Fast pseudorandom quantum state generators via inflationary quantum gates

We propose a mechanism for reaching pseudorandom quantum states, computationally indistinguishable from Haar random, with shallow log-n depth quantum circuits, where n is the number of qudits. We argue that $\log n$ depth 2-qubit-gate-based generic random quantum circuits that are claimed to provide a lower bound on the speed of information scrambling, cannot produce computationally pseudorandom quantum states. This conclusion is connected with the presence of polynomial (in $n$) tails in the stay probability of short Pauli strings that survive evolution through such shallow circuits. We show, however, that stay-probability-tails can be eliminated and pseudorandom quantum states can be accomplished with shallow $\log n$ depth circuits built from a special universal family of `inflationary' quantum (IQ) gates. We prove that IQ-gates cannot be implemented with 2-qubit gates, but can be realized either as a subset of 2-qudit-gates in $U(d^2)$ with $d\ge 3$ and $d$ prime, or as special 3-qubit gates.


INTRODUCTION
The focus of this paper is on addressing the following question: what is the lowest-depth quantum circuit that can generate computationally pseudorandom quantum states, i.e., quantum states that cannot be distinguished from Haar random by an adversary limited to polynomial resources?For us this question was motivated by two conjectures concerning scrambling by quantum circuit models of black hole dynamics that have emerged in the context of decadesold efforts of reconciling general relativity with quantum mechanics.The first, due to Susskind and collaborators, is that black holes are the fastest scramblers in nature with a scrambling time τ sc ∼ log n, where n is the number of degrees of freedom of the system [1], a conjecture supported by holography-based calculations [2][3][4].The second conjecture is that black holes must be also thorough scramblers of information [5][6][7].In a nutshell, the idea is that black holes are also efficient generators of (computational) pseudorandomness: that they scramble information efficiently (i.e., in polynomial time) but that unscrambling (decoding) that information requires superpolynomial (in n) effort.While convincing arguments have been advanced for each of these conjectures, the question of whether one can achieve both 'speed' and 'thoroughness' at the same time -namely whether a quantum circuit of log n depth (corresponding to a 'computational time' scaling as log n) can create pseudorandom states indistinguishable from Haar random for an adversary with polynomial resources -has, to our knowledge, not been discussed explicitly in the black hole literature.
Irrespective of whether or not satisfying both 'speed' and 'thoroughness' conditions is critical to understanding the quantum mechanics of black holes, the question of the level of scrambling by log n-depth circuits is conceptually and practically important to a number of areas of quantum information.In particular, the issue has been discussed in the context of t-designs.In their comprehensive studies, Harrow and Mehraban [8] conjectured that complete-graphstructured log n-depth random circuits display the property of anti-concentration, namely that the probability that two different realizations of the circuit lead to identical outcomes is exponentially small in n, and at most a constant multiple of the value obtained by averaging over the Haar measure.They also conjectured that log n-depth long-range circuits are sufficient for reaching 2-designs.While the anti-concentration conjecture was recently proved for a few circuit connectivities, anti-concentration is not sufficient for proving 2-design [9,10].In particular, we show below that log n-depth long-range 2-qubit circuits lead to polynomial (rather than superpolynomial) decay of a 4-point out-oftime-order correlator, and therefore these shallow circuits cannot produce 2-designs.We note that being a 2-design is a stronger (statistical) condition than computational indistinguishability based on measurements of 2-time/4-operator correlations.The notion of t-design refers to 'statistical indistinguishability' from Haar-random, which is determined using the distance between probability distributions or the difference between the correlations they produce.By contrast, the discussions of pseudorandomness and all arguments of this paper are limited to 'computational indistinguishability', a more physical notion referring to adversaries who are limited to a polynomial number of measurements.
FIG. 1. Evolution of weight-1 Pauli strings: an effective 2-qubit reversible gate obtained by averaging uniformly over 2qubit gates in U (4) leads to equal transition amplitudes among the 15 (=4 2 − 1) non-trivial weight-1 and weight-2 string states, including a finite stay probability, pw=1 < 1, for weight-1 strings (i.e., a finite amplitude for the transition from a weight-1 to another weight-1 string state).Applying log n layers of 2-qubit gates leads to a polynomial tail (pw=1) log n = n −log(1/p w=1 ) in the stay probability of weight-1 strings that, in turn, translates into polynomial tails in OTOCs.Exponential decay of OTOCs in log n depth quantum circuits requires the use of special 'inflationary' gates that map all weight-1 strings into weight-2 strings, thus eliminating the stay probability for weight-1 strings, as depicted schematically in the inset.
Building computational pseudoramdom Boolean functions with log n-depth (NC 1 ) circuits, a closely related classical version of the question we ask of quantum circuits, has been addressed by the cryptography community [11][12][13].These classical constructions, however, involve pre-processing and non-trivial storage considerations that are not obviously amenable to low-depth quantum implementations.
Our own interest in information scrambling and the issues raised in this paper stem from our work on n-input/noutput reversible-circuit-based classical block ciphers and, in particular, on the question of what is the fastest, lowestdepth block cipher that is secure to attacks by polynomially-limited adversaries.In Ref. [14] we proposed a cipher design that is capable of scrambling information with only O(log n) layers of gates, on a par with the conjectured fastest scrambling time by black holes, but, we argued, to cryptographic level: the special log n-depth cipher produces a permutation which is computationally indistinguishable from pseudorandom to an adversary with polynomial resources.
[We stress that the O(log n)-depth cipher design in Ref. [14] meets necessary conditions for indistinguishability from a pseudorandom permutation.These conditions are based on quantitative measures of chaos and irreversibility in quantum systems (such as out-of-time-order correlators and string entropies).We do not establish sufficiency of these measures as this would be equivalent to proving that P̸ = NP.]It is also worth noting that these ciphers are NC 1 reversible circuits, implemented without the need for preprocessing or additional storage [11][12][13].
At first sight, classical ciphers seem only distantly related to the problem of information scrambling by quantum circuits.However, our progress in designing fast classical ciphers was based on a mapping of reversible classical computations into the space of Pauli strings.Within the framework of strings, the notions of irreversibility and chaos and their quantitative measure in terms of string entropies and out-of-time-order correlators (OTOCs) used in studies of quantum scrambling translate naturally to the problem of scrambling by reversible classical circuits.It is the string space picture that allows us to use the intuition gained from the study of one problem to the study of the other.
