Lecture 11
Grover's Search Algorithm

Week 6 | a square-root speedup for any search, built from two reflections | reading: Watrous Ch. 8; de Wolf Ch. 7

Grover's algorithm alternates two reflections; each pair rotates the state a small, fixed angle toward the answer

In this lecture

Unstructured search
Two reflections: the oracle and the diffuser
The geometry: a rotation in a plane
How many iterations?
Building it from gates
Try it in code
Summary and exercises

Simon's algorithm needed a hidden structure. Grover's algorithm (1996) needs none: given a black box that recognises a solution, it finds one with about $\sqrt N$ queries instead of the $N$ a classical search needs. The speedup is only quadratic, but it applies to almost anything, and that is why it matters for cryptography. By the end you should be able to define the oracle and the diffusion operator, explain "inversion about the mean", prove that each Grover iteration is a rotation by $2\theta$ with $\sin\theta=1/\sqrt N$, choose the number of iterations, and build the whole circuit from standard gates.

1 — Unstructured search

definition 11.1 — the search problem

Let $N=2^n$. Given oracle access to $f:\{0,1\}^n\to\{0,1\}$ with exactly one marked input $w$, meaning $f(w)=1$ and $f(x)=0$ for $x\neq w$, find $w$.

"Unstructured" means there is nothing to exploit except the oracle: no ordering, no pattern. Classically each query rules out one candidate. Querying in a random order finds $w$ after $(N+1)/2$ queries on average, and $q$ queries succeed with probability $q/N$, so any classical algorithm needs on the order of $N$ queries. The marked input could be the key that decrypts a ciphertext, a preimage of a hash value, or a satisfying assignment of a formula.

Grover's algorithm uses the phase oracle of Lecture 7,

$$Z_f\,|x\rangle=(-1)^{f(x)}|x\rangle ,\qquad\text{i.e.}\qquad Z_f=I-2|w\rangle\langle w| ,$$

which is one query to $U_f$ with the output qubit in $|-\rangle$. It flips the sign of the marked amplitude and leaves the rest alone. A sign flip on its own changes no probability; the second ingredient turns sign information into amplitude.

Start in the uniform superposition $|s\rangle$ on $N$ items and apply the oracle $Z_f$ once, with nothing else. The probability of measuring $w$ is now .

The Born rule uses $|a_w|^2$. What does a sign flip do to the size of an amplitude?

The marked amplitude changes from $\tfrac1{\sqrt N}$ to $-\tfrac1{\sqrt N}$, and $|{\pm}\tfrac1{\sqrt N}|^2=\tfrac1N$. The oracle hides its answer in a phase, which the next step must turn into probability.

2 — Two reflections: the oracle and the diffuser

Let $|s\rangle=H^{\otimes n}|0^n\rangle=\tfrac{1}{\sqrt N}\sum_x|x\rangle$ be the uniform superposition.

definition 11.2 — diffusion operator, Grover iteration

The diffusion operator is $D=2|s\rangle\langle s|-I$. One Grover iteration is $G=D\,Z_f$: query the oracle, then diffuse. Grover's algorithm prepares $|s\rangle$, applies $G$ some number $k$ of times, and measures.

proposition 11.1 — diffusion is inversion about the mean

$D$ is Hermitian and $D^2=I$, so it is unitary. It fixes $|s\rangle$ and negates every vector orthogonal to $|s\rangle$: it is the reflection in the line through $|s\rangle$. On amplitudes it acts as

$$D\Big(\sum_xa_x|x\rangle\Big)=\sum_x\big(2\bar a-a_x\big)|x\rangle ,\qquad \bar a=\frac1N\sum_xa_x ,$$

replacing each amplitude by its mirror image in the mean $\bar a$.

$D^\dagger=2|s\rangle\langle s|-I=D$. Since $\langle s|s\rangle=1$, $D^2=4|s\rangle\langle s|s\rangle\langle s|-4|s\rangle\langle s|+I=I$. So $D^\dagger D=D^2=I$. Next, $D|s\rangle=2|s\rangle-|s\rangle=|s\rangle$, and if $\langle s|v\rangle=0$ then $D|v\rangle=-|v\rangle$. For the amplitude formula, $\langle s|\psi\rangle=\tfrac{1}{\sqrt N}\sum_xa_x=\sqrt N\,\bar a$, so $2|s\rangle\langle s|\psi\rangle=2\sqrt N\bar a\cdot\tfrac{1}{\sqrt N}\sum_x|x\rangle=\sum_x2\bar a|x\rangle$. Subtracting $|\psi\rangle$ gives the formula.

