JP7101355B2 - Judgment device, calculation device, and learning system - Google Patents

Description

Application of Article 30, Paragraph 2 of the Patent Act (1) Date of issue November 26, 2018 Publications The Institute of Electronics, Information and Communication Engineers Quantum Information Technology Special Research Committee (co-sponsored by the Japan Society of Applied Physics Quantum Electronics Research Group) 39th Materials of the Japan Society of Applied Physics Information Technology, pp. 100-101

The present invention relates to a quantum calculation technique in which a calculation is performed by a quantum computer.

Quantum computers are expected to have computational power far surpassing current computers in some application areas. One of the famous quantum algorithms is the quantum algorithm published by Shor in 1994, which efficiently solves factorization and discrete logarithm problems. With this announcement as an opportunity, various quantum algorithms that draw out the computing power of quantum computers have been studied. In particular, research on quantum algorithms that solve combinatorial optimization problems at high speed, which cannot be solved efficiently by classical computers, is active. Recently, with the support of the recent boom in artificial intelligence, research on machine learning using quantum computers (quantum machine learning) has been attracting attention. Non-Patent Document 1 is a paper reviewing the latest research results on quantum machine learning.

Box 1 Table of Non-Patent Document 1 summarizes the comparison between quantum machine learning and classical machine learning. Some machine learning systems have been shown to be able to learn efficiently using quantum computers, such as learning linear support vector machines. A quantum algorithm called the HHL (Harrow-Hassidim-Lloyd) algorithm plays a central role in the application to these systems.
The HHL algorithm is based on the phase estimation algorithm, which is also used in Shor's algorithm, and enables efficient learning of linear systems. However, systems such as deep neural networks, which have a wide range of industrial applications and the development of high-speed algorithms has a large impact on society, are generally non-linear and cannot be efficiently learned using the HHL algorithm.

Non-Patent Document 1 introduces learning of a classical Boltzmann machine and a quantum Boltzmann machine as an application to learning a nonlinear system of a quantum computer. Since learning with a quantum computer of a classical Boltzmann machine can be realized with only limited operations, experiments are being conducted using a quantum annealing machine (quantum annealers) that has already been commercialized. In addition, the learning of the quantum Boltzmann machine is still in the preparatory stage for experiments using hardware, but it has been theoretically proved that the amount of calculation and the number of data samples required for learning are √N. However, the Boltzmann machine is a kind of stochastic recurrent neural network, which is a special system as a neural network. The above quantum learning algorithm cannot be applied to the training of a feed-forword neural network, which is generally used as a deep neural network.

Learning the weights of each layer in a feedforward neural network can result in the problem of solving linear equations with errors. This is a problem similar to the lattice problem called LWE (Learning with Errors) used in next-generation post-quantum public-key cryptography and the like. The lattice problem represented by the shortest vector problem is a basic problem used in next-generation cryptography as well as artificial intelligence. Techniques for dealing with this on current computers (hereinafter also referred to as "classical computers") and quantum computers are being studied in detail. Hereinafter, the method using a classical computer and the method using a quantum computer will be described.

The most common classical algorithm for solving lattice problems is the lattice reduction algorithm. The lattice reduction algorithm calculates a new basis from the basis of a given vector space so that all the bases are approximately orthogonal to each other. To do this, all combinations of basis vectors are repeatedly subjected to an operation similar to Gram-Schmidt orthogonalization. In the worst case, the length of the shortest vector obtained by the grid reduction algorithm is exponentially larger than the length of the shortest vector to be obtained.

As a quantum algorithm for solving a lattice problem, for example, the methods of Non-Patent Documents 3 and 4 have been proposed. In Non-Patent Document 3, a quantum state called Dihedral Coset State is recently created based on a vector problem, and a solution is obtained by using a quantum Fourier transform. In Non-Patent Document 4, a solution is searched for using probability amplitude amplification. However, neither method is guaranteed to solve the lattice problem efficiently. In other words, no quantum algorithm has been found to efficiently solve the lattice problem.

Jacob Biamonte, Peter Wittek, Nicola Pancotti, Patrick Rebentrost, Nathan Wiebe, Seth Lloyd, Quantum Machine Learning, Nature 549, pp. 195-202. (2017). Doi: 10.1038 / nature23474. Aram W. Harrow, Avinatan Hassidim, Seth Lloyd, Quantum algorithm for solving linear systems of equations, Phys. Rev. Lett. Vol. 15, no. 103, pp. 150502 (2009) Oded Regev, Quantum Computation and Lattice Problems, SIAM Journal on Computing, Vol 33, No. 3, pp. 738-760, (2004). T. Laarhoven and M. Mosca and J. van de Pol, Finding shortest lattice vectors faster using quantum search, Designs, Codes and Cryptography, Vol 7. No 2, pp. 375-400 (2015).

An object of the present invention is to provide a solution of a distance comparison problem, which is an elemental method for solving a lattice problem at a higher speed than before by combining a classical computer and a quantum computer in a hybrid manner. For example, by having a classical computer take charge of light tasks and a quantum computer take charge of heavy tasks in the entire calculation process, it can be realized even with a quantum computer whose execution time cannot be lengthened due to decoherence due to noise, and in a shorter time than before. It provides a solution to a distance comparison problem that can be applied to find a solution to a grid problem.

の量子状態からなるレジスタを複数個生成する。第２量子状態生成部は、一部の量子状態｜φ＞_０のレジスタに量子操作を行い、量子操作が施されたレジスタの量子状態を

に遷移させる。第１スワップテスト部は、量子状態｜φ＞_０のレジスタと各量子状態｜φ＞_ｔ１のレジスタとの各ペアに対してスワップテストを実行し、量子状態｜φ＞_０と量子状態｜φ＞_ｔ１とのペアに対するスワップテストの結果が受理となるか拒否となるかを判定する。第３量子状態生成部は、

の量子状態からなるレジスタを複数個生成する。第４量子状態生成部は、一部の量子状態｜φ＞_０のレジスタに量子操作を行い、量子操作が施されたレジスタの量子状態を

に遷移させる。第２スワップテスト部は、量子状態｜φ＞_０のレジスタと量子状態｜φ＞_ｔ２のレジスタとの各ペアに対してスワップテストを実行し、量子状態｜φ＞_０と量子状態｜φ＞_ｔ２とのペアに対するスワップテストの結果が受理となるか拒否となるかを判定する。第２古典計算部は、スワップテストの結果を用いて、量子状態｜φ＞_０と量子状態｜φ＞_ｔ１とのペアに対するスワップテストの結果が受理となる確率ｐ_１と、量子状態｜φ＞_０と量子状態｜φ＞_ｔ２とのペアに対するスワップテストの結果が受理となる確率ｐ_２を計算し、ｐ_１≧ｐ_２の場合に||ｔ１^（ｄ）||≦||ｔ２^（ｄ）||であることを表す情報を出力し、ｐ_１＜ｐ_２の場合に||ｔ１^（ｄ）||＞||ｔ２^（ｄ）||であることを表す情報を出力するか、または、ｐ_１＞ｐ_２の場合に||ｔ１^（ｄ）||＜||ｔ２^（ｄ）||であることを表す情報を出力し、ｐ_１≦ｐ_２の場合に||ｔ１^（ｄ）||≧|ｔ２^（ｄ）||であることを表す情報を出力する。ただし、ｎ，Ｎが正の整数であり、ｉ＝１，…，ｎであり、ｉ_ｍが虚数単位であり、η^Ｔがηの転置であり、｜Λ｜がΛの要素数であり、||η||がηの長さであり、＜τ，χ＞がτとχとの内積であり、η１⊆η２はη１がη２の部分集合であることを表し、Ｂ＝｛ｂ_１，…，ｂ_ｎ｝が一次独立なｎ次元ベクトルｂ_ｉからなる基底であり、ｎ次元ベクトルｂ_ｉのそれぞれがｎ個の整数要素からなり、Ｌ（Ｂ）が格子｛Σ_{ｉ＝１，…，ｎ} ｘ_ｉｂ_ｉ｜ｘ_ｉ∈Ｚ，ｂ_ｉ∈Ｂ｝であり、Ｌ（Ｂ^－）が基底Ｂと整数Ｎとに対して定義されるＮに関する双対格子であり、ｘ_ｉが整数であり、Ｂ^－がＢのＮに関する双対基底であり、Ｒ⊆Ｚ^ｎが整数要素からなるｎ次空間に属する部分領域であり、ｔ１＝（ｔ_１，１，…，ｔ_１，ｎ）^Ｔがｎ個の整数要素ｔ_１，ｉからなる目標ベクトルであり、ｔ２＝（ｔ_２，１，…，ｔ_２，ｎ）^Ｔがｎ個の整数要素ｔ_２，ｉからなる目標ベクトルであり、ｔ１^（ｄ）が目標ベクトルｔ１と目標ベクトルｔ１の最近ベクトルｔ１^（ｃ）∈Ｌ（Ｂ）との差分ベクトルｔ１^（ｄ）＝ｔ１－ｔ１^（ｃ）＝（ｔ_１，１ ^（ｄ），…，ｔ_１，ｎ ^（ｄ））であり、ｔ２^（ｄ）が目標ベクトルｔ２と目標ベクトルｔ２の最近ベクトルｔ２^（ｃ）∈Ｌ（Ｂ）との差分ベクトルｔ２^（ｄ）＝ｔ２－ｔ２^（ｃ）＝（ｔ_２，１ ^（ｄ），…，ｔ_２，ｎ ^（ｄ））である。 The first classical calculation unit uses the basis B and the integer N to obtain and output the dual basis B ⁻ . The first quantum state generator is

Generate multiple registers consisting of the quantum states of. The second quantum state generator performs a quantum operation on some of the quantum states | φ> ₀ registers, and changes the quantum states of the quantum-operated registers.

To transition to. The first swap test unit executes a swap test for each pair of the quantum state | φ> ₀ register and each quantum state | φ> _t1 register, and the quantum state | φ> ₀ and the quantum state | φ>. It is determined whether the result of the swap test for the pair with _t1 is accepted or rejected. The third quantum state generator is

Generate multiple registers consisting of the quantum states of. The fourth quantum state generator performs a quantum operation on a part of the quantum state | φ> ₀ register, and changes the quantum state of the quantum-operated register.

To transition to. The second swap test unit executes a swap test for each pair of the quantum state | φ> ₀ register and the quantum state | φ> _t2 register, and the quantum state | φ> ₀ and the quantum state | φ> _t2 . Determines whether the result of the swap test for the pair with is accepted or rejected. The _second classical calculator uses the results of the swap test to determine the probability p1 that the result of the swap test for the pair of quantum state | φ> ₀ and quantum state | φ> _t1 is accepted, and the quantum state | φ>. Calculate the probability p2 that the result of the swap test for the _pair of ₀ and the quantum state | φ> _t2 is accepted, and when p ₁ ≧ p ₂ , || t1 ^(d) || ≦ || t2 ^(d) The information indicating that it is || is output, and when p ₁ <p ₂ , || t1 ^(d) ||> || t2 ^(d) || is output, or the information indicating that it is || is output. When p ₁ > p ₂ , the information indicating that || t1 ^(d) || <|| t2 ^(d) || is output, and when p ₁ ≤ p ₂ , || t1 ^(d) | | ≧ | t2 ^(d) || Outputs information indicating that. However, _n and N are positive integers, i = 1, ..., N, im is an imaginary unit, η ^T is a translocation of η, and | Λ | is the number of elements of Λ. || η || is the length of η, <τ, χ> is the inner product of τ and χ, η1 ⊆ η2 means that η1 is a subset of η2, and B = {b ₁ ,, ..., b _{n }} is a base consisting of linearly independent n-dimensional vectors bi, each of the _n -dimensional vectors bi consists of n integer elements, and L (B) is a lattice {Σ _{i = 1, ..., n} x _i bi | x _i ∈ Z, bi ∈ B _} , where L (B ⁻ _{) is a dual lattice for N defined for the base B and the integer N, and x i is} an integer. , B ^- is a dual basis for N of B, R⊆Zn is a subregion belonging to the ^nth -order space consisting of integer elements, and t1 = (t _1,1 , ..., t _{1, n} ) ^T is n. It is a target vector consisting of t _{1, 1, i} integer elements, and t2 = (t 2, ₁ , ..., T _{2, n} ) ^T is a target vector consisting of n integer elements t _{2, i} , and t1 ⁽ . ^d) is the difference vector between the target vector t1 and the recent vector t1 ^(c) ∈ L (B) of the target vector t1 t1 ^(d) = t1-t1 ^(c) = (t _1,1 ^(d) , ..., T _{1, n} ^(d) ), where t2 ^(d) is the difference vector between the target vector t2 and the recent vector t2 ^(c) ∈ L (B) of the target vector t2 t2 ^(d) = t2-t2 ^(c) = (T _2,1 ^(d) , ..., t _{2, n} ^(d) ).

In this way, the present invention can solve the distance comparison problem. By using this, the lattice problem can be solved at high speed.

FIG. 1 is a conceptual diagram showing the correspondence relationship of each embodiment. FIG. 2 is a conceptual diagram showing the correspondence relationship of each embodiment. FIG. 3 is a block diagram illustrating the functional configuration of the determination device of the embodiment. FIG. 4 is a block diagram illustrating the functional configuration of the quantum calculation unit of the embodiment. FIG. 5 is a diagram illustrating a quantum circuit for performing a swap test of the embodiment. FIG. 6 is a diagram for explaining a specific example of the embodiment. FIG. 7 is a block diagram illustrating the functional configuration of the arithmetic unit of the embodiment. FIG. 8 is a conceptual diagram for explaining the generation of child nodes in the embodiment. FIG. 9 is a conceptual diagram for explaining the generation of child nodes in the embodiment. FIG. 10 is a block diagram illustrating the functional configuration of the arithmetic unit of the embodiment. FIG. 11 is a block diagram illustrating the functional configuration of the arithmetic unit of the embodiment. FIG. 12 is a diagram for explaining a specific example of the embodiment. FIG. 13 is a diagram for explaining a specific example of the embodiment. FIG. 14 is a conceptual diagram showing the correspondence relationship of each embodiment. FIG. 15 is a conceptual diagram illustrating the configuration of a feedforward neural network. FIG. 16 is a block diagram illustrating the functional configuration of the learning device of the embodiment.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
In the embodiment, for example, a new quantum calculation method for accelerating the learning of a feedforward neural network is provided. Learning the weights of each layer in a feedforward neural network can result in the problem of solving linear equations with errors. This is a problem similar to the lattice problem called LWE (Learning with Errors) used in next-generation post-quantum public-key cryptography and the like. Therefore, first, the element method used to solve the lattice problem at high speed with the quantum computing device and the method of solving the lattice problem using it will be described (first to eighth embodiments), and the quantum computing device is applied. A learning system for learning a feedforward neural network will be described (9th embodiment). While backpropagation, which is generally used in the learning of feedforward neural networks, cannot easily escape from the locally optimal solution in the learning process, the learning system proposed in the ninth embodiment makes use of the characteristics of quantum physics. High speed is realized by searching for the optimum solution globally. Since the lattice problem dealt with in this embodiment is an NP-hard problem, the proposed method can be widely applied not only to learning a feedforward neural network but also to a combinatorial optimization problem in general.

[Definition]
Define terms used in embodiments.
n, m, m', M, N, N'are positive integers. i = 1, ..., n, j = 1, ..., m, u = 1, ..., n. s is an n-dimensional vector consisting of integer elements. r _ji ^(c) , r _ji ^(d) , r _j0 , X _j , di, _{g i ,} and _ej are integers. L and γ are positive real numbers. a _j is an n-dimensional vector a _j = (a _1j , ..., a _nj ) ^T consisting of n integer elements a _1j , ..., a _nj . g is an n-dimensional vector g = (g ₁ , ..., gn) ^T consisting of _n elements g ₁ , ..., G _n . ε _u is an n-dimensional unit vector ε _u = (0, ..., 1,0, ..., 0) ^T in which the u-th element is 1 and the other elements are 0.

η ^T represents the transpose of η. η is a vector or matrix. | Λ | represents the number of elements in the set Λ. ABS (μ) represents the absolute value of μ. || η || represents the norm of η. For example, || η || represents the Euclidean norm (length) of η. round (μ) is the integer closest to μ. That is, round represents a rounding function. floor (μ) is the largest integer less than or equal to μ. That is, floor represents the floor function. ceil (μ) is the smallest integer greater than or equal to μ. That is, ceil represents the ceiling function. λ ∈ Λ means that λ is an element of the set Λ. <τ, χ> represents the inner product of the vector τ and the vector χ. det (η) represents the determinant of η. | Δ> represents a vertical vector indicating the quantum state corresponding to δ. | δ ₁ > | δ ₂ > represents the tensor product of | δ ₁ > and | δ ₂ >.

B = {b ₁ , ..., b _n } is a basis consisting of _n linearly independent n-dimensional vectors bi (that is, B is a linearly independent n n-dimensional vectors b ₁ , ..., b _n . It is a set). _n -dimensional vector bi = (bi ₁ , ..., _bin ) ∈ Z Each of ⁿ consists of n _integer elements bi ₁ , ..., bin ∈ Z. Z represents a set of integers. β is an n-by-n matrix having n-dimensional vectors b ₁ , ..., B _n of the basis B as elements. This β is called the basis matrix of basis B. For example, β is the following matrix having the n-dimensional vector bi as the component (row vector) of the _i -th row.

t = (t ₁ , ..., t _n ) ^T is a target vector consisting of _n integer elements ti ∈ Z.

である。 L (B) is a lattice {Σ _{i = 1, ..., n} x _i bi | x _i ∈ Z, bi ∈ B _} . However, _xi is an integer. That is,

Is.

For the n-dimensional vector t and the grid L (B), τ + L (B) represents a set obtained by translating all the grid points of the grid L (B) by the n-dimensional vector τ. That is, τ + L (B) = {τ + χ | χ ∈ L (B)}. Further, τ + L (B) = L (B) + τ.

である。Ｒｅは実数の集合を表す。 The hyperplane created by the subset B'of the basis B is referred to as H (B'). The hyperplane H (B') is a vector space {Σ _{i = 1, ..., n} ζ _i b _i '| ζ _i ∈ Re, b, which is stretched by the vector bi'∈ B', which is an element of the subset B'. It means _i'∈ B'}. However, ζ _i is a real number. That is,

Is. Re represents a set of real numbers.

t is an n-dimensional vector t = (t ₁ , ..., t _n ) ^T consisting of _n integer elements t ₁ , ..., T n. The origin of the n-dimensional vector t is any lattice point (point on the lattice L (B)). The vector from the origin to the grid points is called the grid point vector.

<Grid problem>
The lattice problem dealt with in the embodiment will be briefly described. See references 1 and 2 for more details.
[Reference 1] Daniele Micciancio and Shafi Goldwasser, Complexity of Lattice Problems: a cryptographic perspective, Kluwer Academic Publishers, The Kluwer International Series in Engineering and Computer Science, vol. 671 (2002).
[Reference 2] Cohen, Henri, A Course in Computational Algebraic Number Theory,
Springer-Verlag New York, Inc., ISBN 0-387-55640-0 (1993).

≪Shortest vector problem (SVP) ≫
The shortest vector problem is a problem of finding the grid point closest to the origin in the grid L (B) (the vector from the origin to the grid point closest to the origin, that is, the shortest vector) when the basis B is given. be. When the ratio of the length of the shortest vector to the length of the vector second closest to the origin in the grid L (B) is γ or more, the shortest vector problem is called the γ-unique SVP. The shortest vector problem is NP-hard, and the difficulty of the problem can be adjusted by changing γ. It is known that the shortest vector problem can be reduced to the following vector problem in polynomial time. Therefore, the vector problem these days is more difficult than the shortest vector problem.

≪Recently Vector Problem (CVP) ≫
The recent vector problem is a recent vector t ^{(recent vector t (} B) on the lattice L (B) such that the difference vector from the target vector t is the shortest when a set (B, t) of the basis B and the target vector t is given. ^c) It is a problem to find ∈ L (B). The recent vector problem for a set (B, t) is referred to as CVP (B, t). Recently, the vector t ^(c) ∈ L (B) is the lattice point vector closest to the target vector t. t ^(d) is the difference vector between the target vector t and the recent vector t ^(c) ∈ L (B) t ^(d) = tt ^(c) = (t ₁ ^(d) , ..., t _n ^(d) ) Represents ^T. Such a difference vector t ^(d) is called a shortest difference vector. When the ratio of the lengths of the shortest difference vector t ^(d) = tt ^(c) and the difference vector between the target vector t and the lattice point vector second closest to the target vector t is γ or more, the latest vector. The problem is called γ-gap CVP. Recently, the Rounding-Off algorithm and Nearest Plane algorithm proposed by Babai are known as classical algorithms for solving vector problems approximately.
[Reference 3] L. Babai, On Lovasz Lattice Reduction and the Nearest Lattice Point Problem, Combinatorica, Vol. 6, No. 1, pp.1-13, (1986).
However, the approximations of the solutions obtained by these algorithms are 1 + 2n (9/2) ^{n / 2} and 2n / ² , respectively, both of which guarantee only an exponential approximation of the dimension.

Recently, the following GapCVP _γ is known as a more basic problem than the vector problem. While the vector problem is a search problem these days, GapCVP _γ is a decision problem (a problem that answers Yes / No).

なら、ＧａｐＣＶＰ_γはＮＰ困難であることが知られている。
［参考文献４］Dinur, I. and Kindler, G. and Safra, S., Approximating-CVP to Within Almost-Polynomial Factors is NP-Hard, Proceedings of the 39th Annual Symposium on Foundations of Computer Science, FOCS '98, IEEE Computer Society, Washington, DC, USA, pp.99-111 (1998).
逆にγ≧√ｎの場合、ＧａｐＣＶＰ_γはＮＰ困難でないと予想されている。
［参考文献５］岡本龍明，“応用数理の散歩道(79) これからの暗号”， 応用数理， Vol. 24, No. 3, pp. 36-39, December, (2014). ≪GapCVP _γ≫
GapCVP _γ is either dist (B, t) ≤ L or dist (B, t)> γL when a set (B, t) of a basis B and a target vector t and a length L are given. It is a decision problem to determine whether the vector (B, t) ≤ L (Yes instance) or the dust (B, t)> γL (No instance) under the promise that it is always correct. Here, the dust (B, t) is the length of the shortest difference vector t ^(d) (that is, || t ^(d) ||). The smaller the γ, the more difficult the GapCVP _γ becomes.

If so, GapCVP _γ is known to be NP-hard.
[Reference 4] Dinur, I. and Kindler, G. and Safra, S., Approximating-CVP to Within Almost-Polynomial Factors is NP-Hard, Proceedings of the 39th Annual Symposium on Foundations of Computer Science, FOCS '98, IEEE Computer Society, Washington, DC, USA, pp.99-111 (1998).
On the contrary, when γ ≧ √n, GapCVP _γ is not expected to be NP-hard.
[Reference 5] Tatsuaki Okamoto, "Applied Mathematics Walkway (79) Future Cryptography", Applied Mathematics, Vol. 24, No. 3, pp. 36-39, December, (2014).

While SVP, CVP, and GapCVP _γ are lattice problems that have been studied for a long time, the following LWE is a relatively recently proposed problem. Since LWE is used in promising next-generation cryptography, it has been studied in detail alongside the above problems.
[Reference 6] Oded Regev, On Lattices, Learning with Errors, Random Linear Codes, and Cryptography, J. ACM, Vol 56, No. 6, 34: 1-34: 40 (2009).

によりｇ＝（ｇ_１，…，ｇ_ｎ）^Ｔを定めたとき、（Ａ，ｇ，Ｎ）からＸを求める問題である。ただし、Ｘ_ｊは整数である。ｄが分かれば（３）からＸも計算できるため、ｄを求めてもよい。 ≪LWE (Learning with Errors) ≫
LWE is a positive integer m, n, N, n × m random matrix A = (a _ij ) (i = 1, ..., n, j = 1, ..., M) of integer elements, m-dimensional random vector X. = (X ₁ , ..., X _m ) ^T , and a short vector d = (d ₁ , ..., d _n ) ^T where each element follows a Gaussian distribution

When g = (g ₁ , ..., _gn ) ^T is determined by, it is a problem to obtain X from (A, g, N). However, X _j is an integer. If d is known, X can also be calculated from (3), so d may be obtained.

In general, {x ∈ Z ⁿ | <x, b> ∈ Z for all b ∈ L (B)} is called the "dual lattice" of the lattice L (B).
[Reference 7] Daniele Micciancio and Shafi Goldwasser, Complexity of Lattice Problems: a cryptographic perspective, Kluwer Academic Publishers, The Kluwer International Series in Engineering and Computer Science, vol. 671 (2002).

The "dual grid for N" introduced in each embodiment is different from this general "dual grid". The reason for introducing the dual lattice with respect to N is that the result of performing the N-dimensional quantum Fourier transform for all the coordinate axes in the superposition state of the lattice is the superposition of the dual lattice with respect to N. The LLL irreducible basis of the dual lattice for N will be referred to as the "dual basis for N". See pages 33-35 of Reference 1 for the definition of the LLL irreducible basis. It is known that when the LLL algorithm is applied to an arbitrary basis, a basis satisfying the definition of an LLL irreducible basis can be obtained (References 1 and 2.2). Therefore, by applying the LLL algorithm to the basis of the dual lattice for N, an irreducible basis for N can be obtained. The dual basis for N can be efficiently calculated using the Hermite Normal Form.

≪Dual lattice about N≫
For the basis B and the integer N, the lattice defined by {τ ∈ Z ⁿ | <τ, χ> = 0 mod N for all χ ∈ L (B)} is defined as "dual lattice for N (dual lattice in method N)". Is called. The LLL irreducible basis of the dual lattice of the lattice L (B) with respect to N is written as B- ^and is called a dual basis (dual basis with respect to N). The " ^- " in the upper right subscript of "B-" should be written directly above "B", but it may be written in the upper right of "B" due to the limitation of the description notation.

