcomes are recorded in $\mathsf{Y}$ . Since the input workspace state is $\lvert0\rangle$ , only block column 0 of $U$ determines this transformation.

If the workspace started in a different state, other block columns could contribute. For the present input, however, the remaining columns are not reached. They only need to complete $U$ to a valid unitary, so their specific values are irrelevant:

V=\begin{pmatrix}\sqrt{P_0}\\\sqrt{P_1}\\\vdots\\\sqrt{P_{m-1}}\end{pmatrix}

Completing the unitary

A matrix is unitary exactly when its columns form an . So to complete $U$ , the specified block column must first have orthonormal columns.

The measurement condition gives exactly this. The conjugate-transpose product of $V$ collapses to the identity on $\mathsf{X}$ , so $V$ is an isometry — its columns are orthonormal in the larger $(\mathsf{Y},\mathsf{X})$ space:

V^{\dagger}V=\sum_{a=0}^{m-1}\bigl(\sqrt{P_a}\bigr)^{\dagger}\sqrt{P_a} =\sum_{a=0}^{m-1}P_a=I_{\mathsf{X}}

Any can be extended to an orthonormal basis. We can therefore choose additional columns to complete the columns of $V$ to a basis and place them in the remaining part of $U$ . The resulting matrix is unitary.

The unspecified blocks therefore represent exactly this freedom: different valid choices of the remaining columns give different unitary completions, while the required action on the initial $\mathsf{Y}=0$ input stays the same.

Why the circuit works

The unitary was chosen to have the required action on the initial state $\lvert0\rangle_{\mathsf{Y}}\otimes\rho_{\mathsf{X}}$ . We can now run the circuit and verify that measuring $\mathsf{Y}$ produces the correct probabilities.

The circuit starts with the workspace in $\lvert0\rangle_{\mathsf{Y}}$ , applies $U$ , and then measures $\mathsf{Y}$ in the standard basis. Order the joint system as $(\mathsf{Y},\mathsf{X})$ , so each block is indexed by a workspace state and contains an operator on $\mathsf{X}$ . Before applying $U$ , the joint state is $\sigma_{\mathrm{in}}=\lvert0\rangle\langle0\rvert_{\mathsf{Y}}\otimes\rho_{\mathsf{X}}$ .

Its block with row $a$ and column $b$ is $\bigl(\sigma_{\mathrm{in}}\bigr)_{ab}=\langle a\rvert0\rangle\langle0\rvert b\rangle\,\rho$ . Because the workspace basis states are orthonormal, $\langle a\rvert0\rangle$ is zero unless $a=0$ , and $\langle0\rvert b\rangle$ is zero unless $b=0$ . Therefore every block is zero except the $(0,0)$ block:

\sigma_{\mathrm{in}}= \begin{pmatrix} \rho_{00}&\rho_{01}&\cdots&\rho_{0,m-1}\\ \rho_{10}&\rho_{11}&\cdots&\rho_{1,m-1}\\ \vdots&\vdots&\ddots&\vdots\\ \rho_{m-1,0}&\rho_{m-1,1}&\cdots&\rho_{m-1,m-1} \end{pmatrix}=

\rho

0

\cdots

0

0

0

\cdots

0

\vdots

\vdots

\ddots

\vdots

0

0

\cdots

0

What has to be shown is that, after applying $U$ , measuring $\mathsf{Y}$ gives outcome $a$ with probability $\mathrm{Tr}(P_a\rho)$ . This must hold for every input state $\rho$ and every outcome $a$ , so that the circuit implements exactly the original measurement $\{P_0,\ldots,P_{m-1}\}$ .

Sandwiching the input state between $U$ and $U^{\dagger}$ leaves only the first block column of $U$ and the first block row of $U^{\dagger}$ . Every other block meets a zero block of the input and therefore makes no contribution. The unspecified part of $U$ is never reached by this particular input:

\sigma_{\mathrm{out}}=U\sigma_{\mathrm{in}}U^{\dagger}=

V

\sqrt{P_0}

\sqrt{P_1}

\vdots

\sqrt{P_{m-1}}

?

\rho

0

\cdots

0

0

0

\cdots

0

\vdots

\vdots

\ddots

\vdots

0

0

\cdots

0

V^{\dagger}

\sqrt{P_0}

\sqrt{P_1}

\cdots

\sqrt{P_{m-1}}

?^{\dagger}

\phantom{\sigma_{\mathrm{out}}} =V\rho V^{\dagger}\textcolor{#94a3b8}{\;+\;V\,0\,?^{\dagger}}\textcolor{#94a3b8}{\;+\;?\,0\,V^{\dagger}}\textcolor{#94a3b8}{\;+\;?\,0\,?^{\dagger}}\textcolor{#94a3b8}{\;+\;\cdots}=V\rho V^{\dagger}

\sigma_{\mathrm{out}}=\begin{pmatrix} \sqrt{P_0}\,\rho\,\sqrt{P_0}&\cdots&\sqrt{P_0}\,\rho\,\sqrt{P_{m-1}}\\ \vdots&\ddots&\vdots\\ \sqrt{P_{m-1}}\,\rho\,\sqrt{P_0}&\cdots&\sqrt{P_{m-1}}\,\rho\,\sqrt{P_{m-1}} \end{pmatrix}

The same matrix written as a sum over blocks, with $\lvert a\rangle\langle b\rvert$ naming the block position in $\mathsf{Y}$ and the $\mathsf{X}$ factor giving its contents:

\sigma_{\mathrm{out}}=\sum_{a,b=0}^{m-1}\lvert a\rangle\langle b\rvert\otimes\sqrt{P_a}\,\rho\,\sqrt{P_b}

The final measurement acts on $\mathsf{Y}$ alone, so first reduce the state to $\mathsf{Y}$ by tracing out $\mathsf{X}$ . Taking the trace of each block gives

\sigma_{\mathsf{Y}}=\sum_{a,b=0}^{m-1} \mathrm{Tr}\bigl(\sqrt{P_a}\,\rho\,\sqrt{P_b}\bigr)\lvert a\rangle\langle b\rvert

\mathrm{Tr}_{\mathsf{X}}

A standard basis measurement of $\mathsf{Y}$ reads outcome $a$ from the $a$ th diagonal entry. Using cyclicity of the trace,

\mathrm{Pr}(\text{outcome}=a)=\langle a\rvert\sigma_{\mathsf{Y}}\lvert a\rangle =\mathrm{Tr}\bigl(\sqrt{P_a}\,\rho\,\sqrt{P_a}\bigr)=\mathrm{Tr}(P_a\rho)

This is exactly the probability assigned to outcome $a$ by the original measurement $\{P_0,\ldots,P_{m-1}\}$ .

So the circuit reproduces the measurement exactly. Every general measurement can therefore be implemented by adding an initialized workspace with one basis state per outcome, applying a single unitary to the workspace and the measured system, and performing a standard basis measurement on the workspace.

Non-destructive measurements

A destructive measurement describes the classical outcome probabilities, without retaining a quantum state of the measured system. A non-destructive measurement has both a classical outcome and a post-measurement quantum state of the system that was measured.

There are two useful ways to formulate a non-destructive measurement. The first reads the post-measurement state directly from the , where the measured system remains on an outgoing wire. The second gives the general mathematical form directly.

Reading the state from Naimark’s construction

Take a general (destructive) measurement $\{P_0,\ldots,P_{m-1}\}$ of a system $\mathsf{X}$ , and the . The final measurement acts on the workspace $\mathsf{Y}$ alone, and nothing discards $\mathsf{X}$ . Ignoring that outgoing wire is what made the measurement destructive. Keeping it gives a non-destructive measurement with exactly the same outcome probabilities.

XYY

The joint state just before the is:

\sigma_{\mathrm{out}}=\sum_{a,b=0}^{m-1}\lvert a\rangle\langle b\rvert\otimes\sqrt{P_a}\,\rho\,\sqrt{P_b}

Measuring $\mathsf{Y}$ in the standard basis and obtaining outcome $a$ leaves $\mathsf{Y}$ in $\lvert a\rangle$ . This selects the $(a,a)$ block of $\sigma_{\mathrm{out}}$ , so the state left on $\mathsf{X}$ is $\sqrt{P_a}\,\rho\,\sqrt{P_a}$ .

Dividing by the probability of outcome $a$ normalizes the state, so conditioned on observing $a$ , the state of $\mathsf{X}$ becomes $\displaystyle\frac{\sqrt{P_a}\,\rho\,\sqrt{P_a}}{\mathrm{Tr}(P_a\rho)}$ .

From Kraus operators

Naimark’s construction uses $\sqrt{P_a}$ as the measurement operator for outcome $a$ , but this choice is not unique. The outcome probability depends on $\sqrt{P_a}$ only through $\bigl(\sqrt{P_a}\bigr)^{\dagger}\sqrt{P_a}=P_a$ , so different matrices can produce the same probabilities while leaving the system in different post-measurement states.

Let $M_0,\ldots,M_{m-1}$ be square matrices satisfying $\sum_{a=0}^{m-1}M_a^{\dagger}M_a=I_{\mathsf{X}}$ — they define a non-destructive measurement.

For an input state $\rho$ , outcome $a$ occurs with probability $\mathrm{Pr}(\text{outcome}=a)=\mathrm{Tr}\bigl(M_a\rho M_a^{\dagger}\bigr)=\mathrm{Tr}\bigl(M_a^{\dagger}M_a\rho\bigr)$ .

Conditioned on that outcome, the measured system is left in $\displaystyle\frac{M_a\rho M_a^{\dagger}}{\mathrm{Tr}\bigl(M_a\rho M_a^{\dagger}\bigr)}$ .

If the outcome is ignored, the state changes as $\rho\mapsto\sum_a M_a\,\rho\,M_a^{\dagger}$ . This is a quantum channel, with the $M_a$ as its . The same matrices therefore describe the non-destructive measurement when each term is associated with its corresponding outcome.

State discrimination and tomography

Quantum state discrimination

A measurement is not just something that produces an outcome. When the possible states are known in advance, the measurement can be chosen to make those outcomes as informative as possible. Quantum state discrimination asks how to choose that measurement when the goal is to identify which one of several known states was prepared.

Let $\rho_0,\ldots,\rho_{m-1}$ be quantum states of a system $\mathsf{X}$ , and let $(p_0,\ldots,p_{m-1})$ be the probabilities with which they are prepared. A label $a\in\{0,\ldots,m-1\}$ is drawn according to $(p_0,\ldots,p_{m-1})$ , and the system is then prepared in the corresponding state $\rho_a$ . The label is hidden, while the list of possible states and their probabilities are known. The task is to measure $\mathsf{X}$ and guess which label was chosen.

A strategy is a $\{P_0,\ldots,P_{m-1}\}$ , with one outcome for each possible label. If outcome $a$ occurs, the strategy guesses that the prepared state was $\rho_a$ . Its performance is measured by the probability of guessing correctly:

\mathrm{Pr}(\text{correct})=\sum_{a=0}^{m-1}p_a\,\mathrm{Tr}(P_a\rho_a)

The measurement should therefore be chosen to make this quantity as large as possible. The probabilities $p_a$ matter because some states are more likely to occur than others: correctly identifying a common state contributes more to the overall success probability than correctly identifying a rare one. A measurement that maximizes the expression is called a minimum-error measurement.

This immediately gives two useful limits. If the possible states are mutually orthogonal, they can be , so the success probability can reach $1$ . At the other extreme, the measurement can simply be ignored: always guessing the most likely state already gives success probability $\max_a p_a$ . State discrimination is interesting because the measurement can do better than this baseline by extracting information from $\mathsf{X}$ , while perfect discrimination is possible only when the states are sufficiently distinguishable.

The problem is therefore not to determine an unknown quantum state from scratch. The possible states are already known, and only the label identifying the prepared state is hidden. This is what distinguishes quantum state discrimination from , where the state itself is unknown and must be reconstructed from measurement data.

