Hybrid quantum linear equation algorithm and its experimental test on IBM Quantum Experience.

We propose a hybrid quantum algorithm based on the Harrow-Hassidim-Lloyd (HHL) algorithm for solving a system of linear equations. In this paper, we show that our hybrid algorithm can reduce a circuit depth from the original HHL algorithm by means of a classical information feed-forward after the quantum phase estimation algorithm, and the results of the hybrid algorithm are identical to those of the HHL algorithm. In addition, it is experimentally examined with four qubits in the IBM Quantum Experience setups, and the experimental results of our algorithm show higher accurate performance on specific systems of linear equations than that of the HHL algorithm.

Introduction

A quantum computer is a physical machine based on quantum physics. Since the Shor’s algorithm was known to be a method for factoring a very large number with exponential speed-up on a quantum computer[1], various quantum algorithms have been theoretically introduced under the assumption of noiseless quantum computers. However, the performance of quantum algorithms in practice suffers from physical errors in noisy quantum devices under technical limitations (e.g., decoherence). Thus, it is of great importance to find more efficient and error-robust methods for existing quantum algorithms within physical error thresholds for near-term future applications.

The Harrow-Hassidim-Lloyd (HHL) algorithm[2] is a well-known quantum algorithm for finding the solution of a given system of linear equations represented by an input matrix and a vector . Intuitively, the HHL algorithm performs the inverse of the matrix on the vector in a heralded way and is more efficiently operated with sparse matrix . Because the HHL algorithm demonstrates how to use quantum computers for mathematical problems, it provides important impact on other quantum applications such as the quantum machine learning algorithm[3] and the high-order quantum algorithm[4] for solving differential equations.

The purpose of this paper is to provide a modified version of the original HHL algorithm[2] to be efficiently operated on both classical and quantum computers in sequential steps. The main idea of our hybrid algorithm is to remove an unnecessary quantum part of the original HHL algorithm with prior classical information, so we call it the hybrid HHL algorithm. This makes the shortened circuit depth of the original algorithm without losing quantum advantages dependent to the original algorithm. We also demonstrate the hybrid HHL algorithm compared with the original one with different eigenvalues of in the IBM Quantum eXperience (IBMQX) setups, and show that our hybrid algorithm has more enhanced performance than the other.

Preliminaries

Definitions

A general form of linear systems of equations is given inwhere is an N × N matrix and is a vector. Throughout this paper, it is assumed that the matrix is Hermitian and the vector is unit. Then the matrix has a spectral decomposition[5]where λ is an eigenvalue of corresponding to the eigenstate |u〉. From this decomposition, a unitary operator is defined as follows:It is easy to see that for any non-zero eigenvalue λ of there exists λ′ ∈ (0, 1) such that . Thus, for convenience, we may assume that the eigenvalues of are in (0, 1).

We then introduce three definitions to explain the main idea of this work.

Definition 1.

Let λ be a positive real number with the range of (0, 1), then its binary representation is given by

where b ∈ {0, 1} is a k-th bit of the binary representation. For , the n-binary estimation of λ, say λ(n), is given by

Definition 2.

Let be the set of all non-zero eigenvalues of a Hermitian matrix . For , define a constant as

where is the k-th bit of the binary representation of λ. We call the k-th eigenmean of . Moreover, if or 1, is called fixed.

In Definition 2, we remark that if the k-th eigenmean of is fixed then every k-th bits of the binary representations of is equal, that is, if is fixed then for any 1 ≤ j1, j2 ≤ l.

Definition 3

Let λ be an eigenvalue of a Hermitian matrix and let .

λ is called perfectly n-estimated, if λ satisfies 2λ = λ(n), where λ(n) is the n-binary estimation of λ in Definition 1.

The matrix is called perfectly n-estimated, if all the eigenvalues of are perfectly n-estimated.

HHL algorithm

For a given , the HHL algorithm[2] was devised to figure out the approximation of the expectation value for some operator M. In the algorithm, is represented as a quantum state , where |u〉 is an eigenstate of and such that , and the solution is given as a quantum statewhere is the inverse matrix of . As shown in Fig. 1, the HHL algorithm with n-qubit register consists of three main parts: the quantum phase estimation (QPE) algorithm[6-9] without the final measurement part (we call it as QPE part), the ancilla quantum encoding (AQE) part, in which the ancillary qubit A conditionally operates on the state of the register qubits, and the inverse QPE part.