In each embodiment, the concept of "transformation LWE" is introduced using the concept of dual basis for N. As will be described later, a quantum computer can be used to efficiently obtain the modified LWE from CVP and LWE, and a classical computer can be used to efficiently determine whether the length of the modified LWE solution is L or less or larger than γL. Can be determined.

で近似できることが知られている。ここで、ｄｅｔ（Ｂ）は格子の基底が作る行列の行列式である。この値

はGaussian heuristicと呼ばれる（例えば、参考文献１１の３４４ページを参照）。ｍ”とｎ”をｍ”≧ｎ”を満たす正の整数とする。ｍ”×ｎ”整数行列Ａ”＝（ａ”_σξ）_{１≦σ≦ｍ”，１≦ξ≦ｎ”}が（行）エルミート標準形（HNFと略される）とは、整数１≦ｒ”≦ｎ”と単調増加関数ｆ：｛１，…，ｎ”－ｒ”｝→｛１，…，ｍ”｝（すなわちｆ（σ＋１）＞ｆ（σ））が存在して以下が成立することである。
１．最後のｒ”行の要素が０である。
２．１≦ξ＜σに対して０≦ａ”_{ξｆ（σ）}＜ａ”_{σｆ（σ）}であり、σ＜ξ≦ｎ”に対してａ”_{ξｆ（σ）}＝０である。したがって、エルミート標準形は次の形で書ける。

ｍ”×ｎ”整数行列Ａ”＝（ａ”_σξ）_{１≦σ≦ｍ”，１≦ξ≦ｎ”}に対して、唯一のエルミート標準形のｍ”×ｎ”整数行列Ａ_Ｈと、ｍ×ｍユニモジュラ（unimodular）行列Ｕ（唯一とは限らない）が存在し、
ＵＡ”＝Ａ_Ｈ
が成立する。ここで、ユニモジュラ行列とは、行列式が＋１または－１（ゆえに可逆）な整数要素の正方行列である。Ｕは変換行列（transforming matrix）と呼ばれる。エルミート標準形の整数行列Ａ_Ｈと変換行列Ｕは、整数行列Ａ”から効率的に計算できることが知られている。
ｍ”とｎ”がｍ”≧ｎ”を満たす正の整数であるとき、ｍ”×ｎ”整数行列Ａ”＝（ａ”_σξ）_{１≦σ≦ｍ”，１≦ξ≦ｎ”}がスミス標準形であるとは、この整数行列Ａ”が以下の形に書けることをいう。

ただし、ｋ”はｎ”以下の整数であり、ａ”_１１，…，ａ”_ｋ”ｋ”はすべての１≦σ”＜ｋ”に対してａ”_σσ｜ａ”_{σ＋１ σ＋１}を満足する。またこの行列の空白部分の要素はすべて０である。なお、「γ１｜γ２」はγ２がγ１で割り切れることを表す。例えば、整数行列Ａ”の対角要素が 1, 1, 3, 6, 24, 168, 0, 0, 0ならばすべてのσ=1,2,…,8に対してａ”_σσ｜ａ”_{σ＋１ σ＋１}を満たすためＡ”はスミス標準形であるが、整数行列Ａ”の対角要素が1, 1, 3, 6, 24, 128 , 0, 0, 0ならσ=5に対してａ”_σσ｜ａ”_{σ＋１ σ＋１}を満たさないためＡ”はスミス標準形ではない。
ｍ”×ｎ”整数行列Ａ”＝（ａ”_σξ）_{１≦σ≦ｍ”，１≦ξ≦ｎ”}に対して唯一のスミス標準形Ａ_Ｓとユニモジュラ行列Ｕ，Ｖ（唯一とは限らない）が存在して
ＵＡ”Ｖ＝Ａ_Ｓ
が成り立つことが知られている。Ｕ，Ｖは変換行列と呼ばれる。エルミート標準形と同様、Ａ”からスミス標準形と変換行列Ｕ，Ｖを効率的に計算できることが知られている。 Details of the Extended Euclidean algorithm, Smith Normal Form, and Hermite Normal Form are described in the following documents, for example.
[Reference 8] Cohen, Henri, A Course in Computational Algebraic Number Theory, Springer-Verlag New York, Inc., ISBN 0-387-55640-0 (1993).
[Reference 9] Ravindran Kannan and Achim Bachem, Polynomial Algorithms for Computing the Smith and Hermite Normal Forms of an Integer Matrix, SIAM Journal on Computing, vol. 8, No. 4, pp. 499-507, (1979).
[Reference 10] Storjohann, Arne, Near Optimal Algorithms for Computing Smith Normal Forms of Integer Matrices, Proceedings of the 1996 International Symposium on Symbolic and Algebraic Computation, ISSAC '96, pp. 267-274 (1996).
[Reference 11] Galbraith, Steven D., Mathematics of Public Key Cryptography, Cambridge University Press, ISBN 978-1107013926 (2012).
The Hermite normal form and the Smith normal form are explained.
The length of the shortest vector of a random n-dimensional lattice is

It is known that it can be approximated by. Here, det (B) is the determinant of the matrix created by the basis of the lattice. This value

Is called a Gaussian heuristic (see, eg, page 344 of reference 11). Let m "and n" be positive integers satisfying m "≧ n". m "x n" integer matrix A "=" (a " _σξ ) 1≤σ≤m" _{, 1≤ξ≤n "} is (row) Hermite normal form (abbreviated as HNF) is an integer 1≤r" ≤n "and monotonically increasing function f: {1, ..., n" -r "} → {1, ..., m"} (that is, f (σ + 1)> f (σ)) exists and the following holds. Is.
1. 1. The element of the last r "row is 0.
2.1 For ≦ ξ <σ, 0 ≦ a ” _{ξf (σ)} <a” _{σf (σ)} , and for σ <ξ ≦ n ”, a” _{ξf (σ)} = 0. Therefore, the Hermite normal form can be written in the following form.

For m "x n" integer matrix A "= (a" _σξ ) _{1 ≤ σ ≤ m ", 1 ≤ ξ ≤ n"} , the only Hermite normal form m "x n" integer matrix A _H and m × m There is a unimodular matrix U (not necessarily the only one),
UA "= A _H
Is established. Here, the unimodular matrix is a square matrix of integer elements whose determinant is +1 or -1 (hence reversible). U is called a transforming matrix. It is known that the Hermite normal form integer matrix A _H and the transformation matrix U can be efficiently calculated from the integer matrix A ”.
When m "and n" are positive integers satisfying m "≥n", m "x n" integer matrix A "= (a" _σξ ) 1≤σ≤m ", 1≤ξ≤n _" is Smith. The standard form means that this integer matrix A "can be written in the following form.

However, k "is an integer less than or equal to n", and a " ₁₁ , ..., A" _{k "k"} satisfies a " _σσ | a" _{σ + 1 σ + 1} for all 1 ≦ σ ”<k”. Also, all the elements in the blank part of this matrix are 0. In addition, "γ1 | γ2" means that γ2 is divisible by γ1. For example, if the diagonal elements of the integer matrix A "are 1, 1, 3, 6, 24, 168, 0, 0, 0, then a" _σσ | a "for all σ = 1, 2, ..., 8 _{σ + 1} A "is the Smith standard form to satisfy σ + 1, but if the diagonal elements of the integer matrix A" are 1, 1, 3, 6, 24, 128, 0, 0, 0, then a "for σ = 5". _{Since σσ} | a " _{σ + 1 σ + 1} is not satisfied, A" is not a Smith standard form.
m "x n" integer matrix A "=" (a " _σξ ) _{1 ≤ σ ≤ m", 1 ≤ ξ ≤ n "} , the only Smith normal form _AS and the unimodular matrix U, V (not the only one) Not) exists and UA "V = _AS
Is known to hold. U and V are called transformation matrices. It is known that the Smith normal form and the transformation matrices U and V can be efficiently calculated from A "as in the Hermite normal form.

[First Embodiment]
In the first embodiment, the distance comparison problem is solved by a calculation by a quantum computer (quantum calculation) and a calculation by a classical computer (classical calculation) (FIGS. 1 and 2). The distance comparison problem is a problem of determining (determining) which of the two vectors has the closest distance to the vector in the closest L (B).

<Structure>
As illustrated in FIG. 3, the determination device 7 of this embodiment has a classical calculation unit 71, 73 (first and second classical calculation units), a quantum calculation unit 72, and a control unit 74. As illustrated in FIG. 4, the quantum calculation unit 72 of the present embodiment includes quantum state generation units 72a and 72b (first to fourth quantum state generation units) and a swap test unit 72c (first and second swap test units). Have. The determination device 7 executes each process under the control of the control unit 74. The classical calculation units 71 and 73 have a plurality of arithmetic units, and the quantum state generation units 72a and 72b and the swap test unit 72c have a plurality of quantum calculation units (not shown).

<Processing>
The processing of this embodiment will be described.
The determination device 7 of the present embodiment has a basis B, a target vector t1 = (t _1,1 , ..., T1 _{, n} ) ^T composed of n integer elements t _{1, i} , and n integer elements t _{2, 2.} The target vector t2 = (t _2,1 , ..., ^t _{2, n} ) consisting of _i is used as an input, and the classical calculation and quantum calculation described below are performed, and || t1 ^(d) || and || t2 ^{( d)} Determine which of || is larger. Note that t1 ^(d) is a difference vector between the target vector t1 and the latest vector t1 ^(c) ∈ L (B) of the target vector t1 t1 ^(d) = t1-t1 ^(c) = (t _1,1 ^(d)). , ..., t _{1, n} ^(d) ). t2 ^(d) is the difference vector between the target vector t2 and the recent vector t2 ^(c) ∈ L (B) of the target vector t2 t2 ^(d) = t2-t2 ^(c) = (t _2,1 ^(d) , ... , T _{2, n} ^(d) ). n, N are positive integers, i = 1, ..., n, η ^T is the translocation of η, || η || is the length of η, and B = {b ₁ , ..., b _{n }} is a basis consisting of linearly independent n-dimensional vectors bi, and each of the _n -dimensional vectors bi consists of n integer elements. β is an n-row, n-column basis matrix (n × n matrix) having n-dimensional vectors b ₁ , ..., B _n of the basis B as elements. For example, β is the following matrix having the n-dimensional vector bi as the component (row vector) of the _i -th row.

<< Processing of classical calculation unit 71 >>
The arithmetic unit of the classical calculation unit 71 (FIG. 3) of the determination device 7 selects an integer N (step S711). For example, the classical calculation unit 71 sets the common multiple of the denominator of the non-zero element of the inverse matrix β ^-1 of the basis matrix β to the integer N. There are an infinite number of such common multiples, but an arbitrarily selected number may be fixed to an integer N. For example, the classical calculation unit 71 sets the least common multiple of the denominator of the non-zero element of the inverse matrix β ^-1 of the basis matrix β to an integer N.

をエルミート分解し、

を満たす２ｎ×２ｎユニモジュラ行列Ｕと、エルミート標準形の２ｎ×ｎ行列Ｈを計算する。さらに古典計算部７１は、ユニモジュラ行列Ｕの右下ｎ×ｎ部分行列を

と設定する。ただし、ｕ_ｉはｎ次元ベクトル（ｎ次元行ベクトル）である。古典計算部７１は、｛ｕ_１，…，ｕ_ｎ｝のＬＬＬ既約基底を計算し、このＬＬＬ既約基底を双対基底Ｂ^－＝｛ｂ^－ _１，…，ｂ^－ _ｎ｝として出力する。双対基底Ｂ^－のｎ次元ベクトルｂ^－ _１，…，ｂ^－ _ｎを要素とするｎ行ｎ列の基底行列（ｎ×ｎ行列）をβ^－と表記する。例えば、β^－はｎ次元ベクトルｂ^－ _ｉをｉ行目の成分（行ベクトル）とする以下の行列である。

Further, the arithmetic unit of the classical calculation unit 71 uses the basis B and the integer N to obtain and output the dual basis B ⁻ with respect to N of B (step S712). Note that L (B) is a lattice {Σ _{i = 1, ..., n} x _i bi | x _i ∈ Z, bi ∈ B _} , x _i is an integer, and L (B ⁻ ) is the basis B. And a dual lattice with respect to N defined for the integer N. The superscript " ^- " of "B-" should be written directly above "B", but due to the limitation of the description notation, it is written diagonally above the right of "B". For example, the classical calculation unit 71 calculates the dual basis B ⁻ as follows. The classical calculation unit 71 is an n-row, 2n-column matrix (n × 2n matrix) obtained by arranging NI and B in the row direction, and is expressed as (NI B). However, I is an n-dimensional identity matrix. The classical calculation unit 71 is a transposed matrix of this matrix (NI B).

Hermitian disassembled

A 2n × 2n unimodular matrix U satisfying the condition and a Hermite normal form 2n × n matrix H are calculated. Further, the classical calculation unit 71 sets the lower right n × n submatrix of the unimodular matrix U.

And set. However, _ui is an n-dimensional vector (n-dimensional row vector). The classical calculation unit 71 calculates the LLL irreducible basis of {u ₁ , ..., _Un }, and outputs this LLL irreducible basis as _a dual basis B ⁻ = {b ^-1 , ..., b ⁻ _n }. The n-by ^{-n basis matrix (n × n matrix) having n-dimensional vectors b-1, ..., b- n of} _the ^dual _basis B- is expressed as β-. For example, β ⁻ is the following matrix having the n-dimensional vector b ⁻ _i as the component (row vector) of the i-th row.

<< Processing of quantum calculation unit 72 >>
The quantum calculation unit 72 (FIG. 4) takes the dual basis B ⁻ and the target vectors t1 and t2 as inputs, and for an appropriate region (a subregion belonging to the nth-order space consisting of integer elements) R⊆Zn in the ⁿ -dimensional space. The following process is executed, and the result of the swap test is output (step S72). For example, R ⊂ Z ⁿ . η1 ⊆ η2 indicates that η1 is a subset of η2, and η1 ⊂ η2 indicates that η1 is a true subset of η2.

ただし、Ｒ_[０，Γ）は０以上Γ未満の実数を表し、ｘ"_j"は実数であり、Γは２以上の整数であり、例えばΓ＝２である。
あるいは、例えば、以下の領域Ｒ（ΓＢ^－*）を領域Ｒとしてもよい。

ただし、Ｂ^－*は双対基底Ｂ^－のGram-Schmidt非正規化直交ベクトルｂ^－* _１，…，ｂ^－* _ｎからなる基底Ｂ^－*＝｛ｂ^－* _１，…，ｂ^－* _ｎ｝を表す。ｂ^－* _１，・・・，ｂ^－* _ｎはｂ^－ _１，・・・，ｂ^－ _ｎを適当な順序に並べ、Gram-Schmidt直交化法を使って直交化することで得られる。ｂ^－* _ｉのそれぞれはｎ個の整数要素からなるｎ次元ベクトルである。なお、これらの領域Ｒは本発明を限定するものではない。 For example, the following region R (ΓB ⁻ ) can be defined as region R.

However, R _{[0, Γ)} represents a real number of 0 or more and less than Γ, x "_j" is a real number, and Γ is an integer of 2 or more, for example, Γ = 2.
Alternatively, for example, the following region R (ΓB ^{− *} ) may be used as the region R.

However, B- ^* is a basis B- ^* = {b- ^* ₁ , ..., b- ^* _n } consisting of the Gram ^- Schmidt denormalized orthogonal vector b- ^* ₁ , ..., b- ^* _n of the dual basis B-. Represents. b- ^* ₁ , ..., b- ^* _n can be obtained by arranging b ^- ₁ , ..., b ^- _n in an appropriate order and orthogonalizing them using the Gram-Schmidt orthogonalization method. Each of b- ^* _i is an n-dimensional vector consisting of n integer elements. It should be noted that these regions R do not limit the present invention.

である量子状態（通常、複数の量子ビットで構成される）からなるレジスタを複数個生成（準備）する。ただし、｜Λ｜はΛの要素数を表す（ステップＳ７２ａ－１）。 The quantum calculation unit 72 performs the following calculation.
(A-1) The quantum state generation unit 72a of the quantum calculation unit 72 has a quantum state.

Generate (prepare) a plurality of registers consisting of quantum states (usually composed of a plurality of qubits). However, | Λ | represents the number of elements of Λ (step S72a-1).

例えば、量子状態生成部７２ｂは、ステップＳ７２ａ－１で作成された量子状態｜φ＞_０のレジスタのうち半分のレジスタに量子操作を行う。ただし、＜τ，χ＞はτとχとの内積であり、ｉ_ｍは虚数単位を表す。ここで用いる量子操作とは、例えば、ｉ＝１，…，ｎについて以下で表される量子回転ゲート、つまりｎ種類の量子回転ゲートである。

以上により、量子操作がされないレジスタは量子状態｜φ＞_０であり、量子操作がされたレジスタは量子状態｜φ＞_ｔ１となる。以下、便宜上、量子状態｜φ＞_０のレジスタを第１レジスタ、量子状態｜φ＞_ｔ１のレジスタを第２レジスタと呼ぶこととすると、第１レジスタと第２レジスタはそれぞれ複数あってもよく、第１レジスタと第２レジスタの数が同数であることが好ましい。 (B-1) The quantum state generation unit 72b performs a quantum operation on a register of some quantum states | φ> ₀ (step S72b-1). As a result, the quantum state of the register subjected to quantum operation transitions (changes) to the following state.

For example, the quantum state generation unit 72b performs a quantum operation on half of the registers of the quantum state | φ> ₀ created in step S72a-1. However, <τ, χ> is the inner product of τ and _χ , and im represents an imaginary unit. The quantum operation used here is, for example, a quantum rotation gate represented by the following for i = 1, ..., N, that is, n kinds of quantum rotation gates.

As a result, the quantum-operated register has a quantum state | φ> ₀ , and the quantum-operated register has a quantum state | φ> _t1 . Hereinafter, for convenience, if the register with the quantum state | φ> ₀ is referred to as the first register and the register with the quantum state | φ> _t1 is referred to as the second register, there may be a plurality of first register and second register, respectively. It is preferable that the number of the first register and the number of the second register are the same.

(C-1) The swap test unit 72c executes a swap test for each pair with a register having a quantum state | φ> ₀ and a register having a quantum state | φ> _t1 as a pair, and a swap test for each pair. It is determined whether the result of is accepted (0, Yes) or rejected (1, No). Since the swap test is a well-known test method, detailed description thereof will be omitted. For example, the swap test unit 72c includes the Hadamard gates 721c and 723c, the control swap gate 722c, and the observation gate 724c as illustrated in FIG. Swap test is performed by the quantum operation corresponding to the quantum circuit. Specifically, the swap test unit 72c applies the adamar gate 721c to the qubit I (one qubit) of the qubit | 0>, and the qubit II (usually a plurality of qubits II) of the qubit | φ> ₀ . Qubit) and qubit | φ> _t = | φ> _t1 qubit III (usually multiple qubits) and qubit I, with qubit II and qubit III as control bits, qubit I Accept (0, Yes) or reject (1, No) by applying the control swap gate 722c with ) And output.

である量子状態（通常、複数の量子ビットで構成される）からなるレジスタを複数個生成（準備）して出力する（ステップＳ７２ａ－２）。 Further, the quantum calculation unit ₇₂ calculates the probability p2 as follows.
(A-2) The quantum state of the quantum state generation unit 72a of the quantum calculation unit 72 is

A plurality of registers composed of quantum states (usually composed of a plurality of qubits) are generated (prepared) and output (step S72a-2).

例えば、量子状態生成部７２ｂは、量子状態｜φ＞_０のレジスタのうち半分のレジスタに量子操作を行うことで量子状態｜φ＞_ｔ２のレジスタを得る。ここでの量子操作は、例えば以下で表される量子回転ゲートである。

以上により、量子操作がされないレジスタは量子状態｜φ＞_０であり、量子操作がされたレジスタは量子状態｜φ＞_ｔ２となる。以下、量子状態｜φ＞_０のレジスタを第１レジスタ、量子状態｜φ＞_ｔ２のレジスタを第３レジスタと呼ぶこととすると、第１レジスタと第３レジスタはそれぞれ複数あってもよく、第１レジスタと第３レジスタの数が同数であることが好ましい。 (B-2) The quantum state generation unit 72b performs a quantum operation on a register of some quantum states | φ> ₀ (step S72b-2). As a result, the quantum state of the register subjected to quantum operation transitions (changes) to the following state.

For example, the quantum state generation unit 72b obtains a register of quantum state | φ> _t2 by performing a quantum operation on half of the registers of quantum state | φ> ₀ . The quantum operation here is, for example, a quantum rotation gate represented by the following.

As a result, the quantum-operated register has a quantum state | φ> ₀ , and the quantum-operated register has a quantum state | φ> _t2 . Hereinafter, assuming that the register of quantum state | φ> ₀ is referred to as the first register and the register of quantum state | φ> _t2 is referred to as the third register, there may be a plurality of first register and third register, respectively, and the first register may be present. It is preferable that the number of registers and the number of third registers are the same.

(C-2) The swap test unit 72c executes a swap test for each pair with a register having a quantum state | φ> ₀ and a register having a quantum state | φ> _t2 as a pair, and a swap test for each pair. It is determined whether the result of is accepted (0, Yes) or rejected (1, No). The swap test unit 72c outputs the result obtained by performing the swap test for each of the plurality of pairs.

<< Processing of classical calculation unit 73 >>
Using the result output from the quantum calculation unit 72, the classical calculation unit 73 has a probability p ₁ that the result of the swap test for the pair of the quantum state | φ> ₀ and the quantum state | φ> _t1 is accepted, and the quantum. Calculate the probability p2 that the result of the swap test for the _pair of state | φ> ₀ and quantum state | φ> _t2 is accepted. Then, the classical calculation unit 73 outputs information indicating that || t1 ₍ ^d) || ≦ || t2 ₍ ^d) || when _p1 ≧ p2, and when _p1 <p2. Outputs information indicating that || t1 ^(d) ||> || t2 ^(d) ||. Alternatively, the classical calculation unit 73 outputs information indicating that || t1 ^(d) || <|| t2 ^(d) || in the case of p ₁ > p ₂ , and in the case of p ₁ ≤ p ₂ . Information indicating that || t1 ^(d) || ≧ | t2 ^(d) || is output to || (step S73).

この領域Ｒ（２Ｂ^－）は基底Ｂ^－が張るｎ次元空間におけるｎ次元平行多面体の内部領域である。
≪領域の例２≫

この領域Ｒ（２Ｂ^－*）は基底Ｂ^－が張るｎ次元空間におけるｎ次元立方体の内部領域である。
以下では、上記の２種類の領域Ｒ＝Ｒ（２Ｂ^－），Ｒ（２Ｂ^－*）について

で定義された量子状態｜φ＞_０の効率的な生成方法を例示する。 <Selection of region R and corresponding quantum state | φ> Example of efficient creation method of ₀ >
Next, an efficient method for creating the region R and the corresponding quantum state | φ> ₀ will be illustrated.
In the following, a case where the region R is defined as in Examples 1 and 2 below will be illustrated.
<< Example of area 1 >>

This region R (2B ⁻ ) is an internal region of an n-dimensional parallel polyhedron in the n-dimensional space stretched by the basis B ⁻ .
<< Example 2 of the area >>

This region R (2B ^{− *} ) is an internal region of an n-dimensional cube in the n-dimensional space stretched by the basis B ⁻ .
In the following, the above two types of regions R = R ( ^2B- ) and R (2B- ^* )

An efficient method for generating the quantum state | φ> ₀ defined in is illustrated.

<< Example of efficient generation method of quantum state | φ> ₀ in region example 1 >>
The arithmetic unit of the classical calculation unit 71 sets the common multiple of the denominator of the non-zero element of the inverse matrix β ^-1 of the basis matrix β to an integer N. For example, the classical calculation unit 71 sets the least common multiple of the denominator of the non-zero element of the inverse matrix β ^-1 of the basis matrix β to the integer N (step S711). Further, the arithmetic unit of the classical calculation unit 71 uses the basis B and the integer N, and obtains and outputs the dual basis B ⁻ with respect to N of B as described above (step S712).

これは、Ｌ（Ｂ^－）の格子点を重ね合せ状態で表現したものに相当する。 The quantum state generation unit 72a generates a quantum state | φ> ₀ by the following procedure (step S72a-1).
1. 1. The quantum state generation unit 72a prepares a quantum bit string (first register) composed of the following quantum superposition states in a quantum state space having ^Nn dimensions.

This corresponds to the representation of the L (B ⁻ ) grid points in a superposed state.

ここで、

とは、

を満たす唯一の行ベクトルｙのことである。したがって、

は基底Ｂ^－が張る空間の座標系におけるベクトルｘの終点の座標である。この量子操作により第１レジスタと第２レジスタの量子状態は以下の状態に変換される。

とすると、式（１２）は

と書ける。 2. 2. The quantum state generation unit 72a converts the following conversions into the first register of the quantum state of the equation (11) and the newly prepared quantum bit (second register) of the initialized quantum state | 0>. Perform quantum operations corresponding to.

here,

Is

It is the only row vector y that satisfies. therefore,

Is the coordinates of the end point of the vector x in the coordinate system of the space spanned by the basis B ⁻ . By this quantum operation, the quantum states of the first register and the second register are converted into the following states.

Then, equation (12) is

Can be written.

これにより、第１レジスタと第２レジスタと第３レジスタの量子状態は以下の状態に変換される。

3. 3. The quantum state generation unit 72a is further represented by the following with respect to the first register and the second register of the quantum state of the equation (13) and the newly prepared n initialized quantum bit strings (third register). Quantum operation.

