Searcharxiv⌕ Search

arXiv subjects

Gábor Ivanyos

Publications and source records attributed to Gábor Ivanyos.

At least 19 recordsLinked to original sources

Reconquering Bell sampling on qudits: stabilizer learning and testing, quantum pseudorandomness bounds, and more

Bell sampling is a simple yet powerful tool based on measuring two copies of a quantum state in the Bell basis, and has found applications in a plethora of problems related to stabiliser states and measures of magic. However, it was not known how to generalise the procedure from qubits to $d$-level systems -- qudits -- for all dimensions $d > 2$ in a useful way. Indeed, a prior work of the authors (arXiv'24) showed that the natural extension of Bell sampling to arbitrary dimensions fails to provide meaningful information about the quantum states being measured. In this paper, we overcome the difficulties encountered in previous works and develop a useful generalisation of Bell sampling to qudits of all $d\geq 2$. At the heart of our primitive is a new unitary, based on Lagrange's four-square theorem, that maps four copies of any stabiliser state $|\mathcal{S}\rangle$ to four copies of its complex conjugate $|\mathcal{S}^\ast\rangle$ (up to some Pauli operator), which may be of independent interest. We then demonstrate the utility of our new Bell sampling technique by lifting several known results from qubits to qudits for any $d\geq 2$: 1. Learning stabiliser states in $O(n^3)$ time with $O(n)$ samples; 2. Solving the Hidden Stabiliser Group Problem in $\tilde{O}(n^3/\varepsilon)$ time with $\tilde{O}(n/\varepsilon)$ samples; 3. Testing whether $|ψ\rangle$ has stabiliser size at least $d^t$ or is $\varepsilon$-far from all such states in $\tilde{O}(n^3/\varepsilon)$ time with $\tilde{O}(n/\varepsilon)$ samples; 4. Clifford circuits with at most $n/2$ single-qudit non-Clifford gates cannot prepare pseudorandom states; 5. Testing whether $|ψ\rangle$ has stabiliser fidelity at least $1-\varepsilon_1$ or at most $1-\varepsilon_2$ with $O(d^2\varepsilon_2/(\varepsilon_2-\varepsilon_1)^2)$ samples if $\varepsilon_1 = O(\varepsilon_2/d^{2})$.

quant-ph↗

Beyond Bell sampling: stabilizer state learning and quantum pseudorandomness lower bounds on qudits

Bell sampling is a simple yet powerful measurement primitive that has recently attracted a lot of attention, and has proven to be a valuable tool in studying stabiliser states. Unfortunately, however, it is known that Bell sampling fails when used on qu\emph{d}its of dimension $d>2$. In this paper, we explore and quantify the limitations of Bell sampling on qudits, and propose new quantum algorithms to circumvent the use of Bell sampling in solving two important problems: learning stabiliser states and providing pseudorandomness lower bounds on qudits. More specifically, as our first result, we characterise the output distribution corresponding to Bell sampling on copies of a stabiliser state and show that the output can be uniformly random, and hence reveal no information. As our second result, for $d=p$ prime we devise a quantum algorithm to identify an unknown stabiliser state in $(\mathbb{C}^p)^{\otimes n}$ that uses $O(n)$ copies of the input state and runs in time $O(n^4)$. As our third result, we provide a quantum algorithm that efficiently distinguishes a Haar-random state from a state with non-negligible stabiliser fidelity. As a corollary, any Clifford circuit on qudits of dimension $d$ using $O(\log{n}/\log{d})$ auxiliary non-Clifford single-qudit gates cannot prepare computationally pseudorandom quantum states.

quant-ph↗

Efficient quantum algorithms for some instances of the semidirect discrete logarithm problem

The semidirect discrete logarithm problem (SDLP) is the following analogue of the standard discrete logarithm problem in the semidirect product semigroup $G\rtimes \mathrm{End}(G)$ for a finite semigroup $G$. Given $g\in G, σ\in \mathrm{End}(G)$, and $h=\prod_{i=0}^{t-1}σ^i(g)$ for some integer $t$, the SDLP$(G,σ)$, for $g$ and $h$, asks to determine $t$. As Shor's algorithm crucially depends on commutativity, it is believed not to be applicable to the SDLP. Previously, the best known algorithm for the SDLP was based on Kuperberg's subexponential time quantum algorithm. Still, the problem plays a central role in the security of certain proposed cryptosystems in the family of \textit{semidirect product key exchange}. This includes a recently proposed signature protocol called SPDH-Sign. In this paper, we show that the SDLP is even easier in some important special cases. Specifically, for a finite group $G$, we describe quantum algorithms for the SDLP in $G\rtimes \mathrm{Aut}(G)$ for the following two classes of instances: the first one is when $G$ is solvable and the second is when $G$ is a matrix group and a power of $σ$ with a polynomially small exponent is an inner automorphism of $G$. We further extend the results to groups composed of factors from these classes. A consequence is that SPDH-Sign and similar cryptosystems whose security assumption is based on the presumed hardness of the SDLP in the cases described above are insecure against quantum attacks. The quantum ingredients we rely on are not new: these are Shor's factoring and discrete logarithm algorithms and well-known generalizations.

