Lecture 9
The Query Model: Deutsch–Jozsa and Bernstein–Vazirani

Week 5 | Block II begins: the first problems a quantum computer solves with fewer questions | reading: Watrous §5.1–5.3; de Wolf Ch. 2

one quantum query can carry a superposition of every question; interference decides what you learn

In this lecture

The query model
The Hadamard transform
Deutsch's algorithm
The Deutsch–Jozsa algorithm
The Bernstein–Vazirani algorithm
Try it in code
Summary and exercises

Block I built the machinery. Block II asks what it is good for. The cleanest place to compare quantum and classical computers is the query model, where a function is hidden in a black box and we count how many times we must consult it. By the end you should be able to state the query model and its limits, use the formula for the Hadamard transform on $n$ qubits, analyse Deutsch's, the Deutsch–Jozsa and the Bernstein–Vazirani algorithms, and say honestly how large their advantage over classical algorithms is.

1 — The query model

definition 9.1 — query problems and query complexity

In a query problem an algorithm must compute some property of a function $f:\{0,1\}^n\to\{0,1\}^m$ that it can access only through an oracle. A classical query asks for $f(x)$ at one input $x$. A quantum query applies the standard oracle of Lecture 7,

$$U_f\,|x\rangle|y\rangle=|x\rangle|y\oplus f(x)\rangle ,$$

to any state, superpositions included. The query complexity of the problem is the number of queries needed in the worst case over all allowed $f$; all other gates are free.

Recall from Lecture 7 (Proposition 7.3) that for one-bit outputs a query with the output qubit in $|-\rangle$ acts as a phase oracle:

$$U_f\,|x\rangle|-\rangle=(-1)^{f(x)}\,|x\rangle|-\rangle .$$

So one query writes the whole truth table of $f$ into the signs of a superposition. Every algorithm in this lecture is built on that sentence.

Let $n=2$ and let $f(x_1x_0)=1$ only for $x=10$. The input register starts in the uniform superposition $\tfrac12\sum_x|x\rangle$ and the output qubit in $|-\rangle$. After one query, the amplitude of $|10\rangle$ is .

With the output in $|-\rangle$, the query multiplies the amplitude of $|x\rangle$ by $(-1)^{f(x)}$ and changes nothing else.

$f(10)=1$, so $\tfrac12$ becomes $-\tfrac12$; the other three amplitudes stay $\tfrac12$. The truth table is now written in the signs.

idea — why count queries, and why be careful

Counting queries is the main setting in which we can prove large separations between quantum and classical computation; in the ordinary circuit model nobody can yet prove that factoring, say, is classically hard. The price is realism. A real $f$ is not a sealed box: it is a circuit you can read, and a classical algorithm may exploit that structure. So a query speedup shows what quantum interference can do, but it becomes a real-world speedup only if $f$ genuinely behaves like a black box (as a cipher is designed to), and only after counting the gates that implement each query (Lecture 7).

2 — The Hadamard transform

Every algorithm here starts and ends with $H$ applied to each of $n$ qubits. We need a formula for $H^{\otimes n}=H\otimes\cdots\otimes H$. For bit strings $x,y\in\{0,1\}^n$ write

$$x\cdot y=x_{n-1}y_{n-1}\oplus\cdots\oplus x_1y_1\oplus x_0y_0 ,$$

the dot product mod 2. It is 1 exactly when $x$ and $y$ share an odd number of 1s.

Compute $x\cdot y$ for $x=1011$ and $y=1101$.

Multiply bit by bit (AND), then add the results mod 2. Only the parity of the number of shared 1s matters.

The strings share 1s in two positions (the first and the last), and $1\oplus1=0$, so $x\cdot y=0$.

proposition 9.1 — the Hadamard transform

For every $x\in\{0,1\}^n$,

$$H^{\otimes n}|x\rangle=\frac{1}{2^{n/2}}\sum_{y\in\{0,1\}^n}(-1)^{x\cdot y}\,|y\rangle .$$

In particular $H^{\otimes n}|0^n\rangle$ is the uniform superposition of all $2^n$ strings, and $H^{\otimes n}$ is its own inverse.