In particular, in the context of random reversible classical circuits, the repeated forward and backward propagation that defines OTOCs involving a polynomial number of string operators naturally describes arbitrary polynomial measurements carried out by an adversary on inputs and/or outputs of the circuits.Security to such attacksreferred to as differential attacks in cryptoanalysis -requires that all OTOCs describing correlations between results of such alternating measurements vanish faster than any polynomial (and ideally exponentially) in the number of bits acted on by the circuit.However, as discussed in Ref. [14] for unstructured classical random circuits of universal reversible gates and as explained in the body of the paper for 2-qubit-gate-based random quantum circuits, the typical OTOC vanishes exponentially with 'computational time' -the number of layers of gates applied.(The same exponential decay of the OTOC with time is the generic behavior expected for scrambling of information and the approach to chaos in quantum systems described by unitary Hamiltonian evolution [4].)As a result, generic circuits of log n depth lead to polynomial decays of the OTOCs, and thus are not secure to polynomial attacks (in the classical case) and do not generate computationally pseudorandom quantum states (in the quantum case).
The first message of this paper is that generic random quantum circuits of 2-qubit gates like those used as simple models of black hole dynamics cannot produce computationally pseudorandom quantum states while at the same time saturating the log n lower bound on the scrambling time purported to qualify black holes as the fastest scramblers in nature.The root of the problem is the presence of polynomial tails of the stay-probabilities for low-weight Pauli strings, illustrated schematically in Fig. 1.In turn, for generic log n-depth random circuits, these tails translate into a polynomial decay of OTOCs with n.Using the intuition gained from the study of shallow classical ciphers in Ref. [14], we argue that ensuring a superpolynomial decay of OTOCs in log n-depth quantum circuits requires employing special 'inflationary gates' that eliminate the stay-probability of weight-1 strings and accelerate the spreading of string operators (see the inset of Fig. 1).
Our second message is that, while inflationary gates do not exist as 2-qubit gates in U (4), they can be realized as 2-qudit gates with local Hilbert space dimension d ≥ 3 and d prime, or as 3-qubit gates.Circuits built from these gate sets would implement cryptographic level scrambling at the log n 'speed limit,' performance one might like to ascribe to a supreme 'superscrambling' black hole.
Finally, we note that, while saturating the log n scrambling time lower bound may not be critical for resolving black hole paradoxes, reaching computationally pseudorandom permutations at the log n 'speed limit' for scrambling was crucial in our own work on classical ciphers.As discussed in a recent paper [15], ciphers of log n-depth enable Encrypted Operator Computing (EOC), a gate-based polynomial complexity approach to secure computation on encrypted data that offers an alternative to Fully Homomorphic Encryption.For larger-depth circuits (and even for circuits of log 2 n depth), the implementation of the EOC scheme would become superpolynomial in n and thus computationally intractable.

Our contributions
The principal conclusions of this paper are that: • Due to polynomial tails in the stay-probability for weight-1 Pauli strings, 2-qubit-gate-based random quantum circuits of depth O(log n) cannot produce pseudorandom states.
• Reaching pseudorandom quantum states with O(log n)-depth circuits becomes possible if one employs circuits comprised of special universal 3-qubit gates or 2-qudit gates with local Hilbert space dimension d ≥ 3 and d prime.These gates, which we refer to as 'inflationary quantum gates', or IQ gates, both expand and proliferate Pauli strings.
These conclusions are built on the intuition gained from our work in Ref. [14] on classical ciphers based on reversible circuits of log n depth, which we translate to the problem of information scrambling by quantum circuits.The polynomial tails in the probability distribution of weight-1 strings also occur in random reversible classical circuits and it is the elimination of these tails that required the structured design of our log n-depth classical cipher.This design involves a permutation P expressed as a 3-stage circuit P = Lr N Ll , with each stage represented by tree-structured reversible classical circuits built out of 3-bit permutations (gates), which enable universal classical computing.(The wiring of tree-structured circuits is described in the 'Tree-structured circuits' discussion in the Methods section.) The bookends Ll,r are comprised of log 2 n layers of special (classical) linear inflationary gates, that flip at least two output bits upon flipping a single input.The implementation of inflationary gates in string space eliminates the stay probability of weight-1 strings and accelerates the spreading of their effect across the n bitlines of the circuit.These inflationary stages flank a reversible circuit N , comprised of log 3 n layers of (classical) nonlinear gates that maximize production of (Pauli)-string entropy.As argued in Ref. [14], the 3-stage circuit realizes a log n-depth cipher that satisfies the necessary (and we conjecture sufficient) conditions for pseudorandomness.[We note that the tree structure mimics a system of infinite dimension and, when combined with the inflationary property of the gates, ensures that the weight of the strings grows exponentially with the depth or number of layers of gates.]The interplay between inflation and proliferation of strings leads to a double exponential decay of OTOCs as a function of the computational time, i.e., the number of layers of gates.For our shallow log n-depth cipher this double exponential behavior, which implies an infinite Lyapunov exponent, translates into an exponential decay of OTOCs with n.We note that, in classical circuits, inflation and proliferation of strings are implemented by different families of gates and thus, as described above, fast and thorough scrambling requires a structured 3-stage cipher.In this paper we exploit the interplay of inflation and proliferation of strings in the context of quantum circuits.Unlike the case of classical circuits, in the quantum case one can build IQ gates that incorporate both string inflation and string proliferation.As a result, fast and thorough quantum scrambling can be realized with unstructured single-stage random quantum circuits comprised of IQ gates.
Generating pseudorandom quantum states with log n-depth circuits In this section we first argue that log n-depth random quantum circuits built by sampling uniformly over 2-qubit gates in U (4) cannot produce pseudorandomness.We then give an example, schematically depicted in Fig. 2, of how to construct a pseudorandom state by employing a quantum circuit comprising a layer of Hadamard gates followed by the log n-depth 3-stage classical cipher of Ref. [14] and described in the previous section.Sec. .Given that the classical cipher produces a pseudorandom permutation, an assumption tested via the Strict Avalanche Criterion (SAC) for pseudorandomness of classical ciphers [16][17][18], we show that the resulting quantum state satisfies the pseudorandomness condition expressed in Eq. ( 1) below.