Figure 1

The circuit diagram for the HHL algorithm[2]: the circuit consists of the QPE part, the AQE part and the inverse QPE part. The unitary gate is used for controlled-unitary gates between the register R and the input qubit V while the controlled AQE indicates a set of controlled gates between the register R and the ancillary qubit A.

We first describe the QPE part of the HHL algorithm and assume that the initial state is prepared in with a n-qubit register. After finishing the QPE part, the state at step (a) in Fig. 1 is written by the superposition of the state (see details in Eq. (16)) with index j and the ancillary qubit |0〉 such thatwhere . Then the estimated value x in Eq. (4) can be relabeled with λ = x/2 such asIn the AQE part, a quantum encoding operation about the ancillary qubit A is performed, and the the controlled AQE in Fig. 1 is given bywhere . In practice, the value c in Eq. (5) has to be chosen with O(1/κ) as in the original result[2], where κ is called the condition number of . Then the state at step (b) in Fig. 1 is equal toIf all the eigenvalues λ are perfectly n-estimated then , and the state in Eq. (6) becomesThen after performing the inverse QPE part, the state at step (c) in Fig. 1 is represented asin which all the register qubits are reseted in . The normalized solution of the linear equation appears when the measurement of the ancillary qubit A is performed in Z-axis. In other words, if the outcome state of A is |1〉, the state describing the qubit system V successfully represents the solution of the linear equation as follows:where . Note that the pure state in Eq. (8) is obtained only when is perfectly n-estimated as we mentioned earlier. If there exists an eigenvalue of which is not perfectly n-estimated, then the total state of Eq. (7) becomes a pure entangled state so that the state in Eq. (8) turns into a mixed state.

We note that the running time of the HHL algorithm is a polynomial of logN and κ, and the HHL algorithm runs exponentially faster than any classical algorithm[2]. In this paper, we consider only one-qubit state preparation with respect to the initial state of the algorithm. However, it would be more difficult to prepare an arbitrary n-qubit state in general. In fact, loading the initial data has been considered as one of the main caveats of quantum algorithms[10,11], and hence several methods[12,13] to handle this caveat have been proposed.

Results

Hybrid HHL algorithm

Motivation: specific linear equations

For 0 < λ < 1, let us now consider the following linear system of equationswhereThen one can readily check that is positive, and can obtain the solution of the equation which is given bywhere .

From the original HHL algorithm with and in Eq. (10), we can obtain the fidelity[5] between the results of the algorithm with a k-qubit register (k = 1, 2, 3) and analytical results given bywhere F(⋅,⋅) indicates the quantum fidelity, the final state ρ is the approximated solution state describing the qubit system V obtained at the end of algorithm performance, and ψ is the normalized solution of in Eq. (11). In Fig. 2(a), the fidelities F(λ) are presented with k = 1, 2, 3 (details in Section Methods). It indicates that more register qubits make a better and larger window for higher fidelity between outcome states and the analytical solutions. From the curves, we gain two features on the performance of the original HHL algorithm which have not appeared in any previous literature. One is that we can find an exact solution of the linear system of equations only when the matrix is perfectly n-estimated. In particular, note that the fidelities reach to 1 with both 2- and 3-qubit registers for λ = 1/4, 1/2, 3/4. In other words, additional register qubits can increase the fidelity if is not perfectly n-estimated. For the other one, let us observe that F3 < F2 < F1 for λ = 0.475 in Fig. 2(a). These inequalities can be interpreted as the statement that the use of a smaller size of register provides more precise solutions at neighborhoods of the perfectly n-estimated eigenvalues, although it is not rigorously proved in this paper. We conjecture that the statement is true for the general case including n-qubit register with n > 3 and larger systems of linear equations.

Figure 2

(a) Fidelities between solutions of the linear systems of equations in Eq. (10) and output states obtained from the HHL algorithm with k-qubit register for k = 1, 2, 3. (b) The probability distribution for measurement outcomes: The QPEA with 2-qubit register is performed on and in Eq. (10). Since the QPEA makes use of 2 qubits as register, its measurement outcomes are two-bit strings b1b2 with b1, b2 ∈ {0, 1}, and Pr(b1b2) denotes the probability that the outcome is b1b2. Details of the probabilities are presented in Eqs (12) and (13).

