{
  "video_id": "Dlsa9EBKDGI",
  "channel_slug": "3blue1brown",
  "channel_handle": "3blue1brown",
  "title": "Where my explanation of Grover’s algorithm failed",
  "duration_seconds": 983.0,
  "url": "https://www.youtube.com/watch?v=Dlsa9EBKDGI",
  "upload_date": "",
  "transcript": "Last week, I put up a video introducing\nquantum computing. And in the final\nsection, we were stepping through\nsomething known as Grover's algorithm.\nAnd based on the comments that I saw, I\nthink there was a very common point of\nconfusion that reveals I clearly could\nhave done a better job explaining a core\npiece of it. Right here, I wanted to\nthrow together a very quick supplement\nin the hopes of adding a bit of clarity.\nThe premise was to have a function which\nis somehow triggered by a unique value\nout of a big bag of options. And the\npuzzle is basically to figure out how do\nyou find that unique value just by\napplying the function on various inputs.\nNow in a classical setting, it's not a\nvery interesting question. The best you\ncan do is guess and check. But what we\nwalked through was a completely\ndifferent approach that you can take\nthat becomes possible in the setting of\na quantum computer. When we did this,\nthere was a certain key step where, if\nI'm understanding the comments\ncorrectly, it looked to a lot of people\nlike in order to apply this key step,\nyou would have to already know the value\nthat you're searching for, which would\nof course defeat the whole purpose of\nthe algorithm. More specifically, we had\nthis very highdimensional vector space\nand one of the axes in that space\ncorresponded to the value that we're\nsearching for. And this step of the\nalgorithm looked like flipping along\nthat axis, multiplying any component of\na vector in that direction by -1. Now,\nviewers were essentially asking, \"Whoa,\nwhoa, whoa. How could you know how to do\nthat without already knowing which axis\nyou're searching for?\" I genuinely tried\nto forestall that objection, but I think\nI failed. So, backing up, I think the\nwhole discussion might be clearer if we\nfocus on a very concrete example,\nsomething like solving a sedoku. On your\nnormal classical computer, it's not hard\nto write a function that checks whether\na proposed solution follows all of the\nSudoku rules and solves the puzzle. You\nknow, it would check the rows, the\ncolumns, squares for duplicates, things\nlike that. If you have written this\nfunction, just because you know how to\nverify a solution, it's not at all\nobvious what the solution is in the\nfirst place. This is after all why a\nsudoku is a puzzle. The rules alone\ndon't reveal the answer. There are other\nsituations where this is actually a much\nstronger assumption. The function SHA\n256, for example, is what's called a\ncryptographic hash function. That\nbasically means if you want to find what\ninput gives you a particular output, it\nis strongly believed that you really\ncan't gain much insight by looking at\nhow the function is implemented. If\nsomeone could reverse engineer it, they\nwould be mining all of the Bitcoin in\nthe world and breaking numerous other\ncryptographic schemes. But it's believed\nthat the best thing you can do when\nyou're searching for a particular output\nis guess and check. So it's not that the\nkey value is like hiding inside the\nfunction behind some curtain. It's more\nof a difficult to find emergent\nphenomenon of the function itself. Now,\nthe idea with Grover's algorithm is that\nif you have this sort of verifier\nfunction for some hard problem and you\ntranslate it into the language of\nquantum computing, there is a method for\nsifting out valid solutions which\nrequires fewer steps than simple\nguessing and checking over all the\npossibilities. Now, to be clear, it is\nnot dramatically faster. It's only a\nquadratic speed up. And given the\noverheads for making quantum computing\nwork, this frankly has questionable\nutility. In fact, let's talk a little\nbit more about that at the end. First to\nthe clarification, if you have this\nSudoku verifying function, it's not like\nyou can just run it on a quantum\ncomputer. After all, quantum computers\nspeak an entirely different language.