Polylogarithmic-depth controlled-NOT gates without ancilla qubits

Abstract

Controlled operations are fundamental building blocks of quantum algorithms. Decomposing n-control-NOT gates (Cⁿ(X)) into arbitrary single-qubit and CNOT gates, is a crucial but non-trivial task. This study introduces Cⁿ(X) circuits outperforming previous methods in the asymptotic and non-asymptotic regimes. Three distinct decompositions are presented: an exact one using one borrowed ancilla with a circuit depth $\mathrm{\Theta }\left(\log {\left(n\right)}^3\right)$, an approximating one without ancilla qubits with a circuit depth $\mathcal{O}\left(\log {\left(n\right)}^3\log \left(1/ϵ\right)\right)$ and an exact one with an adjustable-depth circuit which decreases with the number m≤n of ancilla qubits available as $\mathcal{O}\left(\log {\left(n/\lfloor m/2\rfloor \right)}^3+\log \left(\lfloor m/2\rfloor \right)\right)$. The resulting exponential speedup is likely to have a substantial impact on fault-tolerant quantum computing by improving the complexities of countless quantum algorithms with applications ranging from quantum chemistry to physics, finance and quantum machine learning.

Multi-controlled operations are very common in quantum algorithms applications. Here, the authors propose three schemes for decomposing n-control-NOT gates into single-qubit and CNOT gates, which have polylog overhead as opposed to current linear schemes.

Introduction

In the past three decades, quantum algorithms promising an exponential speedup over their classical counterparts have been designed^1–3. The advantages of these algorithms stem from the peculiar properties of superposition and entanglement of the quantum bits (qubits). These properties enable the manipulation of a vast vector of qubit states using basic operations that act on either one or two qubits³. The question of decomposing efficiently any n-qubit operation into a reasonable number of primitive single- and two-qubit operations is one of the major challenges in quantum computing⁴. In this context, multi-controlled operations act as building blocks of many prevalent quantum algorithms such as qubitisation⁵ within the quantum singular value transformation⁶, which have immediate repercussions on Hamiltonian simulation⁷, quantum search⁶ and quantum phase estimation methods⁸. For this reason, achieving more effective decompositions of multi-controlled operations has the potential to bring about significant enhancements in quantum algorithms, impacting various fields such as quantum chemistry, specifically in estimating ground state energy⁹, physics for the simulation of quantum systems¹⁰, engineering for solving partial differential equations^11,12, quantum machine learning¹³, and finance¹⁴.

This non-trivial challenge and the quest for optimal solutions have been an active and ongoing research focus for decades. In 1995, Barenco et al.¹⁵ proposed several linear depth constructions of multi-controlled NOT (MCX) gates (also known as n-Toffoli gates, multi-controlled Toffoli, generalised-Toffoli gates, multi-controlled X or n-controlled NOT gates). All these linear depth constructions used ancilla qubits or relied on an efficient approximation, while the first ancilla-free exact decomposition has a quadratic depth.

Years later, exact implementations of multi-controlled NOT gates with linear depth and quadratic size were proposed^16,17. It was only in 2015 that Craig Gidney published a pedagogical blog post describing an exact linear size decomposition without ancilla qubits¹⁸. Even though his method was linear, its depth leading coefficient is large compared to that of other methods. Still, this one-of-a-kind method was used in subsequent work^19–21. In 2017, a logarithmic-depth multi-controlled NOT gate using as many zeroed ancilla qubits as control qubits was presented²². Such a finding motivated the search for a trade-off between the number of ancillae and the circuit depth. Computational approaches have been implemented²³, suggesting that any zeroed ancilla qubit could be used to reduce the circuit depth of controlled operations. Recently, Orts et al.²⁴ provided a review of the 2022 state-of-the-art methods for MCX.

Every multi-controlled NOT decomposition method aims at optimising certain metrics such as circuit size, circuit depth, or ancilla count. This article considers only the case of n-controlled NOT gates with n > 2 (he particular problem of decomposing the 2-controlled NOT gate, i.e., the Toffoli gate, possesses distinct optimal solutions for various metrics concerning both single- and two-qubit gates^25,26). The attention is directed towards circuit depth, the metric associated with quantum algorithmic runtime, circuit size, the total number of primitive quantum gates (computed on the basis of arbitrary single-qubit and CNOT gates), and ancilla qubit count, which corresponds to the amount of available qubits during the computation. A precise distinction is made between borrowed ancilla qubits (qubits in any state beforehand which are restored afterwards) and zeroed ancilla qubits (which are in state $∣0⟩$ initially and reset to $∣0⟩$ at the end of the computation). Zeroed ancilla qubits are efficient to use since they are initially in a well-known state. Borrowed ancilla qubits are more constraining but have the advantage of being available more often during computations: operations that do not impact the entire system can utilise unaffected wires as borrowed qubits.

This article introduces three circuit identities to build a n-controlled NOT gate Cⁿ(X). They display the following depth complexities.