By Proposition 11.1, first find the mean $\bar a$ of the four amplitudes, then reflect: $a\mapsto2\bar a-a$.

$\bar a=1.8/4=0.45$, so $0.1\mapsto0.9-0.1=0.8$. The amplitude furthest below the mean ends up furthest above it; the new state $(0.4,0.4,0.2,0.8)$ is still normalised.

example 11.1— N = 4: one iteration finds the answer

Take $n=2$ with marked string $w=10$. Track the four amplitudes through one Grover iteration.

Start with all amplitudes $\tfrac12$, in the order $00,01,10,11$:

$$\big(\tfrac12,\tfrac12,\tfrac12,\tfrac12\big)\ \xrightarrow{\ Z_f\ }\ \big(\tfrac12,\tfrac12,-\tfrac12,\tfrac12\big).$$

The mean is now $\bar a=\tfrac14\big(\tfrac12+\tfrac12-\tfrac12+\tfrac12\big)=\tfrac14$. Inversion about the mean sends $\tfrac12\mapsto2\cdot\tfrac14-\tfrac12=0$ and $-\tfrac12\mapsto2\cdot\tfrac14+\tfrac12=1$:

$$\big(\tfrac12,\tfrac12,-\tfrac12,\tfrac12\big)\ \xrightarrow{\ D\ }\ (0,0,1,0)=|10\rangle .$$

One query, and the measurement returns $w$ with certainty. Classically, one query finds $w$ only with probability $\tfrac14$ (or $\tfrac12$ if you guess when the query fails). The oracle pushed the marked amplitude below the mean; the reflection then threw it far above.

3 — The geometry: a rotation in a plane

Large $N$ is easier to understand with a picture than with bars. Everything happens in a two-dimensional plane. Let $|w^\perp\rangle$ be the uniform superposition of all unmarked strings,

$$|w^\perp\rangle=\frac{1}{\sqrt{N-1}}\sum_{x\neq w}|x\rangle ,$$

and define the angle $\theta\in(0,\pi/2)$ by $\sin\theta=1/\sqrt N$. Then

$$|s\rangle=\sin\theta\,|w\rangle+\cos\theta\,|w^\perp\rangle ,$$

since $\tfrac{1}{\sqrt N}$ of the amplitude sits on $|w\rangle$ and the rest, $\sqrt{(N-1)/N}=\cos\theta$, on the others. The start is a vector at angle $\theta$ above the $|w^\perp\rangle$ axis, close to it when $N$ is large.

theorem 11.2 — each Grover iteration is a rotation by 2θ

On the plane spanned by $|w^\perp\rangle$ and $|w\rangle$, $G=DZ_f$ is the rotation by angle $2\theta$ towards $|w\rangle$. Consequently

$$G^k|s\rangle=\sin\big((2k+1)\theta\big)\,|w\rangle+\cos\big((2k+1)\theta\big)\,|w^\perp\rangle ,$$

and after $k$ iterations the measurement returns $w$ with probability $\sin^2\big((2k+1)\theta\big)$.

Both reflections map the plane to itself: $Z_f=I-2|w\rangle\langle w|$ negates the $|w\rangle$ component and fixes $|w^\perp\rangle$, so on the plane it is the reflection in the $|w^\perp\rangle$ axis. By Proposition 11.1, $D$ is the reflection in the line through $|s\rangle$, which lies in the plane. A reflection in a line at angle $\alpha$ followed by a reflection in a line at angle $\beta$ is a rotation by $2(\beta-\alpha)$ (a fact from plane geometry: compose the two reflection matrices). Here $\alpha=0$ and $\beta=\theta$, so $G$ rotates by $2\theta$. Starting from angle $\theta$, after $k$ rotations the angle is $(2k+1)\theta$, and the probability of $w$ is the squared $|w\rangle$ component.

After $k$ Grover iterations, what angle does the state make with the $|w^\perp\rangle$ axis?

