Exponential speedup of quantum algorithms for the pathfinding problem

Jianqiang Li Department of Computer Science and Engineering, Pennsylvania State University, PA, USA jxl1842@psu.edu

Abstract

Given $x,y$ on an unweighted undirected graph $G$ , the goal of the pathfinding problem is to find an $x$ - $y$ path. In this work, we first construct a graph $G$ based on welded trees and define a pathfinding problem in the adjacency list oracle $O$ . Then we provide an efficient quantum algorithm to find an $x$ - $y$ path in the graph $G$ . Finally, we prove that no classical algorithm can find an $x$ - $y$ path in subexponential time with high probability. The pathfinding problem is one of the fundamental graph-related problems. Our findings suggest that quantum algorithms could potentially offer advantages in more types of graphs to solve the pathfinding problem.

1 Introduction

Quantum algorithms can exploit the superposition and interference properties of quantum mechanics to solve certain problems significantly faster than classical algorithms, achieving super-polynomial speedup. However, the list of such problems is limited. The most well-known problems demonstrating this advantage include Simon’s problem, factoring, discrete logarithms, the Pell equation, and other related algebraic problems. Efficient quantum algorithms [1, 2, 3] exist for these problems, while no known classical algorithms can solve them. In addition, there are graph-related problems, such as the welded tree problem [4] and the graph property testing problem [5], where exponential separations can be achieved relative to the adjacency list oracle.

Identifying problems that can be leveraged by quantum algorithms to achieve superpolynomial speedup over classical algorithms remains one of the major challenges in the field of quantum computation. These challenges arise from two aspects. First, the problem needs to be believed to be classically hard. Second, the problem also needs to be quantumly easy. Several previous attempts to identify such problems have failed due to these constraints. For example, hopes of achieving exponential speedup with quantum algorithms in various machine learning problems, including recommendation systems, principal component analysis, supervised clustering, support vector machines, low-rank regression, and solving semidefinite programs, were later refuted by Tang’s breakthrough results [6] and subsequent work [7, 8]. Moreover, although quantum algorithms [9, 10] that utilize the HHL algorithm [11] as a subroutine show potential to achieve superpolynomial speed-up in solving certain multivariate polynomial systems, it remains unknown how to find such special polynomial systems to demonstrate this quantum speedup.

The welded tree pathfinding problem in the adjacency list oracle is one of the top open problems in the field of quantum query complexity [12]. A welded tree graph consists of two balanced binary trees of height $n$ with roots $s$ and $t$ and a random cycle that alternates between the leaves of the two binary trees. Given the name of the two roots $s$ and $t$ , the goal of the welded tree pathfinding problem is to output the names of vertices of an $s$ - $t$ path. While there is an efficient quantum algorithm to solve the welded tree problem, that is, finding the name of the root $t$ given the name of the root $s$ , it has been shown that a natural class of quantum algorithms cannot solve the welded tree pathfinding problem [13].

Moreover, the pathfinding problem in isogeny graphs plays an important role in the security of isogeny-based cryptosystems [14, 15, 16, 17]. An isogeny graph is constructed with vertices as isomorphism classes of elliptic curves and edges as isogenies (maps) between two elliptic curves. The size of the graph is exponentially large, making it difficult to find a path (map) between two vertices (elliptic curves) of polynomial length. Depending on the constraints on the isogenies, there will be different types of graph, such as volcano graphs, Cayley graphs, and supersingular graphs. So far, the best quantum algorithm takes exponential time to solve the pathfinding problem in supersingular isogeny graphs [18, 19]. Notably, given a vertex in an isogeny graph, one can efficiently compute its neighbors. This makes isogeny graphs a natural instantiation of the adjacency list oracle of an abstract graph. Recent advances have shown that efficient classical algorithms can be used to attack SIDH and SIKE in certain supersingular isogeny graphs, provided additional information is available alongside the starting vertex [20]. However, the general pathfinding problem underlying isogeny-based cryptosystems remains secure [21]. Consequently, other isogeny-based cryptosystems, such as CSIDH [22] continue to be secure against this attack [23].