From the fact that F2(0.5) = F3(0.5) = 1, one may think that, for some restriction of λ, circuit implementations for the HHL algorithm with 3-qubit register can be simplified by using 2 qubits as register of the algorithm. For example, the algorithm may be implemented by using a smaller number of gates, and could have more efficient performance with the reduced amount of errors. The idea motivates us to devise a quantum linear equation algorithm whose circuit implementation is more simplified than that of the original HHL algorithm.

Description of hybrid HHL algorithm

We here present the hybrid HHL algorithm, which mainly consists of the blocks of the quantum phase estimation algorithm (QPEA), classical computing, and a reduced HHL algorithm to test the original and hybrid HHL algorithms with a two-qubit register as described in Fig. 3. In particular, the third part of the hybrid algorithm is called the reduced HHL part because the part is not an independent quantum algorithm.

Figure 3

The circuit diagrams of the original and hybrid HHL algorithms for and in Eq. (10). (a) The controlled gate, where for . (b) The inverse quantum Fourier transform for two qubits. (c) Additional measurement devices to check outputs of the algorithms. In the hybrid HHL algorithm, AQE′ indicates a reduced AQE part (aqua color). The detailed circuit implementations of (a,b), and AQE′ are given in Fig. 4.

QPEA: Repeatedly perform the QPEA to obtain k-bit classical information of eigenvalues with and |b〉.

Classical Computing: Analyze measurement outcomes from the first step by means of classical computers. Based on the analyzed data, such as an estimation of the probability distribution in Fig. 2(b), one determines which simpler circuit implementation of the original AQE part, called the reduced AQE part, is applicable. The circuit of the reduced AQE part is implemented by the classical analysis.

Reduced HHL: Perform the HHL algorithm with the reduced AQE part instead of the original AQE part.

Figure 4

The circuit implementations on IBMQX setups: (a) the controlled gate where for , (b) the inverse quantum Fourier transform for two qubits, (c) the original AQE part, and (d) the reduced AQE part for the reduced HHL part when λ = 1/4, 2/4. Here, θ′3: = θ3−(θ1 + θ2).

Importantly, if the reduced AQE part is not applicable from the second step of the hybrid algorithm due to the lack of capability to distinguish different eigenvalues, the user of the algorithm should restart the first step with more register qubits to perform the reduced HHL part.

How does hybrid HHL algorithm work?

Let us consider that our hybrid HHL algorithm is applied to the linear equation in Eq. (9) when λ = 1/4, 2/4, 3/4, and that we use only 2 qubits as register of the hybrid HHL algorithm. Assume that λ = 1/4, 2/4, 3/4 is unknown.

In the first step of the hybrid HHL algorithm, the QPEA with 2-qubit register is repeatedly performed on the matrix and the state . Then as depicted in Fig. 2(b), we may obtain a probability distribution for the measurement outcomes of the QPEA given bywhere j = 0, 1.

In the second step of the algorithm, we can know what the eigenvalues of are from the probability distribution in Fig. 2(b). In addition, we can also know that is perfectly 2-estimated, is a fixed eigenmean for the matrices and , and the matrix has fixed eigenmeans (=1) and (=0). From the classical information, the AQE part of the HHL algorithm can be simply implemented. In detail, the AQE parts for the matrices and are given by a controlled-unitary operationand the AQE for the matrix is given by a single-qubit unitary operationOne of the practical drawbacks in the HHL algorithm is that we anyway need to know some partial information of the matrix to setup the value c in Eq. (5) in the physical circuit of the AQE. Our main purpose is to extract this information with QPEA, and then the approximated value c is now known for AQE and reduced AQE. The rotation gate R(θ) is defined as follows:where I is the identity operator and B can be one of Pauli operators X, Y, and Z. To implement the original and reduced AQE parts, we employ a specific conditional phase gate R(θ), where with for n≥1.

In the third step, by performing the reduced HHL part on the linear equation , whose reduced AQE part is reconstructed based on Eqs (14) and (15), we can obtain the normalized solution of the linear equation in the qubit system V.

In these examples, our hybrid algorithm solves the linear equation under the condition that the matrix is perfectly 2-estimated and it has fixed eigenmeans. In fact, this condition is indispensable for reducing the AQE part of the original HHL algorithm. More generally, the following theorem shows that if a matrix in Eq. (1) is perfectly n-estimated, and it has fixed eigenmeans, then we can implement the AQE part by using smaller size of register when the eigenvalues are known as follows.

