New Quantum Algorithms for Computing Quantum Entropies and Distances

We propose a series of quantum algorithms for computing a wide range of quantum entropies and distances, including the von Neumann entropy, quantum R\'{e}nyi entropy, trace distance, and fidelity. The proposed algorithms significantly outperform the prior best (and even quantum) ones in the low-rank case, some of which achieve exponential speedups. In particular, for $N$-dimensional quantum states of rank $r$, our proposed quantum algorithms for computing the von Neumann entropy, trace distance and fidelity within additive error $\varepsilon$ have time complexity of $\tilde O(r/\varepsilon^2)$, $\tilde O(r^5/\varepsilon^6)$ and $\tilde O(r^{6.5}/\varepsilon^{7.5})$, respectively. By contrast, prior quantum algorithms for the von Neumann entropy and trace distance usually have time complexity $\Omega(N)$, and the prior best one for fidelity has time complexity $\tilde O(r^{12.5}/\varepsilon^{13.5})$. The key idea of our quantum algorithms is to extend block-encoding from unitary operators in previous work to quantum states (i.e., density operators). It is realized by developing several convenient techniques to manipulate quantum states and extract information from them. The advantage of our techniques over the existing methods is that no restrictions on density operators are required; in sharp contrast, the previous methods usually require a lower bound on the minimal non-zero eigenvalue of density operators.

entropies characterize the randomness of a quantum system, while quantum distances measure the closeness of quantum systems.It is essential to compute their values in many important applications, from the estimation of the capacity of quantum communication channels and verification of the outcomes of quantum computation to the characterization of quantum physical systems (see, e.g., [2], [3], [4]).Several kinds of quantum algorithms for computing quantum entropies and distances have been proposed under different computational resources, e.g., quantum algorithms with access to copies of quantum states [5], [6], [7], quantum algorithms with purified quantum query access [8], [9], [10], [11], and variational quantum algorithms [12], [13], [14].
A main consideration of those quantum algorithms with copy access for computing quantum entropies and distances is the number of copies of quantum states used in the algorithms.This type of input model is known as the "quantum sample access" model, where identical copies of quantum states are directly given.For example, a method of testing the closeness of N -dimensional mixed quantum states was provided in [5] with respect to trace distance and fidelity using O(N/ε 2 ) and O(N/ε) copies, respectively, based on quantum spectrum testing [15] and efficient quantum tomography [16], [17], [18].A method of computing the von Neumann and quantum Rényi entropies of an N -dimensional quantum state was introduced in [6] using O(N 2 /ε 2 ) and O(N 2/α /ε 2/α ) copies, respectively.Recently, a new method of computing entropies was proposed in [7], especially computing the von Neumann entropy uses Õ(κ 2 /ε 5 ) copies, 1 where κ > 0 is given such that Π/κ ≤ ρ ≤ I for some projector Π.A distributed quantum algorithm for computing tr(ρσ), i.e., the fidelity of pure quantum states, was proposed in [19] using O(max{ √ N /ε, 1/ε 2 }) copies.Another class of quantum algorithms for computing quantum entropies and distances utilizes the conventional "purified quantum query access" model, where mixed quantum states are given by quantum oracles that prepare their purifications.Quantum algorithms for computing the von Neumann entropy and closeness testing with respect to trace distance were developed in [8] with query complexity Õ(N/ε 1.5 ) and Õ(N/ε), respectively, both of which have complexity exponential in the number of qubits.Recently, a quantum algorithm for computing the von Neumann entropy within a multiplicative factor was proposed in [9], which reproduces the result within additive error of [8].A method of computing the quantum α-Rényi entropy was proposed in [10]  queries to the oracle, where κ > 0 is given such that I/κ ≤ ρ ≤ I and x = tr(ρ α )/N .Compared to the "quantum sample access" model where only identical copies of quantum states are directly given, the "purified quantum query access" model allows more potential operations from which one can learn properties of quantum states.This is because any operation allowed in the former model can be trivially simulated in the latter model.Consequently, the latter model (in query complexity) usually uses fewer computational resources than the former (in sample complexity).For example, the best known query complexity for computing the von Neumann entropy is Õ(N/ε 1.5 ) [8], while the best known sample complexity for the same task is O(N 2 /ε 2 ) [6].In addition, the latter model also plays an important role in computational complexity theory when comparing classical and quantum computing.For example, testing the closeness between two quantum states (in trace distance) is known to be QSZK-complete (in certain parameter regime) [20], [21], where the quantum states are given in the "purified quantum query access" model.
The recent quantum algorithms with purified quantum query access mentioned above are usually developed in the general framework of quantum singular value transformation (QSVT) [22].The powerful technique of QSVT on unitary operators developed by [22] has been successfully applied as a unified framework in a wide range of quantum algorithms, including Grover's search algorithm [23], the quantum walk algorithms [24], [25], the HHL algorithm for solving systems of linear equations [26], and Hamiltonian simulation [27].In the framework of QSVT, a unitary operator U can be regarded as a block-encoding that stores a matrix A in (the upper-left corner of) its matrix representation (see Definition II.1).QSVT can be understood as an algorithmic technique that transforms the matrix A to f (A) for some function f (•) of interest, and it also provides a quantum circuit implementation of Ũ that block-encodes f (A) using queries to U .The original QSVT deals with unitary operators, while a Hamiltonian variant of the QSVT was proposed in [28], which was then used in quantum polar decomposition [29], [30].
Except for unitary operators and Hamiltonians, density operators (mixed quantum states) are another important class of objects we can manipulate in quantum computation.A technique was developed in [31] to implement a unitary operator that block-encodes a density operator, using queries to its purified quantum query oracle.Equipped with QSVT, this technique enables us to implement unitary operators that block-encode certain matrix functions of quantum states, and thus strengthens the power of the "purified quantum query access" model.This technique has been employed in quantum algorithms for semidefinite programming [32] and quantum fidelity estimation [11].Conversely, however, it seems difficult to prepare a quantum state from a unitary operator that block-encodes its density operator.
A natural idea of extracting information from a density operator is to directly manipulate the quantum state itself rather than a unitary operator that encodes it.This leads us to extend the definition of block-encoding proposed originally for unitary operators [22], [31], [33] to that for general operators (see Definition II.1), especially for quantum states (i.e., density operators).Regarding quantum states as blockencodings, we are able to design new quantum algorithms for computing a wide range of quantum entropies and distances, such as the von Neumann entropy, quantum Rényi entropy, quantum Tsallis entropy, trace distance, and fidelity.These quantum algorithms significantly outperform the best known ones in the low-rank case, and some of them can even achieve exponential speedups.Here, the low-rank case means that the rank of N -dimensional quantum states is much smaller than N , e.g., r = polylog(N ), which is of great interest in both theoretical (e.g., [34], [35]) and experimental (e.g., [36]) physics.
In the remainder of this Introduction, we will first present our main results in Section I-A.The new techniques that enable us to achieve our results will be outlined in Section I-B.Then related works will be reviewed in Section I-C, and a discussion will be given in Section I-D.