In this paper, we show that the pathfinding problem in some graphs admits an exponential separation between the quantum algorithm and the classical algorithm under the adjacency list oracle. Instead of solving the welded tree pathfinding problem and the isogeny graph pathfinding problem directly, we construct a graph $G$ by associating $n$ distinct welded trees with a path of length $n$ as in Figure 1. Given the name of two vertices $x$ , $y$ in $G$ , the goal of the pathfinding problem is to output the names of vertices of an $x$ - $y$ path. Similarly to the welded tree pathfinding problem, there is an exponential number of $x$ - $y$ paths in the graph $G$ . On the other hand, the shortest $x$ - $y$ path is unique in the graph $G$ , while there is an exponential number of shortest paths in the welded tree graph. Using the distinctness of the welded trees in the graph $G$ , we show that there is an efficient quantum algorithm that solves this pathfinding problem. This quantum algorithm works by finding the edges of the $x$ - $y$ shortest path step-by-step. For each step, the polynomial time continuous quantum walk algorithm [4] for the welded tree problem is used to select one edge of the shortest $x$ - $y$ path. Repeat $n$ steps, the quantum algorithm outputs the shortest $x$ - $y$ path. In particular, our quantum algorithm uses the continuous quantum walk algorithm [4] as a subroutine, which is a new class of algorithm outside of the natural quantum algorithms considered in [13]. This suggests that there might be a new way to solve the welded tree pathfinding problem.

Finally, we show that no classical algorithm can solve the path-finding problem in subexponential time. Observe that any paths between the two vertices $s$ and $t$ have to go through a vertex of degree at least $4$ , or pass the vertex $p_{n/2}$ as indicated in Figure 1. To establish the classical lower bound, we show that it is classically hard to output the name of the vertex $p_{n/2}$ or vertices that have a degree of at least $4$ . The proof uses the result of the classical lower bound of the welded tree problem, which informally states that, given the name of one root, it is classically hard to traverse through the welded tree to find the other root.

To the best of our knowledge, this is the first example that exhibits the exponential speedup of quantum algorithms for the pathfinding problem. Previous quantum algorithms have achieved at most a polynomial speedup for solving the pathfinding problem in both general and specific graphs. For example, quantum algorithms based on amplitude amplification [24] can solve the pathfinding problem in a general graph using $O(N^{3/2})$ queries to the adjacency matrix oracle, where $N$ is the number of vertices in the graph. By restricting the class of graphs and under the same query model, a quantum algorithm [25] based on the span program to generate the quantum $s$ - $t$ electrical flow slightly improves the query complexity to solve the pathfinding problem. In the incidence list oracle model, [26] uses the HHL algorithm to generate the quantum $s$ - $t$ electrical flow and provide a sublinear time ( $\tilde{O}(\sqrt{N})$ ) quantum algorithm for the pathfinding problem in some graphs while the known classical and quantum algorithms take linear time $\Omega(N)$ . Furthermore, there exist quantum algorithms [27, 28, 29] that utilize quantum walks to solve the pathfinding problem in specific graph structures such as a chain of star graphs and a regular tree graph, providing a quadratic speedup compared to classical algorithms.

Organization.

In Section 2, we introduce the main results of the continuous quantum walk for the welded tree problem, which will be a key subroutine of our quantum pathfinding algorithm. In Section 3, we construct the graph $G$ from the welded trees and use it to define the pathfinding problem. Then we present the quantum algorithm that solves the pathfinding problem. In Section 4, we establish the classical lower bound of the pathfinding problem showing that no classical algorithm can solve this problem with a polynomial number of queries. Finally, we give a discussion and provide some open problems in Section 5.

2 Quantum algorithms for the welded tree problem

In this section, we introduce the main results of the continuous quantum walk approach for the welded tree problem, which will be a key subroutine of our quantum algorithm for the pathfinding problem.

It should be noted that several quantum algorithms have been developed to solve the welded tree problem, encompassing techniques such as continuous quantum walks [4], multidimensional quantum walks [30], discrete quantum walks [31] and the coupled classical oscillator approach [32]. However, in this paper, we specifically focus on the original continuous quantum walk approach for the welded tree problem.

A welded tree graph $W$ consists of two balanced binary trees of height $n$ with roots $s$ and $t$ and a random cycle that alternates between the leaves of the two binary trees. The number of vertices in $W$ is $2^{n+2}-2$ and the names of the vertices are randomly assigned from the set $\{0,1\}^{2n}$ . To access the neighbors of a particular vertex, we use an adjacency list oracle denoted as $O$ for the graph $G$ . Given a $2n$ -bit string $u\in\{0,1\}^{2n}$ , the adjacency list oracle $O$ provides the neighboring vertices of $u$ , or it returns $\perp$ if $u$ is not a valid vertex name in the graph.

Problem 2.1 (The welded tree problem).