1. Polylogarithmic-depth circuit with a single borrowed ancilla (Proposition 1).

2. Polylogarithmic-depth approximate circuit without ancilla (Proposition 2).

3. Adjustable depth circuit using an arbitrary number m ≤ n of ancillae (Proposition 3).

The first one is an exact decomposition whose depth is affine in the depth of a quadratically smaller controlled operation $C^{\sqrt{n}}\left(X\right)$. The global decomposition takes advantage of a single borrowed ancilla qubit, and each of the smaller controlled operations can be associated with a locally borrowed ancilla. As a consequence, a recursive construction of the multi-controlled NOT gate emerges with an overall polylogarithmic circuit depth in the number of control qubits $\mathrm{\Theta }\left(\log {\left(n\right)}^3\right)$ and a circuit size $\mathcal{O}\left(n\log {\left(n\right)}^4\right)$. The second method approximates a Cⁿ(X) without ancilla qubits up to an error ϵ > 0 with a circuit depth $\mathcal{O}\left(\log {\left(n\right)}^3\log \left(1/ϵ\right)\right)$ and a circuit size $\mathcal{O}\left(n\log {\left(n\right)}^4\log \left(1/ϵ\right)\right)$. It makes use of the decomposition of a n-controlled X gate into (n − 1)-controlled unitaries, generating borrowed ancilla qubits that facilitate the application of the first method up to an error ϵ. The last method provides an adjustable-depth quantum circuit which implements exactly a Cⁿ(X) for any given number m ≤ n of zeroed ancilla qubits. The depth decreases with m from a polylogarithmic-with-n scaling to a logarithmic one as $\mathcal{O}\left(\log {\left(n/\lfloor m/2\rfloor \right)}^3+\log \left(\lfloor m/2\rfloor \right)\right)$. To the best of our knowledge, these methods stand out as the only approaches achieving such depth complexities. In particular, they demonstrate an exponential speedup over previous state-of-the-art (or, more formally, a superpolynomial speedup²⁷) and readily improve a wide range of quantum algorithms.

Results

This section is subdivided into three parts. The first subsection details the logical steps towards achieving method 1. This includes a detailed study of the single-zeroed-ancilla case, how it can be turned into a borrowed one and where the recursive decomposition can stem from to yield the polylogarithmic-depth controlled-NOT circuit with a single borrowed ancilla. The methods 2 and 3 are described respectively in IIB and IIC.

Notations

This paragraph gathers the most important definitions that will be used throughout the article. Let n ≥ 1 and let ${\left\{∣x⟩\right\}}_{x=0}^{2^n-1}$ be the computational basis of an n-qubit register R and T be a one-qubit register, the so-called target register. The Cⁿ(X) controlled by R with target T is the gate defined by equation (1):

$$C^n\left(X\right)=\left(I_R-∣2^n-1⟩⟨2^n-1∣\right)\otimes I_T+∣2^n-1⟩⟨2^n-1∣\otimes X,$$ 1

where I_R and I_T are the identities on register R and T. The symbol X denotes the Pauli matrix $X=∣0⟩⟨1∣+∣1⟩⟨0∣$. More generally, a Cⁿ(U) gate will denote a controlled U gate. If the register R is in state $∣2^n-1⟩$, it will be termed as active. When one wants to emphasise the control and target registers, one will note ${\mathcal{C}}_R^T$. If $R^{\prime }$ is a second qubit register, define the (partial) white control ${\mathcal{C}}_{\overline{R}\cup R^{\prime }}^T\equiv \left({\prod }_{q\in R}{X}_q\right){\mathcal{C}}_{R\cup R^{\prime }}^T\left({\prod }_{q\in R}{X}_q\right)$, where X_q denotes an X gate on white control qubit q. The support of a quantum circuit is the set of qubits on which it does not act like the identity. Ancilla qubits are qubits outside the support of U which may be used during the computation. From now, the function $\log$ signifies the logarithm in base 2. All circuit sizes and depths are computed on the basis of arbitrary single-qubit and CNOT gates.

Polylogarithmic-depth gate using one borrowed ancilla

The decomposition uses a single zeroed ancilla to reduce the global MCX gate to five layers, each exhibiting the depth of a quadratically smaller operation. The n-control-qubit register R = {q₀, …, q_n−1} is first divided into subregisters. Let $p=\lfloor \sqrt{n}\rfloor$. The control register R can then be written as the disjoint union $R={\bigcup }_{i=0}^b{R}_i$ where subregister R₀ = {q₀, …, q_2p−1} is a subregister of size 2p and subregister R_i is of size at most p, for each i ∈ {1, …, p}. More precisely, let $R_i={\left\{q_j\right\}}_{j=\left(1+i\right)p}^{\left(2+i\right)p-1}$ for each i ∈ {1, …, p}. Let $b=\mid \left\{i\in \left\{1,\dots ,p\right\}:R_i\ne \mathrm{\varnothing }\right\}\mid$ be the number of non-empty registers of positive index. Moreover, the first register R₀ is further divided into $R_0^{*}={\left\{q_i\right\}}_{i=0}^{b-1}$ containing the first b qubits and $R_0^{\prime }=R_0\backslash R_0^{*}$.