We proceed by relating quantum expectation values of string operators to OTOCs, an identity which turns out to be useful in establishing the results of this section.We consider a quantum state | ψ ⟩ on the Hilbert space of n qubits that is obtained through the evolution via a unitary transformation Û applied to an initial product state | ψ 0 ⟩: | ψ ⟩ = Û | ψ 0 ⟩.If the state | ψ ⟩ is pseudorandom, then the expectation values of (non-trivial) Pauli string operators must vanish faster than any polynomially bounded function η(n) of the number of qubits, n: where a Pauli string, is labeled by the set α = (α x , α z ) of qubit indices present in the string.By adding a phase i α x •α z to Ŝα -picking up an i each time both a σx j and σz j appear at the same j, or basically deploying the σy s as well -would make the string operator Hermitian.Here we prefer the definition Eq. ( 2) for the applications we consider, and work explicitly with both Ŝα and Ŝ † α when needed.(When convenient, we also use the equivalent notation α , as for example in the definition of the dot product a • b ≡ i a i b i .)We next move the unitary transformation onto the string operators to rewrite the left hand side of Eq. (1) in terms of 'time'-evolved Pauli strings, Ŝα (τ ) ≡ Û † Ŝα Û , and Ŝα (−τ ) ≡ Û Ŝα Û † ( Ŝα (0) ≡ Ŝα ).Without loss of generality, we consider an initial product state in the computational basis, | ψ 0 ⟩ = | x ⟩, where x is an n-bit binary vector.We can then write: where Px is the projector onto the state | x ⟩, expressed in terms of Pauli strings as: If the correlator in Eq. ( 3) decays superpolynomially in n for all initial states | x ⟩, then the superpolynomial decay carries over to the average over all initial states.Thus, averaging Eq. (3) over x, and using x (−1) where we shifted the time-dependence from τ to −τ by using the cyclic property of the trace and the fact that the z-string operator Ŝβ z is Hermitian.Notice that the expression within parentheses in Eq. ( 5) represents an OTOC of Pauli string operators.
Eq. ( 5) can be translated into a more intuitive form by writing the τ -dependent string, U Ŝα U † = β A αβ (−τ ) Ŝβ in terms of string amplitudes, A αβ (−τ ), and then expressing Q α (τ ) as For simplicity we consider a local z-string, Ŝα = σz i (i.e., α x = 0, α z j = δ ij ), in which case, where p i;1 1 (−τ ; β z ), p i;z (−τ ; β z ), p i;x (−τ ; β z and p i;y (−τ ; β z ) are the probabilities that, at position i (and computational time −τ ), the Pauli string contains, respectively, an identity, a σz , a σx , or the product σx σz .[Throughout we keep track of the initial non-trivial string state β z defining the transition amplitudes A γβ z (−τ ) in Eq. ( 7).] Unstructured random quantum circuits: We will now make use of Eq. ( 7) to address the following question: can a log n-depth random quantum circuit built from 2-qubit gates (2-local) in U (4) representing the unitary operator Û in | ψ ⟩ = Û | ψ 0 ⟩ lead to pseudorandom states for which Q σz i satisfies the pseudorandomness condition in Eq. ( 1)?We answer this question by considering the average string weight, which is obtained by averaging Eq. ( 7) uniformly over circuits and over the axis of quantization, whereby we can write p i;x (−τ ; β z ) = p i;y (−τ ; β z ) = p i;z (−τ ; β z ) = 1 3 ρ(−τ ; β z ), where ρ(−τ ; β z ) is the string density.As a result, The averaging in Eq. ( 8) is carried out over random 2-qubit-gate-based universal circuits in which case the superpolynomial bound on Q σz i (τ ) for a given random circuit remains valid for the average Q σz (τ ).Here we assume that Q σz i (τ ) obtained for a typical random circuit coincides with the average over circuits, Q σz (τ ).[Note that considering the average quantity eliminates the pathological behavior of individual atypical circuits -such as for example one comprised of only identity gates -because their contribution are only included in the average with vanishingly small probability.]Moreover, the average of the string density over circuits depends on the initial condition, β z , but is independent of the site index i.Also, note that we kept the subscript σz on Q σz (τ ) as a reminder of the initial σz -string expectation value in Eq. (7).Parametrizing the τ dependence in terms of the number of layers of gates ℓ (the depth) of the circuit describing the unitary transformation Û that generated the evolution of string amplitudes up to time −τ , we can define to write Q σz (τ ) = 1 2 n β z ϵ(ℓ; β z ).A lower bound on the function η(n) in Eq. ( 1) is determined by how fast ρ(ℓ; β z ) reaches its asymptotic value of 3/4 starting from an initial condition associated with the arbitrary (non-trivial) initial string state β z .
The equation describing the evolution of the average string weight ρ(ℓ; β z ) can be derived by following all 15 (= 4 × 4 − 1) non-trivial two-site strings through the unitary evolution with consecutive layers of effective (average) gates which connect with equal amplitude each of these states to themselves and to each other.Here we shall make a mean-field approximation, which is equivalent to the assumption that the densities at different positions along the string are uncorrelated.It then follows that, since the identity string does not scatter into a non-trivial string, a configuration involving identity operators on both sites, which occurs with probability (1 − ρ) 2 , cannot contribute < l a t e x i t s h a 1 _ b a s e 6 4 = " G 7 o A g w F 4 B i / g 1 X q y 3 q x 3 6 2 P e m r E W M 8 d g C d b n D 8 w q l d I = < / l a t e x i t > P e r Y 9 F 6 5 q V z p y A J V i f P 8 3 B l d M = < / l a t e x i t > x 2 < l a t e x i t s h a 1 _ b a s e 6 4 = " T k r l n D Ll < l a t e x i t s h a 1 _ b a s e 6 4 = " 6 j f z F b v 2 7 E 0 g P 2 P C 4 P S K q f K t

Inflationary gates
Proliferation gates

Inflationary gates
< l a t e x i t s h a 1 _ b a s e 6 4 = " C B f q h 6 3 6 U E X A 5 / X 3 i c 1 L p s i 7 The circuit architecture that generates the pseudorandom quantum state with depth O(log n).This construction uses the three-stage (computationally) pseudorandom permutation of Ref. [14], which is built out of three circuits, Ll/r and N , comprised of linear inflationary gates and nonlinear proliferation gates, respectively.Each block contains O(n logn) three-qubit gates organized into a tree structure of O(log n) layers (see the 'Tree-structured circuits' discussion in the Methods section.) a Pauli operator on a given site.Otherwise, with probability 1 − (1 − ρ) 2 , non-trivial 1-site and 2-site string states scatter into a configuration with a Pauli operator on a given site with transition probability 12/15 = 4/5, accounting for the fact that only 12 (3 weight-1 strings and 9 weight-2 strings) out of the 15 non-trivial string states feature a Pauli operator on that site.Therefore, As expected, ρ(ℓ → ∞; β z ) = 3/4 is a fixed point.Writing Eq. ( 10) in terms of ϵ(ℓ; β z ) defined in Eq. ( 9), we obtain This equation must be solved with initial condition ϵ(0; β z ) = 1 − (4/3) ρ(0; β z ).Asymptotically, ϵ(ℓ; β z ) tends to zero exponentially in ℓ as ∼ (2/5) ℓ , for any initial string state β z .We note that incorporating two-site correlations beyond mean-field can alter the coefficients in Eq. ( 11) by terms of order 1/n but cannot change the fixed point density, ρ(ℓ → ∞; β z ) = 3/4.In particular, these 1/n corrections can modify the coefficient of the linear term in Eq. ( 11) but cannot eliminate it all together, thus preserving the exponential decay of OTOCs with ℓ.For ℓ ∼ O(log n), Q σz in Eq. ( 8) can only decay as a power law in n, violating the assumption that η(n) in Eq. ( 1) is superpolynomially small in n, as pseudorandomness requires.We conclude that evolution via a log n-depth circuit built from universal 2-qubit gates drawn uniformly from unitaries in U (4) is incapable of reaching a pseudorandom state.[It is interesting to note that the number of layers required to reach the equilibrium string weight ρ = 3/4 (1 − ϵ) starting from an initial value ρ(0; β z = σz i ) ∼ 1/n that emerges from the differential equation derived from the mean-field recursion in Eq. ( 10) corresponds to a circuit of size S = 5  6 n [ln n + ln(1/ϵ)].This is precisely the expression for the lower bound on circuit size required for anti-concentration derived in Ref. [10] for 2-qubit gates on a complete graph and conjectured earlier by Harrow and Mehraban [8].] In the next section we use the O(log n)-depth structured classical reversible circuits discussed in Ref. [14] to build a pseudorandom quantum state, i.e., a quantum state for which the bound in Eq. ( 1) is satisfied.