A. Main Results
Let us first set the stage for presenting our main results.In order to manipulate quantum states, we extend the definition of block-encoding for unitary operators to that for general operators (see Definition II.1), and use this extended definition of block-encoding to describe our quantum algorithms.In our quantum algorithms, a mixed quantum state is given by a quantum unitary operator (oracle) which prepares a purification of the state (see Definition II.2).This conventional model is known as the "purified quantum query access" model and has been widely used in developing quantum algorithms [8], [9], [10], [32], [37], [38].
Throughout this paper, the quantum query complexity of a quantum query algorithm means the number of queries to the given quantum oracles.The time complexity of a quantum query algorithm is the sum of its quantum query complexity and the number of elementary quantum gates used in it.When quantum algorithms are compared with classical algorithms, quantum oracles are given as classical descriptions of quantum circuits.The actual number of elementary quantum gates performed in the quantum algorithm only has a polynomial overhead compared to its "time complexity" defined here.Then our main results can be summarized in the following: Theorem I.1 (Informal): In the "purified quantum query access" model, given quantum oracles that prepare N -dimensional mixed quantum states of rank r, there are quantum query algorithms that compute
within additive error ε with time complexity poly (log(N ), r, 1/ε), where the time complexity hides a constant which depends only on α. 2  Our quantum algorithms are compared with the existing algorithms in Table I.In particular, our algorithms outperform the best known ones in the low-rank case, e.g., r = polylog(N ).To see this more clearly, let us recast the existing results in the low-rank case, and then compare them with ours.Table I compares the query complexity (in the "purified quantum query access" model) and the sample complexity (in the "quantum sample access" model).It is important to note the difference between the two models in the comparison.While it is trivial that a sample in the "quantum sample access" model can be simulated by a query in the "purified quantum query access" model, the vice versa remains unknown.In other words, the "quantum sample access" model can be seen as a restricted version of the "purified quantum query access" model where the oracle is only used to prepare the mixed quantum states.Therefore, any sample complexity in the "quantum sample access" model implies the same amount of query complexity in the "purified quantum query access" model.Regarding these, we still compare the query/sample complexities defined in the two models together.For further discussion regarding the two different quantum input models, please refer to [8].
• For the von Neumann entropy and quantum α-Rényi entropy, it was shown in [6] that their sample complexities are O N 2 /ε 2 and O (N/ε) max{2/α,2} , respectively.Unitarily invariant properties of entropies considered, their method is based on weak Schur sampling (see [43]), and does not imply a straightforward method for low-rank quantum states.The query complexity for the von Neumann entropy was shown in [8] to be Õ(N/ε 1.5 ), which can be improved to Õ( √ N r/ε 1.5 ) for the low-rank case after a careful analysis.It was shown in [42] that Õ(κ 2 /ε) queries are sufficient to compute the von Neumann entropy of a quantum state ρ if some κ > 0 is known in advance such that ρ ≥ I/κ.Similarly, the method in [10] for the quantum α-Rényi entropy can be improved to Õ κN r max{α−1,0} /ε 2 for the low-rank case.
• For the trace distance and fidelity, most algorithms are proposed for closeness testing with respect to them.The sample complexities O N/ε 2 and O (N/ε) given in [5] can be improved (by their Corollary 1.6) to O r/ε 2 and O (r/ε) for the low-rank case, respectively.The query complexity Õ(N/ε) given in [8] can be improved to Õ(min{ √ N r/ε, r/ε 2 }) for the low-rank case.The above results do not cover our results, because closeness 2 A few days after this paper was submitted to arXiv, the concurrent work of Gilyén and Poremba [39] appeared.They proposed a quantum algorithm for fidelity estimation using identical copies of quantum states based on density matrix exponentiation [40], [41].We note that their techniques of converting identical copies to unitary block-encodings (Corollary IV.4 in [39]) can be applied to our quantum algorithms in Theorem I.1.As a result, we can obtain quantum algorithms for computing these quantum entropies and distances using poly(r, 1/ε) copies of quantum states, which only has a polynomial overhead compared to the query complexity of our quantum query algorithms.
testing can be solved by computing the closeness but the converse seems difficult.
• For the quantum algorithms in [7], [10], and [42] that attempt to reduce the dependence on N , they introduce an extra dependence on κ, where κ is the reciprocal of the minimal non-zero eigenvalue of quantum states.
Our quantum algorithms can be easily adapted to their settings by taking r = O(κ), thus with time complexity poly(log(N ), κ, 1/ε), while the converse seems not applicable. 3lthough our quantum algorithms focus on low-rank quantum states, they are also comparable to those for the general case where one could only assume that the quantum states are full-rank, i.e., r = N .
• For the von Neumann entropy, our quantum algorithm has query complexity Õ(N/ε 2 ) when the quantum state is full-rank, which is slightly worse than the query complexity Õ(N/ε 1.5 ) in [8].• For the trace distance, our quantum algorithm has query complexity Õ(N 5 /ε 6 ) when the quantum state is fullrank.To the best of our knowledge, this is the first quantum algorithm for computing the trace distance between quantum states with time complexity poly(N ) in the general case.We will further discuss the above results for quantum entropies in Section I-A.1 and those for closeness (i.e.trace distance and fidelity) of quantum states in Section I-A.2.
1) Computing Quantum Entropies: In quantum information theory, the entropy of a (mixed) quantum state is a measure of its uncertainty, and computing its value is crucial when characterizing and verifying an unknown quantum system.After von Neumann [44] introduced the famous von Neumann entropy S(ρ) = − tr (ρ ln (ρ)) , which is a natural generalization of the classical Shannon entropy [45], several other entropies have been proposed, e.g., Rényi entropy [46], [47], [48], [49], Tsallis entropy [50], [51], [52], Min and Max (Hartley) entropies [53], [54], [55], and the unified entropy [56], [57].The quantum α-Rényi entropy and the quantum α-Tsallis entropy are defined by for α ∈ (0, 1) ∪ (1, +∞), respectively.It is easy to see that the von Neumann entropy is a limiting case of the Rényi entropy [48] and the Tsallis entropy [50]: For α = 0, the quantum Tsallis entropy degenerates to the rank of quantum states: ). a) Overview: Given a quantum unitary oracle that prepares a mixed quantum state (see Definition II.2), we develop quantum algorithms for computing several quantum entropies.Their quantum query complexities are collected in Table II, which are also their quantum time complexities up to polylogarithmic factors.Most of our algorithms do not require any restrictions on the lower bound for the eigenvalues of quantum states except those for computing the quantum Max entropy and the rank of quantum states, where Π/κ ≤ ρ is required for some projector Π and κ > 0.
The prior best quantum algorithms for computing von Neumann entropy [6], [8], [9] and quantum Rényi entropy [6], [10] have time complexity Ω(N ) even for rank r = 2. Compared to them, our quantum algorithms are exponentially faster in the low-rank case.In particular, our quantum algorithm for computing the von Neumann entropy with query complexity Õ(r/ε 2 ) is comparable to the quantum algorithm given in [42] with query complexity Õ(κ 2 /ε), where we note that r ≤ κ always holds.
It is worth mentioning that for odd integer α > 1, the query complexity of computing the quantum Tsallis entropy S T α (ρ) does not depend on rank r.In this case, there is a simple SWAP test-like quantum algorithm that computes tr(ρ α ) using O(1/ε 2 ) copies [41], [58].Compared to it, our algorithm (Theorem III.7) yields a quadratic speedup (see Section III-C for more discussions).For non-integer α, we are not aware of any prior approaches for computing the quantum Tsallis entropy with complexity better than quantum state tomography.

b) Lower bounds:
We are able to give a query lower bound Ω(r c ) for computing the quantum Rényi entropy S R α (ρ) including the von Neumann entropy S(ρ) in terms of rank r, where c ≥ 1/3 is a constant depending only on α (see Theorem III.11).This lower bound is simply derived from the quantum query complexity for computing the Rényi (and Shannon) entropy of classical probability distributions [59], [60].
Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.2) Computing Quantum Distances: Distance measures of quantum states are basic quantities in quantum computation and quantum information.Two of the most important distance measures are the trace distance and fidelity.For each of them, we propose quantum algorithms that compute it and its extensions.Here, we assume that there are two quantum oracles U ρ and U σ that prepare the density operators ρ and σ, respectively.The query complexity of a quantum algorithm means the total number of queries to both U ρ and U σ .
We develop quantum algorithms for computing α-trace distance for α > 0, with their query complexities shown in Table III.As a special case, our quantum algorithm (Theorem IV.1) for computing the trace distance (i.e., the 1-trace distance) has query complexity Õ r 5 /ε 6 .Note that the closeness testing of the α-trace distances of quantum states for integer α, e.g., the 1-, 2and 3-trace distances, was studied in [8].For other cases of α, we are not aware of any prior approaches to compute the α-trace distance with complexity better than quantum state tomography.
We develop quantum algorithms for computing the α-fidelity for 0 < α < 1, with their query complexities shown in Table IV).As a special case, our quantum algorithm (Theorem IV.5) for computing the fidelity (i.e., the 1/2-fidelity) has query complexity Õ r 6.5 /ε 7.5 , which is a polynomial speedup over the best known Õ r 12.5 /ε 13.5 in [11].For other cases of α, we do not know any prior approaches to compute the α-fidelity with complexity better than quantum state tomography.c) Lower bounds and hardness: Our quantum algorithms for computing the fidelity and trace distance have a time complexity polynomial in the rank r.We show that there is no quantum algorithm that computes the fidelity or trace distance with time complexity poly(log(r), 1/ε) unless BQP = QSZK (see Theorem IV.7), based on the result of [20] that (α, β)-Quantum State Distinguishability is QSZK-complete for 0 ≤ α < β 2 ≤ 1. 4Our quantum algorithms for computing the fidelity and trace distance achieve a significant speedup under the lowrank assumption.We argue that these problems are unlikely to be efficiently solved by classical computers because computing the fidelity and trace distance are DQC1-hard (see Theorem IV.8); and it was shown in [63] that DQC1 is not (classically) weakly simulatable unless the polynomial hierarchy collapses to the second level, i.e., PH = AM.