The circuit in Fig. 1 illustrates a decomposition of the controlled-NOT operation ${\mathcal{C}}_R^t$ using a single zeroed ancilla. Note that qubit q_i is positioned between registers R_i and R_i+1. The unitary associated with the circuit is given by

$${\mathcal{U}}_0\equiv {\mathcal{C}}_{R_0}^a\mathfrak{C}{\mathcal{C}}_{R_0}^a,$$ 2

where

$$\mathfrak{C}\equiv \left({\prod }_{i=1}^b{\mathcal{C}}_{R_i}^{q_{i-1}}\right){\mathcal{C}}_{\overline{R_0^{*}}\cup a}^t\left({\prod }_{i=1}^b{\mathcal{C}}_{R_i}^{q_{i-1}}\right).$$ 3

The first operation ${\mathcal{C}}_{R_0}^a$ sets the zeroed ancilla to $∣1⟩$ if and only if R₀ is active. Now, consider the operation $\mathfrak{C}$: for ${\mathcal{C}}_{\overline{R_0^{*}}\cup a}^t$ to apply an X gate to the target, all the qubits from $R_0^{*}$ must be in state $∣0⟩$, and the ancilla a must be in state $∣1⟩$. Now, notice that for each qubit $q_i\in R_0^{*}$, q_i is in state $∣0⟩$ when applying $C_{\overline{R_0^{*}}\cup a}^t$ if and only if it was in the same activation state as R_i+1 right before applying $\mathfrak{C}$. Therefore, $\mathfrak{C}$ is a multi-controlled-X gate conditioned on:

• the ancilla a being in state $∣1⟩$ and

• for each index i ∈ {0, …, b − 1}: q_i being in the same activation state as R_i+1.

By inspection, in the circuit in Fig. 1, these conditions are fulfilled if and only if the register R of interest is active. Therefore, the target t is flipped under exactly the right hypothesis. The operations following the potential flip of qubit t leave it unchanged and reset both the qubits from $R_0^{*}$ and the ancilla to their initial state. The overall operation is the desired ${\mathcal{C}}_R^t$ gate. A more formal proof is given in Supplementary Note 1.

Fig. 1. n controlled ${\mathcal{C}}_R^t$ using the zeroed ancilla a, where $p=\lfloor \sqrt{n}\rfloor$ and R_i is a register of at most p qubits for each i ∈ {1, …, b}.

r is the remainder of the euclidean division of $∣R\backslash R_0∣=n-2p$ by $p,r=∣R_b∣$.

This subsection discusses how the above zeroed ancilla is transformed into a borrowed ancilla. The construction is displayed in the circuit in Fig. 2, which is formally defined by the unitary operation

$$\mathcal{U}\equiv \mathfrak{C}{\mathcal{C}}_{R_0}^a\mathfrak{C}{\mathcal{C}}_{R_0}^a=\mathfrak{C}{\mathcal{U}}_0.$$ 4

Notice that ${\mathcal{U}}_0$ and $\mathfrak{C}$ both leave the control qubits and the ancilla unchanged. As a consequence, one only needs to focus on what happens to the target t. If the ancilla starts in state $∣0⟩$, the last $\mathfrak{C}$ does not affect t and $\mathcal{U}$ overall acts as the desired ${\mathcal{C}}_R^t$ gate. It is now sufficient to focus on the case where qubit a arrives in state $∣1⟩$ and to repeat the above analysis: ${\mathcal{U}}_0$ flips the target if both R₀ is inactive and for each i ∈ {0, …, b − 1}, qubit q_i is in the same activation state as R_i+1. Refer to this flip as the first flip. Then, $\mathfrak{C}$ flips the target if and only if for each i ∈ {0, …, b − 1}, qubit q_i is in the same activation state as R_i+1. Refer to this flip as the second flip. Summarising, if R is active only the second flip occurs. If R is inactive, there are two cases: R₀ is either inactive or active. If R₀ is inactive, both flip 1 and flip 2 occur, resulting in no flip at all. If R₀ is active, the second condition cannot be verified. Therefore, none of the two flips occurs. In any case, the circuit applies the ${\mathcal{C}}_R^t$ gate and leaves the ancilla unaffected. A more thorough proof is given in Supplementary Note 1.

Fig. 2. n controlled ${\mathcal{C}}_R^t$ using the borrowed ancilla a, where $p=\lfloor \sqrt{n}\rfloor$ and R_i is a register of at most p qubits for each i ∈ {1, …, b}.

r is the remainder of the euclidean division of $∣R\backslash R_0∣=n-2p$ by $p,r=∣R_b∣$.