As a result, the quantum states of the first register, the second register, and the third register are converted into the following states.

を観測し、観測値をｚ_１，…，ｚ_ｎを得る。観測後の第１レジスタと第２レジスタの量子状態は以下の状態となる。

ここで

とすると、

である。すると、以下の性質が成立する。
R(2B^-)∩L (B^-)=[0,N)ⁿ∩L_n+1(B^-) (15A) 4. The quantum state generator 72a is the third register of the equation (14).

Is observed, and the observed values are z ₁ , ..., _Zn . The quantum states of the first register and the second register after observation are as follows.

here

Then

Is. Then, the following properties are established.
R ( ^2B- ) ∩L (B- ⁾ = [0, N) ⁿ ∩L _{n + 1} (B- ⁾ (15A)

で表される量子操作を行う。これにより、第２レジスタが消去され、第１レジスタは以下の量子状態となる。

5. The quantum state generation unit 72a relates to the first register and the second register of the quantum state of the equation (15).

Perform the quantum operation represented by. As a result, the second register is erased, and the first register is in the following quantum state.

で表される量子操作を行う。これにより、第１レジスタの量子状態は以下の状態となる。

式(15A)の性質により、式（１７）の量子状態は

と等しいことが言える。つまり、以上の操作により、量子状態｜φ＞_０が得られたことになる。 6. The quantum state generator 72a refers to the first register.

Perform the quantum operation represented by. As a result, the quantum state of the first register becomes the following state.

Due to the nature of equation (15A), the quantum state of equation (17) is

Can be said to be equal to. That is, the quantum state | φ> ₀ is obtained by the above operation.

が成り立つ。ただし、ｊ”＝ｎ－１，ｎ－２，…，１である。また

はベクトルｂ^－ _ｊ”のｂ^－* _ｊ”への射影である。したがって、

である。ただし、Ｑは有理数の集合を表す。有理数を要素とする上半三角行列Ａ”を以下のように定義する。

すると、式（１９）より、

が成立する。ｂ^－* _１，…，ｂ^－* _ｎは直交ベクトルなので、これらを正規化した要素を行ベクトルとした行列

は直交行列である。 << Example of efficient generation method of quantum state | φ> ₀ in region example 2 >>
The definition of the region R (2B ^{− *} ) depends on the order of orthogonalization of the dual basis B ⁻ to the n-dimensional vectors b ^- ₁ , ..., b ⁻ _n . In this example, for the sake of simplicity, b- ^* ₁ , ..., b- ^* _n are obtained by orthogonalizing b ^- ₁ , ..., b ^- _n in the reverse order, that is, in the order of b ^- _n , ..., b ^- ₁ . , Quantum state | φ> ₀ is illustrated. From the definition of b- ^* ₁ , ..., b- ^* _n

Is true. However, j "= n-1, n-2, ..., 1 is also satisfied.

Is a projection of the vector b ^- _{j "} on b- ^* _j" . therefore,

Is. However, Q represents a set of rational numbers. The upper half triangular matrix A "with rational numbers as elements is defined as follows.

Then, from equation (19),

Is established. Since b- ^* ₁ , ..., b- ^* _n are orthogonal vectors, a matrix whose normalized elements are row vectors.

Is an orthogonal matrix.

The arithmetic unit of the classical calculation unit 71 sets the common multiple of the denominator of the non-zero element of the inverse matrix β -1 of the base matrix β (which may be the ^inverse matrix β ^-1 of the base matrix β ⁻ ) to an integer N. For example, the classical calculation unit 71 sets the least common multiple of the denominator of the non-zero element of the inverse matrix β ^-1 of the basis matrix β to the integer N (step S711). Further, the arithmetic unit of the classical calculation unit 71 uses the basis B and the integer N, and obtains and outputs the dual basis B ⁻ with respect to N of B as described above (step S712).

これは、Ｌ（Ｂ^－）の格子点を重ね合せ状態で表現したものに相当する。 The quantum state generation unit 72a generates a quantum state | φ> ₀ by the following procedure (step S72a-1).
1. 1. The quantum state generation unit 72a prepares the following quantum bit strings (first register) in the quantum superposition state in the quantum state space having ^Nn dimensions.

This corresponds to the representation of the L (B ⁻ ) grid points in a superposed state.

で表される量子操作を行う。ここで、ｘ＝（ｘ_１，…，ｘ_ｎ）のとき

であるとする。この量子操作によって第１レジスタと第２レジスタの量子状態は以下の状態となる。

ｙ＝（ｙ'_ｘ，１，…，ｙ'_ｘ，ｎ）＝ｘ・Ｕとすると、この量子状態は

と表現できる。式（２４）の量子状態を｜Ψ_１＞と表記する。 2. 2. The quantum state generation unit 72a relates to the first register of the quantum state of the equation (23) and one newly prepared qubit (second register).

Perform the quantum operation represented by. Here, when x = (x ₁ , ..., X _n )

Suppose that By this quantum operation, the quantum states of the first register and the second register become the following states.

If y = (y'x _{, 1} , ..., y'x _{, n} ) = x · U, then this quantum state is

Can be expressed as. The quantum state of equation (24) is expressed as | Ψ ₁ >.

と表現される量子状態である。ただし、

とする。
（ａ）量子状態生成部７２ａは、量子状態｜Ψ_ｉ＞の第１レジスタおよび第２レジスタと、新たに用意した１個の初期化された量子ビット（第３レジスタ）に対し、以下の量子状態に変換する量子操作を行う。

（ｂ）量子状態生成部７２ａは、第３レジスタの量子ビットを観測する。観測により得られる観測値をｚ_ｉとし、観測後の第１レジスタおよび第２レジスタからなる量子状態を｜Ψ_ｉ＋１＞とする。 3. 3. The quantum state generation unit 72a executes the following operations (a) and (b) for i = 1, ..., N, and changes | Ψ ₁ > to | Ψ ₂ >, | Ψ ₃ >, ... By converting the quantum state to, the quantum state | Ψ _{n + 1} > is finally obtained. Here, | Ψ _i > means that the observed values z ₁ , ..., _Zn obtained by observing the third register of the above equation (14) are used.

It is a quantum state expressed as. however,

And.
(A) The quantum state generation unit 72a has the following quanta with respect to the first and second registers of the quantum state | Ψ _i > and one newly prepared initialized qubit (third register). Perform a quantum operation to convert to a state.

(B) The quantum state generation unit 72a observes the qubit of the third register. Let _zi be the observed value obtained by the observation, and let | Ψ _{i + 1} > be the quantum state consisting of the first register and the second register after the observation.

で表される量子操作を行う。これにより、第２レジスタが消去され、第１レジスタは以下の量子状態となる。

4. The quantum state generation unit 72a with respect to the obtained quantum state | Ψ _{n + 1} >

Perform the quantum operation represented by. As a result, the second register is erased, and the first register is in the following quantum state.

で表される量子操作を実行する。これにより、第１レジスタの量子状態は以下の状態に変化する。

式（２７）の量子状態は

と等しいため、以上の操作により、量子状態｜φ＞_０が得られたことになる。 5. The quantum state generator 72a refers to the first register.

Perform the quantum operation represented by. As a result, the quantum state of the first register changes to the following state.

The quantum state of equation (27) is

Therefore, the quantum state | φ> ₀ is obtained by the above operation.

であり、最近ベクトルｔ１^（ｃ）＝（４０，２０），ｔ２^（ｃ）＝（３４，５７）、差分ベクトル（最短差分ベクトル）ｔ１^（ｄ）＝（１，２），ｔ２^（ｄ）＝（－５，０）である。 <Specific example>
Next, a specific example of this embodiment will be shown. Here, a calculation example of the probabilities p1 and p2 for n _{= 2} , B = {(8,4), (6, -5)}, t1 = (41,22), t2 = (29,57). show. However, the basis matrix is

Recently, the vector t1 ^(c) = (40,20), t2 ^(c) = (34,57), the difference vector (shortest difference vector) t1 ^(d) = (1,2), t2 ^(d) = (-5,0).

を得る。６４の倍数なら整数Ｎとして何を選んでもよいが、最も簡単な例としてＮ＝６４が選択されたとする（ステップＳ７１１）。 << Processing of classical calculation unit 71 >>
The classical calculation unit 71 calculates the inverse matrix β -1 of the basis matrix β, and calculates the inverse matrix β ^-1 .

To get. Any integer N may be selected as long as it is a multiple of 64, but it is assumed that N = 64 is selected as the simplest example (step S711).

である。行列Ａ’のエルミート標準形は上半三角行列

であり、ユニモジュラ行列

に対してＵ・Ａ’＝Ａ”が成立する。このＵの右下の２×２部分行列の行ベクトルの集合｛（１，１４），（０，６４）｝は、格子Ｌ（Ｂ）のＮに関する双対格子（法Ｎにおける双対格子）の基底である。ＬＬＬアルゴリズムを用いて｛（１，１４），（０，６４）｝のＬＬＬ既約基底を計算すると｛（５，６），（４，－８）｝が得られる。従って、双対基底Ｂ^－＝｛（５，６），（４，－８）｝とする。また双対基底Ｂ^－の基底ベクトル（５，６），（４，－８）を行ベクトルとする行列を

と表現する（ステップＳ７１２）。 Further, the arithmetic unit of the classical calculation unit 71 uses the basis B = {(8,4), (6, -5)} and the integer N = 64, and obtains the dual basis B ^- related to N of B as follows. Output. Let A'be the matrix (NI B) ^T. That is,

Is. Hermite normal form of matrix A'is the upper half triangular matrix

And the unimodular matrix

U ・ A'= A ”is established for. The set of row vectors {(1,14), (0,64)} of the 2 × 2 submatrix at the lower right of U is the lattice L (B). It is the basis of the dual lattice (dual lattice in the method N) for N. When the LLL irreducible basis of {(1,14), (0,64)} is calculated using the LLL algorithm, {(5,6), (4, -8)} is obtained. Therefore, the dual basis B ⁻ = {(5, 6), (4, -8)}. Also ^, the basis vector (5, 6), ( A matrix whose row vector is 4, -8)

Is expressed (step S712).

<< Processing of quantum calculation unit 72 >>
The quantum calculation unit 72 takes the dual basis B- ^and the target vectors t1 and t2 as inputs, executes the following processing for the region R = R ( ^2B- ), and obtains 0 (acceptance, Yes) with a probability p. ₁ and p ₂ are calculated and output (step S72). When R = R (2B ⁻ ), the following holds.

の量子状態がエンコードされた６個の量子ビットからなるレジスタを２個生成（合計１２個の量子ビットを生成）して出力する。ただし、－８や－２はそれぞれ５６（＝－８ ｍｏｄ ６４），６２（＝－２ ｍｏｄ ６４）としてエンコードされる（ステップＳ７２ａ－１）。 The quantum calculation unit 72 calculates the probability p ₁ as follows.
(A-1) The quantum state generation unit 72a of the quantum calculation unit 72 is

Generates two registers consisting of six qubits encoded by the quantum state of (a total of 12 qubits are generated) and outputs them. However, -8 and -2 are encoded as 56 (= -8 mod 64) and 62 (= -2 mod 64), respectively (step S72a-1).

これにより、回転ゲートを適用したレジスタの量子状態は、

となる。ただし、ｔ１＝（ｔ_１，１，ｔ_１，２）＝（４１，２２）である（ステップＳ７２ｂ－１）。 (B-1) The quantum state generation unit 72b applies the following two types of quantum rotation gates (the same number as the number of dimensions n of the lattice) to one register whose quantum state is | φ> ₀ .

As a result, the quantum state of the register to which the rotating gate is applied becomes

Will be. However, t1 = (t ₁ , 1, t 1, ₂ ) = (41, 22) (step S72b-1).

(C-1) The swap test unit 72c executes a swap test for each pair of the register of the quantum state | φ> ₀ and the register of the quantum state | φ> _t1 , and the result is accepted (0, Yes). (Step S72c-1), the determination result of whether or not the result is rejected (1, No) is obtained and output.

の量子状態がエンコードされた６個の量子ビットであるレジスタを２個生成（合計１２個の量子ビットを生成）して出力する。ただし、－８や－２はそれぞれ５６（＝－８ ｍｏｄ ６４），６２（＝－２ ｍｏｄ ６４）としてエンコードされる（ステップＳ７２ａ－２）。 The quantum calculation unit 72 performs the following calculation.
(A-2) The quantum state generation unit 72a of the quantum calculation unit 72 is

Generates two registers (a total of 12 qubits are generated), which are 6 qubits in which the quantum state of is encoded, and outputs them. However, -8 and -2 are encoded as 56 (= -8 mod 64) and 62 (= -2 mod 64), respectively (step S72a-2).

これにより、量子回転ゲートを適用したレジスタの量子状態は以下のようになる。

ただし、ｔ２＝（ｔ_２，１，ｔ_２，２）＝（２９，５７）である（ステップＳ７２ｂ－２）。 (B-2) The quantum state generator 72b applies the following two types of quantum rotation gates (for the number of dimensions) to one register (six qubits) whose quantum state is | φ> ₀ . do.

As a result, the quantum state of the register to which the quantum rotation gate is applied becomes as follows.

However, t2 = (t _2,1 , t _2,2 ) = (29,57) (step S72b-2).

(C-2) The swap test unit 72c executes a swap test for each pair of the quantum state | φ> ₀ of the register and the quantum state | φ> _t2 of the register, and the result is accepted (0, Yes). (Step S72c-2), the determination result of whether or not the result is rejected (1, No) is obtained and output.

ただし、前述のようにｉ_ｍは虚数単位である。また、Δ(B^-)はL(B^-)の単位平行多面体の頂点座標を列挙した行列である。よって以下が成り立つ。

目標ベクトルｔ２は（２９，５７）であるため、以下が成り立つ。

よって以下が成り立つ。

<< Processing of classical calculation unit 73 >>
_The classical calculation unit 73 calculates the values of the above _- mentioned probabilities p1 and p2 by using the determination result of the swap test unit 72c. Since the target vector t1 is (41,22), the following holds.

However, as described above, _im is an imaginary unit. Also, Δ (B- ⁾ is a matrix that lists the coordinates of the vertices of the unit parallel polyhedron of L (B- ⁾ . Therefore, the following holds.

Since the target vector t2 is (29,57), the following holds.

Therefore, the following holds.

The classical calculation unit 73 compares these with the probabilities p ₁ and p ₂ obtained in steps S72c-1 and S72c-2 as inputs. In this example, since p ₁ > p ₂ , the classical calculation unit 73 outputs information indicating that || t1 ^(d) || <|| t2 ^(d) || (step S73). FIG. ₆ illustrates the relationship between the density distribution of the probabilities p ₌ p1 and p2 and the target vectors t1 and t2 in this specific example. The closer to the grid points of the grid L (B) (B = (8,4), (6, -5)), the larger the value of p. In FIG. 6, the region where p is larger is colored darker. It can be seen from FIG. 6 that || t1 ^(d) || <|| t2 ^(d) ||.

[Second Embodiment]
In the second embodiment, the solution of a given n-dimensional recent vector problem (B, t) is calculated using the method of the first embodiment (FIG. 1). That is, for a given n-dimensional recent vector problem (B, t), the recent vector t ^{(B, c)} ∈ L (B) is obtained on the lattice L (B) using the method of the first embodiment. .. Recently, the vector is a vector such that the difference vector t ^{(B, d)} = tt ^{(B, c)} with the target vector t is the shortest. However, t = (t ₁ , ..., t _n ) ^T is a target vector consisting of _n integer elements ti. If there is no confusion even if B is not expressed in t (B, c ⁾ and t (B, ^d ), t ^{(B, c)} and t ^{(B, d)} are referred to as t ^(c) , respectively. And t ^(d) . Further, (B, t) = (B ₀ , t (0)).

In the present embodiment, in order to calculate the difference vector t ^(d) , the calculator uses a sequence of partial grids L (B) = L (B ₀ ) ⊃ L (B ₁ ) ⊃ L (of the grid L (B)). B ₂ ) ⊃ ・ ・ ・ (30)
(Η2 ⊃ η1 means that η1 is a true subset of η2), L ( _BD-1 ) / L ( _BD ) (where D is a positive integer, that is, D = 1, From the representative elements of coset {c _{D, 0} , c _{D, 1} , ..., c _{D, ν (D) -1} } in (2, ...), α (D) that satisfies the following (however, Find 0≤α (D) <ν (D)).
t ^{(B, d)} = (t (D-1) -c _{D, α (D)} ) ^{(BD, d)} (31)
However, ν (D) is a positive integer. Further, "BD" included in the superscript "(BD, d)" should be originally described as " _BD ", but due to the limitation of the description notation, it is described as "BD". That is, the superscript "( _BD , d)" represents "(BD, d)". Here, {c _{D, 0} , c _{D, 1} , ..., c _{D, ν (D) -1} } is a coset in L ( _BD-1 ) / L ( _BD ). c _{D, 0} , c _{D, 1} , ..., c _{D, ν (D) -1} } satisfies the following conditions 1 and 2.
Condition 1: (c _{D, 0} + L ( _BD )) ∪ (c _{D, 1} + L ( _BD )) ∪ ・ ・ ・ ∪ (c _{D, ν (D) -1} + L ( _BD )) = L ( _BD-1 )
Condition 2: For any κ1, κ2 (0 ≦ ∀κ1, κ2 ≦ ν (D)) of 0 or more and ν (D) or less, when κ1 ≠ κ2 (c _{D, κ1} + L ( _BD )) ∩ (C _{D, κ2} + L ( _BD )) is empty.
For α (D) selected by the search, t (D) = t (D-1) -c _D, k'is defined. However, k'= 0,1, ..., ν (D) -1. Then, from the equation (31), the difference vector t ^{(B, d)} can be expressed as follows.
t ^{(B, d)} = t (0) ^{(B0, d)} = t (1) ^{(B1, d)} = t (2) ^{(B2, d)} ... (32)
That is, the recent vectors t ^{(B0, c)} , t ⁽ in the recent vector problem (B ₀ , t (0)), (B ₁ , t (1)), (B ₂ , t (2)), ... The columns of t (0), t (1), t (2), ... Are selected so that ^{B1, c)} , t ^{(B2, c)} , ... Are invariant. In general, the greater the distance between the grids, the easier it is to calculate the vector these days. Therefore, if the search is executed to a sufficient depth _D , (BD, t (D)) can be solved in a short time by the classical algorithm. Therefore, the vector problem (B, t) has recently been solved by using the equation (32). ) Can be calculated by a classical computer.

In the present embodiment, the probability obtained from the result of the swap test described in the first embodiment is used as an evaluation function, and α (30) satisfying the equation (30) in the search interval 0 ≦ α (D) <ν (D). Search for D). First, select the column L (B) = L (B ₀ ) ⊃L (B ₁ ) ⊃ L (B ₂ ) ⊃ ... Of the partial grid of the grid L (B) of the equation (30). If this happens, a search error will occur due to an error in selecting the columns of the partial lattice. Therefore, at each depth D, a search is executed for a plurality of candidates of the partial lattice L ( _BD ), and the best partial lattice _BD is executed. And α (D). That is, the sequence of the partial grids of the grid L (B) of the equation (30) is not determined first, but is sequentially determined by the search process of each depth D = 1, 2, ....

<Structure>
As illustrated in FIG. 7, the arithmetic unit 8 of this embodiment has an initial setting unit 81, a base selection unit 82, a representative element selection unit 83, a child node generation unit 84, a classical calculation unit 87, a node selection unit 85, and a control unit. It has 86, a quantum calculation unit 72. The initial setting unit 81, the basis selection unit 82, the representative source selection unit 83, the child node generation unit 84, the classical calculation unit 71, the node selection unit 85, and the control unit 86 have a plurality of calculation units, and the quantum calculation unit 72. Has multiple quantum calculators (not shown).

<Processing>
The processing of this embodiment will be described.
<< Processing of initial setting unit 81 >>
The initial setting unit 81 takes a set (B, t) corresponding to the vector problem (B, t) as an input, and a node (B ₀ , t (0) consisting of a set of a basis B ₀ and a target vector t (0). )) = (B, t) is set and output. The initial setting unit 81 assigns a label representing (B ₀ , t (0)) to the generated node (B ₀ , t (0)) and stores them in a memory (not shown). Further, D = 1 is set (step S81).

<< Processing of base selection unit 82 >>
The basis selection unit 82 takes the basis _BD-1 as an input, selects the basis _BD of the partial lattice L ( _BD ) ⊂L (BD- ₁ ) of the lattice L ( _BD-1 ), and outputs it ( Step S82).

<< Processing of representative source selection unit 83 >>
The representative element selection unit 83 takes the grids L ( _BD ) and L ( _BD-1 ) as inputs, and represents the coset in L ( _BD-1 ) / L ( _BD ) that satisfies the above conditions 1 and 2. The elements c _{D, 0} , c _{D, 1} , ..., C _{D, ν (D) -1} are selected and output (step S83). Note that each representative element c _{D, 0} , c _{D, 1} , ..., C _{D, ν (D) -1} is an n-dimensional vector composed of integer elements.

<< Processing of child node generation unit 84 >>
As illustrated in FIGS. 8 and 9, the child node generation unit 84 has _BD , t (D-1), c _{D, 0} , c _{D, 1} , ..., C _{D, ν (D)-. With 1} as the input, as a child node of the node ( _BD-1 , t (D-1)), for k'= 0, 1, ..., Ν (D) -1, the node ( _BD , t (D-1)) ) -C _{D, k'} ) is generated. The child node generation unit 84 assigns a label representing ( _BD , t (D-1) -c _{D, k'} ) to the generated node ( _BD , t (D-1) -c _D , k'). Then, they are stored in a memory (not shown) (step S84).

<< Processing of classical calculation unit 87 >>
The classical calculation unit 87 uses the basis _BD and the integer N to generate and output a dual basis _BD ⁻ for N of _BD (step S87).

量子計算部７２は、第１実施形態のスワップテスト部７２ｃと同様の処理により、ｋ’＝０，１，…，ν（Ｄ）－１について、量子状態｜φ＞_Ｄ，０のレジスタと、量子状態｜φ＞_{ｔ（Ｄ，ｋ’）}のレジスタとの各ペアに対してスワップテストを実行し、量子状態｜φ＞_Ｄ，０と量子状態｜φ＞_{ｔ（Ｄ，ｋ’）}とのペアに対するスワップテストの結果が受理となるか不受理となるかの結果を得て出力する（ステップＳ８７２）。 The quantum state generation unit 72 performs the same processing as the processing of the quantum calculation unit 72 of the first embodiment, and obtains and outputs an observed value as a result of the swap test. However, in the first embodiment, the basis B is used, but in the quantum state generation unit 72 of the present embodiment, the basis _BD is used instead of the basis B.
Instead of the quantum state | φ> ₀ and | φ> _t1 generated for the basis B of the first embodiment, the processing of the quantum state generation unit 72 of the first embodiment is executed for the basis _BD in the present embodiment. When the obtained quantum states are expressed as | φ> _{D, 0} and | φ> _{t (D, k')} , each quantum state can be expressed as follows.

The quantum calculation unit 72 performs the same processing as the swap test unit 72c of the first embodiment to obtain a quantum state | φ> _{D, 0} register for k'= 0,1, ..., Ν (D) -1. Quantum state | φ> _{t (D, k')} Quantum state | φ> _{D, 0} and quantum state | φ> _{t (D, k')} The result of the swap test for the pair is accepted or rejected, and the result is obtained and output (step S872).

<< Processing of node selection unit 85 >>
The node selection unit determines the quantum state | φ> _{D, 0} and the quantum state | φ> _t from the result of the swap test which is the output of the quantum computing unit 72 for k'= 0,1, ..., Ν (D) -1. The probabilities p _{D, 0} , ..., p _{D, ν (D) -1} that the result of the swap test for the pair with _{(D, k')} is accepted are obtained, and the probabilities p _{D, 0} , ..., P _{D, ν} are obtained. (D) Select and output the node ( _BD , t (D-1) -c _{D, kmax} ) corresponding to the highest probability p _{D, kmax} among _-1 . However, kmax ∈ {0,1, ..., ν (D) -1} (step S85).

<< Processing of control unit 86 >>
The control unit 86 recently solved the vector problem ( _BD , t (D-1) -c _{D, kmax} ) by a well-known classical algorithm such as the nearest plane algorithm, and set it as t (D-1) -c _{D, kmax} . The shortest difference vector t ^{(BD, d)} with the grid L ( _BD ) is obtained. The control unit 86 determines that the obtained difference vector t ^{(BD, d)} is correct when the length of the difference vector t ^{(BD, d)} is smaller than the reference value, and when it is not, the difference vector t ⁽ It is judged that ^{BD, d)} is not correct. For example, the control unit 86 obtains the difference vector t ^{(BD, d)} when the length of the difference vector t ( _BD , d) is smaller than 2 ^{n / 2} times the shortest vector of the LLL irreducible basis of ^{BD. )} Is correct, and if not, it is determined that the difference vector t ^{(BD, d)} is not correct. When the control unit 86 determines that the obtained difference vector t ^{(BD, d)} is correct (when the length of the difference vector t ^{(BD, d)} is smaller than the reference value), the control unit 86 determines that the difference vector t (BD, ^d ) is correct. ⁾ Is output as the difference vector t ^(d) , and the recent vector t ^{(BD, c)} = tt ^{(BD, d)} ∈ L ( _BD ) is recently vector t ^(c) (that is, the recent vector problem (B). , T) is output as a solution) (Fig. 8: D = θ). On the other hand, when the control unit 86 determines that the obtained difference vector t ^{(BD, d)} is incorrect (when the length of the difference vector t ^{(BD, d)} is equal to or longer than the reference value), D + 1 is newly added. Let D be, and then t (D) = t (D-1) -c _{D, kmax} , and set the basis selection unit 82, the representative element selection unit 83, the child node generation unit 84, the classical calculation unit 87, the quantum calculation unit 72, and the node. Control is performed to re-execute each process (steps S82, S83, S84, S87, S872, S85, S86) of the selection unit 85 and the control unit 86 (step S86). That is, the process of steps S82, S83, S84, S87, S872, S85, and S86 is repeated with D + 1 as a new D and t (D) = t (D-1) -c _{D, kmax} . That is, the search of the search tree is continued.

