Kerdock Codes Determine Unitary 2-Designs

The binary non-linear Kerdock codes are Gray images of ${\mathbb{Z}_4}$-linear Kerdock codes of length N =2m. We show that exponentiating $\imath = \sqrt { - 1} $ by these ${\mathbb{Z}_4}$-valued codewords produces stabilizer states, which are the common eigenvectors of maximal commutative subgroups (MCS) of the Pauli group. We use this quantum description to simplify the proof of the classical weight distribution of Kerdock codes. Next, we partition stabilizer states into N +1 mutually unbiased bases and prove that automorphisms of the Kerdock code permute the associated MCS. This automorphism group, represented as symplectic matrices, is isomorphic to the projective special linear group PSL(2,N) and forms a unitary 2-design. The design described here was originally discovered by Cleve et al. (2016), but the connection to classical codes is new. This significantly simplifies the description of the design and its translation to circuits.

quantum error-correcting codes (QECCs) to ensure reliability of computation. Classical error-correcting codes inspired the discovery of the first QECC by Shor [4], the development of CSS codes by Calderbank, Shor and Steane [5], [6], and the development of stabilizer codes [7], [8] by Calderbank, Rains, Shor and Sloane and by Gottesman. A QECC protects m − k logical qubits by embedding them in a system comprising m physical qubits. In fault-tolerant computation, any desired operation on the m − k logical (protected) qubits must be implemented as a physical operation on the m physical qubits that preserves the code space. The most common QECCs are stabilizer QECCs, that are derived from commutative subgroups of the Heisenberg-Weyl group HW N (also known as the Pauli group), and the simplest quantum circuits are composed of unitary operators from the Clifford group Cliff N (see Section III for formal definitions). Note that N = 2 m throughout this paper. The Clifford group normalizes HW N , so each element of Cliff N induces an automorphism of HW N under conjugation. Since HW N elements can be efficiently represented as binary length-2m vectors, Clifford operators can be efficiently represented as 2m × 2m binary symplectic matrices that preserve the group structure of HW N under the binary mapping. A central theme in this paper is that beyond inspiring the construction of QECCs, interactions between the classical and quantum worlds still prove mutually beneficial for other purposes, especially via the binary representations of HW N and Cliff N .
Prior to running applications, a quantum computer needs to be assessed for its quality, in terms of the fidelity of the quantum operations executed on the system. The randomized benchmarking protocol, introduced by Emerson et al. [9], [10], is a well-established scheme that estimates the fidelity of the noise in the system by twirling the underlying channel through a randomized sequence of gates and calculating the fidelity of the resulting depolarizing channel. The depolarizing channel can be interpreted as the quantum analogue of the binary symmetric channel in classical communication theory. Since the fidelity is shown to be an invariant of this twirling process, the protocol indeed estimates the fidelity of the actual noise (under some additional assumptions). This protocol works on the physical operations in the computer, so the fidelity estimates then need to be translated into the quality of the logical operations (on the protected qubits) for an errorcorrected quantum computer. Since this translation might not be reliable, the procedure has recently been extended to the logical randomized benchmarking protocol [11] that directly estimates the fidelity of the logical operations more reliably.
Randomized benchmarking requires that the sequence of gates be sampled from an ensemble of unitaries that form a unitary 2-design. A unitary t-design is an ensemble of unitaries, bestowed with a probability distribution, that ap-proximates the Haar distribution on the unitary group up to the t-th moment. Section VI makes this precise by discussing linear maps called twirls over the full unitary ensemble and the finite ensemble. When the two linear maps coincide the finite ensemble is a unitary t-design. It is easy to analyze protocols that randomly sample unitary matrices with respect to the Haar measure, but such sampling is infeasible, hence the interest in finite ensembles of unitary matrices that approximate the Haar distribution. Cliff N is known to be a unitary 3-design [12], and the proof by Webb involves the concepts of Pauli mixing and Pauli 2-mixing, which we introduce in Section VI. However, Cliff N has size 2 m 2 +2m m j=1 (4 j − 1) (up to scalars e 2πıθ , θ ∈ R) which is much larger than the lower bound of ≈ 2 4m for any unitary 2-design, established by Gross, Audenaert and Eisert [13], and by Roy and Scott [14]. They also discuss the existence of Clifford ensembles that saturate this bound. Although random circuits are known to be exact or approximate unitary 2-designs [15], [16], deterministic constructions of such ensembles facilitate practical realizations. Cleve et al. [17] have recently found an explicit subgroup of Cliff N that is a unitary 2-design. The central contribution of this paper is to use the classical Kerdock codes to simplify the construction of this quantum unitary 2-design and its translation to circuits (see Section VI).