Given an adjacency list oracle $O$ of the welded tree $W$ and the name of the starting vertex $s\in\{0,1\}^{2n}$ , the goal is to output the name of the other root $t$ .

Let $A$ be the adjacency matrix of a graph $G$ , $\tau$ be a real number, and $\ket{\psi_{0}}=\ket{s}$ as the initial input state, the continuous-time quantum walk is defined as

\ket{\psi_{\tau}}=e^{-iA\tau}\ket{\psi_{0}}.

Lemma 2.2 (Theorem 3 in [4]).

Let $A$ be the adjacency matrix of the welded tree graph $W$ . With the adjacency list oracle $O$ of the welded tree $W$ , the name of the starting vertex $s\in\{0,1\}^{2n}$ and let $\ket{\psi_{0}}=\ket{s}$ , running the continuous quantum walk $\ket{\psi_{\tau}}=e^{-iA\tau}\ket{\psi_{0}}$ for a time $\tau$ chosen uniformly in $[0,n^{5}]$ and then measuring on the computational basis yields a probability of finding the name of the other root vertex $t$ that is greater than $\Omega(\frac{1}{n})$ .

By querying the adjacency list oracle $O$ of a given vertex, one can determine whether it has a degree of $2$ or not. Since only two vertices, $s$ and $t$ , have a degree of $2$ in the welded tree $W$ , repeating the quantum algorithm multiple times can find the other root $t$ in poly( $n$ ) time. On the other hand, no classical algorithm can solve the welded tree problem in subexponential time by the following Lemma 2.3.

Lemma 2.3 (Theorem 9 in [4]).

For the welded tree problem, any classical algorithm that makes at most $2^{n/6}$ queries to the oracle finds the ending vertex or a cycle with probability at most $4\cdot 2^{-n/6}$ .

Note that the exact statement of Theorem 9 in [4] does not mention finding a cycle while the proof in their classical lower bound result holds for this case.

3 The pathfinding problem and the quantum algorithm

In this section, we construct a graph $G$ based on welded trees and provide an efficient quantum algorithm that outputs an $x$ - $y$ path. The key idea is to construct the graph $G$ associating an $x$ - $y$ path $P_{n}$ of length $n$ with $n$ distinct welded trees. The quantum algorithm finds the $x$ - $y$ path step by step. For each step, we use the quantum algorithm for the welded tree problem [4] to detect and select the edge $(x,u_{i})$ that is in the path $P_{n}$ . Then we remove the selected edge and update the starting vertex $x=u_{i}$ . Repeat until $x=y$ and output all selected edges as an $x$ - $y$ path.

Without loss of generality, assume that $n$ is an even positive integer. Given $n$ disjoint welded trees $W^{i}$ with roots $s_{i}$ and $t_{i}$ , the graph $G$ is constructed as follows:

1.

For each $i\in[n]$ , adding $i+1$ new isolated edges $e_{k}=(m^{i}_{k},n^{i}_{k}),k\in[i+1]$ , then adding $i+1$ new edges between $t_{i}$ and vertices $m^{i}_{k}$ such that the root vertex $t_{i}$ has degree $i+3$ .
2.

Given a path graph $P_{n}$ with $n$ vertices $p_{1},\cdots,p_{n}$ , for each $i\in[n]$ , add an edge between $p_{i}$ and $s_{i}$ .
3.

Adding a random cycle between all vertices $n^{i}_{k}$ for each $i\in[n]$ and $k\in[i+1]$ . Denote the resulting graph as $G$ .

Refer to caption — Figure 1: The Welded Tree Path Graph $G$

Let $x=p_{1}$ be the starting vertex, $y=p_{n}$ be the ending vertex, and given the names of $s$ and $t$ , the goal is to find an $x$ - $y$ path in the graph $G$ .

Problem 3.1 (Pathfinding problem).

Given the adjacency list oracle $O$ of the graph $G$ and the name of the starting, ending vertices $x,y\in\{0,1\}^{2n}$ , the goal is to output an $x$ - $y$ path in $G$ .

Algorithm 1 Quantum algorithm for finding an

s

t

path in the graph

G

0: Graph

G=(V,E)

x,y\in V

and

i=1

0: an

x

y

path

1.

Given the name of the vertex $x\in\{0,1\}^{2n}$ , the adjacency list oracle $O$ returns the names of the two neighbors of $x$ , that is $u_{1},u_{2}\in\{0,1\}^{2n}$ . Without loss of generality, pick one of the two neighbors $u_{1}$ as the initial state $\ket{u_{1}}$ .
2.