[Standard method of steps S82 and S83]
The above-mentioned steps S82 and S83 may be executed by any method, and the following can be exemplified as standard methods of steps S82 and S83. However, this does not limit the present invention. B _D-1 = {b _D-1 , 1, ..., b _{D-1, n} }. However, for i = 1, ..., N, b _{D-1, i} are linearly independent n-dimensional vectors, and each of the n-dimensional vectors b _{D-1, i} consists of n integer elements. The base selection unit 82 selects an arbitrary positive integer ρ'(where 1 ≤ ρ'≤ n) and the prime number p', and _BD = {b _D-1 , 1, ..., b _{D-1, ρ'. -1} , p'b _{D-1, ρ'} , b _{D-1, ρ'+ 1} , ..., b _{D-1, n} }, and the representative element selection unit 83 is c _{D, k'} = κ'b _{D. -1, ρ'} (where κ'= 0,1, ..., p'-1) and ν (D) = p'.

[Third Embodiment]
In this embodiment, the processing of the second embodiment is used as a subroutine to solve the SVP (FIG. 1).

<Structure>
As illustrated in FIG. 10, the arithmetic unit 6 of this embodiment has a basis generation unit 61, a setting unit 62, a selection unit 63, and a control unit 65.

<Processing>
The calculation device 6 of this embodiment takes the basis B as an input and outputs the shortest vector t ^(c) to the grid point closest to the origin in the grid L (B).

First, the basis generation unit 61 sets Bi = {b ₁ , ..., bi _-1 , _2bi , bi _{+ 1} , ..., b _n } for all _i = 1, ..., N (step S61). ).

Next, the setting unit 62 sets B = _Bi and t = bi for _i = 1, ..., N, and requests the calculation device 8 described in the second embodiment to perform processing. The calculation device 8 performs the processing described in the second embodiment with B _{= Bi} and t = bi to obtain and output the difference vector t ^(d) . The setting unit 62 sets the difference vector t ^(d) obtained for B _{= Bi} and t ₌ bi to ti ( ^d) . As a result, the setting unit 62 obtains t ₁ ^(d) , ..., T _n ^(d) (step S62).

The selection unit 63 takes t ₁ ^(d) , ..., T _n ^(d) obtained by the setting unit 62 as an input, and is the shortest (length) among t ₁ ^(d) , ..., T _n ^(d) . The shortest vector) is output as the shortest vector t ^(c) (step S63).

を満たす（Ｘ_１，…，Ｘ_ｍ）^Ｔを得て出力する（図２）。ｎ，ｍ，Ｎは正の整数である。例えば、ｎ，ｍはｍ＜ｎを満たし、Ｎは素数である（なお、本発明のアルゴリズムはＮが素数でなくても適用可能である。すなわちＮが合成数でもよい）。ａ_ｊはｎ個の整数要素ａ_１ｊ，…，ａ_ｎｊからなるｎ次元ベクトルａ_ｊ＝（ａ_１ｊ，…，ａ_ｎｊ）^Ｔである。ｊ＝１，…，ｍである。例えば、ａ_１ｊ，…，ａ_ｎｊはＮ未満の非負整数である。（Ｘ_１，…，Ｘ_ｍ）^Ｔは整数要素Ｘ_１，…，Ｘ_ｍからなるｍ次元ベクトルである。例えば、Ｘ_１，…，Ｘ_ｍはＮ未満の非負整数である。ｇはｎ個の要素ｇ_１，…，ｇ_ｎからなるｎ次元ベクトルｇ＝（ｇ_１，…，ｇ_ｎ）^Ｔである。例えば、ｇ_１，…，ｇ_ｎはＮ未満の非負整数である。ｄはｎ個の要素ｄ_１，…，ｄ_ｎからなるｎ次元ベクトルｄ＝（ｄ_１，…，ｄ_ｎ）^Ｔである。例えば、ｄ_１，…，ｄ_ｎはＮ未満の非負整数である。

と置くと、式（33)は以下のように表現できる。
ｇ＝ＡＸ＋ｄ ｍｏｄ Ｎ (34)
ここでａ_ｊ＝（ａ_１ｊ，…，ａ_ｎｊ）^Ｔであるため、Ａは以下のように表現できる。
Ａ＝（ａ_１，ａ_２，…，ａ_ｍ） [Fourth Embodiment]
The arithmetic unit of the present embodiment uses the method of the first embodiment for inputs of n-dimensional vectors _aj , g and N.

Satisfy (X ₁ , ..., X _m ) ^T is obtained and output (Fig. 2). n, m, and N are positive integers. For example, n and m satisfy m <n, and N is a prime number (note that the algorithm of the present invention is applicable even if N is not a prime number, that is, N may be a composite number). a _j is an n-dimensional vector a _j = (a _1j , ..., a _nj ) ^T consisting of n integer elements a _1j , ..., a _nj . j = 1, ..., m. For example, a _1j , ..., A _nj are non-negative integers less than N. (X ₁ , ..., X _m ) ^T is an m-dimensional vector consisting of integer elements X ₁ , ..., X _m . For example, X ₁ , ..., X _m are non-negative integers less than N. g is an n-dimensional vector g = (g ₁ , ..., gn) ^T consisting of _n elements g ₁ , ..., G _n . For example, g ₁ , ..., G _n are non-negative integers less than N. d is an n-dimensional vector d = (d ₁ , ..., d _n ) ^T consisting of n elements d ₁ , ..., D _n . For example, d ₁ , ..., d _n are non-negative integers less than N.

Then, equation (33) can be expressed as follows.
g = AX + d mod N (34)
Here, since a _j = (a _1j , ..., a _nj ) ^T , A can be expressed as follows.
A = (a ₁ , a ₂ , ..., _am )

In this embodiment, ^T is calculated by searching for a search tree similar to that in the second embodiment (X ₁ , ..., X _m ). At this time, the variables (elements) X ₁ , ..., X _m of X = (X ₁ , ..., X _m ) ^T each have a one-to-one correspondence with the depth D of the search tree. Therefore, the depth of the search tree coincides with the number m of the variable of X. That is, each of X ₁ , ..., X _m can be obtained by searching at any depth D = 1, ..., M of any of the search trees (processing corresponding to any of D = 1, ..., M). .. The variable X _j (X _j obtained by the process corresponding to the depth D) determined at the depth D (= 1, 2, ..., M) of the search tree is X _{j (D)} ∈ {X ₁ , ..., X _m }. Further, the value of X _{j (D)} obtained by the search of the depth D (obtained by the process corresponding to the depth D) is α _{j (D)} , and the n-dimensional vector corresponding to this X _{j (D)} . a _j is a _{j (D)} ∈ {a ₁ , ..., a _m }. This is because, from the equation (34), g = X ₁ a ₁ + ... + X _{j (D)} a _{j (D)} + ... + X _{ma m +} d mod N. For example, X _{j (D)} and a _{j (D} ) corresponding to each D = 1, ..., M are predetermined. For example, X _{j (D)} = X _D and a _{j (D)} = a _D. Since the value of each variable X _{j (D)} is any of 0, 1, ..., N-1, the number of branches of the search tree is N regardless of the depth. In the case of this embodiment, the representative elements of coset in L ( _BD-1 ) / L ( _BD ) are c _{D, 0} , c _{D, 1} , ..., C _{D, N-1} , and they are 0 and X, respectively. Corresponds to _{j (D)} , 2X _{j (D)} , ..., (N-1) X _{j (D)} . Therefore, c _{D, j'} = j'· X _{j (D)} (however, j'= 0, 1, 2, ..., N-1). _BD and cD, _j'can be calculated by, for example, the "standard method of steps S82 and S83" exemplified in the second embodiment, but when N is a prime number, in steps S82 and S83. If you try to select the prime number p'by the standard method, you have to set p'= N.

深さＤ－１まで探索を終えると、変数Ｘ_ｊ（１），Ｘ_ｊ（２），…，Ｘ_{ｊ（Ｄ－１）}の値が決まる。深さＤの探索で得られるＸ_ｊ（Ｄ）の値（深さＤに対応する処理で得られるＸ_ｊ（Ｄ）の値）をα_ｊ（Ｄ）とすると、式（35)から以下の関係が得られる。

なお、深さＤで探索を行う変数Ｘ_ｊ（Ｄ）は未探索の変数のいずれであってもよい。ここで、Ｄ＝２，…，ｍについて
Ａ_Ｄ－１＝（ａ_ｊ（Ｄ）ａ_{ｊ（Ｄ＋１）} … ａ_ｊ（ｍ））
Ｘ’_Ｄ－１＝（Ｘ_ｊ（Ｄ），Ｘ_{ｊ（Ｄ＋１）}，…，Ｘ_ｊ（ｍ））^Ｔ

とおく。またＤ＝１については、Ａ_０＝Ａであり、Ｘ’_０＝Ｘであり、ｇ_０’＝ｇである。探索木の深さＤ＝１，２，…，ｍに対して、条件
ｇ_Ｄ－１’＝Ａ_Ｄ－１Ｘ’_Ｄ－１＋ｄ ｍｏｄ Ｎ (36)
の下、（Ａ_Ｄ－１，ｇ_Ｄ－１’，Ｎ）からＸ_ｊ（Ｄ）を求めていけば、最終的に（Ｘ_１，…，Ｘ_ｍ）^Ｔの値を得ることができる。 In equation (34), the equation in which the order of the elements of A and X is changed is as follows.

When the search to the depth D-1 is completed, the values of the variables X _{j (1)} , X _{j (2)} , ..., X _{j (D-1)} are determined. Assuming that the value of X _{j (D)} obtained by the search for the depth D (the value of X _{j (D)} obtained by the process corresponding to the depth D) is α _{j (D)} , the following from the equation (35) A relationship is obtained.

The variable X _{j (D)} to be searched at the depth D may be any unsearched variable. Here, for D = 2, ..., M A _D-1 = (a _{j (D)} a _{j (D + 1)} ... a _{j (m)} )
_X'D-1 = (X _{j (D)} , X _{j (D + 1)} , ..., X _{j (m)} ) ^T

far. For D = 1, A ₀ = A, _{X'0 = X, and g 0 '} = g. For the depths D = 1, 2, ..., M of the search tree, the condition g _D-1 '= A _D-1 X'D _-1 + d mod N (36)
Under, if X _{j (D)} is obtained from ( _AD-1 , g _D-1 ', N), the value of (X ₁ , ..., X _m ) ^T can be finally obtained.

<Structure>
As illustrated in FIG. 11, the calculation device 10 of this embodiment has an initial setting unit 100, a classical calculation unit 101, 103 (first and second classical calculation units), a selection unit 102, and a quantum calculation unit 72. The classical calculation units 101 and 103 have a plurality of calculation units, and the quantum calculation unit 72 has a plurality of quantum calculation units (not shown).

<Processing>
The processing of this embodiment will be described.
≪Initial setting unit 100≫
The initial setting unit 100 initially sets D = 1, A ₀ = A, _{X'0 = X, g 0 '} = g (step S100). After that, each of the following processes is executed as a search at the depth D (process corresponding to the depth D).

<< Processing of classical calculation unit 101 >>
Equation (36) can be expressed as follows for each of j'= 0, 1, 2, ..., N-1.
g _D- 1'-j' · a _{j (D) = AD} X'D + d mod N (37)
By transposing equation (37), the following equation (38) is obtained.
g _D- ^1'T -j'・ a _{j (D)} ^T = _{X'D T A D} ^T ₊ ^{d T} mod N (38)
Since the column vectors of A and _D are a _{j (D + 1)} , a _{j (D + 2)} , ..., a _{j (m)} , a _{j (D + 1)} ^T , a _{j (D + 2)} ^T , ... a _{j (m)} ^T Is a row vector of _AD .

The arithmetic unit of the classical calculation unit 101 takes A _D , N, ε ₁ , ..., Ε _n as inputs, and adds N ε _i ^T (where i = 1, ..., N) to A _D ^T , and is a set of row vectors. The LLL irreducible base _BD of the lattice defined by {a _{j (D + 1)} ^T a _{j (D + 2)} ^T ... a _{j (m)} ^T Nε ₁ ^T ... Nε _n ^T } is calculated and output. For each j'= 0, 1, 2, ..., N-1 and _d ^T , the existence of the solution ^X'DT in Eq. (38) and
g _D- ^1'T -j'・ a _{j (D)} ^T = u (D) _BD + d ^T (39)
It is equivalent to the existence of a solution u (D) ∈ Z ⁿ that satisfies. Note that u (D) is an n-dimensional vector composed of integer elements (step S1011).

The arithmetic unit of the classical calculation unit 101 obtains and outputs the dual basis _BD ⁻ with respect to N of the LLL irreducible basis _BD obtained in step S1011 (step S1012).

The quantum calculation unit 72 describes each j'= 0, 1, for each node ( _BD , g _D- ^1'T -j', a _{j (D)} ^T ) corresponding to the depth D as follows. 2 ... Obtain the judgment result of the swap test corresponding to N-1.

量子状態｜φ＞_{ｔ（Ｄ，ｊ´）}を生成するために用いる量子回転ゲートの例を以下に示す。

量子計算部７２は、ｊ’＝０，１，２，…，Ｎ－１について、ステップＳ１０７２ａで得られた量子状態｜φ＞_Ｄ，０のレジスタと、ステップＳ１０７２ｂで得られた量子状態｜φ＞_{ｔ（Ｄ，ｊ’）}のレジスタとの各ペアに対してスワップテストを実行し、量子状態｜φ＞_Ｄ，０と量子状態｜φ＞_{ｔ（Ｄ，ｊ’）}とのペアに対するスワップテストの結果が受理となるか不受理となるかの結果を得て出力する。 The quantum calculation unit 72 performs the same processing as the quantum calculation unit 72 of the second embodiment, generates quantum states | φ> _{D, 0} and | φ> _{t (D, j')} , and swaps them into these quantum states. A test is performed, and a determination result of the swap test is obtained and output (step S1072). However, instead of k'= 0,1, ..., ν (D) -1 in the second embodiment, j'= 0,1,2, ..., N-1 is used in this embodiment. Each quantum state can be expressed as follows.

An example of a quantum rotating gate used to generate a quantum state | φ> _{t (D, j')} is shown below.

The quantum computing unit 72 has the quantum state | φ> _{D, 0} register obtained in step S1072a and the quantum state | φ obtained in step S1072b for j'= 0, 1, 2, ..., N-1. > Execute a swap test for each pair with the register of _{t (D, j')} , and perform a swap test for the pair of quantum state | φ> _{D, 0} and quantum state | φ> _{t (D, j')} . The result of whether the result of is accepted or rejected is obtained and output.

<< Processing of selection unit 102 >>
The selection unit 102 has a quantum state | φ> _{D, 0} and a quantum state | based on the determination result of the swap test output from the quantum calculation unit 72 for j'= 0, 1, 2, ..., N-1. Probability that the result of the swap test for the pair with φ> _{t (D, j')} is accepted p _{D, 0} , p _{D, 1} , ..., p _{D, N-1} is obtained, and the highest probability p is among them. The jmax ∈ {0, 1, 2, ..., N-1} corresponding to _{D, jmax} is output as α _{j (D)} . That is, p _{D, jmax} ≧ p _{D, 0} , p _{D, 1} , p _{D, jmax-1,} p _{D, jmax + 1,} ..., P _{D, N-1} , and α _{j (D)} = jmax. Further, the selection unit 102 calculates and outputs g _D '= g _D- 1'-α _{j (D)} and a _{j (D)} (step S102). The value α _{j (D)} obtained here is the value of X _{j (D)} at the depth D.

<< Processing of classical calculation unit 103 >>
When the selection unit 102g outputs α _{j (D)} for all D = 1, ..., M, the classical calculation unit 103 obtains by arranging α _{j (1)} , ..., α _{j (m)} . (X ₁ , ..., X _m ) The solution of ^T (α ₁ , ..., α _m ) ^T is output. On the other hand, when the selection unit 102g does not output α _{j (D)} for any of D = 1, ..., M, the classical calculation unit 103 sets D + 1 as a new D, and sets the classical calculation unit 101 and the quantum calculation unit. Control is performed to re-execute each process (step S1011, S1012, S1072, S102, S103) of 72, the selection unit 102, and the classical calculation unit 103 (step S103).

ここで、Ａ，Ｘはランダムな要素を持つ行列とベクトルであり、ｄは平均０分散１の正規分布に従うランダムな要素を持つベクトルであり、ｇはＡＸ＋ｄ ｍｏｄ Ｎを計算して得たベクトルである。ＬＷＥでは、Ｘとｄが未知であり、（Ａ，ｇ，Ｎ）が与えられたとき、Ｘを求める。以下、Ｘの最初の変数Ｘ_１をＸ_ｊ（１）とし、深さＤ＝１で探索において、その値α_ｊ（１）＝１０を計算する手順を例示する。変数Ｘ_２，変数Ｘ_３についても、深さＤ＝２，３の探索で同様に求めることができるため、変数Ｘ_２，変数Ｘ_３の計算手順については省略する。 <Specific example>
Next, a specific example of this embodiment will be shown. Here, as an example of LWE, the following cases will be illustrated. m = 3, n = 9 (= m ² ), N = 11 (the smallest prime number greater than n),

Here, A and X are matrices and vectors having random elements, d is a vector having random elements following a normal distribution with an average of 0 variances 1, and g is a vector obtained by calculating AX + d mod N. be. In LWE, when X and d are unknown and (A, g, N) are given, X is obtained. Hereinafter, a procedure in which the first variable X ₁ of X is set to X _{j (1)} and the value α _{j (1)} = 10 is calculated in the search at the depth D = 1 will be illustrated. Since the variables X ₂ and X ₃ can be similarly obtained by searching for the depth D = 2 and ₃ , the calculation procedure of the variables X ₂ and X 3 will be omitted.

≪Initial setting unit 100≫
The initial setting unit 100 initially sets D = 1, A ₀ = A, _{X'0 = X, g 0 '} = g (step S100).

が表す基底で定義される格子のＬＬＬ既約基底Ｂ_１を計算して出力する。ｍ＝３，ｎ＝９の場合、この例のＢ_１を構成するｎ次元ベクトルｂ_１，…，ｂ_ｎを要素とする９行９列の基底行列β_１は以下のようになる（ステップＳ１０１１）。

<< Processing of classical calculation unit 101 >>
The n × (m-1) matrix excluding the sequence of variable numbers to be obtained at the depth D from A is expressed as Rest (A). In the case of this example, Rest (A) is a 9 × 2 matrix excluding the first column from A because we want to find the value of the _first variable X1 of X. The calculation unit of the classical calculation unit 101 is a (n + m-1) × n matrix.

Calculates and outputs the LLL irreducible basis B ₁ of the lattice defined by the basis represented by. When m = 3, n = 9, the 9-by-9 basis matrix β ₁ having n-dimensional vectors b ₁ , ..., B _n constituting B ₁ of this example as elements is as follows (step S1011). ).

The arithmetic unit of the classical calculation unit 101 obtains and outputs the dual basis B ₁ ⁻ with respect to N of B ₁ (step S1012). When n = 9, the 9 ^- by-9 basis matrix β ₁ ^- with the n ^- dimensional vectors b _1- ^, ..., B _9- constituting B _1- in this example as elements is as follows.

量子計算部７２は、量子状態｜φ＞_１，０がｎ×ｃｅｉｌ（ｌｏｇ_２（Ｎ＋１)）個の量子ビットの量子重ね合わせ状態からなる第１レジスタを複数個生成して出力する。この第１レジスタは、格子Ｌ（Ｂ^－）の格子点を頂点とした単位平行多面体の各頂点の値のエンコード値の量子重ね合せ状態に相当する。例えば、ｎ＝９の場合、量子状態生成部７２ａは、以下の量子状態｜φ＞_１，０の第１レジスタを複数個生成する。

<< Processing of quantum calculation unit 72 >>
In this example, the quantum calculation unit 72 selects the above-mentioned R (2B ⁻ ) as the region R. Assuming that the region R is the above-mentioned R (2B ⁻ ), the following holds.

The quantum computing unit 72 generates and outputs a plurality of first registers consisting of quantum superposition states of n × ceil (log 2 (N + 1)) qubits in which the quantum state | φ> _1,0 is n × ceil (log ₂ (N + 1)). This first register corresponds to the quantum superposition state of the encoded value of the value of each vertex of the unit parallelepiped having the lattice point of the lattice L (B ⁻ ) as the vertex. For example, when n = 9, the quantum state generation unit 72a generates a plurality of first registers of the following quantum states | φ> _1,0 .

ここで、この例の目標ベクトルｇ_０’^Ｔ－ｊ’・ａ_ｊ（１） ^Ｔは以下の１１種類である。
ｇ_０’^Ｔ－ｊ’・ａ_ｊ（１） ^Ｔ＝（１，８－ｊ’，６－３ｊ’，７－ｊ’，４－９ｊ’，５，８－７ｊ’，１０－４ｊ’，６） ｍｏｄ １１ The quantum computing unit 72 divides a plurality of registers of quantum state | φ> _1,0 into two groups, and applies a quantum rotation gate to one of the group registers. As a result, a register consisting of the following quantum states is obtained.

Here, the target vectors g _0'T -j' · a _{j (1)} ^T in this ^example are the following 11 types.
g _0'T -j'・ a _{j (1)} ^T = (1,8-j', ^6-3j ', 7-j', 4-9j', 5,8-7j', 10-4j', 6) mod 11

Then, the quantum computing unit 72 has a quantum state | φ> _1,0 register and a quantum state | φ> _{t (1, j')} register for j'= 0, 1, 2, ..., 10. A swap test is executed for the pair, and the result of the swap test for the pair of the quantum state | φ> _1,0 and the quantum state | φ> _{t (1, j')} is obtained and output.

<< Processing of selection unit 102 >>
The selection unit 102 calculates the probabilities p _{1, j'that} the swap test is accepted from the result of the swap test obtained by the quantum calculation unit 72. For example, the quantum computing unit 72 executes a swap test a plurality of times (for example, 100 times) for each j'= 0, 1, 2, ..., 10 and determines the acceptance ratio as the probability p _{1, j} in each j'. _' Calculate as. The theoretical calculation of the probabilities p _{1, j'is} as follows.
p _1,0 = 0.500002
p _1,1 = 0.500001
p _1,2 = 0.500000
p _1,3 = 0.500000
p _1,4 = 0.500002
p _1,5 = 0.500132
p _1,6 = 0.500093
p _1,7 = 0.500000
p _1,8 = 0.504587
p _1,9 = 0.500001
p _1,10 = 0.665613
Next, the selection unit 102 outputs 10 corresponding to the highest probability p ₁ , 10 among the probabilities p 1, ₀ , p ₁ , 1, ..., P _{1, N-1} as α _{j (1)} . As shown in equation (41), X ₁ = 10, and the correct answer α _{j (1)} = 10 could be calculated.

[Fifth Embodiment]
Also in the fifth embodiment, the distance comparison problem is solved by quantum calculation and classical calculation (FIGS. 1 and 2). In the first embodiment, a dual grid L (B ⁻ ) having the same dimension as the grid L (B) that is the target of the distance comparison problem is used. In this embodiment, the accuracy is improved by using a grid obtained by embedding the grid L (B), which is the target of the distance comparison problem, in a space having a larger dimension n'.

<Structure>
As illustrated in FIG. 3, the determination device 11 of this embodiment has classical calculation units 111, 73 (first and second classical calculation units), a quantum calculation unit 112, and a control unit 74. As illustrated in FIG. 4, the quantum calculation unit 112 of the present embodiment includes quantum state generation units 112a and 112b (first to fourth quantum state generation units) and a swap test unit 72c (first and second swap test units). Have. The determination device 11 executes each process under the control of the control unit 74. The classical calculation units 111 and 73 have a plurality of arithmetic units, and the quantum state generation units 112a and 112b and the swap test unit 72c have a plurality of quantum calculation units (not shown).

<Processing>
The processing of this embodiment will be described. The determination device 11 of the present embodiment has a basis B, a target vector t1 = (t _1,1 , ..., T _{1, n} ) ^T composed of n integer elements t _{1, i} , and n integer elements t _{2, 2.} The target vector t2 = (t _2,1 , ..., ^t _{2, n} ) consisting of _i is used as an input, and the classical calculation and quantum calculation described below are performed, and || t1 ^(d) || and || t2 ^{( d)} Determine which of || is larger.

<< Processing of classical calculation unit 111 >>
The arithmetic unit of the classical calculation unit 111 (FIG. 3) of the determination device 11 takes the basis B as an input, and the transposed matrix ^β'T of the matrix β'= (α β) in which the matrix α and the basis matrix β are arranged in the row direction. Select the matrix α in which the Elmeet standard form of is a matrix of the diagonal component 1, and obtain and output the matrix β'. β is an n-row, n-column basis matrix having n-dimensional vectors b ₁ , ..., B _n of the basis B as elements, and is, for example, a matrix having n-dimensional vectors b ₁ , ..., B _n as row vectors. α is a matrix consisting of n rows of integer elements. An example of the matrix α is an n × n identity matrix, but the present invention is not limited thereto. In general, if α is an n × n matrix consisting of random 0 or 1 elements, the Hermite normal form of the transposed matrix ^β'T of the matrix β'= (α β) is a matrix of diagonal component 1 (diagonal component). It becomes a matrix with only) and satisfies the above conditions. Also, the matrix α does not have to be an n × n matrix, and is a matrix with n rows with a smaller number of columns than n, or n rows with a much larger number of columns than n (for example, the number of columns is larger than n ² ). It may be a matrix of. The basis consisting of the row vector b ₁ ^' , ..., b ^n'of the matrix β'= (b ₁ ^' , ..., b _n'' ^{' )} is _expressed as B ^' . The row vectors b ₁ ^' , ..., b _n'are linearly independent, and for _i = 1, ..., ⁿ , ^bi'is an n'dimensional vector consisting of integer elements. However, n'is a positive integer larger than n (step S111-1).