Theorem 4.

Let with k ≤ n. If a matrix is perfectly n-estimated, and the matrix has k fixed eigenmeans, then the AQE part can be implemented by (n−k)-qubit register.

Remark that Theorem 4 is useful for our hybrid algorithm as follows. First of all, the eigenvalues of can be perfectly n-estimated when a sufficiently large number of qubits are used as register of the HHL algorithm. Secondly, since the HHL algorithm deals with positive semidefinite matrices whose eigenvalues are between 0 and 1 in our case, the matrix can have at least a fixed eigenmean. Thus, by Theorem 4, the AQE part can be implemented with the reduced number of qubit register, depending on the number of fixed eigenmeans. In our hybrid algorithm, if is perfectly n-estimated, and it has k fixed eigenmeans, then the number k can be estimated by repeatedly performing the QPEA, and hence we can implement the reduced AQE part.

Circuit implementation and experiment

IBM Quantum Experience

The IBMQX is the name of online facilities for general public who can test their own experimental protocols in five (or sixteen) superconducting qubits. Although its physical setup consists of a complex architecture built by superconducting qubits and readout resonators in a single chip, the user interface is designed with simple diagrams, which represent single- and two-qubit gates, and is easy to understand and to write the programs without much prior knowledge of quantum information theory and experimental setups.

We in particular use four qubits in the five-qubit systems (called IBMQX2 and IBMQX4) and they have a different topology of connectivity for two-qubit gates. For example, they provide a controlled-NOT (CNOT) gate at the end-user level but the physical two-qubit gate is actually performed by a cross-resonance gate[14,15], which implies that additional single-qubit gates are required to match the desired CNOT gate. Fortunately, single-qubit gates in their transmon qubits are very accurate and the fidelity of gate operations mostly depends on that of the cross-resonance gate and the readout errors after the total quantum operation. For example, we utilize single-qubit R gates for the algorithms as much as we can because this can be realized without applying any microwave but with only shifting the phase of the next applied microwave[16].

Because the IBMQX setup shows the daily small fluctuation of parameters, they provide average device calibrations, which might be useful for understanding the imperfection of the experimental data. For example, the transmons energy frequency (between 0 and 1) is roughly about 5 GHz, which is fit to the microwave frequency with 6 cm wavelength. Importantly, one of the important measures for coherence time is T1 ≈ 50 μ s, and it approximately limits the total operation time t in performance of quantum processing such as for a single-qubit decay rate. For example, the CNOT gate (consisting of a cross-resonance gate and a few single-qubit gates) takes around 200 ns, and it roughly indicates that 50 times of CNOT gates might not exceed the fidelity 0.82 because e−1/5 ≈ 0.82 at the current IBMQX setup. Therefore, the hybrid quantum algorithm might be beneficial for experimental demonstrations under practical circumstances because it has simpler quantum gates with the support of classical information processing.

Setups for circuit implementations on IBMQX

We now describe experimental setups of the hybird HHL algorithm compared with the original HHL algorithm with two qubit register to solve the linear equation given by the parameterized matrix in Eq. (10). In addition, we only deal with the matrices and , since and have the same eigenvalues. In the IBMQX setups, it is also possible to test the algorithms by using a three-qubit register. However, the complex circuit implementations dramatically decrease the fidelities of the solutions beyond the analysis scope. More importantly, because the original and hybrid HHL algorithms exactly find the same solution of for the ideal (no-error) cases that λ = 1/4, 2/4, it is crucial to compare the performance of the original and hybrid HHL algorithms under the IBMQX setups under error-propagating circumstances. Note that a similar experimental investigation has been recently shown with fixed matrix , which cannot cover the class of our parameterized matrix in Eq. (10)[17].