Let $A^{\prime}$ be the modified adjacency matrix of the adjacency matrix $A$ of $G$ by removing all the edges adjacent to a degree $2$ vertex. Let $O^{\prime}$ be $O$ except it returns no edge if one endpoint of the edge is a degree $2$ vertex. Run the continuous quantum walk $e^{-iA^{\prime}\tau}\ket{u_{1}}$ for a uniform random time $\tau\in[0,n^{5}]$ . Measure the resulting state in the computational basis and get the name of an outcome vertex $v\in\{0,1\}^{2n}$ . Compute the degree of the vertex $v$ by querying the adjacency list oracle $O$ of $G$ .
3.

Repeat Step 2 $n^{2}$ times or until the degree of the measured vertex equals $i+3$ .
4.

If the degree of the measured vertex $v$ equals $i+3$ , then collect the edge $(x,u_{2})$ as an $x$ - $y$ path edge and let $x=u_{2}$ . Otherwise, collect the edge $(x,u_{1})$ as an $x$ - $y$ path edge and let $x=u_{1}$ .
5.

Let i=i+1 and update the graph $G$ by deleting the selected edge. Repeat all the above steps until $x=y$ , then output all the selected edges as an $x$ - $y$ path.

Theorem 3.2.

With high probability, Algorithm 1 outputs an $x$ - $y$ path in poly( $n$ ) time.

Proof.

For the $i$ -th iteration, the key subroutine is to implement the continuous quantum walk $e^{-iA^{\prime}\tau}$ for $\tau\in[0,n^{5}]$ in Step 2. The adjacency list oracle $O^{\prime}$ can be performed by removing all edges adjacent to a degree $2$ vertex from the adjacency list oracle $O$ . Then use the adjacency list oracle $O^{\prime}$ to construct a block encoding of the modified adjacency matrix $A^{\prime}$ . With this block encoding, we can perform the Hamiltonian simulation $e^{-iA^{\prime}\tau}\ket{u_{1}}$ in poly( $n$ ) time by implementing polynomials of $A^{\prime}$ [33, Theorem 58].

Recall that the only vertex that has degree $i+3$ is the root $t_{i}$ of the welded tree $W^{i}$ in the graph $G$ . If $u_{1}$ is the same as the root vertex $s_{i}$ of the welded tree $W^{i}$ , then by Lemma 2.2, the success probability of measuring a vertex of degree $i+3$ is $\Omega(1/n)$ . The probability of success is $1-\exp(-\Omega(n))$ by repeating Step 2 $n^{2}$ times. Otherwise, the probability of measuring a vertex of degree $i+3$ is $0$ . This is true because the initial starting vertex $\ket{u_{1}}$ is disconnected from the welded tree $W^{1},\cdots,W^{i}$ and connected to the welded trees $W^{i+1},\cdots W^{n}$ in the modified graph associated with the adjacency list oracle $O^{\prime}$ . Therefore, for each iteration, Algorithm 1 outputs an edge of the $x$ - $y$ path with probability $1-\exp(-\Omega(n))$ in poly( $n$ ) time.

The length of the $x$ - $y$ path outputted by Algorithm 1 is $n$ , the same as the total number of iterations. Therefore, with high probability, Algorithm 1 outputs an $x$ - $y$ path in poly( $n$ ) time. ∎

Remark 3.3.

The random cycle at the top of the graph $G$ is not strictly necessary for showing the exponential quantum-classical separation for the pathfinding problem. Instead, it serves to illustrate the exponential separation persists when there are multiple $x$ - $y$ paths, highlighting the robustness of the quantum advantage in more complex graph structures.

4 Classical Lower bound

In this section, we prove that no classical randomized algorithm $\mathcal{R}$ can solve the pathfinding problem 3.1 in the welded tree path graph $G=(V,E)$ within subexponential time. Our approach is inspired by the classical lower bound established for the welded (glued) tree graph in [4], which demonstrates an exponential quantum-classical separation for finding a marked vertex. We adapt their techniques to address the classical lower bound for the pathfinding problem.

Intuitively, the pathfinding problem can be seen as a generalization of the vertex-finding problem, as it requires identifying a sequence of vertices that form an $x$ - $y$ path. To establish a classical lower bound for the pathfinding problem, we demonstrate that no classical algorithm can efficiently identify certain critical vertices along $x$ - $y$ paths of the constructed welded tree path graph $G=(V,E)$ . By the construction of the graph $G$ , we define the set of critical vertices as $p_{n/2}$ and the vertices with degrees of at least $4$ , specifically $\{t_{1},\ldots,t_{n}\}$ .

