Efficient ancilla-free reversible and quantum circuits for the Hidden Weighted Bit function

The Hidden Weighted Bit function plays an important role in the study of classical models of computation. A common belief is that this function is exponentially hard for the implementation by reversible ancilla-free circuits, even though introducing a small number of ancillae allows a very efficient implementation. In this paper, we refute the exponential hardness conjecture by developing a polynomial-size reversible ancilla-free circuit computing the Hidden Weighted Bit function. Our circuit has size $O(n^{6.42})$, where $n$ is the number of input bits. We also show that the Hidden Weighted Bit function can be computed by a quantum ancilla-free circuit of size $O(n^2)$. The technical tools employed come from a combination of Theoretical Computer Science (Barrington's theorem) and Physics (simulation of fermionic Hamiltonians) techniques.


Introduction
The origins of the Hidden Weighted Bit function go back to the study of models of classical computation.This function, denoted HWB, takes as input an n-bit string x and outputs the k-th bit of x, where k is the Hamming weight of x; if the input weight is 0, the output is 0. It is best known for combining the ease of algorithmic description and implementation by classical Boolean circuits with the hardness of representation by Ordered Binary Decision Diagrams (OBDDs) [1]-a popluar tool in VLSI [2].The difference between logarithmic-depth implementations of HWB by circuits (recall that HWB ∈ N C 1 but HWB ∈ AC 0 ) and an exponential lower bound for the size of the OBDD [3] is startling two exponents.Relaxing the constraints on the type of Binary Decision Diagram considered or restricting the computations by circuits enables a multitude of implementations with polynomial cost [4].
The Hidden Weighted Bit function was first introduced in the context of reversible and quantum computations about 15 years ago by I. L. Markov and K. N. Patel (unpublished), and the earliest explicit mention dates to the year 2005 [5].The original specification is irreversible, and required a slight modification to comply with the restrictions of reversible and quantum computations.Specifically, the Hidden Weighted Bit function was redefined to become the cyclic shift to the right by the input weight.We denote this reversible specification as hwb.Formally, hwb(x) is defined as the cyclic shift of its input x to the right by W positions, where W = x 1 +x 2 + . . .+x n is the Hamming weight of x.The following shows the truth table of 3-input hwb: x 000 100 010 110 001 101 011 111 hwb(x) 000 010 001 101 100 011 110 111 Since its introduction, hwb was used by numerous authors focusing on the synthesis and optimization of reversible and quantum circuits as a test case.
Despite a stream of improvements in the respective circuit sizes by various research groups [6,7,8,9], the best known ancilla-free reversible circuits exhibit exponential scaling in the number of gates.The synthesis algorithms benefiting from the inclusion of additional gates, such as multiple-control multiple-target Toffoli, Fredkin, and Peres gates [5,8,10] also failed to find an efficient implementation without ancillae.In 2013, this culminated with the hwb receiving the designation of a "hard" benchmark function [11].A recent asymptotically optimal synthesis algorithm over the library with NOT, CNOT, and Toffoli gates [12], introduced in the year 2015, was also unable to find an efficient ancilla-free implementation.An ancillafree quantum circuit can be obtained by employing an asymptotically optimal quantum circuit synthesis algorithm such as [13], but the quantum gate count appears to remain exponential and larger than what is possible to obtain through the application of the asymptotically optimal reversible logic synthesis algorithm [12].
The introduction of even a small number of ancillae changes the picture dramatically.Just O(log(n)) ancillary (qu)bits suffice to develop a reversible circuit with O(n log 2 (n)) gates [14].Barrington's theorem [15] allows one to obtain a polynomial-size reversible circuit using three ancillae.This polynomial-size three-ancilla reversible circuit can be obtained by computing the individual bits of the input weight through Barrington's theorem, and using such bits logarithmically many times to control-SWAP the respective input (qu)bits into their desired positions.Finally, the existence of a polynomial-size quantum circuit using a single ancilla follows from [16].