cs.CR↗

Hidden Stabilizers, the Isogeny To Endomorphism Ring Problem and the Cryptanalysis of pSIDH

The Isogeny to Endomorphism Ring Problem (IsERP) asks to compute the endomorphism ring of the codomain of an isogeny between supersingular curves in characteristic $p$ given only a representation for this isogeny, i.e. some data and an algorithm to evaluate this isogeny on any torsion point. This problem plays a central role in isogeny-based cryptography; it underlies the security of pSIDH protocol (ASIACRYPT 2022) and it is at the heart of the recent attacks that broke the SIDH key exchange. Prior to this work, no efficient algorithm was known to solve IsERP for a generic isogeny degree, the hardest case seemingly when the degree is prime. In this paper, we introduce a new quantum polynomial-time algorithm to solve IsERP for isogenies whose degrees are odd and have $O(\log\log p)$ many prime factors. As main technical tools, our algorithm uses a quantum algorithm for computing hidden Borel subgroups, a group action on supersingular isogenies from EUROCRYPT 2021, various algorithms for the Deuring correspondence and a new algorithm to lift arbitrary quaternion order elements modulo an odd integer $N$ with $O(\log\log p)$ many prime factors to powersmooth elements. As a main consequence for cryptography, we obtain a quantum polynomial-time key recovery attack on pSIDH. The technical tools we use may also be of independent interest.

cs.CR↗

Symbolic determinant identity testing and non-commutative ranks of matrix Lie algebras

One approach to make progress on the symbolic determinant identity testing (SDIT) problem is to study the structure of singular matrix spaces. After settling the non-commutative rank problem (Garg-Gurvits-Oliveira-Wigderson, Found. Comput. Math. 2020; Ivanyos-Qiao-Subrahmanyam, Comput. Complex. 2018), a natural next step is to understand singular matrix spaces whose non-commutative rank is full. At present, examples of such matrix spaces are mostly sporadic, so it is desirable to discover them in a more systematic way. In this paper, we make a step towards this direction, by studying the family of matrix spaces that are closed under the commutator operation, that is matrix Lie algebras. On the one hand, we demonstrate that matrix Lie algebras over the complex number field give rise to singular matrix spaces with full non-commutative ranks. On the other hand, we show that SDIT of such spaces can be decided in deterministic polynomial time. Moreover, we give a characterization for the matrix Lie algebras to yield a matrix space possessing singularity certificates as studied by Lov'asz (B. Braz. Math. Soc., 1989) and Raz and Wigderson (Building Bridges II, 2019).

cs.CC↗

Algorithms based on *-algebras, and their applications to isomorphism of polynomials with one secret, group isomorphism, and polynomial identity testing

We consider two basic algorithmic problems concerning tuples of (skew-)symmetric matrices. The first problem asks to decide, given two tuples of (skew-)symmetric matrices $(B_1, \dots, B_m)$ and $(C_1, \dots, C_m)$, whether there exists an invertible matrix $A$ such that for every $i\in\{1, \dots, m\}$, $A^tB_iA=C_i$. We show that this problem can be solved in randomized polynomial time over finite fields of odd size, the real field, and the complex field. The second problem asks to decide, given a tuple of square matrices $(B_1, \dots, B_m)$, whether there exist invertible matrices $A$ and $D$, such that for every $i\in\{1, \dots, m\}$, $AB_iD$ is (skew-)symmetric. We show that this problem can be solved in deterministic polynomial time over fields of characteristic not $2$. For both problems we exploit the structure of the underlying $*$-algebras, and utilize results and methods from the module isomorphism problem. Applications of our results range from multivariate cryptography, group isomorphism, to polynomial identity testing. Specifically, these results imply efficient algorithms for the following problems. (1) Test isomorphism of quadratic forms with one secret over a finite field of odd size. This problem belongs to a family of problems that serves as the security basis of certain authentication schemes proposed by Patarin (Eurocrypto 1996). (2) Test isomorphism of $p$-groups of class 2 and exponent $p$ ($p$ odd) with order $p^k$ in time polynomial in the group order, when the commutator subgroup is of order $p^{O(\sqrt{k})}$. (3) Deterministically reveal two families of singularity witnesses caused by the skew-symmetric structure, which represents a natural next step for the polynomial identity testing problem following the direction set up by the recent resolution of the non-commutative rank problem (Garg et al., FOCS 2016; Ivanyos et al., ITCS 2017).