B. Techniques
In this subsection, we give an overview of the techniques that enable us to achieve the results presented in the above subsection.
1) Quantum States as Block-Encodings: The key idea of our quantum algorithms is to regard quantum states as Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.

TABLE V COMPARISON BETWEEN DENSITY OPERATORS AND UNITARY OPERATORS AS BLOCK-ENCODINGS *
block-encodings.To this end, we extend the definition of block-encoding proposed for unitary operators to that for general ones (see Definition II.1).Suppose that a unitary operator U A prepares a subnormalized density operator A (see Definition II.2).In this framework, we provide a convenient way to manipulate the subnormalized density operator A and extract information from it as follows.
• Evolution: If U is a unitary operator, which is a block-encoding of an operator B, we can prepare a subnormalized density operator BAB † (see Lemma II.2).This evolution of the subnormalized density operator can be seen as a generalization of quantum unitary operation ρ → U ρU † for (normalized) density operator ρ. • Trace Estimation: We provide an efficient method to estimate the trace of A based on quantum amplitude estimation [64] (see Lemma II.15).As will be seen, trace estimation is an important subroutine in our quantum algorithms (see Section I-A.1 and Section I-A.2). • Linear Combinations: As an analog of Linear-Combination-of-Unitaries (LCU) algorithm through a series of work [22], [65], [66], [67], [68], [69], [70], we also provide a technique to prepare a linear (convex) combination of subnormalized density operators (see Lemma II.17).This technique will be used in computing the trace distance (see Section I-A.2 and Theorem IV.1).The technique of "trace estimation" is the cornerstone in developing our quantum algorithms.To compute the values of quantum entropies and distances, the key part has the form tr(ϱ), where ϱ is a (subnormalized) density operator.Our strategy is to prepare a quantum state, which is a blockencoding of ϱ, through the technique of "evolution".Roughly speaking, we prepare the subnormalized density operator ϱ up to a scaling factor; we will use the phrase "prepare ϱ" regardless of the scaling factor in the following discussion of this section.For example, we prepare −ρ ln(ρ) for the von Neumann entropy, and prepare ρ α for the quantum α-Rényi and Tsallis entropies.To achieve this, we develop techniques for eigenvalue transformation of density operators based on QSVT as follows.
• Eigenvalue Transformation: Based on the evolution, if we can construct a unitary operator U , which is a block-encoding of P (A) for some polynomial P (•) as in QSVT [22], we can transform A to another subnormalized density operator A(P (A)) 2 (see Theorem II.4).• Positive Powers: We develop a technique to prepare the subnormalized density operator A c for 0 < c < 1 without any restrictions on A (see Lemma II.8).Inspired by this, we can also obtain a unitary operator, which is a blockencoding of |A| c , using queries to a unitary operator U , which is a block-encoding of Hermitian operator A (see Lemma II.13).In order to obtain block-encodings of powers of A, previously known methods [22], [33], [38] usually require a lower bound for the minimal non-zero eigenvalues of density operators; for example, I/κ ≤ A ≤ I for some κ > 0 in [33].This technique for positive powers of subnormalized density operators will be frequently used in our quantum algorithms for computing quantum entropies, fidelity and trace distance (see Section I-A.1 and Section I-A.2), in order to avoid restrictions on density operators.
We also provide a method to block-encode the eigenvalue threshold projector Π supp(A) of A in a quantum state, where supp(A) is the support of A, and Π S is the projector onto subspace S.
• Eigenvalue threshold projector: We propose a method to (approximately) block-encode the eigenvalue threshold projector Π supp(A) of A in a subnormalized density operator (see Lemma II.19).We note that a technique for block-encoding eigenvalue threshold projectors was also provided in [32], but they required that A ≥ qΠ for some projector Π and the value of q > 0 is known in advance.In contrast, our method does not impose any restriction on A. This method will be used in computing the trace distance (see Section I-A.2 and Theorem IV.1).
A comparison between density operators and unitary operators as block-encodings is given in Table V.
To (approximately) prepare η, we first prepare Π ≈ Π supp(µ) through the technique of "eigenvalue threshold projector" (Lemma II.19).Here, µ = (ρ + σ)/2 can be prepared through the technique of "linear combinations" (Lemma II.17).Then we only need to construct a unitary operator, which is a block-encoding of ν ≈ |ν| To get an estimation of the trace distance between ρ and σ, we should just note that T (ρ, σ) = tr(η) ≈ tr ν Πν † , where we have already prepared ν Πν † through the above process.Strictly speaking, we have prepared a mixed quantum state, whose density operator is a block-encoding of ν Πν † up to a scaling factor.After carefully selecting appropriate parameters that determine the errors in the above process, we obtain a quantum algorithm for computing the trace distance with query complexity Õ(r 5 /ε 6 ), where r is (an upper bound for) the rank of quantum states ρ and σ, and ε is the desired additive error.Here, Õ(•) suppresses the polylogarithmic factor of N , where N is the dimension of the Hilbert space of ρ and σ.
C. Related Works a) Classical property testing: The problems considered in this paper can be thought of as a quantum analog of testing properties of probability distributions.Classical algorithms for testing properties of probability distributions have been widely studied since the beginning of this century.The first algorithm was proposed in [71] for the closeness testing of probability distributions in ℓ 1 distance using Õ(N 2/3 /ε 4 ) samples, which was then improved to use Õ(N 2/3 /ε 8/3 ) samples [72].Later, it was shown in [73] that the optimal sample complexity for this problem is Θ max{N 2/3 /ε 4/3 , N 1/2 /ε 2 } , and they also proved that the optimal sample complexity Θ(1/ε 2 ) for closeness testing in ℓ 2 distance.The identity testing is a special case of the closeness testing given that one of the distributions is known.It was shown in [74] that Õ(N 1/2 /ε 4 ) samples are sufficient for the identity testing in ℓ 1 distance, which was improved to optimal Θ(N 1/2 /ε 2 ) in [75].The independence testing, i.e., whether a distribution on [N ] × [M ] (N ≥ M ) is equal to or ε-far from a product distribution in ℓ 1 distance, was shown to have sample complexity Õ(N 2/3 M 1/3 ) • poly(1/ε) [74].Recently, a modular reduction-based approach was proposed in [76], which covers the closeness, identity and independence testing.They also gave a tight sample complexity Θ max{N 2/3 M 1/3 /ε 4/3 , (N M ) 1/2 /ε 2 } for the independence testing.In addition, the monotonicity testing was also shown to have sample complexity Õ(N 1/2 /ε 4 ) [77].
Apart from property testing between distributions, properties of a single distribution are well studied in the literature, e.g., [78], [79], and [80].An algorithm that computes the Shannon entropy using samples for ε = Ω(N 0.03 ) was proposed in [81] and [82].After that, the optimal estimator of Shannon entropy using samples was given in [83] and [84].Also, an estimator for exp (1 − α)S R α (p) was provided in [83], where S R α (p) is the α-Rényi entropy of distribution p.
b) Quantum property testing: The emerging topic of quantum property testing (see [43]) studies the quantum advantage in testing classical statistical and quantum information properties.
Quantum advantages in testing classical statistical properties have been extensively studied.Quantum algorithms for testing properties of classical distributions was first studied in [85], which gave quantum query complexity O(N 1/2 /ε 6 ) for the closeness testing, and O(N 1/3 ) for identity testing (to the uniform distribution) in ℓ 1 distance (for constant precision ε).Later, the quantum query complexity of the identity testing (to a known distribution) was improved to Õ(N 1/3 /ε 5 ) in [86].The quantum query complexity for the closeness testing in ℓ 1 distance was further improved to Õ(N 1/2 /ε 2.5 ) in [87], to Õ(N 1/2 /ε) in [8], and to O(N 1/2 /ε) in [88].Recently, the quantum query complexity for computing the Shannon entropy and the Rényi entropy was studied in [59]; especially, an Õ(N 1/2 /ε 2 ) quantum query complexity was shown for the Shannon entropy.
There are also some quantum algorithms for testing quantum information properties not mentioned above.It was shown in [41] that testing the orthogonality of pure quantum states requires Θ(1/ε) copies, promised that either they are orthogonal or have fidelity ≥ ε.Recently, it was shown in [89] that quantum identity testing only uses O(N 3/2 /ε 2 ) copies with the help of random choice of independent measurements.