State of the art, in both the classical reversible and quantum settings, thus points to an exponential difference in the gate count between circuits with no ancillae and circuits with a constant number of ancillae.In this paper, we demonstrate efficient implementations of the hwb function by ancilla-free reversible and quantum circuits, thereby reducing these exponential differences to polynomial.Specifically, our reversible ancilla-free circuit requires O(n 6.42 ) gates and our quantum ancilla-free circuit requires O(n 2 ) gates.These results refute the exponential hardness belief and remove hwb from the class of hard benchmarks.
We next sketch main ideas behind our ancilla-free circuits.We begin with the reversible circuit.Our construction works as follows.First, we show that the n-bit hwb function can be decomposed into a product of O(n log(n)) gates denoted C5(f (x); B), where f (x) is a symmetric Boolean function and B ⊂ x is a subset with 5 input bits.The gate C5(f ; B) cyclically shifts the 5-bit register B if f (x)=1, and does nothing when f (x)=0.To implement C5(f ; B), we first break it down into a product of 6 gates of the form C5| M i (f (x\B); B), where i ∈ {1, 2, 3, 4, 5, 6}, each M i is a fixed set of Boolean 5-tuples, and f are symmetric Boolean functions.The gate C5| M i restricts the operation of the corresponding gate C5 onto the set M i and simultaneously separates the set B of bits being cycle-shifted from the set x\B controlling these shifts.This allows to employ Barrington's theorem [15] to implement the gates C5| M i (f (x\B); B) in the ancilla-free fashion by expressing them as polynomial-size branching programs with the input x\B and computing into B. Each instruction in such program realizes a permutation of 5-bit strings controlled by a single bit and it can thus be mapped into a reversible circuit over 6 = 5+1 wires.
Next we introduce our quantum ancilla-free circuit.Let U hwb be the n-qubit unitary operator implementing the hwb function.By definition, U hwb |x = C x 1 +x 2 +...+xn |x , where C is the cyclic shift of n qubits.Suppose we can find an n-qubit Hamiltonian H such that C = e iH and H commutes with the Hamming weight operator W = n j=1 |1 1| j .Then U hwb = e iHW .Thus it suffices to construct a quantum circuit simulating the time evolution under the Hamiltonian HW .Since the cyclic shift C is analogous to the translation operator for a particle moving on a circle, the Hamiltonian H generating the cyclic shift C is analogous to the particle's momentum operator.This observation suggests that H can be diagonalized by a suitable Fourier transform.We formalize this intuition using the language of fermions and the fermionic Fourier transform, which is routinely used in Physics and quantum simulation algorithms [17,18].The desired Hamiltonian H such that C = e iH is shown to have the form H = V † H V , where V is a (modified) fermionic Fourier transform and H is a simple diagonal Hamiltonian.We also show that V commutes with the Hamming weight operator W , so that U hwb = e iHW = V † e iH W V .We demonstrate that each layer in this decomposition of U hwb can be implemented by a quantum circuit of size O(n 2 ).
The rest of the paper is organized as follows.Section 2 introduces a simple modification of the known O(n log 2 (n))-gate O(log(n))-ancilla reversible circuit that requires O(n log(n)) gates and O(log(n)) ancillary bits.Section 3 describes an O(n 6.42 )-gate ancilla-free reversible circuit.Section 4 reports an ancilla-free O(n 2 )-gate quantum circuit.These sections are independent of each other and can be read in any order.Appendices A and B prove technical lemmas stated in Section 4.

Reversible circuit of size O(n log n) using ancillas
We start with the description of a modification of the previously reported classical/reversible circuit that implements hwb with O(n log(n)) gates and O(log(n)) ancillae [14].Compared to [14], our circuit features favorable asymptotics.However, it uses twice the computational/ancillary space.
