register = [ thick, rectangle, draw=black, minimum height=.7cm, text centered ]

1 Fourier Transform over Finite Abelian Groups

Given a finite abelian group G with n elements, we want to study the Fourier transform over it. Usually, we are interested in the following two cases: (1) G = Z_{n}:= {0,1,...,n − 1}, the group of integers modulo n under addition; and (2) G = Z_{2}^{m} with m = log_{2}n, the group of m-bit strings under bitwise addition modulo two.

To define the Fourier transform, we consider the characters of G. A map χ_{j} : G → C is a character if it is a group homomorphism, i.e. χ_{j}(gg′) = χ_{j}(g)χ_{j}(g′) for any g,g′∈ G. There are exactly |G| characters, and they form a group under pointwise multiplication. This group is called the dual group of G, and is denoted as Ĝ. The Fourier transform maps |g⟩ to ∑_{j∈Ĝ} \frac{1}{\sqrt{|G|}}χ_{j}(g)|j⟩.

For example, when G = Z_{n}, and χ_{j}(1) = ω^{j}, then we have χ_{j}(k) = ω^{jk}, where ω = e^{2πi/n} is the n-th primitive root of unity. When written as a vector, |χ_{j}⟩ = (1,ω^{j},ω^{2j},...,ω^{(n−1)j} )^{⊤} , and the matrix of Fourier transform F is defined as F_{ij} = \frac{1}{\sqrt{|G|}}ω^{ij} (where i and j runs from zero to n − 1).

In general, when G ≅ Z_{N_{1}}× Z_{N_{2}}× ··· × Z_{N_{ℓ}}, with its elements identified as (g_{1},g_{2},...,g_{ℓ}) (g_{i} ∈ Z_{N_{i}}), G’s characters have the form χ_{k_{1},k_{2},...,k_{ℓ}}(g_{1},g_{2},...,g_{ℓ}) = ω_{N_{1}}^{k_{1}g_{1}}ω_{N_{2}}^{k_{2}g_{2}}··· ω_{N_{ℓ}}^{k_{ℓ}g_{ℓ}}, where ω_{N_{i}} = e^{2πi/N_{i}} is the N_{i}-th primitive root of unity. In this case, the Fourier transform maps |g_{1},g_{2},...,g_{ℓ}⟩ to \frac{1}{\sqrt{|G|}}∑_{k_{1},k_{2},...,k_{ℓ}}χ_{k_{1},k_{2},...,k_{ℓ}}(g_{1},g_{2},...,g_{ℓ})|k_{1},k_{2},...,k_{ℓ}⟩.

If we identify the n distinguishable states |0⟩,|1⟩,...,|n − 1⟩ in a quantum system with the group elements, we can express any state |ϕ⟩ as a superposition ∑_{g∈G} α_{g}|g⟩.

Fix any g′∈ G, and consider the action of multiplication by g′. It maps ∑_{g∈G} α_{g}|g⟩ to ∑_{g∈G} α_{g}|g′g⟩. If we express this linear transformation as a matrix A_{g′}, mapping |ϕ⟩ to A_{g′}|ϕ⟩, then A_{g′} is a permutation matrix (a zero-one matrix having exactly one 1 on each row and each column) in the basis of G. However, if we express the multiplication in the Fourier basis, we should get a diagonal matrix.

Claim For any g′∈ G, the multiplication by g′is diagonal in the Fourier basis. Proof Let A_{g′} be the multiplication by g′, and |χ_{j}⟩ = (1,ω^{j},ω^{2j},...,ω^{(n−1)j} )^{⊤} = ∑_{g∈G} χ_{j}(g)|g⟩ be a vector representing a character (up to a normalizing factor of \frac{1}{\sqrt{|G|}}).