Discriminating pairs of states

With only two possible states, the optimal measurement for discriminating between them has a closed-form solution. A pair $\rho_0$ and $\rho_1$ is best discriminated by the Helstrom measurement—a two-outcome $\{\Pi_0,\Pi_1\}$ read off a single Hermitian operator built from the two states and the prior probabilities $p_0$ and $p_1$ with which they are prepared.

The Helstrom operator is the weighted difference of the two states:

\Delta=p_0\rho_0-p_1\rho_1

Read it as a scoreboard. Every direction in the state space gets a score, and the sign of the score says which hypothesis that direction supports:

$\Delta>0$ —the weighted evidence for $\rho_0$ outweighs that for $\rho_1$ . Assign this direction to outcome $0$ , i.e. answer “ $\rho_0$ was prepared.”
$\Delta<0$ — $\rho_1$ wins. Assign it to outcome $1$ , answer $\rho_1$ instead.
$\Delta=0$ —the two weighted contributions cancel exactly. The direction carries no information, and either answer is right equally often.

\Delta<0\rightarrow\text{say }\rho_1

\lambda_-=-0.29

\lambda_+=0.29

\Delta>0\rightarrow\text{say }\rho_0

Prior p₀0.50

Angle θ between the states72°

\begin{aligned} \mathrm{Pr}(\text{correct identification}) &=\tfrac12\bigl(1+\lVert\Delta\rVert_1\bigr)\\[4pt] &=\tfrac12\bigl(1+0.59\bigr)\approx0.79 \end{aligned}

Note that $\Delta$ is not a density operator: its trace is $p_0-p_1$ , not $1$ , and its eigenvalues may be negative. Both are features— $\Delta$ encodes a comparison of two states, so its eigenvalues are scores, not probabilities.

Because $\Delta$ is Hermitian, the applies: it can be diagonalized. Thus there is an orthonormal basis $\{\lvert\psi_k\rangle\}$ of eigenvectors of $\Delta$ , with real eigenvalues $\lambda_k$ , such that $\Delta\lvert\psi_k\rangle=\lambda_k\lvert\psi_k\rangle$ .

These directions $\lvert\psi_k\rangle$ are not chosen by hand—they are determined by $\Delta$ itself. They are the directions on which the action of $\Delta$ is simple: it does not change the direction and only multiplies it by the real number $\lambda_k$ .

The same eigenvectors yield the spectral decomposition $\Delta=\sum_k\lambda_k\lvert\psi_k\rangle\langle\psi_k\rvert$ .

What matters here is the meaning of $\lambda_k$ . Since $\Delta=p_0\rho_0-p_1\rho_1$ , along the direction $\lvert\psi_k\rangle$ the eigenvalue indicates which of the two weighted contributions is larger. A positive value means that $p_0\rho_0$ outweighs $p_1\rho_1$ in that direction, a negative value means the reverse, and zero means the two are exactly equal.

Prior p₀0.50

Angle θ between the states72°

\begin{aligned} \Delta&=\lambda_+\lvert\psi_+\rangle\langle\psi_+\rvert +\lambda_-\lvert\psi_-\rangle\langle\psi_-\rvert\\[6pt] &=\textcolor{#0284c7}{0.29} \lvert\psi_+\rangle\langle\psi_+\rvert \textcolor{#7c3aed}{-0.29} \lvert\psi_-\rangle\langle\psi_-\rvert \end{aligned}

Grouping the indices by the sign of the corresponding eigenvalue gives two sets:

\begin{aligned} S_0&=\{k\in\{0,\ldots,n-1\}:\lambda_k\geq0\}\\[4pt] S_1&=\{k\in\{0,\ldots,n-1\}:\lambda_k<0\} \end{aligned}

To turn each group into a measurement outcome, we construct a projector onto the corresponding subspace. For a single normalized direction $\lvert\psi_k\rangle$ , the operator $\lvert\psi_k\rangle\langle\psi_k\rvert$ projects onto that direction, keeping the component of a state along $\lvert\psi_k\rangle$ and discarding components along orthogonal directions. Since the eigenvectors within each group are mutually orthogonal, adding these individual projectors gives a projector onto the entire subspace spanned by that group. We therefore use the positive-eigenvalue subspace for outcome $0$ , identifying $\rho_0$ , and the negative-eigenvalue subspace for outcome $1$ , identifying $\rho_1$ :

\begin{aligned} \Pi_0&=\sum_{k\in S_0}\lvert\psi_k\rangle\langle\psi_k\rvert &&\quad\textcolor{#94a3b8}{\longrightarrow\ \text{outcome }0,\ \text{identify }\rho_0}\\[4pt] \Pi_1&=\sum_{k\in S_1}\lvert\psi_k\rangle\langle\psi_k\rvert &&\quad\textcolor{#94a3b8}{\longrightarrow\ \text{outcome }1,\ \text{identify }\rho_1} \end{aligned}

That $\{\Pi_0,\Pi_1\}$ is a valid measurement follows from the same decomposition. The eigenvectors form an orthonormal basis, so the two subspaces are orthogonal and together span the whole space, which in operator form reads

\begin{aligned} \Pi_0\Pi_1&=0 &&\quad\textcolor{#94a3b8}{\longrightarrow\ \text{the outcomes never fire together}}\\[4pt] \Pi_0+\Pi_1&=I_{\mathsf{X}} &&\quad\textcolor{#94a3b8}{\longrightarrow\ \text{one of them always fires}} \end{aligned}

The projectors determine the measurement outcomes:

Given that the system was prepared in $\rho_0$ , the probabilities of the two possible outcomes are

\begin{aligned} \mathrm{Pr}(0\mid\rho_0)&=\mathrm{Tr}(\Pi_0\rho_0),\\[4pt] \mathrm{Pr}(1\mid\rho_0)&=\mathrm{Tr}(\Pi_1\rho_0). \end{aligned}

Given that the system was prepared in $\rho_1$ , they are

\begin{aligned} \mathrm{Pr}(0\mid\rho_1)&=\mathrm{Tr}(\Pi_0\rho_1),\\[4pt] \mathrm{Pr}(1\mid\rho_1)&=\mathrm{Tr}(\Pi_1\rho_1). \end{aligned}

The first and last of these are the probabilities of correct identification: obtaining outcome $0$ when $\rho_0$ was prepared, or outcome $1$ when $\rho_1$ was prepared. Since $\rho_0$ is prepared with probability $p_0$ and $\rho_1$ with probability $p_1$ , the overall success probability is the prior-weighted sum of these two correct-identification probabilities:

\mathrm{Pr}(\text{correct identification})=p_0\,\mathrm{Tr}(\Pi_0\rho_0)+p_1\,\mathrm{Tr}(\Pi_1\rho_1).

To express this in terms of the Helstrom operator $\Delta$ , use $\Pi_1=I_{\mathsf{X}}-\Pi_0$ . Because $\rho_1$ is a density operator, $\mathrm{Tr}(\rho_1)=1$ , so

\begin{aligned} \mathrm{Pr}(\text{correct identification}) &=p_0\,\mathrm{Tr}(\Pi_0\rho_0) +p_1\,\mathrm{Tr}\bigl((I_{\mathsf{X}}-\Pi_0)\rho_1\bigr)\\[4pt] &=p_0\,\mathrm{Tr}(\Pi_0\rho_0) +p_1\bigl(\mathrm{Tr}(I_{\mathsf{X}}\rho_1)-\mathrm{Tr}(\Pi_0\rho_1)\bigr)\\[4pt] &=p_0\,\mathrm{Tr}(\Pi_0\rho_0)+p_1-p_1\,\mathrm{Tr}(\Pi_0\rho_1)\\[4pt] &=p_1+p_0\,\mathrm{Tr}(\Pi_0\rho_0)-p_1\,\mathrm{Tr}(\Pi_0\rho_1)\\[4pt] &=p_1+\mathrm{Tr}(\Pi_0\,p_0\rho_0)-\mathrm{Tr}(\Pi_0\,p_1\rho_1)\\[4pt] &=p_1+\mathrm{Tr}\bigl(\Pi_0(p_0\rho_0-p_1\rho_1)\bigr). \end{aligned}

Since $\Delta=p_0\rho_0-p_1\rho_1$ , this becomes $\mathrm{Pr}(\text{correct identification})=p_1+\mathrm{Tr}(\Pi_0\Delta)$ .

Now we can see why the positive-eigenvalue subspace was chosen for $\Pi_0$ . That expression shows that, with $p_1$ fixed, maximizing the probability of correct identification means maximizing $\mathrm{Tr}(\Pi_0\Delta)$ . In the eigenbasis of $\Delta$ , each direction $\lvert\psi_k\rangle$ contributes its eigenvalue $\lambda_k$ . Therefore, including a direction with $\lambda_k>0$ increases the trace, while including a direction with $\lambda_k<0$ decreases it. The optimal projector $\Pi_0$ must therefore include all positive-eigenvalue directions and exclude all negative-eigenvalue directions. This is exactly the projector we constructed from $S_0$ :

\Pi_0=\sum_{k\in S_0}\lvert\psi_k\rangle\langle\psi_k\rvert.

We can now evaluate the value of the trace for this optimal choice. Since $\Delta=\sum_j\lambda_j\lvert\psi_j\rangle\langle\psi_j\rvert$ ,

\begin{aligned} \Pi_0\Delta &=\Bigl(\sum_{k\in S_0}\lvert\psi_k\rangle\langle\psi_k\rvert\Bigr) \Bigl(\sum_j\lambda_j\lvert\psi_j\rangle\langle\psi_j\rvert\Bigr) &&\quad\textcolor{#94a3b8}{\text{the projector times the decomposition}}\\[4pt] &=\sum_{k\in S_0}\sum_j\lambda_j \lvert\psi_k\rangle\langle\psi_k\vert\psi_j\rangle\langle\psi_j\rvert &&\quad\textcolor{#94a3b8}{\text{multiplied out, every }k\text{ against every }j}\\[4pt] &=\sum_{k\in S_0}\sum_j\lambda_j\,\delta_{kj} \lvert\psi_k\rangle\langle\psi_j\rvert &&\quad\textcolor{#94a3b8}{\text{orthonormality: }\langle\psi_k\vert\psi_j\rangle=\delta_{kj}}\\[4pt] &=\sum_{k\in S_0}\lambda_k\lvert\psi_k\rangle\langle\psi_k\rvert &&\quad\textcolor{#94a3b8}{\delta_{kj}=0\ \text{unless }j=k,\ \text{so only that term survives}} \end{aligned}

and taking the trace,

\begin{aligned} \mathrm{Tr}(\Pi_0\Delta) &=\mathrm{Tr}\Bigl(\sum_{k\in S_0}\lambda_k \lvert\psi_k\rangle\langle\psi_k\rvert\Bigr)\\[4pt] &=\sum_{k\in S_0}\lambda_k\, \mathrm{Tr}\bigl(\lvert\psi_k\rangle\langle\psi_k\rvert\bigr) &&\quad\textcolor{#94a3b8}{\text{the trace is linear}}\\[4pt] &=\sum_{k\in S_0}\lambda_k &&\quad\textcolor{#94a3b8}{\mathrm{Tr}\bigl(\lvert\psi_k\rangle\langle\psi_k\rvert\bigr)=\langle\psi_k\vert\psi_k\rangle=1} \end{aligned}

The success probability is therefore obtained by adding the fixed term $p_1$ to the contributions from all nonnegative eigenvalues selected by $\Pi_0$ :

\mathrm{Pr}(\text{correct identification})=p_1+\sum_{k\in S_0}\lambda_k.

