Provable super-exponential quantum advantage for learning secrets in Mastermind

Abstract

Quantum computing can speed up the solution of certain computational problems. However, a large proportion of such problems discovered so far are either contrived or do not directly correspond to real-world applications. Here, we prove super-exponential quantum speedups for a learning problem called Mastermind where Alice hopes to learn the secret string from Bob by doing as few interactive question-answering as possible. It first appeared as a popular game and then was abstracted to a combinatorial optimization problem with a wide range of applications. To establish the quantum advantage, we propose non-adaptive and adaptive quantum algorithms for this problem, both demonstrating super-exponential quantum speedups over their classical counterparts. The non-adaptive one has a promising experimental realizability on near-term quantum computers since it is simply to run a shallow quantum circuit. Our work adds a new member to the zoo of super-exponential quantum speedups and demonstrates quantum advantages for problems with potential applications.

Introduction

Can quantum computers win more than classical computers on the popular board game Mastermind given in Fig. 1? Can quantum computers solve more efficiently for the well-known coin-weighing problem: “ Counterfeit coins weigh 9 grams and genuine coins all weigh 10 grams. One is given n coins of unknown composition, and an accurate scale (not a balance). How many weighings are needed to isolate the counterfeit coins?” Our answer in this article is “Absolutely yes”!

Fig. 1: Mastermind game (the image comes from ref. ³⁰): alice creates a secret code of 4 pegs, where each peg is drawn from the same palette of 6 colors.

Bob’s task is to infer the secret code by asking as few questions as possible. Each question is itself a candidate code, and the response is two integers called Black and White. The value of Black indicates in how many positions there is exact agreement, and the value of White indicates how many colors are correct but in the wrong position.

One of the main motivations for work in quantum information science is the prospect of fast quantum algorithms to solve important computational problems^1,2. Despite great effort over the past few decades, we still do not understand on what class of problems quantum computers outperform classical computers and to what extent. Shor’s factoring algorithm is renowned for its exponential quantum speedups in time complexity, but this speedup relies on the conjecture that factoring cannot be achieved in polynomial time on a classical computer. In quantum machine learning³, some problems were claimed to admit exponential quantum speedups, but subsequent de-quantization studies showed that they were not as successful as expected^4,5,6.

If we don’t obsess over time complexity, exponential and even super-exponential separation between quantum and classical computing can be proved unconditionally from the perspective of other complexities. For instance, in the query complexity model (or black-box model), exponential quantum speedups have been proven in Simon’s problem⁷, the welded tree problem^8,9, the graph property testing problem¹⁰, NP search problems¹¹, simulating coupled classical oscillators¹², and so on. Exponential separation has also been shown from the perspective of communication complexity for computing distributed functions^{13,14,15,16,17}. More than 20 years ago, quantum computing was shown to exponentially reduce the state complexity of quantum automata for recognizing a regular language¹⁸. In circuit depth complexity, quantum advantage has been proven for a 2D hidden linear function problem¹⁹.

The above results provide provable quantum advantages from different perspectives. However, all the aforementioned problems either are contrived or do not directly correspond to real-world applications. In this article, we seek provable sharp quantum speedups for natural computational problems with potential applications. Mastermind is a good candidate for such problems²⁰, since it has attracted plenty of attention not only from the public as a popular game but also from the academic community as a combinatorial optimization problem with a wide range of applications. Mastermind is a classic board game introduced commercially in the 1970s and formalized in the mathematics literature in 1983 by Chvatal²¹. The game is played in turns by two players: codemaker and codebreaker. The codemaker generates a hidden secret string of length n where each entry is one out of k characters. Then the task of the codebreaker is to determine the secret by making a sequence of guesses. To each guess, the codemaker replies with two numbers: one denotes the number of correctly guessed indices, and the other one indicates the number of correctly guessed characters but in the wrong position. The codebreaker “wins” the game if he learns the secret, with the goal of winning the game in as few guesses as possible.

Mastermind has attracted plenty of attention from the public as a popular game. The commercial version (see Fig. 1) corresponds to the case of k = 6 and n = 4, and Knuth²² proved in 1977 that 5 guesses are sufficient to determine the secret. 2-character Mastermind is essentially equivalent to the coin-weighing problem mentioned before, which was posed by Shapiro and Fine²³ in 1960 and studied by Erdős and Rényi²⁴. As mentioned in²⁵, before the commercial version released in 1971, variations of Mastermind have been played earlier under other names, such as the pen-and-paper based games of Bulls and Cows, and Jotto. The game has been played on TV as a game show in multiple countries under the name of Lingo. Recently, a similar web-based game has gained much attention under the name of Wordle.

Mastermind is not only a popular game, but also a learning problem with rich applications. Since the 1970s, Mastermind has sparked a long line of work, especially in the field of mathematics and computer science^{21,22,23,24,25,26,27,28,29,30,31,32,33,34,35}, with a close relation to information theory and graph theory^27,32 as well as machine learning³⁵. It has been applied to various fields. For example, it can be regarded as a benchmark problem for intelligent algorithms (genetic and evolutionary algorithms)³⁶, and can be used as a test-bed for search algorithms, as claimed by the title of the paper³⁷. Furthermore, it has been applied to understanding the intrinsic difficulty of heuristic algorithms³⁸, simulating attacks on DNA data^39,40, cracking bank ciphers⁴¹, and learning from database⁴². Gagneur et al.⁴³ stated that it is the Mastermind game that leads the authors to the research in bio-informatics. In addition, Mastermind has been proposed as a teaching tool in mathematics and life science^44,45.

Being able to come up with an effective algorithm that can be applied to all these problems is already a good enough reason to study Mastermind. When quantum computers meets Mastermind, it is natural to ask: Are quantum algorithms more efficient than classical ones for Mastermind? Depending on the strategy of how to make a query, algorithms can be divided into two kinds: adaptive and non-adaptive. In the adaptive strategy, each query can depend on answers of the previous queries. Otherwise, it is non-adaptive. Note that the adaptive strategy could be more efficient than the non-adaptive one, due to it’s more genernal and complex operations. On the hand, non-adaptive algorithms are preferred over their adaptive counterparts, due to their simpler as well as highly parallelizable nature. The non-adaptive one is even more attractive in the field of quantum computing, since it has a low-depth quantum circuit and thus is easy to implement in experiments.