Proof. HW5. For $n=1$ the formula says $H|x\rangle=\tfrac{1}{\sqrt2}(|0\rangle+(-1)^x|1\rangle)$, which is the definition of $H$; Example 9.1 checks a case with $n=2$.

Use Proposition 9.1 to find the amplitude of $|110\rangle$ in $H^{\otimes3}|011\rangle$.

Every amplitude has size $2^{-3/2}=\tfrac1{2\sqrt2}$; only the sign $(-1)^{x\cdot y}$ with $x=011$, $y=110$ needs work.

$011\cdot110=0\oplus1\oplus0=1$, so the amplitude is $-\tfrac1{2\sqrt2}\approx-0.354$.

The sign pattern $(-1)^{x\cdot y}$ of $H^{\otimes 2}$ and $H^{\otimes3}$: column $x$ is the input, row $y$ the output. Every row except the first has as many $+$ as $-$, and any two rows agree in exactly half their entries, which is why the rows (scaled) are orthonormal.

example 9.1 — two ways to compute H⊗H|01⟩

Compute $(H\otimes H)|01\rangle$ directly and from Proposition 9.1.

3 — Deutsch's algorithm

The smallest interesting query problem has $n=1$. There are four functions $f:\{0,1\}\to\{0,1\}$: two constant ($f=0$, $f=1$) and two balanced, taking each value once ($f(x)=x$, $f(x)=1-x$). Deutsch's problem: decide whether $f$ is constant or balanced, i.e. compute $f(0)\oplus f(1)$.

Classically one query is useless: $f(0)$ alone is consistent with both a constant and a balanced $f$. Two queries are necessary and sufficient.

theorem 9.2 — Deutsch's algorithm (1985; this form Cleve et al. 1998)

Prepare $|0\rangle|1\rangle$ (input, output), apply $H$ to both, make one query, apply $H$ to the input and measure it. The result is $f(0)\oplus f(1)$ with certainty.

After the Hadamards the input is $|+\rangle$ and the output is $|-\rangle$. By the phase-oracle identity, the query turns the input into

$$\frac{1}{\sqrt2}\Big((-1)^{f(0)}|0\rangle+(-1)^{f(1)}|1\rangle\Big)=(-1)^{f(0)}\,\frac{1}{\sqrt2}\Big(|0\rangle+(-1)^{f(0)\oplus f(1)}|1\rangle\Big).$$

Up to the global sign this is $|+\rangle$ when $f(0)\oplus f(1)=0$ and $|-\rangle$ when it is 1. The final $H$ maps these to $|0\rangle$ and $|1\rangle$.

$f$	input after the query (up to sign)	measured	verdict
$f=0$	$\|+\rangle$	0	constant
$f=1$	$-\|+\rangle$	0	constant
$f(x)=x$	$\|-\rangle$	1	balanced
$f(x)=1-x$	$-\|-\rangle$	1	balanced

The quantum algorithm never learns $f(0)$ or $f(1)$: measuring gives one bit, and it spends that bit on the global property $f(0)\oplus f(1)$. This is the pattern for everything that follows: a quantum algorithm wins by computing a joint property of many values without computing any of them.

Deutsch's algorithm is run once on an unknown $f:\{0,1\}\to\{0,1\}$ and outputs 1. Tick every statement that is now certain.

$f(0)\oplus f(1)=1$
$f$ is balanced
$f(x)=x$$f(x)=1-x$ also gives output 1. The algorithm cannot tell the two balanced functions apart.
$f(0)=0$The algorithm spends its one bit on $f(0)\oplus f(1)$ and learns neither value on its own.

The output is exactly $f(0)\oplus f(1)$, nothing more. Which statements follow from that one bit alone?