2. Apply controlled-SWAP gates to SWAP inputs into their correct position as specified by the hwb.
3. Restore the value of ancillary register to |0 by appending the inverse of the stage 1.
Note that the stage 3. is omitted in [14], allowing a direct comparison to our circuit illustrated in Fig. 1.The difference between our construction and [14] is how we compute the input weight.Specifically, we use the same "plus-one" approach to calculate the weight into the ancillary register, however, we implement the integer increment function differently.Given input x i , 1≤i≤n, the resister w 1 , w 2 , . . ., w log(i) +1 , where the input weight is being computed into, and temporary storage t 1 , t 2 , . . ., t log(i) −1 , "increment by one" works as follows.If i = 1, apply CNOT(x1; w1).For i > 1:  3. if i>3: for j from log(i) −1 down to 2 apply the half adder, computed by the circuit Toffoli(t j−1 , w j ; t j )CNOT(t j−1 ; w j ).Apply Toffoli(x i , w 1 ; t 1 )CNOT(x i ; w 1 ).
In our implementation, the t register is used to store necessary digit shifts.Advertised asymptotics follow by inspection of the above construction.We furthermore illustrated our circuit in Fig. 1 for n=7.
3 Ancilla-free reversible circuit of size O(n 6.42 ) In this section we show how to construct an ancilla-free classical reversible circuit of size poly(n) implementing hwb.We focus on n ≥ 5, noting that optimal circuits with n up to 4 are already known.
Let n be the total number of bits, and x = (x 1 , x 2 , ..., x n ) ∈ {0, 1} n be the input.In some discussions where it is convenient, we label these bits by the integers {0, 1, . . ., n−1} = Z n .Suppose B ⊆ Z n is a subset of 5 bits and f : {0, 1} n → {0, 1} is a symmetric Boolean function (that is, f (x) depends only on the Hamming weight of x).Define a reversible gate where the output is obtained from the input x by applying the cyclic shift to the register B if f (x)=1.Otherwise, when f (x)=0, the gate does nothing.Note that, because the symmetric function f does not depend on the order of the bits, C5(f ; B) is a permutation of the set {0, 1} n .Moreover, C5(f ; B) is an even permutation, since it is a product of length-5 cycles and each length-5 cycle is an even permutation.
function f evaluates to one and does nothing otherwise.We call i 0 , i 1 , ..., i t−1 the targets.We call a collection of C-type gates a layer when the sets of their targets do not overlap.
We next construct hwb by first expressing it as a circuit with the C-type gates, then breaking down the C-type gates into elementary reversible gates and C5-type gates, and finally expressing the C5-type gates in terms of the elementary reversible gates.
Lemma 1.The n-bit hwb function can be implemented by an ancilla-free circuit with log(n) + 1 layers of C-type gates.
Proof.We will create a circuit with k layers numbered 0, 1, ..., log(n) .At each layer, the C gates take the form C(f k ; * ).Select the symmetric functions f k as follows: let f k (x) = 1 iff the kth power of 2 in the binary expansion of the weight W = x 1 +x 2 +...+x n equals one.Note that f k are symmetric functions since the calculation of weight does not depend on the order the bits are added in.The function hwb can now be expressed as For any k = 0, 1, . . ., log(n) , let g := GCD(n, 2 k ) and Then by elementary modular arithmetic, and the targets of any two distinct C i in this product do not overlap.This shows that each of the log(n) +1 factors in Eq. ( 1) can be written as a layer of C-type gates.
We next implement each of log(n) +1 layers of cyclic shift gates in Lemma 1 as circuits with O(n) C5-type gates by expressing the cycles (i 0 , i 1 , ..., i t−1 ) as products of length-5 cycles.Note that a length-5 cycle is always an even permutation and (i 0 , i 1 , ..., i t−1 ) is an odd permutation when t is even.It is not possible to implement an odd permutation as a product of even permutations.However, with one exception, the C-type gates C i come in pairs (recall that their number, g, is a power of two) and thus they can usually be paired up to form an even permutation that can then be decomposed into a product of length-5 cycles.The one exception is the leftmost gate in Eq. ( 1), C(f 0 ; (0, 1, ..., n−1)), when n is even.We handle this case first.