There are many other applications of unitary 2-designs. The first is quantum data hiding (the LOCC model described in [18]), where the objective is to hide classical information from two parties who each share part of the data but are only allowed to perform local operations and classical communication. The data hiding protocol can be implemented by sampling randomly from the full unitary group but it is sufficient to sample randomly from a unitary 2-design. Other applications of unitary 2-designs are the fidelity estimation of quantum channels [19], quantum state and process tomography [20], and more recently minimax quantum state estimation [21]. In quantum information theory, they have been used extensively in the analysis of decoupling [14], [16], [22], [23].
The next section discusses the flow of ideas in the rest of the paper, and points to related work and applications.

II. MAIN IDEAS AND DISCUSSION
The first result in the paper is to use the (quantum) commutative subgroups of HW N to simplify the derivation of weight distributions for the (classical) Kerdock codes.
Recall that Hermitian matrices that commute can be simultaneously diagonalized. The Kerdock and Delsarte-Goethals binary codes are unions of cosets of the first order Reed-Muller (RM) code RM (1, m), the cosets are in one-to-one correspondence with symplectic forms, and the weight distribution of a coset is determined by the rank of the symplectic form (see [24,Chapter 15] for more details). Section IV-A reviews the Z 4 description of these codes given in [25]. Section IV-B shows that when we exponentiate codewords in these cosets of RM(1, m) we obtain a basis of common eigenvectors for a maximal commutative subgroup of Hermitian Pauli matrices. The operators that project onto individual lines in a given eigenbasis are invariants of the corresponding subgroup [26], and the distance distribution of the code is determined by the inner product of pairs of such eigenvectors (see [Section IV, Lemma 10]). When calculating weight distributions, this property makes it possible to avoid using Dickson's Theorem [24,Chapter 15] to choose an appropriate representation of the symplectic form. The correspondence between classical and quantum worlds simplifies the calculation (of the weight distribution) given in [24] significantly. In order to demonstrate this simplicity, we provide the proof of the weight distribution here. For most parts of the proof, we only need a brief description of the Kerdock set, Kerdock code, and the Gray map. See Section IV for formal definitions, constructions, and results used in the following proof.
In [27], the Kerdock set P K (m) is defined to be a collection of N binary m × m symmetric matrices that is characterized by the following properties: it is closed under binary addition, and if P, Q ∈ P K (m) are distinct, then P + Q is non-singular. The codewords of the length-N Z 4 -linear Kerdock code K(m) can be expressed as [xP x T + 2wx T + κ] (mod 4), where x ∈ F m 2 chooses the symbol index in a codeword, and the codeword is determined by the choice of w ∈ F m 2 , P ∈ P K (m) and κ ∈ Z 4 = {0, 1, 2, 3}. One can obtain complex vectors of quaternary phases {1, ı, −1, −ı} by raising ı = √ −1 to the integer powers in the (Z 4 -valued) codeword vector. We will refer to this operation as exponentiating the codeword by ı. The Gray map is an isometry from (length-N vectors of quaternary phases, Euclidean metric) to (Z 2N 2 , Hamming metric) defined by g (1) 00, g(ı) 01, g(−1) 11, and g(−ı) 10. Note that the domain of the map can equivalently be taken as Z 4 in which case the metric is the Lee metric (defined in Section IV-B). The codewords of the binary nonlinear Kerdock code of length 2 m+1 are obtained as Gray images of the Z 4 -valued codewords described above.
Theorem 1: Let m be odd. The weight distribution A i , i = 0, . . . , 2 m+1 of the classical binary Kerdock code of length 2 m+1 is as follows.