A_{g′}|χ_{j}⟩ = A_{g′} ∑_{g∈G}χ_{j}(g)|g⟩ = ∑_{g∈G}χ_{j}(g)|g′g⟩ = ∑_{g∈G}χ_{j}(g^{′−1}g)|g⟩ = χ_{j}(g^{′−1}) ∑_{g∈G}χ_{j}(g)|g⟩ = χ_{j}(g^{′−1})|χ_{j}⟩,

so each |χ_{j}⟩ in Ĝis an eigenvector of A_{g′} with an eigenvalue of χ_{j}(g^{′−1}), i.e. A_{g′} diagonalizes in the basis of Ĝ.

2 Subgroups and Cosets

Every subgroup H of G corresponds to a subgroup H^{⊥} of Ĝ, given by H^{⊥} = {k ∈ Ĝ| χ_{k}(h) = 1 ∀h ∈ H}. If we define

|H⟩ := \frac{1}{\sqrt{|H|}}∑_{h∈H} |h⟩ to be the uniform superposition of states in H, its Fourier transform is |H^{⊥} ⟩ = \sqrt{\frac{|H|}{|G|}}∑_{k∈H^{⊥}} |k⟩,

which is the uniform superposition of states in H^{⊥} (note that |H^{⊥} | = \frac{|G|}{|H|}).

Moreover, if Hg is a coset of H, the uniform superposition of its states |Hg⟩ := \frac{1}{\sqrt{|H|}}∑_{h∈Hg} |h⟩ is mapped to

\sqrt{\frac{|H|}{|G|}}∑_{k∈H^{⊥}} χ_{k}(g)|k⟩ under Fourier transform.

Claim Fourier transform takes |H⟩ to |H^{⊥} ⟩ and |Hg⟩ to \sqrt{\frac{|H|}{|G|}}∑_{k∈H^{⊥}} χ_{k}(g)|k⟩.

Proof For the first case, consider k ∈ H^{⊥} , its amplitude = ∑_{h∈H} \frac{1}{\sqrt{|H|}} \frac{χ_{k}(h)}{\sqrt{|G|}} = \sqrt{\frac{|H|}{|G|}} (because χ_{k}(h) = 1 when k ∈ H^{⊥}

and h ∈ H).

For k ∉ H^{⊥} , there is a h′∈ H such that χ_{k}(h′) ≠ 1. Let β_{k}:= the amplitude of k = ∑_{h∈H} \frac{1}{\sqrt{|H|}} \frac{χ_{k}(h)}{\sqrt{|G|}} = ∑_{h∈H} \frac{1}{\sqrt{|H|}} \frac{χ_{k}(h′h)}{\sqrt{|G|}} =

χ_{k}(h′)∑_{h∈H} \frac{1}{\sqrt{|H|}} \frac{χ_{k}(h)}{\sqrt{|G|}} = χ_{k}(h′)β_{k}, so we get (1−χ_{k}(h′))β_{k} = 0 and deduce that β_{k} = 0. This completes the first case.

For the second case, we observe that the amplitude of k in |Hg⟩ is χ_{k}(g) multiplied by its amplitude in |H⟩. Indeed, its amplitude in |Hg⟩ = ∑_{h∈Hg} \frac{1}{\sqrt{|H|}} \frac{χ_{k}(h)}{\sqrt{|G|}} = ∑_{h∈H} \frac{1}{\sqrt{|H|}} \frac{χ_{k}(hg)}{\sqrt{|G|}} = χ_{k}(g)∑_{h∈H} \frac{1}{\sqrt{|H|}} \frac{χ_{k}(h)}{\sqrt{|G|}} = χ_{k}(g) multiplied by its am-

plitude in |H⟩. From this, we deduce that, for k ∈ H^{⊥} , its amplitude is χ_{k}(g)\sqrt{\frac{|H|}{|G|}}; and for k ∉ H^{⊥} , its amplitude is still 0.

3 Hidden Subgroup Problem

Given a finite abelian group G and a function f: G → S. Assume that there is a subgroup H of G, such that f is constant on cosets of H and distinct on different cosets, i.e. f(g) = f(g′) iff g = g′modH, we want to figure out the hidden H given oracle access to f. This is known as the hidden subgroup problem.