\nIt's a totally different framework for\ncomputing that looks a lot more like\nvector manipulation. The first step to\nport over this verification function\ninto the new context is to imagine that\nwe've kind of compiled your verifier\ninto a bunch of logic gates, things like\nand, or, and not. So for any proposed\nSudoku solution, you would represent it\nall in binary. All of those bits would\nbe processed by your web of logic gates\nand the output would be a one if it's a\nvalid Sudoku solution and a zero for all\nthe invalid ones. And again, being able\nto assemble these logic gates does not\nrequire knowing ahead of time which\ninput solves the puzzle. The logic gates\ndistill the rules of the game, but not\nthe strategy. Now, I'm assuming everyone\nhas watched the main video, in\nparticular the core section about the\nfundamentals of the state vector, but as\na quick recap, the upshot is that you\nthink of every possible bit string as a\nunit vector along a coordinate axis in\nsome highdimensional space. In the\nlanguage of linear algebra, you would\ncall these the basis vectors of your\ncoordinate system. For example, with a\ntwo cubit quantum computer, you would\nhave four possible bit strings, and\nthese would all look like basis\ndirections in some four-dimensional\nspace. These state vectors get very big\nvery fast. If you have a k cubit quantum\ncomputer, that gives you 2 to the k\npossible bit strings, and you think of\neach one of them as being a coordinate\ndirection in some very highdimensional\nvector space. Now, operations on a\nquantum computer don't spit out true or\nfalse the way you can see on a classical\ncomputer. Instead, they take in a vector\nand they spit out a new vector, both of\nwhich live in the same space. And like I\nsaid last video, you often think about\nthem as somehow flipping or rotating the\nvectors in that space. Now, here's the\ncrux of the confusion. I mentioned how\nif you have this classical verifier\nfunction, something like a sudoku\nchecker that spits out a one or a zero,\nit is possible to translate it into an\noperation on a quantum computer that has\nthe following behavior. If a bit string\nreturns one for true up in the classical\ncase, then down in the quantum case, the\ncorresponding basis vector gets\nmultiplied by negative1, effectively\nflipping 180°. And then if in the\nclassical case, a bit string outputs\nzero for false, then in the quantum\ntranslation, the corresponding basis\nvector is unchanged. Now, I can see\nthree reasons that this step might have\ncaused some confusion. First of all, I\ndidn't explain how it actually works. I\ndidn't step through the translation.\nNow, my hope with that video was that\nit's just not too huge a leap to have\nyou accept that in principle there\nexists this correspondence between\nreturning true and false up in the\nclassical world and multiplying by\nnegative 1 or positive 1 down in the\nquantum world with vectors. Now, maybe\nthat is a leap. I could preview for you\nwhat that translation looks like. The\nrelevant search term here is quantum\ncompilation, but I'm going to be honest,\nI don't think it would add much clarity.\nIn the same way that knowing the logic\ngates that implement addition don't\nreally teach you much about how to add\ntwo numbers. Now, it's not exactly like\nthis, but loosely speaking, every time\nyou see an ANDgate, you translate it\ninto a quantum operation that looks kind\nof like an and. Every time you see a\nnotgate, there's a quantum analog that\ndoes something kind of like a knot. I\nsuspect the real cause of confusion\noriginates not from a lack of low-level\ndetail, but from how I had framed the\nentire setup. I opened that video by\nhaving you imagine that there was some\nmystery number that we're searching for.\nAnd as one commenter helpfully pointed\nout, this made it seem like the computer\nkind of knows the answer ahead of time.\nIt's just hiding it from us. And this is\nalmost certainly exacerbated by me\nbriefly flashing an example function\nthat just checks if the input is 12 and\nsaying that we were going to treat the\nfunction as a black box. That's on me.\nThat's a misleading way to open things.\nWhat I wanted to foreshadow is how with\nGrover's algorithm, the only way you use\nthe new quantum function is by trying it\nout on inputs as opposed to maybe like\nreverse engineering it. So in that\nsense, it's treated as a black box. But\nto be clear, in order to translate the\nclassical verifier into the quantum\nversion, you absolutely need to get into\nthe guts of the function. And if this is\ngoing to be a compelling example, it\nwould be very silly if the only thing\nthe function did was just check if the\ninput equals some hidden number. The\nSudoko example is much better and a\ncryptographic hash like Shaw 256 would\nbe much better still. In these contexts,\nthere is one value that will trigger the\nfunction and we don't know what it is.