Output 1 means $f(0)\ne f(1)$, i.e. $f$ is balanced. Both balanced functions are still possible, so the individual values stay unknown.

4 — The Deutsch–Jozsa algorithm

definition 9.2 — the Deutsch–Jozsa problem

Given $f:\{0,1\}^n\to\{0,1\}$ that is promised to be either constant or balanced (equal to 1 on exactly half of the $2^n$ inputs), decide which.

proposition 9.3 — deterministic classical cost

A deterministic classical algorithm needs $2^{n-1}+1$ queries in the worst case.

Enough. Among any $2^{n-1}+1$ inputs a balanced function takes both values, so if all answers agree, $f$ is constant. Necessary. Answer the first $2^{n-1}$ queries of any algorithm with 0. Both the constant function 0 and a balanced function that is 0 on some set of $2^{n-1}$ inputs containing all the queried ones (and 1 elsewhere) are consistent with those answers, so an algorithm that stops now is wrong for one of them.

For $n=5$, how many queries does a deterministic classical algorithm need in the worst case to solve the Deutsch–Jozsa problem?

There are $2^5=32$ inputs and a balanced function is 0 on exactly half of them. How many equal answers can a balanced $f$ still give, and how many queries does it take to rule that out?

$2^4+1=17$. Sixteen equal answers are still consistent with a balanced $f$; the seventeenth settles it.

The Deutsch–Jozsa circuit. The target starts in $|1\rangle$ so that $H$ puts it in $|-\rangle$, turning the query into a phase oracle. Bernstein–Vazirani (Section 5) uses the same circuit with a different oracle.

theorem 9.4 — Deutsch–Jozsa (1992)

Run the circuit above. The probability that the measured string is $0^n$ is

$$P(0^n)=\Big|\frac{1}{2^n}\sum_{x\in\{0,1\}^n}(-1)^{f(x)}\Big|^2 ,$$

which is 1 if $f$ is constant and 0 if $f$ is balanced. So one query decides the problem with certainty: output "constant" exactly when the result is $0^n$.

After the first layer of Hadamards and the query, the input register is in the phase state

$$|\varphi_f\rangle=\frac{1}{2^{n/2}}\sum_x(-1)^{f(x)}|x\rangle .$$

We only need the amplitude of $|0^n\rangle$ after the last $H^{\otimes n}$. By Proposition 9.1 with $y=0^n$, every $|x\rangle$ contributes $2^{-n/2}$ to that amplitude (the first row of the sign grid is all $+$). So the amplitude is $2^{-n/2}\cdot2^{-n/2}\sum_x(-1)^{f(x)}$, which gives the formula. If $f$ is constant the sum is $\pm2^n$ and the probability is 1. If $f$ is balanced the sum has $2^{n-1}$ terms $+1$ and $2^{n-1}$ terms $-1$, so it is 0.

Suppose $n=3$ and $f$ is 1 on exactly one of the eight inputs, so it breaks the promise. Use the formula of Theorem 9.4 to find $P(000)$.

$\sum_x(-1)^{f(x)}$ has seven terms $+1$ and one term $-1$. Divide by $2^n=8$ and square.

The sum is $7-1=6$, so $P(000)=(6/8)^2=\tfrac9{16}$. A function close to constant gives $0^n$ most of the time; the formula interpolates between 1 and 0.

example 9.2 — Deutsch–Jozsa on majority

Let $n=3$ and $f=\mathrm{MAJ}$, the majority of three bits. Check that $f$ is balanced and find the full output distribution of the algorithm.