As explained in Section Preliminaries: HHL algorithm and Fig. 3, the original HHL algorithm consists of the QPE, the AQE, and the inverse QPE with a qubit measurement on the ancillary qubit, as shown in the top of Fig. 3. The QPE part is mainly decomposed by the parts (a) and (b) in Fig. 3 or Fig. 4. The first part (a) consists of two controlled unitary gates whose circuit implementations[18] are found in Fig. 4(a). The second part (b) is the inverse of the two-qubit QFT, which is a combination of a SWAP gate, two CNOT gates, and some single-qubit gates shown in Fig. 4(b). After the inverse QPE part, if the ancillary qubit is measured in |1〉, the register qubits always become in principle. However, the propagated errors during the whole operation time might cause the other outcomes () in real experiments. This can be verified by setting the measurements of register qubits in Fig. 3(c) to post-select successful outcomes.

For the hybrid HHL algorithm in Fig. 3, classical computing is sandwiched between two quantum computing parts. The first part of the quantum algorithm is called QPEA similar to the QPE part in the original HHL. After the measurement of the two-qubit register (step 1), the analysis from classical computing decides the operation angles (θ) in the reduced AQE circuit (AQE′) with respect to the measured first two digits in r1 and r2 (step 2). Finally, the chosen angles from the classical information are applied in the lightened circuit of AQE′ (step 3). The original and reduced AQE circuits are shown in Fig. 4(c,d), respectively.

Therefore, we will show the experimental results of QPEA and the reduced HHL parts with λ = 1/4, 1/2 compared with the original HHL algorithm in the next subsection. If we consider a general case that λ ≠ k/4 with k = 1, 2, 3, we cannot exactly estimate the eigenvalues of from the probability distribution given in Fig. 2(b) and request more register qubits for the algorithm, however, it also indicates that a small variance of eigenvalues (|λ − k/4| = δ with small δ) would give us a high fidelity of the solution state (even better than using a three-qubit register in principle) as shown in Fig. 2(a).

Experimental results for QPEA and Reduced HHL parts

We here examine the original and hybrid HHL algorithms at the setups of IBMQX4. The experiments of QPEA are performed by using six CNOTs, and the original HHL algorithm requires 28 CNOT gates while the reduced HHL algorithm now has 14 CNOT gates. Thus, this indicates the reduction of 14 CNOT gates from the original HHL algorithm. Note that ten sets of experimental data are used for each λ with 1024 single-shot readouts per set for individual algorithms.

The QPE in the original HHL and QPEA in the hybrid HHL commonly have (a) a set of controlled unitary operations with and (b) the inverse QFT for two qubits shown in Fig. 4. The only difference between them is the measurement part in QPEA. The hybrid scheme first accepts the results of QPEA to estimate partial information of eigenvalues in two bits used for building the QAE circuit as shown in Fig. 4(d). From the results depicted in Fig. 5(a), we can verify that the performance of the QPEA on IBMQX is quite useful to confirm the first two bits of the eigenvalues of even with some unavoidable errors in the IBMQX circuit.

Figure 5

Experimental results on IBMQX4: (a) the QPEA with 2-qubit register. (b) the original HHL algorithm and reduced HHL part.

In Fig. 5(b), the probabilities of theoretical and two experimental cases are depicted for both the original and reduced HHL algorithms. The solution state |x〉 is measured in observable X in the basis set of {|+〉, |−〉} to verify the experimental solution state for both algorithms. We also perform ten sets of data with 1024 single shots per set. Since |x〉 is represented by c+ |+〉 + c−|−〉, where such that |c+|2 + |c−|2 = 1, probabilities |c+|2 and |c−|2 tell us how close x is to the theoretical solution. As mentioned earlier, the solution of the linear equation is obtained when the ancillary qubit is 1 after measured by Z. Theoretically, this probability of the post-measurement state 1 is quit small in the case of the linear equation in Eq. (9). This means that only the minority data contribute to plot the probabilities |c+|2 and |c−|2.

From Fig. 5, we can know that the solution of the reduced HHL part is more accurate than that of the original HHL algorithm. The figure shows that, if we accept to use the first two bits of QPEA for the reduced AQE circuit, we can conclude that the results of the hybrid algorithm are closer to the theoretical results than that of the original HHL algorithm in the IBMQX setups.

Discussion

We have described the HHL algorithm which solves a quantized version of given linear equations. We have especially analyzed the QPE part of the HHL algorithm, and have devised the hybrid version of the HHL algorithm. Under the IBMQX setups, we have shown that the hybrid algorithm can reduce the number of two-qubit gates, and thus has more enhanced performance than that of the HHL algorithm for some specific linear equations.