D. Discussion
In this paper, we suggest a generalized definition of block-encoding, with which we can directly manipulate subnormalized density operators and extract information from them.Based on this, we develop new quantum algorithms that compute a large class of quantum entropies and distances, which achieve a significant speedup over the best known ones in the low-rank case.Several interesting problems remain open: • Our upper and lower bounds are far from being tight, a similar issue for computing the von Neumann entropy arose in [8].In the error analysis of our algorithms, the rank r appears in the upper bound for the error as a multiplicative factor.This makes our algorithms unlikely to have complexity sub-polynomial in r.Can we find more efficient algorithms (for example, with query complexity sub-polynomial in r) or improve the lower bounds (to, for example, Ω(r))? • It would be interesting to study other distance measures of quantum states, e.g., the relative von Neumann entropy [1] (the quantum generalization of the Kullback-Leibler divergence [90]) ) .
• Can we apply the idea of manipulating quantum states to problems other than computing quantum entropies and distances?

E. Recent Developments
After the work described in this paper, a series of quantum algorithms for computing quantum entropies and distances have been developed and applied in practical tasks.
• Von Neumann entropy.In the "purified quantum query access" model, the query complexity for computing the von Neumann entropy was further analyzed in detail and shown to be O(r log(r)/ε 2 ) in [91].Computing the von Neumann entropy in space-bounded quantum computation was investigated in [92], and they showed that the space-bounded version of von Neumann entropy difference is BQL-complete.In the "quantum sample access" model, the time complexity for computing the von Neumann entropy was improved to Õ(N 2 ) in [93], compared to the Õ(N 6 ) in [6], while retaining the same (up to polylogarithmic factors) sample complexity Õ(N 2 ).
• Rényi entropy.In the "purified quantum query access" model, the query complexity for computing the α-Rényi entropy of a quantum state was improved to Õ(r [94].In the "quantum sample access" model, the time complexity for computing the α-Rényi entropy was improved to Õ(N [93], compared to the Õ(N 6 α ) for 0 < α < 1 and Õ(N 6 ) for α > 1 in [6], at the cost of larger sample complexity; they also showed sample lower bounds Ω(max{N, N 1 α −1 }) for computing the α-Rényi entropy.In addition, variational quantum algorithms for computing the von Neumann and Rényi entropies were proposed in [95].
• Trace distance.In the "purified quantum query access" model, the query complexity for computing the trace distance was improved to Õ(r/ε 2 ) in [96], and they showed that low-rank trace distance estimation is BQPcomplete based on the result of [97], improving the DQC1-hardness given in this paper.The space-bounded version of trace distance estimation was shown to be BQL-complete in [92], and its certification was shown to be coRQ U L-complete.In the "quantum sample access" model, the sample complexity for computing the fidelity was shown to be Õ(r 2 /ε 5 ) in [96], which was later employed in a hypothesis testing based auditing pipeline for quantum differential privacy with domain knowledge [98].• Fidelity.In the "purified quantum query access" model, the query complexity for computing the fidelity was improved to Õ(r 2.5 /ε 5 ) in [39].When quantum states are well-conditioned (i.e., ρ, σ ≥ I/κ for some known κ > 0), the query complexity was shown to be Õ(κ 4 /ε) in [99], with the dependence on ε optimal (up to polylogarithmic factors).It was shown in [97] that pure-state fidelity estimation is BQP-complete, which, together with the polynomial-time quantum algorithms for low-rank fidelity estimation in [11] and [39] and this paper, implies that low-rank fidelity estimation is also BQP-complete, improving the DQC1-hardness given in this paper.In the "quantum sample access" model, the sample complexity for computing the fidelity was shown to be Õ(r 5.5 /ε 12 ) in [39].

F. Organization of This Paper
Section II introduces the idea that regards quantum states as block-encodings, and provides a series of basic techniques for manipulating them.Section III presents quantum algorithms that compute quantum entropies, including the von Neumann entropy, quantum Rényi entropy and quantum Tsallis entropy.Section IV presents quantum algorithms that compute the trace distance, fidelity and their extensions.

II. QUANTUM STATES AS BLOCK-ENCODINGS
Since the introduction of qubitization in Hamiltonian simulation [31], block-encodings have been widely used as a basic notion in quantum algorithms, e.g., [22] and [33].In the existing research, block-encodings are unitary operators that block-encode smaller ones.
Quantum states (i.e., density operators) are often used to contain necessary information in quantum algorithms.For this purpose, a technique was provided in [31] to implement a unitary operator that block-encodes a mixed quantum state.However, to the best of our knowledge, there is no known method to do the inverse, that is, to prepare a mixed quantum state using queries to the given unitary operator (quantum oracle) that block-encodes its density operator.As a result, it could be difficult to extract information from operators that are block-encoded in unitary operators.This motivate us to regard quantum states as block-encodings.As will be seen later in this section, it is convenient to extract information from the operators block-encoded in quantum states as well as to manipulate them.
In this section, we will extend the definition of blockencoding proposed for unitary operators as in [22], [31], and [33] to that for general operators, especially for density operators (i.e., quantum states).Then we show the possibility that information can be stored in and extracted from quantum states as block-encodings.Also, we can manipulate the information block-encoded in quantum states.Here, the "information" block-encoded in quantum states (i.e., density operators) is essentially subnormalized density operators.

A. Subnormalized Density Operators
We will use the language of the conventional blockencoding.Here, we give the definition of block-encoding for ordinary quantum operators as follows.
Definition II.1 (Block-Encoding): Intuitively, A is represented by the matrix in the upper left corner of B, i.e.
Here, we write |0⟩ a to denote |0⟩ ⊗a , where the subscript a indicates which (and how many) qubits are involved in the Dirac symbol.For example, if a system consists of two subsystems of a qubits and b qubits and it is in state |0⟩ ⊗(a+b) , we can represent it as |0⟩ a+b or |0⟩ a |0⟩ b .We are interested in matrices block-encoded in a mixed quantum state (density operator), which are indeed subnormalized density operators.
Definition II.2 (Subnormalized Density Operator): A subnormalized density operator A is a semidefinite operator with tr(A) ≤ 1.A (normalized) density operator is a subnormalized density operator with trace 1.An (n + a + b)-qubit unitary operator U is said to prepare an n-qubit subnormalized density operator A, if it prepares the purification |ρ⟩ = U |0⟩ n+a+b of a density operator ρ = tr b (|ρ⟩ ⟨ρ|), which is a (1, a, 0)-blockencoding of A.
Given a subnormalized density operator A prepared by a unitary operator U , we usually need to construct another unitary operator Ũ which is a block-encoding of A. This technique was first introduced by [31], then generalized for subnormalized density operators by [22] and [32].
Lemma II.1 (Block-Encoding of Subnormalized Density Operators [22], [31], [32]): Suppose U is an (n + a)qubit unitary operator that prepares an n-qubit subnormalized density operator A. Then there is a (2n + a)-qubit unitary operator Ũ which is a (1, n+a, 0)-block-encoding of A, using 1 query to U and U † and O(a) elementary quantum gates.

B. Generalized Evolution
It is well known that after applying a unitary operator U on a mixed quantum state ρ, it will become another state U ρU † .Here, we extend the basic unitary evolution to the case of subnormalized density operators, which transforms a subnormalized density operator A to BAB † , where B is block-encoded in a unitary operator.
Lemma II.2 (Evolution of Subnormalized Density Operators): Suppose that 1) U is an (n + a)-qubit unitary operator that prepares an n-qubit subnormalized density operator A, and 2) V is an (n+b)-qubit unitary operator which is a (1, b, 0)block-encoding of B. Then, Ũ = (V ⊗ I a )(U ⊗ I b ) is an (n + a + b)-qubit unitary operator that prepares an n-qubit subnormalized density operator BAB † .