$2k\theta$That counts the rotations but forgets where the state started: $|s\rangle$ is already at angle $\theta$, not on the axis.
$k\theta$Each iteration is two reflections, and two reflections in lines $\theta$ apart rotate by $2\theta$, not $\theta$.
$(2k+1)\theta$
$(k+1)\theta$The start angle is right, but each iteration adds $2\theta$.

Two ingredients: the starting angle of $|s\rangle$, and the angle added by each iteration $G$.

The start $|s\rangle$ is at $\theta$ and each iteration adds $2\theta$, so the angle is $\theta+2k\theta=(2k+1)\theta$, and $P(w)=\sin^2((2k+1)\theta)$.

Theorem 11.2 for $N=32$, where $\theta=\arcsin(1/\sqrt{32})\approx10.2^\circ$. Four iterations carry the state from $10.2^\circ$ to $91.6^\circ$, just past $|w\rangle$. Inset: one iteration is two reflections, first in the $|w^\perp\rangle$ axis (the oracle), then in $|s\rangle$ (the diffuser).

Example 11.1 fits the picture: for $N=4$, $\sin\theta=\tfrac12$, so $\theta=30^\circ$, and one rotation by $60^\circ$ takes $30^\circ$ to exactly $90^\circ$.

For $N=2^{20}$, the success probability before any iteration is $1/N$. After one iteration it is about how many times $1/N$?

Use Theorem 11.2 with $k=1$. For large $N$, $\theta\approx\sin\theta=1/\sqrt N$, so $\sin3\theta\approx3/\sqrt N$.

$\sin^2(3\theta)\approx9/N$: a factor of about 9. The amplitude grows roughly linearly, like $(2k+1)/\sqrt N$, so the probability grows like $(2k+1)^2/N$ until the angle nears $90^\circ$.

4 — How many iterations?

We want $(2k+1)\theta$ as close as possible to $\pi/2$, which suggests $k\approx\tfrac{\pi}{4\theta}-\tfrac12$.

theorem 11.3 — the iteration count

With $k=\big\lfloor\tfrac{\pi}{4\theta}\big\rfloor$ iterations, Grover's algorithm finds $w$ with probability at least $1-\tfrac1N$. Since $\theta\ge\sin\theta=1/\sqrt N$, this uses at most $\tfrac\pi4\sqrt N$ queries.

Write $\tfrac{\pi}{4\theta}=k+\varepsilon$ with $0\le\varepsilon\lt 1$. Then $(2k+1)\theta=\tfrac\pi2-2\varepsilon\theta+\theta$, which differs from $\tfrac\pi2$ by $|1-2\varepsilon|\,\theta\le\theta$. So the success probability $\sin^2((2k+1)\theta)$ is at least $\cos^2\theta=1-\sin^2\theta=1-\tfrac1N$. For the query count, $k\le\tfrac{\pi}{4\theta}\le\tfrac{\pi}{4\sin\theta}=\tfrac\pi4\sqrt N$.

Use Theorem 11.3 to find the number of Grover iterations for $N=2^{14}$ (one marked item).

$\sin\theta=2^{-7}$, and $\theta$ is very slightly larger than $\sin\theta$. Compute $\tfrac{\pi}{4\theta}$ and round down.

$\tfrac{\pi}{4\theta}\approx100.53$, so $k=100$, close to $\tfrac\pi4\cdot128\approx100.5$, against about 8,200 classical queries on average.

Success probability $\sin^2((2k+1)\theta)$ after $k$ iterations, for $N=32$ and $N=128$. The best $k$ (green) is 4 and 8, with success $0.999$ and $0.996$. Iterating past the peak rotates the state beyond $|w\rangle$ and the probability falls again: Grover's algorithm is not "the more the better".

For $N=32$ the probabilities after $k=0,1,\dots,6$ iterations are

$$0.031,\quad 0.258,\quad 0.602,\quad 0.897,\quad 0.999,\quad 0.860,\quad 0.546 .$$

For $N=2^{20}$, about a million items, $\theta=\arcsin(2^{-10})$ and the theorem gives $k=804$ iterations (close to $\tfrac\pi4\cdot1024\approx804.2$), with failure probability below $3\times10^{-7}$. A classical search needs about half a million queries on average.

idea — what you need to know in advance

The iteration count depends on $N$ and on the number of marked items. The analysis generalises to $M$ marked items; HW6 asks you to work out the optimal count. If $M$ is unknown, a fixed count can badly overshoot; Lecture 12 shows how to cope (randomised iteration counts, and the general framework of amplitude amplification). It also proves that no quantum algorithm can beat order $\sqrt N$ queries, so Grover's speedup is the best possible for unstructured search.