Proof: We explicitly use Lemma 10 and Corollary 16 to calculate the weight distribution. Fix a vector v of quaternary phases obtained by exponentiating a codeword in the Z 4 -linear Kerdock code. Consider any vector u of quaternary phases obtained by exponentiating a second codeword (Lemmas 11 and 15 consider κ 1 = κ 2 = 0 so that the eigenvalues are ±1 (and not in {±1, ±ı}), but we account for these factors here.) Let n j be the number of indices x ∈ F m 2 for which (c u ) x − (c v ) x = j, for j ∈ Z 4 . Since the Gray map preserves the Lee metric, the Hamming distance between the Gray images of c u and c v is d H (g(c u ), g(c v )) = n 1 + 2n 2 + n 3 . Since n 0 + n 1 + n 2 + n 3 = 2 m we simply have to relate n 0 and n 2 to obtain d H (g(c u ), g(c v )). Observe that u, v = (n 0 − n 2 ) + (n 1 − n 3 )ı. Lemma 10 implies (1) Now we observe three distinct cases for the codeword c u − c v . Note that there are 2 2m+2 codewords in K(m).
(i) P 1 = P 2 , w 1 = w 2 : If κ 1 − κ 2 = 0 then we have the all-zeros codeword, and if κ 1 − κ 2 = 2 then we have the all-ones codeword. However, if κ 1 − κ 2 ∈ {1, 3} then n 0 −n 2 = 0 and this determines two codewords of weight 2 m (more precisely, at distance 2 m from c v ). (ii) P 1 = P 2 , w 1 = w 2 : From Corollary 16, irrespective of κ 1 , κ 2 , we have u, v = 0, which implies n 0 − n 2 = 0 and hence the distance is 2 m . This determines another Since m is odd, and n j are non-negative integers, direct calculation shows that this means (n 0 − n 2 ) 2 = (n 1 − n 3 ) 2 = 2 m−1 and therefore n 0 −n 2 = ±2 (m−1)/2 . More formally, since the Gaussian integers Z[ı] are a unique factorization domain, we have (n 0 −n 2 )+(n 1 −n 3 )ı = (±1 ± ı)2 (m−1)/2 and this gives weights 2 m ± 2 (m−1)/2 . Thus, we have 2 2m+2 − 2 m+2 codewords remaining and it is easy to see that the signs occur equally often. Hence there are 2 2m+1 − 2 m+1 codewords of each weight. Lemma 11 shows that the (normalized) length-N vectors of quaternary phases obtained by exponentiating Kerdock, or more generally Delsarte-Goethals, codewords are common eigenvectors of maximal commutative subgroups of HW N . These eigenvectors are called stabilizer states in the quantum information literature [28] (also see end of Section III). They can equivalently be described as those quantum states obtainable by applying Clifford unitaries to the basis state |0 ⊗m = e 0 ⊗ · · · ⊗ e 0 = [1, 0, 0, . . . , 0] T [29]. Clifford elements act by conjugation on HW N , permuting the maximal commutative subgroups, and fixing the ensemble of stabilizer states (see Section V). The Clifford group is highly symmetric, and it approximates the full unitary group in a way that can be made precise by comparing irreducible representations [26], [30]. Kueng and Gross [31] have shown that the ensemble of stabilizer states is a complex projective 3-design; given a polynomial of degree at most 3, the integral over the N -sphere can be calculated by evaluating the polynomial at stabilizer states, and taking a finite sum. Stabilizer states also find application as measurements in the important classical problem of phase retrieval, where an unknown vector is to be recovered from the magnitudes of the measurements (see Kueng, Zhu and Gross [32]). A third application is unsourced multiple access, where there is a large number of devices (messages) each of which transmits (is transmitted) infrequently. This provides a model for machine-to-machine communication in the Internetof-Things (IoT), including the special case of radio-frequency identification (RFID), as well as neighbor discovery in ad-hoc wireless networks. Here, Thompson and Calderbank [33] have shown that stabilizer states associated with Delsarte-Goethals codes support a fast algorithm for unsourced multiple access that scales to 2 100 devices (arbitrary 100-bit messages). Section V constructs the N + 1 eigenbases (of N stabilizer states each) determined by the Kerdock code of length N over Z 4 , and shows that the corresponding maximal commutative subgroups partition the non-identity Hermitian Pauli matrices. The eigenbases are mutually unbiased, so that unit vectors u, v in different eigenbases satisfy | u, v | = N − 1 2 , and hence each eigenbasis looks like noise to the other eigenbases. The Kerdock ensemble of N (N + 1) complex lines is extremal; Calderbank et al. [34] have shown that any collection of unit vectors for which pairwise inner products have absolute value 0 or N − 1 2 has size at most N 2 + N , and that any extremal example must be a union of eigenbases. The group of Clifford symmetries of this ensemble, represented as binary symplectic matrices, is shown to be isomorphic to the projective special linear group PSL(2, N ), and hence its size is (N + 1)N (N − 1) = 2 3m − 2 m . We note that the Kerdock ensemble also appears in the work of Tirkkonen et al. [35].