For example, the Simon’s algorithm is solving this problem with G = Z_{2}^{m}. There, the hidden subgroup H is generated by a single hidden non-zero string s (so H = {0,s}), and f(x) = f(y) iff x = y mods. In fact, the algorithm can be changed slightly to solve the general hidden subgroup problem, as follows.

Step 1 Set up a random coset state |Hg⟩: Since a coset is just a pre-image of some value of f, we can get a uniform superposition on a random coset as follows:

|0⟩|0⟩ \underrightarrow{Hadamard on 1st} \frac{1}{\sqrt{|G|}} ∑_{g∈G} |g⟩|0⟩ \underrightarrow{compute f} \frac{1}{\sqrt{|G|}} ∑_{g∈G} |g⟩|f(g)⟩

\underrightarrow{measure on 2nd} \frac{1}{\sqrt{|H|}} ∑_{g∈Hg′} |g⟩|f(g′)⟩ = |Hg′⟩|f(g′)⟩,

CS  294,  Spring  2009,  1

for some random coset Hg′, after ignoring (or, equivalently by the safe storage principle, measuring) the second component.

Step 2 Fourier sampling for a random element in H^{⊥} : By using the fact that all cosets of H map to the same vector H^{⊥} (up to varying phases but same amplitude),

|H⟩ \underrightarrow{Fourier transform} |H^{⊥} ⟩  |Hg⟩ \underrightarrow{Fourier transform} χ(g) · |H^{⊥} ⟩^{1},

a measurement on the Fourier transform of |Hg⟩ gives a random element in H^{⊥} . Each element in H^{⊥} enforces a constraint that (elements of) H has to satisfy, and we can then recover H with high probability given enough random samples of H^{⊥} .

4 Factoring

To factorize an integer N, we find the order of a random element by solving a hidden subgroup problem.

First, we need some definitions. Let Z_{N}^{∗} := {0 < a < N | gcd(a,N) = 1} denotes the set of integers co-prime to N, which forms a group under multiplication modulo N. Let ϕ(N) := |Z_{N}^{∗}| be the Euler ϕ function. Recall that if N = p_{1}^{e_{1}}p_{2}^{e_{2}} ··· p_{k}^{e_{k}}, then we know ϕ(N) = (p_{1}− 1)p_{1}^{e_{1}−1} (p_{2}− 1)p_{2}^{e_{2}−1} ··· (p_{k}− 1)p_{k}^{e_{k}−1} .

We want to pick a random element x modN and compute its order given by ord_{N}(x) := min_{r>0} x^{r} ≡ 1 modN. In fact, the order of an element x is defined (or finite) iff gcd(x,N) = 1. However, if gcd(x,N) ≠ 1, we already get a non-trivial factor of N. Let’s assume that gcd(x,N) = 1, and let r:= ord_{N}(x). Clearly r divides ϕ(N) (by the Lagrange theorem).

Let M = ϕ(N) (or a multiple of ϕ(N)). We consider the function f: Z_{M} → Z_{N} given by f(a) = x^{a} modN. If we denote ⟨r⟩:= the subgroup generated by r in Z_{M} (using the fact that r divides ϕ(N)), then f is constant on cosets and is distinct on different cosets of ⟨r⟩. Indeed, f(a) = f(a′) iff x^{a} = x^{a′} modN iff x^{a−a′} = 1 modN iff a = a′modr.

The quantum algorithm gives us the value of r as a non-trivial factor of ϕ(N) (with high probability), which can be used to factorize N. More precisely, the Fourier sampling step gives us a random element of ⟨r⟩^{⊥} ≅ ⟨\frac{M}{r}⟩, i.e. we get an element \frac{sM}{r} for a random s ∈ \{0,1,...,r −1\}. With enough samples of the form \frac{sM}{r} (for different s), we know their gcd= \frac{M}{r}.

The above works if M is a multiple of ϕ(N). But the value of ϕ(N) is not known (or we could have factorized N directly with it). Therefore, we run the algorithm with a large enough M ≫ N instead, which works because the error between the Fourier transform over Z_{M} and that over Za large multiple of ϕ(N) is small.