The arithmetic unit of the classical calculation unit 111 takes the matrix β'as an input, decomposes the matrix β'T into Hermitian, and satisfies β ^−'β ' ^T = H', ^and the unimodular matrix β ^−'and the Hermite normal form matrix H'. To get. Unimodular matrix β ^- '= (b _1- ', ... ^, b _n'- ' ⁾ The basis consisting of the row vector b ^1- ' ^, ... ^, b _{n'- '} of ^T is output as B-'. The row vectors b _1- ', ..., b _n' ^- 'are linearly independent, ^and for i'= 1, ..., n', bi _' ^- 'is an n'dimensional vector consisting of integer elements. ^n'is the number of lines β-'. The superscript " ^- " of B-'should be written directly above "B", but due to the limitation of the description notation, it may be written in the upper right of "B". The superscript " ^- " of "bi'- _' " should be written directly above "b", but due to the limitation of the description notation, it may be written in the upper right of "b" ( Step S111-2).

The arithmetic unit of the classical calculation unit 111 inputs the basis ^B'and the target vector t1 = (t ₁ , 1, ..., t _{1, n} ) ^T , t2 = (t 2, ₁ , ..., T _{2, n} ) ^T. Then, the target vector t1'= ( _t'1 , ₁ , ..., t'1 _{, n'} ) consisting of n'integer elements t'1, i'belonging to the space span (B') spanned by the basis B'). Target vector t2'= (t'2, ₁ , ..., t'2 _{, n'} ) consisting of ^T ∈ span (B') and n'integer elements t'2 _{, i} ') ^T ∈ span (B') And output. However, Proj (t1') = (0, t1), Proj (t2') = (0, t2), and Proj (μ) is an n-dimension in which the first n'-n elements of μ are 0. Represents a projection onto a vector space (step S111-3).

<< Processing of quantum calculation unit 112 >>
The quantum calculation unit 112 (FIG. 4) takes the basis B ^−'and the target vectors t1'and t2' as inputs, and an appropriate region in the n'dimensional space (a subregion belonging to the n'th order space consisting of integer elements) R⊆ The following processing is executed for Z ^n' , and the result of the swap test is output (step S112). For example, R ⊂ Z ^n' .

ただし、Ｒ_[０，Γ）は０以上Γ未満の実数を表し、ｘ”_j"は実数であり、Γは２以上の整数であり、例えばΓ＝２である。また、ｊ”の値に応じて異なる整数Γが用いられてもよい。
あるいは、例えば、以下の領域Ｒ（ΓＢ^－’^*）を領域Ｒとしてもよい。

ただし、Ｂ^－*’は双対基底Ｂ^－’のGram-Schmidt非正規化直交ベクトルｂ^－*’_１，…，ｂ^－*’_ｎからなる基底Ｂ^－*’＝｛ｂ^－*’_１，…，ｂ^－*’_ｎ｝を表す。ｂ^－*’_ｉのそれぞれはｎ’個の整数要素からなるｎ’次元ベクトルである。なお、これらの領域Ｒは本発明を限定するものではない。 For example, the following region R (ΓB ⁻ ') can be defined as region R.

However, R _{[0, Γ)} represents a real number of 0 or more and less than Γ, x "_j" is a real number, and Γ is an integer of 2 or more, for example, Γ = 2. Further, a different integer Γ may be used depending on the value of j ”.
Alternatively, for example, the following region R (ΓB ⁻ ' ^* ) may be used as the region R.

However, B ^{-* '} is _a basis B ^{- *} ' ₌ {b- ^* ' ₁ ^, ... , B ^-* ' _n }. each of b ^-* ' _i is an n'dimensional vector consisting of n'integer elements. It should be noted that these regions R do not limit the present invention.

The quantum computing unit 112 obtains the result of the swap test by the following procedure.
(A-1) The quantum state generation unit 112a of the quantum calculation unit 112 generates a plurality of registers composed of the following quantum states (step S1172a-1).

これにより、｜φ＞_０の量子状態のレジスタと｜φ＞_ｔ１’の量子状態のレジスタがそれぞれ複数個存在することになる。 (B-1) The quantum state generation unit 112b performs a quantum operation on some of the registers generated in (a-1) to obtain a register converted into the following quantum state (step S1172b-1). ..

As a result, there are a plurality of registers having a quantum state of | φ> ₀ and a register having a quantum state of | φ>_t1' .

(C-1) The swap test unit 72c executes a swap test for each pair of the register of the quantum state | φ> ₀ and the register of the quantum state | φ>_t1' , and the result of the swap test for each pair. Is received (0, Yes) or rejected (1, No), and an output is obtained (step S1172c-1).

The quantum computing unit 112 also calculates the result of another swap test according to the following procedure.
(A-2) The quantum state generation unit 112a of the quantum calculation unit 112 creates a plurality of registers composed of the following quantum states (step S1172a-2).

(B-2) The quantum state generation unit 112b performs a quantum operation on a part of the register generated in (a-2) to obtain a register consisting of the following quantum states (step S1172b-2).

(C-2) The swap test unit 72c executes a swap test for each pair of the register of the quantum state | φ> ₀ and the register of the quantum state | φ>_t2' , and the result of the swap test for each pair. Is received (0, Yes) or rejected (1, No), and an output is obtained (step S1172c-2).

<< Processing of classical calculation unit 73 >>
The classical calculation unit 73 uses the result of the swap test obtained by the quantum calculation unit 112, and the probability that the result of the swap test for the pair of the quantum state | φ> ₀ and the quantum state | φ>_t1'is accepted p ₁ And the probability p2 that the result of the swap test for the _pair of the quantum state | φ> ₀ and the quantum state | φ>_t2'is accepted is calculated. Then, the classical calculation unit 73 outputs information indicating that || t1 ₍ ^d) || ≦ || t2 ₍ ^d) || when _p1 ≧ p2, and when _p1 <p2. Outputs information indicating that || t1 ^(d) ||> || t2 ^(d) ||. Alternatively, the classical calculation unit 73 outputs information indicating that || t1 ^(d) || <|| t2 ^(d) || in the case of p ₁ > p ₂ , and in the case of p ₁ ≤ p ₂ . Information indicating that || t1 ^(d) || ≧ | t2 ^(d) || is output to || (step S73).

行列β’＝（ｂ_１’，…，ｂ_ｎ’’）^Ｔの行ベクトルｂ_１’，…，ｂ_ｎ’’からなる基底をＢ’と表現する（ステップＳ１１１－１）。 <Specific example>
The same problem as the specific example of the first embodiment is dealt with. Here, the simplest example of embedding the basis B in a space one-dimensionally higher will be described.
<< Processing of classical calculation unit 111 >>
The arithmetic unit of the classical calculation unit 111 takes the basis B as an input, obtains the following matrix β'and outputs it.

The matrix β'= (b ₁ ', ..., b _n' ') The basis consisting of the row vectors b ₁ ', ..., b _n' ' of ^T is expressed as B'(step S111-1).

従って、以下が成立する。

古典計算部１１１の演算部は、ユニモジュラ行列β^－’＝（ｂ_１ ^－’，ｂ_２ ^－’，ｂ_３ ^－’）^Ｔの行ベクトルｂ_１ ^－’，ｂ_２ ^－’，ｂ_３ ^－’からなる基底をＢ^－’として出力する（ステップＳ１１１－２）。 The arithmetic unit of the classical calculation unit 111 takes the matrix β'as an input and decomposes the matrix ^β'T into Hermitian. The diagonal components of the Hermite normal form matrix H'are all 1, and the unimodular matrix β ^- 'is as follows.

Therefore, the following holds.

The arithmetic unit of the classical calculation unit 111 is a unimodular matrix β ^- '= (b _1- ', _{b 2-} ^{' ,} b _3- ') ^T _{row vector b 1-} ^{' ,} _{b 2-} ^{' ,} b _3- '. The basis consisting of B-'is output as B ^- '(step S111-2).

The calculation unit of the classical calculation unit 111 inputs the basis _B'and the target vector t1 = (t ₁ , 1, t 1, ₂ ) ^T , t2 = (t 2, 1, t 2, ₂ ) ^T , and the basis B. Target vector t1 _' = ( _t'1,1 , ..., _t'1,3 ) ^T ∈ span (B' ) And a target vector consisting of three integer elements t'2 _{, i} '= ( _t'2,1 , _t'2,2 , _t'2,3 ) ^T ∈ span (B') and output do. t1'and t2'are as follows (step S111-3).

<< Processing of quantum calculation unit 112 >>
When the region R (2B ⁻ ') is the region R, the following holds.

The quantum calculation unit 112 performs the following calculation.
(A-1) The quantum state generation unit 112a of the quantum calculation unit 112 generates a plurality of the following quantum state registers.

(B-1) The quantum state generation unit 112b applies a quantum rotation gate operation to some of the above-mentioned plurality of registers. As a result, the quantum state of the register to which the rotating gate is applied becomes as follows.

(C-1) The swap test unit 72c executes a swap test for each pair of a register having a quantum state | φ> ₀ and a register having a quantum state | φ> _t1 , and outputs the result.

The quantum calculation unit 112 performs the following calculation.
(A-2) The quantum state generation unit 112a of the quantum calculation unit 112 generates a plurality of registers composed of the following quantum states.

(B-2) The quantum state generation unit 112b applies a quantum rotation gate operation to some of the above-mentioned plurality of registers. As a result, the quantum state of the register to which the rotating gate is applied becomes as follows.

(C-2) The swap test unit 72c executes a swap test for each pair of the register of the quantum state | φ> ₀ and the register of the quantum state | φ>_t2' , obtains the result, and outputs the result. ..

となる。これらの値は第１実施形態の具体例のものと同一である。図１２に、この具体例での確率ｐ＝ｐ_１，ｐ_２の密度分布を例示する。図１２から分かるように、第１実施形態と同様、確率ｐ＝ｐ_１，ｐ_２の値で目標ベクトルが格子点に近いか否かを判断できることが分かる。 << Processing of classical calculation unit 73 >>
_The classical calculation unit 73 calculates the values of probabilities p1 and _p2 from the results of the above swap test. Theoretically, this value can be calculated.

Will be. These values are the same as those of the specific example of the first embodiment. FIG. 12 illustrates the density distribution of the probabilities p = p ₁ and p ₂ in this specific example. As can be seen from FIG. 12, as in the first embodiment, it can be seen that whether or not the target vector is close to the grid point can be determined by the values of probabilities p = p ₁ and p ₂ .

Finally, since p ₁ > p ₂ in this example, the classical calculation unit 73 outputs information indicating that || t1 ^(d) || <|| t2 ^(d) ||.

[Sixth Embodiment]
The sixth embodiment is a modification of the second embodiment, and solves a given n-dimensional recent vector problem (B, t) by using the method of the fifth embodiment instead of the method of the first embodiment. (Fig. 1). That is, for a given n-dimensional recent vector problem (B, t), the difference vector t ^{(B, d)} = tt ^{(B, c)} with the target vector t using the method of the fifth embodiment. Find the recent vector t ^{(B, c)} ∈ L (B) on the lattice L (B) such that is the shortest.

<Structure>
As illustrated in FIG. 7, the arithmetic unit 12 of this embodiment has an initial setting unit 81, a base selection unit 82, a representative element selection unit 83, a child node generation unit 84, a classical calculation unit 127, a node selection unit 85, and a control unit. It has 86 and a quantum calculation unit 112. The initial setting unit 81, the basis selection unit 82, the representative element selection unit 83, the child node generation unit 84, the classical calculation unit 71, the node selection unit 85, and the control unit 86 have a plurality of calculation units, and the quantum calculation unit 112. Has multiple quantum calculators (not shown).

<Processing>
The processing of this embodiment will be described.
The processing of the initial setting unit 81, the base selection unit 82, the representative source selection unit 83, and the child node generation unit 84 is the same as that of the second embodiment.

<< Processing of classical calculation unit 127 >>
The classical calculation unit 127 uses the basis _BD and the integer N, and the Hermite of the transposed matrix β _D' ^T of the matrix β _D '= (α _D β _D ) in which the matrix α _D and the basis matrix β _D are arranged in the row direction. Select the matrix α _D whose standard form is the matrix of diagonal component 1, and output β _D '. The classical calculation unit 127 obtains and outputs a unimodular matrix β _D ^−'that satisfies β _D ^−'β _D' ^T = H'with respect to the Hermite normal form matrix H'. The classical calculation unit 127 uses B as the basis consisting of the row vectors b _{D, 1} ', ..., b _{D, n'} ' of the matrix β _D '= (b _{D, 1} ', ..., b _{D, n'} ') ^T. Let _D' be a monomodular matrix β _D ^- '= (b _{D, 1-} ^' , ..., b _{D, n'-} ' ^{) T} row vector b _{D, 1-} ^' , ..., b _{D, n'-} ^' Let BD ^- 'be the basis consisting of, and let the target vector t ( _D , k') ∈ span ( _BD ') consisting of n'integer elements belonging to the space span ( _BD ') spanned by the basis _BD '. Get and output. However, k'= 0,1, ..., ν (D) -1, and Proj (t (D, k')) = (0, t (D-1) -c _{D, k'} ). Proj (μ) represents a projection onto an n-dimensional vector space where the first n'-n elements of μ are 0, ^and L (B-') is a lattice L (B-' ⁾ = {Σ _{i'= 1, ...,} n'x i'b ^- 'i _' | x _i'∈ Z, b ^- _{'i' ∈} B- _' }, x ^i'is an integer, and R ⊆ Z ^n'is an integer element. It is a subregion belonging to the n'th order space consisting of (step S1287).

In the processing of the quantum calculation unit 112, | φ> ₀ , B ⁻ ', | φ>_t1' , t1'of (a-1) and (b-1) are | φ> _{D, 0} , _BD ⁻ ', | φ> _{t (D, k')} , t (D, k'), respectively, and (c-1) is replaced with the swap test of the second embodiment, and (a-2) (b-2) ( It is the same as the fifth embodiment except that c-2) is not executed.

The processing of the node selection unit 85 and the control unit 86 is the same as that of the second embodiment.

[7th Embodiment]
In this embodiment, the processing of the sixth embodiment is used as a subroutine to solve the SVP (FIG. 1).

<Structure>
As illustrated in FIG. 10, the arithmetic unit 6 of this embodiment has a basis generation unit 61, a setting unit 62, a selection unit 63, and a control unit 65.

<Processing>
The calculation device 6 of the present embodiment takes the basis B as an input and outputs the shortest vector t ^(c) to the grid point closest to the origin in the grid L (B).
The setting unit 62 of the third embodiment obtained the difference vector t ^(d) by the calculation device 8 of the second embodiment, but the setting unit 62 of the present embodiment is the calculation device 12 described in the sixth embodiment. To obtain the difference vector t ^(d) . Since other processes are the same as those in the third embodiment, the description thereof will be omitted.

を満たす（Ｘ_１，…，Ｘ_ｍ）^Ｔを得て出力する（図２）。 [Eighth Embodiment]
This embodiment is a modification of the fourth embodiment. The arithmetic unit of this embodiment applies the method of the fifth embodiment instead of the method of the first embodiment, and for the input of the n-dimensional vectors _aj , g and N.

Satisfy (X ₁ , ..., X _m ) ^T is obtained and output (Fig. 2).

<Structure>
As illustrated in FIG. 11, the calculation device 14 of the present embodiment has an initial setting unit 100, a classical calculation unit 1401, 103 (first and second classical calculation units), a selection unit 102, and a quantum calculation unit 112. The classical calculation units 1401 and 103 have a plurality of calculation units, and the quantum calculation unit 112 has a plurality of quantum calculation units (not shown).

<Processing>
The processing of this embodiment will be described. The same functions as the processing unit already described will be omitted.

<< Processing of classical calculation unit 1401 >>
The arithmetic unit of the classical calculation unit 1401 is a set of row vectors in which A _D , N, ε ₁ , ..., Ε _n are input, and N ε _i ^T (where i = 1, ..., N) is added to A _D ^T. The LLL irreducible base _BD of the lattice defined by {a _{j (D + 1)} ^T a _{j (D + 2)} ^T ... a _{j (m)} ^T Nε ₁ ^T ... Nε _n ^T } is calculated and output (step S1411). ..

The arithmetic unit of the classical calculation unit 1401 is the base of the LLL transposed base _BD of a _{j (D + 1)} ^T , a _{j (D + 2)} ^T , ..., a _{j (m)} ^T , Nε ₁ ^T , ..., Nε _n ^T. The matrix β _D '= (α _D β _D ) transposed matrix β _D' ^T in which the matrix β _D is obtained and output, and the matrix α _D consisting of n-column integer elements and the base matrix β _D are arranged in the row direction. Select the matrix α _D for which the Elmeet standard form is the matrix of the diagonal component 1, and output β _D '. The arithmetic unit of the classical calculation unit 1401 obtains and outputs a unimodular matrix β _D ^- 'that satisfies β _D ^−'β _D' ^T = H'with respect to the Hermite normal form matrix H'. The arithmetic unit of the classical calculation unit 1401 consists of the row vectors b _{D, 1} ', ..., b _{D, n'} ' of the matrix β _D '= (b _{D, 1} ', ..., b _{D, n'} ') ^T. The basis is _BD ', and the unimodular matrix β _D ^- '= (b _{D, 1-} ', ..., b _{D, n'-} ') ^T row vector b _{D, 1-} ^{' , ...} , b _{D, n} ^The basis consisting of _' ^- 'is output as _BD- '. The arithmetic unit of the classical calculation unit 1401 obtains a target vector t (D, j') ∈ span ( _BD ') consisting of n'integer elements belonging to the space span ( _BD ') spanned by the basis _BD '. And output. However, j'= 0, 1, 2, ..., N-1, and Proj (t (D, j')) = (0, g _D- ^1'T -j' · a _{j (D)} ^T ). Yes, Proj (μ) represents a projection onto an n-dimensional vector space where the first n'-n elements of μ are 0 (step S1412).

In the processing of the quantum calculation unit 112, | φ> ₀ , B ⁻ ', | φ>_t1' , t1'of (a-1) and (b-1) are | φ> _{D, 0} , _BD ⁻ ', | φ> _{t (D, j')} , t (D, j'), respectively, and (c-1) is replaced with the swap test of the fourth embodiment, (a-2) (b-2) ( It is the same as the fifth embodiment except that c-2) is not executed.

<Specific example>
Next, a specific example of this embodiment will be shown. Here, as an example of LWE, the same problem as the specific example of the fourth embodiment is dealt with. Here, the processing of the depth D = 1 is illustrated, but these processings are the same for other Ds other than the value of D.

が表す基底で定義される格子のＬＬＬ既約基底Ｂ_１を計算して出力する（ステップＳ１４１１）。ｍ＝３，ｎ＝９の場合、この例のＢ_１を構成するｎ次元ベクトルｂ_１，…，ｂ_９を要素とする９行９列の基底行列β_１は以下のようになる（ステップＳ１４１１）。

<< Example 1 of processing of the classical calculation unit 1401 >>
1. 1. The n × (m-1) matrix excluding the sequence of variable numbers to be obtained from A is expressed as Rest (A). In the case of this example, we want to find the value of the first variable X ₁ of X, so Rest (A) is a 9 × 2 matrix excluding the first column from A. The arithmetic unit of the classical calculation unit 1401 is a (n + m-1) × n matrix.

LLL irreducible basis _B1 of the lattice defined by the basis represented by is calculated and output (step S1411). When m = 3, n = 9, the 9-by-9 basis matrix β ₁ having the n-dimensional vectors b ₁ , ..., B ₉ constituting B ₁ of this example as elements is as follows (step S1411). ).

Then, as step S1412, the following steps S1412a to S1412g are executed.
2. 2. The arithmetic unit of the classical calculation unit 1401 determines the dimension n'of the space in which the lattice L (B ₁ ) is embedded (step S1412a). n'is a multiple of n. In the following, an example in which n'is three times n, that is, n'= 9 × 3 = 27 will be described.

をランダムに選ぶ（ステップＳ１４１２ｂ）。すなわち、

が成り立つ。古典計算部１４０１の演算部は、ｎ×ｎの行列β_１Ｃ_ｉ ^－1（ｉ＝１，２，…，（ｎ’／ｎ）－１）を横（行方向）に並べて、ｎ×（ｎ’－ｎ）行列

を得る（ステップＳ１４１２ｃ）。さらに古典計算部１４０１の演算部は、以下のようにｎ×ｎ’行列β_１’を設定する。
β_１’＝（Ｉ_ｎ Ｒ’） (41)
ここでＩ_ｎはｎ×ｎの単位行列である（ステップＳ１４１２ｄ）。β_１’の行ベクトルｂ_１’，…，ｂ_ｎ’を要素とする｛ｂ_１’，…，ｂ_ｎ’｝が定義するｎ次元格子基底をＢ_１’で表現する。以下にｎ’＝３ｎ＝２７のときのＲ’を例示する。

3. 3. The arithmetic unit of the classical calculation unit 1401 is a different irreducible basis of the lattice L (B ₁ ).

Is randomly selected (step S1412b). That is,

Is true. The arithmetic unit of the classical calculation unit 1401 arranges the n × n matrix β ₁ C _i - ¹ (i = 1, 2, ..., (N'/ n) -1) horizontally (row direction), and n × ( n'-n) matrix

(Step S1412c). Further, the arithmetic unit of the classical calculation unit 1401 sets n × n'matrix β _1'as follows.
β ₁ ' ₌ (In R') (41)
Here, In is an identity matrix of n × _n (step S1412d). The _{n-dimensional lattice basis defined by {b 1', ..., b n '} whose elements are the row vectors b 1 ' ,} ..., b n'of β _1'is represented by B ₁ '. The following is an example of R'when n'= 3n = 27.

とを得る（ステップＳ１４１２ｅ）。ここで、Ｏ_{ｎ，ｎ’－ｎ}はｎ×（ｎ’－ｎ）ゼロ行列である。古典計算部１４０１の演算部は、このユニモジュラ行列の行ベクトルをｂ_１ ^－’，…，ｂ_ｎ’ ^－’とし、｛ｂ_１ ^－’，…，ｂ_ｎ’ ^－’｝で定義されるｎ’次元格子基底をＢ_１ ^－’とする（ステップＳ１４１２ｆ）。すなわち、

を満たす。式（４３）により、β_１’の行ベクトルが張る空間（ｓｐａｎ｛ｂ_１’，…，ｂ_ｎ’｝）と（ｎ’－ｎ）×ｎ’行列（－Ｒ^Ｔ Ｉ_ｎ’－ｎ）の行ベクトルが張る空間（ｓｐａｎ｛ｂ_ｎ＋１ ^－’，…，ｂ_ｎ’ ^－’｝）とが垂直であることに注意のこと。 4. The arithmetic unit of the classical calculation unit 1401 decomposes the transposed matrix β _1'T of β ^1'in Hermitian, and the n'xn matrix of the diagonal component ₁ of the Hermite normal form and the unimodular matrix.

And (step S1412e). Here, _{On, n'-n} is an nx (n'-n) zero matrix. The arithmetic unit of the classical calculation unit 1401 sets the row vector of this unimodular matrix to b _1- ', ..., b _n'-' , ^and is defined by {b ^1- ' ^, ... ^, b _{n'- '} }. Let'the base of the dimensional matrix be B ₁ ^- '(step S1412f). That is,

Meet. According to the equation (43), the space (span {b ₁ ', ..., b _n '}) in which the row vector of β 1'is stretched and the ( _n' -n) × n'matrix ( ^-RT I _n'-n ). Note that the space (span {b _{n + 1-} ^{' ,} ..., b _n'- '}) spanned by the row vector of is perpendicular.

となる。例として、この具体例におけるｔ（１，１０）の計算結果を以下に示す。

The arithmetic unit of the classical calculation unit 1401 has _{a target vector t (1, j'consisting of n'integer elements belonging to the space span (B 1 '} ) spanned by the basis B 1'as shown in the following equation (43A). ) ∈ span (B ₁ ') is obtained and output. This target vector t (1, j') is obtained by embedding the target vector g _0'T -j' · a _{j (1)} ^T in the ^{n'dimensional} space.
t ( ₁ , j') = (g _0'T -j' · a _{j (1)} ^{T )} β ^1-1 β ₁ '(43A)
By definition, t (1, j') is a linear sum of β ₁ ', so t (1, j') ∈ span (B ₁ ') (step S1412g). Here, span (B ₁ ') is a hyperplane formed by the linear sum of the real number coefficients of B ₁ '. However, since (g _0'T ^- j' · a _{j (1) T} ⁾ β ^1-1 is not always an integer, it is generally

Will be. As an example, the calculation result of t (1,10) in this specific example is shown below.

After that, for example, B ⁻ = B ₁ ⁻ ′, and the above-mentioned region R (ΓB ⁻ ) or R (ΓB ^{− *} ) is set as the region R, and the subsequent processing of the quantum calculation unit 112, processing of the selection unit 102, and The processing of the classical calculation unit 103 is performed.