It is now possible to use a borrowed ancilla to implement any Cⁿ(X) using smaller C^2p(X), C^p+1 and C^p(X) gates. This section details how a qubit can be borrowed to compute each of the smaller MCX operations. This allows the setting up of a recursive construction, keeping the number of ancillae to one and achieving the polylogarithmic depth decomposition of n-MCX.

In Fig. 2, the block ${\prod }_{i=1}^b{\mathcal{C}}_{R_i}^{q_{i-1}}$ has the same depth as a single controlled-NOT gate with p control qubits since it is the product of b unitaries with disjoint support. The depth of a controlled operation containing white controls is the same as that of standard controlled-NOT plus that of two additional layers of X gates acting on qubits whose control colour is white. One may want to apply the decomposition from the circuit in Fig. 2 to each C^p(X) gate. In order to do so, each block must have a borrowed ancilla qubit at its disposal.

There are more available borrowed qubits in the register $R_0^{\prime }$ than operations to perform in parallel: $∣R_0^{\prime }∣\ge ∣R_0^{*}∣$ (see Supplementary Note 1). Hence, there are sufficiently many borrowed ancilla qubits to construct the smaller operations recursively. The recursion gives the following equality for the depth D_n of a Cⁿ(X) gate.

$$D_n=2D_{2p}+4D_p+2D_{b+1}+4,$$ 5

with $p=\lfloor \sqrt{n}\rfloor$ and p − 2≤b≤p. The asymptotic behaviour of the depth can be studied as follow: let ${\left(\mathcal{D}\left(k\right)\right)}_{k\in \mathbb{N}}\equiv {\left(D_{2^{k+2}}\right)}_{k\in \mathbb{N}}$ be the circuit depth of $C^{2^{k+2}}\left(X\right)$ gates. Equation (5) implies:

$$\mathcal{D}\left(k\right)\le 8\mathcal{D}\left(k/2\right)+4.$$ 6

The Master Theorem, recalled in Supplementary Note 2, implies that $\mathcal{D}\left(k\right)\in \mathcal{O}\left(k^3\right)$. In terms of n, the circuit depth of a Cⁿ(X) gate using one borrowed ancilla qubit is $D_n\in \mathcal{O}\left(\log {\left(n\right)}^3\right)$. Now, a lower bound is derived by defining ${\left(\tilde{\mathcal{D}}\left(k\right)\right)}_{k\in \mathbb{N}}\equiv {\left(D_{2^k}\right)}_{k\in \mathbb{N}}$ such that $\tilde{\mathcal{D}}\left(k\right)\ge 8\tilde{\mathcal{D}}\left(k/2\right)+4$. Similarly, this inequality leads to $D_n\in \mathrm{\Omega }\left(\log {\left(n\right)}^3\right)$. The scaling of the size is computed similarly to the scaling of the depth, i.e., by solving the corresponding recursive equation. Details are given in Supplementary Note 3. The following proposition gathers these statements.

Proposition 1

A controlled-NOT gate with n control qubits is implementable with a circuit of depth $\mathrm{\Theta }\left(\log {\left(n\right)}^3\right)$, size $\mathcal{O}\left(n\log {\left(n\right)}^4\right)$ and using a single borrowed ancilla qubit through the recursive use of the circuit in Fig. 2.

A first application improved by Proposition 1 affects the decomposition of multi-controlled unitary Cⁿ(U) using one zeroed ancilla. The zeroed ancilla allows the decomposed Cⁿ(U) gate into two Cⁿ(X) gates and one C¹(U) using the circuit identity in Fig. 3 (Lemma 7.11 from¹⁵).

Fig. 3. Controlling arbitrary unitary operation with a zeroed ancilla qubit.

$U$ is the unitary to control, $V$ is a square root of $U$ and $n$ is the number of control qubits.

The following corollary gives the complexity to implement a Cⁿ(U) gate.

Corollary 1

Let U be a unitary of size S in the basis of single-qubit gates and CNOT gates. A controlled U gate with n control qubits is implementable with depth $\mathcal{O}\left(S+\log {\left(n\right)}^3\right)$, size $\mathcal{O}\left(S+n\log {\left(n\right)}^4\right)$ and one zeroed ancilla qubit through the circuit in Fig. 3.

It is also straightforward to implement any special unitary single-qubit gate $W\in \mathsf{SU}\left(2\right)$ with polylogarithmic complexity and without ancilla. This can be done with the help of Lemma 7.9 in ref. ¹⁵, illustrated in Fig. 4.

Fig. 4. Controlling arbitrary special unitary operation W.

Without loss of generality, W = AXBXC for some matrices $A,B,C\in \mathsf{SU}\left(2\right)$ such that ABC = I.

Corollary 2

Let W be a special unitary single-qubit gate. A Cⁿ(W) operation can be implemented with a circuit of depth $\mathcal{O}\left(\log {\left(n\right)}^3\right)$ and size $\mathcal{O}\left(n\log {\left(n\right)}^4\right)$ without ancilla qubits.