Results

Mastermind

Our main result in this article is discovery of super-exponential quantum advantages for Mastermind, a popular game in daily life as well as a combinatorial optimization problem with a wide range of applications. Before formally stating the result, we first introduce some notations. Let [k] = {0, 1, …k − 1}. The Mastermind game with n positions and k characters is formally described as follows. The game is played in turns by two players: codemaker and codebreaker. First, the codemaker chooses a secret string s ∈ [k]ⁿ. Then in each round, the codebreaker guesses a string x ∈ [k]ⁿ to tell the codemaker, and the codemaker replies with two numbers given as:

$$b(s,x)=| \{i\in \{1,2,\ldots ,n\}:{s}_{i}={x}_{i}\}| ,$$

and

$$w(s,x)=\mathop{\max }\limits_{\sigma }| \{i\in \{1,2,\ldots ,n\}:{s}_{i}={x}_{\sigma (i)}\}| -b(s,x),$$

where σ goes over all permutations of {1, 2, …, n}. In other words, b(s, x) (denoted by the number of black pegs) indicates the number of positions where s and x coincide, and w(s, x) (denoted by the number of white pegs) indicaties the number of right characters but being in the wrong position. The goal of the codebreaker is to learn the secret s in as few guesses as possible. When we mention “complexity” in this paper, it always means the number of queries (guesses) used. The game is called black-peg Mastermind when only one number b(s, x) is replied, and black-white-peg Mastermind when both the two numbers b(s, x) and w(s, x) are replied. It is obvious that the black-white-peg query provides more information than the black-peg query. Thus, any algorithm for black-peg Mastermind also works for black-white-peg Mastermind, but the reverse is not true.

Quantum algorithms for Mastermind

The main results are presented in Theorem 1. The standard asymptotic notations O( ⋅ ), Ω( ⋅ ), and Θ( ⋅ ) are used. We say the complexity is O(f(n)) (resp. Ω(f(n))), if for large enough n, it is at most (resp. at least) cf(n) for some constant c. The complexity is said to be Θ(f(n)), if for large enough n, it is between c₁f(n) and c₂f(n) for some constants c₁, c₂.

Theorem 1

For Mastermind game with n positions and k characters:

• 1. There is a non-adaptive quantum algorithm that learns the secret s with certainty, using at most k − 1 black-peg queries.

• 2. There is an adaptive quantum algorithm that learns the secret s with certainty, using $O(\lceil \frac{k}{n}\rceil +\sqrt{| {C}_{s}| })$ black-white-peg queries, where C_s is the set of characters occupied by s.

The first algorithm is more practical and easier to implement than the second one, since the former needs only to run a simple and shallow quantum circuit k − 1 times. We can construct the specific quantum circuit for it (see Supplementary Information A for details). Thus, it has a promising experimental realizability on near-term quantum computers. When more general adaptive strategies are allowed and more feedback information is made use of, we obtain the second algorithm with $O(\lceil \frac{k}{n}\rceil +\sqrt{| {C}_{s}| })$ queries, which is more efficient than the first one, but may require a longer sequential quantum circuit. Note that this algorithm is instance-optimal, that is, the complexity is related to the specific instance s (one can refer to^46,47 for more information about instance optimal algorithms). Thus, it could greatly reduce the complexity for some instances. For example, if k = n and ∣C_s∣ is a constant c, then the algorithm requires only a constant number of queries. This indicates that adaptivity can be used to achieve a meaningful speed-up compared to the non-adaptive schemes for Mastermind on quantum computers. Note that there are some papers dedicated to discussing the power of adaptivity in quantum algorithms (for example, see⁴⁸).

In classical computing, after a long list of work since 1970s, the complexity of Mastermind has been recently understood completely: the classical complexity of adaptive algorithms is $\Theta (n\frac{\log k}{\log n}+k)$ and that of non-adaptive algorithms is $\Theta (n\frac{\log k}{\log n}+\frac{k}{n})$ (see refs. ^25,33). So if we regard k as a constant, then the classical complexity is proportional to $\frac{n}{\log n}$. In contrast, the quantum complexity is independent of n, that is, O(1), by noting that $\lceil \frac{k}{n}\rceil =1$ when n ≥ k and we always have ∣C_s∣ ≤ k. If one could reduce the complexity from $\frac{n}{\log n}$ to $\log \frac{n}{\log n}$, then exponential speedups would be achieved. Here, our result reduces the complexity further from $\frac{n}{\log n}$ to O(1), thereby yielding super-exponential quantum speedups on Mastermind.

Discussion

In this article, we have demonstrated super-exponential quantum speedups for Mastermind, a problem from real life, which is not only a popular game but also a learning problem with a wide range of applications. More specifically, we have proposed adaptive and non-adaptive quantum algorithms for Mastermind. The non-adaptive algorithm is preferred over the adaptive one, due to its simpler as well as highly parallelizable nature. More importantly, the non-adaptive algorithm is promising to be realizable on near-term quantum computers, since it is simply to run a shallow quantum circuit. The adaptive one has a lower query complexity by making full use of the feedback information and using more complicated sequences of quantum operations. Technically, we have developed a framework for designing quantum algorithms for the general string learning problem, which not only allows huge quantum speedups on Mastermind but also is very likely helpful for addressing other similar problems.

A circuit diagram for our non-adaptive algorithm is given in Supplementary Fig. 1, from which one can see that the circuit uses only some elementary quantum gate such as H, and the remaining thing is to implement the oracle B_s. In Supplementary Information A, we present a universal approach to the implementation of it. For some carefully selected instances, the quantum circuits can be greatly optimized. Thus, it is promising to have a proof-of-principle experimental demonstration on near-term quantum computers, and we hope to see this soon.