cs.DS↗

Explicit equivalence of quadratic forms over $\mathbb{F}_q(t)$

We propose a randomized polynomial time algorithm for computing nontrivial zeros of quadratic forms in 4 or more variables over $\mathbb{F}_q(t)$, where $\mathbb{F}_q$ is a finite field of odd characteristic. The algorithm is based on a suitable splitting of the form into two forms and finding a common value they both represent. We make use of an effective formula for the number of fixed degree irreducible polynomials in a given residue class. We apply our algorithms for computing a Witt decomposition of a quadratic form, for computing an explicit isometry between quadratic forms and finding zero divisors in quaternion algebras over quadratic extensions of $\mathbb{F}_q(t)$.

math.RA↗

On learning linear functions from subset and its applications in quantum computing

Let $\mathbb{F}_q$ be the finite field of size $q$ and let $\ell: \mathbb{F}_q^n \to \mathbb{F}_q$ be a linear function. We introduce the {\em Learning From Subset} problem LFS$(q,n,d)$ of learning $\ell$, given samples $u \in \mathbb{F}_q^n$ from a special distribution depending on $\ell$: the probability of sampling $u$ is a function of $\ell(u)$ and is non zero for at most $d$ values of $\ell(u)$. We provide a randomized algorithm for LFS$(q,n,d)$ with sample complexity $(n+d)^{O(d)}$ and running time polynomial in $\log q$ and $(n+d)^{O(d)}$. Our algorithm generalizes and improves upon previous results \cite{Friedl, Ivanyos} that had provided algorithms for LFS$(q,n,q-1)$ with running time $(n+q)^{O(q)}$. We further present applications of our result to the {\em Hidden Multiple Shift} problem HMS$(q,n,r)$ in quantum computation where the goal is to determine the hidden shift $s$ given oracle access to $r$ shifted copies of an injective function $f: \mathbb{Z}_q^n \to \{0, 1\}^l$, that is we can make queries of the form $f_s(x,h) = f(x-hs)$ where $h$ can assume $r$ possible values. We reduce HMS$(q,n,r)$ to LFS$(q,n, q-r+1)$ to obtain a polynomial time algorithm for HMS$(q,n,r)$ when $q=n^{O(1)}$ is prime and $q-r=O(1)$. The best known algorithms \cite{CD07, Friedl} for HMS$(q,n,r)$ with these parameters require exponential time.

quant-ph↗

Constructive noncommutative rank computation is in deterministic polynomial time

We extend our techniques developed in our earlier paper appeared in Computational Complexity, 2017 (preprint: arXiv:1508.00690) to obtain a deterministic polynomial time algorithm for computing the non-commutative rank together with certificates of linear spaces of matrices over sufficiently large base fields. The key new idea is a reduction procedure that keeps the blow-up parameter small, and there are two methods to implement this idea: the first one is a greedy argument that removes certain rows and columns, and the second one is an efficient algorithmic version of a result of Derksen and Makam. Both methods rely crucially on the regularity lemma in our aforementioned paper, and in this manuscript we also improve that lemma by removing a coprime condition there.

cs.CC↗

On the Polynomial Parity Argument Complexity of the Combinatorial Nullstellensatz

The complexity class PPA consists of NP-search problems which are reducible to the parity principle in undirected graphs. It contains a wide variety of interesting problems from graph theory, combinatorics, algebra and number theory, but only a few of these are known to be complete in the class. Before this work, the known complete problems were all discretizations or combinatorial analogues of topological fixed point theorems. Here we prove the PPA-completeness of two problems of radically different style. They are PPA-Circuit CNSS and PPA-Circuit Chevalley, related respectively to the Combinatorial Nullstellensatz and to the Chevalley-Warning Theorem over the two elements field GF(2). The input of these problems contain PPA-circuits which are arithmetic circuits with special symmetric properties that assure that the polynomials computed by them have always an even number of zeros. In the proof of the result we relate the multilinear degree of the polynomials to the parity of the maximal parse subcircuits that compute monomials with maximal multilinear degree, and we show that the maximal parse subcircuits of a PPA-circuit can be paired in polynomial time.