First, by assigning a random $2n$ -bits string to each vertex in the graph $G$ , any classical algorithm to solve the pathfinding problem with at most $2^{n/6}$ queries of $O$ must traverse connected subgraphs with starting vertices $x$ or $y$ . The reason is as follows: the total number of vertices in the graph $G$ is $n2^{n+2}+\frac{n(n+1)}{2}$ while the total number of potential vertex names is $2^{2n}$ . If $\mathcal{R}$ makes at most $2^{n/6}$ queries, the probability of querying the name of a vertex that has not been previously returned by the oracle $O$ is at most

2^{n/6}(n2^{n+2}+\frac{n(n+1)}{2})/2^{2n}=O(2^{-n/6}).

Thus, it is unlikely that $\mathcal{R}$ can guess a name of vertices of the graph $G$ that is not returned by the oracle $O$ when making at most $2^{n/6}$ queries. Without loss of generality, in the rest of the section, we restrict $\mathcal{R}$ to traverse two connected subgraphs starting with vertices $x$ and $y$ , respectively.

Under these conditions, solving the pathfinding problem with at most $2^{n/6}$ queries of the adjacency list oracle $O$ is equivalent to playing the following game.

Game A The oracle $O$ assigns each vertex of a randomly chosen graph $G$ a distinct $2n$ -bit string as its name. The starting vertex $x$ has the name $0^{2n}$ and the ending vertex $y$ has the name $1^{2n}$ . At each step, $\mathcal{R}$ sends a $2n$ -bit string to $O$ , and the oracle $O$ returns the names of the neighbors of that vertex if the given vertex name is valid. $\mathcal{R}$ wins if it outputs the names of the vertices forming an $x$ - $y$ path.

To bound on the success probability of $\mathcal{R}$ winning Game A, we consider a simpler Game B, which relaxes the winning conditions. In Game B, $\mathcal{R}$ wins by outputting the name of any critical vertex, such as $\{t_{1},t_{2},\ldots,t_{n}\}$ or the vertex $p_{n/2}$ or a cycle while winning Game A needs to output names of an $x$ - $y$ paths.

Game B Let Game B be the same as Game A, except that $\mathcal{R}$ wins if it outputs the name of any vertex of degree at least $4$ , i.e., $\{t_{1},t_{2},\ldots,t_{n}\}$ or the name of the vertex $p_{n/2}$ , or a cycle among the vertices visited by $\mathcal{R}$ .

To prove the classical lower bound for the pathfinding problem, it suffices to show that $\mathcal{R}$ cannot win this easier Game B in subexponential time. Following [4], the condition that allows $\mathcal{R}$ to win by finding a cycle in Game B simplifies the analysis. One key concept in [4] is the random embedding of a rooted binary tree. To analyze the success probability of $\mathcal{R}$ in Game B, we restate the defintion of a random embedding of a rooted binary tree as follows:

Definition 4.1 (Random embedding of a rooted binary tree).

Given the name of the starting vertex $x$ , the random embedding of a rooted binary tree $T$ into the graph $G$ is defined as a function $\pi$ from the vertices of $T$ to the vertices of $G$ such that

1.

$\pi(\textit{ROOT})=x$ .
2.

Let $i$ and $j$ be the two neighbors of $ROOT$ in $T$ and let $u$ and $v$ be the neighbors of $x$ in $G$ . With probability $1/2$ set $\pi(i)=u$ and $\pi(j)=v$ , and with probability $1/2$ set $\pi(i)=v$ and $\pi(j)=u$ .
3.

For any non-leaf vertex $i$ in $T$ , let $j$ and $k$ denote the children of vertex $i$ , and let $\ell$ denote the parent of vertex $i$ . Let $u$ and $v$ be the two neighbors of $\pi(i)$ in $G$ other than $\pi(\ell)$ . With probability $1/2$ set $\pi(i)=u$ and $\pi(j)=v$ , and with probability $1/2$ set $\pi(i)=v$ and $\pi(j)=u$ .

We say that an embedding $\pi$ is proper if it is injective, that is for any $i,j\in T$ , we have $\pi(i)\neq\pi(j)$ if $i\neq j$ . We say that $T$ exits under $\pi$ if, for any $i\in T$ , the degree of $\pi(i)$ in $G$ is at least $4$ or $\pi(i)$ is $p_{n/2}$ or $y=p_{n}$ .

Theorem 4.2.