Grover's algorithm with exactly one marked item. Tick every true statement.

To choose the number of iterations you need to know $N$.
Whoever builds the oracle must already know $w$.The oracle only has to recognise a solution, for example by encrypting a known plaintext under a candidate key and comparing. Recognising is much easier than finding.
Running more than $\lfloor\pi/(4\theta)\rfloor$ iterations can lower the success probability.
With the iteration count of Theorem 11.3 the success probability is exactly 1.Theorem 11.3 promises at least $1-\tfrac1N$; the angle $(2k+1)\theta$ usually misses $90^\circ$ slightly (for $N=32$: 0.999).
The number of oracle queries grows like $\sqrt N$.

Re-read Theorem 11.3 and the $N=32$ table. Also ask what the oracle has to do: find $w$, or check a candidate?

The count $\lfloor\pi/(4\theta)\rfloor\le\tfrac\pi4\sqrt N$ depends on $N$; past it the rotation overshoots $|w\rangle$; and success is only guaranteed to be at least $1-\tfrac1N$. The oracle needs a way to check candidates, not the answer.

5 — Building it from gates

Both reflections reduce to one gate: a phase flip on a single basis state. The multi-controlled Z on $n$ qubits multiplies $|1\cdots1\rangle$ by $-1$ and fixes every other basis state. It is symmetric in its qubits, like CZ (Lecture 6), and it can be built as a multi-controlled $X$ on one qubit sandwiched between Hadamards on that qubit, since $HXH=Z$.

proposition 11.4 — circuits for the two reflections

Oracle. Apply $X$ to every qubit $k$ with $w_k=0$, then the multi-controlled Z, then the same $X$ gates. This is $Z_f=I-2|w\rangle\langle w|$.
Diffuser. Apply $H^{\otimes n}$, then $X^{\otimes n}$, then the multi-controlled Z, then $X^{\otimes n}$, then $H^{\otimes n}$. This is $-D=I-2|s\rangle\langle s|$, which equals $D$ up to a global sign.

The multi-controlled Z is $I-2|1^n\rangle\langle1^n|$. Conjugating by a unitary $U$ gives $U(I-2|1^n\rangle\langle1^n|)U^\dagger=I-2|u\rangle\langle u|$ with $|u\rangle=U|1^n\rangle$. (1) The $X$ gates on the zero positions of $w$ map $|1^n\rangle$ to $|w\rangle$, and they are self-inverse, so we get $I-2|w\rangle\langle w|$. (2) Here $U=H^{\otimes n}X^{\otimes n}$ maps $|1^n\rangle$ to $H^{\otimes n}|0^n\rangle=|s\rangle$, giving $I-2|s\rangle\langle s|=-D$. A global sign on the whole iteration is unobservable (Lecture 3).

With the convention $w=w_3w_2w_1w_0$ and $w_k$ on qubit $q_k$, the oracle of Proposition 11.4 for $w=0010$ puts $X$ gates on .

The X gates must turn $|w\rangle$ into $|1111\rangle$. Which bits of $w=0010$ are 0, and which qubits hold them?

$w_3=w_2=w_0=0$ and $w_1=1$, so the $X$ gates go on $q_0$, $q_2$ and $q_3$; they map $|0010\rangle$ to $|1111\rangle$, where the multi-controlled Z acts.

One Grover iteration for $n=3$ with $w=101$: the oracle needs $X$ only on $q_1$, where $w_1=0$. The three joined dots are the three-qubit controlled-Z.