The hybrid HHL algorithm stems from the fact that the QPE part of the HHL algorithm is identical to the QPEA without measurement. It follows that the AQE part of the original HHL algorithm can be reconstructed if we are able to obtain classical information from measurement outcomes of the prior QPEA to solve a linear equation. We remark that an iterative QPEA[19] can be used as the first step of our hybrid algorithm. Since the iterative QPEA does not need the quantum Fourier transform for its implementation, the small number of qubits is required. So the use of the iterative QPEA would improve the resource efficiency of the hybrid algorithm. In addition, there have been some results in literature[20,21] which generalize or improve the QPEA, and we expect that combining these results with the hybrid algorithm leads to other new hybrid quantum linear equation algorithms. Finally, there have been developed some quantum algorithms, such as the quantum counting algorithm[22], the quantum machine learning algorithm[3], and the high-order quantum algorithm[4], which have relevance to the QPEA or the HHL algorithm. Hence, it would be interesting to find out hybrid versions for these algorithms.

Regarding quantum supremacy[23], IBM has currently announced a new term, quantum volume[24], which measures the useful amount of quantum computing done by a quantum device with specific number of qubits and error rate. In addition, error mitigation approaches[25-27] have shown a new direction of managing the error accuracy for specific cases. In order to apply this extrapolation scheme, the amount of errors should be sufficiently small to claim that the error-propagation curve is linear. As mentioned earlier, the reduced HHL part of our hybrid algorithm can be implemented by a smaller number of quantum gates, which reduces the total error rate from the gates. Hence, we expect that the technique in the hybrid algorithm can be adopted in quantum algorithms to show quantum supremacy.

Methods

Quantum phase estimation algorithm

Suppose that a matrix is Hermitian with an eigenvalue λ in (0, 1) with respect to the corresponding eigenstate |u〉. For the unitary operation defined as in Eq. (3), we obtainThe aim of the QPEA is to find out an estimated value of λ, which is given by a binary string. The QPEA is performed with the input eigenstate |u〉 and n-qubit register. Then the estimated value of λ is obtained by measuring this n-qubit register as describedin Fig. 6.

Figure 6

The circuit diagram of the QPEA with n-qubit register: H and are the Hadamard gate and the inverse quantum Fourier transform. At the end, every register qubit is measured in observable Z.

Specifically, let us explain a process of the QPEA on in Eq. (1) and its eigenstate |u〉 in Eq. (2). The total input state of the QPEA is initialized in a quantum state and Hadamard operations are firstly performed in n-qubit register, as shown in Fig. 6. After n controlled unitary gates, controlled-, the state (a) in Fig. 6 is given inThen, the inverse of quantum Fourier transform is applied in the register qubits, and the state (b) in Fig. 6 can be written inFinally, each qubit in the register system R is measured with observable Z. For large n, if the measured outcome x in register qubits is close to λ(n), we find that Pr(x) is also close to one. Otherwise, if x is close to another n-bit string which is not λ(n), Pr(x) is close to zero. Therefore for sufficiently large n, we are able to obtain the n-binary estimation λ(n) of λ from the probability distribution of the measurement outcomes.

Fidelities in Figure 2(a)

We here present explicit expressions of the fidelities in Fig. 2(a). For i = 1, 2, 3 and λ ∈ (0, 1), denote F(λ) as the fidelity between an exact normalized solution and the solution obtained from the HHL algorithm with i-qubit register. Let t = e2, and be the complex conjugate of t. ThenLet X = (40 + 32i) − (129 + 64i)λ + 129λ2 and Y = (9 + 32i) − (146 + 64i)λ + 146λ2. ThenLet A = 140 + 105i, , , , , , , and , and let , , γ = 350 + 608i−700λ, , ξ = −304 + 175i + 608λ. Then we have the fidelitywhere

Proof of Theorem 4 Since each eigenvalue λ of is perfectly n-estimated, its binary representation can be expressed as

for some . Then since β in Eq. (6) becomesif x = 2λ, and β = 0 otherwise, the state in Eq. (4) must beSince the positions of the fixed eigenmeans of do not affect this process, without loss of generality, we may assume that the k fixed eigenmeans of the matrix are . Then the state in Eq. (17) becomessince holds for all j and 1 ≤ i ≤ k. Thus the AQE part can be implemented by using (n−k)-qubit register as follows:where 0 ≤ y ≤ 2−1 and □.