Section VI defines a graph H N whose vertices are labeled by (scalar multiples of) all non-identity (Hermitian) Pauli matrices, where two matrices (vertices) are joined (by an edge) if and only if they commute. This graph is shown to be strongly regular; every vertex has the same degree, and the number of vertices joined to two given vertices depends only on whether the two vertices are joined or not joined. The automorphism group of this graph is the group of binary symplectic matrices Sp(2m, F 2 ). A subgroup of Cliff N containing HW N is proven to be Pauli mixing if it acts transitively on vertices, and Pauli 2-mixing if it acts transitively on edges and on non-edges. These properties imply that Pauli mixing ensembles are unitary 2-designs and Pauli 2-mixing ensembles are unitary 3-designs [12]. The Clifford symmetries of the Kerdock ensemble (of stabilizer states), again represented as symplectic matrices, are shown to be transitive on the vertices of H N and hence a unitary 2-design. Since the Clifford symmetries include all Hermitian Paulis, in addition to PSL(2, N ), the size of the Kerdock unitary 2design is N 5 −N 3 ≈ 2 5m , which almost saturates the bound by Gross et al. [13] discussed above. The next step is to translate these symmetry elements into circuits for, say, randomized benchmarking.
T. Can has developed an algorithm [36] that factors a 2m × 2m binary symplectic matrix into a product of at most 6 elementary symplectic matrices of the type shown in Table I. The target symplectic matrix maps the (Hadamard) dual basis ) (see Section III for notation) to a dual basis X ′ N , Z ′ N . Then, row and column operations by the elementary matrices return X ′ N , Z ′ N to the original pair X N , Z N thereby producing a decomposition of the target symplectic matrix.
Section VI uses this decomposition to simplify the translation of the Kerdock unitary 2-design into circuits. The elementary symplectic matrices appearing in the product can be related to the Bruhat decomposition of the symplectic group Sp(2m, F 2 ) (see [37]). When the algorithm is run in reverse it produces a random Clifford matrix that can serve as an approximation to a random unitary matrix. This is an instance of the subgroup algorithm [38] for generating uniform random variables. The algorithm has complexity O(m 3 ) and uses O(m 2 ) random bits, which is order optimal given the order of the symplectic group Sp(2m, F 2 ) (cf. [39]). We note that the problem of selecting a unitary matrix uniformly at random finds application in machine learning (see [40] and the references therein). The algorithm developed by Can is similar to that developed by Jones, Osipov and Rokhlin [41] in that it alternates (partial) Hadamard matrices and diagonal matrices; the difference is that the unitary 3-design property of the Clifford group [12] provides randomness guarantees.
Finally, Section VII constructs logical unitary 2-designs that can be applied in the logical randomized benchmarking protocol of Combes et al. [11]. In prior work [42], we have developed a mathematical framework for synthesizing all physical circuits that implement a logical Clifford operator (on the encoded qubits) for stabilizer codes (up to equivalence classes and ignoring stabilizer freedom). Circuit synthesis is enabled by representing the desired physical Clifford operator as a 2m × 2m binary symplectic matrix. For an [[m, m − k]] stabilizer code, every logical Clifford operator is shown to have 2 k(k+1)/2 symplectic solutions, and these are enumerated efficiently using symplectic transvections, thus enabling optimization with respect to a suitable metric. See https://github.com/nrenga/symplectic-arxiv18a for implementations.
It is now well-known that different codes yield efficient (e.g., low-depth) implementations of different logical operators. However, computing environments can change dynamically so that qubits or qubit links might have varying fidelity, and thus low-depth alone might not be desirable. Under such circumstances it is necessary to leverage all degrees of freedom in implementing a logical operator, and a compiler might use the above framework for this purpose. More generally, a compiler might usefully switch between several codes [43] dynamically, depending on the state of the system. Then this algorithm enables the compiler to be able to determine logical operators for a code quickly depending on the user-input circuit (on the protected qubits).