Structured random quantum circuits: Let us start with a product state | 0 ⟩ ⊗n in the computational basis, and apply a non-trivial string β x of Pauli σx operators that flips the initial state to | β x ⟩.By applying Hadamard gates to this state we then obtain: Finally, evolving the resulting state with a classical reversible permutation circuit P , P | x ⟩ = | P (x) ⟩, leads to: A general reversible classical circuit P can be built from 3-bit gates in S 8 , which generate all permutations on the space of n bits within the alternating group A 2 n (all even permutations in the group S 2 n ).
Refs. [19,20] show that a state of the form in Eq. ( 13), with the phase given by a pseudorandom function, is a pseudorandom state.Here we will use pseudorandom permutations that, for large n, cannot be distinguished from pseudorandom functions.More precisely, we will deploy 3-stage log n-depth circuits discussed in Ref. [14], where it was argued that such circuits generate permutations satisfying the necessary (and conjectured to also be sufficient) conditions for pseudorandomness.The resulting quantum circuit architecture that generates the pseudorandom quantum states considered in this section is shown in Fig. 2.
To illustrate the importance of the 3-stage structure to the generation of pseudorandomness, we consider the expectation value of a Pauli string operator in the state | ψ β x ⟩ of Eq. ( 13).We proceed by applying Ŝα to this state: which, in turn, leads to the following expression for the expectation value of the string operator Ŝα : We note that for α z = 0, α x k = δ k,i (i.e., Ŝα = σx i ), and β x l = δ l,j (i.e., flipping only the jth qubit of the initial state) this expectation value is expressed as the OTOC representing the SAC [14], a simple test of security for a classical block cipher: where the qubit-wise XOR operation for two n-qubit strings x ⊕ c i flips the ith qubit of x (i.e., c i = 2 i ).In Ref. [14] we presented a calculation of the evolution of the SAC OTOC Eq. ( 16) through the application of consecutive layers of the structured cipher.To summarize the results of that calculation, we first introduce P −1 (ℓ), the partial circuit comprised of the first ℓ layers of the circuit P −1 , with P −1 (0) ≡ 1 1 and P −1 (ℓ f ) ≡ P −1 and define the expectation value of the string operator in Eq. ( 16) after ℓ layers of the permutation P −1 are applied as, As in the mean-field calculation above we will focus on averages over circuits, s(ℓ Since gates defining individual layers are chosen independently we can easily derive recursion relations relating s(ℓ+1) and q(ℓ + 1) to s(ℓ) and q(ℓ), which depend on the specific gate set chosen.As shown in Ref. [14] and summarized in the 'SAC OTOC' discussion of the Methods section, evolution through ℓ layers of linear inflationary gates, leads to and evolution through ℓ layers of supernonlinear gates, which maximize string entropy production' [14], leads to: We note that the recursion relations in Eqs.(18a), (18b), (19a), and (19b) are exact for tree-structured circuits of depth ℓ ≤ log 3 n.We note that if the circuit contained only supernonlinear gates, the analysis of the decay of the OTOC (and of the expectation value of the string operator) could be carried out by linearizing Eqs.(19b) for small s and q: In this case, it is inescapable that q(ℓ) can only decay exponentially with depth ℓ: q(ℓ) ∼ e −λℓ , with λ = ln(28/3).One can interpret the coefficient of the linear term in the expansion of the recursion relation as a Lyapunov exponent, λ.The exponential decay of q(ℓ) with a finite Lyapunov exponent λ implies that circuits of log n depth can only lead to polynomial decay of the SAC OTOC.It is important to stress that the same linear leading behavior in s and q of the recursion relations occurs for random circuits of universal gates.Eliminating the linear terms requires fine tuning -this is precisely what makes the linear inflationary gates both special and necessary for ensuring that the SAC OTOC decays exponentially with n for depth log n structured circuits.Indeed, the recursions for s and q in the case of inflationary gates start with quadratic leading terms.[Note that q = 1 is a fixed point of the recursion Eq. (18b), and thus nonlinear gates are needed to reduce the value of q below 1 before the system can evolve towards the q = 0 fixed point.]To lowest order in q, the recursion Eq. (18b), which is activated following the action of the layers of supernonlinear gates, reads the asymptotic solution of which is a double exponential in ℓ, q(ℓ) ∼ 3 2 2 3 q(0) . This behavior, which corresponds to an infinite Lyapunov exponent, is non-universal but essential in ensuring the exponential decay with n of the SAC OTOC and, equivalently, in proving the superpolynomial bound of Eq. ( 1) for expectation values of string operators in the quantum state | ψ β x ⟩ in Eq. ( 13).