To put this into a symmetric form, start from the trace of $\Delta$ . Both $\rho_0$ and $\rho_1$ are density operators, so each has unit trace:

\begin{aligned} \mathrm{Tr}(\Delta) &=\mathrm{Tr}(p_0\rho_0-p_1\rho_1) &&\quad\textcolor{#94a3b8}{\text{the definition of }\Delta}\\[4pt] &=p_0\,\mathrm{Tr}(\rho_0)-p_1\,\mathrm{Tr}(\rho_1) &&\quad\textcolor{#94a3b8}{\text{the trace is linear}}\\[4pt] &=p_0-p_1 &&\quad\textcolor{#94a3b8}{\mathrm{Tr}(\rho_0)=\mathrm{Tr}(\rho_1)=1} \end{aligned}

The trace is also the sum of the eigenvalues, and $S_0$ and $S_1$ between them account for every index, so that sum splits in two:

\begin{aligned} \sum_{k\in S_0}\lambda_k+\sum_{k\in S_1}\lambda_k &=\sum_k\lambda_k=\mathrm{Tr}(\Delta)=p_0-p_1 &&\quad\textcolor{#94a3b8}{\text{every index lies in one set or the other}}\\[4pt] \sum_{k\in S_1}\lambda_k &=p_0-p_1-\sum_{k\in S_0}\lambda_k &&\quad\textcolor{#94a3b8}{\text{rearranged for the negative part}} \end{aligned}

Every eigenvalue in $S_1$ is negative, so $\lvert\lambda_k\rvert=-\lambda_k$ there, and the total magnitude of the eigenvalues can be written using only the selected sum:

\begin{aligned} \sum_k\lvert\lambda_k\rvert &=\sum_{k\in S_0}\lvert\lambda_k\rvert+\sum_{k\in S_1}\lvert\lambda_k\rvert\\[4pt] &=\sum_{k\in S_0}\lambda_k-\sum_{k\in S_1}\lambda_k &&\quad\textcolor{#94a3b8}{\lvert\lambda_k\rvert=\lambda_k\text{ on }S_0,\ -\lambda_k\text{ on }S_1}\\[4pt] &=\sum_{k\in S_0}\lambda_k-\Bigl(p_0-p_1-\sum_{k\in S_0}\lambda_k\Bigr) &&\quad\textcolor{#94a3b8}{\text{substituting the line above}}\\[4pt] &=2\sum_{k\in S_0}\lambda_k-p_0+p_1 &&\quad\textcolor{#94a3b8}{\text{collecting the two copies}} \end{aligned}

Solving that for the selected sum gives $\sum_{k\in S_0}\lambda_k=\tfrac12\bigl(\sum_k\lvert\lambda_k\rvert+p_0-p_1\bigr)$ , and substituting it into the success probability above:

\begin{aligned} \mathrm{Pr}(\text{correct identification}) &=p_1+\tfrac12\Bigl(\sum_k\lvert\lambda_k\rvert+p_0-p_1\Bigr) &&\quad\textcolor{#94a3b8}{\text{substituted into }p_1+\textstyle\sum_{k\in S_0}\lambda_k}\\[4pt] &=\frac{p_0+p_1}{2}+\frac12\sum_k\lvert\lambda_k\rvert &&\quad\textcolor{#94a3b8}{\text{collecting the priors}}\\[4pt] &=\frac12+\frac12\sum_k\lvert\lambda_k\rvert &&\quad\textcolor{#94a3b8}{p_0+p_1=1} \end{aligned}

Since $\sum_k\lvert\lambda_k\rvert$ is the trace norm $\lVert\Delta\rVert_1$ , this becomes the Helstrom bound

\boxed{\;\mathrm{Pr}(\text{correct identification})=\frac12+\frac12\lVert\Delta\rVert_1.\;}

The two extremes can be read straight off this formula. If the states are identical and the priors equal, then $\Delta=0$ , the norm vanishes, and the measurement does no better than a coin toss at $1/2$ . If the states are orthogonal, the norm equals $1$ , the success probability reaches $1$ , and is possible. Everything else lies in between.

The Helstrom bound applies to any pair of quantum states, whether pure or mixed, and to arbitrary prior probabilities. A particularly simple special case is two pure states with equal priors, $\rho_0=\lvert\psi_0\rangle\langle\psi_0\rvert$ , $\rho_1=\lvert\psi_1\rangle\langle\psi_1\rvert$ , and $p_0=p_1=1/2$ . For this case, the trace norm can be expressed directly through the overlap of the two states, giving the compact formula

\mathrm{Pr}(\text{correct identification})=\frac12+\frac12\sqrt{1-\lvert\langle\psi_0\vert\psi_1\rangle\rvert^{2}}.

Here $\lvert\langle\psi_0\vert\psi_1\rangle\rvert$ measures how similar the two states are: the larger the overlap, the harder they are to distinguish, and the lower the achievable success probability.

States

Prior p₀ / p₁0.50 / 0.50

Guess50%

Helstrom measurement79.4%

Partial discriminationEqual priors

\lvert\langle\psi_0\vert\psi_1\rangle\rvert

0.81

\lambda_+

0.29

\lambda_-

-0.29

\begin{aligned} \mathrm{Pr}(\text{correct identification}) &=\frac{1+\lVert p_0\rho_0-p_1\rho_1\rVert_1}{2}\\[6pt] &=\frac{1+\textcolor{#0f766e}{0.59}}{2} \approx\textcolor{#0f766e}{0.79} \end{aligned}

Optimality of the Helstrom measurement

The measurement constructed from the eigenvalues of $\Delta$ achieves the Helstrom bound, but we still need to show that this bound cannot be exceeded by a more general measurement. The Helstrom–Holevo theorem establishes exactly this: the optimal success probability is unchanged even when arbitrary measurements, not only projective ones, are allowed.

To see this, consider any two-outcome $\{P_0,P_1\}$ . This is sufficient because any measurement with more outcomes can group them according to the two possible guesses, $\rho_0$ or $\rho_1$ .

The derivation of the success probability did not rely on $P_0$ being a projector. It used only the completeness relation $P_0+P_1=I_{\mathsf{X}}$ and the normalization $\mathrm{Tr}(\rho_1)=1$ . Therefore, for any two-outcome measurement $\{P_0,P_1\}$ , we may substitute $P_1=I_{\mathsf{X}}-P_0$ in exactly the same way to obtain $\mathrm{Pr}(\text{correct identification})=p_1+\mathrm{Tr}(P_0\Delta)$ .

To compare an arbitrary $P_0$ with the projector $\Pi_0$ , look at what $P_0$ does along each eigenvector $\lvert\psi_k\rangle$ of $\Delta$ . Define $c_k=\langle\psi_k\rvert P_0\lvert\psi_k\rangle$ .

Because $0\leq P_0\leq I_{\mathsf{X}}$ , each $c_k$ lies between $0$ and $1$ . It can therefore be viewed as how much of the $k$ -th eigendirection contributes to outcome $0$ . Using the eigenbasis of $\Delta$ , the trace becomes $\mathrm{Tr}(P_0\Delta)=\sum_k\lambda_k c_k$ .

For every nonnegative eigenvalue, the largest possible contribution is obtained by taking $c_k=1$ , and for every negative eigenvalue, the largest contribution is obtained by taking $c_k=0$ . Hence $\mathrm{Tr}(P_0\Delta)\leq\sum_{k\in S_0}\lambda_k$ .

The Helstrom projector $\Pi_0$ has exactly this choice: $c_k=1$ for every $k\in S_0$ and $c_k=0$ for every $k\in S_1$ . It therefore attains the maximum possible value of $\mathrm{Tr}(P_0\Delta)$ . Hence every two-outcome measurement satisfies, and since $\Pi_0$ attains this bound, the Helstrom measurement is optimal:

\mathrm{Pr}(\text{correct identification})\leq p_1+\sum_{k\in S_0}\lambda_k=\frac12+\frac12\lVert\Delta\rVert_1.

Discriminating three or more states

Two-state discrimination works because there is only ever one question to answer. Every relevant direction either favors $\rho_0$ or favors $\rho_1$ , and the sign of a single operator settles the choice. The is simply that sign, read off from the states.

With $m\geq3$ states, there is no such question. A direction that favors $\rho_0$ over $\rho_1$ may still be more useful for distinguishing $\rho_2$ , so all outcomes compete simultaneously and no single operator has a sign by which to sort them. There is no known closed-form formula for the optimal measurement in general.

The can still be solved as an optimization. The success probability is linear in the measurement operators, while the operators themselves are constrained to be positive semidefinite and to sum to the identity. An optimization problem with exactly this structure is called a semidefinite program (SDP).

For a given set of states and priors, a numerical solver can therefore return the optimal measurement operators—usually as numerical matrices—together with the corresponding maximum success probability. What it generally cannot provide is a simple closed-form expression for those operators in terms of the states.

Verifying a candidate measurement

A measurement that was guessed, or constructed from the states using some natural recipe, can be tested directly for optimality. Given the proposed measurement $\{P_a\}$ , form $Y=\sum_a p_a\rho_aP_a$ .

The Holevo–Yuen–Kennedy–Lax (HYKL) conditions state that this measurement is optimal exactly when both of the following hold:

$Y=Y^{\dagger}$ (Hermiticity)
$Y-p_b\rho_b\geq0$ for every $b$

When these conditions hold, the measurement’s success probability is $\mathrm{Pr}(\text{correct identification})=\mathrm{Tr}(Y)$ .

For an arbitrary collection of states, verifying the conditions may still require a nontrivial calculation. Symmetry can simplify the problem: when several states are arranged symmetrically, the measurement suggested by that symmetry can sometimes be verified directly, and some such families can be solved exactly.

States evenly spaced around a circle

For example, consider $m$ equally likely states arranged symmetrically around a circle of the Bloch sphere. The symmetry makes it possible to construct and verify an optimal measurement explicitly. In this case, the optimal measurement succeeds with probability $2/m$ , compared with $1/m$ for guessing.

Guess25%

Best measurement50%

States

m

4

\begin{aligned} \text{guess}\quad&\tfrac1m=\tfrac1{4}\approx0.25\\[6pt] \text{best measurement}\quad&\tfrac2m=\tfrac2{4}\approx0.50 \end{aligned}

The tetrahedral states

The are the same idea, with the symmetry spread over the whole Bloch sphere rather than around a single circle. Four equally likely states point toward the vertices of a tetrahedron, and the corresponding symmetric four-outcome measurement uses $P_a=\lvert\phi_a\rangle\langle\phi_a\rvert/2$ . The tetrahedral symmetry makes the HYKL conditions easy to verify, showing directly that this natural measurement is optimal.

Guess25%

Best measurement50%

Asking which of a known list of states was prepared can look like an invented puzzle: if someone prepared the state, why not simply ask them? But theoretically, a quantum experiment can produce a state without revealing which preparation was used. A measurement then has to infer the state from the quantum system alone.

The discrimination problem sounds simple, but the mathematics turns out to be surprisingly heavy, and this treatment has not even touched the physical problem of how to construct the measurements. The payoff, however, is a fundamental limit: for non-orthogonal states, no measurement can identify the state with absolute certainty.

Quantum state tomography

Quantum state tomography is the task of reconstructing an unknown quantum state from measurement data.

Let $\rho$ be an unknown quantum state of a system. Identical systems $\mathsf{X}_1,\ldots,\mathsf{X}_N$ are each independently prepared in the state $\rho$ . The goal is to approximate $\rho$ by measuring $\mathsf{X}_1,\ldots,\mathsf{X}_N$ .

Compare this with . There, the candidates were handed over in advance and the only thing hidden was a label, so one system and one measurement sufficed to make a decision. Here, nothing is given in advance: the answer is a matrix rather than an index, and accuracy is paid for with the number of copies $N$ .

One copy is worth almost nothing on its own. A measurement of a single system returns a single outcome, and an outcome is merely a sample from a probability distribution rather than the distribution itself. Only by repeating a measurement across many identically prepared systems do the probabilities that describe $\rho$ begin to show through. This is why tomography is inherently a statistical procedure, while discrimination is not.

Quantum state tomography comes in several variants:

Local vs. global measurements. Measurements can be local, with each of $\mathsf{X}_1,\ldots,\mathsf{X}_N$ measured separately, or global, with a single joint measurement performed on all copies at once. Global measurements can extract more information from the same number of copies, but are much harder to implement.
Reconstruction strategies. Different strategies can be used to infer $\rho$ from the measurement data. The simplest inverts the relationship between the state and the outcome probabilities, treating the observed frequencies as exact. But this naive inversion can produce a matrix that is not a valid quantum state, motivating more sophisticated approaches.