cs.CC↗

On the Complexity of Trial and Error for Constraint Satisfaction Problems

In 2013 Bei, Chen and Zhang introduced a trial and error model of computing, and applied to some constraint satisfaction problems. In this model the input is hidden by an oracle which, for a candidate assignment, reveals some information about a violated constraint if the assignment is not satisfying. In this paper we initiate a {\em systematic} study of constraint satisfaction problems in the trial and error model. To achieve this, we first adopt a formal framework for CSPs, and based on this framework we define several types of revealing oracles. Our main contribution is to develop a \emph{transfer theorem} for each type of the revealing oracle, under a broad class of parameters. To any hidden CSP with a specific type of revealing oracle, the transfer theorem associates another, potentially harder CSP in the normal setting, such that their complexities are polynomial time equivalent. This in principle transfers the study of a large class of hidden CSPs, possibly with a promise on the instances, to the study of CSPs in the normal setting. We then apply the transfer theorems to get polynomial-time algorithms or hardness results for hidden CSPs, including satisfaction problems, monotone graph properties, isomorphism problems, and the exact version of the Unique Games problem. Most of the proofs of these results are short and straightforward, which exhibits the power of the transfer theorems.

cs.CC↗

Irreducibility and r-th root finding over finite fields

Constructing $r$-th nonresidue over a finite field is a fundamental computational problem. A related problem is to construct an irreducible polynomial of degree $r^e$ (where $r$ is a prime) over a given finite field $\mathbb{F}_q$ of characteristic $p$ (equivalently, constructing the bigger field $\mathbb{F}_{q^{r^e}}$). Both these problems have famous randomized algorithms but the derandomization is an open question. We give some new connections between these two problems and their variants. In 1897, Stickelberger proved that if a polynomial has an odd number of even degree factors, then its discriminant is a quadratic nonresidue in the field. We give an extension of Stickelberger's Lemma; we construct $r$-th nonresidues from a polynomial $f$ for which there is a $d$, such that, $r|d$ and $r\nmid\,$#(irreducible factor of $f(x)$ of degree $d$). Our theorem has the following interesting consequences: (1) we can construct $\mathbb{F}_{q^m}$ in deterministic poly(deg($f$),$m\log q$)-time if $m$ is an $r$-power and $f$ is known; (2) we can find $r$-th roots in $\mathbb{F}_{p^m}$ in deterministic poly($m\log p$)-time if $r$ is constant and $r|\gcd(m,p-1)$. We also discuss a conjecture significantly weaker than the Generalized Riemann hypothesis to get a deterministic poly-time algorithm for $r$-th root finding.

cs.CC↗

Computing explicit isomorphisms with full matrix algebras over $\mathbb{F}_q(x)$

We propose a polynomial time $f$-algorithm (a deterministic algorithm which uses an oracle for factoring univariate polynomials over $\mathbb{F}_q$) for computing an isomorphism (if there is any) of a finite dimensional $\mathbb{F}_q(x)$-algebra $A$ given by structure constants with the algebra of $n$ by $n$ matrices with entries from $\mathbb{F}_q(x)$. The method is based on computing a finite $\mathbb{F}_q$-subalgebra of $A$ which is the intersection of a maximal $\mathbb{F}_q[x]$-order and a maximal $R$-order, where $R$ is the subring of $\mathbb{F}_q(x)$ consisting of fractions of polynomials with denominator having degree not less than that of the numerator.

math.RA↗

Non-commutative Edmonds' problem and matrix semi-invariants

In 1967, Edmonds introduced the problem of computing the rank over the rational function field of an $n\times n$ matrix $T$ with integral homogeneous linear polynomials. In this paper, we consider the non-commutative version of Edmonds' problem: compute the rank of $T$ over the free skew field. It is known that this problem relates to the ring of matrix semi-invariants. In particular, if the nullcone of matrix semi-invariants is defined by elements of degree $\leq σ$, then there follows a $\mathrm{poly}(n, σ)$-time randomized algorithm to decide whether the non-commutative rank of $T$ is $<n$. To our knowledge, previously the best bound for $σ$ was $O(n^2\cdot 4^{n^2})$ over algebraically closed fields of characteristic $0$ (Derksen, 2001). In this article we prove the following results: (1) We observe that by using an algorithm of Gurvits, and assuming the above bound $σ$ for $R(n, m)$ over $\mathbb{Q}$, deciding whether $T$ has non-commutative rank $<n$ over $\mathbb{Q}$ can be done deterministically in time polynomial in the input size and $σ$. (2) When $\mathbb{F}$ is large enough, we devise a deterministic algorithm for non-commutative Edmonds' problem in time polynomial in $(n+1)!$, with the following consequences. (2.a) If the commutative rank and the non-commutative rank of $T$ differ by a constant, then there exists a randomized efficient algorithm that computes the non-commutative rank of $T$. (2.b) We prove that $σ\leq (n+1)!$. This not only improves the bound obtained from Derksen's work over algebraically closed field of characteristic $0$ but, more importantly, also provides for the first time an explicit bound on $σ$ for matrix semi-invariants over fields of positive characteristics.