Methods

Notation

[k] = {0, 1, …k − 1}. C^d denotes a d-dimensional Hilbert space. ⊕ _m stands for the operation of modulo m addition. ∣A∣ is the cardinality of set A. δ_ij indicates whether i equals j, that is, δ_ij = 1 when i = j and δ_ij = 0 when i ≠ j. The quantum Fourier transform on a d-dimensional Hilbert space, denoted by QFT_d, is defined by $QF{T}_{d}\left\vert l\right\rangle =\frac{1}{\sqrt{d}}\mathop{\sum }\nolimits_{j = 0}^{d-1}{\omega }^{lj}\left\vert j\right\rangle$, with ω = e^2πi/d and l ∈ [d]. The inverse of QFT_d is denoted by $QF{T}_{d}^{\dagger }$. In Mastermind with n positions and k characters, it can be regarded that the codemaker has an oracle B_s that outputs b(s, x) for each guessed string x in the case of black-peg Mastermind, or has the oracle BW_s that outputs the pair (b(s, x), w(s, x)) in black-white-peg Mastermind. Correspondingly, in quantum computing it is assumed that the codemaker has the following quantum oracles that can be accessed with quantum superposition states: ${B}_{s}| x\left.\right\rangle | y\left.\right\rangle =| x\left.\right\rangle | y{\oplus }_{{2}^{m}}b(s,x)\left.\right\rangle$ or $B{W}_{s}| x\left.\right\rangle | y\left.\right\rangle | z\left.\right\rangle =| x\left.\right\rangle | y{\oplus }_{{2}^{m}}b(s,x)\left.\right\rangle | z{\oplus }_{{2}^{m}}w(s,x)\left.\right\rangle$, where it suffices to satisfy 2^m≥n + 1.

Non-adaptive quantum algorithm with black-peg queries

Here we will propose a non-adaptive quantum algorithm. Specifically, we develop a three-step framework for designing quantum algorithms, which not only allows huge quantum speedups on Mastermind but also perhaps sheds light on exploring quantum speedups for other similar problems. Our framework is as follows:

We first obtain the structure information of Mastermind. Given a string x ∈ [k]ⁿ and c ∈ [k], the product of x and c is defined by x ⋅ c = (x₁ ⋅ c)(x₂ ⋅ c) ⋯ (x_n ⋅ c). Given two strings x, y ∈ [k]ⁿ, the sum of x, y, denoted by x + y, is an n-length string with the ith position being $({x}_{i}+{y}_{i})\,\mathrm{mod}\,\,k$ for i = 1, 2, ⋯ n.

Definition 1

Let s be a secret string from [k]ⁿ. M is a k × n matrix with rows indexed by characters in [k] and columns indexed by positions in {1, 2, …, n}, defined by

$$M({c}_{i},j)=\left\{\begin{array}{ll}\,1,\quad {s}_{j}={c}_{i},\\\, 0,\quad \,{\text{otherwise}}\,.\end{array}\right.$$

M is called the characteristic matrix associated with s.

It is obvious that identifying s is equivalent to learning M. More specifically, the secret string s can be represented as $s={\sum }_{{c}_{i}\in [k]}{c}_{i}\cdot M({c}_{i},* )$, where M(c_i, $*$) denotes the c_i-th row of M.

Let ${M}^{({c}_{l},{c}_{h})}$ be the sum of the c_l-th and c_h-th rows of M given by ${M}^{({c}_{l},{c}_{h})}\equiv M({c}_{l},* )\oplus M({c}_{h},* )$, where c_l ≠ c_h ∈ [k] and ⊕ denotes the bitwise XOR. It can be seen that the i-th entry of ${M}^{({c}_{l},{c}_{h})}$ satisfies

$${M}_{i}^{({c}_{l},{c}_{h})}=\left\{\begin{array}{ll}\, 1,\quad {s}_{i}={c}_{l}\,\,{\text{or}}\,\,{c}_{h},\\\,0,\quad \,{\text{otherwise}}\,,\end{array}\right.$$

Thus, ${M}^{({c}_{l},{c}_{h})}$ indicates the positions where s takes the character c_l or c_h.

The next lemma shows an important property of the characteristic matrix M.

Lemma 1

Suppose M is the characteristic matrix of s ∈ [k]ⁿ. Then we can determine s from the set $\{{M}^{({c}_{2},{c}_{1})},{M}^{({c}_{3},{c}_{1})},\ldots ,{M}^{({c}_{k},{c}_{1})}\}$ where c_i ≠ c_j for i ≠ j.

Proof

First from ${M}^{({c}_{l},{c}_{h})}\equiv M({c}_{l},* )\oplus M({c}_{h},* )$, we have

$$M({c}_{i},* )=M({c}_{j},* )\oplus {M}^{({c}_{i},{c}_{j})},$$

(1)

Next, we can show

$$M({c}_{i},* )={M}^{({c}_{i},{c}_{j})}\wedge {M}^{({c}_{i},{c}_{l})},$$

(2)

where ∧ denotes the bitwise AND, and ∨ denotes the bitwise OR in the sequel. Actually, we have

$$\begin{array}{ll}{M}^{({c}_{i},{c}_{j})}\wedge {M}^{({c}_{i},{c}_{l})}=(M({c}_{i},* )\oplus M({c}_{j},* ))\wedge (M({c}_{i},* )\oplus M({c}_{l},* ))\\\qquad\qquad\qquad\qquad =(M({c}_{i},* )\vee M({c}_{j},* ))\wedge (M({c}_{i},* )\vee M({c}_{l},* ))\\\qquad\qquad\qquad\qquad =M({c}_{i},* )\vee (M({c}_{j},* )\wedge M({c}_{l},* ))\\\qquad\qquad\qquad\qquad =M({c}_{i},* )\vee {\bf{0}}\\\qquad\qquad\qquad\qquad =M({c}_{i},* ),\end{array}$$

where the second and fourth equations hold from the fact that two different rows of M never have 1 on the same position.