Polylogarithmic-depth and ancilla-free approximate gate

This section outlines how to make use of Proposition 1 to control single-qubit unitaries in the absence of ancilla qubits. The first step generates borrowed ancilla qubits by decomposing a n-controlled unitary into (n − 1)-controlled unitaries. More precisely, for any single-qubit unitary U whose square root is denoted by V, one can implement a Cⁿ(U) gate from two Cⁿ⁻¹(X), a Cⁿ⁻¹(V) and two simple two-qubit gates using the circuit identity in Fig. 5 (Lemma 7.8 in ref. ¹⁵).

Fig. 5. Decomposition of a controlled unitary operation into controlled operations with fewer control qubits.

$U$ is the unitary to control, $n$ is the number of control qubits and $k$ is the number of qubits on which the gate $U$ acts.

Applying this decomposition k times involves implementing the 2^k-th root V_k of the original unitary. Performing this recursion n times leads to a linear depth quantum circuit¹⁸. To circumvent this issue, it is possible to neglect the (n − k)-controlled V_k gate, introducing an error exponentially small with k (Lemma 7.8 in ref. ¹⁵):

$$∥C^{n-k}\left(V_k\right)-C^{n-k}\left(I\right)∥\le \pi /2^k.$$ 7

Applying the recursion $k=\lceil \log \left(\pi /ϵ\right)\rceil$ times gives an ϵ > 0 error on the implementation of the Cⁿ(U) gates. This decomposition leads to 2k one-controlled-root of U and 2k multi-controlled NOT gates. Each MCX gate is controlled by a number j ∈ {1, …, n − 1} of qubits and, therefore, is implementable using one of the non-affected qubits as a borrowed ancilla through the first method 1 with a polylogarithmic depth. The following proposition summarises the complexity of the method.

Proposition 2

For any single-qubit unitary $U\in \mathsf{U}\left(2\right)$, a controlled-U gate with n control qubits is implementable up to an error ϵ > 0 (in spectral norm) with a circuit of depth $\mathcal{O}\left(\log {\left(n\right)}^3\log \left(1/ϵ\right)\right)$, size $\mathcal{O}\left(n\log {\left(n\right)}^4\log \left(1/ϵ\right)\right)$ without ancilla qubits.

The size and depth of the quantum circuits are trivially bounded noticing that the computational cost of kj-MCX, j ≤n − 1, is bounded by the computational cost of kn-multi-controlled NOT gates.

This approximation proves highly effective for practical applications, as it is not needed to implement gates with exponentially small phases. The error ϵ > 0 can be selected to align with the intrinsic hardware error, providing a level of flexibility that exact methods approaches may not offer.

Adjustable-depth method

This subsection explains how to implement a Cⁿ(X) gate given 2 ≤ m ≤ n zeroed ancilla qubits. For simplicity, consider an even number of ancillae m and a number of control qubits n divisible by m/2. The method has three steps: a first one where m/2 controlled-NOT gates, each controlled by n/(m/2) qubits, are performed in parallel in order to store the activation of the subregisters into m/2 ancillae. A second step where a C^m/2(X) controlled by the first m/2 ancillae is implemented on the target qubit using the last m/2 zeroed ancillae. A last one to restore the ancilla qubits in state $∣0⟩$. The first step makes use of Proposition 1 to implement each C^n/(m/2)(X) with depth $\mathrm{\Theta }\left(\log {\left(n/\left(m/2\right)\right)}^3\right)$ using one zeroed ancilla of the last m/2 ancillae. The second step uses the logarithmic method from²² to implement the C^m/2(X) with depth $\mathcal{O}\left(\log \left(m/2\right)\right)$ using m/2 ancillae. The circuit in Fig. 6 represents the three steps of the adjustable-depth method.

Fig. 6. Decomposition of a controlled-NOT gate into controlled operations with fewer control qubits using zeroed ancilla qubits.

$R$ is the control register of size $n$, $R_i$ are subregisters of $R$. $A_i$ are registers of zeroed ancilla qubits containing the qubits $a_i$, $i\in \left\{0,,m-1\right\}$. $t$ denotes the target qubit.

More generally, one can consider any value of n control qubits and m ancilla qubits such that 2 ≤ m ≤ n qubits. Let A = {a₀, …, a_m−1} be the register of zeroed ancilla qubits, A₀ = {a₀, …, a_{⌊m/2⌋−1}} and A₁ = {a_⌊m/2⌋, …, a_m−1} such that A = A₀ ∪ A₁ and let the control register R be divided into ⌊m/2⌋ balanced subregisters ${\left(R_i\right)}_{i=0}^{\lfloor m/2\rfloor -1}$. Let Π be the operation associated to the first step:

$$\mathrm{\Pi }\equiv {\prod }_{i=0}^{\lfloor m/2\rfloor -1}{\mathcal{C}}_{R_i}^{a_i}.$$ 8

Each of the $C_{R_i}^{a_i}$ is implemented in parallel of the others using the circuit in Fig. 1 with one zeroed ancilla of register A₁. Since all the $C_{R_i}^{a_i}$’s are performed in parallel, the operation Π has the same depth as the maximum depth of the ${\mathcal{C}}_{R_i}^{a_i}$’s. After applying Π, one can implement ${\mathcal{C}}_{A_0}^t$ using the method from²², which uses as many ancillae as control qubits to achieve a logarithmic depth. Therefore, one can implement $C_{A_0}^t$ with depth $16\lceil \log \left(\lfloor m/2\rfloor \right)\rceil +12$ using A₁ as a register of zeroed ancilla qubits (Corollary 2 in²²). Finally, one can repeat Π to fully reset the register A. Proposition 3 summarises the complexity of this new method.