Proof.The Boolean function f 0 (x) = x 1 ⊕ x 2 ⊕ ... ⊕ x n can be implemented on the top bit to control all bit SWAPs on the bottom bits, and it can be implemented on the bottom bit to control all bit SWAPs on the top bits.The number of controlled-SWAP gates required is n−1, and the total number of the CNOT gates required to compute/uncompute the control register is 4(n−1).We illustrated this construction in Fig. 3  )).This is equivalent to saying that the following permutation equality holds: Note that the bit 'a' can be found since n ≥ 5. We will show only the permutation equalities in the rest of the proof, since it is trivial to translate those to circuits.
To implement a pair of gates C(f ; (x 1 , x 2 , x 3 )) and C(f ; (y 1 , y 2 , y 3 )) rely on the cycle product equality ( ) and (y 1 , y 2 , y 3 , y 4 ) can be obtained by the equality where first and second part require two C5 gates each, as described in the cases t = 2 and t = 3, for a total of four C5 gates.
Observe how the above proof implies that the number of C5 gates required to implement each of C 2 k ((0, 1, ..., n−1); f k ) stages in Eq. ( 1) for k = 1, 2, ..., log(n) is between n 4 + Const and n 2 + Const.Thus, per Lemma 2, the total number of elementary and C5 gates required to implement hwb over n qubits is between n log(n) 4 We next show how to implement C5(f k ; B) as a branching program, using Barrington's theorem [15], by closely following the original proof.In preparation for using Barringon's theorem, we first remove the dependence of the functions f k in C5(f k ; B) on the variables inside the set B, to allow the desired cyclic shift to be controlled by the values of n−5 variables outside the set B itself.To accomplish this, note that C5(f k ; B) acts trivially on the strings 00000 and 11111; those can be ignored.This leaves 30 non-fixed by the operation 5-bit strings that can be partitioned into six disjoint subsets M 1 , M 2 , M 3 , M 4 , M 5 , and M 6 , with 5 strings each.Every subset M i contains 5 cyclic shifts of some fixed 5-bit string, and is defined as follows: We implement C5(f k ; B) by performing the cyclic shifts of a single subset M i per time.
First, let us introduce some more notations.Given a bit string x ∈ {0, 1} n , write x = (y, b), where b ∈ {0, 1} 5 is the restriction of x onto the register B and y ∈ {0, 1} n−5 is the rest of x.Let w i ∈ {1, 2, 3, 4} be the Hamming weight of bit strings in M i (note that all strings in the same subset M i have the same weight).Define a Boolean function f k,i : {0, 1} n−5 → {0, 1} such that f k,i (y)=1 iff 2 k appears in the binary expansion of |y|+w i .Then that maps an input x = (y, b) to an output x = (y, b ) according to the following rules: By definition, the cyclic shift of bits in the register B can be realized by cyclically shifting elements of each subset M i for i = 1, 2, 3, 4, 5, 6.Thus Here the order in the product does not matter because the gates Note that the dependence of function f k on the variables inside the set B has now been removed, and we can proceed to implementing C5| M i (f k ; B) as a branching program, and finally mapping the instructions used by the branching program into reversible gates.
Recall some relevant notation used in Barrington's paper [15].Let S 5 be the group of permutations of 5 numbers, {1, 2, 3, 4, 5}.Given a 5-tuple of distinct integers a 1 , a 2 , a 3 , a 4 , and a 5 , we write (a 1 , a 2 , a 3 , a 4 , a 5 ) to denote the 5-cycle.Let e be the identity permutation.A branching program of length L with m Boolean input variables y 1 , y 2 , ..., y m is a list of instructions y i , σ i , τ i with i = 1, 2, ..., L and σ i , τ i ∈ S 5 , such that σ i is applied if y i =1, and τ i is executed when y i =0.Given a permutation σ ∈ S 5 , the branching program is said to σcompute a Boolean function f (y) if executing the list of all instructions in the program results in e (the identity permutation) for all inputs y such that f (y)=0 and permutation σ for all inputs y such that f (y)=1.