Then from Eqs. (1) and (2), we have

$$M({c}_{1},* )={M}^{({c}_{1},{c}_{2})}\wedge {M}^{({c}_{1},{c}_{3})},$$

and for i = 2, 3, …, k, there is

$$\begin{array}{ll}M({c}_{i},* )=M({c}_{1},* )\oplus {M}^{({c}_{i},{c}_{1})}\\\qquad\qquad =({M}^{({c}_{1},{c}_{2})}\wedge {M}^{({c}_{1},{c}_{3})})\oplus {M}^{({c}_{i},{c}_{1})}.\end{array}$$

It means that we can get {M(c₁, $*$), M(c₂, $*$), …, M(c_k, $*$)} from $\{{M}^{({c}_{2},{c}_{1})},{M}^{({c}_{3},{c}_{1})},\ldots ,{M}^{({c}_{k},{c}_{1})}\}$, and thus obtain s according to $s={\sum }_{{c}_{i}\in [k]}{c}_{i}\cdot M({c}_{i},* )$. □

We then develop a quantum algorithm for learning ${M}^{({c}_{l},{c}_{h})}$. In this algorithm, any two different characters c_l, c_h ∈ [k] are taken as input, and the algorithm returns ${M}^{({c}_{l},{c}_{h})}$ with certainty.

First, for the secret string s ∈ [k]ⁿ and any two characters c_l, c_h ∈ [k] with c_l ≠ c_h, we define a function ${B}_{s}^{({c}_{l},{c}_{h})}:{[2]}^{n}\to \{0,1,\cdots \,,n\}$ as

$${B}_{s}^{({c}_{l},{c}_{h})}(x)=\mathop{\sum }\limits_{i=1}^{n}({\delta }_{{x}_{i}0}{\delta }_{{s}_{i}{c}_{l}}+{\delta }_{{x}_{i}1}{\delta }_{{s}_{i}{c}_{h}}),$$

indicating how many positions i satisfy that s_i takes character c_l when x_i = 0 or c_h when x_i = 1. Its quantum oracle works as

$${B}_{s}^{({c}_{l},{c}_{h})}| x\left.\right\rangle | b\left.\right\rangle =| x\left.\right\rangle | b\,{\oplus }_{{2}^{m}}{B}_{s}^{({c}_{l},{c}_{h})}(x)\left.\right\rangle ,$$

where m is required to satisfy 2^m≥ (n + 1).

Now we obtain the following result.

Lemma 2

There is a quantum algorithm (Algorithm 1) that returns ${M}^{({c}_{l},{c}_{h})}$ with certainty and costs one query to the oracle ${B}_{s}^{({c}_{l},{c}_{h})}$.

Proof

We construct explicitly the quantum algorithm called FindTwoCharacterPosition (see Algorithm 1).

At the first step, we prepare the initial state

$$\left\vert {\Phi }_{0}\right\rangle ={| 0\left.\right\rangle }^{\otimes n}{\left\vert 0\right\rangle }^{\otimes m-1}| 1\left.\right\rangle \in {({C}^{2})}^{\otimes n}\otimes {({C}^{2})}^{\otimes m}.$$

At the second step, applying the unitary operator H^⊗n ⊗ H^⊗m to $\left\vert {\Phi }_{0}\right\rangle$, we get

$$\left\vert {\Phi }_{1}\right\rangle ={H}^{\otimes n}\otimes {H}^{\otimes m}| {\Phi }_{0}\left.\right\rangle =\frac{1}{\sqrt{{2}^{n}}}\mathop{\sum }\limits_{x=0}^{{2}^{n}-1}| x\left.\right\rangle \otimes \frac{1}{\sqrt{{2}^{m}}}\mathop{\sum }\limits_{y=0}^{{2}^{m}-1}{(-1)}^{y}| y\left.\right\rangle .$$

At the third step, recall that ${B}_{s}^{({c}_{l},{c}_{h})}(x)=\mathop{\sum }\nolimits_{i = 1}^{n}({\delta }_{{x}_{i}0}{\delta }_{{s}_{i}{c}_{l}}+{\delta }_{{x}_{i}1}{\delta }_{{s}_{i}{c}_{h}})$ and ${B}_{s}^{({c}_{l},{c}_{h})}| x\left.\right\rangle | b\left.\right\rangle =| x\left.\right\rangle | b{\oplus }_{{2}^{m}}{B}_{s}^{({c}_{l},{c}_{h})}(x)\left.\right\rangle$. Then after applying the oracle ${B}_{s}^{({c}_{l},{c}_{h})}$, we have

$$\begin{array}{ll}\left\vert {\Phi }_{2}\right\rangle ={B}_{s}^{({c}_{l},{c}_{h})}| {\Phi }_{1}\left.\right\rangle \\\qquad =\displaystyle\frac{1}{\sqrt{{2}^{n}}}\mathop{\sum }\limits_{x=0}^{{2}^{n}-1}\left(| x\left.\right\rangle \otimes \frac{1}{\sqrt{{2}^{m}}}\mathop{\sum }\limits_{y=0}^{{2}^{m}-1}{(-1)}^{y}| y{\oplus }_{{2}^{m}}{B}_{s}^{({c}_{l},{c}_{h})}(x)\left.\right\rangle \right)\\\qquad =\displaystyle\frac{1}{\sqrt{{2}^{n}}}\mathop{\sum }\limits_{x=0}^{{2}^{n}-1}\left(| x\left.\right\rangle \otimes \frac{1}{\sqrt{{2}^{m}}}\mathop{\sum }\limits_{y=0}^{{2}^{m}-1}{(-1)}^{y+{B}_{s}^{({c}_{l},{c}_{h})}(x)-{B}_{s}^{({c}_{l},{c}_{h})}(x)}| y{\oplus }_{{2}^{m}}{B}_{s}^{({c}_{l},{c}_{h})}(x)\left.\right\rangle \right)\\\qquad =\displaystyle\frac{1}{\sqrt{{2}^{n}}}\mathop{\sum }\limits_{x=0}^{{2}^{n}-1}\left({(-1)}^{-{B}_{s}^{({c}_{l},{c}_{h})}(x)}| x\left.\right\rangle \otimes \frac{1}{\sqrt{{2}^{m}}}\mathop{\sum }\limits_{y=0}^{{2}^{m}-1}{(-1)}^{y+{B}_{s}^{({c}_{l},{c}_{h})}(x)}| y{\oplus }_{{2}^{m}}{B}_{s}^{({c}_{l},{c}_{h})}(x)\left.\right\rangle \right)\end{array}$$