C. Polynomial Eigenvalue Transformation
Now we show how a subnormalized density operator A can be transformed to a new subnormalized density operator A(P (A)) 2 , where P (x) is a polynomial.To this end, we recall the polynomial eigenvalue transformation of unitary operators in [22], and extend it to the case of preparing subnormalized density operators.
2) Ũ uses d queries to U and U † , 1 query to controlled-U and O((a + 1)d) elementary quantum gates.3) A description of Ũ can be computed by a (classical) Turing machine in O(poly(d, log(1/δ))) time.In the following, combining Theorem II.3 and Lemma II.2, we develop a technique of polynomial eigenvalue transformation of subnormalized density operators.
Theorem II.4 (Polynomial Eigenvalue Transformation of Subnormalized Density Operators): Suppose that 1) U is an (n + a)-qubit unitary operator that prepares an n-qubit subnormalized density operator A.
Then for every δ ∈ (0, 1), there is a quantum circuit Ũ such that 1) Ũ prepares an n-qubit subnormalized density operator B, and We claim that Ũ = ( Ṽ ⊗ I a )(U ⊗ I b ) is desired.To see this, by Lemma II.2, Ũ prepares an n-qubit subnormalized density We conclude that Ũ prepares the purification |ρ⟩ of ρ, which is a (1, O(n + a), Θ(δ))-block-encoding of A(P (A)) 2 , which yields the proof.By Theorem II.4,we are able to transform a subnormalized density operator A to A(f (A)) 2 for a large range of f (x), provided f (x) can be efficiently approximated by a polynomial.
Theorem II.5 (Eigenvalue Transformation of Subnormalized Density Operators): Suppose that 1) U is an (n + a)-qubit unitary operator that prepares an n-qubit subnormalized density operator A.
Moreover, if P is even or odd, the latter condition can be relaxed to ∥P ∥ Then there is a quantum circuit Ũ such that 1) Ũ prepares an n-qubit subnormalized density operator B, and 2) Ũ uses O(d) queries to U and U † , 1 query to controlled-U and controlled-U † , and O((n + a)d) elementary quantum gates.3) A description of Ũ can be computed by a (classical) Turing machine in O(poly(d, log(1/δ))) time.Proof: Let Ũ be the quantum circuit obtained by Theorem II.4,which prepares an n-qubit subnormalized density operator B as a (1, 0, δ)-block-encoding of A(P (A)) 2 .We analyze the error by the fact that As will be seen, Theorem II.5 can be used to develop a technique of preparing positive powers of Hermitian operators (see Section II-D).
Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.

D. Positive Powers
We will use Theorem II.5 to develop an efficient approach for implementing positive powers of Hermitian matrix A, which removes the dependence on κ that I/κ ≤ A ≤ I as in [33] (see Lemma II.13 of its full version).In this subsection, we will provide the positive power tricks for an Hermitian operator block-encoded in a density operator (Lemma II.8) and in a unitary operator (Lemma II.13).To this end, we recall some results of polynomial approximations of power functions.
Lemma II.8 (Positive Powers Block-Encoded in Density Operators): Suppose that 1) U is an (n + a)-qubit unitary operator that prepares an n-qubit subnormalized density operator A. 2) δ, ε ∈ 0, 1  2 and c ∈ (0, 1).Then there is a quantum circuit Ũ such that 1) Ũ prepares an n-qubit subnormalized density operator B, and B is a (4δ c−1 , 0, Θ(δ c +εδ c−1 ))-block-encoding of A c .2) Ũ uses O(d) queries to U and U † , 1 query to controlled-U and controlled-U † , and O((n + a)d) elementary quantum gates, where . By Lemma II.7, we can obtain an even/odd polynomial P (x) parameters δ and ε.This allows us to prepare positive powers of density operators flexibly, without dealing with their "condition numbers" κ such that Π/κ ≤ ρ for some projector Π.The method used in Lemma II.8 is a straightforward application of Theorem II.5 with the observation that x(f (x)) 2 → 0 when x → 0. In fact, any function f (x) that satisfies this condition (and, of course, other conditions required in Theorem II.5) is applicable in this trick, without dealing with κ.As will be seen, this technique for positive powers of subnormalized density operators will be frequently used in our quantum algorithms (see Section III and Section IV), in order to avoid the κ restrictions on density operators.Next, inspired by the above observation, we extend the result to the case that A is given as block-encoded in a unitary operator.Here, we need to implement a threshold projector.The following lemma is Corollary III.3 of [22].
2) Ũ uses 1 query to each of U and V .With the approximation of threshold functions, we are able to implement positive powers of Hermitian matrix A, which is given as block-encoded in a unitary operator.
Lemma II.13 (Positive Powers Block-Encoded in Unitary Operators): Suppose that 1) U is an (n + a)-qubit unitary operator which is a (1, a, 0)-block-encoding of an n-qubit Hermitian operator A.
2) W uses O(Q) queries to U and U † , O(1) query to controlled-U and O((a + 1)Q) elementary quantum gates, where Turing machine in poly(Q) time.Proof: Let f (x) = 1  2 |x| c be an even function and δ, ε ∈ (0, 1  4 ].By Lemma II.6, there is an even degree-d P polynomial P ∈ R[x], where By Theorem II.3, for δ V > 0, there is a quantum circuit Ṽ such that 1) Ṽ is a (1, a + 2, 0)-block-encoding of C, and C is a (1, 0, δ V )-block-encoding of R(A).2) Ṽ uses d R queries to U and U † , 1 query to controlled-U and O((a + 1)d R ) elementary quantum gates.3) A description of Ṽ can be computed by a (classical) Turing machine in poly(d R , log(1/δ V )) time.By Lemma II.12, using one query to each of Ũ and Ṽ , we can obtain a quantum circuit W , which is a (1, 2a + 4, 0)block-encoding of BC.In the following, we will show that ∥BC − f (A)∥ ≤ Θ(ε + δ c ).We note that This is seen by the following three cases: By setting κ = 1/δ, Lemma II.13 reproduces the result of [33] (see Lemma II.13 of its full version).The strength of Lemma II.13 is to allow implement positive powers of A, regardless of whether the condition I/κ ≤ A ≤ I holds.The technique used in Lemma II.13 by multiplying the polynomial approximation with a threshold function is similar to Corollary 42 of the full version of [22] for implementing the threshold pseudoinverse.

E. Trace Estimation
In this subsection, we will provide a method of estimating the trace of an Hermitian matrix which is block-encoded in a density operator.Before that, we recall the quantum amplitude estimation [64].
Theorem II.14 (Quantum Amplitude Estimation, [64]): Suppose U is an (a + b)-qubit unitary operator such that where |ϕ 0 ⟩ and |ϕ 1 ⟩ are normalized (pure) quantum states and p ∈ [0, 1].There is a quantum algorithm that outputs p ∈ [0, 1] such that with probability ≥ 8 π 2 , using O(M ) queries to U and U † .If we know an upper bound B of p, then we can take Based on quantum amplitude estimation, we develop the trace estimation of subnormalized density operators as shown below, which will be useful to design quantum algorithms, see Section III and Section IV.
Lemma II.15 (Trace Estimation of Subnormalized Density Operators): Suppose U is an (n + a)-qubit unitary operator that prepares an n-qubit subnormalized density operator A, and B > 0 is a known constant that tr(A) ≤ B. For every ε > 0, there is a quantum algorithm that estimates tr(A) within additive error ε with O Then we have where |ψ j ⟩ is an orthogonal basis, and a1 ⟨0|⊥ a1 ⟩ n+a1+a2 = 0.Moreover, we have for some (pure) quantum states |ϕ 0 ⟩ and |ϕ 1 ⟩, where p = tr(A).
Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.
If we know an upper bound B of tr(A), then let M = 2π 2
Before stating our linear combination result of subnormalized density operators, we introduce a technique that embeds a density operator in a larger space.
Lemma II.16: Suppose U is an (n + a)-qubit unitary operator that prepares an n-qubit density operator ρ.For every b ≥ 0, there is an (n + a + b)-qubit unitary operator prepares an (n+b)-qubit density operator ρ (b) , and Now we are ready to show the technique to prepare a linear combination of subnormalized density operators.The basic idea is to prepare a linear combination of (normalized) density operators, but a careful qubit alignment is needed with the help of Lemma II.16.
2) U uses 1 query to each Let Therefore, U (V ⊗ I a ⊗ I b ) prepares a subnormalized density operator A.
As it will be also used to design quantum algorithms in this paper, we provide the LCU algorithm for comparison.Here, we use the notion as in the full version of [22].
Definition II.3 (State Preparation Pair): Let y ∈ C m with ∥y∥ 1 ≤ β, and ε ≥ 0. A pair of unitary operator (P L , P R ) is called a (β, b, ε)-state-preparation-pair if Theorem II.18 (Linear Combination of Unitary Operators [22]): Suppose Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.
1) y ∈ C m with ∥y∥ 1 ≤ β, and (P L , P R ) is a (β, b, ε 1 )state-preparation-pair for y. 2) For every k ∈ [m], U k is an (n + a)-qubit unitary operator that is an (α, a, ε 2 )-block-encoding of an nqubit operator A k .Then there is an