Proposition 3

Let n ≥ 2 be the number of control qubits and 2 ≤ m ≤ n be the number of available zeroed ancillae. Then, there exists a decomposition of the Cⁿ(X) into single-qubit gates and CNOT gates with depth complexity:

$$\mathcal{O}\left(\log {\left(n/\lfloor m/2\rfloor \right)}^3+\log \left(\lfloor m/2\rfloor \right)\right).$$ 9

Note that the depth decreases as the number of ancillae m increases, providing a method with adjustable depth. This is a valuable asset for aligning with the constraints of the hardware resources. Also, remark that the method from²² has been used only for the second part of the algorithm. Using it in the first part would require a number of ancilla qubits proportional to the number of blocks, thus be potentially large. Different combinations of methods did not seem to lead to particular improvements in terms of depth or size. Overall, this decomposition provides a range of logarithmic-depth methods using less than n ancillae, by considering m(n) = αn, with 0 < α < 1, improving the decomposition proposed in²².

Discussion

In non-asymptotic regimes, pre-factors play a crucial role. This section employs graphical comparisons and complexity tables to fairly evaluate the overall effectiveness of current MCX decomposition methods. The circuits are compiled on the basis of single-qubit and CNOT gates for the number of control qubits ranging from 10² to 10⁷. The obtained depths are numerically fitted, giving useful estimates for each method. Since this section only aims to serve as a resource estimator, the linear depth decompositions are fitted with a first-order polynomial in the variable n and the depth of the decomposition from Proposition 1 is fitted with a first-order polynomial in the variable $\log {\left(n\right)}^3$.

In the case where only one zeroed borrowed ancilla qubit is available, a comparison is made with the one ancilla method from¹⁵ as well as Craig Gidney’s ancilla-free method, and illustrated in Fig. 7a. In practice, the recurrence from Proposition 1 must be initialised. For a number of control qubits n less than 30, the Cⁿ(X) gate is implemented using Barenco et al.’s single-borrowed-ancilla method (the small gates can also be optimised via a brute-force approach). From there, the circuits and depths can be computed with a simple dynamic programming approach. This implementation provides a shallower circuit for any number of control qubits. In that case, the asymptotic advantage of Proposition 1 becomes evident early in the process, making the method applicable across various regimes.

Fig. 7. Numerical analysis of circuit depths.

a Comparison of circuit depths for methods involving a single or no ancilla. b C¹⁰⁰(X) depth as a function of the number of zeroed ancillae. c $C^{10^5}\left(X\right)$ depth as a function of the number of zeroed ancillae.

Next, in the absence of an ancilla qubit but allowing an approximation error ϵ > 0, a comparison is conducted against the state-of-the-art method outlined by Silva et al.²⁸, as depicted in Fig. 7a. Proposition 2 yields a shallower circuit than the method²⁸ as soon as n ≳ 10⁵.

Finally, with a fixed number of control qubits set at n = 100, Fig. 7b illustrates the depth as a function of the number of ancillae. For a single ancilla, the use of the circuit in Fig. 1 already surpasses the state-of-the-art, and an increase in the number of zeroed ancillae rapidly reduces the overall circuit depth. Proposition 3 achieves the same depth as the previous best method but with a significantly lower number of ancillae, getting even larger as the number n of control qubits increases as depicted in Fig. 7b, c.

Table 1 compares the depth of various methods without employing any ancilla by fitting numerically the data from the implementations. Craig Gidney’s method stands out as the only exact method but results in a notably higher overall depth. The linear decomposition from²⁸ achieves a leading coefficient of 48 at an approximation error of ϵ = 10⁻⁷, representing a significant improvement. Lastly, the implementation of Proposition 2 delivers a depth of $\lceil \log \left(\pi /ϵ\right)\rceil \left(43\log {\left(n\right)}^3-1287\right)$ and emerges as the most efficient method for n ≳ 10⁵ control qubits.

Table 1.

Circuit depth of ancilla-free methods

Method	Circuit depth
Gidney18	494n − 1413
Silva (ϵ)28	64n + 1645 if (ϵ = 10−7)
Proposition 2 (ϵ)	$\lceil \log \left(\pi /ϵ\right)\rceil \left(86\log {\left(n\right)}^3-2564\right)$

The depths are numerically fitted in the range from 10² to 10⁷ control qubits.