(3)

$$\begin{array}{lll}\,=\,\displaystyle\frac{1}{\sqrt{{2}^{n}}}\mathop{\sum }\limits_{x=0}^{{2}^{n}-1}{(-1)}^{{B}_{s}^{({c}_{l},{c}_{h})}(x)}| x\left.\right\rangle \otimes \displaystyle\frac{1}{\sqrt{{2}^{m}}}\mathop{\sum }\limits_{{y}^{{\prime} }=0}^{{2}^{m}-1}{(-1)}^{{y}^{{\prime} }}| {y}^{{\prime} }\left.\right\rangle \\ \,=\,\displaystyle\frac{1}{\sqrt{{2}^{n}}}\mathop{\sum }\limits_{x=0}^{{2}^{n}-1}{(-1)}^{\mathop{\sum }\nolimits_{i = 1}^{n}({\delta }_{{x}_{i}0}{\delta }_{{s}_{i}{c}_{l}}+{\delta }_{{x}_{i}1}{\delta }_{{s}_{i}{c}_{h}})}| x\left.\right\rangle \otimes \displaystyle\frac{1}{\sqrt{{2}^{m}}}\mathop{\sum }\limits_{{y}^{{\prime} }=0}^{{2}^{m}-1}{(-1)}^{{y}^{{\prime} }}| {y}^{{\prime} }\left.\right\rangle \\ \,=\,\displaystyle\frac{1}{\sqrt{{2}^{n}}}\mathop{\bigotimes }\limits_{i=1}^{n}[{(-1)}^{{\delta }_{{s}_{i}{c}_{l}}}| 0\left.\right\rangle +{(-1)}^{{\delta }_{{s}_{i}{c}_{h}}}| 1\left.\right\rangle ]\otimes \displaystyle\frac{1}{\sqrt{{2}^{m}}}\mathop{\sum }\limits_{{y}^{{\prime} }=0}^{{2}^{m}-1}{(-1)}^{{y}^{{\prime} }}| {y}^{{\prime} }\left.\right\rangle .\end{array}$$

(4)

Note that in Eq. (3), we have ${(-1)}^{y+{B}_{s}^{({c}_{l},{c}_{h})}(x)}={(-1)}^{y{\oplus }_{{2}^{m}}{B}_{s}^{({c}_{l},{c}_{h})}(x)}$. Then by letting ${y}^{{\prime} }=y\,{\oplus}_{{2}^{m}}{B}_{s}^{({c}_{l},{c}_{h})}(x)$, we get Eq. (4).

At the fourth step, applying H^⊗n ⊗ H^⊗m to $\left\vert {\Phi }_{2}\right\rangle$, we get

$$\left\vert {\Phi }_{3}\right\rangle ={H}^{\otimes n}\otimes {H}^{\otimes m}| {\Phi }_{2}\left.\right\rangle$$

(5)

$$= \bigotimes_{i=1}^{n} (-1)^{\delta_{s_i c_l}} \left| \delta_{s_i c_l} \oplus \delta_{s_i c_h} \right\rangle \otimes \left| 0 \right\rangle^{\otimes (m-1)} \left| 1 \right\rangle$$

(6)

$$=\bigotimes_{i=1}^{n} (-1)^{\delta_{s_i c_l}} \left| \delta_{s_i c_1} \vee \delta_{s_i c_h} \right\rangle \otimes \left| 0 \right\rangle^{\otimes (m-1)} \left| 1 \right\rangle$$

(7)

where Eq. (7) holds because ${\delta }_{{s}_{i}{c}_{l}}$ and ${\delta }_{{s}_{i}{c}_{h}}$ never be both 1.

Finally, by measuring the first n registers, the algorithm outputs with certainty the string x satisfying x_i = 1 if s_i = c_l or s_i = c_h, and x_i = 0 otherwise.

Note that the algorithm uses one query to ${B}_{s}^{({c}_{l},{c}_{h})}$. □

Algorithm 1

FindTwoCharacterPosition

Input: A quantum oracle ${B}_{s}^{({c}_{l},{c}_{h})}$ with s ∈ [k]ⁿ and two different characters c_l, c_h ∈ [k].

Output: A string ${M}^{({c}_{l},{c}_{h})}\in {\{0,1\}}^{n}$ satisfying

$${M}_{i}^{({c}_{l},{c}_{h})}=\left\{\begin{array}{ll}\,1,\quad {s}_{i}={c}_{l}\,\,{\text{or}}\,\,{c}_{h},\\\,0,\quad \,{\text{otherwise}}\,.\end{array}\right.$$

Runtime: One query to ${B}_{s}^{({c}_{l},{c}_{h})}$. Succeeds with certainty.

Procedure:

1 Prepare the initial state $\left\vert {\Phi }_{0}\right\rangle ={| 0\left.\right\rangle }^{\otimes n}{\left\vert 0\right\rangle }^{\otimes m-1}| 1\left.\right\rangle \in {({C}^{2})}^{\otimes n}\otimes {({C}^{2})}^{\otimes m}$ with 2^m≥ (n + 1);

2 Apply the unitary transformation H^⊗n ⊗ H^⊗m to $\left\vert {\Phi }_{0}\right\rangle$;

3 Apply the oracle ${B}_{s}^{({c}_{l},{c}_{h})}$;

4 Apply the unitary transformation H^⊗n ⊗ H^⊗m;

5 Measure the first n registers in the computational basis.

Finally, we are only one step away from obtaining a quantum algorithm for Mastermind: showing how to construct ${B}_{s}^{({c}_{l},{c}_{h})}$ from the black-peg oracle B_s. Now we are finishing it with the lemma below.

Lemma 3

Given s ∈ [k]ⁿ, and two characters c_l, c_h ∈ [k] with c_l ≠ c_h, ${B}_{s}^{({c}_{l},{c}_{h})}$ can be implemented by using one black-peg oracle B_s.