G. Eigenvalue Threshold Projector
In this subsection, we show how to block-encode an eigenvalue threshold projector Π supp(A) of a subnormalized density operator A in another.We note that a technique for blockencoding eigenvalue threshold projectors in subnormalized density operators was also provided in [32].The major difference is that our approach does not have any further requirements on the subnormalized density operator A, while the method of [32] requires that A ≥ qΠ for some projector Π and the value of q > 0 is known in advance.
First, we introduce the notion of truncated support.Let δ > 0 and A be an Hermitian operator with spectral decomposition Note that supp δ (A) ⊆ supp 0 (A) = supp(A).Here, we write Π S to denote the projector onto a subspace S.
Proof: Let f (x) = δ 1/2 2 x −1/2 , and by Lemma II.7, there is a degree-O 1 δ log 1 and O((n + a)d) elementary quantum gates.3) A description of U Q can be computed by a (classical) Turing machine in poly(d, log(1/δ Q )) time.By Lemma II.2, using 1 query to each of U Q and U , we obtain a unitary operator Ũ that prepares A 1 AA † 1 .We note that 1 can be regarded as a (scaled) projector.
To see this, let 1 S be the indicator function that We need to show that for every x ∈ [0, 1].This is seen by the following four cases.1) x = 0.This case is trivial as each hand side is equal to 0 is similar to Case 3. The left hand side is as follows.
Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.
In this section, we will propose a series of quantum algorithms for computing several quantum entropies.Section III-A provides a quantum algorithm for computing the von Neumann entropy.Section III-B is for the Max entropy.Section III-C is for the quantum Rényi and Tsallis entropies.

A. Von Neumann Entropy
The von Neumann entropy is one of the most important quantum information quantities.As mentioned above, both quantum algorithms for estimating von Neumann entropy provided by [6] and [8] have time complexity exponential in the number n = log 2 (N ) of qubits of the quantum state.Here, we provide a different approach that exponentially improves the dependence on n given that the density operator of the mixed quantum state is low-rank.Our key technique used here is different from that of [8], where they approximated a function ∝ − ln(x) and constructed a unitary operator that is a block-encoding of S(ρ), while we approximate a function ∝ − ln(x) and prepare a density operator that is a blockencoding of S(ρ).
Theorem III.1: Suppose that 1) U ρ is an (n + n ρ )-qubit unitary operator that prepares an n-qubit density operator ρ with rank(ρ) ≤ r. 2) n ρ is a polynomial in n. 10  There is a quantum algorithm that computes the von Neumann entropy S(ρ) within additive error ε using Õ( r ε 2 ) queries to U ρ and Õ( r ε 2 poly(n)) elementary quantum gates. 11Before the proof of Theorem III.1, we need the following method of approximating functions by polynomials based on Taylor series.
Lemma III.2 (Corollary 66 of the Full Version of [22]): Let x 0 ∈ [−1, 1], r ∈ (0, 2], δ ∈ (0, r] and f : [x 0 − r − δ, 10 Theoretically, any n-qubit mixed quantum state has a purification with at most n ancilla qubits, so it is sufficient to assume that nρ ≤ n.Here, we just assume that nρ = poly(n) for convenience. 11Since the quantum algorithm is complicated, we do not distinguish between the queries to a unitary operator and those to its controlled versions, and we ignore poly-logarithmic factors.
then there is an efficient computable polynomial By Lemma III.2, we are able to give an approximation of scaled − ln(x) as follows.
Lemma III.3:For every δ ′ , ε ∈ (0, 1  4 ], there is an efficient computable polynomial whose Taylor series we choose the definitions of ln(•) and (•) to be their principle branches in complex analysis.Thus the radius of convergence of the Taylor series of f (x) expanded around x 0 = 1 2 is R = 1 2 .We have lim sup Therefore, there exists k 0 ∈ N such that for every k > k 0 , it holds that k |a k | < 2 + δ ′ .Now we set r = 1 2 − δ ′ and δ = δ ′ /2, and we have Here, we note that Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.
Finally, since we are only interested in the real part of P (x) and x is always a real number, just selecting the real part of the coefficients of P (x) will obtain a desired polynomial with real coefficients.Now we are ready to give the proof of Theorem III.1.
By Lemma III.3, there is a polynomial Let δ 1 ∈ (0, 1) and by Lemma II.4,there is a quantum circuit Ũ such that 1) Ũ prepares an n-qubit subnormalized density operator A 1 , and 2) Ũ uses O(d) queries to U ρ and U † ρ , 1 query to controlled-U and controlled-U † ρ , and O((n + a)d) elementary quantum gates.

3) A description of Ũ can be computed by a (classical)
Turing machine in O(poly(d, log(1/δ 1 ))) time.Now we are going to show that We consider four cases.
Finally, we choose 16 ln 1 δ p to be the approximation of S(ρ).The error is bounded by Let the right hand side of Eq. ( 4) become ≤ ε, then the number of queries to U ρ is

B. Max Entropy and Rank of Quantum States
The Max (Hartley) entropy S max (ρ) = ln (rank(ρ)) of a quantum state ρ is the logarithm of its rank.Low-rank quantum states turn out to be useful in quantum algorithms, e.g.[11], [34], [37], [40], and [101].Estimating the rank of quantum Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.
states is important in checking whether a quantum state fits in a certain low-rank condition of a quantum algorithm.Recently, a variational quantum algorithm was proposed in [14] to estimate the rank of quantum states.Here, we provide a quantum algorithm for rank estimation.For δ > 0, the δ-rank of a matrix A is defined by In particular, rank 0 (A) = rank(A).We note that if A is Hermitian and has the spectrum decomposition A = j λ j |ψ j ⟩ ⟨ψ j |, then rank δ (A) = tr Π supp δ (A) is the number of eigenvalues λ j such that |λ j | > δ.
3) A description of Ũ can be computed by a (classical) Turing machine in poly(d, log(1/δ 1 )) time.
We note that tr(A) − tr( Π) ≤ 2 n δ 1 and by Eq. ( 5) we have Step 2: Introducing a parameter ε 2 , by Lemma II.15, we can compute p that estimates tr(A) queries to Ũ and Ũ † , where B is an upper bound for tr(A).Here, we just choose B = 1.
Step 3: Output r = 8δ −1 p as the estimation of the rank of ρ.Here, we see that By letting ε 1 = 1 32 δε < 1 (note that it also holds that 32ε 2  1 < 32ε 1 = δε < δ), ε 2 = 1 16 δε ′ , and To see this, we have to show the following three inequalities. 1) This is simple by directly taking the values of ε 2 and δ 1 .Finally, the number of queries to U is And similarly, the number of elementary quantum gates is O 1 δ 2 ε ′ log 1 δε poly(n) .Based on Theorem III.4,we can obtain the exact rank of ρ if Π/κ ≤ ρ for some projector Π and κ > 0.
Proof: The claim holds immediately by letting δ = ε = Theorem III.6 (Max Entropy Estimation): Suppose that 1) U is an (n + a)-qubit unitary operator that prepares an n-qubit density operator ρ. 2) δ ∈ (0, 1  10 ].For ε > 0, there is a quantum algorithm that outputs s such that Moreover, if Π/κ ≤ ρ for some projector Π and κ > 0, there is a quantum algorithm that computes the Max entropy S max (ρ) within additive error ε using Õ( κ 2 ε ) queries to U and Õ( κ 2 ε poly(n)) elementary quantum gates.Proof: By Theorem III.4,there is a quantum algorithm that outputs r such that ) queries to U and Õ( 1 δ 2 ε poly(n)) elementary quantum gates.After taking logarithm of both sides, we have Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.
which is We only need to output s = ln(r) as an estimation of the Max entropy S max (ρ).Moreover, if Π/κ ≤ ρ for some projector Π and κ > 0, the claim is obtained by letting δ = 1 κ (and then S max δ (ρ) = S max (ρ)).