Section VII provides a proof of concept implementation of the Kerdock unitary 2-design on the protected (logical) qubits of the [ [6,4,2]] CSS code using the above logical Clifford synthesis algorithm. The logical randomized benchmarking protocol requires a unitary 2-design on the logical qubits, and Combes et al. use the full Clifford group for this purpose, which is much larger than the Kerdock design as shown above.
In summary, the purpose of this paper is to emphasize that interactions between the classical and quantum domains still prove mutually beneficial, as much as they helped inspire the first QECC more than two decades back. Specifically, we make four main theoretical contributions: 1) Use of quantum concepts to simplify the calculation of classical weight distributions of several families of nonlinear binary codes [24], [44]- [50]. 2) Elementary description of symmetries of the Kerdock code, and the N 2 + N stabilizer states determined by this code [27], [33], [35], [51].
3) Demonstration that the symmetry group of the Kerdock code is a unitary 2-design and that sampling from it is straightforward. Introduction of elementary methods for translation to circuits without using ancillary qubits. 4) Provide a proof of concept construction for unitary 2designs on the logical qubits of a stabilizer code [11], [42]. We also provide software implementations of all algorithms, at https://github.com/nrenga/symplectic-arxiv18a. Using this utility, we provide empirical estimates of the gate complexity for circuits obtained from the Kerdock design. We believe this paves the way for employing this design in several applications, specifically in randomized benchmarking [10], [52].

III. THE HEISENBERG-WEYL AND CLIFFORD GROUPS
Quantum error-correcting codes serve to protect qubits involved in quantum computation, and this section summarizes the mathematical framework introduced in [5], [7], [8], [53], and described more completely in [54] and [42]. In this framework for fault-tolerant quantum computation, Clifford operators on the N -dimensional complex space afforded by m qubits are represented as 2m×2m binary symplectic matrices. This is an exponential reduction in size, and the symplectic matrices serve as a binary control plane for the quantum computer.
Remark 2: Throughout the paper, we adopt the convention that all binary vectors are row vectors, and Z 4 -, real-or complex-valued vectors are column vectors, where Z 4 is the ring of integers modulo 4. The values ı κ , where ı √ −1, κ ∈ Z 4 , are called quaternary phases.
A single qubit is a 2-dimensional Hilbert space, and a quantum state v is a superposition of the two states e 0 [1, 0] T , e 1 [0, 1] T which form the computational basis.
Given row vectors a, b ∈ F m 2 define the m-fold Kronecker product (4) where U N denotes the group of all N × N unitary operators. The Heisenberg-Weyl group HW N (also called the m-qubit Pauli group) consists of all operators The standard symplectic inner product in F 2m 2 is defined as where the symplectic form Ω 0 I m I m 0 (see [7], [42]).
has kernel ıI N and allows us to represent elements of HW N (up to multiplication by scalars) as binary vectors. The Clifford group Cliff N consists of all unitary matrices g ∈ C N ×N for which gD(a, b)g † ∈ HW N for all D(a, b) ∈ HW N , where g † is the Hermitian transpose of g [54]. Cliff N is the normalizer of HW N in the unitary group U N . The Clifford group contains HW N and its size is |Cliff N | = 2 m 2 +2m m j=1 (4 j − 1) (up to scalars e 2πıθ , θ ∈ R) [7]. We regard operators in Cliff N as physical operators acting on quantum states in C N , to be implemented by quantum circuits. Every operator g ∈ Cliff N induces an automorphism of HW N by conjugation. Note that the inner automorphisms induced by matrices in HW N preserve every conjugacy class {±D(a, b)} and {±ıD(a, b)}, because (5) implies that elements in HW N either commute or anti-commute. Matrices D(a, b) are symmetric or anti-symmetric according as ab T = 0 or 1, hence the matrix is Hermitian. Note that E(a, b) 2 = I N . The automorphism induced by a Clifford element g satisfies is a 2m × 2m binary matrix that preserves symplectic inner products: Hence F g is called a binary symplectic matrix and the symplectic property reduces to F g ΩF T g = Ω, or equivalently (See [57] for an extensive discussion on general symplectic geometry and quantum mechanics.) The symplectic property encodes the fact that the automorphism induced by g must respect commutativity in HW N . Let Sp(2m, F 2 ) denote the group of symplectic 2m × 2m matrices over F 2 . The map φ : is a homomorphism with kernel HW N , and every Clifford operator projects onto a symplectic matrix F g . Thus, HW N is a normal subgroup of Cliff N and Cliff N /HW N ∼ = Sp(2m, F 2 ). This implies that the size is |Sp(2m, The number of 1s in Q and P directly relates to number of gates involved in the circuit realizing the respective unitary operators (see [42,Appendix I]). The N coordinates are indexed by binary vectors v ∈ F m 2 , and ev denotes the standard basis vector in C N with an entry 1 in position v and all other entries 0. Here H 2 t denotes the Walsh-Hadamard matrix of size (also see [7]). project onto the ±1 eigenspaces of E(a, b), respectively. Remark 3: Since all elements of S are unitary, Hermitian and commute with each other, they can be diagonalized simultaneously with respect to a common orthonormal basis, and their eigenvalues are ±1 with algebraic multiplicity N/2. We refer to such a basis as the common eigenbasis or simply eigenspace of the subgroup S, and to the subspace of eigenvectors with eigenvalue +1 as the +1 eigenspace of S.