We note that there are 144 3-bit inflationary gates among the 8! gates 3-bit gates in S 8 [14].One can then ask whether inflationary gates are also present among the 2-qubit U (4) gates that generate universal quantum computation, in which case one could imagine constructing pseudorandom quantum states by employing such 2-qubit gates.Below we show that there are no 2-qubit inflationary gates, but that 2-qudit inflationary gates do exist for d ≥ 3 and d prime.

Absence of two-qubit inflationary gates
The main message of this section is that there are no inflationary 2-qubit gates in U (4), i.e., that there are no U (4) gates which eliminate the stay probability of weight-1 strings.We prove this statement first for 2-qubit Clifford gates, and then for general unitary gates in U (4).
Clifford Gates: We argue by contradiction: suppose that a two-qubit Clifford gate U Cl maps both Pauli operators σx 1 and σz 1 on site 1 to Pauli strings of weight two with a footprint on both site 1 and site 2: section above.Because of their inflationary property, the 2-qudit Clifford gates discussed discussed in this section are necessarily entangling.These 2-qudit Clifford gates also form a finite group, which includes the identity gate, and therefore one can write single qudit unitaries as products of IQ gates.As demonstrated in Ref. [21], an entangling 2-qudit gate and arbitrary single qudit rotations are the two ingredients required for the universality of a gate set.Therefore, the 2-qudit IQ gates in Fig. 3 form a universal set for quantum computation.IQ gates can also be realized by padding the 144 classical inflationary gates of Ref. [14] (shown in Fig. 7) with 1-qubit rotations at inputs and outputs, as depicted in Fig. 3b.We note that the 144 classical inflationary gates generate all classical linear 3-bit gates and, in particular, the identity gate and 2-bit CNOTs across any of the 3 bitlines, [The inflationary gates associated to the two permutations 0 3 5 6 7 4 2 1 and 1 4 6 3 2 7 5 0 suffice to generate the group of all 1344 permutations associated to classical linear 3-bit gates, i.e., gates g such that g(x ⊕ y) = g(x) ⊕ g(y) ⊕ c, for a constant c.]One can then write both single qubit unitaries and entangling CNOTs as products of IQ gates and thus, the 3-qubit IQ gates in Fig. 3b also form a universal set for quantum computation.
As discussed in the 'Our contributions' section above and in more detail in Ref. [14], reaching cryptographic-level scrambling with log n-depth classical reversible circuits required a 3-stage structure that separated linear classical gates responsible for string inflation from nonlinear classical gates responsible for string proliferation and entropy production.What makes these 2-qudit and 3-qubit IQ gates special is that they generate both 'diffusion' and 'confusion' in the FIG. 3. Inflationary Quantum (IQ) Gates: (a) 2-qudit IQ gates obtained by padding Clifford qudit inflationary gates (see the second section of Methods) that transform weight-1 strings into weight-2 strings gates with 1-qudit rotations at inputs and outputs; (b) 3-qubit IQ gates obtained by adopting the 144 3-bit classical (linear) inflationary gates that transform weight-1 strings into weight-2 strings (see Ref. [14]) to qubits, and padding the resulting 3-qubit gates with 1-qubit rotations at inputs and outputs.Employing random circuits of 3-qubit or 2-qudit IQ gates will eliminate the stay probability of weight-1 Pauli strings, as depicted in the inset to Fig. 1, while, at the same time proliferating operator strings and generating string entropy.sense of Shannon [22], i.e., IQ gates posses the ability to simultaneously (a) eliminate stay-probabilities for weight-1 strings and accelerate the inflation of strings; and (b) proliferate the number of strings and generate string entropy.We thus expect that single-stage random quantum circuits comprised of IQ gates can scramble both at the speed limit (i.e., in log n-depth) and to cryptographic level.

DISCUSSION
As we detailed in this paper, scrambling rapidly (i.e., with log n-depth) and thoroughly (i.e., to cryptographic precision), via quantum circuits, is a tall order.More precisely, this paper makes two specific complementary points, namely: (i) that generic 2-qubit-gate quantum circuits cannot scramble information to cryptographic precision within a computational time scaling as log n; and (ii) that fast scrambling to cryptographic precision can be realized with a special set of universal inflationary quantum (IQ) gates.These special IQ gates can simultaneously expand individual Pauli strings as well as proliferate their number, the latter leading to string entropy production.IQ gates should play a key role in a number of areas in quantum information in which fast scrambling is desirable.(We note that the special properties of IQ gates will affect the behavior of circuits in any architecture, beyond the tree-structured circuits of long-ranged gates on which we concentrated in this paper.)For example, in the case of one-dimensional 'brickwall' circuits of 2-qudit IQ gates, the front associated with operator spreading will propagate deterministically without dispersion, at the Lieb-Robinson speed limit.This behavior is due to the fact that at the front (i.e., at the edges of the Pauli strings at the light cone boundary) an IQ gate always acts on a fresh site with vanishing string weight (i.e., an up to then untouched site just outside the front), so that the inflationary property ensures that the evolved string will always acquire weight at that site after evolution by the gate.By contrast, as described in Ref. [23], evolution by generic qudit circuits, would lead to a stochastic evolution of the front, with an average velocity below the maximum attainable value, and with a front-width that spreads diffusively.A cartoon of the difference between these cases is shown in Fig. 4.More generally, IQ gates would lead to faster, deterministic front propagation in any spatial dimension D. The speed up is most dramatic when D → ∞ as in the case of our tree-structured circuits, for which IQ gates are essential for reaching cryptographic-level scrambling with minimal log n-depth circuits.
Furthermore, we expect that the rapid scrambling property of IQ gates provides an additional ingredient that should lead to stronger bounds on t-designs.For example, a circuit of IQ gates may validate the conjecture of Harrow and Mehraban [8] that one can build 2-designs with log n-depth circuits.
IQ gates may also be useful in desiging novel quantum advantage experiments, since they accelerate the expansion and proliferation of Pauli strings.We note, however, that inflation of strings are counter-acted by depolarizing noise, which removes contributions from high weight strings.This mechanism of suppression of large strings has been explored in Refs.[24,25] to design efficient classical algorithms for sampling from the output distribution of a noisy random quantum circuit.
Finally, while employing random circuits of IQ gates should enable the construction of cryptographic level fast quantum scramblers -quantum 'superscramblers' -we do not expect that unitary evolution via a time-independent Hamiltonian of interacting qudits or qubits can scramble to such a level in a time O(log n), even if non-local couplings are employed.