5 Discrete Logarithm

In this section, we consider another hardness assumption used in cryptography (e.g. Diffie-Helman cryptosystem), namely the problem of discrete logarithm.

Let p be a prime, then Z_{p} forms a group under addition modulo p. Its non-zero elements Z_{p}^{∗} forms a group under multiplication modulo p, which in fact is cyclic, i.e. there is an element g that generates Z_{p}^{∗} = {g^{0},g^{1},...,g^{p−2} }. The question of discrete logarithm is, given x, p and g, to compute an exponent r such that g^{r} modp ≡ x.

Let G:= Z_{p−1} ×Z_{p−1} , and we define f(a,b) := g^{a}x^{−b} modp. Note that f(a,b) = 1 iff a−br = 0 modp−1. Hence, if we let H := the subgroup generated by (r,1), then f is constant on cosets and distinct on different cosets of H. By the quantum algorithm, we get a random sample (c,d) ∈ H^{⊥} , satisfying cr + d = 0 mod p− 1. With non-negligible probability, such a random sample satisfies an additional relation that gcd(c,p − 1) = 1, which allows us to compute r = dc^{−1} modp−1. We can amplify the success probability by repeating the whole algorithm, and checking for those r satisfying g^{r} = x modp.

1Here, we use the notation χ(g) · |H^{⊥} ⟩ to mean the pointwise multiplication of the two vectors. That is, for k ∈ Ĝ, its amplitude in χ(g) · |H^{⊥} ⟩ is χ_{k}(g)\sqrt{\frac{|H|}{|G|}} if k ∈ H^{⊥} , and is 0 otherwise.

CS  294,  Spring  2009,  2

6 Quantum Error Correction

From time to time, the qubits in quantum registers get corrupted with certain probability. Therefore, we need a method to correct errors in quantum registers for fault tolerant quantum computation. In order to study quantum error correction, we first need to understand what quantum errors are possible.

The first kind of errors are bit flips, analogous to the classical bit flips. For example, a state α|0000⟩ + β|1111⟩ may be corrupted to α|0010⟩ + β|1101⟩ if the third bit is flipped. We model a bit flip as an application of a NOT gate to a

certain qubit, represented by the matrix X := [ \begin{matrix}01 \\ 10 \end{matrix}].

[scale=1, auto] (data) [register, text width = 3cm] at (0, 0) Original Data; (codeword) [register, text width = 9cm] at (9, 0) Codeword; (corrupted) [register, text width = 9cm] at (9, -1.4) Corrupted Codeword; (recovered) [register, text

width = 3cm] at (0, -1.4) Recovered Data; [-¿, thick] (data.east) to node Encode (codeword.west); [-¿, thick] (codeword.south) to node Bit Flips (corrupted.north); [-¿, thick] (corrupted.west) to node [swap] Reconstruct (recovered.east);

data.northwest)+0,.2) coordinate (data north west); data.northeast)+0,.2) coordinate (data north east); codeword.northwest)+0,.2) coordinate (codeword north west); codeword.northeast)+0,.2) coordinate (codeword north east); [¡-¿] (data north west) to node n (data north east); [¡-¿] (codeword north west) to node 3n

(codeword north east);

Figure 1: Flow Diagram of the Imagined Error Correction for Bit Flips

If we take the quantum analogue of classical error correction, we may want to introduce redundancy into the data by repeating qubits, so that when a small fraction of qubits in the codeword is corrupted, hopefully we can reconstruct the original data. For example, we may naïvely want to stretch a data of n qubits into a codeword of 3n qubits by repeating each qubit three times. However, there is no transformation for turning |ϕ⟩ into |ϕ⟩|ϕ⟩|ϕ⟩ for a general state ϕ in superposition, by the no-cloning theorem. So we cannot directly translate the classical error correction techniques for quantum error correction, even for the analogous error of bit flips.