If the subgroup S is generated by E(a i , b i ), i = 1, . . . , k, then the operator projects onto the 2 m−k -dimensional subspace V (S) fixed pointwise by S, i.e., the +1 eigenspace of S. The subspace V (S) is the stabilizer code determined by S. We use the notation [[m, m−k]] code to represent that V (S) encodes m−k logical qubits into m physical qubits. Let γ(S) denote the subspace of F 2m 2 formed by the binary representations of the elements of S using the homomorphism γ in (7). A generator matrix for γ(S) is projects onto V (S ǫ1···ǫ k ), and that Hence the subspaces V (S ǫ1···ǫ k ), or equivalently the subgroups S ǫ1···ǫ k , provide a resolution of the identity, and elements (errors) in HW N simply permute these subspaces (under conjugation).
Given an [[m, m − k]] stabilizer code, it is possible to perform encoded quantum computation in any of the subspaces V (S ǫ1···ǫ k ) by synthesizing appropriate logical Clifford operators (see [42] for algorithms). If we think of these subspaces as threads, then a computation starts in one thread and jumps to another when an error (from HW N ) occurs. Quantum errorcorrecting codes enable error control by identifying the jump that the computation has made. Identification makes it possible to modify the computation in flight instead of returning to the initial subspace and restarting the computation. The idea of tracing these threads is called as Pauli frame tracking in the literature (see [58] and references therein).
A stabilizer group S defined by k = m generators is called a maximal commutative subgroup of HW N and γ(S) is called a maximal isotropic subspace of F 2m 2 . The generator matrix G S has rank m and can be row-reduced to We will denote these subgroups as E([0 | I m ]) and E([I m | P ]), respectively. The condition G S ΩG T S = 0 implies P = P T , and any element of γ(S) can be expressed in the form [a, aP ] for some a ∈ F m 2 .
Since dim V (S) = 2 m−m = 1, the subgroup S fixes exactly one vector. The N eigenvectors in an orthonormal eigenbasis for S are defined up to an overall phase and called stabilizer states [28], [29]. The number of non-zero entries in a stabilizer state is determined by the intersection of S with Z N [59].

IV. WEIGHT DISTRIBUTIONS OF KERDOCK CODES
Kerdock codes were first constructed as non-linear binary codes [45], as was the Goethals code [47] and the Delsarte-Goethals codes [49]. In this section, we describe the Kerdock and Delsarte-Goethals codes as linear codes over Z 4 , the ring of integers modulo 4. These Z 4 -linear codes were constructed by Hammons et al. [25] as Hensel lifts of binary cyclic codes, and this description requires Galois rings. The description given in Section IV-A requires finite field arithmetic, but is entirely binary and follows [27]. Our construction of unitary 2-designs in Section VI uses the matrices that are defined in Section IV-A. In Section IV-B, we make a connection between the Kerdock and Delsarte-Goethals codes and maximal commutative subgroups of HW N via stabilizer states, use this relation to compute inner products between stabilizer states, and hence calculate weight distributions of Kerdock codes.

A. Kerdock and Delsarte-Goethals Sets [27]
The finite field F 2 m is obtained from the binary field F 2 by adjoining a root α of a primitive irreducible polynomial p(x) of degree m [60]. The elements of F 2 m are polynomials in α of degree at most m − 1, with coefficients in F 2 , and we will identify the polynomial z 0 + z 1 α + . . . + z m−1 α m−1 with the binary (row) vector [z 0 , z 1 , . . . , z m−1 ].