The multi-controlled Z is the expensive part. On $n$ qubits it decomposes into a number of Toffoli-type gates that grows linearly in $n$ (with one or more helper qubits), so each iteration costs $O(n)$ gates plus one oracle call. For real problems the oracle dominates: it is a reversible circuit for $f$, built with Lecture 7's compute–copy–uncompute, and for a cipher that means running the cipher twice per iteration.

crypto connection — brute force becomes square-root force

Searching for an $n$-bit key with a known plaintext–ciphertext pair is unstructured search over $N=2^n$ keys, so Grover finds it in about $\tfrac\pi4\,2^{n/2}$ iterations (each running the cipher reversibly) instead of about $2^{n-1}$ classical trial encryptions. That halves the security level in bits: a 128-bit key offers roughly 64-bit security against an idealised quantum attacker. Lecture 12 makes this precise, including what parallel hardware does and does not buy, and how large the real cost per iteration is (Lecture 7's AES estimates). Lab 3 builds the oracle for a toy cipher and runs the attack.

A cipher has a 192-bit key. Against an idealised Grover attacker, about how many bits of security does it offer? (Ignore the constant $\tfrac\pi4$.)

Grover needs about $\sqrt N=2^{n/2}$ iterations for $N=2^n$ keys. Security in bits is the exponent of the work.

$\sqrt{2^{192}}=2^{96}$: about 96-bit security. Grover halves the exponent, it does not take its square root.

6 — Try it in code

tool — Grover for n = 5, marked string 10110 (tested with qiskit 2.5)

import numpy as np
from qiskit import QuantumCircuit
from qiskit.primitives import StatevectorSampler

def phase_flip_on_ones(qc, n):                # multiplies |11...1> by -1: H, multi-controlled X, H
    qc.h(n - 1); qc.mcx(list(range(n - 1)), n - 1); qc.h(n - 1)

def oracle(qc, n, w):                         # Z_f for the single marked string w
    zeros = [k for k in range(n) if w[n - 1 - k] == "0"]
    if zeros: qc.x(zeros)                     # map |w> to |11...1>
    phase_flip_on_ones(qc, n)
    if zeros: qc.x(zeros)

def diffuser(qc, n):                          # 2|s><s| - I, up to a global sign
    qc.h(range(n)); qc.x(range(n))
    phase_flip_on_ones(qc, n)
    qc.x(range(n)); qc.h(range(n))

n, w = 5, "10110"
theta = np.arcsin(2 ** (-n / 2))
sampler = StatevectorSampler(seed=11)
for k in range(7):
    qc = QuantumCircuit(n)
    qc.h(range(n))
    for _ in range(k):
        oracle(qc, n, w); diffuser(qc, n)
    qc.measure_all()
    counts = sampler.run([qc], shots=2000).result()[0].data.meas.get_counts()
    print(f"k = {k}:  found w in {counts.get(w, 0) / 2000:.3f} of shots,"
          f"  sin^2((2k+1)theta) = {np.sin((2 * k + 1) * theta) ** 2:.3f}")

k = 0:  found w in 0.032 of shots,  sin^2((2k+1)theta) = 0.031
k = 1:  found w in 0.260 of shots,  sin^2((2k+1)theta) = 0.258
k = 2:  found w in 0.603 of shots,  sin^2((2k+1)theta) = 0.602
k = 3:  found w in 0.901 of shots,  sin^2((2k+1)theta) = 0.897
k = 4:  found w in 1.000 of shots,  sin^2((2k+1)theta) = 0.999
k = 5:  found w in 0.861 of shots,  sin^2((2k+1)theta) = 0.860
k = 6:  found w in 0.546 of shots,  sin^2((2k+1)theta) = 0.546

The sampled frequencies track Theorem 11.2, peak at $k=4=\lfloor\pi/(4\theta)\rfloor$, and fall after it. Note the bit-order bookkeeping in oracle: $w_k$ is the $k$-th character from the right of the string, as in Lecture 9's Bernstein–Vazirani code. The printed key "10110" is in the same order, so counts.get(w) looks up the right outcome.

7 — Summary and exercises

summary

Unstructured search over $N$ items with one marked item needs about $N/2$ classical queries on average and order $N$ in the worst case.
The oracle $Z_f=I-2|w\rangle\langle w|$ and the diffuser $D=2|s\rangle\langle s|-I$ are reflections. $D$ inverts every amplitude about the mean.
In the plane of $|w\rangle$ and $|w^\perp\rangle$, each iteration $G=DZ_f$ rotates by $2\theta$, $\sin\theta=1/\sqrt N$; after $k$ iterations the success probability is $\sin^2((2k+1)\theta)$.
$k=\lfloor\pi/(4\theta)\rfloor\le\tfrac\pi4\sqrt N$ iterations succeed with probability at least $1-1/N$. Too many iterations overshoot.
Both reflections are a multi-controlled Z conjugated by $X$ and $H$ layers. For key search, Grover turns $2^n$ into about $2^{n/2}$ cipher evaluations.