$\mathrm{MAJ}(x)=1$ for the four inputs with at least two 1s, $011,101,110,111$, and 0 for the other four, so it is balanced and $P(000)=0$. For the rest, the amplitude of $|y\rangle$ is, by Proposition 9.1 applied to each term,

$$a_y=\frac18\sum_x(-1)^{\mathrm{MAJ}(x)\oplus x\cdot y}.$$

For $y=001$ we have $(-1)^{x\cdot y}=(-1)^{x_0}$. The eight products $(-1)^{\mathrm{MAJ}(x)}(-1)^{x_0}$, for $x=000,\dots,111$ in order, are

$$+1,\;-1,\;+1,\;+1,\;+1,\;+1,\;-1,\;+1 ,$$

whose sum is 4, so $a_{001}=\tfrac12$. By the symmetry of MAJ in its three bits, $a_{010}=a_{100}=\tfrac12$ as well. Those three already use up probability $\tfrac34$. The same computation for $y=111$, where $(-1)^{x\cdot y}$ is the parity sign, gives $a_{111}=-\tfrac12$, the last $\tfrac14$. So the output is $001,010,100$ or $111$, each with probability $\tfrac14$, and never $000$. The Qiskit run in Section 6 shows exactly these four strings.

example 9.3 — breaking the promise

Run the algorithm with $n=2$ on $f=\mathrm{AND}$, which is neither constant nor balanced. What happens?

$\sum_x(-1)^{f(x)}=1+1+1-1=2$, so $P(00)=\big|\tfrac{2}{4}\big|^2=\tfrac14$. The algorithm answers "constant" a quarter of the time and "balanced" the rest. That is not a flaw: the promise is part of the problem, and the guarantee of Theorem 9.4 only covers functions that satisfy it. In general $P(0^n)$ measures how far $f$ is from balanced.

idea — an honest comparison

One quantum query against $2^{n-1}+1$ classical queries looks like an exponential speedup, but only against deterministic algorithms. A randomised classical algorithm can query $k+1$ uniformly random inputs and answer "constant" if all answers agree. It is never wrong on a constant $f$, and on a balanced $f$ all answers agree with probability $2\cdot2^{-(k+1)}=2^{-k}$. Eleven queries give an error below $0.1\%$, whatever $n$ is. So Deutsch–Jozsa separates quantum from deterministic computation, not from randomised computation. Simon's algorithm (Lecture 10) is the first to beat randomised algorithms exponentially.

The randomised classical algorithm above makes 8 independent uniformly random queries and answers "constant" if all 8 answers agree. If $f$ is balanced, what is the probability that it answers wrongly?

A balanced $f$ fools the algorithm only if all 8 answers agree. Each random query gives 0 or 1 with probability $\tfrac12$; there are two ways to agree.

$k+1=8$, so the error is $2\cdot2^{-8}=2^{-7}=\tfrac1{128}\approx0.8\%$, independent of $n$.

5 — The Bernstein–Vazirani algorithm

definition 9.3 — the Bernstein–Vazirani problem

Given $f:\{0,1\}^n\to\{0,1\}$ promised to have the form $f(x)=s\cdot x$ for some secret string $s\in\{0,1\}^n$, find $s$.

Here the answer is $n$ bits, not one. The quantum algorithm is the Deutsch–Jozsa circuit, unchanged; only the interpretation of the output differs. An oracle for $f(x)=s\cdot x$ is easy to build from Lecture 7: one CNOT from each input qubit $k$ with $s_k=1$ into the target.

A Bernstein–Vazirani oracle on input qubits $q_0,q_1,q_2$ with target $q_3$ consists of cx(0, 3) and cx(1, 3). Written as a Qiskit bit string $s_2s_1s_0$, the secret is .

$s_k=1$ exactly for the controls $k$. Then write the string with $s_0$ on the right.

$s_0=s_1=1$ and $s_2=0$, so $s=$011, and the algorithm's output will print as 011 too.

The oracle for $s=101$. Because Qiskit numbers qubits from the right of a bit string, $s_0$ is the last character of "101" and controls the CNOT from $q_0$.

example 9.4 — recovering s = 101

Run the Deutsch–Jozsa circuit with the oracle in the figure. Show that the output is $101$ with certainty.