C. Quantum Rényi Entropy and Quantum Tsallis Entropy
Now we are going to discuss how quantum algorithms can compute the quantum Rényi entropy S R α (ρ) and the quantum Tsallis entropy S T α (ρ).The key is to compute tr(ρ α ), which is given as follows.
Theorem III.7 (Trace of Positive Powers): Suppose that 1) U ρ is an (n + n ρ )-qubit unitary operator that prepares an n-qubit density operator ρ with rank(ρ) ≤ r. 2) n ρ is a polynomial in n.For a ∈ (0, 1) ∪ (1, +∞), there is a quantum algorithm that computes tr(ρ α ) within additive error ε using Q queries to U ρ and Q • poly(n) elementary quantum gates, where and {x} = x − ⌊x⌋ is the decimal part of real number x.
Proof: We will discuss in three cases as stated in the statement of this theorem.
3) The description of Ũ can be computed by a classical Turing machine in O(poly ), we have )).Therefore, By Lemma II.15 and introducing ε 2 , we can obtain x as an approximation of tr(A) with queries to Ũ such that |tr(A) − x| ≤ ε 2 .Then we output 4δ α−1 1 x as an approximation of tr(ρ α ) by noting that ) .

2
. By Lemma II.13 and introducing δ 1 and ε 1 , there is a unitary operator queries to U 1 .By Lemma II.12, there is a unitary operator ))block-encoding of ρ β+c with 1 query to U β and 1 query to U c .By Lemma II.2, there is a unitary operator U that prepares a subnormalized density operator A with 1 query to U ρ and 1 query to U β+c , and A is a (4, 0, Θ(ε By Lemma II.15 and introducing ε 2 , we can obtain x as an approximation of tr(A) with queries to U such that |x − tr(A)| ≤ ε 2 .Then we output 4x as an approximation of tr(ρ α ) by noting that ).The number of queries to U ρ is In the following, we are going to show how to estimate the quantum Rényi and Tsallis entropies based on Theorem III.7.
Theorem III.8 (Quantum Rényi Entropy): Suppose that 1) U ρ is an (n + n ρ )-qubit unitary operator that prepares an n-qubit density operator ρ with rank(ρ) ≤ r. 2) n ρ is a polynomial in n.For a ∈ (0, 1) ∪ (1, +∞), there is a quantum algorithm that computes S R α (ρ) within additive error ε using Q queries to U ρ and Q • poly(n) elementary quantum gates, where and {x} = x − ⌊x⌋ is the decimal part of real number x.
Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.
Proof: We will discuss in cases as stated in the statement of this theorem.
Case 2: α > 1.In this case, r 1−α ≤ tr(ρ α ) ≤ 1.By Theorem III.7, there is a quantum algorithm that outputs Subcase 2.2: α > 1 and α is not an odd number.The number of queries to U ρ is Theorem III.9 (Quantum Tsallis Entropy): Suppose that 1) U ρ is an (n + n ρ )-qubit unitary operator that prepares an n-qubit density operator ρ with rank(ρ) ≤ r. 2) n ρ is a polynomial in n.For a ∈ (0, 1) ∪ (1, +∞), there is a quantum algorithm that computes S T α (ρ) within additive error ε using Q queries to U ρ and Q • poly(n) elementary quantum gates, where and {x} = x − ⌊x⌋ is the decimal part of real number x. Proof: By Theorem III.7, there is a quantum algorithm that outputs Let ε ′ = Θ(|1 − α| ε).We will discuss in three cases as stated in the statement of this theorem.Case 1: .
Case 2: α > 1 and α is an odd number.The number of queries to U ρ is Case 3: α > 1 and α is not an odd number.The number of queries to U ρ is We note that when α > 1 is an odd number, the query complexities of our quantum algorithms for tr(ρ α ) and S T α (ρ) do not depend on r.This result can be applied to computing the classical Tsallis entropy of a distribution p : [N ] → [0, 1].Suppose a quantum oracle U is given as For convenience, we assume that N = 2 n .This kind of quantum oracle is called "classical distribution with pure state preparation access".We start from the quantum state |0⟩ n |0⟩ n , and the algorithm for estimating the classical Tsallis entropy of p is as follows.1) Apply U on the first part of the quantum state, then the state becomes 2) Apply a CNOT gate with control qubit the j-th qubit of the first part and target qubit the j-th qubit of the second part for each j ∈ [n], then the state becomes 3) Note that if the second part of the quantum state after step 2 is traced out, it becomes a mixed quantum state (density operator) Apply the algorithm of Theorem III.9, we are able to obtain an estimation of the quantum Tsallis entropy S T α (ρ) (i.e., the classical α-Tsallis entropy of p) within additive error ε with O(1/ε) queries to U and O(1/ε • poly(n)) elementary quantum gates.Corollary III.10:For odd integer α > 1, given the quantum oracle U to a probability distribution p : [N ] → [0, 1] as in Eq. ( 6), there is a quantum algorithm that computes the Tsallis entropy S T α (p) of p within additive error ε, using O(1/ε) queries to U and O(1/ε • poly(n)) elementary quantum gates.
For integer α ≥ 2, according to [58] (see also [41]), there is a simple SWAP test like quantum circuit that outputs 0 and 1 with probability (1 ± tr(ρ α ))/2, respectively, using α copies of ρ.With a straightforward statistical method, we can estimate tr(ρ α ) within additive error ε by O(1/ε 2 ) repetitions of that quantum circuit.Directly applying this method also implies a quantum algorithm, which computes the Tsallis entropy (both quantum and classical) within additive error ε, using O(1/ε 2 ) queries to quantum oracles.Compare to this simple algorithm, our quantum algorithm (of Theorem III.9 and Corollary III.10) yields a quadratic speedup for odd α > 1.

D. Lower Bounds
We establish lower bounds for estimating quantum entropies in the low-rank case, which are derived from known lower bounds for estimating entropies of classical distributions [59], [60].
Theorem III.11: Suppose U ρ is a quantum oracle that prepares the density operator ρ (see Definition II.2), and r = rank(ρ).For α ≥ 0, any quantum algorithm that computes S R α (ρ) within additive error ε = Θ(1) requires Ω(Q(r)) queries to U ρ , where Proof: We obtain lower bounds from those for classical distributions.The quantum query model for classical distributions we adopt is called the "classical distribution with quantum query access", which is defined as follows.Suppose It is pointed out in [8] that we can easily construct a "purified quantum query access" oracle by preparing a uniform superposition through the Hadamard gates, and then makes a query to U .Therefore, all lower bounds in the "classical distribution with quantum query access" model also hold in the "purified quantum query access" model.Let B(N ) be the lower bound for estimating the Rényi entropy.It is straightforward to see that if there is a quantum algorithm that computes the quantum Rényi entropy using Q(r) queries to U ρ , then with the same algorithm, we can compute the Rényi entropy of a probability distribution p : [N ] → [0, 1] using Q(N ) queries to the "classical distribution with quantum query access" oracle.Therefore, we have Q(r) ≥ B(r).Our claim immediately holds by taking the lower bounds of B(N ) given in [59] and [60].
IV. QUANTUM DISTANCES Distance measures of quantum states are quantum information quantities that indicate their closeness.Testing the closeness of quantum states is a basic problem in quantum property testing.Two of the most important distance measures of quantum states are the trace distance and fidelity.
In this section, we will provide quantum algorithms for computing them as well as their extensions.Section IV-A presents quantum algorithms for computing the trace distance and its extension.Section IV-B presents quantum algorithms for computing the fidelity and its extensions.