In Table 2, various methods are compared when using a borrowed ancilla qubit. It is worth noting that employing such methods allows putting to use any qubit unaffected by the controlled operation for implementation, a situation frequently encountered in practice without the need for extra qubits. Notably, Proposition 1 is competitive across all control qubit numbers. The advantage becomes evident with over 10² control qubits, resulting in a significant decrease in circuit depth. From this table, it is also straightforward to compare the depth of controlled-$\mathsf{SU}\left(2\right)$ gates. Reference²⁹ improved the base construction presented in ref. ¹⁵ to yield a depth of leading-order term 55n. Recently³⁰, improved this result with a depth of 32n. Naively, the construction from Corollary 2 has a a leading order depth of two times the depth of a Cⁿ⁻¹(X) with borrowed ancilla qubit: $86\log {\left(n\right)}^3$. By implementing the first Cⁿ⁻¹(X) with the decomposition shown in Fig. 2 ($\mathfrak{C}{\mathcal{C}}_{R_0}^a\mathfrak{C}{\mathcal{C}}_{R_0}^a$) and the second with its conjugate (${\mathcal{C}}_{R_0}^a\mathfrak{C}{\mathcal{C}}_{R_0}^a\mathfrak{C}$), this depth can be reduced by $2\times 43\log {\left(n^{1/2}\right)}^3$ bringing a leading order of $76\log {\left(n\right)}^3$.

Table 2.

Circuit depth of borrowed ancillae methods

Method	Circuit depth	Borrowed
Barenco 115	48n − 148	1
Barenco n − 215	24n − 43	n − 2
Proposition 1	$43\log {\left(n\right)}^3-1287$	1

The depths are numerically fitted in the range from 10² to 10⁷ control qubits.

Finally, Table 3 compares the methods using additional zeroed ancilla qubits. For a given number of available zeroed ancillae, Proposition 3 achieves shallower circuits. When the number of ancilla qubits matches the number of control qubits, the method proves as effective as the previously shallowest method by He et al.²². However, note that similar performances can be reached with significantly less zeroed ancillae (see Fig. 7b and c).

Table 3.

Circuit depth of zeroed ancillae methods

Method	Circuit depth	Zeroed
Barenco 115	36n − 111	1
Barenco n − 215	12n − 12	n − 2
Proposition 1	$27\log {\left(n\right)}^3-808$	1
Proposition 3	$27\log {\left(n/\lceil m/2\rceil \right)}^3+$	2 ≤ m ≤ n
	$16\lceil \log \left(\lfloor m/2\rfloor \right)\rceil -808$
He22	$16\lceil \log \left(n\right)\rceil +12$	n

The depths are numerically fitted in the range from 10² to 10⁷ control qubits.

This paragraph provides an overview of some standard quantum algorithm oracles where multi-controlled operations act as both building blocks and complexity drivers and where the improved decomposition reported in this paper readily provides the corresponding speedup. Quantum search³¹, quantum phase estimation⁸, and Hamiltonian simulation¹⁰ provide robust support for the claimed exponential quantum advantage. These algorithms can be seen as particular instances of the quantum singular value transformation (QSVT)⁶, which allows the embedding of any Hamiltonian H into an invariant subspace of the signal unitary, thereby enabling to compute a broad range of polynomials of H. The qubitisation⁵ is the central technique to the framework of QSVT. When qubitising the Hamiltonian expressed as a linear combination $H={\sum }_{k=1}^s{\alpha }_k{U}_k$, with each U_k decomposable into a maximum of C native gates, the process exhibits optimal query complexity for the two following oracles. The PREPARE oracle consists of a quantum state preparation step. Formally, it involves preparing the state $∣\text{PREPARE}⟩$ from a set of coefficients ${\left\{{\alpha }_k\right\}}_{k=1}^s$ such as :

$$\text{PREPARE}{∣0⟩}^{\otimes \log s}={\sum }_{k=1}^s\sqrt{\frac{{\alpha }_k}{\lambda }}∣k⟩,\lambda ={\sum }_{k=1}^s{\alpha }_k$$ 10

The CVO-QRAM algorithm³² performs an efficient task by proceeding s layers of n-controlled operations, where n represents the number of control qubits and s represents the number of non-zero amplitude in the target state. The resulting circuit exhibits a depth of $\mathcal{O}\left(sn\right)$ assuming the usual linear decomposition of multi-controlled operations. The Cⁿ(X) gate decompositions provided in this paper readily improve the scaling to $\mathcal{O}\left(s\log {\left(n\right)}^3\right)$. The PREPARE operator finds application in a broader context beyond qubitisation, whenever there is a need to transfer classical data into the qubit register. The SELECT oracle consists of a block-diagonal operator and acts as follows :

$$\text{SELECT}\equiv {\sum }_{k=1}^s∣k⟩⟨k∣\otimes U_k$$ 11

It can be efficiently decomposed as s layers of $\log \left(s\right)$-controlled-U_k operations, yielding a depth in $\mathcal{O}\left(s\log \left(s\right)C\right)$ with usual linear-depth decomposition of $C^{\log \left(s\right)}\left(U\right)$ gates. The decompositions presented in this paper readily reduce the SELECT operation complexity to $\mathcal{O}\left(s\log {\left(\log \left(s\right)\right)}^{3}C\right)$.