After the query the input register holds $\tfrac{1}{2\sqrt2}\sum_x(-1)^{x_2\oplus x_0}|x\rangle$. Its sign pattern, over $x=000,\dots,111$, is

$$+,\;-,\;+,\;-,\;-,\;+,\;-,\;+ ,$$

By Proposition 9.1, the amplitude of $|101\rangle$ after $H^{\otimes3}$ is $\tfrac18\sum_x(-1)^{x_2\oplus x_0}(-1)^{x\cdot101}$. Since $x\cdot101=x_2\oplus x_0$, each of the eight terms is $(+1)$, and the amplitude is $\tfrac18\cdot8=1$. The output state has length 1, so every other amplitude is 0, and the output is $101$ with certainty. (You can also spot the answer in the figure: the sign pattern above is row $101$ of the $n=3$ grid.)

theorem 9.5 — Bernstein–Vazirani (1993)

For $f(x)=s\cdot x$, the Deutsch–Jozsa circuit outputs $s$ with certainty, using one query.

Proof. HW5, which also asks how many queries a classical algorithm needs.

Query lab: one quantum query, n = 3

Choose a function $f:\{0,1\}^3\to\{0,1\}$ from the presets, or toggle any of its eight values by clicking the top bars. Top: the phases $(-1)^{f(x)}$ written into the register by one query. Bottom: the output distribution after $H^{\otimes3}$. The readout says whether $f$ is constant, balanced or neither, whether it has the form $s\cdot x$ (possibly plus 1), and how many classical queries a deterministic algorithm that asks $x=000,001,\dots$ in order would use to settle the Deutsch–Jozsa question.

crypto connection — quantum queries to a keyed function

Bernstein–Vazirani extracts a hidden linear structure from a single superposition query. Simon's algorithm (Lecture 10) does the same for a hidden XOR-period, and that has been turned into attacks on real symmetric constructions. Kuwakado and Morii (2010, 2012) broke the 3-round Feistel construction (as a pseudorandom permutation) and the Even–Mansour cipher, and Kaplan, Leurent, Leverrier and Naya-Plasencia (CRYPTO 2016) broke CBC-MAC and several authenticated-encryption modes, all in polynomial time. The catch is the model: the attacker must be able to query the keyed primitive in superposition, which a remote server encrypting classical messages does not allow. Whether such "quantum superposition queries" are ever realistic is debated, and the area is a good source of course projects.

6 — Try it in code

tool — Deutsch–Jozsa on majority (tested with qiskit 2.5)

from qiskit import QuantumCircuit
from qiskit.primitives import StatevectorSampler

n = 3
qc = QuantumCircuit(n + 1, n)                 # inputs q0..q2, target q3
qc.x(n); qc.h(n)                              # target in |->
qc.h(range(n))
qc.ccx(0, 1, n); qc.ccx(0, 2, n); qc.ccx(1, 2, n)   # U_f for MAJ = x0x1 xor x0x2 xor x1x2
qc.h(range(n))
qc.measure(range(n), range(n))

counts = StatevectorSampler(seed=5).run([qc], shots=2000).result()[0].data.c.get_counts()
print(dict(sorted(counts.items())))

{'001': 514, '010': 520, '100': 483, '111': 483}

Majority is $x_0x_1\oplus x_0x_2\oplus x_1x_2$ (check the eight inputs), so its oracle is three Toffolis XORing into the target, as in Lecture 7. The counts match Example 9.2: four outcomes near $\tfrac14$ each, and never 000, so the function is balanced. With QuantumCircuit(n + 1, n) the classical register is named c.