Barrigton's theorem asserts that any function in the class NC 1 can be (1, 2, 3, 4, 5)-computed by a branching program of polynomial size [15].We next specialize the proof of the theorem to explicitly develop a short branching program that (1, 2, 3, 4, 5)-computes the Boolean function f k,i (y).Recall that f k,i (y)=1 iff 2 k appears in the binary expansion of y 1 +y 2 + . . .+y n−5 +w i with w i ∈ {1, 2, 3, 4} being the weight of bit strings in M i .It suffices to develop a branching program computing the Boolean function f k (y) with y ∈ {0, 1} m and m = n−5 by appending at most two constant binary variables 1 encoding w i to the bit string y.
While the original proof [15] explored the mapping of logarithmic-depth classical circuits over {AND, OR} library, we focus on the classical circuits over 3-input 1-output MAJ(a, b, c) := ab ⊕ bc ⊕ ac and XOR(a, b, c) := a ⊕ b ⊕ c gates.Recall that the library {MAJ, XOR} is universal for classical computations if constant inputs are allowed.Proof.First, we describe a logarithmic-depth classical circuit that computes functions f k (y) for the range of applicable values k, and second, report expressions for MAJ and XOR in the form of a branching program that can be used in the recursion [15, Proof of Theorem 1].The length of the branching program computing f k (y) is upper bounded by taking the maximal length of the program implementing MAJ or XOR to the power of the circuit depth.
First, construct a classical circuit with MAJ and XOR gates that implements f k (y).To do so, we develop a circuit that computes all bits of the W (y), and for the purpose of implementing a given single Boolean component, discard all gates that compute the bits we are not interested in.Such operation does not increase the depth of the circuit, and may, in fact, decrease it slightly.
To find W (y), we employ a circuit consisting of two stages.First, compose a circuit of depth log 3/2 (m)+O(1) with 3-input 2-output Full Adder gates FA(a, b, c) := (MAJ(a, b, c), XOR(a, b, c)) by grouping as many triples of digits of same significance at each step as possible (note that MAJ and XOR are implemented in parallel).We finish this first stage when the output contains two log(m)-digit integer numbers u and v such that W = u + v.To analyze this circuit, it is convenient to group all bits needing to be added into the smallest set of integer numbers, and count the reduction in the number of integers left to be added by treating layers of FA gates as Carry-Save Adders [19,20].A Carry-Save Adder is defined as the 3-integer into 2-integer adder, which is implemented by applying the Full Adders to the individual components of the three integer numbers at the input.Since the number of integers left to be added changes by a factor of 2  3 at each step, and every step is implemented by a depth-1 MAJ/XOR circuit, the depth of the first stage is log 3/2 (m) + O(1).To find the individual components of W (y), the second stage adds two log(m)-digit integer numbers u and v.This can be accomplished by any logarithmic-depth integer addition circuit in depth O(log log(m)), such as [21].The total depth is thus log 3/2 (m) + O(log log(m)).
Next, construct S 5 -programs computing the MAJ and XOR functions: ( The branching program that (1, 2, 3, 4, 5)-computes f k (y) is created by recursively replacing gates MAJ and XOR in the circuit constructed above with the branching programs Eq. ( 4) and Eq. ( 5), where each z i is either one of the primary input variables y 1 , y 2 . . ., y m or one of the intermediate variables in the circuit computing f k (y), until all instructions are controlled by constants and primary variables y 1 , y 2 . . ., y m .The recoding of branches of the program τ -computing a desired intermediate variable z * when τ =(1, 2, 3, 4, 5) (note how Eq. ( 4) and Eq. ( 5) (1, 2, 3, 4, 5)-compute the gates, but not τ -compute them for arbitrary τ ) is accomplished in accordance with [15,Lemma 1].The total length of the branching program is thus upper bounded by the size of longest branching program implementation of the basic gates used (MAJ and XOR) raised to the power the depth of the circuit it encodes, 9 log 3/2 (m)+O(log log(m)) = O(m 5.4190225... log(m) O( 1) ) = O(m 5.42 ).