<< Example 2 of processing of the classical calculation unit 1401 >>
Instead of B ^1- ', B _{1 -} ^'generated as follows may be used, which allows the correct α _{j (D)} to be obtained using a space with a smaller number of dimensions n'. In this case, the arithmetic unit of the classical calculation unit 1401 executes step S1411 described in the above << Example 1 of processing of the classical calculation unit 1401 >>, executes the processing of S1412a to S1412f as step S1412, and further executes the following processing. Steps S1412h to S1412k and S1412f are executed.

なお、式（４４）のランク（一次独立な行ベクトルの最大数）はｎなので、行列Ｐ_１は逆行列Ｐ_１ ^－１を持たない。 5. The arithmetic unit of the classical calculation unit 1401 is a projection vector Proj _B1' (unit) _{on the space span (B 1 '} ) stretched by the _n -dimensional lattice base B 1'of the unit vector unit ₁ , ..., unit n'in the dimensional space. ₁ ), ..., Proj _B1' (unit _n' ) is calculated (step S1412h). Here, the unit vectors unit ₁ , ..., Unit n'are used because L (B _1- ' ⁾ coincides with the lattice based on the unit vectors unit ₁ , ..., unit _{n '} . These projection vectors Proj _B1' (unit ₁ ), ..., Proj _B1' (unit _n' ) are n'dimensional vectors of rational number elements having a length of 1 or less. As shown in the equation (44), let P ₁ be an n'× n'matrix in which these projection vectors Proj _B1' (unit ₁ ), ..., Proj _B1' (unit _n' ) are arranged vertically.

Since the rank (maximum number of linearly independent row vectors) of the equation (44) is n, the matrix P ₁ ^does not have the inverse matrix P _1-1 .

6. The arithmetic unit of the classical calculation unit 1401 calculates the LLL irreducible basis {q ₁ , q ₂ , ..., q _n } of {Proj _B1' (unit ₁ ), ..., Proj _B1' (unit _n' )}. Obtain the n'dimensional vectors q ₁ , q ₂ , ..., Q _n of the rational number elements constituting the LLL irreducible basis {q ₁ , q ₂ , ..., q _n } (step S1412i). As shown in equation (45), let Q ₁ be an n × n'matrix (n-dimensional lattice basis in n'dimensional space) in which n'dimensional vectors q ₁ , q ₂ , ..., Q _n are arranged vertically. ..

ここで、式（４７）を使って式（４５）からＰ_１を削除すると、以下の式（４８）が得られる。

古典計算部１４０１の演算部は、行列Ｑ_１，Ｕ_１，Ｖ_１と整数α_１，１，α_２，２，…，α_ｎ，ｎとを用い、式（４８）に従って行列Ｘ_１を得る。なお、式（４８）の右辺の要素は分数で表現されているが、これらを計算すれば各要素の分子が分母で割り切れ、行列Ｘ_１の各要素は整数となる。 7. The arithmetic unit of the classical calculation unit 1401 obtains an n × n'matrix X ₁ of integer elements satisfying the following equation (46) (step S1412j).
X ₁ P ₁ = Q ₁ (46)
However, since the matrix P ₁ does not have the inverse matrix P _1-1 as described above, it is not possible to obtain the matrix X ₁ by ^multiplying the inverse matrix P ^1-1 of the matrix P ₁ from the right _side of both sides of the equation (46). Can not. Therefore, the arithmetic unit of the classical calculation unit 1401 first performs Smith decomposition of the matrix P ₁ , and the unimodular n'× n'matrix U ₁ , V ₁ and the integers α ₁ , 1, which satisfy the following equation (47). Calculate α ₂ , 2, ..., α _{n, n} .

Here, if P ₁ is deleted from the equation (45) using the equation (47), the following equation (48) is obtained.

The arithmetic unit of the classical calculation unit 1401 uses the matrices Q ₁ , U ₁ , V ₁ and the integers α ₁ , 1, α ₂ , 2, ..., α _{n, n} , and obtains the matrix X ₁ according to the equation (48). .. The elements on the right side of the equation (48) are expressed as fractions, but if these are calculated, the numerator of each element is divisible by the denominator, and _each element of the matrix X1 becomes an integer.

古典計算部１４０１の演算部は、行列β_１ ^－”の行ベクトルの集合で定義される基底をＢ_１ ^－”に設定する（ステップＳ１４１２ｋ）。 8. The arithmetic unit of the classical calculation unit 1401 replaces the first to nth rows of the equation (42) (that is, the part of ( _{In On, n'-n)) with the n × n'matrix X 1} . ^The matrix β _1- "shown in the following equation (49) is generated.

The arithmetic unit of the classical calculation unit 1401 sets the basis defined by the set of row vectors of the matrix β ₁ ⁻ "to B ₁ ⁻ " (step S1412k).

After that, the arithmetic unit of the classical calculation unit 1401 executes the above-mentioned step S1412g. Then, for example, B ⁻ = B ₁ ⁻ ”and the above-mentioned region R (ΓB ⁻ ) or R (ΓB ^{− *} ) as the region R, and the subsequent processing of the quantum calculation unit 112, processing of the selection unit 102, and The processing of the classical calculation unit 103 is performed.

<< Processing of selection unit 102 >>
The selection unit 102 describes each node (B ₁ , g _0'T -j', a _{j (1)} ^T ) corresponding to the depth ^D = 1 based on the result of the swap test performed by the quantum calculation unit 112. , Probabilities p _{1, j'that} are evaluation values corresponding to each j'= 0, 1, 2, ..., 10 are calculated, and based on these evaluation values, X _{j (1)} at a depth D = 1 Find the value α _{j (1)} . In this specific example, when the processing of the quantum calculation unit 112 is executed using R (2B _1- " ^{* )} as the region R, the probabilities p _{1, j'are} as follows.
p _1,0 = 0.500007
p _1,1 = 0.500167
p _1,2 = 0.500019
p _1,3 = 0.500106
p _1,4 = 0.500013
p _1,5 = 0.500133
p _1,6 = 0.500007
p _1,7 = 0.50128
p _1,8 = 0.500071
p _1,9 = 0.500012
p _1,10 = 0.500721
In the above example, when the swap test is performed 10,000 times, 0 (acceptance, Yes) of about 5007 times is obtained for j = 10, whereas it is only about 5001 times for j ≠ 10. 0 (acceptance, Yes) cannot be obtained. Therefore, the selection unit 102 outputs _{10 corresponding to the highest probability p 1,10 among} the probabilities p 1, ₀ , p ₁ , 1, ..., P 1, 10 as α _{j (1)} . Further, the selection unit 102 calculates and outputs g ₁ '= g _0-10 · a _{j (1)} .

Compared with the specific example of the fourth embodiment, the difference between the probabilities p _1,10 of the specific example of the eighth embodiment and the other probabilities p _1,0 , ..., P 1, ₉ is remarkably small in the grid. This is because the dimension of the space to be embedded is too small. In order to increase the difference between the probabilities p _1,10 and the other probabilities p _1,0 , ..., P _1,9 , the number of dimensions n'should be increased. FIG. 13 illustrates the relationship between the number of dimensions n'and the probabilities p _{1, j'} (where j'= 0, ..., 10). From FIG. 13, it can be seen that the difference between the probabilities p _1,10 and the other probabilities p _1,0 , ..., P 1, ₉ increases by increasing the number of dimensions n'. In general, the number of dimensions n'in space required to select the correct j'depends on the number of dimensions n of the original lattice, the basis B ₁ ', and the magnitude of the error || error ||. If the dimension n'of the space in which the grid is embedded is increased and the basis B _1'is selected well, it is possible to solve a larger error.

[9th Embodiment]
In the ninth embodiment, a data set and a class label, which are training data, are input, and supervised learning of a feedforward neural network is performed using any of the methods of the fourth and eighth embodiments (FIG. 14). Since the neural network handled in this embodiment is only a forward propagation type, the description of "forward propagation type" is omitted below and is simply referred to as "neural network".

FIG. 15 shows a configuration diagram of a neural network. A neural network is represented by a weighted directed graph of nodes called a unit, and is composed of an input layer, a hidden layer, and an output layer. A neural network without a hidden layer is called a single-layer neural network. Further, a neural network having one or more hidden layers is called a deep (multilayer) neural network. Except for units with fixed values called bias units, it is assumed that the units are labeled with variables with real (floating point) values. Hereinafter, the L "th layer (L" = 1, 2, ..., D "-2, D" -1, D "), ι" th (ι "= 0, 1, 2, ..., M) unit. The variable of is expressed as x _{ι "} ^(L") , where D "is an integer of 2 or more and m is a positive integer. The unit corresponding to ι "= 0 is the bias unit, and the fixed value of the bias unit is 1 for all depths L".

ここで、Ｗ_{ι”，κ”} ^（Ｌ”）は第Ｌ”層目のι”番目のユニットと、第Ｌ”＋１層目のκ”番目のユニットとの間の重みを意味する実数値である。なお、本来「ｘ_κ” ^{（Ｌ”＋１）}」「Ｗ_{ι”，κ”} ^（Ｌ”）」等の上付き添え字は下付き添え字の真上に表記すべきであるが、記載表記の制約上、上付き添え字を下付き添え字の右上に表記することがある。また、Ψは活性化関数（activation function）と呼ばれる非線形の関数である。活性化関数Ψの例は、シグモイド（Sigmoid）関数（ロジスティック（Logistic）関数とも呼ばれる）

や、双曲線正接（tanh）

などであるが、以下に示すアルゴリズムはこれらの活性化関数に限定されない。なお、説明の便宜上、本実施形態では活性化関数Ψの逆像が一意に定まるものとする。ｅ_ｎａｐは自然対数の底（ネイピア数）を表す。 From the values of the variables x ₁ ^{(L ")} , ..., x _m ^(L") in the L "th layer (L" = 1, 2, ..., D "-2, D" -1), the L "+1 The value of the variable x _{κ "} ^{(L" + 1)} of the κ "th unit of the layer is calculated as follows.

Here, W _{ι ", κ"} ^{(L ")} is a real value meaning the weight between the ι" th unit of the L "th layer" and the κ "th unit of the L" + 1st layer. There is. Originally, superscripts such as "x _κ" ^{(L "+ 1)} ", "W _{ι", κ "} ^(L") "should be written directly above the subscripts, but they are described. Due to notational restrictions, the subscript superscript may be written in the upper right corner of the subscript superscript. Also, Ψ is a non-linear function called the activation function. An example of the activation function Ψ is the Sigmoid function (also known as the Logistic function).

Or hyperbolic tangent (tanh)

However, the algorithms shown below are not limited to these activation functions. For convenience of explanation, the inverse image of the activation function Ψ is uniquely determined in this embodiment. e _nap represents the base of the natural logarithm (Napier number).

および各データセット｛ａ”_ｉ，１，…，ａ”_ｉ，ｍ｝に対するクラスラベルｇ”_ｉからなるベクトル

と、ニューラルネットワークの深さＤ”とが与えられたときに、各ｉ＝１，２，３，…，ｎ番目のデータセット｛ａ”_ｉ，１，…，ａ”_ｉ，ｍ｝について、変数ｘ_ｊ ^（１）に各要素ａ”_ｉ，ｊ（ｊ＝１，…，ｍ）を代入し、式（５０）（５１）により、深さＬ”＝２，３，…，Ｄ”の順序で変数ｘ_ｊ ^（Ｌ”）（ただし、１≦Ｌ”＜Ｄ”のとき１≦ｊ≦ｍであり、Ｌ”＝Ｄ”のときｊ＝１である）の値ａ”_ｉ，ｊ ^（Ｌ”）を計算して得られる、Ｌ”＝Ｄ”に対する変数ｘ_ｊ ^（Ｄ”）の値ａ”_ｉ，１ ^（Ｄ”）が

を満たすような重みＷ_{ι”，κ”} ^（Ｌ”）（ただし、１≦Ｌ”＜Ｄ”－２のとき０≦ι”≦ｍ，１≦κ”≦ｍであり、Ｌ”＝Ｄ”－１のとき０≦ι”≦ｍ，κ”＝１である）を決めることである。ただし、Ｒｅは実数の集合を表し、

はα１とα２との近似することを表す。 Supervised learning of a neural network consists of n sets of m-dimensional data sets {a " _{i, 1} , ..., a" _{i, m} } (i = 1, 2, 3, ..., N) which are training data. queue

And a vector consisting of the class label g " _i for each dataset {a" _{i, 1} , ..., a " _{i, m} }"

And the depth D of the neural network, for each i = 1, 2, 3, ..., Nth data set {a " _{i, 1} , ..., a" _{i, m} }. Substituting each element a " _{i, j} (j = 1, ..., M) into the variable x _j ⁽¹⁾ , and using equations (50) and (51), the depth L" = 2,3, ..., D " Variables x _j ^{(L ")} in order (however, 1 ≤ j ≤ m when 1 ≤ L"<D"and j = 1 when L" = D ") values a" _{i, j} ⁽ The value a " _{i, 1} ^(D") of the variable x _j ^{(D ")} for L" = D ", which is obtained by calculating ^L") , is

Weights that satisfy W _{ι ", κ"} ^{(L ")} (However, when 1 ≤ L"<D"-2, 0 ≤ ι" ≤ m, 1 ≤ κ "≤ m, and L" = D " When -1, 0 ≤ ι "≤ m, κ" = 1) is to be determined. However, Re represents a set of real numbers.

Represents an approximation between α1 and α2.

ここで、

である。式（５３）の

はｍ×１行列Ｕ１とｍ×ｍ行列Ａ_ｔ ^（Ｌ”）を行方向（横方向）に並べて作ったｍ×（ｍ＋１）行列を意味する。式（５４）の

はＺ^{（Ｌ”＋１）}の各要素に活性化関数Ψを作用させて得られた各要素からなる行列（Ｚ^{（Ｌ”＋１）}と同じサイズの行列）を表す。 Expressing this in a mathematical formula, supervised learning of a neural network is the following equation (52) (53) (54) from a given n × _m matrix At, n + 1 matrix G ”and integer D” ≧ 2. W ⁽¹⁾ , W ⁽²⁾ , ..., W ^{(D "-1)} satisfying the equation (55) are determined for the n × 1 matrix _At ^(D") calculated by ..

here,

Is. Of equation (53)

Means an m × (m + 1) matrix made by arranging an m × 1 matrix U1 and an m × _m matrix At ^{(L ”)} in the row direction (horizontal direction).

Represents a matrix consisting of each element obtained by applying the activation function Ψ to each element of Z ^{( L "+1) (} a matrix having the same size as Z (L" + 1)).

このニューラルネットワークの教師あり学習では、式（５６）を満たすＷ_０，１ ^（１），Ｗ_１，１ ^（１），…，Ｗ_ｍ，１ ^（１）を計算する。 In this embodiment, supervised learning of the neural network is performed by using any of the methods of the 4th and 8th embodiments. The concept will be explained below.
<< In the case of single-layer neural network (D "= 2) >>
For the sake of simplicity, the case of a single-layer neural network will be described first. From equations (52) (53) (54) (55), the following holds.

In the supervised learning of this neural network, W ₀ , 1 ⁽¹⁾ , W _{1, 1} ⁽¹⁾ , ..., W _{m, 1} ⁽¹⁾ satisfying the equation (56) are calculated.

そのため、第４，８実施形態の何れかの手法を用いて式（５７）のＬＷＥ問題の解Ｘ_０，Ｘ_１，…，Ｘ_ｍを求め、求めた解をＷ_０，１ ^（１）＝Ｘ_０，Ｗ_１，１ ^（１）＝Ｘ_１，…，Ｗ_ｍ，１ ^（１）＝Ｘ_ｍに設定することができる。ｄ＝（ｄ_１，…，ｄ_ｎ）^Ｔは短いベクトルである。第４，８実施形態のＬＷＥ問題ではｊ＝１，…，ｍであり、解が（Ｘ_１，…，Ｘ_ｍ）^Ｔであったが、第４，８実施形態においてｊ＝１，…，ｍをι”＝０，１，２，…，ｍに置換することで、式（５７）のＬＷＥ問題の解Ｘ_０，Ｘ_１，…，Ｘ_ｍを求めることができる。 Here, select a sufficiently large integer s ", and let N be a power of 2 that is sufficiently larger than s". For example, select an integer as s "that is greater than or equal to the number of significant digits in the binary representation in the computer, and let N be a power of 2 that is sufficiently larger than s". An example of N that is sufficiently larger than s "is N that satisfies N>(s") ² m. As a specific example of s "and N, for example, when the number of significant digits in the binary representation is 64 and m = 210, N = ^{2 140} >(s") ² m> s "= 2 ⁶⁴ . Select s ”and N to meet. At this time, s "a" _{i, j} and s "Ψ ^-1 (g" _i ) may be considered as integers (i = 1, ..., n, j = 1, ..., M). Then, the equation (56) is equivalent to the LWE problem of the following equation (57).

Therefore, the solution X ₀ , X ₁ , ..., X _m of the LWE problem of the equation (57) is obtained by using any of the methods of the fourth and eighth embodiments, and the obtained solution is W ₀ , 1 ⁽¹⁾ =. It can be set to X ₀ , W ₁ , 1 ⁽¹⁾ = X ₁ , ..., W _{m, 1} ⁽¹⁾ = X _m . d = (d ₁ , ..., d _n ) ^T is a short vector. In the LWE problem of the 4th and 8th embodiments, j = 1, ..., M and the solution was (X ₁ , ..., X _m ) ^T , but in the 4th and 8th embodiments, j = 1, ..., By substituting m with ι "= 0, 1, 2, ..., M, the solution X ₀ , X ₁ , ..., X _m of the LWE problem of Eq. (57) can be obtained.

≪In the case of deep neural network (D” ≧ 3) ≫
Next, the case of a deep neural network will be described. In the supervised learning of the deep neural network in this embodiment, the weights W _{ι ", κ"} ^{(L ")} are positive in the order of L" = 1, 2, ..., D "-1 (that is, from front to back). The calculation is performed in order. The processing in the case of L "= D" -1 is the same as that in the case of the single-layer neural network. In the following, W _{ι ", κ} for 1 <L"<D"-1. Assuming that _" ^{(L" -1)} (0≤ι "≤m, 1≤κ"≤m) has already been calculated, W _{ι ", κ"} ^{(L ")} (0≤ι" ≤m, 1≤ The calculation method of κ ”≦ m) is shown.

に設定する。１＜Ｌ”＜Ｄ”－１の場合には、式（５２）（５３）（５４）を用いてＷ_{ι”，κ”} ^{（Ｌ”－１）}（０≦ι”≦ｍ，１≦κ”≦ｍ）から、変数ｘ_κ” ^（Ｌ”）の値ａ”_{ι”，κ”} ^（Ｌ”）が計算される。次に、第４，８実施形態の何れかの手法を用い、以下の式（５８）のＬＷＥ問題の解Ｘ＝（Ｘ_０，Ｘ_１，…，Ｘ_ｍ）^Ｔの候補値を求め、求めた解Ｘの候補値をＷ_{ι”，κ”} ^（Ｌ”）（０≦ι”≦ｍ，１≦κ”≦ｍ）に設定する。

ｄ＝（ｄ_１，…，ｄ_ｎ）^Ｔは短いベクトルである。式（５８）のＬＷＥ問題に一意的な解が存在する場合、ＬＷＥ問題の求解計算過程において、解Ｘ＝（Ｘ_０，Ｘ_１，…，Ｘ_ｍ）^Ｔの一つの候補値だけが他と比べて極端に短い差分ベクトルｄに対応する。そのため、差分ベクトルｄの長さ||ｄ||から正しい解を見分けやすい。一方、ニューラルネットワークの学習では、重みの準最適値が多数存在すると考えられ、解Ｘの候補値の多くが似たような長さ||ｄ||の差分ベクトルｄを持つ可能性がある。そこで、式（５８）を解いて、長さ||ｄ||が短い順で１番目からｍ番目までである差分ベクトルｄに対応するｍ組の解Ｘの候補値を選択し、κ”（１≦κ”≦ｍ）番目の解Ｘ＝（Ｘ_０，Ｘ_１，…，Ｘ_ｍ）^Ｔの候補値を（Ｗ_０，κ” ^（Ｌ”），Ｗ_１，κ” ^（Ｌ”），…，Ｗ_ｍ，κ” ^（Ｌ”））^Ｔとする。なお、第４実施形態等の選択部１０２では、スワップテストの結果が受理となる確率ｐ_Ｄ，０，ｐ_Ｄ，１，…，ｐ_{Ｄ，Ｎ－１}を求め、この中から最も高い確率ｐ_{Ｄ，ｊｍａｘ}に対応するｊｍａｘ∈｛０，１，２…，Ｎ－１｝をα_ｊ（Ｄ）＝Ｘ_ｊ（Ｄ）として出力していたが、Ｘ_ｊ（Ｄ）の候補値は確率ｐ_Ｄ，０，ｐ_Ｄ，１，…，ｐ_{Ｄ，Ｎ－１}の中から確率の高い順に選択した複数個の確率に対応するｊである。 First, when L "= 1

Set to. In the case of 1 <L "<D" -1, W _{ι ", κ"} ^{(L "-1)} (0 ≤ ι" ≤ m, 1 ≤ κ using equations (52) (53) (54). From "≤m), the values a" _{ι ", κ"} (L ") of the variable x _κ" ^{( L ")} are calculated. Next, using any of the methods of the 4th and 8th embodiments, the following The candidate value of the solution X = (X ₀ , X ₁ , ..., X _m ) ^T of the LWE problem of the equation (58) is obtained, and the candidate value of the obtained solution X is W _{ι ”, κ”} ^{(L ”)} ( Set to 0 ≦ ι ”≦ m, 1 ≦ κ” ≦ m).

d = (d ₁ , ..., d _n ) ^T is a short vector. When a unique solution exists in the LWE problem of equation (58), only one candidate value of solution X = (X ₀ , X ₁ , ..., X _m ) ^T is the other in the solution calculation process of the LWE problem. Corresponds to the extremely short difference vector d. Therefore, it is easy to distinguish the correct solution from the length || d || of the difference vector d. On the other hand, in neural network learning, it is considered that there are many semi-optimal values of weights, and many of the candidate values of solution X may have a difference vector d of similar length || d ||. Therefore, by solving the equation (58), the candidate values of the m sets of solutions X corresponding to the difference vector d whose lengths || d || are from the first to the mth in ascending order are selected, and κ ”(. 1 ≤ κ "≤ m) th solution X = (X ₀ , X ₁ , ..., X _m ) ^T candidate values are (W _{0, κ"} ^{(L ")} , W _{1, κ"} ^{(L ")} , …, W _{m, κ ”} ^(L”) ) ^{Let T} be. In the selection unit 102 of the fourth embodiment or the like, the probabilities p _{D, 0} , p _{D, 1} , ..., P _{D, N-1} that the result of the swap test is accepted are obtained, and the highest probability p is obtained from these. The jmax ∈ {0, 1, 2, ..., N-1} corresponding to _{D, jmax} was output as α _{j (D)} = X _{j (D)} , but the candidate value of X _{j (D)} is the probability p. It is j corresponding to a plurality of probabilities selected from _{D, 0} , p _{D, 1} , ..., P _{D, N-1} in descending order of probability.

また、式（５８）において各要素はＮに対して十分小さいため、ｍｏｄ Ｎを無視すると以下の式（６０）が成り立つ。

ｃ”を｜Ψ（ｚ_１”）－Ψ（ｚ_２”）｜≦ｃ”｜ｚ_１”－ｚ_２”｜を満たす適当な数とすると（例えば、ｃ”はΨ（ｚ_１”）の微分値の絶対値の上界とすればよい）、式（５９）（６０）より、以下の式（６１）が成り立つ。

Ｌ”が大きくなるに従って式（６１）の右辺（差分ベクトルの長さ）が小さくなるように重みＷ_０，κ” ^（Ｌ”），Ｗ_１，κ” ^（Ｌ”），…，Ｗ_ｍ，κ” ^（Ｌ”）が選ばれるため、式（６１）の左辺はＬ”が大きくなるにつれて０に近づいていく。 When the weights W _{ι ", κ"} ^{(L ")} are determined in this way, the value a" _{i, j} ^{(L "+1)} of the variable x _j ^{(L" + 1)} of the unit of the L "+1 layer becomes the first. It can be expected that the class label g " _i is closer than the value a" _{i, j} ^{(L "} ) of the variable x _j ^(L") of the unit of the L "layer. This is due to the following reasons.
From the definition of a " _{i, j} ^{(L" + 1)} by the equations (52), (53) and (54), the following holds.

Further, since each element is sufficiently small with respect to N in the equation (58), the following equation (60) holds if mod N is ignored.

If c "is an appropriate number that satisfies | Ψ (z ₁ ")-Ψ (z ₂ ") | ≤ c" | z ₁ "-z ₂ " | (for example, c "is Ψ (z ₁ ")). The upper bound of the absolute value of the differential value may be used), and the following equation (61) holds from the equations (59) and (60).

Weights W _{0, κ "} ^(L") , W _{1, κ "} ^(L") , ..., W _m, so that the right side (length of the difference vector) of equation (61) becomes smaller as L "becomes larger. _{Since κ "} ^(L") is selected, the left side of equation (61) approaches 0 as L "becomes larger.

<Structure>
As illustrated in FIG. 16, the learning system 15 of the present embodiment has a learning device 150 and any of the calculation devices 10 and 14 described in the fourth and eighth embodiments. The learning device 150 includes an initial setting unit 151, an LWE problem processing unit 152, an activation function calculation unit 153, and a control unit 154. The learning device 150 is connected to any of the calculation devices 10 and 14 through a network, for example.

および各データセット｛ａ”_ｉ，１，…，ａ”_ｉ，ｍ｝（ｉ＝１，２，３，…，ｎ）に対するクラスラベルｇ”_ｉ（ｉ＝１，２，３，…，ｎ）からなるベクトル

と、ニューラルネットワークの深さＤ”とが入力される。学習装置１５はこれらを用いて以下の各処理を実行する。 <Processing>
The processing of this embodiment will be described.
The learning device 15 has a matrix consisting of n sets of m-dimensional data sets {a " _{i, 1} , ..., a" _{i, m} } (i = 1, 2, 3, ..., N) which are training data.