tool — Bernstein–Vazirani with s = "1011"

from qiskit import QuantumCircuit
from qiskit.primitives import StatevectorSampler

s = "1011"                                    # the secret, written s3 s2 s1 s0
n = len(s)
qc = QuantumCircuit(n + 1, n)
qc.x(n); qc.h(n)                              # target qubit n in |->
qc.h(range(n))
for k in range(n):
    if s[n - 1 - k] == "1":                   # s_k is the k-th character from the RIGHT
        qc.cx(k, n)                           # oracle for f(x) = s.x
qc.h(range(n))
qc.measure(range(n), range(n))                # qubit k -> classical bit k

counts = StatevectorSampler(seed=5).run([qc], shots=100).result()[0].data.c.get_counts()
print(counts)

{'1011': 100}

All 100 shots return the secret. The ordering works out because both the secret string and Qiskit's printed outcome put bit $k$ at position $k$ from the right. Index the string from the left by mistake (s[k]) and you recover the reversed secret 1101, a bug that is easy to miss when $s$ is a palindrome.

7 — Summary and exercises

summary

In the query model only calls to the oracle are counted. With the output qubit in $|-\rangle$, one quantum query writes $(-1)^{f(x)}$ into the amplitude of every $|x\rangle$ at once.
$H^{\otimes n}|x\rangle=2^{-n/2}\sum_y(-1)^{x\cdot y}|y\rangle$; $H^{\otimes n}$ is its own inverse and turns $|0^n\rangle$ into the uniform superposition.
Deutsch: one query computes $f(0)\oplus f(1)$, which needs two classical queries.
Deutsch–Jozsa: $P(0^n)=|2^{-n}\sum_x(-1)^{f(x)}|^2$ is 1 for constant and 0 for balanced $f$. One query against $2^{n-1}+1$ deterministic queries, but only a constant number of randomised ones for small error.
Bernstein–Vazirani: the same circuit returns the secret $s$ of $f(x)=s\cdot x$ in one query. Mind Qiskit's right-to-left bit order when building the oracle.

Next time: Simon's algorithm, the first exponential separation from randomised classical algorithms, and the complexity classes P, BPP, BQP and NP. HW5 covers Lectures 9 and 10.

exercises 9

Use Proposition 9.1 to write $H^{\otimes3}|110\rangle$ as a sum of the eight basis states. Check it against the $n=3$ sign grid.
Show that for the constant function $f=1$ the Deutsch–Jozsa circuit ends in the state $-|0^n\rangle$ on the input register. Why is the sign harmless?
Let $f(x)=x_2\oplus x_0\oplus1$ on three bits. Is it constant, balanced or neither? What does the Deutsch–Jozsa circuit output, and what does that tell you about using Bernstein–Vazirani when $f(x)=s\cdot x\oplus c$?
Run Deutsch–Jozsa with $n=2$ on $f=\mathrm{OR}$. What is $P(00)$?
A randomised classical algorithm for Deutsch–Jozsa with $n=3$ queries three distinct inputs chosen uniformly at random and answers "constant" if all three values agree. What is its error probability on a balanced $f$? Compare with $2^{-2}$ for three independent queries.
Suppose you forget both the $X$ and the $H$ on the target, so it enters the query in $|0\rangle$ instead of $|-\rangle$. Show that for a balanced $f$ the input register then reads $0^n$ with probability $\tfrac12$, so the algorithm no longer works. Relate this to the garbage of Lecture 7.

