Hidden subgroup problem

Given a group ${\displaystyle G}$, a subgroup ${\displaystyle H\leq G}$, and a set ${\displaystyle X}$, we say a function ${\displaystyle f:G\to X}$ hides the subgroup ${\displaystyle H}$ if for all ${\displaystyle g_{1},g_{2}\in G,f(g_{1})=f(g_{2})}$ if and only if ${\displaystyle g_{1}H=g_{2}H}$. Equivalently, ${\displaystyle f}$ is constant on the cosets of H, while it is different between the different cosets of H.

Hidden subgroup problem: Let ${\displaystyle G}$ be a group, ${\displaystyle X}$ a finite set, and ${\displaystyle f:G\to X}$ a function that hides a subgroup ${\displaystyle H\leq G}$. The function ${\displaystyle f}$ is given via an oracle, which uses ${\displaystyle O(\log |G|+\log |X|)}$ bits. Using information gained from evaluations of ${\displaystyle f}$ via its oracle, determine a generating set for ${\displaystyle H}$.

A special case is when ${\displaystyle X}$ is a group and ${\displaystyle f}$ is a group homomorphism in which case ${\displaystyle H}$ corresponds to the kernel of ${\displaystyle f}$.

The hidden subgroup problem is especially important in the theory of quantum computing for the following reasons.

• Shor's quantum algorithm for factoring and discrete logarithm (as well as several of its extensions) relies on the ability of quantum computers to solve the HSP for finite Abelian groups.
• The existence of efficient quantum algorithms for HSPs for certain non-Abelian groups would imply efficient quantum algorithms for two major problems: the graph isomorphism problem and certain shortest vector problems (SVPs) in lattices. More precisely, an efficient quantum algorithm for the HSP for the symmetric group would give a quantum algorithm for the graph isomorphism.[1] An efficient quantum algorithm for the HSP for the dihedral group would give a quantum algorithm for the ${\displaystyle \operatorname {poly} (n)}$ unique SVP.[2]

There is an efficient quantum algorithm for solving HSP over finite Abelian groups in time polynomial in ${\displaystyle \log |G|}$. Shor's algorithm applies a particular case of this quantum algorithm.

For arbitrary groups, it is known that the hidden subgroup problem is solvable using a polynomial number of evaluations of the oracle.[3] However, the circuits that implement this may be exponential in ${\displaystyle \log |G|}$, making the algorithm overall not efficient; efficient algorithms must be polynomial in the number of oracle evaluations and running time. The existence of such an algorithm for arbitrary groups is open. Quantum polynomial time algorithms exist for certain subclasses of groups, such as semi-direct products of some Abelian groups.

To solve the problem for finite Abelian groups, the 'standard' approach to this problem involves: the creation of the quantum state ${\displaystyle {\frac {1}{\sqrt {|G|}}}\sum _{x\in G}{|x\rangle \otimes |f(x)\rangle }}$, a subsequent quantum Fourier transform to the left register, after which this register gets sampled. This approach has been shown to be insufficient for the hidden subgroup problem for the symmetric group.[4][5]

• Dual group (Quantum Computing)
• Hidden shift problem

• Richard Jozsa: Quantum factoring, discrete logarithms and the hidden subgroup problem
• Chris Lomont: The Hidden Subgroup Problem - Review and Open Problems
• Hidden subgroup problem on arxiv.org