Next time: amplitude amplification, the optimality of Grover, unknown numbers of solutions, and what Grover really means for AES and SHA (Lab 3 launches). HW6 covers Lectures 11 and 12.

exercises 11

For $N=4$, what is the success probability after two Grover iterations? Check your answer by applying inversion about the mean to the amplitudes of Example 11.1 once more.
For $N=2^{10}$, find $\theta$ in degrees, the iteration count of Theorem 11.3, and the success probability.
Show directly from the definition that $D|s\rangle=|s\rangle$ and $D|v\rangle=-|v\rangle$ whenever $\langle s|v\rangle=0$. What does the diffuser do if the oracle is skipped?
A classical algorithm queries $q$ distinct inputs chosen uniformly at random. Show that it finds the marked item with probability $q/N$, and that querying in a random order finds it after $(N+1)/2$ queries on average.
Write the oracle circuit for $n=4$ and marked string $w=0110$. Which qubits get $X$ gates?
Suppose the oracle mistakenly marks no item ($f\equiv0$). What does Grover's algorithm output, for any number of iterations?

After one iteration the state is $|w\rangle$, at angle $90^\circ$; a second rotation by $60^\circ$ takes it to $150^\circ$, so the success probability is $\sin^2150^\circ=\tfrac14$. With amplitudes: $(0,0,1,0)\xrightarrow{Z_f}(0,0,-1,0)$, whose mean is $-\tfrac14$; inversion gives $\big(-\tfrac12,-\tfrac12,\tfrac12,-\tfrac12\big)$, and $|\tfrac12|^2=\tfrac14$.
$\theta=\arcsin\tfrac1{32}\approx1.791^\circ$. Then $\tfrac{\pi}{4\theta}\approx25.1$, so $k=25$, and the success probability is $\sin^2(51\theta)\approx0.99946$. A classical search needs about 512 queries on average.
$D|s\rangle=2|s\rangle\langle s|s\rangle-|s\rangle=|s\rangle$, and $D|v\rangle=2|s\rangle\langle s|v\rangle-|v\rangle=-|v\rangle$. Without the oracle the algorithm only applies $D$ to $|s\rangle$, which does nothing: the output stays uniformly random. The oracle is what breaks the symmetry.
Each of the $\binom{N}{q}$ query sets is equally likely, and $\binom{N-1}{q-1}$ of them contain $w$, so the success probability is $\binom{N-1}{q-1}/\binom Nq=q/N$. In a uniformly random order, $w$ is equally likely to be in any of the $N$ positions, so the expected position is $\tfrac1N(1+2+\cdots+N)=\tfrac{N+1}{2}$.
$w=0110$ means $w_3=0$, $w_2=1$, $w_1=1$, $w_0=0$. Apply $X$ to $q_0$ and $q_3$, then the 4-qubit controlled-Z, then $X$ to $q_0$ and $q_3$ again.
Then $Z_f=I$ and every iteration is just $D$, which fixes $|s\rangle$. The output is uniformly random for every $k$. A single non-solution is consistent with there being none (a correct run can also fail, with small probability), but repeated failures, each checked with one classical query, make "no solution" increasingly likely.

Reading and sources

J. Watrous, Understanding Quantum Information and Computation, Ch. 8, Grover's algorithm (arXiv:2507.11536; IBM course Fundamentals of Quantum Algorithms, Lesson 4).
R. de Wolf, Quantum Computing: Lecture Notes, Ch. 7 (arXiv:1907.09415).
L. K. Grover, "A fast quantum mechanical algorithm for database search", STOC 1996; C. H. Bennett, E. Bernstein, G. Brassard and U. Vazirani, "Strengths and weaknesses of quantum computing", SIAM J. Comput. 26 (1997); M. Boyer, G. Brassard, P. Høyer and A. Tapp, "Tight bounds on quantum searching", Fortschr. Phys. 46 (1998).

all numbers and figures in these notes are computed in python (verify_L11.py) and follow the page theme