We conclude this section by summarizing the main result in a Theorem.
Theorem 1.The n-bit hwb function can be implemented by an ancilla-free reversible circuit of size O(n 6.42 ).
4 Ancilla-free quantum circuit of size O(n 2 ) Consider a register of n qubits and let C be the cyclic shift operator, The hidden weighted bit function U hwb may be written as In other words, U hwb implements the k-th power of C on the subspace with the Hamming weight k.Here we show that U hwb can be implemented by an ancilla-free quantum circuit of the size O(n 2 ).The circuit is expressed using Clifford gates and single-qubit Z-rotations.Let be the Hamming weight operator.Our starting point is Lemma 5. Suppose C = e iH for some n-qubit Hamiltonian H that commutes with W . Then Proof.Indeed, let L k be the subspace spanned by all basis states |x with the Hamming weight k.The full Hilbert space of n qubits is the direct sum L 0 ⊕ L 1 ⊕ . . .⊕ L n .Let us say that an operator O is block-diagonal if O maps each subspace L k into itself.Since H commutes with W , we infer that H is block-diagonal.Therefore HW and e iHW are also block-diagonal.Note that HW and kW have the same restriction onto L k .Thus e iHW and e ikH have the same restriction onto L k .By assumption, e iH = C. Thus e iHW and C k have the same restriction onto L k .Likewise, U hwb is block-diagonal and the restriction of U hwb onto L k is C k .We conclude that U hwb and e iHW have the same restriction onto L k for all k.Since both operators are block-diagonal, one has U hwb = e iHW .
We will construct a Hamiltonian H satisfying conditions of Lemma 5 using the language of fermions and the fermionic Fourier transform [17,18].First, define fermionic creation and annihilation operators a † p and a p with p ∈ Z n ≡ {0, 1, . . ., n − 1} as Here Note that Eq. ( 9) uniquely specifies F. Indeed, suppose x ∈ {0, 1} n is a weight-k basis state with ones at qubits p 1 < p 2 < . . .< p k .Then Since each operator Fa † p i F † = (Fa p i F † ) † is determined by Eq. ( 9), this uniquely specifies the action of F on the basis vectors |x .It will be important that F commutes with the Hamming weight operator W , FW = W F.
Indeed, from Eqs. (9,10) one can see that F|x is a linear combination of states n is non-zero only if all indices q 1 , q 2 , . . ., q k are distinct.Such state has weight k.Thus F maps weight-k states to linear combinations of weight-k states proving Eq. (11).
We will use the following fact established by Kivlichan et al. [18].
Lemma 6.The fermionic Fourier transform F on n qubits can be implemented by a quantum circuit of size O(n 2 ).The circuit requires no ancillary qubits.
For completeness, we provide a simplified proof of Lemma 6 and an explicit construction of the quantum circuit realizing F in Appendix A. Now we are ready to define a Hamiltonian H satisfying conditions of Lemma 5. Let be the projector onto the even-weight subspace.Define n-qubit Hamiltonians and Lemma 7. The Hamiltonian H defined in Eq. ( 13) satisfies C = e iH .
A proof of this lemma is given in Appendix B. A high-level intuition behind the definition of H comes from the fact that FH 0 F † is the fermionic momentum operator.Note that H = FH 0 F † in the odd-weight subspace where E = 0.The extra terms in the definition of H are needed to change integer momentums (periodic boundary conditions) in the odd-weight subspace to half-integer momentums (anti-periodic boundary conditions) in the even-weight subspace.This accounts for the difference between the qubit cyclic shift and its fermionic analogue, as detailed in Appendix B.