Qubit tomography

Suppose $\rho$ is an unknown qubit state, and $\mathsf{X}_1,\ldots,\mathsf{X}_N$ are qubits independently prepared in the state $\rho$ . The goal is to determine $\rho$ by performing measurements on these qubits.

There are several possible measurement strategies. For example, one could measure the Pauli observables, or use a tetrahedral measurement, whose four outcomes correspond to the vertices of a tetrahedron on the Bloch sphere.

The Pauli observables $\sigma_x$ , $\sigma_y$ , and $\sigma_z$ provide a natural way to reconstruct a qubit state, but they are incompatible with each other: they cannot be measured simultaneously on the same qubit, and a measurement disturbs the state. The $N$ qubits are therefore divided into three groups, with each group used to measure one observable, yielding estimates of the three expectation values $\langle\sigma_x\rangle$ , $\langle\sigma_y\rangle$ , and $\langle\sigma_z\rangle$ .

Measuring $\sigma_x$

$\{\lvert+\rangle\langle+\rvert,\lvert-\rangle\langle-\rvert\}$

$N/3$ qubits

The two outcomes are the eigenvectors of $\sigma_x$ .

+1for each $\lvert+\rangle\langle+\rvert$ outcome
−1for each $\lvert-\rangle\langle-\rvert$ outcome

Expected value for each measurement:

\mathrm{Tr}(\sigma_x\rho)

Measuring $\sigma_y$

$\{\lvert{+}i\rangle\langle{+}i\rvert,\lvert{-}i\rangle\langle{-}i\rvert\}$

$N/3$ qubits

The two outcomes are the eigenvectors of $\sigma_y$ .

+1for each $\lvert{+}i\rangle\langle{+}i\rvert$ outcome
−1for each $\lvert{-}i\rangle\langle{-}i\rvert$ outcome

Expected value for each measurement:

\mathrm{Tr}(\sigma_y\rho)

Measuring $\sigma_z$

$\{\lvert0\rangle\langle0\rvert,\lvert1\rangle\langle1\rvert\}$

$N/3$ qubits

The two outcomes are the eigenvectors of $\sigma_z$ .

+1for each $\lvert0\rangle\langle0\rvert$ outcome
−1for each $\lvert1\rangle\langle1\rvert$ outcome

Expected value for each measurement:

\mathrm{Tr}(\sigma_z\rho)

Reconstructing $\rho$

\displaystyle\rho=\frac{I+\mathrm{Tr}(\sigma_x\rho)\,\sigma_x+\mathrm{Tr}(\sigma_y\rho)\,\sigma_y+\mathrm{Tr}(\sigma_z\rho)\,\sigma_z}{2}

Any qubit state can be written in the Pauli basis as

\displaystyle\rho=\frac{I+r_x\sigma_x+r_y\sigma_y+r_z\sigma_z}{2},

where $r_x$ , $r_y$ , and $r_z$ are the three components of the state’s . For the state $\rho$ , these components are exactly the expectation values of the Pauli observables:

r_x=\mathrm{Tr}(\sigma_x\rho),\quad r_y=\mathrm{Tr}(\sigma_y\rho),\quad r_z=\mathrm{Tr}(\sigma_z\rho).

The measurement results therefore provide estimates of $r_x$ , $r_y$ , and $r_z$ . Substituting them into the Pauli-basis expansion gives the reconstructed state above.

What finite measurements reveal

The reconstruction formula is exact only when true expectation values are available, while a real experiment yields merely finite samples. With $N$ copies divided into three groups, each group of $N/3$ outcomes provides a sample average that estimates one expectation value. The typical error of such an average scales as $1/\sqrt{N}$ , so increasing the number of copies improves the estimate but never makes it exact for any finite run.

More importantly, the three estimated coefficients need not correspond to a physical state. If $r_x^2+r_y^2+r_z^2>1$ , the reconstructed point lies outside the Bloch ball, and the resulting matrix has a negative eigenvalue — it is not a density matrix at all. This is why finite-data tomography is inherently approximate, and why practical reconstruction methods must do more than simply invert the sample averages.

State

true stateestimate

Polar angle52°

Azimuth40°

Bloch radius1.00

Copies150

Copies per group50

\lVert\hat{r}\rVert

1.05

\displaystyle\hat{\rho}=\frac{I+\hat{r}_x\sigma_x+\hat{r}_y\sigma_y+\hat{r}_z\sigma_z}{2}={\small\begin{pmatrix}0.74&0.30-0.36i\\0.30+0.36i&0.26\end{pmatrix}}

Purifications

are more difficult to work with than pure states because they represent statistical mixtures rather than a single state vector. A useful way to handle them is to represent a mixed state as part of a larger system whose overall state is pure. Purification formalizes this construction.

A purification of a density matrix $\rho$ on system $\mathsf{X}$ is a pure state $\lvert\psi\rangle$ of a larger composite system $\mathsf{X}\otimes\mathsf{Y}$ such that, after ignoring the auxiliary system $\mathsf{Y}$ , the state of $\mathsf{X}$ is exactly $\rho$ :

\mathrm{Tr}_{\mathsf{Y}}\bigl(\lvert\psi\rangle\langle\psi\rvert\bigr)=\rho.

Here $\mathrm{Tr}_{\mathsf{Y}}$ denotes the over $\mathsf{Y}$ . The auxiliary system $\mathsf{Y}$ can be thought of as containing degrees of freedom that are not accessible when only $\mathsf{X}$ is observed. If $\mathsf{X}$ and $\mathsf{Y}$ are correlated, $\mathsf{X}$ can therefore appear mixed even though the joint state of $\mathsf{X}\otimes\mathsf{Y}$ is pure.

State

mixed state of X

pure state of X and Y

\rho_{\mathsf{X}}=0.50\,\lvert0\rangle\langle0\rvert+0.50\,\lvert1\rangle\langle1\rvert

\lvert\psi\rangle=0.71\,\lvert00\rangle+0.71\,\lvert11\rangle

	$\langle0\rvert$	$\langle1\rvert$
$\lvert0\rangle$	0.50	0.00
$\lvert1\rangle$	0.00	0.50

	$\langle00\rvert$	$\langle11\rvert$
$\lvert00\rangle$	0.50	0.50
$\lvert01\rangle$	0.00	0.00
$\lvert10\rangle$	0.00	0.00
$\lvert11\rangle$	0.50	0.50

X

Y

Mixture of |0⟩ and |1⟩0.50 / 0.50

\mathrm{Tr}_{\mathsf{Y}}\bigl(\lvert\psi\rangle\langle\psi\rvert\bigr)={\small\begin{pmatrix}0.50&0\\0&0.50\end{pmatrix}}=\rho_{\mathsf{X}}

Purifications are useful because they allow mixed-state problems to be studied through a larger pure state, where tools such as entanglement and unitary evolution can often be applied more directly.

Existence of purifications

Let $\mathsf{X}$ be a quantum system and let $\rho$ be a density matrix describing a state of $\mathsf{X}$ . By definition, $\rho$ can be written as a of pure states, for some probability vector $(p_0,\ldots,p_{n-1})$ and some state vectors $\lvert\phi_0\rangle,\ldots,\lvert\phi_{n-1}\rangle$ of $\mathsf{X}$ :

\displaystyle\rho=\sum_{a=0}^{n-1}p_a\,\lvert\phi_a\rangle\langle\phi_a\rvert.

This decomposition already tells us how to construct a purification. Introduce an auxiliary system $\mathsf{Y}$ whose classical states are labelled $0,\ldots,n-1$ , and pair each term of the mixture with a distinct classical state $\lvert a\rangle$ of that system, so that the probability $p_a$ becomes the square of an amplitude:

\displaystyle\lvert\psi\rangle=\sum_{a=0}^{n-1}\sqrt{p_a}\,\lvert\phi_a\rangle\otimes\lvert a\rangle.

To see that $\lvert\psi\rangle$ is indeed a purification of $\rho$ , trace out $\mathsf{Y}$ . The cross terms vanish because $\mathrm{Tr}(\lvert a\rangle\langle b\rvert)=\delta_{ab}$ , which is one when $a=b$ and zero otherwise, so only the diagonal terms survive and the original mixture comes back:

\displaystyle\begin{aligned} \mathrm{Tr}_{\mathsf{Y}}\bigl(\lvert\psi\rangle\langle\psi\rvert\bigr) &=\mathrm{Tr}_{\mathsf{Y}}\Bigl(\Bigl(\sum_{a=0}^{n-1}\sqrt{p_a}\,\lvert\phi_a\rangle\otimes\lvert a\rangle\Bigr)\Bigl(\sum_{b=0}^{n-1}\sqrt{p_b}\,\langle\phi_b\rvert\otimes\langle b\rvert\Bigr)\Bigr) &&\quad\textcolor{#94a3b8}{\text{the state vector and its conjugate, written out}}\\[4pt] &=\sum_{a,b=0}^{n-1}\sqrt{p_ap_b}\,\lvert\phi_a\rangle\langle\phi_b\rvert\,\mathrm{Tr}\bigl(\lvert a\rangle\langle b\rvert\bigr) &&\quad\textcolor{#94a3b8}{\text{each term splits, and the trace falls on }\mathsf{Y}}\\[4pt] &=\sum_{a,b=0}^{n-1}\sqrt{p_ap_b}\,\lvert\phi_a\rangle\langle\phi_b\rvert\,\delta_{ab} &&\quad\textcolor{#94a3b8}{\mathrm{Tr}\bigl(\lvert a\rangle\langle b\rvert\bigr)=\langle b\rvert a\rangle=\delta_{ab}}\\[4pt] &=\sum_{a=0}^{n-1}p_a\,\lvert\phi_a\rangle\langle\phi_a\rvert &&\quad\textcolor{#94a3b8}{\text{only the terms with }a=b\text{ survive}}\\[4pt] &=\rho &&\quad\textcolor{#94a3b8}{\text{the mixture we started from}} \end{aligned}

Finally, every density matrix has at least one such decomposition — its — with at most as many terms as the dimension of $\mathsf{X}$ . Therefore every state of $\mathsf{X}$ has a purification, provided that $\mathsf{Y}$ has at least as many classical states as $\mathsf{X}$ does.

Schmidt decomposition

A pure state of a bipartite system can contain correlations between its two subsystems. The Schmidt decomposition provides a useful way to make these correlations explicit by expressing the state as a sum of paired states of the two subsystems.

Every state vector $\lvert\psi\rangle$ of a bipartite system $(\mathsf{X},\mathsf{Y})$ can be written in the form:

\displaystyle\lvert\psi\rangle=\sum_{a=0}^{r-1}\sqrt{p_a}\,\lvert x_a\rangle\otimes\lvert y_a\rangle.

The coefficients $p_0,\ldots,p_{r-1}$ are strictly positive and satisfy $\sum_a p_a=1$ .
The sets $\{\lvert x_0\rangle,\ldots,\lvert x_{r-1}\rangle\}$ and $\{\lvert y_0\rangle,\ldots,\lvert y_{r-1}\rangle\}$ are . They do not necessarily span the full state spaces of $\mathsf{X}$ and $\mathsf{Y}$ , since only the subspaces involved in $\lvert\psi\rangle$ are needed.
The number of terms $r$ is the Schmidt rank, and it can be no larger than the dimension of either system. A Schmidt rank of one means the state is a product state, while a larger rank indicates correlations between $\mathsf{X}$ and $\mathsf{Y}$ .

Constructing the decomposition

To find the Schmidt decomposition, first extract the coefficients and basis states on one side, then use the original state to recover the corresponding states on the other side.