A. Trace Distance
The α-trace distance of two quantum states ρ and σ is defined by Here, T 1 (ρ, σ) = T (ρ, σ) is the trace distance.The trace distance of two pure quantum states (i.e., quantum states of rank 1) can be computed directly from their fidelity, which can be solved by the SWAP test [102].The closeness testing of the 1-, 2-, and 3-trace distances were studied in [8].
Our quantum algorithms for computing the α-trace distance are given as follows.
Especially, taking α = 1, we obtain a quantum algorithm for trace distance estimation using Õ(r 5 /ε 6 ) queries to U ρ and U σ .
The key observation of our quantum algorithm is that , where µ = (ρ + σ) /2, supp(µ) is the support of µ and Π S is the projector onto a subspace S. A straightforward idea is to first prepare a subnormalized density operator that is a block-encoding of Π supp(µ) , and then prepare another subnormalized density operator that is a block-encoding of |ν| α/2 Π supp(µ) |ν| α/2 by the evolution of subnormalized density operators (Lemma II.2),where ν = (ρ − σ)/2.However, we are only able to prepare subnormalized density operator that is a block-encoding of a projector onto a truncated support by Lemma II.19.In this way, we can prepare a subnormalized density operator |ν| α/2 Π supp δ (µ) |ν| α/2 for some δ > 0, When δ is fixed, the inherent error of this approach is Proposition IV.2: Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.
Note that Then for α ≥ 1, we have Before deriving bounds for 0 < α < 1, we need the following lemma.
Lemma IV.3: Suppose that A is an n-dimensional positive semidefinite operator, |ψ⟩ is an n-dimensional vector, and 0 < α < 1.Then where {|ψ j ⟩} is an orthonormal basis, and λ j ≥ 0 for all By Hölder's inequality, we have For 0 < α < 1, by Lemma IV.3, we have Therefore, Hence, we could obtain a reasonable error by setting δ small enough.
Introducing three parameters δ 1 , ε 1 , δ Q ∈ (0, 1  10 ], by Lemma II.19, there is a quantum circuit U 1 , which prepares a subnormalized density operator A 1 and A 1 is a (1, 0, δ Q )block-encoding of Π 1 , where Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.
Now we analyze the error if we replace Π supp(µ) by 4δ −1 1 Π 1 in the following.Proposition IV.4: where This leads to where for convenience.Therefore, By Proposition IV.2, we have .
Also we have Combining the both, we have .
In the following, we separately consider different cases of α.
Step 4: Output 4δ −1 1 p ≈ T α (ρ, σ) as the estimation.The additive error is In order to make 4δ −1 , and other parameters become small enough polynomials in r and 1/ε.Under these conditions, the number of queries to U ρ and U σ is and the number of elementary quantum gates is O(Q • poly(n)).Case 3 (0 < α < 1): Step 2: Introducing two parameters δ 2 , ε 2 ∈ (0, 1  4 ], by Lemma II.13, there is a quantum circuit . By Lemma II.2, using 1 query to each of W α/2 and U 1 , we obtain a quantum circuit Ũ , which prepares a subnormalized density operator A 2 A 1 A † 2 .We note that 2 ) .
Step 4: Output 4δ −1 1 p ≈ T α (ρ, σ) as the estimation.The additive error is Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.

+ tr |ν|
In order to make 4δ −1 and other parameters become small enough polynomials in r and 1/ε.Under these conditions, the number of queries to U ρ and U σ is and the number of elementary quantum gates is O(Q • poly(n)).

B. Fidelity
Quantum fidelity estimation is a problem to compute the fidelity of two mixed quantum states given their purifications.The well-known SWAP test [102] can solve this problem when one of the quantum states is pure.Recently, a polynomial-time quantum algorithm was proposed in [11] for the case that one of the quantum states is low-rank.However, their algorithm has very large exponents of r (rank) and ε (additive error) in the complexity.Here, we are able to improve the complexity with much smaller exponents, compared to the Õ(r 12.5 /ε 13.5 ) quantum algorithm for fidelity estimation proposed by [11].
Our quantum algorithms for computing the α-fidelity are given as follows.
We put the detailed proofs into the following subsubsections.In fact, such techniques used in estimating the relative sandwiched Rényi entropy can also be used to compute the relative Rényi entropy.
and the number of elementary quantum gates is

C. Lower Bounds and Hardness
Our quantum algorithms for both fidelity estimation and trace distance estimation requires time complexity polynomial in the rank r of quantum states.Here, we show that unless BQP = QSZK, there is no quantum algorithm for both fidelity estimation and trace distance estimation with time complexity polylogarithmic in r.
Theorem IV.7:If there is a quantum algorithm that computes fidelity or trace distance of quantum states of rank ≤ r within additive error ε with time complexity poly (log r, 1/ε), then BQP = QSZK.
If there is a quantum algorithm for computing trace distance with time complexity poly (log r, 1/ε), then we can distinguish the two cases with time complexity poly(n) by letting r = 2 n be the dimension of the two quantum states and ε = (β − α)/2 > 0.
Our quantum algorithms for estimating the fidelity and trace distance achieve a significant speedup under the low-rank assumption.One might wonder whether our algorithms can be "dequantized" through quantum-inspired low-rank techniques such as [105] and [106].We suspect that it might be unachievable because the following theorem shows that computing fidelity and trace distance are DQC1-hard.
Theorem IV.8: Computing the fidelity and trace distance are DQC1-hard, even for pure quantum states.
Proof: It was already proved in [12] that estimating the fidelity is DQC1-hard, even for pure quantum states.Here, we reduce the problem of estimating the fidelity to that of estimating the trace distance, and therefore show the DQC1hardness of estimating the trace distance.
It was shown in [63] that DQC1 is not (classically) weakly simulatable unless the polynomial hierarchy collapses to the second level, i.e., PH = AM.This, together with Theorem IV.8, means that there is unlikely an efficient classical algorithm that estimates the fidelity or trace distance.It should be noted that this does not rule out the existence of a dequantized version of our quantum algorithms because dequantized algorithms often assume a different input model from Theorem IV.8.More specifically, dequantized algorithms assume "sampling and query access" [105], [106] to the input matrix (in our case, the density operator of the quantum state) stored in a pre-computed data structure.
queries to U and U † , 1 query to controlled-U and controlled-U † , and O((n + a)d) elementary quantum gates.3) A description of Ũ can be computed by a (classical) Turing machine in O(poly(d, log(1/δ))) time.Proof: By Lemma II.1, there is a quantum circuit V that is a (1, O(n + a), 0)-block-encoding of A, which consists of 1 query to U and U † and O(n+a) elementary quantum gates.Then by Theorem II.3, there is a quantum circuit Ṽ , which is a (1, b, δ)-block-encoding of P (A), with d queries to V and V † , 1 query to controlled-V , and O((n + a)d) elementary quantum gates, where b = O(n + a).
unitary operator that prepares an (n+a k )-qubit density operator ρ k , and ρ k is a (1, a k , 0)-block-encoding of an n-qubit subnormalized density operator A k .Let a = max k∈[2 m ] {a k } and b = max k∈[2 m ] {b k }.Then there is an (m + n + a + b)-qubit unitary operator U such that 1) U (V ⊗ I n+a+b ) prepares an n-qubit subnormalized density operator

uses 1
unitary operator, where U (b) = U ⊗ I b is defined as in Lemma II.16.Here, U (a ′ k +b ′ k )k acts on n + a + b qubits.To be precise, if we split the n + a + b qubits into three parts: (i) n qubits, (ii) a qubits and (iii) b qubits, query to U k which acts on: (i) the whole n qubits, (ii) the first a k qubits and (iii) the first b k qubits.
uses 1 query to each of P † L , P R and (controlled-)U k for k ∈ [m], and O(b 2 ) elementary quantum gates.

) 2 )
Ũ uses O(d) queries to U and U † , 1 query to controlled-U and O((n + a)d) elementary quantum gates, where d = O 1 δ log 1 ε1

TABLE I OUR
QUANTUM ALGORITHMS VS.PRIOR WORKS *

TABLE II QUANTUM
QUERY COMPLEXITY FOR COMPUTING QUANTUM ENTROPIES * and the quantum Rényi entropy becomes the logarithm of the rank, i.e., the quantum Max (Hartley) entropy:

TABLE III QUANTUM
QUERY COMPLEXITY FOR COMPUTING α-TRACE DISTANCE *

TABLE IV QUANTUM
QUERY COMPLEXITY FOR COMPUTING α-FIDELITY * and B is a (1, 0, δ U )-block-encoding of P (A).2) Ũ uses d P queries to U and U † , 1 query to controlled-U and O((a + 1)d P ) elementary quantum gates.3) A description of Ũ can be computed by a (classical) Turing machine in poly(d P , log(1/δ U )) time.Let R ∈ R[x] be the even degree-d R polynomial in Corollary II.10,where d and by Theorem II.14, we can computes p such that