And the class label g " _i (i = 1,2,3, ..., n) for each data set {a" _{i, 1} , ..., a " _{i, m} } (i = 1,2,3, ..., n). ) Vector

And the depth D of the neural network are input. The learning device 15 executes each of the following processes using these.

The initial setting unit 151 sets L " ₌ 1 and sets a" _{i, j} ⁽¹⁾ as follows using the matrix At (step S151).

The LWE problem processing unit 152, the activation function calculation unit 153, and the control unit 154 execute the following steps S152a and S153a in the order of L "= 1, 2, ..., D" -2.

なお、式（６２）は、式（６３）のＬＷＥ問題と等価である。

ｓ”は十分大きな整数である。ｓ”の例は、コンピュータにおける２進表現の有効桁数を超える整数である。また、第４，８実施形態のＬＷＥ問題ではｊ＝１，…，ｍであり、解が（Ｘ_１，…，Ｘ_ｍ）^Ｔであったが、計算装置１０，１４は、第４，８実施形態においてｊ＝１，…，ｍをι”＝０，１，２，…，ｍに置換することで、式（６２）（６３）のＬＷＥ問題の解Ｘ＝（Ｘ_０，Ｘ_１，…，Ｘ_ｍ）^Ｔの候補値を求めて出力する。なお、式（６３）の

は、それぞれ、式（１０）（３３）（４０）の

に相当する。解Ｘ＝（Ｘ_０，Ｘ_１，…，Ｘ_ｍ）^Ｔの候補値は、ＬＷＥ問題処理部１５２に入力される。ＬＷＥ問題処理部１５２は、解Ｘの候補値のうち、対応するｄ＝（ｄ_１，…，ｄ_ｎ）^Ｔの長さ||ｄ||が短い順にｍ組の解Ｘの解候補を選択し、選択したｍ組の解Ｘの解候補を（Ｗ_０，κ” ^（Ｌ”），Ｗ_１，κ” ^（Ｌ”），…，Ｗ_ｍ，κ” ^（Ｌ”））^Ｔとする（κ”＝１，２，…，ｍ）。ＬＷＥ問題処理部１５２は、これらの（Ｗ_０，κ” ^（Ｌ”），Ｗ_１，κ” ^（Ｌ”），…，Ｗ_ｍ，κ” ^（Ｌ”））^Ｔを用い、以下のＷ^（Ｌ”）を設定して出力する。

≪Step S152a≫
The LWE problem processing unit 152 sends the LWE problem of the following equation (62) to any of the calculation devices 10 and 14. The arithmetic units 10 and 14 to which the LWE problem was sent solve the following equation (62) as described above to generate candidate values for the solution X = (X ₀ , X ₁ , ..., X _m ) ^T. Output.

The equation (62) is equivalent to the LWE problem of the equation (63).

s "is a sufficiently large integer. An example of s" is an integer that exceeds the number of significant digits in the binary representation in a computer. Further, in the LWE problem of the 4th and 8th embodiments, j = 1, ..., M, and the solution was (X ₁ , ..., X _m ) ^T , but the arithmetic units 10 and 14 have the 4th and 8th. By substituting j = 1, ..., M with ι "= 0, 1, 2, ..., M in the embodiment, the solution of the LWE problem of equations (62) and (63) X = (X ₀ , X ₁ , 1, ..., X _m ) The candidate value of ^T is obtained and output. Note that the equation (63) is used.

Are of equations (10), (33) and (40), respectively.

Corresponds to. The candidate value of the solution X = (X ₀ , X ₁ , ..., X _m ) ^T is input to the LWE problem processing unit 152. Among the candidate values of the solution X, the LWE problem processing unit 152 selects the solution candidates of the m set of the solution X in the order of the shortest length || d || of the corresponding d = (d ₁ , ..., d _n ) ^T. Then, the solution candidates of the selected m sets of solutions X are (W _{0, κ "} ^(L") , W _{1, κ "} ^(L") , ..., W _{m, κ "} ^(L") ) ^T ( κ "= 1, 2, ..., M). The LWE problem processing unit 152 has these (W _{0, κ"} ^{(L ")} , W _{1, κ"} ^{(L ")} , ..., W _{m, κ"} ^{( L ")} ) Using ^T , set the following W ^(L") and output.

<< Step S153a >>
Next, the activation function calculation unit 153 sets a " _{j, κ"} ^{(L "+1)} (1 ≦ j, κ” ≦ m) as follows and outputs it (step S153a).

<< Step S154 >>
The control unit 154 determines whether or not L "= D" -2. If L "= D" -2 is not satisfied, the process returns to the process of step S152a with L "+1 as a new L". If L "= D" -2, the process proceeds to the next step S152b.

なお、式（６４）は、式（６５）のＬＷＥ問題と等価である。

なお、式（６５）の

は、それぞれ、式（１０）（３３）（４０）の

に相当する。解Ｘ＝（Ｘ_０，Ｘ_１，…，Ｘ_ｍ）^Ｔは、ＬＷＥ問題処理部１５２に入力される。ＬＷＥ問題処理部１５２は、解Ｘ＝（Ｘ_０，Ｘ_１，…，Ｘ_ｍ）^Ｔを（Ｗ_０，１ ^{（Ｄ”－１）}，Ｗ_１，１ ^{（Ｄ”－１）}，…，Ｗ_ｍ，１ ^{（Ｄ”－１）}）^Ｔとする。ＬＷＥ問題処理部１５２は、これらの（Ｗ_０，１ ^{（Ｄ”－１）}，Ｗ_１，１ ^{（Ｄ”－１）}，…，Ｗ_ｍ，１ ^{（Ｄ”－１）}）^Ｔを用い、以下のＷ^{（Ｄ”－１）}を設定して出力する。

<< Step S152b >>
The following processing is executed for L "= D" -1.
The LWE problem processing unit 152 sends the LWE problem of the following equation (63) to any of the calculation devices 10 and 14. The arithmetic units 10 and 14 to which the LWE problem is sent solve the following equation (63) as described above to generate and output the solution X = (X ₀ , X ₁ , ..., X _m ) ^T.

The equation (64) is equivalent to the LWE problem of the equation (65).

In addition, in formula (65)

Are of equations (10), (33) and (40), respectively.

Corresponds to. The solution X = (X ₀ , X ₁ , ..., X _m ) ^T is input to the LWE problem processing unit 152. The LWE problem processing unit 152 sets the solution X = (X ₀ , X ₁ , ..., X _m ) ^T to (W ₀ , 1 ^{(D "-1)} , W _{1, 1} ^{(D" -1)} , ..., W. _{m, 1} ^{(D "-1)} ) ^T. The LWE problem processing unit 152 has these (W ₀ , 1 ^{(D" -1)} , W _{1, 1} ^{(D "-1)} , ..., W _m . _{, 1} ^{(D "-1)} ) Using ^T , set the following W ^{(D" -1)} and output.

<< Step S153b >>
Next, the activation function calculation unit 153 sets a " _{j, 1} ^{(D" + 1)} (1 ≦ j ≦ m) as follows and outputs the output.

The learning device 15 outputs W ⁽¹⁾ , ..., W ^{(D "-1)} obtained as described above as the weight of the neural network.

[Other variants]
The present invention is not limited to the above-described embodiment. For example, the various processes described above may not only be executed in chronological order according to the description, but may also be executed in parallel or individually as required by the processing capacity of the device that executes the processes. In addition, it goes without saying that changes can be made as appropriate without departing from the spirit of the present invention.

Classic calculation unit 71, 73, 87, 101, 103, 111, 127, 1401, control unit 74, 86, initial setting unit 81, base selection unit 82, representative source selection unit 83, child node generation unit 84, node selection unit The 85, the computing device 6, and the learning device 150 include, for example, a processor (hardware processor) such as a CPU (central processing unit) and a memory such as a RAM (random-access memory) and a ROM (read-only memory). A general-purpose or dedicated computer is configured to execute a predetermined program. This computer may have one processor and memory, or may have a plurality of processors and memory. This program may be installed in a computer or may be recorded in a ROM or the like in advance. Further, it is not a processing circuitry that is an electronic circuit that realizes a functional configuration by reading a program like a CPU, but a processing circuitry that is an electronic circuit that realizes a processing function without using a program. A part or all of the arithmetic units may be configured by using. Further, the electronic circuit constituting one device may include a plurality of CPUs. The quantum calculation units 72 and 112 are configured by a known quantum computer (processing circuits by a quantum computer).

A specific configuration example of a quantum computer is shown below.
1. 1. Quantum gate (quantum circuit) -based method type: A quantum gate type quantum computer is a quantum computer that realizes calculations by sequentially applying basic operations called qubits to qubits. The application order of quantum gates can be described as a quantum circuit. In a quantum gate type quantum computer, by applying an operation corresponding to a quantum gate to a quantum bit, the quantum state encoded by a set of quantum bits (qubits) changes sequentially, and finally the quantum state is changed. The calculation result can be obtained by observing. The quantum gate type quantum computer is the most orthodox method, has a long history of research, and hardware development is progressing (see Reference 12). Many companies such as IBM, Google, Intel, Rigetti, and IonQ are developing quantum computers based on this method, and as of 2018, the scale has reached dozens of cubics.
[Reference 12] Michael A. Nielsen and Isaac L. Chuang, Quantum Computation and Quantum Information, Cam-bridge: Cambridge University Press (2000) ISBN 0-521-63235-8, MR 1796805.

2. 2. Adiabatic Quantum Computation: Quantum computers based on adiabatic quantum computation perform calculations by adiabically changing the physical system from a simple Hamiltonian to a (complex) Hamiltonian that describes a solution to a given problem with a base state. do. Adiabatic quantum computation has been proven to be equivalent in polynomial time to quantum circuit models (see reference 13).
[Reference 13] Farhi, E .; Goldstone, J .; Gutmann, S .; Sipser, M. (2000). "Quantum Computation by Adiabatic Evolution". ArXiv: quant-ph / 0001106v1 Freely accessible.
Quantum Annealing is also known as a method similar to adiabatic quantum computation (see Reference 14). As of 2018, D-wave of Canada has released a 2048 cubic computer based on quantum annealing. It has been introduced by multiple research institutes.
[Reference 14] Kadowaki, T .; Nishimori, H. (1998-11-01). "Quantum annealing in the transverse Ising model". Physical Review E. 58: 5355. ArXiv: cond-mat / 9804280 Freely accessible. Bibcode : 1998PhRvE..58.5355K. Doi: 10.1103 / PhysRevE.58.5355.

3. 3. Topological quantum computation: A quantum computer based on topological quantum computation is a quantum computer using elementary particles called Majorana fermions, which are expected to exist theoretically but have not been experimentally confirmed. Equivalent to a quantum computer based on (see Reference 15). Compared to the quantum circuit method, it is more resistant to quantum errors and is considered to be advantageous for large scale.
[Reference 15] Freedman, Michael; Kitaev, Alexei; Larsen, Michael; Wang, Zhenghan (2003-01-01). "Topological quantum computation". Bulletin of the American Mathematical Society. 40 (1): 3138. ArXiv: quant-ph / 0101025 Freely accessible. Doi: 10.1090 / S0273-0979-02-00964-3. ISSN 0273-0979.

4. Observation-based quantum calculation (unidirectional quantum calculation): In a quantum computer based on observation-based quantum calculation, a large number of entangled cue bits are prepared, and these cue bits are observed sequentially from the end, and the following are performed according to the observation results. Perform the calculation by changing the observation base. Observation-based quantum computation has been proven to be equivalent in polynomial time to quantum circuit models (see reference 16).
[Reference 16] R. Raussendorf; DE Browne & HJ Briegel (2003). "Measurement based Quantum Computation on Cluster States". Phys. Rev. A. 68 (2): 022312. ArXiv: quant-ph / 0301052 Freely accessible.
Bibcode: 2003PhRvA..68b2312R. Doi: 10.1103 / PhysRevA.68.022312.

It should be noted that a large amount of hardware-related resources are required to obtain an accurate solution in the 5th to 8th embodiments, and a high-dimensional grid problem can be solved by using these embodiments. On the other hand, the 1-4th embodiment does not require a large resource like the 5th-8th embodiment, but cannot solve a high-dimensional lattice problem. This is because the method of the first to fourth embodiments does not have a parameter that can be adjusted according to the difficulty of the problem such as the dimension of the space in which the grid is embedded described in the fifth to eighth embodiments. Therefore, it is desirable to consider the advantages and disadvantages of each and use an appropriate method.

When the above configuration is realized by a computer (classical computer and quantum computer), the processing content of the function that each device should have is described by a program. By executing this program on a computer, the above processing function is realized on the computer. The program describing the processing content can be recorded on a computer-readable recording medium. An example of a computer-readable recording medium is a non-transitory recording medium. Examples of such recording media are magnetic recording devices, optical discs, optomagnetic recording media, semiconductor memories, and the like.

The distribution of this program is performed, for example, by selling, transferring, renting, or the like a portable recording medium such as a DVD or a CD-ROM in which the program is recorded. Further, the program may be stored in the storage device of the server computer, and the program may be distributed by transferring the program from the server computer to another computer via a network.

A computer that executes such a program first temporarily stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads the program stored in its own storage device and executes the process according to the read program. Another form of execution of this program may be for the computer to read the program directly from the portable recording medium and perform processing according to the program, and further, each time the program is transferred from the server computer to this computer. , Sequentially, the processing according to the received program may be executed. Even if the above processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition without transferring the program from the server computer to this computer. good.

Instead of executing a predetermined program on a computer to realize the processing functions of the present device, at least a part of these processing functions may be realized by hardware.

The industrial applicability of the present invention is illustrated below. However, these availabilitys are merely examples and do not limit the present invention. By using the present invention, it is possible to efficiently solve a partial problem of a lattice problem, which is a kind of combinatorial optimization problem. This affects, for example, two industrial fields. The fields of artificial intelligence and quantum cryptography.

For example, by applying the present invention, it is possible to efficiently (high-speed) solve a partial problem of a combinatorial optimization problem in the field of artificial intelligence. For example, by implementing the present invention on a gated quantum computer and on a classical computer, various phenomena such as industry, materials, medicine, medicine, energy, physics, chemistry, economy, and the real world can be simulated at high speed using artificial intelligence. It will be possible to contribute to the rapid progress and development of each field.

Hereinafter, a more specific description will be given. Recently, the vector problem, the shortest vector problem, and LWE are all problems called NP-hard, and it is known that other NP (nondeterministic polynomial time complexity class) problems can be efficiently reduced to these problems. Since the solution to the original NP problem can be obtained by solving the resulting problem, the quantum algorithm proposed in the present invention can be applied to, for example, all NP problems. The NP problem includes many important problems centered on artificial intelligence, and has an extremely wide range of industrial applications. List typical application examples.

1. 1. Optimal route selection for autonomous driving of cars:
The optimum route selection in the automatic driving of a car is formulated by the NP-complete problem called the traveling salesman problem. This problem has been studied for a long time in the field of artificial intelligence, and when the number of vertices increases, it becomes difficult to find the optimum solution with a classical computer. Therefore, in recent years, the application of quantum computers (particularly quantum annealing) to this problem has been actively studied.
2. Optimization of large-scale integrated circuits:
By expressing the problem of optimizing a large-scale integrated circuit with a logical formula, it becomes a Constraint Satisfaction Problem. This problem is a typical problem in artificial intelligence, and because of its high usefulness, it has a long history of research using classical algorithms. This problem is one of the most promising applications of quantum computers.
3. 3. Network infrastructure optimization:
Optimizing large-scale and complicated urban functions such as electricity / gas / water networks, transportation / communication networks, and oil / gas pipelines has been difficult due to the explosion of calculations. The application of the quantum algorithm proposed in the present invention is expected to solve these problems.

For example, the problem of optimal route selection in the automatic driving of a car results in a grid problem by expressing the combination of routes with a vector. When the length of the path becomes less than a certain distance, the vector is encoded so as to approach the lattice point by a certain distance or less so that the information about the path can be obtained by solving the lattice problem. See reference 17 below for a more detailed explanation of how to reduce the NP-complete problem to the grid problem.
[Reference 17] Daniele Micciancio and Sha_ Goldwasser, Complexity of Lattice Problems: a cryptographic perspective,
Kluwer Academic Publishers, The Kluwer International Series in Engineering and Computer Science, vol. 671 (2002).
For other NP-complete issues, please refer to the following documents.
[Reference 18] Michael R. Garey and David S. Johnson, Computers and Intractability: A Guide to the Theory of NP-Completeness, WH Freeman & Co (1979).
It is expected that there is no efficient way to solve all NP problems with a classical computer among experts (P. NP conjecture). When dealing with NP-complete problems with classical computers for industrial application purposes, you may be forced to choose between using approximate calculation results at the expense of solution accuracy or limiting to partial problems to obtain an exact solution. many. On the other hand, when the quantum algorithm of the present invention is used, the accuracy of the calculation result can be remarkably improved, and the condition of limitation to the partial problem can be relaxed. As a result, it will be possible to provide services that could not be provided until now.

Further, in the field of quantum cryptography, the present invention may impair the security of conventional lattice-based cryptography. It is necessary to take measures such as lengthening the key length to compensate for the vulnerability, but changing the key length may lead to deterioration of cryptographic efficiency. If the present invention is used for the evaluation of the security of lattice-based cryptography and the evaluation of cryptographic efficiency, it is expected to contribute to the development of a cryptographic method that solves these problems together.

Claims (9)

It is a judgment device
The first classical calculation unit, the first quantum state generation unit, the second quantum state generation unit, the first swap test unit, the third quantum state generation unit, the fourth quantum state generation unit, the second swap test unit, and the second classical calculation unit. Has a part and
n, N are positive integers, i = 1, ..., _n , im is an imaginary unit, η ^T is a translocation of η, | Λ | is the number of elements of Λ, || η || is the length of η, <τ, χ> is the inner product of τ and χ, η1 ⊆ η2 means that η1 is a subset of η2, and B = {b ₁ , ..., b _{n }} is a base consisting of linearly independent n-dimensional vectors bi, each of the _n -dimensional vectors bi consists of n integer elements, and L (B) is a lattice {Σ _{i = 1, ..., N.} x _i bi | x _i ∈ Z, bi ∈ B _} , where L (B ⁻ _{) is a dual lattice with respect to N defined for the base B and the integer N, and x i is} an integer. Yes, B ^- is a dual basis for N of B, R⊆Zn is a subregion belonging to the ^nth -order space consisting of integer elements, and t1 = (t ₁ , 1, ..., t _{1, n} ) ^T is. It is a target vector consisting of n integer elements t _{1, i} , and t2 = (t 2, ₁ , ..., T _{2, n} ) ^T is a target vector consisting of n integer elements t _{2, i} , and t1 ^(D) is the difference vector between the target vector t1 and the recent vector t1 ^(c) ∈ L (B) of the target vector t1 t1 ^(d) = t1-t1 ^(c) = (t _1,1 ^(d) , ..., t _{1, n} ^(d) ), where t2 ^(d) is the difference vector t2 ^(d) = t2- between the target vector t2 and the recent vector t2 ^(c) ∈ L (B) of the target vector t2. t2 ^(c) = (t _2,1 ^(d) , ..., t _{2, n} ^(d) ), and
The first classical calculation unit uses the basis B and the integer N to obtain and output the dual basis B ⁻ .
The first quantum state generator is

Generate multiple registers consisting of quantum states of
The second quantum state generator performs a quantum operation on a part of the quantum state | φ> ₀ register, and changes the quantum state of the register to which the quantum operation is performed.

To transition to
The first swap test unit executes a swap test for each pair of a quantum state | φ> ₀ register and each quantum state | φ> _t1 register, and the quantum state | φ> ₀ and the quantum state. | Φ> Determine whether the result of the swap test for the pair with _t1 is accepted or rejected.
The third quantum state generator is

Generate multiple registers consisting of quantum states of
The fourth quantum state generator performs a quantum operation on a part of the quantum state | φ> ₀ register, and changes the quantum state of the register to which the quantum operation is performed.

To transition to
The second swap test unit executes a swap test for each pair of the quantum state | φ> ₀ register and the quantum state | φ> _t2 register, and the quantum state | φ> ₀ and the quantum state | Determine whether the result of the swap test for the pair with φ> _t2 is accepted or rejected.
Using the result of the swap test, the second classical calculation unit has a probability p ₁ that the result of the swap test for the pair of the quantum state | φ> ₀ and the quantum state | φ> _t1 is accepted, and the quantum state | Calculate the probability p ₂ that the result of the swap test for the pair of φ> ₀ and the quantum state | φ> _t2 is accepted, and when p ₁ ≧ p ₂ , || t1 ^(d) || ≦ || t2 ^{( d)} Output the information indicating that it is ||, and output the information indicating that it is || t1 ^(d) ||> || t2 ^(d) || when p ₁ <p ₂ . Alternatively, when p ₁ > p ₂ , the information indicating that || t1 ^(d) || <|| t2 ^(d) || is output, and when p ₁ ≤ p ₂ , || t1 ^{(d). )} || ≧ | t2 ^(d) A determination device that outputs information indicating that it is ||. It ’s a computing device,
It has an initial setting unit, a basis selection unit, a representative element selection unit, a child node generation unit, a classical calculation unit, a node selection unit, a control unit, a first quantum state generation unit, a second quantum state generation unit, and a swap test unit. ,
n, N, ν (D), D are positive integers, i = 1, ..., _n , im is an imaginary unit, η ^T is a translocation of η, and | Λ | is Λ. It is the number of elements, || η || is the length of η, η1 ⊆ η2 means that η1 is a subset of η2, and η1 ⊂ η2 means that η1 is a true subset of η2. , <τ, χ> is the inner product of τ and χ, and B = {b ₁ , ..., b _{n }} is the base consisting of linearly independent n-dimensional vectors bi, and each of the _n -dimensional vectors bi. Is composed of n integer elements, L (B) is a lattice {Σ _{i = 1, ..., n} x _i bi | x _i ∈ Z, bi ∈ B _} , and L (B ⁻ ) is the basis. It is a dual lattice L (B ⁻ ) with respect to N defined for B and the integer N, x _i is an integer, B ⁻ is a dual base for N of B, and R ⊆ Z ⁿ is an integer element. It is a subregion belonging to the nth-order space consisting of t = (t ₁ , ..., t _n ) ^T is a target vector consisting of _n integer elements ti.
The initial setting unit takes a set (B, t) as an input, and sets a node (B ₀ , t (0)) = (B, t) consisting of a set of a basis B ₀ and a target vector t (0). ,
The basis selection unit selects the basis _BD of the partial lattice L ( _BD ) ⊂ L ( _BD-1 ) of the lattice L ( _BD-1 ).
The representative element selection unit is (c _{D, 0} + L ( _BD )) ∪ (c _{D, 1} + L ( _BD )) ∪ ... ∪ (c _{D, ν (D) -1} + L ( _BD )). ) = L ( _BD-1 ), and for any κ1, κ2 of 0 or more and ν (D) or less, when κ1 ≠ κ2 (c _{D, κ1} + L ( _BD )) ∩ (c _D, Select the representative elements c _{D, 0} , c _{D, 1} , ..., C _{D, ν (D) -1} , which satisfy the condition that _κ2 + L ( _BD )) is empty, and select the representative element c. Each of _{D, 0} , c _{D, 1} , ..., C _{D, ν (D) -1} is an n-dimensional vector consisting of integer elements.
The child node generation unit, as a child node of the node ( _BD-1 , t (D-1)), has a node (BD, t ( _D ) for k'= 0, 1, ..., Ν (D) -1. -1) Select -c _{D, k'} ) and select
The classical calculation unit uses the basis _BD and the integer N to obtain and output the dual basis _BD ⁻ .
The first quantum state generator is

Generate multiple registers consisting of quantum states of
The second quantum state generator performs a quantum operation on a part of the quantum states | φ> _{D, 0} registers, and obtains the quantum states of the registers subjected to the quantum operations.