\nBut the computer also doesn't know what\nit is. It's not like the key value is\njust hiding in the source code. Whether\nwe're up here in the classical setting\nwhere triggering the function means\nreturning true or down in the quantum\nsetting where triggering the function\nmeans multiplying by negative one. Which\nspecific key input does this is a\ndifficult to find an emergent property\nof those logic gates. It's not something\nthat's baked in ahead of time. Now the\nother potential source of confusion I\nsuspect is that I didn't appropriately\nemphasize the idea of linearity. In\nfact, this is a central enough feature\nof quantum computing and quantum\nmechanics that half of my reason for\nmaking this whole follow-up video is as\nan excuse to talk about it. So, most\nvectors don't look like a pure basis\ndirection. They look like some weighted\nsum of all the different basis vectors.\nOne way that you can represent this is\nwith a column vector where we think of\neach component as being associated with\none of the possible bit strings. The\nmore common convention among physicists\nis to write general vectors as an\nexplicit weighted sum of all the basis\ndirections, each one represented with a\ncat. When the state vector for a\ncomputer looks like this, you say that\nit's in superp position, meaning it has\nsome nonzero component associated with\nmultiple distinct bitstrings. It's a lot\nlike saying if someone is walking\nnortheast, their velocity is a superp\nposition of north and east. They're\ntraveling both directions at the same\ntime. A core idea from the last video is\nthat you never actually see the\ncoordinates of a state vector in superp\nposition like this. When you read out\nfrom the computer, all you see is one of\nthe bitst strings at random. And the\nprobability of seeing it is equal to the\nsquare of the magnitude of the component\nof the state vector associated with that\nvalue. I'm saying magnitude here with\nthe absolute value signs because in\ngeneral these components can be complex\nnumbers. But for simplicity, I'm only\ngoing to be showing real values. When I\nsay that operations in quantum computers\nare linear, what I mean is that if you\npass in one of these weighted sums of\nthe different basis directions, that is\nto say a superp position, then the\noutput looks like the same weighted sum\nbut of the transformed versions of each\nvector. So here's a very small example.\nOn a single cubit, there's an operation\nthat we call a zgate. What it does is it\nleaves the zero direction unchanged, but\nit multiplies that vertical one\ndirection by -1. These are only two out\nof the infinitely many possible state\nvectors, but they're all you need to\nknow. If you pass in a superp position\nof those two, something that has a\nlittle bit of zero plus a little bit of\none, what you do is look at what the\nZgate does to each part separately and\nthen add those together again with the\nsame components. In this case, that\nmeans flipping the sign associated with\nthe one component. Geometrically, when\nyou draw this vector in a 2D space, the\naction of a Zgate looks like flipping\naround the X-axis. The Zgate is simple\nenough that just by looking at the\ndefinition, you can clearly see which\ndirection gets flipped. But keep in\nmind, for more complicated functions,\nthe definition alone might not so easily\nreveal how it behaves. Take a look back\nat the Sudoku verification function and\nits translation onto a quantum computer\nand then say that the state of your\ncomputer is not one of those clean basis\ndirections, but it is a combination of\nall the basis vectors, a superposition\nof every possible bit string in this\ncontext representing every possible\nsolution to the sudoku. to figure out\nwhat our verifier does to this new\nvector. What you do is look at what it\nwould do to each basis separately. And\nthen the output is going to be the same\nscaled sum of the result. In this case,\nmost parts of that sum stay unchanged.\nBut one of them, the one that's\nassociated with the key input that\nrepresents a Sudoku solution, that part\nis going to have its sign flipped. When\nyou do this, it's very tempting to look\nat it and say that the function is\nacting on every possible basis vector at\nonce in parallel. and then adding the\nresults. Now, that might be true, but I\ninvite you to reflect on whether that's\nnecessarily a fair way to summarize it.\nAs an analogy, if a hiker is walking\nnortheast and you tell him to rotate\n90°, that rotation is a linear\noperation. In other words, the final\ndirection is the same as what you would\nget by rotating the north vector 90°,\nrotating the east vector 90°, and adding\nthe two results. But that doesn't mean\nthat you have to perform two separate\nrotations in parallel in order to move\nthe hiker. The linearity is a property\nof the transformation. It's not\nnecessarily a set of instructions on how\nto do it. It's very similar over here.