Proof

Given a secret string s = s₁s₂…s_n ∈ [k]ⁿ and x = x₁x₂…x_n ∈ [2]ⁿ, we now describe how to compute ${B}_{s}^{({c}_{l},{c}_{h})}(x)=\mathop{\sum }\nolimits_{i = 1}^{n}({\delta }_{{x}_{i}0}{\delta }_{{s}_{i}{c}_{l}}+{\delta }_{{x}_{i}1}{\delta }_{{s}_{i}{c}_{h}})$ by using B_s. The quantum circuit diagram implementing ${B}_{s}^{({c}_{l},{c}_{h})}$ is shown in Supplementary Fig. 2. First we define a string y^x ∈ [k]ⁿ as

$${y}_{i}^{x}=\left\{\begin{array}{ll}{c}_{l},\quad if\,{x}_{i}=0,\\ {c}_{h},\quad if\,{x}_{i}=1.\end{array}\right.$$

Let V = {i ∈ {1, 2, …, n}: x_i = 0}, and $\overline{V}=\{1,2,\ldots ,n\}-V$. Feeding the black-peg function B_s with y^x, we get

$$\begin{array}{ll}{B}_{s}({y}^{x})=| \{i\in V:{s}_{i}={c}_{l}\}\cup \{i\in \overline{V}:{s}_{i}={c}_{h}\}| \\\qquad\qquad =\mathop{\sum }\limits_{i=1}^{n}\left({\delta }_{{x}_{i}0}{\delta }_{{s}_{i}{c}_{l}}+{\delta }_{{x}_{i}1}{\delta }_{{s}_{i}{c}_{h}}\right)\\\qquad\qquad ={B}_{s}^{({c}_{l},{c}_{h})}(x).\end{array}$$

As a result, ${B}_{s}^{({c}_{l},{c}_{h})}(x)$ can be computed by calling the black-peg function B_s once. □

Now we have achieved a non-adaptive quantum algorithm with at most k − 1 queries, as shown in Algorithm 2. The idea is to first apply the subroutine FindTwoCharacterPosition to get the result ${M}^{({c}_{1},{c}_{i})}$ for i ∈ {2, 3, …, k}, and then obtain all the rows of the characteristic matrix M, from which the secret string s can be deduced. The correctness of Algorithm 2 is ensured by Lemmas 1, 2 and 3. Since there are k − 1 calls to FindTwoCharacterPosition and each call consumes one black-peg query to B_s by Lemma 3, the complexity of Algorithm 2 with respective to B_s is k − 1.

It should be pointed out that this algorithm is not applicable to k = 2. But it is not difficult to construct a quantum algorithm using only one black-peg query for k = 2, as shown in Supplementary Information B.

Algorithm 2

A non-adaptive quantum algorithm for Mastermind with n positions and k ≥ 3 characters using k − 1 black-peg queries

 Input: A black-peg oracle B_s for s ∈ [k]ⁿ such that ${B}_{s}\left\vert x\right\rangle \left\vert b\right\rangle =\left\vert x\right\rangle \left\vert b{\oplus }_{{2}^{m}}{B}_{s}(x)\right\rangle$ with 2^m ≥ n + 1.

 Output: The secret string s.

 Runtime: k − 1 queries to B_s. Succeeds with certainty.

 Procedure:

1 for i = 2 to k do

2  Construct ${B}_{s}^{({c}_{1},{c}_{i})}$ from B_s and the pair (c₁, c_i); //Lemma 3

3  Call FindTwoCharacterPosition with ${B}_{s}^{({c}_{1},{c}_{i})}$ as input to get ${M}^{({c}_{1},{c}_{i})}$; //Lemma 2

4 end

5 Set $M({c}_{1},* )={M}^{({c}_{1},{c}_{2})}\wedge {M}^{({c}_{1},{c}_{3})}$; // Here k ≥ 3 is required7D2

6 for j = 2 to k do

7  Set $M({c}_{j},* )=M({c}_{1},* )\oplus {M}^{({c}_{1},{c}_{j})}$; //Lemma 1

8 end

9 Ouput the secret string $s=\mathop{\sum }\limits_{i=1}^{k}{c}_{i}\cdot M({c}_{i},* )$.

Adaptive quantum algorithm with black-white-peg queries

Here we propose an adaptive quantum algorithm with $O(\lceil \frac{k}{n}\rceil +\sqrt{| {C}_{s}| })$ queries. For the secret s ∈ [k]ⁿ, let C_s = {s_i ∈ [k]: i ∈ {1, 2, …, n}}, that is, the set of characters occupied by s. Thus, the size of C_s is obviously not more than n and k. The idea of the adaptive quantum algorithm consists of two steps: (i) learn the character set C_s in $O(\lceil \frac{k}{n}\rceil )$ black-white-peg queries, and (ii) search s from C_s in $O(\sqrt{| {C}_{s}| })$ queries. In the following, we shows the details.

For an arbitrary ordered character set T = {t_i} ⊆ [k] with ∣T∣ ≤ n, a bit string ${x}^{(T,s)}={x}_{1}^{(T,s)}\ldots {x}_{| T| }^{(T,s)}$ associated with s is defined by

$${x}_{i}^{(T,s)}=\left\{\begin{array}{ll}1,\quad {t}_{i}\in {C}_{s},\\ 0,\quad {t}_{i}\notin {C}_{s},\end{array}\right.$$

(8)

which indicates whether the i-th character t_i in T is used in s or not. Then we have the following result.

Lemma 4

Given the secret s ∈ [k]ⁿ and an arbitrary character set T ⊆ [k] with ∣T∣≤n, there is a quantum algorithm that uses O(1) black-white-peg queries and returns x^{(T, s)} with certainty.

Proof

The idea is as follows: first convert the provided oracle into the inner product oracle, and then apply the Bernstein-Vazirani algorithm⁴⁹. Now we show the inner product x^{(T, s)} ⋅ y for y ∈ [2]^∣T∣ can be computed by using two black-white-peg queries.

First, we submit the string consisting of only 1 to the black-white-peg function BW_s and record the result as {b(s, 1), w(s, 1)}.