Considering an example application in ground-state quantum chemistry, the quantum phase estimation (QPE) stands as the standard fault-tolerant algorithm. The QPE performs a projection on an eigenstate of the Hamiltonian and provides an estimate of the associated eigenenergy. The overall complexity is determined by the preparation of an accurate initial state, and the implementation of the phase estimation circuit. A possible strategy involves using CVO-QRAM to initialise the quantum register to an accurate approximation of the ground state obtained with classical computational chemistry simulations³³. Then, the phase estimation algorithm calls multiple times a controlled unitary U. The unitary U should be encoded so that its spectrum is related to the spectrum of the molecular Hamiltonian H. The qubitisation outlined above has become a standard for this task, for example, by implementing the quantum walk operator $U=e^{i\arccos H}$⁶. The polylogarithmic-depth Cⁿ(X) operations presented in this paper directly reduce the depth of two building blocks in QPE, leading to corresponding improvements in the algorithm. The expected costs associated with achieving a quantum advantage in chemistry with QPE^34–38 require a reconsideration incorporating the previous enhancements.

In summary, this paper introduced three methods for decomposing Cⁿ(X) gates into arbitrary single-qubit and CNOT gates. Proposition 1 takes advantage of a single borrowed ancilla qubit to implement a Cⁿ(X) gate with depth complexity $\mathrm{\Theta }\left(\log {\left(n\right)}^3\right)$. Such polylogarithmic complexity significantly improves the present state-of-the-art which is set at a depth of Θ(n). Proposition 2 aims at the more general task of controlling arbitrary single-qubit unitaries. Introducing an approximation error ϵ > 0 and making use of the previous proposition, the task can be achieved with depth $\mathcal{O}\left(\log \left(1/ϵ\right)\log {\left(n\right)}^3\right)$. With polylogarithmic dependence on both relevant parameters, this approach emerges as the most efficient in its category. When zeroed ancillae are available, Proposition 3 provides a strategy for enhancing the efficiency of a Cⁿ(X) gate by optimising the utilisation of these ancillae. A glimpse into the potential applications of these enhanced Cⁿ(X) implementations within the QSVT framework is presented.

While Propositions 1 and 2 offer a superpolynomial speedup in terms of depth, the size is increased by a polylogarithmic factor. The size of the circuit, especially the count of non-Clifford gates (T gates, Toffoli,...), can dominate the total execution time due to the necessity of preparing magic states through distillation³⁹. This process is highly resource-intensive in terms of both runtime and ancilla count, and it does not always allow for efficient parallel execution. Therefore, the larger size resulting from the proposed decompositions could be seen as a drawback compared to methods that scale linearly in size. The key aim of these decompositions is to pioneer a novel approach to circuit design that prioritises minimising depth.

It is also important to note that, for a large number n of qubits (n ≥ 10⁵), it is likely that an error lower than 2⁻ⁿ is experimentally hard to achieve on the parameters of the quantum gates, even in the context of fault-tolerant quantum computing with error correction. Therefore, depending on the wavefunctions that are manipulated in the QPU, it might be preferable to skip a large controlled operation (with more than 10⁵ controls). Examples, where gates with exponentially small phases are omitted can be seen in the Approximate Quantum Fourier Transform⁴⁰ or with Proposition 2. Conversely, removing a multi-controlled NOT gate could significantly impact the algorithm’s outcome in the case of sparse quantum state preparation for example³³.

Further research could explore the potential benefits these enhanced multi-controlled NOT decompositions offer across various quantum algorithms. It could also aim to determine whether the new circuit design behind these decompositions can lead to other improved Oracle implementation strategies.

Author contributions

B.C., C.F., and J.Z. conceived and designed the experiments. B.C., C.F., and J.Z. performed the experiments. B.C., C.F., J.Z., F.D., A.P., and J.P.P. analyzed the data. B.C., C.F., and J.Z. contributed materials/analysis tools. B.C., C.F., J.Z., A.P., and J.P.P. wrote the paper. F.D., A.P., and J.P.P. supervised the work.

Peer review

Peer review information

Nature Communications thanks Craig Gidney and the other anonymous, reviewer(s) for their contribution to the peer review of this work. A peer review file is available.

Data availability

The data generated in this study have been deposited in the database under accession code⁴¹.

Code availability

The code generated in this study has been deposited in the following repository⁴¹.

Competing interests

JPP is a shareholder and co-founder of Qubit Pharmaceuticals. The remaining authors declare no other competing interests.

Supplementary information

The online version contains supplementary material available at 10.1038/s41467-024-50065-x.