\nThe effect of the quantum translation\nfor our verifier looks like adding\ntogether what its effect would be on all\nof the basis vectors. But I will leave\nit to your interpretation whether this\nmeans that it is necessarily acting on\nall 2 to the k possible bit strings at\nonce. Here I've been writing the vector\nthe physicist way, but if I write it\nwith a column vector instead, what this\noperation looks like is taking one\ncomponent of that vector and multiplying\nit by negative 1, specifically whichever\ncomponent corresponds to the Sudoku\nsolution. So stepping back, hopefully\nthis helps clear up some of the\nconfusion there was in that last video.\nThe starting point of Grover's algorithm\nis to assume that you're given a\nfunction that flips one component of a\nvector like this, though you don't know\nwhich one. The puzzle is to somehow\nfigure out which direction is getting\nflipped, where all you're allowed to do\nis apply this function to some\nwell-chosen set of inputs. And in\nGrover's case, it involves interle it\nwith a certain other operation in the\ntoolkit of quantum computing. I get it.\nThat is a really weird place to start\nfrom. And it doesn't help that this is a\nfamously confusing topic. If you find it\nweird to work with a state vector whose\ncomponents you never actually observe\nand which instead acts like a kind of\nsquare root of a probability\ndistribution, you're not alone. Everyone\nfinds that very weird. At this point, I\ngenuinely can't tell if I'm\noverexlaining things or still\nunderexlaining them. But there is one\nfinal aspect of the explanation from\nlast time that may have added to this\nconfusion. When we visualized the\nalgorithm, we chose to view everything\non a certain two-dimensional slice of\nthe enormous n-dimensional vector space\nwhere all these state vectors live. And\nthis slice by definition included the\naxis associated with that mystery value\nwe're searching for. Now, in case that\nleft anyone with the impression that\npart of the algorithm was to choose that\nslice, let me be very clear. It's not.\nThe algorithm is just doing what it's\ngoing to do. It interleles two\noperations that go back and forth. It\ndoesn't have a care in the world how you\nand I choose to visualize it. The fact\nthat the state vector stays confined to\nthis particular plane, that's a happy\nemergent property of the algorithm. It\nis in no way part of the instruction set\nthat we're giving to the computer. One\nvery final thing that I do think\ndeserves some added reflection is how\nGrover's algorithm, while very\nthoughtprovoking, is maybe just not\nreally useful. Take the Sedoku example.\nThe number of possible solutions will\ndepend on how many of those 81 squares\nstart off blank. But let's call it\nsomething like 9 ^ 60. If you tried to\nuse your classical verifier function to\nfind a solution by brute force, there\nare way way too many possibilities to\ncheck. But even if you had a fully\nfunctioning quantum computer sitting on\nyour desk right now with ample cubits\nand no issues maintaining coherence and\nall that using Grover's algorithm, this\nwould still take around 9 to the 30\nsteps, which is a much smaller number,\nbut it's still enormous. Now, in this\ncase, there's obviously many smarter\nways to solve a sodoku than a brute\nforce search. But if you take something\nlike Shaw 256, inverting it by brute\nforce takes 2 to the 256 steps on a\nclassical computer. Using Grover's\nalgorithm, that becomes 2 to the 128, at\nleast up to that pi/4s constant that we\nsaw last video. So even in some sci-fi\nfuture where quantum computers are as\nfar along as today's classical\ncomputers, that is still an infeasibly\nlarge number of steps. The way some\npeople write about quantum computing, it\nmakes it sound like the moment they\narrive, everything is going to change\nand all of cryptography will break. And\nit's true that there are specific\nproblems that have exponential speedups,\nand especially with RSA, some of those\nare relevant to cryptography, but that's\nnot true in general. This quadratic\nspeedup is much more representative of\nwhat you get for most problems. It's\nreally cool, and the math is just\nbeautiful, and there continues to be\nlots of interesting research in the\nfield. But one of my hopes with this\nwhole project is that you now have\nenough background to maybe see through\nsome of the hyperbole that certain\noutlets are so fond of.\n[Music]",
  "transcript_chars": 17929,
  "ingested_at": "2026-05-15T04:53:07.370203+00:00",
  "source": "channel",
  "yt_meta": {
    "view_count": 642288,
    "like_count": 25693,
    "channel_id": "UCYO_jab_esuFRV4b17AJtAw",
    "categories": [
      "Education"
    ],
    "tags": [
      "Mathematics",
      "three blue one brown",
      "3 blue 1 brown",
      "3b1b",
      "3brown1blue",
      "3 brown 1 blue",
      "three brown one blue"
    ]
  }
}