Compute the of the reduced state $\rho_{\mathsf{X}}=\mathrm{Tr}_{\mathsf{Y}}(\lvert\psi\rangle\langle\psi\rvert)$ .
Keep only the $r$ strictly positive eigenvalues $p_a$ and their corresponding eigenvectors $\lvert x_a\rangle$ :
$\displaystyle\rho_{\mathsf{X}}=\sum_{a=0}^{r-1}p_a\,\lvert x_a\rangle\langle x_a\rvert.$
For each $a$ , project $\lvert\psi\rangle$ onto $\lvert x_a\rangle$ and normalize the resulting state on $\mathsf{Y}$ :
$\displaystyle\lvert y_a\rangle=\frac{(\langle x_a\rvert\otimes I)\lvert\psi\rangle}{\sqrt{p_a}}.$

The vectors

\lvert y_a\rangle

are orthonormal by construction

Take the inner product of two vectors $\lvert y_a\rangle$ and $\lvert y_b\rangle$ using their definition above. The resulting expression can be written in terms of the reduced state $\rho_{\mathsf{X}}$ , whose eigenvectors $\lvert x_a\rangle$ are orthonormal:

\displaystyle\begin{aligned} \langle y_b\rvert y_a\rangle &=\Biggl(\frac{(\langle x_b\rvert\otimes I)\lvert\psi\rangle}{\sqrt{p_b}}\Biggr)^{\dagger}\Biggl(\frac{(\langle x_a\rvert\otimes I)\lvert\psi\rangle}{\sqrt{p_a}}\Biggr) &&\quad\textcolor{#94a3b8}{\text{each vector by its definition}}\\[4pt] &=\frac{\langle\psi\rvert(\lvert x_b\rangle\otimes I)(\langle x_a\rvert\otimes I)\lvert\psi\rangle}{\sqrt{p_ap_b}} &&\quad\textcolor{#94a3b8}{(\langle x_b\rvert\otimes I)^{\dagger}=\lvert x_b\rangle\otimes I}\\[4pt] &=\frac{\langle\psi\rvert(\lvert x_b\rangle\langle x_a\rvert\otimes I)\lvert\psi\rangle}{\sqrt{p_ap_b}} &&\quad\textcolor{#94a3b8}{(A\otimes I)(B\otimes I)=AB\otimes I}\\[4pt] &=\frac{\mathrm{Tr}\bigl(\lvert x_b\rangle\langle x_a\rvert\,\rho_{\mathsf{X}}\bigr)}{\sqrt{p_ap_b}} &&\quad\textcolor{#94a3b8}{\langle\psi\rvert(A\otimes I)\lvert\psi\rangle=\mathrm{Tr}(A\rho_{\mathsf{X}})}\\[4pt] &=\frac{\langle x_a\rvert\rho_{\mathsf{X}}\lvert x_b\rangle}{\sqrt{p_ap_b}} &&\quad\textcolor{#94a3b8}{\mathrm{Tr}\bigl(\lvert x_b\rangle\langle x_a\rvert M\bigr)=\langle x_a\rvert M\lvert x_b\rangle}\\[4pt] &=\frac{p_b\,\langle x_a\rvert x_b\rangle}{\sqrt{p_ap_b}} &&\quad\textcolor{#94a3b8}{\rho_{\mathsf{X}}\lvert x_b\rangle=p_b\lvert x_b\rangle}\\[4pt] &=\delta_{ab} \end{aligned}

State

the state of the pair we start with

\lvert\psi\rangle=\overbrace{\tfrac{1}{\sqrt2}\,\underbrace{\lvert0\rangle}_{\beta}\otimes\underbrace{\lvert0\rangle}_{\text{fixed}}+\tfrac{1}{\sqrt2}\,\underbrace{\lvert{+}\rangle}_{\gamma}\otimes\underbrace{\lvert1\rangle}_{\text{fixed}}}^{\textstyle\mathsf{X}\otimes\mathsf{Y}}

Direction β0°

Direction γ45°

Balance between the two terms45°

applying Schmidt decomposition

trace out $\mathsf{Y}$ to get the reduced state:
$\rho_{\mathsf{X}}=\mathrm{Tr}_{\mathsf{Y}}\bigl(\lvert\psi\rangle\langle\psi\rvert\bigr)$
$\phantom{\rho_{\mathsf{X}}}=\mathrm{Tr}_{\mathsf{Y}}\Bigl(\bigl(\tfrac{1}{\sqrt2}\,\lvert\beta\rangle\otimes\lvert0\rangle+\tfrac{1}{\sqrt2}\,\lvert\gamma\rangle\otimes\lvert1\rangle\bigr)\bigl(\tfrac{1}{\sqrt2}\,\langle\beta\rvert\otimes\langle0\rvert+\tfrac{1}{\sqrt2}\,\langle\gamma\rvert\otimes\langle1\rvert\bigr)\Bigr)$
$\phantom{\rho_{\mathsf{X}}}=\mathrm{Tr}_{\mathsf{Y}}\Bigl(0.50\,\lvert\beta\rangle\langle\beta\rvert\otimes\lvert0\rangle\langle0\rvert+0.50\,\lvert\beta\rangle\langle\gamma\rvert\otimes\lvert0\rangle\langle1\rvert+0.50\,\lvert\gamma\rangle\langle\beta\rvert\otimes\lvert1\rangle\langle0\rvert+0.50\,\lvert\gamma\rangle\langle\gamma\rvert\otimes\lvert1\rangle\langle1\rvert\Bigr)$
$\phantom{\rho_{\mathsf{X}}}=0.50\,\lvert\beta\rangle\langle\beta\rvert\,\mathrm{Tr}\bigl(\lvert0\rangle\langle0\rvert\bigr)+0.50\,\lvert\beta\rangle\langle\gamma\rvert\,\mathrm{Tr}\bigl(\lvert0\rangle\langle1\rvert\bigr)+0.50\,\lvert\gamma\rangle\langle\beta\rvert\,\mathrm{Tr}\bigl(\lvert1\rangle\langle0\rvert\bigr)+0.50\,\lvert\gamma\rangle\langle\gamma\rvert\,\mathrm{Tr}\bigl(\lvert1\rangle\langle1\rvert\bigr)$
$\phantom{\rho_{\mathsf{X}}}=0.50\,\lvert\beta\rangle\langle\beta\rvert\,\langle0\vert0\rangle+0.50\,\lvert\beta\rangle\langle\gamma\rvert\,\langle1\vert0\rangle+0.50\,\lvert\gamma\rangle\langle\beta\rvert\,\langle0\vert1\rangle+0.50\,\lvert\gamma\rangle\langle\gamma\rvert\,\langle1\vert1\rangle$
$\phantom{\rho_{\mathsf{X}}}=0.50\,\lvert\beta\rangle\langle\beta\rvert+0.50\,\lvert\gamma\rangle\langle\gamma\rvert$
$\phantom{\rho_{\mathsf{X}}}=0.50\,\begin{pmatrix}1.00&0.00\\0.00&0.00\end{pmatrix}+0.50\,\begin{pmatrix}0.50&0.50\\0.50&0.50\end{pmatrix}$
$\phantom{\rho_{\mathsf{X}}}=\begin{pmatrix}0.75&0.25\\0.25&0.25\end{pmatrix}$
diagonalise $\rho_{\mathsf{X}}$ to get the perpendicular pair:
$\det\bigl(\rho_{\mathsf{X}}-\lambda I\bigr)=0$
$\phantom{\det\bigl(\rho_{\mathsf{X}}-\lambda I\bigr)}=\lambda^{2}-\lambda+0.12$
$\phantom{\det\bigl(\rho_{\mathsf{X}}-\lambda I\bigr)}\Rightarrow\;\lambda=0.85,\;0.15$
solve $\bigl(\rho_{\mathsf{X}}-p_a I\bigr)\lvert x_a\rangle=0$ for each direction:
$\begin{aligned}p_0&=0.85 & \textcolor{#7c3aed}{\lvert x_0\rangle}&=0.92\,\lvert0\rangle+0.38\,\lvert1\rangle\\p_1&=0.15 & \textcolor{#0284c7}{\lvert x_1\rangle}&=-0.38\,\lvert0\rangle+0.92\,\lvert1\rangle\end{aligned}$
recover the matching vectors on $\mathsf{Y}$ :
$\lvert y_a\rangle=\dfrac{(\langle x_a\rvert\otimes I)\lvert\psi\rangle}{\sqrt{p_a}}$
$\begin{aligned}\textcolor{#7c3aed}{\lvert y_0\rangle}&=\dfrac{0.65\,\lvert0\rangle+0.65\,\lvert1\rangle}{0.92}=0.71\,\lvert0\rangle+0.71\,\lvert1\rangle\\\textcolor{#0284c7}{\lvert y_1\rangle}&=\dfrac{-0.27\,\lvert0\rangle+0.27\,\lvert1\rangle}{0.38}=-0.71\,\lvert0\rangle+0.71\,\lvert1\rangle\end{aligned}$

the same state in Schmidt form

\lvert\psi\rangle=\overbrace{\underbrace{0.92\,\textcolor{#7c3aed}{\lvert x_0\rangle\otimes\lvert y_0\rangle}}_{p_0=0.85}+\underbrace{0.38\,\textcolor{#0284c7}{\lvert x_1\rangle\otimes\lvert y_1\rangle}}_{p_1=0.15}}^{\textstyle\mathsf{X}\otimes\mathsf{Y}}

Correlation71%

product stateevenly shared

For two systems, the Schmidt decomposition gives a particularly clean picture: the joint state is written as a sum of matching orthonormal directions on $\mathsf{X}$ and $\mathsf{Y}$ , with the coefficients $\sqrt{p_a}$ showing how much weight each pair carries.

The same idea extends beyond two qubits. For any bipartite state, even when $\mathsf{X}$ and $\mathsf{Y}$ are larger systems, the state can still be decomposed into matching orthonormal sets with one coefficient for each pair. With more than two qubits, what matters is how the qubits are divided into the two sides of the bipartition. For example, three qubits can be split into one qubit in $\mathsf{X}$ and two qubits in $\mathsf{Y}$ , and the same decomposition applies to that split.

Unitary equivalence of purifications

A contains more information than the density matrix it represents: the density matrix describes system $\mathsf{X}$ , while the purification also specifies how $\mathsf{X}$ is correlated with an auxiliary system $\mathsf{Y}$ . Different purifications can therefore look different, but the difference lies entirely in the choice of states on $\mathsf{Y}$ . Any two purifications of the same state on $\mathsf{X}$ are related by a unitary acting only on $\mathsf{Y}$ .

Let $\lvert\psi\rangle$ and $\lvert\phi\rangle$ be two pure states of the composite system $(\mathsf{X},\mathsf{Y})$ with identical reduced states:

\displaystyle \mathrm{Tr}_{\mathsf{Y}}\bigl(\lvert\psi\rangle\langle\psi\rvert\bigr)=\rho=\mathrm{Tr}_{\mathsf{Y}}\bigl(\lvert\phi\rangle\langle\phi\rvert\bigr).

Choose a of $\rho$ :

\displaystyle \rho=\sum_{a=0}^{r-1}p_a\,\lvert x_a\rangle\langle x_a\rvert.

The then gives both purifications in terms of the same eigenvalues and the same orthonormal vectors on $\mathsf{X}$ :

\displaystyle \lvert\psi\rangle=\sum_{a=0}^{r-1}\sqrt{p_a}\,\lvert x_a\rangle\otimes\lvert y_a\rangle,

\displaystyle \lvert\phi\rangle=\sum_{a=0}^{r-1}\sqrt{p_a}\,\lvert x_a\rangle\otimes\lvert z_a\rangle.

Thus, the only difference between the two purifications is the choice of the states $\{\lvert y_a\rangle\}$ and $\{\lvert z_a\rangle\}$ on $\mathsf{Y}$ .

These sets may not span all of $\mathsf{Y}$ . Add normalized vectors orthogonal to all the vectors already present until each set contains enough vectors to span the whole space $\mathsf{Y}$ . This produces two full orthonormal bases:

\displaystyle \{\lvert y_0\rangle,\ldots,\lvert y_{r-1}\rangle,\lvert y_r\rangle,\ldots\}

\displaystyle \{\lvert z_0\rangle,\ldots,\lvert z_{r-1}\rangle,\lvert z_r\rangle,\ldots\}.