If $\mathcal{R}$ uses $2^{n/6}$ queries to the oracle $O$ , then its probability of finding an $s$ - $t$ path is at most $2(n+1)\cdot 4\cdot 2^{-n/6}$ .

Proof.

To obtain an upper bound of the probability of $\mathcal{R}$ for solving the pathfinding problem, it suffices to show that the probability of $\mathcal{R}$ finding the certain set of vertices, that is $p_{n/2}$ and vertices that have degrees at least $4$ , is at most $2(n+1)\cdot 4\cdot 2^{-n/6}$ .

1.

Given the name of the starting vertex $s$ , the upper bound of the probability of $\mathcal{R}$ winning Game $B$ can be expressed as the probability that the embedding $\pi$ is improper or $T$ exits $G$ under $\pi$ using the result of [4, Equation 72, Lemma 7]. This comes from the fact that there exists an algorithm $\mathcal{R}^{\prime}$ to generate a random rooted binary tree by simulating any classical algorithm $\mathcal{R}$ for Game B.

Let $T$ be a random rooted binary tree with at most $2^{n/6}$ vertices and $\pi(T)\subseteq V$ be the image in the graph $G$ under the random embedding $\pi$ . We have the following result:
1. (a)
  
  First, it is unlikely that $\pi(T)$ contains a vertex with degree at least $4$ , i.e., $\{t_{1},t_{2},\ldots,t_{n}\}$ or a cycle. For the vertices $\{t_{1},t_{2},\ldots,t_{n}\}$ and the cycles in $G$ can only be located by entering a welded tree graph. This is true because, as indicated in Figure 1, the vertices that have a degree at least $4$ are the roots $t_{i}$ , and the path $P_{n}$ with the $n$ welded trees form a tree structure. Lemma 2.3 shows that any classical algorithm that makes at most $2^{n/6}$ queries to the oracle $O$ can find a root $t_{i}$ or a cycle in a single welded tree graph $W^{i}$ with probability at most $4\cdot 2^{-n/6}$ . Since there are $n$ welded trees and $n$ vertices of degree at least $4$ in the welded tree path graph $G$ , the union bound ¹¹1The union bound states that the probability of at least one event occurring is at most the sum of the probability of each event: $\Pr[\text{at least one success}]\leq\sum_{i=1}^{n}\Pr[\text{success in tree $i$}]$ . implies that the
  
  $\Pr[\mathcal{R}\text{ finds a cycle or $t_{i},1\leq i\leq n$}]\leq n\cdot 4\cdot 2^{-n/6}.$
2. (b)
  
  The probability of $\pi(T)$ contains the vertex $p_{n/2}$ is exponentially small. Consider a path in $T$ from the root to a leaf. To reach the vertex $p_{n/2}$ , $\pi$ must follow the path $P_{n}$ $\frac{n}{2}$ times, which has probability $2^{-n/2}$ . Since there are at most $2^{n/6}$ tries on each path of $T$ and there are at most $2^{n/6}$ paths. The probability of finding the name of the vertex $p_{n/2}$ is at most $2^{-n/6}$ , that is,
  
  $\Pr[\mathcal{R}\text{ finds }p_{n/2}]\leq 2^{n/6}\cdot 2^{n/6}\cdot 2^{-n/2}=2^{-n/6}.$
Therefore, by the union bound, given the name of the starting vertex $s$ , the probability of $\mathcal{R}$ finding the vertex $p_{n/2}$ , a cycle, or a vertex of degree at least $4$ is at most $(n+1)\cdot 4\cdot 2^{-n/6}$ .
2.

By symmetry structure of the welded tree path graph,, the same bound also holds when the only given name is the vertex $y$ .

Hence, given the names of $x$ and $y$ and by union bound, the probability of $\mathcal{R}$ uses $2^{n/6}$ queries to the oracle $O$ to find a cycle, the vertex $p_{n/2}$ , or a vertex with a degree at least $4$ is at most $2(n+1)\cdot 4\cdot 2^{-n/6}$ . That is, $\mathcal{R}$ cannot win Game A in subexponential time. ∎

5 Discussion

In this paper, we show that the pathfinding problem in the graph $G$ admits an exponential separation between quantum and classical algorithms under the adjacency list oracle. The key idea is to encode the path information into $n$ distinct welded trees, in which quantum algorithms can extract the path information efficiently by distinguishing the $n$ distinct welded trees but no classical algorithm can do this in polynomial time. In fact, there are more types of graphs to show an exponential separation of the pathfinding problem as long as they satisfy this property, for example, replacing the random cycle at the top of the graph $G$ with an arbitrary graph. Also, using the continuous quantum walk approach, [34] exhibits a superpolynomial quantum-classical separation to find a vertex in random hierarchy graphs. Therefore, we can also replace the welded trees with random hierarchy graphs to achieve quantum-classical separation for the pathfinding problem.