The second kind of errors are unwanted interaction with the environment, which is modeled as bit measurements by the environment on certain qubits. For example, a state \frac{1}{\sqrt{2}} |0000⟩ + \frac{1}{\sqrt{2}} |1111⟩ may turn into |0000⟩ or |1111⟩ with equal probability, if the environment measures it on any single qubit.

7 Noise Model

Let us be more specific about what quantum error correction means.

Assume that we have some qubits |ϕ⟩ in a quantum register. To guard against quantum errors, we append a number of qubits initialized to the all-zero state |0⟩, and transform (encode) the resultant qubits with a unitary operator U into a state suitable for correction. After the codeword is corrupted, we append a number of fresh all-zero qubits, and apply an error correction circuit to extract and throw away the error, recovering the encoded codeword U (|ϕ⟩|0⟩). The original qubits |ϕ⟩ can be reconstructed with an application of U^{−1} .

We are going to model a general quantum error (e.g. bit flips and bit measurements) as a unitary operation U′performed by the environment, with part of the output thrown away.

Under this model, the corrupted state |Corrupted⟩ is a linear (and in general non-unitary) transformation of the original state |Original⟩. For a system with a single qubit (modeled by the Hilbert space C^{2}), all linear transformations are spanned by the four matrices: identity I, bit flip X, phase flip Z, and bit-and-phase flip Y = XZ.

Identity I = [ \begin{matrix}1 & 0 \\ 0 & 1 \end{matrix}]  Bit Flip X= [ \begin{matrix}0 & 1 \\ 1 & 0 \end{matrix}]
Phase Flip Z = [ \begin{matrix}1 & 0 \\ 0 & −1 \end{matrix} ]  Bit-and-Phase Flip Y= [ \begin{matrix}0 & 1 \\ −1 & 0 \end{matrix}]

[scale=1, auto] (data) [register, text width = 2cm] at (0, 0) |ϕ⟩; (data zero) [register, text width = 2cm] at (2.25, 0) |0⟩; (codeword) [register, text width = 4cm] at (8, 0) U (|ϕ⟩|0⟩); (corrupted) [register, text width = 4cm] at (8, -1.5)

|Corrutped⟩; (corrupted zero) [register, text width = 3cm] at (11.75, -1.5) |0⟩; (correction) [register, text width = 7cm] at (9.65, -2.5) Error Correction; (recovered) [register, text width = 4cm] at (8, -3.5) U (|ϕ⟩|0⟩); (recovered error) [register, text width = 3cm] at (11.75, -3.5) |Error⟩; (reconstructed) [register, text width = 2cm] at (0, -3.5)

|ϕ⟩; (reconstructed zero) [register, text width = 2cm] at (2.25, -3.5) |0⟩;

corrupted.south)+-1.5 , 0) coordinate (corrupted south); correction.north)+-3.15, 0) coordinate

(correction north); xin 0, 10, ..., 180 corruptedsouth)+xpt, 0 cm) coordinate (corrupted south x) ; correctionnorth)+xpt, 0 cm) coordinate (correction north x) ; (corrupted south x) – (correction north x); correction.south)+-3.15, 0) coordinate (correction south); recovered.north)+-1.5 , 0) coordinate

(recovered north); xin 0, 10, ..., 180 correctionsouth)+xpt, 0 cm) coordinate (correction south x); recoverednorth)+xpt, 0 cm) coordinate (recovered north x); (correction south x) – (recovered north x); [-¿, thick] (data zero.east) to node U (codeword.west); [-¿, thick] (codeword.south) to node Corruption (corrupted.north); [-¿, thick] (recovered.west) to node [swap] U^{−1} (reconstructed zero.east);