Now define $U$ by mapping each vector in the first basis to the corresponding vector in the second:

\lvert y_0\rangle

\lvert z_0\rangle

\vdots

\lvert y_{r-1}\rangle

\lvert z_{r-1}\rangle

\lvert y_r\rangle

\lvert z_r\rangle

\vdots

Because a basis determines every vector in the space, this defines $U$ on all of $\mathsf{Y}$ . For any state $\lvert v\rangle=\sum_j c_j\lvert y_j\rangle$ , the map gives

\displaystyle U\lvert v\rangle=\sum_j c_j\lvert z_j\rangle

Since both $\{\lvert y_j\rangle\}$ and $\{\lvert z_j\rangle\}$ are orthonormal, all cross terms vanish in the inner products, leaving only the squared magnitudes of the coefficients:

\displaystyle \langle v\vert v\rangle=\sum_j\lvert c_j\rvert^2,

\displaystyle \langle Uv\vert Uv\rangle=\Bigl(\sum_j\overline{c_j}\langle z_j\rvert\Bigr)\Bigl(\sum_k c_k\lvert z_k\rangle\Bigr)=\sum_j\lvert c_j\rvert^2.

Thus $U$ preserves norms—and, by the same reasoning, all inner products. This is precisely the defining property of a unitary operator. In particular,

\displaystyle U\lvert y_a\rangle=\lvert z_a\rangle\quad\text{for every }a=0,\ldots,r-1.

Applying $U$ to the auxiliary system $\mathsf{Y}$ transforms one purification into the other:

\displaystyle \begin{aligned}(I_{\mathsf{X}}\otimes U)\lvert\psi\rangle&=(I_{\mathsf{X}}\otimes U)\sum_{a=0}^{r-1}\sqrt{p_a}\,\lvert x_a\rangle\otimes\lvert y_a\rangle\\[6pt]&=\sum_{a=0}^{r-1}\sqrt{p_a}\,\bigl(I_{\mathsf{X}}\lvert x_a\rangle\bigr)\otimes\bigl(U\lvert y_a\rangle\bigr)\\[6pt]&=\sum_{a=0}^{r-1}\sqrt{p_a}\,\lvert x_a\rangle\otimes U\lvert y_a\rangle\\[6pt]&=\sum_{a=0}^{r-1}\sqrt{p_a}\,\lvert x_a\rangle\otimes\lvert z_a\rangle\\[6pt]&=\lvert\phi\rangle.\end{aligned}

Note that the unitary is not necessarily unique. The purification only contains the vectors $\{\lvert y_a\rangle\}$ , so $U$ is fixed only by how it maps those vectors to $\{\lvert z_a\rangle\}$ . Its action on the remaining directions of $\mathsf{Y}$ can be chosen in different ways without changing the result.

So, unitary equivalence of purifications means that any purification of $\rho$ can be transformed into any other purification of $\rho$ by applying a suitable unitary to the auxiliary system $\mathsf{Y}$ alone.

Superdense coding as unitary equivalence

provides a concrete example of the unitary equivalence of purifications.

Alice holds qubit $\mathsf{A}$ , and Bob holds qubit $\mathsf{B}$ . They share an entangled pair, initially in the Bell state:

\displaystyle \lvert\phi^{+}\rangle=\tfrac{1}{\sqrt2}\bigl(\lvert00\rangle+\lvert11\rangle\bigr).

To encode two classical bits, Alice applies a unitary to her qubit, choosing one of four operations according to the value being encoded. The resulting state is one of the four Bell states:

\displaystyle \lvert\phi^{+}\rangle,\quad\lvert\phi^{-}\rangle,\quad\lvert\psi^{+}\rangle,\quad\lvert\psi^{-}\rangle.

From Bob’s perspective, however, these states are identical. Tracing out Alice’s system gives

\mathrm{Tr}_{\mathsf{A}}\bigl(\lvert\phi^{+}\rangle\langle\phi^{+}\rvert\bigr)

=\tfrac12 I,

and the same calculation holds for all four Bell states:

\mathrm{Tr}_{\mathsf{A}}\bigl(\lvert\phi^{+}\rangle\langle\phi^{+}\rvert\bigr)

=

\mathrm{Tr}_{\mathsf{A}}\bigl(\lvert\phi^{-}\rangle\langle\phi^{-}\rvert\bigr)

=

\mathrm{Tr}_{\mathsf{A}}\bigl(\lvert\psi^{+}\rangle\langle\psi^{+}\rvert\bigr)

=

\mathrm{Tr}_{\mathsf{A}}\bigl(\lvert\psi^{-}\rangle\langle\psi^{-}\rvert\bigr)

=

\tfrac12 I.

Thus, the four Bell states are different of the same density matrix on $\mathsf{B}$ . By , any two of them are related by a unitary acting on the purifying system $\mathsf{A}$ .

For superdense coding, these unitaries are the Pauli operations used to encode the two classical bits:

\displaystyle (I\otimes I_{\mathsf{B}})\lvert\phi^{+}\rangle=\lvert\phi^{+}\rangle

\displaystyle (Z\otimes I_{\mathsf{B}})\lvert\phi^{+}\rangle=\lvert\phi^{-}\rangle

\displaystyle (X\otimes I_{\mathsf{B}})\lvert\phi^{+}\rangle=\lvert\psi^{+}\rangle

\displaystyle (XZ\otimes I_{\mathsf{B}})\lvert\phi^{+}\rangle=-\lvert\psi^{-}\rangle.

This gives the structural reason behind the encoding step: because the four Bell states are purifications of the same state on $\mathsf{B}$ , a unitary on Alice’s system alone can move between them. Bob’s remains $\tfrac12 I$ throughout, so his qubit contains no information about which Bell state was chosen until Alice’s encoded qubit is received.

Hughston-Jozsa-Wootters theorem

Suppose $\mathsf{X}$ and $\mathsf{Y}$ are systems and $\lvert\phi\rangle$ is a quantum state vector of $(\mathsf{X},\mathsf{Y})$ . Let $N$ be a positive integer, let $(p_0,\ldots,p_{N-1})$ be a , and let $\lvert\psi_0\rangle,\ldots,\lvert\psi_{N-1}\rangle$ be quantum state vectors of $\mathsf{X}$ such that

\displaystyle \mathrm{Tr}_{\mathsf{Y}}\bigl(\lvert\phi\rangle\langle\phi\rvert\bigr)=\sum_{a=0}^{N-1}p_a\lvert\psi_a\rangle\langle\psi_a\rvert.

There exists a $\{P_0,\ldots,P_{N-1}\}$ of $\mathsf{Y}$ such that these statements are true when $\mathsf{Y}$ is measured while $(\mathsf{X},\mathsf{Y})$ is in the state $\lvert\phi\rangle$ :

Each measurement outcome $a\in\{0,\ldots,N-1\}$ appears with probability $p_a$ .
Conditioned on obtaining the outcome $a$ , the state of $\mathsf{X}$ becomes $\lvert\psi_a\rangle$ .

An ensemble is a collection of pure states of $\mathsf{X}$ , together with the probabilities of preparing them, written as $\{(p_a,\lvert\psi_a\rangle)\}$ . It represents the density matrix $\rho=\sum_{a}p_a\lvert\psi_a\rangle\langle\psi_a\rvert$ .

Different ensembles can represent the same state of $\mathsf{X}$ , meaning they give the same density matrix $\rho$ . Thus a mixed state of $\mathsf{X}$ does not have a unique decomposition into pure states. The HJW theorem says that, given a of $\rho$ on $(\mathsf{X},\mathsf{Y})$ , every such ensemble can be realised by a suitable measurement on the purifying system $\mathsf{Y}$ . The measurement outcome $a$ tells us that $\mathsf{X}$ is in the corresponding pure state $\lvert\psi_a\rangle$ , with probability $p_a$ . Before the outcome is known, the state of $\mathsf{X}$ is still described by the same density matrix $\rho$ , regardless of which measurement is chosen on $\mathsf{Y}$ .

\lvert\phi\rangle\ \text{on}\ (\mathsf{X},\mathsf{Y})

one purification

measure Y one way

\lvert\psi_0\rangle,\ \lvert\psi_1\rangle,\ \ldots

with probabilities $p_0,\ p_1,\ \ldots$

measure Y another way

\lvert\chi_0\rangle,\ \lvert\chi_1\rangle,\ \ldots

with probabilities $q_0,\ q_1,\ \ldots$

\rho\ \text{on}\ \mathsf{X}

the same either way

From an ensemble to a measurement

The hypothesis gives two descriptions of the same state of $\mathsf{X}$ :

\displaystyle \sum_{a=0}^{N-1}p_a\lvert\psi_a\rangle\langle\psi_a\rvert=\rho=\mathrm{Tr}_{\mathsf{Y}}\bigl(\lvert\phi\rangle\langle\phi\rvert\bigr).

The goal is to construct a measurement on $\mathsf{Y}$ whose outcome $a$ occurs with probability $p_a$ and leaves $\mathsf{X}$ in the corresponding pure state $\lvert\psi_a\rangle$ .

1. Record the ensemble in a new system

We first need a way to keep track of which pure state in the ensemble was selected. Introduce a new system $\mathsf{Z}$ with orthonormal states $\lvert0\rangle,\ \ldots,\ \lvert N-1\rangle$ , using one state $\lvert a\rangle_{\mathsf{Z}}$ as a label for each pure state $\lvert\psi_a\rangle_{\mathsf{X}}$ . Now put the label together with the corresponding state of $\mathsf{X}$ :

\displaystyle \lvert\gamma_1\rangle=\sum_{a=0}^{N-1}\sqrt{p_a}\,\lvert\psi_a\rangle_{\mathsf{X}}\otimes\lvert0\rangle_{\mathsf{Y}}\otimes\lvert a\rangle_{\mathsf{Z}}.

The sum is easiest to read one term at a time. Fix a single $a$ , and the term

\displaystyle \sqrt{p_a}\,\lvert\psi_a\rangle_{\mathsf{X}}\otimes\lvert0\rangle_{\mathsf{Y}}\otimes\textcolor{#4f46e5}{\lvert a\rangle_{\mathsf{Z}}}

is a product of three factors, one for each system:

$\lvert\psi_a\rangle_{\mathsf{X}}$ is the member of the ensemble this term carries, one of the pure states $\rho$ decomposes into.
$\lvert a\rangle_{\mathsf{Z}}$ is the label recording which member that is.
$\lvert0\rangle_{\mathsf{Y}}$ holds the purifying system in a fixed state. It does not depend on $a$ and takes no part in the record, so it is along for the ride.

In front of them sits $\sqrt{p_a}$ , which is an amplitude rather than a probability. Measuring $\mathsf{Z}$ in its own basis gives the term carrying the label $a$ probability $\lvert\sqrt{p_a}\rvert^2=p_a$ , which is exactly the weight that term has in the ensemble.

So $\lvert\gamma_1\rangle$ pairs each pure state $\lvert\psi_a\rangle$ of $\mathsf{X}$ with its own label $\lvert a\rangle$ in $\mathsf{Z}$ , and gives that pairing probability $p_a$ .

The important question is whether this larger state still represents the same state $\rho$ on $\mathsf{X}$ . It does. If we ignore both $\mathsf{Y}$ and the record $\mathsf{Z}$ , we should recover exactly the original mixed state.

To see this, start from the density matrix of $\lvert\gamma_1\rangle$ . Multiplying the sum by its own adjoint pairs every term with every other, so the result is a double sum indexed by $a$ and $b$ :

\displaystyle \lvert\gamma_1\rangle\langle\gamma_1\rvert=\sum_{a,b=0}^{N-1}\sqrt{p_a p_b}\,\lvert\psi_a\rangle\langle\psi_b\rvert\otimes\lvert0\rangle\langle0\rvert\otimes\lvert a\rangle\langle b\rvert.

Every factor is now separated by system, so the trace over $\mathsf{Y}$ and $\mathsf{Z}$ passes straight through the $\mathsf{X}$ factor and closes the other two into numbers, using $\mathrm{Tr}\bigl(\lvert u\rangle\langle v\rvert\bigr)=\langle v\vert u\rangle$ :

\displaystyle \mathrm{Tr}_{\mathsf{YZ}}\bigl(\lvert\gamma_1\rangle\langle\gamma_1\rvert\bigr)=\sum_{a,b=0}^{N-1}\sqrt{p_a p_b}\,\lvert\psi_a\rangle\langle\psi_b\rvert\;\langle0\vert0\rangle\;\langle b\vert a\rangle.