To transition to
The swap test unit has a quantum state | φ> _{D, 0} register and a quantum state | φ> _{t (D, k')} register for k'= 0,1, ..., Ν (D) -1. A swap test is executed for each pair, and whether the result of the swap test for the pair of the quantum state | φ> ₀ and the quantum state | φ> _{t (D, k')} is accepted or rejected is determined. Judgment,
Using the result of the swap test, the node selection unit has a probability p that the result of the swap test for the pair of the quantum state | φ> _{D, 0} and the quantum state | φ> _{t (D, k')} is accepted. _{D, k'is} calculated, and the node corresponding to the highest probability p _{D, kmax} among the probabilities p _{D, 0} , ..., P _{D, ν (D) -1} ( _BD , t (D-1)- c _{D, kmax} ) is selected, and kmax ∈ {0,1, ..., ν (D) -1}.
The control unit obtains the shortest difference vector t (BD, d) between t (D-1) -c _{D, kmax} and the lattice L ( _BD ), and obtains the shortest difference vector t ^{(BD, d)} of the difference vector t ^{(BD, d)} . When the length is smaller than the reference value, the difference vector t ^{(BD, d)} is output as the difference vector t ^(d) , and recently the vector t ^{(BD, c)} = tt ( ^{BD, d)} ∈ L ( _BD ) is recently output as a vector t ^(c) , and when the length of the difference vector t ^{(BD, d)} is equal to or greater than the reference value, D + 1 is set as a new D, and t (D) = t (. As D-1) -c _{D, kmax} , the base selection unit, the representative element selection unit, the child node generation unit, the classical calculation unit, the first quantum state generation unit, the second quantum state generation unit, and the above. A computing device that controls the swap test unit, the node selection unit, and the control unit to execute each process again. It is a calculation device that takes the basis B as an input and outputs the shortest vector to the grid point closest to the origin in the grid L (B).
It has a basis generation part, a setting part, and a selection part.
n is a positive integer, B = {b ₁ , ..., b _{n }} is a basis consisting of n linearly independent n-dimensional vectors bi, and each of the _n -dimensional vectors bi is an integer of n. It consists of elements, and L (B) is a vector {Σ _{i = 1, ..., n} x _i bi | x _i ∈ Z, bi ∈ B _} .
The basis generation unit sets Bi = {b ₁ , ..., bi _-1 , _2bi , bi _{+ 1} , ..., b _n } for all _i = 1, ..., N.
The setting unit sets the difference vector t ^(d) obtained by executing the processing of the calculation device according to claim 2 with B _{= Bi} and t ₌ bi in ti (d ⁾ .
The selection unit is a calculation device that outputs the shortest of t ₁ ^(d) , ..., T _n ^(d) obtained by the setting unit as the shortest vector. For inputs of n-dimensional vectors a _j , g and integer N

It is a computing device that outputs ^T that satisfies (X ₁ , ..., X _m ).
It has a first classical calculation unit, a first quantum state generation unit, a second quantum state generation unit, a swap test unit, a selection unit, and a second classical calculation unit.
n, m, N are positive integers, i = 1, ..., n, j = 1, ..., _m , im is an imaginary unit, η ^T is a translocation of η, | Λ | is the number of elements of Λ, <τ, χ> is the inner product of τ and χ, η1 ⊆ η2 indicates that η1 is a subset of η2, and B = {b ₁ , ..., b. _n } is a base consisting of linearly independent _n -dimensional vectors bi, each of the _n -dimensional vectors bi consists of n integer elements, and L (B) is a lattice {Σ _{i = 1, ..., n} x. _i bi | x _i ∈ Z, bi ∈ B _} , where L (B ⁻ ₎ is a dual lattice L (B ⁻ ) with respect to N defined for the base B and the integer N, and x. _i is an integer, B ^- is a dual base for N of B, R⊆Z ⁿ is a subregion belonging to the nth-order space consisting of integer elements, and a _j is n integer elements a _1j ,. An n-dimensional vector consisting of a _nj a _j = (a _1j , ..., a _nj ) ^T , and an n-dimensional vector g = (g ₁ , ..., G) consisting of _n elements g ₁ , ..., G n. _n ) ^T , where d is an n-dimensional vector d = (d ₁ , ..., d _n ) ^consisting of n elements d ₁ , ..., d _n , where ε _u is the u-th element and the others. The element of is an n-dimensional unit vector ε _u = (0, ..., 1,0, ..., 0) ^T of 0,
Each of X ₁ , ..., X _m is obtained by the process corresponding to any of the depths D = 1, ..., M, and X _j obtained by the process corresponding to the depth D is X _{j (D)} ∈ {. X ₁ , ..., X _m }, and the value of X _{j (D)} obtained by the process corresponding to the depth D is α _{j (D)} , and the value of X _j obtained by the process corresponding to the depth D is The corresponding n-dimensional vector a _j is a _{j (D)} ∈ {a ₁ , ..., a _m }, and A _D-1 = (a _{j (D)} a _{j (D + 1)} ... a _{j (m)} ). And _X'D-1 = (X _{j (D)} , X _{j (D + 1)} , ..., X _{j (m)} ) ^T ,

And
The first classical calculation unit is a grid defined by {a _{j (D + 1)} ^T a _{j (D + 2)} ^T ... a _{j (m)} ^T Nε ₁ ^T ... Nε _n ^T } in the process corresponding to the depth D. The dual basis _BD -for N of the LLL irreducible basis _BD ^- is obtained and output.
The first quantum state generator is in the process corresponding to the depth D.

Generate multiple registers consisting of quantum states of
In the process corresponding to the depth D, the second quantum state generator performs a quantum operation on a register of a part of the quantum states | φ> _{D, 0} , and j'= 0, 1, 2, ..., N− For 1, the quantum state of the register subjected to the quantum operation

To transition to
In the process corresponding to the depth D, the swap test unit has a quantum state | φ> _{D, 0} register and a quantum state | φ> _{t (D} ) for j'= 0, 1, 2, ..., N-1. _{, J')} The swap test is executed for each pair with the register, and the result of the swap test for the pair of the quantum state | φ> _{D, 0} and the quantum state | φ> _{t (D, j')} . Determines whether it will be accepted or rejected,
In the process corresponding to the depth D, the selection unit uses the result of the swap test to swap the pair of the quantum state | φ> _{D, 0} and the quantum state | φ> _{t (D, j')} . The probability p _{D, j'that the} test result is accepted is calculated, and jmax corresponding to the highest probability p D, jmax among the probabilities p _{D, 0} , p _{D, 1} , ..., P _{D, N-1} . ∈ {0, 1, 2, ..., N-1} is output as α _{j (D)} , and g _D '= g _D- 1'-α _{j (D)} · a _{j (D)} is output.
The second classical calculation unit outputs α _{j (1)} , ..., α _{j (m)} when the selection unit outputs α _{j (D)} for all D = 1, ..., M. If ^T obtained in alignment (X ₁ , ..., X _m ) is output and the selection unit does not output α _{j (D)} for any of D = 1, ..., M, the first 1 A calculation device that controls to re-execute each process of the classical calculation unit, the first quantum state generation unit, the second quantum state generation unit, the swap test unit, the selection unit, and the second classical calculation unit. It is a judgment device
The first classical calculation unit, the first quantum state generation unit, the second quantum state generation unit, the first swap test unit, the third quantum state generation unit, the fourth quantum state generation unit, the second swap test unit, and the second classical calculation unit. Has a part and
n, n'is a positive integer, n'> n, i = 1, ..., n, i'= 1, ..., _n ', im is an imaginary unit, and η ^T. Is the translocation of η, | Λ | is the number of elements of Λ, || η || is the length of η, <τ, χ> is the inner product of τ and χ, and η1⊆η2 is. Representing that η 1 is a subset of η 2, B = {b ₁ , ..., b _{n }} is a base consisting of linearly independent n-dimensional vectors bi, and each of the _n -dimensional vectors bi has n elements. It consists of integer elements, where L (B ₎ is the matrix {Σ _{i = 1, ..., n} x _i bi | x _i ∈ Z, bi ∈ B _} , x _i is an integer, and β is the base B. The n-dimensional vector b ₁ , ..., b _n of the above n-dimensional vector b 1, ..., b n is an n-row n-column base matrix, α is a matrix consisting of n-row integer elements, and t1 = (t ₁ , 1, ..., t _{1, n} ) ^T is a target vector consisting of n integer elements t _{1, i} , and t 2 = (t ₂ , 1, ..., T _{2, n} ) ^T is composed of n integer elements t _{2, i} . It is a target vector, and t1 ^(d) is a difference vector between the target vector t1 and the latest vector t1 ^(c) ∈ L (B) of the target vector t1 t1 ^(d) = t1-t1 ^(c) = (t ₁ ). _{, 1} ^(d) , ..., t _{1, n} ^(d) ), where t2 ^(d) is the difference vector t2 between the target vector t2 and the recent vector t2 ^(c) ∈ L (B) of the target vector t2. ^(D) = t2-t2 ^(c) = (t _2,1 ^(d) , ..., t _{2, n} ^(d) ).
In the first classical calculation unit, the Elmeet standard form of the transposed matrix ^β'T of the matrix β'= (α β) in which the matrix α and the base matrix β are arranged in the row direction is a matrix of diagonal components 1. The matrix α is selected to obtain a unimodular matrix β ^−'that satisfies β ^−'β ' ^T = H'with respect to the Elmeat standard matrix H', and the matrix β'= (b ₁ ^' , ..., B). _n ^{' )} _Let ^B'be the base consisting of the row vector b ₁ ^' , ..., b n'of ^T , and the row vector of the monomodular matrix β ^- '= (b _1- ' ^, ..., b _n'- ') ^T. The base consisting of b _1- ', ..., b _{n' -} ^' is B-', ^and the target consisting of n'integer elements t'1, i'belonging to the space span (B') stretched ^by the base B'. Vector t1 ^' = ( _t'1,1 , ..., t'1 _{, n'} ) ^T ∈ span (B ^' ) and target vector t2'= (t' consisting of n'item elements t'2 _{, i} ' 2, 1, ..., _{t'2 , n'} ) ^T ∈ span (B') is obtained.
An n-dimensional vector space in which Proj (t1') = (0, t1), Proj (t2') = (0, t2), and the first n'-n elements of Proj (μ) are 0. L (B-') represents the projection ^to the lattice L (B-' ⁾ = {Σ _{i '= 1, ...,} n'x i'b ^- 'i _' | x _i'∈ Z ^, b-'_i'∈ B- _' }, x ^i'is an integer, and R ⊆ Z n'is a subregion belonging to the ^n'th order space consisting of integer elements.
The first quantum state generator is

Generate multiple registers consisting of quantum states of
The second quantum state generator performs a quantum operation on a part of the quantum state | φ> ₀ register, and changes the quantum state of the register to which the quantum operation is performed.

To transition to
The first swap test unit executes a swap test for each pair of a quantum state | φ> ₀ register and a quantum state | φ>_t1'register , and the quantum state | φ> ₀ and the quantum state. ｜ φ> Determine whether the result of the swap test for the pair with _t1'is accepted or rejected.
The third quantum state generator is

Generate multiple registers consisting of quantum states of
The fourth quantum state generator performs a quantum operation on a part of the quantum state | φ> ₀ register, and changes the quantum state of the register to which the quantum operation is performed.

To transition to
The second swap test unit executes a swap test for each pair of the quantum state | φ> ₀ register and the quantum state | φ>_t2'register , and the quantum state | φ> ₀ and the quantum state. Determine whether the result of the swap test for the pair with | φ>_t2'is accepted or rejected.
The _second classical calculation unit uses the result of the swap test to obtain the probability p1 that the result of the swap test for the pair of the quantum state | φ> ₀ and the quantum state | φ> _t1 is accepted, and the quantum state | Calculate the probability p ₂ that the result of the swap test for the pair of φ> ₀ and the quantum state | φ> _t2 is accepted, and when p ₁ ≧ p ₂ , || t1 ^(d) || ≦ || t2 ^{( d)} Output the information indicating that it is ||, and output the information indicating that it is || t1 ^(d) ||> || t2 ^(d) || when p ₁ <p ₂ . Alternatively, when p ₁ > p ₂ , the information indicating that || t1 ^(d) || <|| t2 ^(d) || is output, and when p ₁ ≤ p ₂ , || t1 ^{(d). )} || ≧ | t2 ^(d) A determination device that outputs information indicating that it is ||. It ’s a computing device,
It has an initial setting unit, a basis selection unit, a representative element selection unit, a child node generation unit, a classical calculation unit, a node selection unit, a control unit, a first quantum state generation unit, a second quantum state generation unit, and a swap test unit. ,
n, n', N, ν (D), D are positive integers, n'> n, i = 1, ..., n, i'= 1, ..., n', i _m is an imaginary unit, η ^T is an inversion of η, | Λ | is the number of elements of Λ, || η || is the length of η, and η1 ⊆ η2 is a subset of η1 of η2. , <τ, χ> is the inner product of τ and χ, η1 ⊂ η2 means that η1 is a true subset of η2, and B = {b ₁ , ..., b _n }. It is a base consisting of linearly independent _n -dimensional vectors bi, each of the _n -dimensional vectors bi is composed of n integer elements, and L (B) is a lattice {Σ _{i = 1, ..., n} x _i bi _i . | X _i ∈ Z, bi ∈ B _{}, x i is} an integer, R ⊆ Z ^n'is a subregion belonging to the n'th order space consisting of integer elements, and t = (t ₁ , ..., t _n ) ^T is a target vector consisting of _n integer elements ti.
The initial setting unit takes a set (B, t) as an input, and sets a node (B ₀ , t (0)) = (B, t) consisting of a set of a basis B ₀ and a target vector t (0). ,
The basis selection section selects the basis BD of the partial matrix L ( _BD ) ⊂ L ( _BD-1 ) of the lattice L ( _BD-1 ), and β _D is the basis _BD = {b _{D , 1} , ..., b _{D, n} } n-dimensional vector b _{D, 1} , ..., b _{D, n} is a basis matrix of n rows and n columns with n as row vectors, and α _D is a matrix consisting of n rows of integer elements. can be,
The representative element selection unit is (c _{D, 0} + L ( _BD )) ∪ (c _{D, 1} + L ( _BD )) ∪ ... ∪ (c _{D, ν (D) -1} + L ( _BD )). ) = L ( _BD-1 ), and for any κ1, κ2 of 0 or more and ν (D) or less, when κ1 ≠ κ2 (c _{D, κ1} + L ( _BD )) ∩ (c _D, Select the representative elements c _{D, 0} , c _{D, 1} , ..., C _{D, ν (D) -1} , which satisfy the condition that _κ2 + L ( _BD )) is empty, and select the representative element c. Each of _{D, 0} , c _{D, 1} , ..., C _{D, ν (D) -1} is an n-dimensional vector consisting of integer elements.
The child node generation unit, as a child node of the node ( _BD-1 , t (D-1)), has a node (BD, t ( _D ) for k'= 0, 1, ..., Ν (D) -1. -1) Select -c _{D, k'} ) and select
In the classical calculation unit, the Elmeet standard form of the transposed matrix β _D' ^T of the matrix β _D '= (α _D β _D ) in which the matrix α _D and the base matrix β _D are arranged in the row direction is the diagonal component 1. ^Select the ^matrix _{α D} ^, which _is the _{matrix of} = (B _{D, 1} ', ..., b _{D, n'} ') The base consisting of the row vectors b _{D, 1} ', ..., b _{D, n} '' of ^T is _BD ', and the monomodular matrix β _D ^- '= (B _{D , 1-} ', ..., b _{D, n'-} ' ⁾ Let the base consisting of the row vectors b _{D, 1-} ^{' ,} ..., b _{D, n'-'} ^{of T be} BD-'. , Target vector t ( _D )'= (t'D _{, 1} , ..., T'consisting of n'integer elements t'D, i'belonging to the space span ( _BD ') stretched by the base _BD '. _{D, n'} ) ^T ∈ span ( _BD '),
Proj (t'D _{-1, k'} ) = (0, t (D-1) -c _{D, k'} ), and the first n'-n elements of Proj (μ) are 0. Representing a projection onto a certain n ^- dimensional vector space, L (B-') is a lattice L (B-' ⁾ = {Σ _{i '= 1, ...,} n'x i'b ^- 'i _' | x _i'∈ Z, b ^{- 'i} _' ∈ B- ^' }, x _i'is an integer, and R ⊆ Z n'is a subregion belonging to the n'th order space consisting of integer elements.
The first quantum state generator is

Generate multiple registers consisting of quantum states of
The second quantum state generator performs a quantum operation on a part of the quantum states | φ> _{D, 0} registers, and obtains the quantum states of the registers subjected to the quantum operations.

To transition to
The swap test unit has a quantum state | φ> _{D, 0} register and a quantum state | φ> _{t (D, k')} register for k'= 0,1, ..., Ν (D) -1. A swap test is executed for each pair, and whether the result of the swap test for the pair of the quantum state | φ> ₀ and the quantum state | φ> _{t (D, k')} is accepted or rejected is determined. Judgment,
Using the result of the swap test, the node selection unit has a probability p that the result of the swap test for the pair of the quantum state | φ> _{D, 0} and the quantum state | φ> _{t (D, k')} is accepted. _{D, k'is} calculated, and the node corresponding to the highest probability p _{D, kmax} among the probabilities p _{D, 0} , ..., P _{D, ν (D) -1} ( _BD , t (D-1)- c _{D, kmax} ) is selected, and kmax ∈ {0,1, ..., ν (D) -1}.
The control unit obtains the shortest difference vector t (BD, d) between t (D-1) -c _{D, kmax} and the lattice L ( _BD ), and obtains the shortest difference vector t ^{(BD, d)} of the difference vector t ^{(BD, d)} . When the length is smaller than the reference value, the difference vector t ^{(BD, d)} is output as the difference vector t ^(d) , and recently the vector t ^{(BD, c)} = tt ( ^{BD, d)} ∈ L ( _BD ) is recently output as a vector t ^(c) , and when the length of the difference vector t ^{(BD, d)} is equal to or greater than the reference value, D + 1 is set as a new D, and t (D) = t (. As D-1) -c _{D, kmax} , the base selection unit, the representative element selection unit, the child node generation unit, the classical calculation unit, the first quantum state generation unit, the second quantum state generation unit, and the above. A computing device that controls the swap test unit, the node selection unit, and the control unit to execute each process again. It is a calculation device that takes the basis B as an input and outputs the shortest vector to the grid point closest to the origin in the grid L (B).
It has a basis generation part, a setting part, and a selection part.
n is a positive integer, B = {b ₁ , ..., b _{n }} is a basis consisting of n linearly independent n-dimensional vectors bi, and each of the _n -dimensional vectors bi is an integer of n. It consists of elements, and L (B) is a vector {Σ _{i = 1, ..., n} x _i bi | x _i ∈ Z, bi ∈ B _} .
The basis generation unit sets Bi = {b ₁ , ..., bi _-1 , _2bi , bi _{+ 1} , ..., b _n } for all _i = 1, ..., N.
The setting unit sets the difference vector t ^(d) obtained by executing the processing of the calculation device according to claim 6 with B _{= Bi} and t ₌ bi in ti (d ⁾ .
The selection unit is a calculation device that outputs the shortest of t ₁ ^(d) , ..., T _n ^(d) obtained by the setting unit as the shortest vector. For inputs of n-dimensional vectors a _j , g and integer N

It is a computing device that outputs ^T that satisfies (X ₁ , ..., X _m ).
It has a first classical calculation unit, a first quantum state generation unit, a second quantum state generation unit, a swap test unit, a selection unit, and a second classical calculation unit.
n, n', m, N are positive integers, n'> n, i = 1, ..., n, i'= 1, ..., n', j = 1, ..., _m , im is an imaginary unit, η ^T is the translocation of η, | Λ | is the number of elements of Λ, <τ, χ> is the inner product of τ and χ, and η1 ⊆ η2 Indicates that η 1 is a subset of η 2, and B = {b ₁ , ..., b _{n }} is a base consisting of linearly independent n-dimensional vectors bi, and each of the _n -dimensional vectors bi is n. L (B) is a lattice {Σ _{i = 1, ..., n} x _i bi | x _i ∈ Z, bi ∈ B _} , x _i is an integer, and R ⊆ Z ^{n '} Is a subregion belonging to the n'th order space consisting of integer elements, and a _j is an n-dimensional vector consisting of n integer elements a _1j , ..., a _{nj =} (a _1j , ..., a _nj ) ^T And g is an n-dimensional vector g = (g ₁ , ..., _gn ) ^T consisting of _n elements g ₁ , ..., G n, and d is from n elements d ₁ , ..., d _n . N-dimensional vector d = (d ₁ , ..., d _n ) ^T
Each of X ₁ , ..., X _m is obtained by the process corresponding to any of D = 1, ..., M, and X _j obtained by the process corresponding to the depth D is X _{j (D)} ∈ {X ₁ , ..., X _m }, and the value of X _{j (D)} obtained by the process corresponding to the depth D is α _{j (D)} , which corresponds to X _j obtained by the process corresponding to the depth D. The n-dimensional vector a _j is a _{j (D)} ∈ {a ₁ , ..., a _m }, and A _D-1 = (a _{j (D)} a _{j (D + 1)} ... a _{j (m)} ). , _X'D-1 = (X _{j (D)} , X _{j (D + 1)} , ..., X _{j (m)} ) ^T ,

And
The first classical calculation unit is a matrix defined by {a _{j (D + 1)} ^T a _{j (D + 2)} ^T ... a _{j (m)} ^T Nε ₁ ^T ... Nε _n ^T } in the process corresponding to the depth D. The base matrix β _D of the LLL irreducible base _BD is obtained, and the matrix β _D '= (α _D β _D ) in which the matrix α _D consisting of n columns of integer elements and the base matrix β _D are arranged in the row direction. Select the matrix α _D in which the Elmeet standard form of the transposed matrix β _D' ^T is a matrix with diagonal component 1, and satisfy β _D ^−'β _D' ^T = H'with respect to the Elmeat standard form matrix H'. A unimodular matrix β _D ^- 'is obtained, and the row vector b _{D, 1} ', ..., b _{D, n'} ' of the matrix β _D '= (b _{D, 1} ', ..., b _{D, n'} ') ^T is obtained. Let BD'be the base consisting of, and the row vector b _{D , 1-} ^{' ,} ..., b of the unimodular matrix β _D ^- '= (b _{D, 1-} ^' , ..., b _{D, n'-} ' ^{) T.} The base consisting of _D ^, _n' ^{- '} is BD- ^' _, and the target vector t (d) consisting of n'integer elements t'D, i'belonging to the space span ( _BD ^' ) stretched by the base _BD '. D)'= (t'D _{, 1} , ..., t'D _{, n'} ) ^T ∈ span ( _BD ') is obtained.
Proj (t'D _{-1, j'} ) = (0, g _D- ^1'T -j' · a _{j (D)} ^T ), and Proj (μ) is the first n'-n of μ. Represents a projection onto an n'dimensional vector space whose elements are 0 ^, where L (B-') is a lattice L (B-' ⁾ = {Σ _{i '= 1, ...,} n'x i'b ^- 'i _' | X i'∈ Z, b ^- _{'i' ∈} B- _' }, x ^i'is an integer, and R ⊆ Z n'is a subregion belonging to the ^n'th order space consisting of integer elements.
The first quantum state generator is in the process corresponding to the depth D.

Generate multiple registers consisting of quantum states of
In the process corresponding to the depth D, the second quantum state generator performs a quantum operation on a register of a part of the quantum states | φ> _{D, 0} , and j'= 0, 1, 2, ..., N. For -1, the quantum state of the register subjected to the quantum operation

To transition to
In the process corresponding to the depth D, the swap test unit has a quantum state | φ> _{D, 0} register and a quantum state | φ> _{t (} for j'= 0, 1, 2, ..., N-1. A swap test is executed for each pair with the register of _{D, j')} , and a swap test for the pair of the quantum state | φ> _{D, 0} and the quantum state | φ> _{t (D, j')} is performed. Determine if the result is acceptable or rejected,
In the process corresponding to the depth D, the selection unit uses the result of the swap test to swap the pair of the quantum state | φ> _{D, 0} and the quantum state | φ> _{t (D, j')} . The probability p _{D, j'that the} test result is accepted is calculated, and jmax corresponding to the highest probability p D, jmax among the probabilities p _{D, 0} , p _{D, 1} , ..., P _{D, N-1} . ∈ {0, 1, 2, ..., N-1} is output as α _{j (D)} , and g _D '= g _D- 1'-α _{j (D)} · a _{j (D)} is output.
The second classical calculation unit outputs α _{j (1)} , ..., α _{j (m)} when the selection unit outputs α _{j (D)} for all D = 1, ..., M. If ^T obtained in alignment (X ₁ , ..., X _m ) is output and the selection unit does not output α _{j (D)} for any of D = 1, ..., M, the first 1 A calculation device that controls to re-execute each process of the classical calculation unit, the first quantum state generation unit, the second quantum state generation unit, the swap test unit, the selection unit, and the second classical calculation unit. A learning system having a learning device for supervised learning of a feedforward neural network and a computing device according to claim 4 or 8.
The learning device has an initial setting unit, an LWE problem processing unit, and an activation function calculation unit.
n, m, s ", di are positive integers, _i = 1,2,3, ..., n, D" is an integer of 2 or more, and a " _{i, 1} , ..., a" _{i, m} and g ” _i are real numbers, Ψ is the activation function,
The learning device is a matrix consisting of n sets of m-dimensional data sets {a " _{i, 1} , ..., a" _{i, m} } which are training data.

And a vector consisting of the class label g " _i for each dataset {a" _{i, 1} , ..., a " _{i, m} }"

And the depth D of the feedforward neural network are input.
The initial setting unit uses a matrix _At .

Set to
In the order of L "= 1, 2, ..., D" -2,
(A) The LWE problem processing unit is the first LWE problem.

To the arithmetic unit
(B) The calculation device generates and outputs a candidate value of the solution X = (X ₀ , X ₁ , ..., X _m ) ^T of the first LWE problem, and outputs the result.
(C) The LWE problem processing unit is the m set corresponding to the difference vector d = (d ₁ , ..., d _n ) ^T whose length || d || is from the first to the mth in ascending order. Select the candidate value of the solution X of the first LWE problem, and set the candidate value of the κ "(1 ≤ κ" ≤ m) th solution X to (W _{0, κ "} ^(L") , W _{1, κ "} ^{(L". )} , ..., W _{m, κ "} ^(L") ) ^T

Set to
(D) The activation function calculation unit is

Satisfy a ” _{j, κ”} ^{(L ”+1)} (1 ≦ j, κ” ≦ m), and set
After the processing of (a), (b), (c), (d) is performed in the order of L "= 1, 2, ..., D" -2,
The LWE problem processing unit is the second LWE problem.

To the arithmetic unit
The calculation device generates and outputs a solution X = (X ₀ , X ₁ , ..., X _m ) ^T of the second LWE problem, and outputs the solution.
The LWE problem processing unit sets the solution X = (X ₀ , X ₁ , ..., X _m ) ^T of the second LWE problem to (W ₀ , 1 ^{(D "-1)} , W ₁ , 1 ⁽ D" -1). ⁾ , ..., W _{m, 1} ^{(D "-1)} ) ^T

Set and
A learning system in which W ⁽¹⁾ , ..., W ^{(D "-1)} are output as weights of the neural network.

Images