cs.DS↗

On generating the ring of matrix semi-invariants

For a field $\mathbb{F}$, let $R(n, m)$ be the ring of invariant polynomials for the action of $\mathrm{SL}(n, \mathbb{F}) \times \mathrm{SL}(n, \mathbb{F})$ on tuples of matrices -- $(A, C)\in\mathrm{SL}(n, \mathbb{F}) \times \mathrm{SL}(n, \mathbb{F})$ sends $(B_1, \dots, B_m)\in M(n, \mathbb{F})^{\oplus m}$ to $(AB_1C^{-1}, \dots, AB_mC^{-1})$. In this paper we call $R(n, m)$ the \emph{ring of matrix semi-invariants}. Let $β(R(n, m))$ be the smallest $D$ s.t. matrix semi-invariants of degree $\leq D$ generate $R(n, m)$. Guided by the Procesi-Razmyslov-Formanek approach of proving a strong degree bound for generating matrix invariants, we exhibit several interesting structural results for the ring of matrix semi-invariants $R(n, m)$ over fields of characteristic $0$. Using these results, we prove that $β(R(n, m))=Ω(n^{3/2})$, and $β(R(2, m))\leq 4$.

cs.CC↗

An efficient quantum algorithm for finding hidden parabolic subgroups in the general linear group

In the theory of algebraic groups, parabolic subgroups form a crucial building block in the structural studies. In the case of general linear groups over a finite field $F_q$, given a sequence of positive integers $n_1, ..., n_k$, where $n=n_1+...+n_k$, a parabolic subgroup of parameter $(n_1, ..., n_k)$ in $GL_n(F_q)$ is a conjugate of the subgroup consisting of block lower triangular matrices where the $i$th block is of size $n_i$. Our main result is a quantum algorithm of time polynomial in $\log q$ and $n$ for solving the hidden subgroup problem in $GL_n(F_q)$, when the hidden subgroup is promised to be a parabolic subgroup. Our algorithm works with no prior knowledge of the parameter of the hidden parabolic subgroup. Prior to this work, such an efficient quantum algorithm was only known for the case $n=2$ (A. Denney, C. Moore, and A. Russell (2010), Quantum Inf. Comput., Vol. 10, pp. 282-291), and for minimal parabolic subgroups (Borel subgroups), for the case when $q$ is not much smaller than $n$ (G. Ivanyos: Quantum Inf. Comput., Vol. 12, pp. 661-669).

quant-ph↗

Generalized Wong sequences and their applications to Edmonds' problems

We design two deterministic polynomial time algorithms for variants of a problem introduced by Edmonds in 1967: determine the rank of a matrix M whose entries are homogeneous linear polynomials over the integers. Given a linear subspace B of the n by n matrices over some field F, we consider the following problems: symbolic matrix rank (SMR) is the problem to determine the maximum rank among matrices in B, symbolic determinant identity testing (SDIT) is the question to decide whether there exists a nonsingular matrix in B. The constructive versions of these problems are asking to find a matrix of maximum rank, respectively a nonsingular matrix, if there exists one. Our first algorithm solves the constructive SMR when B is spanned by unknown rank one matrices, answering an open question of Gurvits. Our second algorithm solves the constructive SDIT when B is spanned by triangularizable matrices, but the triangularization is not given explicitly. Both algorithms work over finite fields of size at least n+1 and over the rational numbers, and the first algorithm actually solves (the non-constructive) SMR independently from the field size. Our main tool to obtain these results is to generalize Wong sequences, a classical method to deal with pairs of matrices, to the case of pairs of matrix spaces.

cs.CC↗

Quantum computation of discrete logarithms in semigroups

We describe an efficient quantum algorithm for computing discrete logarithms in semigroups using Shor's algorithms for period finding and discrete log as subroutines. Thus proposed cryptosystems based on the presumed hardness of discrete logarithms in semigroups are insecure against quantum attacks. In contrast, we show that some generalizations of the discrete log problem are hard in semigroups despite being easy in groups. We relate a shifted version of the discrete log problem in semigroups to the dihedral hidden subgroup problem, and we show that the constructive membership problem with respect to $k \ge 2$ generators in a black-box abelian semigroup of order $N$ requires $\tilde Θ(N^{\frac{1}{2}-\frac{1}{2k}})$ quantum queries.

quant-ph↗