Both numbers are easy to read off. $\mathsf{Y}$ carries the same $\lvert0\rangle$ in every term, so $\langle0\vert0\rangle=1$ , and the labels are orthonormal, so $\langle b\vert a\rangle=\delta_{ab}$ is $1$ when $a=b$ and $0$ otherwise. Every off-diagonal term therefore disappears and the double sum collapses back to a single one:

\displaystyle \begin{aligned}\mathrm{Tr}_{\mathsf{YZ}}\bigl(\lvert\gamma_1\rangle\langle\gamma_1\rvert\bigr)&=\sum_{a,b=0}^{N-1}\sqrt{p_a p_b}\,\lvert\psi_a\rangle\langle\psi_b\rvert\;\langle0\vert0\rangle\;\langle b\vert a\rangle\\[4pt]&=\sum_{a,b=0}^{N-1}\sqrt{p_a p_b}\,\lvert\psi_a\rangle\langle\psi_b\rvert\;\delta_{ab}\\[4pt]&=\sum_{a=0}^{N-1}\sqrt{p_a p_a}\,\lvert\psi_a\rangle\langle\psi_a\rvert\\[4pt]&=\sum_{a=0}^{N-1}p_a\lvert\psi_a\rangle\langle\psi_a\rvert\\[4pt]&=\rho.\end{aligned}

What survives is the ensemble decomposition we started from, which is just $\rho$ written out. So $\lvert\gamma_1\rangle$ is a purification of $\rho$ : it is a pure state of the larger system $(\mathsf{X},\mathsf{Y},\mathsf{Z})$ whose reduced state on $\mathsf{X}$ is $\rho$ .

The role of $\mathsf{Z}$ is therefore very concrete: it stores a coherent record of which member of the ensemble is associated with each term, while the overall state seen from $\mathsf{X}$ remains the same $\rho$ .

2. Connect the record to the given purification

We now have a purification $\lvert\gamma_1\rangle$ that contains the ensemble we want, and we already had the given purification $\lvert\phi\rangle$ of $\rho$ . What remains is to get from one to the other without touching $\mathsf{X}$ .

Start with $\lvert\phi\rangle$ and append the same auxiliary system $\mathsf{Z}$ , but leave its record blank by putting it in the fixed state $\lvert0\rangle$ :

\displaystyle \lvert\gamma_0\rangle=\lvert\phi\rangle_{\mathsf{XY}}\otimes\lvert0\rangle_{\mathsf{Z}}.

This is another purification of $\rho$ . Nothing has changed on $\mathsf{X}$ , and $\mathsf{Z}$ is only an extra system sitting in a fixed state, so tracing both away gives back what $\lvert\phi\rangle$ gave:

\displaystyle \begin{aligned}\mathrm{Tr}_{\mathsf{YZ}}\bigl(\lvert\gamma_0\rangle\langle\gamma_0\rvert\bigr)&=\mathrm{Tr}_{\mathsf{Y}}\bigl(\lvert\phi\rangle\langle\phi\rvert\bigr)\\[4pt]&=\rho.\end{aligned}

So there are now two purifications of exactly the same state of $\mathsf{X}$ :

\displaystyle \lvert\gamma_0\rangle=\lvert\phi\rangle_{\mathsf{XY}}\otimes\lvert0\rangle_{\mathsf{Z}}

\displaystyle \lvert\gamma_1\rangle=\sum_{a=0}^{N-1}\sqrt{p_a}\,\lvert\psi_a\rangle_{\mathsf{X}}\otimes\lvert0\rangle_{\mathsf{Y}}\otimes\lvert a\rangle_{\mathsf{Z}}

In both, $\mathsf{X}$ has the same reduced state $\rho$ . Only the purifying systems $(\mathsf{Y},\mathsf{Z})$ are arranged differently. The now says that there is a unitary $U$ acting only on $(\mathsf{Y},\mathsf{Z})$ that turns one into the other:

\displaystyle (I_{\mathsf{X}}\otimes U)\lvert\gamma_0\rangle=\lvert\gamma_1\rangle.

This is the key step. Starting from a blank record, a unitary on $(\mathsf{Y},\mathsf{Z})$ builds exactly the correlations needed to write the ensemble down, and it leaves $\mathsf{X}$ untouched. Afterwards the state of $\mathsf{Z}$ says which $\lvert\psi_a\rangle$ goes with which term.

A different ensemble of the same $\rho$ gives a different $\lvert\gamma_1\rangle$ , and so a different $U$ . This is how the different decompositions of $\rho$ will turn into different measurements on $\mathsf{Y}$ .

3. Read the record

We now have everything needed to read the ensemble stored in $\mathsf{Z}$ : start with $\lvert\phi\rangle$ , append $\mathsf{Z}$ in $\lvert0\rangle$ to reach $\lvert\gamma_0\rangle$ , and apply $U$ to $(\mathsf{Y},\mathsf{Z})$ to reach $\lvert\gamma_1\rangle$ .

\lvert\phi\rangle

ZYX

\lvert\gamma_0\rangle

\lvert\gamma_1\rangle

a

(with probability

p_a

)

After the unitary, the state is

\displaystyle \lvert\gamma_1\rangle=\sum_{a=0}^{N-1}\sqrt{p_a}\,\lvert\psi_a\rangle_{\mathsf{X}}\otimes\lvert0\rangle_{\mathsf{Y}}\otimes\lvert a\rangle_{\mathsf{Z}}.

The states $\lvert a\rangle_{\mathsf{Z}}$ are the labels stored for the ensemble, so measuring $\mathsf{Z}$ in its own basis asks a single question: which label is present?

Suppose the measurement gives outcome $a$ . Projecting onto $\lvert a\rangle_{\mathsf{Z}}$ keeps only the term carrying that label:

\displaystyle \bigl(I_{\mathsf{X}}\otimes I_{\mathsf{Y}}\otimes\lvert a\rangle\langle a\rvert\bigr)\lvert\gamma_1\rangle=\sqrt{p_a}\;\lvert\psi_a\rangle_{\mathsf{X}}\otimes\lvert0\rangle_{\mathsf{Y}}\otimes\lvert a\rangle_{\mathsf{Z}}.

The surviving vector has squared norm $\bigl\lVert\sqrt{p_a}\;\lvert\psi_a\rangle_{\mathsf{X}}\otimes\lvert0\rangle_{\mathsf{Y}}\otimes\lvert a\rangle_{\mathsf{Z}}\bigr\rVert^2=p_a$ , so the outcome $a$ occurs with probability $p_a$ .

The post-measurement state is obtained by dividing by its norm:

\displaystyle \begin{aligned}&\frac{1}{\sqrt{p_a}}\bigl(\sqrt{p_a}\;\lvert\psi_a\rangle_{\mathsf{X}}\otimes\lvert0\rangle_{\mathsf{Y}}\otimes\lvert a\rangle_{\mathsf{Z}}\bigr)\\[4pt]&=\lvert\psi_a\rangle_{\mathsf{X}}\otimes\lvert0\rangle_{\mathsf{Y}}\otimes\lvert a\rangle_{\mathsf{Z}}.\end{aligned}

Once the outcome $a$ is known, the post-measurement state is

\displaystyle \lvert\psi_a\rangle_{\mathsf{X}}\otimes\lvert0\rangle_{\mathsf{Y}}\otimes\lvert a\rangle_{\mathsf{Z}}.

This is a product state of the composite system $(\mathsf{X},\mathsf{Y},\mathsf{Z})$ : it factors into a state of $\mathsf{X}$ , a state of $\mathsf{Y}$ , and a state of $\mathsf{Z}$ . In particular, $\mathsf{X}$ is not entangled with $\mathsf{Y}$ or $\mathsf{Z}$ , and its state is exactly $\lvert\psi_a\rangle$ .

System $\mathsf{Y}$ is always in the same state $\lvert0\rangle_{\mathsf{Y}}$ , regardless of the measurement outcome. It therefore carries no information about $a$ and can be discarded.

Thus, measuring $\mathsf{Z}$ produces exactly the desired ensemble: outcome $a$ occurs with probability $p_a$ and leaves $\mathsf{X}$ in the state $\lvert\psi_a\rangle$ .

There is one problem, though. The theorem asks for a measurement of $\mathsf{Y}$ , not of the newly introduced system $\mathsf{Z}$ . The final step is to show that this whole detour through $\mathsf{Z}$ can be rewritten as a measurement on $\mathsf{Y}$ alone.

4. Turn the construction into a measurement of $\mathsf{Y}$

The construction so far gives everything the theorem requires except one point: we measure $\mathsf{Z}$ , but the theorem asks for a measurement on $\mathsf{Y}$ . We therefore need to express the same procedure as a measurement on $\mathsf{Y}$ , with $\mathsf{Z}$ removed from the final description.

$\mathsf{Z}$ is only an auxiliary system. It starts in the fixed state $\lvert0\rangle_{\mathsf{Z}}$ , interacts with $\mathsf{Y}$ through the unitary $U$ , and is then measured. The only information we keep from $\mathsf{Z}$ is the measurement outcome $a$ . The three steps can therefore be combined into a single operation on $\mathsf{Y}$ .

Recall where $U$ came from. The states $\lvert\gamma_0\rangle=\lvert\phi\rangle_{\mathsf{XY}}\otimes\lvert0\rangle_{\mathsf{Z}}$ and $\lvert\gamma_1\rangle=\sum_a\sqrt{p_a}\,\lvert\psi_a\rangle_{\mathsf{X}}\otimes\lvert0\rangle_{\mathsf{Y}}\otimes\lvert a\rangle_{\mathsf{Z}}$ are purifications of the same state on $\mathsf{X}$ . By the , there is a unitary $U$ acting only on $(\mathsf{Y},\mathsf{Z})$ such that $(I_{\mathsf{X}}\otimes U)\lvert\gamma_0\rangle=\lvert\gamma_1\rangle$ . We now use this same $U$ to describe the corresponding measurement on $\mathsf{Y}$ .

Take an arbitrary normalised state $\lvert v\rangle_{\mathsf{Y}}$ and temporarily leave $\mathsf{X}$ out. Appending the auxiliary system $\mathsf{Z}$ in its fixed state gives $\lvert v\rangle_{\mathsf{Y}}\otimes\lvert0\rangle_{\mathsf{Z}}$ , and applying $U$ gives $U\bigl(\lvert v\rangle_{\mathsf{Y}}\otimes\lvert0\rangle_{\mathsf{Z}}\bigr)$ .

Because $\{\lvert a\rangle_{\mathsf{Z}}\}$ is the basis in which $\mathsf{Z}$ is measured, this state can be expanded in that basis: $U\bigl(\lvert v\rangle_{\mathsf{Y}}\otimes\lvert0\rangle_{\mathsf{Z}}\bigr)=\sum_a\lvert v_a\rangle_{\mathsf{Y}}\otimes\lvert a\rangle_{\mathsf{Z}}$ . Here $\lvert v_a\rangle_{\mathsf{Y}}$ is simply the vector of $\mathsf{Y}$ that accompanies the basis state $\lvert a\rangle_{\mathsf{Z}}$ . No additional assumption is being made. This is just the expansion of a joint state in the basis of $\mathsf{Z}$ , and the vectors $\lvert v_a\rangle$ need not be normalised.

Now measure $\mathsf{Z}$ . For outcome $a$ , the probability is $\bigl\lVert\lvert v_a\rangle\bigr\rVert^2$ , and the corresponding normalised state of $\mathsf{Y}$ is $\lvert v_a\rangle\,\big/\,\bigl\lVert\lvert v_a\rangle\bigr\rVert$ . Thus $\lvert v_a\rangle$ contains both pieces of information associated with outcome $a$ : its squared norm gives the probability, while its normalised direction gives the resulting state of $\mathsf{Y}$ .