Second, given y = y₁y₂…y_∣T∣ ∈ [2]^∣T∣, we define a string z ∈ [k]ⁿ as follows:

$${z}_{i}=\left\{\begin{array}{ll}{t}_{i},\quad {y}_{i}=1\,\,1\le i\le | T| \\ 1,\quad{y}_{i}=0\,\,1\le i\le | T| \\ 1,\quad| T| +1\le i\le n.\end{array}\right.$$

Submit z to the black-white-peg function BW_s and record the result as {b(s, z), w(s, z)}. Then we have

$${x}^{(T,s)}\cdot y=\left\{\begin{array}{l}b(s,z)+w(s,z)-\min \left\{n-| y| ,b(s,1)\right\},\quad \\ \,{\text{if}}\,1\,\notin\, \{{t}_{i}| {y}_{i}=1,1\le i\le | T| \}\,{\text{or}}\,\,b(s,1)=0,\quad \\ b(s,z)+w(s,z)-\min \left\{n-| y| ,b(s,1)-1\right\},\quad \\ \,{\text{otherwise}}\,.\quad \end{array}\right.$$

As a result, x^{(T, s)} ⋅ y can be computed by using two black-white-peg queries. Thus, x^{(T, s)} can be learned with certainty using O(1) black-white-peg queries by the Bernstein-Vazirani algorithm⁴⁹. □

The character set [k] is divided into disjoint sets ${T}_{1},\ldots ,{T}_{\lceil \frac{k}{n}\rceil }$ such that ∣T_i∣ = n for $i < \lceil \frac{k}{n}\rceil$ and $| {T}_{\lceil \frac{k}{n}\rceil }| \le n$. By Lemma 4, we can learn each set using O(1) black-white-peg queries, and thus learn C_s with certainty using $O(\lceil \frac{k}{n}\rceil )$ queries.

Next we show how to search s from C_s, that is, to solve the Mastermind game with n positions and the character set C_s. We will use the fact that Grover’s algorithm can be adjusted to an exact version that finds the target state with certainty, if the proportion of the target states (whose value is $\frac{1}{m}$ in our setting) is known in advance.

In the following, we assume C_s = [m]. The algorithm is presented in Algorithm 3, of which the idea can be intuitively seen as simply applying n exact Grover searches synchronously on n positions, but smartly splitting the oracle and carefully handling the parameters of exact Grover search are required.

Algorithm 3

An adaptive quantum algorithm for Mastermind with n positions and the character set C_s.

Input: A black-peg oracle B_s for s ∈ [m]ⁿ such that ${B}_{s}| x\left.\right\rangle | b\left.\right\rangle =| x\left.\right\rangle | b{\oplus }_{n+1}{B}_{s}(x)\left.\right\rangle$

Output: The secret string s

Runtime: $O(\sqrt{m})$ queries to B_s. Succeeds with certainty.

Procedure:

1 Prepare the initial state $\left\vert {\Phi }_{0}\right\rangle ={\left\vert 0\right\rangle }^{\otimes n}\left\vert 0\right\rangle \in {({C}^{m})}^{\otimes n}\otimes {C}^{n+1}$; Set the number of iterations $T=\lceil \frac{\pi }{4\arcsin (\sqrt{\frac{1}{m}})}-\frac{1}{2}\rceil$ and the rotation angle $\phi =2\arcsin (\frac{sin(\frac{\pi }{4T+2})}{\sin (\theta )})$.

2 Apply the unitary transformation $QF{T}_{m}^{\otimes n}\otimes I$ to $\left\vert {\Phi }_{0}\right\rangle$.

3 for l = 1 to T do

4 Apply the unitary operator ${O}_{s}(\phi )={B}_{s}^{\dagger }(I\otimes D(\phi )){B}_{s}$, where $D(\phi )=\mathop{\sum }\nolimits_{j = 0}^{n}{e}^{ij\phi }| j\left.\right\rangle \left\langle \right.j|$.

5 Apply the unitary operator ${S}_{0}(\phi )={(QF{T}_{m}(I+({e}^{i\phi }-1)\left\vert 0\right\rangle \left\langle \right.0| )QF{T}_{m}^{\dagger })}^{\otimes n}\otimes I$.

6 end

7 Measure the first n registers in the computational basis.

At the first step, we prepare the initial state ${\Phi }_{0}={\left\vert 0\right\rangle }^{\otimes n}\left\vert 0\right\rangle \in {({C}^{m})}^{\otimes n}\otimes {C}^{n+1},$ where ${({C}^{m})}^{\otimes n}$ is associated with the query registers used to store the query string x and Cⁿ⁺¹ is associated with the auxiliary register used to store the query result B_s(x). In addition, we need to set some parameters for the exact Grover search. There are several approaches to achieve the exact Grover search^50,51,52,53. Here we use the approach proposed in⁵², whose parameters including the number of iterations T and the rotation angle ϕ are given as: $T=\lceil \frac{\pi }{4\arcsin (\sqrt{\frac{1}{m}})}-\frac{1}{2}\rceil ,\phi =2\arcsin (\frac{sin(\frac{\pi }{4T+2})}{\sin (\theta )})$ with $\theta =\arcsin (\sqrt{\frac{1}{m}})$. Note that in⁵², ϕ equals $2\arcsin (\frac{sin(\frac{\pi }{4J+6})}{\sin (\theta )})$ with the iteration number being J + 1. If we denote ${J}^{{\prime} }=J+1$, then $\phi =2\arcsin (\frac{sin(\frac{\pi }{4{J}^{{\prime} }+2})}{\sin (\theta )})$.

At the second step, apply the unitary transformation $QF{T}_{k}^{\otimes n}\otimes I$ to $\left\vert {\Phi }_{0}\right\rangle$ to create the uniform superposition state

$$| {\Phi }_{1}\left.\right\rangle =(QF{T}_{m}^{\otimes n}\otimes I)\left\vert {\Phi }_{0}\right\rangle =\frac{1}{\sqrt{{m}^{n}}}\sum _{x\in {[m]}^{n}}| x\left.\right\rangle | 0\left.\right\rangle =\mathop{\bigotimes }\limits_{i=1}^{n}\left(\frac{1}{\sqrt{m}}\mathop{\sum }\limits_{{x}_{i}=0}^{m-1}| {x}_{i}\left.\right\rangle \right)\otimes | 0\left.\right\rangle .$$

From the third to the sixth step, apply T Grover iteration operators ${\left({S}_{0}(\phi ){O}_{s}(\phi )\right)}^{T}$ to $| {\Phi }_{1}\left.\right\rangle$, where ${S}_{0}(\phi )={(QF{T}_{m}(I+({e}^{i\phi }-1)\left\vert 0\right\rangle \left\langle \right.0| )QF{T}_{m}^{\dagger })}^{\otimes n}\otimes I,{O}_{s}(\phi )={B}_{s}^{\dagger }(I\otimes D(\phi )){B}_{s},$ with $D(\phi )=\mathop{\sum }\nolimits_{j = 0}^{n}{e}^{ij\phi }| j\left.\right\rangle \left\langle \right.j|$.