Moving forward, we provide several open problems related to the quantum advantages of pathfinding problems in more types of graphs that do not have the properties used in this paper.

•

The welded tree path graph $G$ we constructed in our paper is not regular, which is the structure that our quantum algorithm exploits to run efficiently. However, isogeny graphs, such as the Cayley graph and supersingular graphs, are examples of regular graphs. It would be intriguing to explore whether there exist regular graphs that exhibit exponential separations between quantum and classical algorithms.
•

In addition to achieving exponential speedups, exploring and characterizing polynomial speedups of quantum algorithms for the pathfinding problem in various types of graphs is a promising and exciting future direction.

Acknowledgements

J.L. would like to thank Sean Hallgren, Andrew Childs, Yi-Kai Liu, Daochen Wang, Sebastian Zur and Guanzhong Li for their valuable feedback and conversations and Mingming Chen for assistance in drawing the figure. Part of this work was done while the author visited Quantum Information and Computer Science (QuICS) and the Simons Institute for the Theory of Computing. J.L. acknowledges funding from the National Science Foundation awards CCF-1618287, CNS-1617802, and CCF-1617710, and a Vannevar Bush Faculty Fellowship from the US Department of Defense.

References

[1] Daniel R. Simon. On the power of quantum computation. SIAM Journal on Computing, 26(5):1474–1483, 1997. Earlier version in FOCS’94.
[2] Peter W. Shor. Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer. SIAM Journal on Computing, 26(5):1484–1509, 1997. Earlier version in FOCS’94. arXiv: quant-ph/9508027
[3] Sean Hallgren. Polynomial-time quantum algorithms for pell’s equation and the principal ideal problem. Journal of the ACM (JACM), 54(1):1--19, 2007.
[4] Andrew M. Childs, Richard Cleve, Enrico Deotto, Edward Farhi, Sam Gutmann, and Daniel A. Spielman. Exponential algorithmic speedup by a quantum walk. In Proceedings of the 35th ACM Symposium on the Theory of Computing (STOC), pages 59--68, 2003. arXiv: quant-ph/0209131
[5] Shalev Ben-David, Andrew M. Childs, András Gilyén, William Kretschmer, Supartha Podder, and Daochen Wang. Symmetries, graph properties, and quantum speedups. In Proceedings of the 61st IEEE Symposium on Foundations of Computer Science (FOCS), pages 649--660, 2020. arXiv: 2006.12760
[6] Ewin Tang. A quantum-inspired classical algorithm for recommendation systems. In Proceedings of the 51st ACM Symposium on the Theory of Computing (STOC), pages 217--228, 2019. arXiv: 1807.04271
[7] Ewin Tang. Quantum principal component analysis only achieves an exponential speedup because of its state preparation assumptions. Physical Review Letters, 127(6):060503, 2021. arXiv: 1811.00414
[8] Nai-Hui Chia, András Gilyén, Tongyang Li, Han-Hsuan Lin, Ewin Tang, and Chunhao Wang. Sampling-based sublinear low-rank matrix arithmetic framework for dequantizing quantum machine learning. In Proceedings of the 52nd ACM Symposium on the Theory of Computing (STOC), page 387–400, 2020. arXiv: 1910.06151
[9] Yu-Ao Chen and Xiao-Shan Gao. Quantum algorithm for boolean equation solving and quantum algebraic attack on cryptosystems. Journal of Systems Science and Complexity, 35(1):373--412, 2022.
[10] Jintai Ding, Vlad Gheorghiu, András Gilyén, Sean Hallgren, and Jianqiang Li. Limitations of the macaulay matrix approach for using the hhl algorithm to solve multivariate polynomial systems. Quantum, 7:1069, 2023.
[11] Aram W. Harrow, Avinatan Hassidim, and Seth Lloyd. Quantum algorithm for linear systems of equations. Physical Review Letters, 103, 10 2009.
[12] Scott Aaronson. Open problems related to quantum query complexity. ACM Transactions on Quantum Computing, 2(4):1--9, 2021.