The vector $\lvert v_a\rangle$ depends linearly on the input $\lvert v\rangle$ , because every step used to obtain it is linear. We can therefore describe this dependence by a linear operator on $\mathsf{Y}$ . To extract the $a$ -labelled component, apply $\langle a\rvert$ to the $\mathsf{Z}$ system:

\displaystyle (I_{\mathsf{Y}}\otimes\langle a\rvert)\,U\,\bigl(\lvert v\rangle_{\mathsf{Y}}\otimes\lvert0\rangle_{\mathsf{Z}}\bigr)=\lvert v_a\rangle_{\mathsf{Y}}.

The operation that appends $\lvert0\rangle_{\mathsf{Z}}$ can be written as $I_{\mathsf{Y}}\otimes\lvert0\rangle$ . Here $\lvert0\rangle$ is read as an operator rather than as a state: it takes a number $c$ to the vector $c\,\lvert0\rangle_{\mathsf{Z}}$ , so it maps the one-dimensional space of numbers into $\mathsf{Z}$ . Tensoring it with $I_{\mathsf{Y}}$ gives an operator that takes a state of $\mathsf{Y}$ to a state of $(\mathsf{Y},\mathsf{Z})$ : $I_{\mathsf{Y}}$ carries $\lvert v\rangle$ through unchanged, and $\lvert0\rangle$ supplies the new factor, so $(I_{\mathsf{Y}}\otimes\lvert0\rangle)\lvert v\rangle_{\mathsf{Y}}=\lvert v\rangle_{\mathsf{Y}}\otimes\lvert0\rangle_{\mathsf{Z}}$ . Therefore

\displaystyle (I_{\mathsf{Y}}\otimes\langle a\rvert)\,U\,(I_{\mathsf{Y}}\otimes\lvert0\rangle)\,\lvert v\rangle_{\mathsf{Y}}=\lvert v_a\rangle_{\mathsf{Y}}.

Since this holds for every input $\lvert v\rangle$ , define

\displaystyle M_a=(I_{\mathsf{Y}}\otimes\langle a\rvert)\,U\,(I_{\mathsf{Y}}\otimes\lvert0\rangle).

The three factors correspond exactly to the three steps of the original construction:

$I_{\mathsf{Y}}\otimes\lvert0\rangle$ : append $\mathsf{Z}$ in the fixed state $\lvert0\rangle$ .
$U$ : apply the unitary to $(\mathsf{Y},\mathsf{Z})$ .
$I_{\mathsf{Y}}\otimes\langle a\rvert$ : extract the component corresponding to outcome $a$ .

The auxiliary system $\mathsf{Z}$ has now disappeared from the input and output of $M_a$ . It remains only inside the definition of the operator.

For an input $\lvert v\rangle$ , the probability of outcome $a$ is therefore $\bigl\lVert M_a\lvert v\rangle\bigr\rVert^2=\langle v\rvert M_a^{\dagger}M_a\lvert v\rangle$ , so define $P_a=M_a^{\dagger}M_a$ . Each $P_a$ is positive semidefinite because it has the form $M_a^{\dagger}M_a$ . It remains to check that the probabilities sum to one, which is equivalent to $\sum_a P_a=I_{\mathsf{Y}}$ . Using the definition of $M_a$ :

\displaystyle \begin{aligned} \sum_a P_a &=\sum_a(I_{\mathsf{Y}}\otimes\langle0\rvert)\,U^{\dagger}\,(I_{\mathsf{Y}}\otimes\lvert a\rangle\langle a\rvert)\,U\,(I_{\mathsf{Y}}\otimes\lvert0\rangle)\\[4pt] &=(I_{\mathsf{Y}}\otimes\langle0\rvert)\,U^{\dagger}\Bigl(I_{\mathsf{Y}}\otimes\sum_a\lvert a\rangle\langle a\rvert\Bigr)U\,(I_{\mathsf{Y}}\otimes\lvert0\rangle) &&\quad\textcolor{#94a3b8}{\text{only the middle factor depends on }a}\\[4pt] &=(I_{\mathsf{Y}}\otimes\langle0\rvert)\,U^{\dagger}\,(I_{\mathsf{Y}}\otimes I_{\mathsf{Z}})\,U\,(I_{\mathsf{Y}}\otimes\lvert0\rangle) &&\quad\textcolor{#94a3b8}{\text{completeness: }\sum_a\lvert a\rangle\langle a\rvert=I_{\mathsf{Z}}}\\[4pt] &=(I_{\mathsf{Y}}\otimes\langle0\rvert)\,U^{\dagger}\,I_{\mathsf{YZ}}\,U\,(I_{\mathsf{Y}}\otimes\lvert0\rangle) &&\quad\textcolor{#94a3b8}{I_{\mathsf{Y}}\otimes I_{\mathsf{Z}}\text{ is the identity on }(\mathsf{Y},\mathsf{Z})}\\[4pt] &=(I_{\mathsf{Y}}\otimes\langle0\rvert)\,U^{\dagger}U\,(I_{\mathsf{Y}}\otimes\lvert0\rangle) &&\quad\textcolor{#94a3b8}{\text{multiplying by the identity changes nothing}}\\[4pt] &=(I_{\mathsf{Y}}\otimes\langle0\rvert)\,I_{\mathsf{YZ}}\,(I_{\mathsf{Y}}\otimes\lvert0\rangle) &&\quad\textcolor{#94a3b8}{U\text{ is unitary: }U^{\dagger}U=I_{\mathsf{YZ}}}\\[4pt] &=(I_{\mathsf{Y}}\otimes\langle0\rvert)(I_{\mathsf{Y}}\otimes\lvert0\rangle) &&\quad\textcolor{#94a3b8}{\text{again the identity changes nothing}}\\[4pt] &=I_{\mathsf{Y}}\otimes\langle0\vert0\rangle &&\quad\textcolor{#94a3b8}{\text{each system multiplies on its own: }I_{\mathsf{Y}}I_{\mathsf{Y}}=I_{\mathsf{Y}}\text{ on }\mathsf{Y},\ \langle0\rvert\lvert0\rangle\text{ on }\mathsf{Z}}\\[4pt] &=I_{\mathsf{Y}} &&\quad\textcolor{#94a3b8}{\lvert0\rangle_{\mathsf{Z}}\text{ is a unit vector, so }\langle0\vert0\rangle=1\text{ and }I_{\mathsf{Y}}\otimes1=I_{\mathsf{Y}}} \end{aligned}

Thus $\{P_a\}$ is a valid measurement on $\mathsf{Y}$ .

It remains to check that this measurement produces the desired ensemble when applied to the original purification $\lvert\phi\rangle_{\mathsf{XY}}$ . Apply $M_a$ to its $\mathsf{Y}$ part, with $\mathsf{X}$ carried along untouched:

\displaystyle \begin{aligned} (I_{\mathsf{X}}\otimes M_a)\lvert\phi\rangle_{\mathsf{XY}} &=\bigl(I_{\mathsf{X}}\otimes(I_{\mathsf{Y}}\otimes\langle a\rvert)\,U\,(I_{\mathsf{Y}}\otimes\lvert0\rangle)\bigr)\lvert\phi\rangle_{\mathsf{XY}} &&\quad\textcolor{#94a3b8}{\text{the definition of }M_a}\\[4pt] &=(I_{\mathsf{X}}\otimes I_{\mathsf{Y}}\otimes\langle a\rvert)\,(I_{\mathsf{X}}\otimes U)\,(I_{\mathsf{X}}\otimes I_{\mathsf{Y}}\otimes\lvert0\rangle)\lvert\phi\rangle_{\mathsf{XY}} &&\quad\textcolor{#94a3b8}{\text{splitting the product, each factor with its own }I_{\mathsf{X}}}\\[4pt] &=(I_{\mathsf{X}}\otimes I_{\mathsf{Y}}\otimes\langle a\rvert)\,(I_{\mathsf{X}}\otimes U)\,\bigl(\lvert\phi\rangle_{\mathsf{XY}}\otimes\lvert0\rangle_{\mathsf{Z}}\bigr) &&\quad\textcolor{#94a3b8}{\text{the identities carry }\lvert\phi\rangle_{\mathsf{XY}}\text{ through, }\lvert0\rangle\text{ supplies the }\mathsf{Z}\text{ factor}}\\[4pt] &=(I_{\mathsf{X}}\otimes I_{\mathsf{Y}}\otimes\langle a\rvert)\,(I_{\mathsf{X}}\otimes U)\lvert\gamma_0\rangle &&\quad\textcolor{#94a3b8}{\lvert\gamma_0\rangle=\lvert\phi\rangle_{\mathsf{XY}}\otimes\lvert0\rangle_{\mathsf{Z}}}\\[4pt] &=(I_{\mathsf{X}}\otimes I_{\mathsf{Y}}\otimes\langle a\rvert)\lvert\gamma_1\rangle &&\quad\textcolor{#94a3b8}{(I_{\mathsf{X}}\otimes U)\lvert\gamma_0\rangle=\lvert\gamma_1\rangle}\\[4pt] &=(I_{\mathsf{X}}\otimes I_{\mathsf{Y}}\otimes\langle a\rvert)\sum_b\sqrt{p_b}\,\lvert\psi_b\rangle_{\mathsf{X}}\otimes\lvert0\rangle_{\mathsf{Y}}\otimes\lvert b\rangle_{\mathsf{Z}} &&\quad\textcolor{#94a3b8}{\lvert\gamma_1\rangle\text{ written out}}\\[4pt] &=\sum_b\sqrt{p_b}\,\lvert\psi_b\rangle_{\mathsf{X}}\otimes\lvert0\rangle_{\mathsf{Y}}\,\langle a\vert b\rangle &&\quad\textcolor{#94a3b8}{\langle a\rvert\text{ meets the }\mathsf{Z}\text{ label of every term}}\\[4pt] &=\sqrt{p_a}\,\lvert\psi_a\rangle_{\mathsf{X}}\otimes\lvert0\rangle_{\mathsf{Y}} &&\quad\textcolor{#94a3b8}{\langle a\vert b\rangle=\delta_{ab}\text{, so only }b=a\text{ survives}} \end{aligned}

The result $(I_{\mathsf{X}}\otimes M_a)\lvert\phi\rangle_{\mathsf{XY}}=\sqrt{p_a}\,\lvert\psi_a\rangle_{\mathsf{X}}\otimes\lvert0\rangle_{\mathsf{Y}}$ describes the state of $\mathsf{X}$ and $\mathsf{Y}$ when outcome $a$ occurs. Its squared norm is $p_a$ , so outcome $a$ occurs with probability $p_a$ . After normalisation, the state is $\lvert\psi_a\rangle_{\mathsf{X}}\otimes\lvert0\rangle_{\mathsf{Y}}$ . Thus, outcome $a$ leaves $\mathsf{X}$ in the pure state $\lvert\psi_a\rangle$ , while $\mathsf{Y}$ is left in the fixed state $\lvert0\rangle$ and is no longer entangled with $\mathsf{X}$ .

Therefore, measuring $\mathsf{Y}$ with the POVM $\{P_a\}$ produces outcome $a$ with probability $p_a$ and prepares $\mathsf{X}$ in the corresponding state $\lvert\psi_a\rangle$ . The auxiliary system $\mathsf{Z}$ was introduced as a construction tool: by adding $\mathsf{Z}$ , applying the unitary $U$ , and measuring $\mathsf{Z}$ , the proof derives the measurement operators $M_a$ and hence the POVM elements $P_a$ acting directly on $\mathsf{Y}$ .

The theorem guarantees the existence of the required unitary $U$ , but it does not by itself provide a physical circuit for implementing $U$ . Constructing such a circuit is a separate problem. The HJW theorem merely establishes the mathematical fact that the desired measurement on $\mathsf{Y}$ exists — what a bummer! DM me if you have read this far and we could rant about this together.

In this way, every decomposition of a density matrix into pure states can be realised by measuring a purifying system. Different decompositions of the same mixed state correspond to different measurements on that purifying system.