Figure 2: Quantum Error Correction

[scale=1, auto] (data) [register, text width = 3cm] at (0, 0) |Original⟩; (environment) [register, text width = 3cm] at (3.25, 0) |Environment⟩; (corruption) [register, text width = 6.25cm] at (1.625, -1) U′; (corrupted) [register, text

width = 3cm] at (0, -2) |Corrupted⟩;

data.south)+-1.25,0) coordinate (data south); corruption.north)+-2.875,0) coordinate (corruption north west); xin 0, 10, ..., 70 datasouth)+xpt, 0 pt) coordinate (data south x); corruptionnorthwest)+xpt, 0 pt)

coordinate (corruption north west x); (data south x) – (corruption north west x);

corruption.south)+-2.875,0) coordinate (corruption south); corrupted.north)+-1.25,0) coordinate

(corrupted north); xin 0, 10, ..., 70 corruptionsouth)+xpt, 0 pt) coordinate (corruption south x); corruptednorth)+xpt, 0 pt) coordinate (corrupted north x); (corruption south x) – (corrupted north x);

environment.south)+1.25, 0) coordinate (environment south); corruption.north)+2.875, 0) coordinate

(corruption north east); xin 0, 10, ..., 70 environmentsouth)+-xpt, 0 pt) coordinate (data south x); corruptionnortheast)+-xpt, 0 pt) coordinate (corruption north east x); (data south x) – (corruption north east

x);

corruption.south)+2.875, 0) coordinate (corruption south east); xin 0, 10, ..., 70 (corruption south east) + (-xpt, 0 pt) – ++ (-xpt, -.8cm);

Figure 3: Noise Model for a General Quantum Error

And for a system with n qubits, all linear transformations are spanned by all n-fold tensor products of the above four matrices. Therefore, to correct a general quantum error, it is enough to be able to correct bit flips and phase flips.

8 Classical Error Correction Codes

We review the elementary theory of (binary) classical error correcting codes. An error correcting code C is a collection of codewords in F_{2}^{n} (i.e. C ⊆ F_{2}^{n}), where F_{2} is the finite field with two elements. We will only be interested in linear codes, where C is in fact a linear subspace of F_{2}^{n}, regarded as an n dimensional vector space over F_{2}. If we denote k:= dimC to be the dimension of C as a linear space, we think of the encoding as stretching a length k message into a length n codeword (i.e. a linear map from F_{2}^{k} to F_{2}^{n}).

The distance of a code d := min_{c_{1}≠c_{2}∈C} Hamming-distance(c_{1},c_{2}) is the minimum hamming distance (i.e. number of unequal symbols) between two distinct codewords in C. For linear codes, the distance d = min_{c≠0∈C} Hamming-weight(c) is given by the minimum hamming weight (i.e. number of ones) of a non-zero codeword. As can be easily seen, an error correcting code can detect up to d − 1 errors, and can correct up to ⌊\frac{d−1}{2} ⌋ errors.

We can associate with a linear code a k by n matrix G, known as the generator matrix. The encoding of a length k message m ∈ F_{2}^{k} is given by the length n codeword c ∈ F_{2}^{n}, where mG = c. Similarly, we can associate with a linear code an n by k matrix P, known as the parity check matrix. The columns of P generates C^{⊥} , so a word c ∈ F_{2}^{n} is a valid codeword (i.e. c ∈ C) iff cP = 0. Assume that a valid codeword c ∈ C is corrupted by some error e ∈ F_{2}^{n}, forming a word c + e. We can use the parity check matrix to detect errors, simply by computing (c + e)P. By properties of P, we know that (c + e)P = cP + eP = eP, which is known as the syndrome. We can detect errors by checking if eP = 0 (provided that the hamming weight of e is at most d − 1), and can correct errors by deducing a unique e from eP (provided that the hamming weight of e is at most ⌊\frac{d−1}{2} ⌋).

9 CSS code

We describe a quantum error correcting code due to Calderbank, Shor and Stein.

Our starting point is two linear error correcting codes C_{1} and C_{2}, where C_{1} ⊆ C_{2} ⊆ F_{2}^{m} with |C_{1}| = 2^{k_{1}} and |C_{2}| = 2^{k_{2}}. We require that the second code C_{2} and the dual code of the first code C_{1}^{⊥} be good error correcting codes, each correcting up to t errors.