Tree-structured circuits
Here we present the wiring of tree-structured circuits that both accelerate the scrambling and allowed us to obtain analytically the recursion relations (18a,18b,19a,19b,20a,20b,21), the detailed derivation of which we present below.]Tree-structure circuits connect qubits or, more generally, qudits in a hierarchy of scales, and mimic systems in D → ∞ spatial dimensions.
We consider first a tree-structured circuit in which pairs of qudit indices acted by 2-qudit gates are arranged in a hierarchical (tree) structure.Let us consider the case when the number of qudits, n, is a power of 2, n = 2 q .Each level in the tree hierarchy comprises of a layer with n/2 2-qudit gates.We proceed by forming pairs indices for each < l a t e x i t s h a 1 _ b a s e 6 4 = " G 7 4 N V 6 s t 6 s d + t j 0 Z q x 0 p l j s A T r 8 w f N s 5 X T < / l a t e x i t > x 3 < l a t e x i t s h a 1 _ b a s e 6 4 = " r t M Q 5 J 6 1 Z a / A K k T i A 3 a 2 5 e G o q g 0 = " > A < l a t e x i t s h a 1 _ b a s e 6 4 = " Y w b u X g 4 f p 0 B 4 q n A 4 / i M m t b S g c s f i 9 a c k c 0 c g y U Y n z / H 1 5 X P < / l a t e x i t > x 5 < l a t e x i t s h a 1 _ b a s e 6 4 = " q a R i g k 0 k 3 n p 0 7 h m V Z 8 G H C h K 1 J w r v 6 e S F E o 5 S T 0 d G e I 1 E i u e j P x P 6 + X q K D m p j S K E 0 U i v F g U J A w q D m d / Q 5 8 K g h W b a I K w o P p W i E d I I K x 0 O k t b P I 8 z f 1 r Q u d i r K f w l 7 Q v T r p q V 2 3 K p c Z U l l A c n 4 B S c A x t c g g a 4 A U 3 Q A h g M w T N 4 A a / G k / F m v B s f i 9 a c k c 0 c g y U Y n z / J b p X Q < / l a t e x i t > x 6 < l a t e x i t s h a 1 _ b a s e 6 4 = " h S e a c W H A R e 6 I g X n 6 u + J F I V S T k J P d 4 Z I j e W q N x P / 8 / q J C u p u S q M 4 U S T C i 0 V B w q D i c P Y 3 9 K k g W L G J J g g L q m + F e I w E w k q n s 7 T F 8 z j z p w W d i 7 2 a w l / S u T D t q l m 5 K Z e a l 1 l C e X A C T s < l a t e x i t s h a 1 _ b a s e 6 4 = " y 5 I q Q a m B 1 j f 7 a B m z h S 4 J q h J z h y 5 F e I h k g h r k 8 7 S l j A U L J q U T C 4 r K a y S l m e 7 F 3 b t t l q p X y 0 S K o I T c A r O g Q t 8 U A c 3 o A G a A I M B e A L P 4 M V 6 t F 6 t N + t 9 3 l q w F j P H Y A n W x z f y Q 5 V J < / l a t e x i t > ... < l a t e x i t s h a 1 _ b a s e 6 4 = " C B f q h 6 3 6 U E X A 5 / X 3 i c 1 L p s i 7 l a t e x i t > { < l a t e x i t s h a 1 _ b a s e 6 4 = " N J q G m 2 7 4 K 3 K S S 3 j z p N J J C O e q 4 m I = " > A A A B / X i c b V D L S g N B E O z 1 G e M r 6 t H L Y B A 8 h V 3 x d R G C X j x G N A 9 I l j A 7 O 5 s M m Z 1 Z Z m a F s A S / w K t + g T f x 6 r f 4 A f 6 H k 2 Q P J r G g o a j q p r s r S D j T x n W / n a X l l d W 1 9 c J G c X N r e 2 e 3 t L f f 0 D J V h N a J 5 F K 1 A q w p Z   5. Hierarchical tree-structured circuit consisting of two-qudit unitary gates.Each unitary gate is represented as a solid line with square endpoints, which indicate the two qudits on which the gate acts.Each layer contains n/2 gates acting on different non-overlapping pairs of qudits.Circuits consisting of three-qubit gates that form a ternary tree structure, like the circuits Ll/r and N shown in Fig. 2, can be constructed in a similar fashion.layer ℓ of gates, selected as follows: More precisely, each of the n/2 = 2 q−1 pairs in layer ℓ are indexed by (i, j), which we write in base 2 as where z a = 0, 1, for a = 0, . . ., q − 1.Notice that at layer ℓ the members of the pairs, (i, j), are numbers that only differ in the (ℓ − 1)-th bit, while the other q − 1 bits z a , a ̸ = ℓ − 1, enumerate the 2 q−1 = n/2 pairs.(If more than q layers are needed, we recycle in layer ℓ > q the pairs of layer ℓ mod q.) Once the pairs of indices, (i, j), are selected for each layer, we can generate other similar binary trees by mapping (i, j) onto (π(i), π(j)), via a (randomly chosen) permutation π of the n indices.A schematic of the hierarchical tree-structure presented above is shown in Fig. 5 below.
The construction can be generalized to trees of other degrees, for example the ternary tree introduced in Ref. [14], which we borrow to provide an additional example.Consider the case when n is a power of 3, n = 3 q .In the ternary case, we proceed by forming groups of triplets of indices for each layer, selected as follows: More precisely, each of the n/3 = 3 q−1 triplets in layer ℓ are indexed by (i, j, k), which we write in base 3 as where z a = 0, 1, 2, for a = 0, . . ., q − 1.Notice that at layer ℓ the members of the triplets, (i, j, k), are numbers that only differ in the (ℓ − 1)-th trit, while the other q − 1 trits z a , a ̸ = ℓ − 1, enumerate the 3 q−1 = n/3 triplets.(Again, if more than q layers are needed, we recycle in layer ℓ > q the triplets of layer ℓ mod q.) Once the triplets of indices, (i, j, k), are selected for each layer, we can map them onto groups of three indices (π(i), π(j), π(k)), via a (randomly chosen) permutation π of the n indices.
The construction above can be generalized for trees of degree k, in which case k-tuples of indices can be selected for k-qudit gates to act on.