From Eq. ( 11) one can see that HW = W H. Thus H satisfies conditions of Lemma 5. Combining Lemma 5, Lemma 7, and noting that V W = W V one arrives at Here we used the well-known fact that e iV † OV = V † e iO V for any Hermitian operator O and any unitary V (which can be verified by expanding the exponent using the Taylor series and noting that (V † OV ) p = V † O p V for all p ≥ 1).We claim that each term in Eq. ( 14) can be implemented using O(n 2 ) two-qubit gates without ancillary qubits.By Lemma 6, the layers F and F † have gate cost O(n 2 ).
For the term e iH 0 E/2 and its inverse, we have the following lemma.
Lemma 8.The operator e iH 0 E/2 can be implemented by a quantum circuit of size O(n) without using ancillary qubits.
Proof.If we set θ p = pπ/n, then The operator |1 1| p E projects the subset of qubits Z n \{p} onto the odd-weight subspace.Note p =0 and let C p be a CNOT circuit that computes the parity of Z n \{p} into the qubit 0, CNOT j,0 .
Therefore, an individual R p is implemented with O(n) gates, which suggests e iH 0 E/2 can be implemented with O(n 2 ) gates.However, we can improve this count by noting that for p =q Thus, in fact, the product in Eq. ( 15) can be implemented with just O(n) gates.
We still need to implement the term e iH W = e iH 0 W e i(π/n)W 2 E .The operator e iH 0 W is a product of O(n 2 ) rotations e iθ|11 11| and e iθ|1 1| .Although a naive implementation of e i(π/n)W 2 E requires O(n 3 ) gates, we next show that a better implementation exists.Lemma 9.The operator e i(π/n)W 2 E can be implemented by a quantum circuit of size O(n 2 ) without using ancillary qubits.
Proof.First, note that The terms in Eq. ( 17) commute.Therefore, we have, with arbitrary order within the products, where, for p < p , U pp = e i(2π/n)|11 11| pp E and U p = e i(π/n)|1 1|pE .
The second and third products in Eq. ( 18) can be implemented with O(n) gates using arguments similar to those in Lemma 8.In the rest of this proof we focus on the first product and show that it can be implemented with O(n 2 ) gates.
Notice that |11 11| pp E projects the subset of qubits Z n \{p, p } onto the even weight subspace while projecting qubits p and p to |11 pp .Therefore, if 0 < p < p , we can define S pp := Z n \{0, p, p } and This implementation of U pp takes O(n) gates, which suggests O(n 3 ) gates might be needed to implement all n(n−1)/2 factors in the first product in Eq. ( 18).However, we can order the factors in such a way as to allow massive cancellation between consecutive CNOT circuits C pp and implement the first product with just O(n 2 ) total gates.
Notice that is a circuit of at most four CNOT gates.In fact, it is a circuit with just two CNOT gates when |{p, p } ∩ {q, q }| = 1.Thus, the following two products can be implemented with O(n) gates: where x, y ∈ Z n \{n−1}.Hence, the first product in Eq. ( 18) can be implemented with O(n 2 ) gates because p,p ∈Zn 0<p<p The above implementation of e i(π/n)W 2 E requires three-qubit gates of the form e iθ|011 011| .The latter can be decomposed into a sequence of O(1) two-qubit Clifford gates and single-qubit Z-rotations using the standard methods [22].We summarize main result of this section in the following Theorem.

Conclusion
In this paper, we introduced two ancilla-free circuits implementing the Hidden Weighted Bit function, O(n 6.42 )-gate reversible circuit and O(n 2 )-gate quantum circuit.Our circuits improve best previously known exponential size reversible and quantum ancilla-free circuits into polynomial-size ones.Our results demote hwb by removing it from the class of "hard" benchmarks [11].Our ancilla-free reversible implementation marks a new point in the study of ancilla vs gate count (space-time) tradeoff.Noting a high exponent in the reversible circuit complexity and a more-than-qubic difference between complexities of our best quantum and reversible circuit implementations, we suggest that a further line of inquiry may target improving the reversible implementation.
end if 13: end for Now f m,m is the only nonzero in the m-th column of f We claim that the quantum circuit U and the unitary matrix f obtained after each call to the function ColumnReduce have the property Indeed, Eq. ( 22) is trivially true initially when U =I and f is defined by Eq. ( 21).The lines 4 and 7-10 of Algorithm 2 apply a sequence of Givens rotations to the matrix f setting to zero all matrix elements f p,m with 0 ≤ p < m and setting f m,m =1.The order in which matrix elements of f are set to 0 or 1 is illustrated for n=3 below (asterisks indicate matrix elements of f ).