Thus, after the sixth step we get

$$\begin{array}{ll}| {\Phi }_{2}\left.\right\rangle ={({S}_{0}(\phi ){O}_{s}(\phi ))}^{T}| {\Phi }_{1}\left.\right\rangle \\\qquad\; =\mathop{\bigotimes }\limits_{i=1}^{n}\left({\left({S}_{0}^{{\prime} }(\phi ){Q}_{{s}_{i}}(\phi )\right)}^{T}\frac{1}{\sqrt{m}}\mathop{\sum }\limits_{{x}_{i}=0}^{m-1}| {x}_{i}\left.\right\rangle \right)\otimes | 0\left.\right\rangle \end{array}$$

(9)

$$=\left\vert {s}_{1}{s}_{2}\cdots {s}_{n}\right\rangle | 0\left.\right\rangle ,$$

(10)

where ${S}_{0}^{{\prime} }(\phi )=QF{T}_{m}(I+({e}^{i\phi }-1)\left\vert 0\right\rangle \left\langle \right.0| )QF{T}_{m}^{\dagger }$ and ${Q}_{{s}_{j}}(\phi )$ is defined as ${Q}_{{s}_{j}}(\phi)\vert {x}_{j}\rangle ={e}^{i\phi {\delta }_{{s}_{j}{x}_{j}}}\vert {x}_{j}\rangle$ which is to decide whether x_j equals to s_j or not. We will explain in more detail later why Eq. (9) holds. Now assume that it is right. Then one sees that ${({S}_{0}^{{\prime} }(\phi ){Q}_{{s}_{i}}(\phi ))}^{T}\frac{1}{\sqrt{m}}\mathop{\sum }\nolimits_{{x}_{i} = 0}^{m-1}| {x}_{i}\rangle$ is actually the exact version of Grover’s algorithm for identifying an x_i such that x_i = s_i. Since the proportions of the target state in n synchronous Grover searches are all 1/m, the number of iterations and the rotation angle are the same for each Grover search. As a result, we get Eq. (10), and then the algorithm outputs the secret string s with certainty by measuring the first n registers.

The number of iterations of the operator O_s(ϕ) is $T=\lceil \frac{\pi }{4\arcsin (\sqrt{\frac{1}{k}})}-\frac{1}{2}\rceil =O(\sqrt{m})$, and thus the number of queries to B_s is $O(\sqrt{m})$.

Now we are going to explain Eq. (9), which means that the unitary operator ${({S}_{0}(\phi ){O}_{s}(\phi ))}^{T}$ plays a role as n synchronous Grover searches on n positions. First, S₀(ϕ) represents the general diffusion operator of Grover’s algorithm ${S}_{0}^{{\prime} }(\phi )=QF{T}_{m}(I+({e}^{i\phi }-1)\left\vert 0\right\rangle \left\langle \right.0| )QF{T}_{m}^{\dagger }$ applied on n m-dimensional spaces in parallel. Second, we have a look at the effect of ${O}_{s}(\phi )={B}_{s}^{\dagger }(I\otimes D(\phi )){B}_{s}$. Recall that the black-peg oracle B_s works as ${B}_{s}| x\left.\right\rangle | b\left.\right\rangle =| x\left.\right\rangle | b{\oplus }_{n+1}{B}_{s}(x)\left.\right\rangle$, where $| x\left.\right\rangle \in {({C}^{m})}^{\otimes n}$, $| b\left.\right\rangle \in {C}^{n+1}$. Then we have

Lemma 5

Let ${O}_{s}(\phi )={B}_{s}^{\dagger }(I\otimes D(\phi )){B}_{s}$. There is

$${O}_{s}(\phi )| x\left.\right\rangle | 0\left.\right\rangle =\mathop{\bigotimes }\limits_{j=1}^{n}{Q}_{{s}_{j}}(\phi )\vert {x}_{j}\rangle | 0\rangle$$

for s = s₁s₂ ⋯ x_n ∈ [m]ⁿ, x = x₁x₂ ⋯ x_n ∈ [m]ⁿ.

Proof

By direct calculation, we have

$$\begin{array}{llll}{O}_{s}(\phi )| x\left.\right\rangle | 0\left.\right\rangle ={B}_{s}^{\dagger }(I\otimes D(\phi )){B}_{s}| x\left.\right\rangle | 0\left.\right\rangle \\\qquad\qquad\qquad ={B}_{s}^{\dagger }(I\otimes D(\phi ))| x\left.\right\rangle | {B}_{s}(x)\left.\right\rangle \\\qquad\qquad\qquad ={e}^{i\phi {B}_{s}(x)}{B}_{s}^{\dagger }| x\left.\right\rangle | {B}_{s}(x)\left.\right\rangle \\\qquad\qquad\qquad ={e}^{i\phi {B}_{s}(x)}| x\left.\right\rangle | 0\left.\right\rangle .\end{array}$$

Note that ${B}_{s}(x)=\mathop{\sum }\limits_{j = 1}^{n}{\delta }_{{s}_{j}{x}_{j}}$. Thus we have

$${O}_{s}(\phi )| x\left.\right\rangle | 0\left.\right\rangle ={e}^{i\phi \mathop{\sum }\nolimits_{j = 1}^{n}{\delta }_{{s}_{j}{x}_{j}}}| {x}_{1}{x}_{2}\cdots {x}_{n}\left.\right\rangle | 0\left.\right\rangle$$

(11)

$$=\mathop{\bigotimes }\limits_{j=1}^{n}{e}^{i\phi {\delta }_{{s}_{j}{x}_{j}}}| {x}_{j}\left.\right\rangle | 0\left.\right\rangle$$

(12)

$$=\mathop{\bigotimes }\limits_{j=1}^{n}{Q}_{{s}_{j}}(\phi )\vert {x}_{j}\rangle | 0\left.\right\rangle .$$

(13)