In our quantum error correcting code, the codewords are cosets of C_{1} in C_{2}, having the form

|C_{1}+ x⟩ = \frac{1}{\sqrt{|C_{1}|}} ∑_{y∈C_{1}} |y + x⟩,

for some x ∈ C_{2}. Hence, the quantum error correcting code has 2^{k_{2}−k_{1}} codewords. CSS code encodes k_{2} − k_{1} qubits into m qubits and can correct up to t qubit errors. The theory of classical error correcting codes shows that we can find codes C_{1} and C_{2} with reasonable value of t, given parameters k_{2}− k_{1} and m.

Recall that it is enough to be able to correct all bit flips and all phase flips. Assume that a codeword |C_{1} + x⟩ is first corrupted by a phase flip error e_{p} and then a bit flip error e_{b}, giving the corrupted state

\frac{1}{\sqrt{|C_{1}|}} ∑_{y∈C_{1}}(−1)^{(y+x)·e_{p}}|y + x + e_{b}⟩ = ∑_{y∈C_{1}}β_{y}|y + x + e_{b}⟩.

Our quantum error correcting algorithm has two stages, one for bit flips and one for phase flips.

In the first stage we correct up to t bit flips. Essentially, we apply the parity check matrix P_{C_{2}} for code C_{2} to compute the syndrome, allowing us to undo the bit flips.

∑_{y∈C_{1}}β_{y}|y + x + e_{b}⟩|0⟩ \underrightarrow{apply P_{C_{2}}} ∑_{y∈C_{1}}β_{y}|y + x + e_{b}⟩|e_{b}P_{C_{2}}⟩ \underrightarrow{compute and undo e_{b}} ∑_{y∈C_{1}}β_{y}|y + x⟩|e_{b}P_{C_{2}}⟩.

We discard (or measure) the second register to obtain the state ∑_{y∈C_{1}}β_{y}|y+x⟩, which is only corrupted by phase flips.

In the second stage we correct up to t phase flips. Essentially, we convert phase flips into bit flips and repeat the first stage to correct the errors. Recall that |C_{1}+x⟩ is mapped to χ(x)·|C_{1}^{⊥} ⟩ under Fourier transform, meaning that Fourier transform turns bit flips into phase flips, and vice versa. Indeed,

∑_{y∈C_{1}}β_{y}|y + x⟩ = \frac{1}{\sqrt{|C_{1}|}} ∑_{y∈C_{1}}(−1)^{(y+x)·e_{p}}|y + x⟩ \underrightarrow{Fourier transform} \frac{1}{\sqrt{|C_{1}^{⊥} |}} ∑_{k∈C_{1}^{⊥}}(−1)^{x·k}|k + e_{p}⟩ = ∑_{k∈C_{1}^{⊥}} α_{k}|k + e_{p}⟩.

We repeat the first stage, using the parity check matrix P_{C_{1}^{⊥}} of the code C_{1}^{⊥} instead.

∑_{k∈C_{1}^{⊥}} α_{k}|k + e_{p}⟩|0⟩ \underrightarrow{apply P_{C_{1}^{⊥}}} ∑_{k∈C_{1}^{⊥}} α_{k}|k + e_{p}⟩|e_{p}P_{C_{1}^{⊥}}⟩ \underrightarrow{compute and undo e_{p}} ∑_{k∈C_{1}^{⊥}} α_{k}|k⟩|e_{p}P_{C_{1}^{⊥}}⟩.

After discarding (or measuring) the second register to get ∑_{k∈C_{1}^{⊥}} α_{k}|k⟩, we recover the codeword with a Fourier transform.

∑_{k∈C_{1}^{⊥}} α_{k}|k⟩ = \frac{1}{\sqrt{|C_{1}^{⊥} |}} ∑_{k∈C_{1}^{⊥}}(−1)^{x·k}|k⟩ \underrightarrow{Fourier transform} \frac{1}{\sqrt{|C_{1}|}} ∑_{y∈C_{1}} |y + x⟩ = |C_{1}+ x⟩.