Since f remains unitary at each step, the final unit-diagonal low-triangular matrix is the identity, i.e. f =I after the last iteration of Algorithm 1.Each time a Givens rotation is applied to some rows p, p + 1 of the matrix f , the corresponding Givens rotations of fermionic operators a p , a p+1 are added to the quantum circuit U , see Eqs. (19,20).More precisely, the angles α, β at Line 7 are chosen such that the operator is proportional to a p+1 , see Eqs. (19,20).Thus the property Eq. ( 22) is maintained at each step.
After the last iteration of Algorithm 1 one has f = I and Eq. ( 22) gives (U F)a p (U F) † = a p for all p. Furthermore U |0 n = |0 n since all gates added to U map |0 n to itself.We conclude that U = F −1 after the last iteration of Algorithm 1. Thus the algorithm returns a quantum circuit realizing F. The inverse circuit U −1 can be obtained from U using the identities R(α, β) −1 = R(−α, β) and S(γ) −1 = S(−γ).The direct inspection shows that the total numberof gates fSWAP, R and S added to U is O(n 2 ).We implemented Algorithms 1,2 in Matlab obtaining the following circuit in the case n=3.
Combining this and Eq. ( 24) one gets where the indices of fermionic operators are evaluated modulo n.Using the identities e −iH 0 a q e iH 0 = e 2πiq/n a q , Fa p F † = 1 √ n n q∈Zn e 2πipq/n a q , and F † a q F = 1 √ n n r∈Zn e −2πiqr/n a r , one gets q∈Zn e 2πi(1−p)q/n Fa q F † = n −1 q,r∈Zn e 2πi(1−p+r)q/n a r = a p−1 .
Since L|0 n = R|0 n = |0 n , it suffices to check that L † a p L = R † a p R for all p ∈ Z n .A simple algebra gives e −i(π/n)W a p e i(π/n)W = e i(π/n) a p , e iH 0 /2 a p e −iH 0 /2 = e −iπp/n a p , and e −iH 0 /2 a p e iH 0 /2 = e iπp/n a p for all p ∈ Z n .Recall that fC † a p fC = a p−1 .Using the above identities one gets respectively.Thus C = e −iH 0 E/2 (Fe iH 0 F † )e iH 0 E/2 e i(π/n)W E on the full Hilbert space.Recall that the fermionic Fourier transform F preserves the Hamming weight.Thus F † commutes with e i(π/n)W E .Commuting the term e i(π/n)W E to the left gives C = e −iH 0 E/2 F e iH 0 e i(π/n)W E F † e iH 0 E/2 = V † e iH V, where V = F † e iH 0 E/2 and H = H 0 + (π/n)W E. Thus C = e iV † H V , proving Lemma 7.

Figure 1 :
Figure 1: 10-stage reversible circuit applying the 7-bit hwb to |x 1 x 2 x 3 x 4 x 5 x 6 x 7 w 1 t 1 w 2 w 3 .Each of first 7 CNOT/Toffoli gate stages increments |w 1 w 2 w 3 by one depending on the value of input variable, next 3 Fredkin gate stages perform controlled-SWAP.Vertical red lines separate these 10 stages.Not shown is Garbage uncomputation that can be performed by appending the inversion of the weight calculation circuit (CNOT/Toffoli gate part).

Lemma 4 .
Suppose y is an m-bit string and f k (y) is the k-th bit in the binary representation of W = y 1 +y 2 +...+y m .The function f k (y) can be (1, 2, 3, 4, 5)-computed by a branching program of size O(m5.42 ).