With $x=110$, $x\cdot y=y_2\oplus y_1$, so $$\begin{aligned}H^{\otimes3}|110\rangle=\frac{1}{2\sqrt2}\big(&|000\rangle+|001\rangle-|010\rangle-|011\rangle\\[4pt] &-|100\rangle-|101\rangle+|110\rangle+|111\rangle\big),\end{aligned}$$ which is row (equivalently column) $110$ of the grid: $+,+,-,-,-,-,+,+$.
The phase state is $-2^{-n/2}\sum_x|x\rangle=-H^{\otimes n}|0^n\rangle$, and $H^{\otimes n}$ is its own inverse, so the output is $-|0^n\rangle$. A global sign changes no probabilities (Lecture 3), so the measurement still gives $0^n$ with certainty.
$x_2\oplus x_0$ is 1 on half the inputs, and adding 1 swaps the halves, so $f$ is balanced. The phase state is $-1$ times the phase state for $s=101$, so the output is $-|101\rangle$: the measurement gives $101$ with certainty. An added constant $c$ only contributes the global sign $(-1)^c$, so Bernstein–Vazirani recovers $s$ and is blind to $c$; one classical query $f(0^n)=c$ supplies the missing bit.
OR is 0 only at $00$, so $\sum_x(-1)^{f(x)}=1-3=-2$ and $P(00)=\big|{-\tfrac24}\big|^2=\tfrac14$.
A balanced $f$ on 3 bits has four 0s and four 1s. Three distinct inputs all land in the same half with probability $2\binom43\big/\binom83=\tfrac{8}{56}=\tfrac17\approx0.143$, smaller than $\tfrac14$ because sampling without replacement cannot hit the same input twice.
With the target in $|0\rangle$, the query produces $2^{-n/2}\sum_x|x\rangle|f(x)\rangle$: the function value is written into the target as a bit, not into a phase, and the target is now entangled with the input. Applying $H^{\otimes n}$ to the input, the amplitude of $|0^n\rangle|b\rangle$ is $2^{-n}$ times the number of $x$ with $f(x)=b$, which is $2^{n-1}$ for each $b$ when $f$ is balanced. So $P(0^n)=2\cdot\big(\tfrac12\big)^2=\tfrac12$, and a constant $f$ still gives $0^n$ with certainty: the two cases are no longer perfectly distinguishable. The target qubit carries a record of $f(x)$, exactly like the garbage qubit of Lecture 7, Example 7.3, and that record kills the interference. In $|-\rangle$ the target is an eigenvector of every possible query, so it never becomes entangled with the input.

Reading and sources

J. Watrous, Understanding Quantum Information and Computation, §5.1–5.3 (the query model, Deutsch's algorithm, and the Deutsch–Jozsa algorithm together with the Bernstein–Vazirani problem) (arXiv:2507.11536; IBM course Fundamentals of Quantum Algorithms, Lesson 1).
R. de Wolf, Quantum Computing: Lecture Notes, Ch. 2 (arXiv:1907.09415).
D. Deutsch, Proc. R. Soc. A 400 (1985); D. Deutsch and R. Jozsa, Proc. R. Soc. A 439 (1992); R. Cleve, A. Ekert, C. Macchiavello and M. Mosca, "Quantum algorithms revisited", Proc. R. Soc. A 454 (1998); E. Bernstein and U. Vazirani, "Quantum complexity theory", STOC 1993 (SIAM J. Comput. 26, 1997).
H. Kuwakado and M. Morii, ISIT 2010 and ISITA 2012; M. Kaplan, G. Leurent, A. Leverrier and M. Naya-Plasencia, "Breaking symmetric cryptosystems using quantum period finding", CRYPTO 2016.

all numbers and figures in these notes are computed in python (verify_L09.py) and follow the page theme

\(f\)	input after the query (up to sign)	measured	verdict
\(f=0\)	\(\|+\rangle\)	0	constant
\(f=1\)	\(-\|+\rangle\)	0	constant
\(f(x)=x\)	\(\|-\rangle\)	1	balanced
\(f(x)=1-x\)	\(-\|-\rangle\)	1	balanced

Lecture 9The Query Model: Deutsch–Jozsa and Bernstein–Vazirani

1 — The query model

2 — The Hadamard transform

3 — Deutsch's algorithm

4 — The Deutsch–Jozsa algorithm

5 — The Bernstein–Vazirani algorithm

Query lab: one quantum query, n = 3

6 — Try it in code

7 — Summary and exercises

Reading and sources

Lecture 9
The Query Model: Deutsch–Jozsa and Bernstein–Vazirani