The Frobenius map f : F 2 m → F 2 m is defined by f (x) x 2 , and the trace map Tr : F 2 m → F 2 is defined by Since (x + y) 2 = x 2 + y 2 for all x, y ∈ F 2 m , the trace is linear over F 2 . The trace inner product x, y tr = Tr(xy) defines a symmetric bilinear form, so there exists a binary symmetric matrix W for which Tr(xy) = xW y T . In fact The matrix W is non-singular since the trace inner product is non-degenerate (if Tr(xz) = 0 for all z ∈ F 2 m then x = 0).
The Frobenius map f (x) = x 2 is linear over F 2 , so there exists a binary matrix R for which f (x) ≡ xR. Since the rows of R are the vectors representing the field elements α 2i , i = 0, . . . , m − 1. Note that square roots exist for all elements of F 2 m since R is invertible. We write multiplication by z ∈ F 2 m as a linear transformation xz ≡ xA z . For z = 0, A 0 = 0, and for z = α i the matrix A z = A i for i = 0, 1, . . . , 2 m − 2, where A is the matrix that represents multiplication by the primitive element α. The matrix A is the companion matrix of the primitive irreducible polynomial p(x) = p 0 + p 1 x + . . . + p m−1 x m−1 + x m over the binary field. Thus and we have chosen A rather than A T as the companion matrix since we are representing field elements in F 2 m by row vectors (rather than column vectors).

Lemma 4:
The matrices A z , W , and R i , for i ∈ [m], satisfy: Proof: Identities (a) through (d) follow directly from the arithmetic of F 2 m . Specifically, for (c), observe that (xA z )W y T = Tr((xz)y) = Tr(x(yz)) = xW (yA z ) T , and (d) can be proven similarly. To prove part (e) we observe Tr(x) = Tr(x 2 ) and verify that for all x, y ∈ F 2 m , Definition 5: For 0 ≤ r ≤ (m − 1)/2 and for z = (z 0 , z 1 , . . . , z r ) ∈ F r+1 2 m define the bilinear form β z,r (x, y) Tr[z 0 xy + z 1 (x 2 y + xy 2 ) + . . . + z r (x 2 r y + xy 2 r )]. Note that β z,r (x, y) is represented by the binary symmetric matrix The Delsarte-Goethals set P DG (m, r) consists of all such matrices P z,r . The Kerdock set P K (m) P DG (m, 0) consists of all matrices P z P z,0 , where z = (z), z ∈ F 2 m . Lemma 6: The Delsarte-Goethals set P DG (m, r) is an m(r+ 1)-dimensional vector space of symmetric matrices. If z = 0 then rank(P z,r ) ≥ m−2r. Matrices in the Kerdock set P K (m) are non-singular.
Remark 7: Note that since the dimension of the vector space of all binary m × m symmetric matrices is m(m + 1)/2, the set P DG (m, (m − 1)/2) contains all possible symmetric matrices. For the remainder of this paper we represent a general symmetric matrix as simply P , thereby dropping the subscripts z, r unless necessary. We will continue to represent Kerdock matrices as P z .

B. Delsarte-Goethals Codes and Weight Distributions
Hammons et al. [25] showed that the classical nonlinear Kerdock and Delsarte-Goethals codes, defined by quadratic forms in [45], [48], are images of linear codes over Z 4 under the Gray map. In this section, we begin by reviewing this construction using the Kerdock and Delsarte-Goethals sets of matrices, and demonstrate that exponentiating these Z 4valued codewords entry-wise by ı produces stabilizer states. For stabilizer states of E([I m | P z 1 ,r ]) and E([I m | P z 2 ,r ]), we calculate their Hermitian inner products using the trace of certain projection operators, and show that the distribution of inner products depends only on rank(P z 1 ,r + P z 2 ,r ). Then, since rank(P z ) ∈ {0, m} for all P z ∈ P K (m), we compute the weight distribution of Kerdock codes by relating these Hermitian inner products to the histogram of values in the difference between two Z 4 -valued codewords. In order to calculate the weight distribution of Delsarte-Goethals codes, we would need to determine the distribution of ranks in the Delsarte-Geothals sets P DG (m, r). While this question is straightforward for P K (m), it remains open for general P DG (m, r) and will be investigated in future work.