[13] Andrew M. Childs, Matthew Coudron, and Amin Shiraz Gilani. Quantum Algorithms and the Power of Forgetting. In 14th Innovations in Theoretical Computer Science Conference (ITCS 2023), volume 251, pages 37:1--37:22, 2023.
[14] Kirsten Eisenträger, Sean Hallgren, Chris Leonardi, Travis Morrison, and Jennifer Park. Computing endomorphism rings of supersingular elliptic curves and connections to path-finding in isogeny graphs. Open Book Series, 4(1):215--232, 2020.
[15] Denis X. Charles, Kristin E. Lauter, and Eyal Z. Goren. Cryptographic hash functions from expander graphs. Journal of Cryptology, 22:93--113, 1 2009.
[16] Anamaria Costache, Brooke Feigon, Kristin Lauter, Maike Massierer, and Anna Puskás. Ramanujan graphs in cryptography, 2018.
[17] Benjamin Wesolowski. The supersingular isogeny path and endomorphism ring problems are equivalent. In 2021 IEEE 62nd Annual Symposium on Foundations of Computer Science (FOCS), pages 1100--1111. IEEE, 2022.
[18] Samuel Jaques and John M Schanck. Quantum cryptanalysis in the ram model: Claw-finding attacks on sike. In Annual International Cryptology Conference, pages 32--61. Springer, 2019.
[19] Seiichiro Tani. Claw finding algorithms using quantum walk. Theoretical Computer Science, 410(50):5285--5297, 2009.
[20] Wouter Castryck and Thomas Decru. An efficient key recovery attack on sidh. In Annual International Conference on the Theory and Applications of Cryptographic Techniques, pages 423--447. Springer, 2023.
[21] Sarah Arpin, Mingjie Chen, Kristin E Lauter, Renate Scheidler, Katherine E Stange, and Ha TN Tran. Orientations and cycles in supersingular isogeny graphs. In Research Directions in Number Theory: Women in Numbers V, pages 25--86. Springer, 2024.
[22] Wouter Castryck, Tanja Lange, Chloe Martindale, Lorenz Panny, and Joost Renes. Csidh: an efficient post-quantum commutative group action. In Advances in Cryptology--ASIACRYPT 2018: 24th International Conference on the Theory and Application of Cryptology and Information Security, Brisbane, QLD, Australia, December 2--6, 2018, Proceedings, Part III 24, pages 395--427. Springer, 2018.
[23] Steven Galbraith. Breaking supersingular isogeny diffie-hellman (sidh), Aug 2022.
[24] Christoph Dürr, Mark Heiligman, Peter HOyer, and Mehdi Mhalla. Quantum query complexity of some graph problems. SIAM Journal on Computing, 35(6):1310--1328, 2006.
[25] Stacey Jeffery, Shelby Kimmel, and Alvaro Piedrafita. Quantum algorithm for path-edge sampling. arXiv preprint arXiv:2303.03319, 2023.
[26] Sean Hallgren and Jianqiang Li. Quantum algorithms for the pathfinding problem via the quantum electrical flow. Under preparation, 2023.
[27] Daniel Reitzner, Mark Hillery, and Daniel Koch. Finding paths with quantum walks or quantum walking through a maze. Physical Review A, 96(3):032323, 2017.
[28] Mark Hillery. Finding more than one path through a simple maze with a quantum walk. Journal of Physics A: Mathematical and Theoretical, 54(9):095301, 2021.
[29] Daniel Koch and Mark Hillery. Finding paths in tree graphs with a quantum walk. Physical Review A, 97(1):012308, 2018.
[30] Stacey Jeffery and Sebastian Zur. Multidimensional quantum walks. In Proceedings of the 55th Annual ACM Symposium on Theory of Computing, pages 1125--1130, 2023.
[31] Guanzhong Li, Jingquan Luo, and Lvzhou Li. Recover the original simplicity: concise and deterministic quantum algorithm for the welded tree problem. arXiv preprint arXiv:2304.08395, 2023.
[32] Ryan Babbush, Dominic W Berry, Robin Kothari, Rolando D Somma, and Nathan Wiebe. Exponential quantum speedup in simulating coupled classical oscillators. arXiv preprint arXiv:2303.13012, 2023.
[33] András Gilyén, Yuan Su, Guang Hao Low, and Nathan Wiebe. Quantum singular value transformation and beyond: exponential improvements for quantum matrix arithmetics. arXiv preprint arXiv:1806.01838, 2018.
[34] Shankar Balasubramanian, Tongyang Li, and Aram Harrow. Exponential speedups for quantum walks in random hierarchical graphs. arXiv preprint arXiv:2307.15062, 2023.