Two-qudit Inflationary Clifford Gates
In this section we prove: We start with a brief review of the higher dimensional Pauli group and its symplectic representation.Pauli matrices have a natural generalization in higher dimensions.Define the generalized Pauli matrices for qudits with local Hilbertspace dimension d (hereafter assumed to be a prime number) as where ω = e i2π/d is the primitive d-th root of unity.The above Pauli operators satisfy the following relations: It is easy to check that the above matrices reduce to the familiar Pauli matrices for qubits upon taking d = 2.A Pauli string is an element of the Pauli group P n acting on n qudits: where we have ignored a possible phase factor.The above Pauli string admits the following symplectic representation as a vector in Z ⊗2n d : where u i , v i ∈ [0, d − 1].For d prime, the integers in Z d form a finite field (or Galois field) F d , such that the multiplicative inverse exists for each element.Since we are interested in the process where a single-site Pauli operator evolves into a weight-two Pauli string, we focus on n = 2.As a concrete example, Pauli-Z and −X operators acting on site 1 are represented as vectors: In the vector representation, products of two Pauli strings correspond to the addition of the two vectors: g 1 + g 2 (mod d).
The commutation relation between two Pauli strings in the symplectic representation can be conveniently computed from the following matrix: namely, where g 1 and g 2 are vectors representing S 1 and S 2 , respectively.
Proof of Theorem 1: To prove Theorem 1, we need the following lemmas.
Lemma 1: If under a Clifford gate U Cl , single-site Pauli operators Z 1 and X 1 evolve to weight-2 strings of the form with a 1 , b 1 , ã1 , b1 = 1, 2, . . ., d − 1, then all single-site Pauli operators of the form Z u1 1 X v1 1 will evolve to weight-2 strings under U Cl .
Proof: First, we note that both g 1 and g 2 are weight-2 strings, as is evident from their vector representations.Then, consider all other single-site Pauli operators of the form Z u1 1 X v1 1 with u 1 ̸ = 0 and v 1 ̸ = 0.Under U Cl , such an operator evolves into Z u1 1 X v1 1 :→ g = u 1 g 1 + v 1 g 2 (mod d).
(39) However, due to properties of the finite field, all elements of g must be nonzero.Hence, we conclude that all single-site Pauli operators evolve to weight-2 strings under U Cl .■ In the above lemma, we assume that the Pauli operators Z and X on site 1 evolve to strings of the form g 1 and g 2 under a two-qudit Clifford gate.At this point, it is unclear whether the specific form of g 1 and g 2 can be achieved.The answer is affirmative for d ≥ 3, as is shown in Lemma 2 below.
Lemma 2: The form of g 1 and g 2 in Lemma 1 can always be achieved via evolution under a Clifford gate U Cl for d ≥ 3, while it is not possible for d = 2.
Proof: The only constraint on the time-evolved Pauli strings g 1 and g 2 is that they must preserve the commutation relation XZ = ωZX of the original Pauli operators.Using the symplectic representation, this amounts to the following linear equation: or, explicitly, For d ≥ 3, one can take a 1 ã1 > 1 and b 1 b1 > 1. Due to properties of the finite field, there always exist pairs of integers (x, y) in F d , such that x + y = 1 (mod d).We can then take a 1 ã1 = x (mod d), and b 1 b1 = y (mod d).Again, using properties of the finite field, it is always possible to find non-zero a 1 , ã1 , b 1 and b1 that satisfy these two equations.Thus, non-zero solutions of Eq. (41) always exist.On the other hand, for d = 2, Eq.(41) can only be satisfied when (a 1 ã1 , b 1 b1 ) = (1, 0) or (0, 1).Either case implies that one of the four numbers a 1 , b 1 , ã1 , b1 must be zero, which contradicts our assumption in Lemma 1.In other words, one of the strings g 1 and g 2 must have weight 1.Therefore, the particular form of g 1 and g 2 in Lemma 1 cannot be achieved for d = 2. ■ Combining the results of Lemma 1 and 2, we have shown that for d ≥ 3, it is always possible to choose two-qudit Clifford gates such that all single-site Pauli operators supported on site 1 evolve to weight-2 strings.To complete the proof of Theorem 1, we need to show that the same Clifford gate is also able to evolve all single-site Pauli operators on site 2 to weight-2 strings.
We show that this is possible by explicitly finding a set of solutions.We assume that the single-site Pauli operators Z 1 , X 1 , Z 2 and X 2 evolve into weight-2 Pauli strings of the following form under U Cl : Z 1 :→ g 1 = (1, 1, 0, 0) X 1 :→ g 2 = (0, 0, ã1 , b1 ) Z 2 :→ g 3 = (a 2 , b 2 , 0, 0) X 2 :→ g 4 = (0, 0, ã2 , b2 ).( 42) Essentially, we have assumed that both Z 1 , X 1 and Z 2 , X 2 evolve into the form of Lemma 1, and further take a 1 = b 1 = 1.We demand that the resulting Pauli strings preserve the original commutation relations, which translates into the following set of linear equations: where the equality mod d is implicit.Notice that with the above parametrization, the commutation relations g 1 Λ g T 3 = 0 and g 2 Λ g T 4 = 0 are automatically guaranteed.Our procedure for finding a particular solution to the above set of equations goes as follows.

SAC OTOC recursion relations for the three-stage cipher
For the reader's convenience, we reproduce the calculation presented in Ref. [14] of the square of the SAC OTOC, , as a function of the number of applied layers of gates ℓ of the tree-structured reversible circuit of 3-bit permutations described in Sec.7.1 of that reference.We use the mean-field assumption (which was checked numerically in Ref. [14]) that the system self-averages, implying that q ij = q, independent of i and j.The independence of i and j can be traced back to the fact that the three bit lines entering the gate g of layer ℓ + 1 originate from independent branches of the tree circuit emerging from layer ℓ (see Fig. 6).As long as ℓ ≤ log 3 n, gates in subsequent layers always bring in fresh bits and, upon averaging over gates, bitlines i and j remain uncorrelated.] We proceed recursively, layer-by-layer, relating q(ℓ + 1) to q(ℓ).The calculation is set up in bit space in terms of probabilities p i (ℓ) that after applying the ℓ-th layer bit i does not flip.In the hierarchical tree construction, the no-flip probability for a given output bit i (at level ℓ + 1) is determined by the outputs, at bitlines i 0 , i 1 , i 2 coming from separate branches of the tree (at level ℓ) and by the 3-bit gate g in layer ℓ + 1 that takes those three bitlines as inputs and connects to bit i as one of its outputs.The recursion relations of Eqs.(55a) and (55b) display two special features: the first and second moments decouple; and more importantly, the coefficient of the linear term in q(ℓ) in the equation for the second moment vanishes.Note that the bimodal initial condition Eq. ( 50), where p only takes values p = 0, 1, implies that an initial q = 1 cannot evolve under Eq.(55b), which displays fixed points at q = 0, 1 (and a non-physical one at q = −3).However, with the deployment of nonlinear gates q drops below 1, following which inflationary gates significantly accelerate the decay of q(ℓ) with ℓ due to the absence of the linear term in q(ℓ) in Eq. (55b).By contrast to the case of inflationary gates, the recursion relations for q(ℓ + 1) in Eqs.(56a) and (56b) depend on both s(ℓ) and q(ℓ), and contain a term linear in q(ℓ).Eqs.(55a), (55b), (56a), and (56b) are the starting point for the discussion of the decay of the SAC OTOC with ℓ.
n X U I 4 i o r x 0 8 k I G j 4 0 S w F B I U 1 z D i f p 3 I k W R U q P I N 5 3 j g 9 W 8 N x b / 8 7 q J D q + 8 l P I 4 0 Y T j 6 a I w Y V A L O M 4 D B l Q S r N n I E I Q l N b d C P E A S Y W 1 S m 9 n i + 4 I F W c n k 4 s y n s E h a p z X n o n Z + f 1 a p X + c J F c E h O A J V 4 I B L U A e 3 o A G a A I M n 8 A J e w Z v 1 b L 1 b H 9 b n t L V g 5 T P 7 Y A b W 1 y + 1 I p 7 o < / l a t e x i t > O(log n) < l a t e x i t s h a 1 _ b a s e 6 4 = " 3 Z 9 D G 4 g + + P Y x u p m n X U I 4 i o r x 0 8 k I G j 4 0 S w F B I U 1 z D i f p 3 I k W R U q P I N 5 3 j g 9 W 8 N x b / 8 7 q J D q + 8 l P I 4 0 Y T j 6 a I w Y V A L O M 4 D B l Q S r N n I E I Q l N b d C P E A S Y W 1 S m 9 n i + 4 I F W c n k 4 s y n s E h a p z X n o n Z + f 1 a p X + c J F c E h O A J V 4 I B L U A e 3 o A G a A I M n 8 A J e w Z v 1 b L 1 b H 9 b n t L V g 5 T P 7 Y A b W 1 y + 1 I p 7 o < / l a t e x i t > O(log n) < l a t e x i t s h a 1 _ b a s e 6 4 = " 3 Z 9 D G 4 g + + P Y x u p m n X U I 4 i o r x 0 8 k I G j 4 0 S w F B I U 1 z D i f p 3 I k W R U q P I N 5 3 j g 9 W 8 N x b / 8 7 q J D q + 8 l P I 4 0 Y T j 6 a I w YV A L O M 4 D B l Q S r N n I E I Q l N b d C P E A S Y W 1 S m 9 n i + 4 I F W c n k 4 s y n s E h a p z X n o n Z + f 1 a p X + c J F c E h O A J V 4 I B L U A e 3 o A G a A I M n 8 A J e w Z v 1 b L 1 b H 9 b n t L V g 5 T P 7 Y A b W 1 y + 1 I p 7 o < / l a t e x i t > O(log n) < l a t e x i t s h a 1 _ b a s e 6 4 = " q v X c R I 7 a Y s k 7 h R q I Y 3 d j b r / T k O 8 = " > A A A C Q n i c b V D L S g M x F M 3 4 r P V V d e k m W I S 6 s M y I r 4 1 Q F M R l B V s L n X b I p J k a z W T G J C M t 6 f y R n + E X u B P d u n En b l 2 Y t r P w d S B w O O c e 7 s 3 x Y 0 a l s u 0 n a 2 J y a n p m N j e X n 1 9 Y X F o u r K z W Z Z Q I T G o 4 Y p F o + E g S R j m p K a o Y a c S C o N B n 5 N K / O R n 6 l 3 d E S B r x C 9 W P S S t E X U 4 D i p E y k l c 4 H b i x p K 5 A v M s I P I J u I B D W T q p d e S u U 3 m n z N

FIG. 4 .
FIG. 4.Operator front profile evolution.Illustration of the profile of the right operator front ρR(x, t) (i.e. total weight of Pauli strings with right endpoint at x) under random unitary circuit and IQ circuit evolution.IQ circuits lead to a larger butterfly velocity and an absence of operator front broadening compared to random unitary circuits.
4 L W D T O c t h J F c R x w 2 g w G t 2 O / + U S V Z l I 8 m m F C / R j 3 B I s Y w c Z K D / z a 6 5 b K b s W d A C 0 S L y d l y F H r l n 4 6 o S R p T B D e p A o A c v 8 A p v z r P z 7 n w 4 n 9 P W J S e f O Y A Z O F + / J p i V a A = = < / l a t e x i t > l = 1 < l a t e x i t s h a 1 _ b a s e 6 4 = " C B f q h 6 3 6 U E X A 5 / X 3 i c 1 L p s i 7J O Q = " > A A A B / H i c d V D L S g M x F M 3 U V 6 2 v q k s 3 w S K 4 G m b 6 H H d F N y 6 r 2 A e 0 Q 8 m k m T Y 0 k w x J R i h D / Q K 3 + g X u x K 3 /4 g f 4 H 6 Y P w Y q e E D i c c y / 3 3 h P E j C r t O B 9 W Z m 1 9 Y 3 M r u 5 3 b 2 d 3 b P 8

Theorem 1 :
There exist 2-qudit inflationary Clifford gates, for local Hilbert space dimension d ≥ 3 and d prime, that expand all weight-1 generalized Pauli strings into weight-2 generalized Pauli strings.

FIG. 6 . 1 2 3 7 x=0(− 1 )FIG. 7 .
FIG. 6.The hierarchical structure of the circuit connectivity.The tree connectivity illustrates the arguments used in the derivation of a recursion relation for the probability pi that a bit flips upon flipping a number of inputs.The specific action of the gate g determines the fraction of inputs for which the output i does not flip when x → x⊕c, with x ≡ x i0 + 2 x i1 + 2 2 x i2 and c ≡ c 0 + 2 c 1 + 2 2 c 2 encoding which ones of the three bits are flipped (c 0,1,2 = 0 for an unflipped input or 1 for a flipped one).This fraction is expressed as C gi c0c1c2 ≡ C gi c = (f gi c + 1) /2, with f gi c = 1 2 3 7 Super nonlinear layers: Using averages C gi a and C gi a C gi b computed over the 10752 super-nonlinear gates, leads to the recursion relations characterizing evolution via super nonlinear gates, namely, ℓ)] 2 (1 + s(ℓ)) + 1 28 [q(ℓ)] 3 .