Definition 8: The Z 4 -linear Delsarte-Goethals code is given by Here the notation [xP x T + 2wx T + κ] x∈F m 2 represents a Z 4 -valued column vector with each entry xP x T + 2wx T + κ (mod 4) indexed by the vector x ∈ F m 2 . Definition 9: For u, v ∈ Z N 4 the Lee weight of u is defined as w L (u) n 1 (u) + 2n 2 (u) + n 3 (u), where n κ (u) denotes the number of entries of u with value κ, and the Lee distance (between u and v) is defined as d L (u, v) w L (u − v). Figure 1 defines the Gray map which assigns integers modulo 4 (or quaternary phases) to binary pairs (see Remark 2 for details). For a vector, the map is applied to each entry and concatenated row-wise to return a row vector, thereby adhering to our convention for binary vectors (see Remark 2). The shortest distance around the circle defines the Lee metric on Z N 4 and Gray encoding is an isometry from (Z N 4 , Lee metric) to (Z 2N 2 , Hamming metric). However, since g(1 + 3) = g(1) + g(3), the Gray map is non-linear. Hence the binary Kerdock and Delsarte-Goethals codes obtained by Gray-mapping the codewords in K(m) and DG(m, r), respectively, are non-linear (see [50,Chapter 12]).  The Gray map is also a scaled isometry from (length-N vectors of quaternary phases, squared Euclidean metric) to (Z 2N 2 , Hamming metric). Note that for this set of quaternary phases, squared Euclidean distance is indeed a metric. This is formalized in the following lemma.
Lemma 10: Let u, v ∈ C N be two length-N vectors of quaternary phases. Then where d H denotes the Hamming distance. Next, we prove a lemma establishing the relation between DG(m, r) and the common eigenspace of E([I m | P ]) determined by a binary symmetric matrix P (see Remark 7). Note that we denote the maximal commutative subgroup determined by the rows of [I m | P ] as E([I m | P ]), and that we do not normalize eigenvectors (stabilizer states) in this section, since the Gray map needs to be applied to quaternary phases.
Lemma 11: Given a binary symmetric matrix P , the (column) vectors [ı xP x T +2wx T ] x∈F m 2 are common eigenvectors of the maximal commutative subgroup E([I m | P ]). Each eigenvector has Euclidean length √ N = 2 m/2 . Proof: It is possible to prove this result by direct calculation, i.e., by calculating E(a, aP ) · [ı xP x T +2wx T ] x∈F m 2 for some a ∈ F m 2 , but the following argument uses the mathematical framework described in Section III. Note that where e x denotes the standard basis vector in C N with a 1 in the position x and 0 elsewhere.  Table I). Hence conjugation by t P maps E([I m | 0]) to E([I m | P ]), i.e., t P E(a, 0)t † P = E(a, aP ), and so the common eigenvectors of E([I m | P ]) are It is easily verified that for any a ∈ F m 2 ,

Now we have the following important observation. Given
Lemma 12: There is a 1-N correspondence between maximal commutative subgroups of HW N and stabilizer states. Proof: If v is a stabilizer state then S v is a maximal commutative subgroup of HW N .
Remark 13: Any stabilizer state of a maximal commutative subgroup of HW N disjoint from Z N can be obtained by exponentiating Delsarte-Goethals codewords, and multiplying the quaternary phase vector by N − 1 2 . The maximal commutative subgroups E([I m | P z ]) determined by the Kerdock matrices P z intersect trivially. Together with Z N = E([0 | I m ]), they partition all (N 2 − 1) non-identity Hermitian Pauli matrices. Hence, given a non-identity Hermitian Pauli matrix E(a, b), it follows that there is a sign ǫ ∈ {±1} such that ǫE(a, b) is in one of the N + 1 subgroups determined by all P z ∈ P K (m) and Z N . Therefore, stabilizer states connect the classical world of Kerdock and Delsarte-Goethals codes and the quantum world of maximal commutative subgroups of HW N . This synergy has proven successful in several applications [27], [31]- [33], [35], [51] and our construction of a unitary 2-design here, from stabilizer states, is yet another instance.
Remark 14: Note that in Lemma 11 we only considered κ = 0 while exponentiating codewords c u ∈ DG(m, r). This is to ensure that the resulting eigenvector corresponds to a ±1 eigenvalue (and not a value in {±1, ±ı}). However, Theorem 1 considers all κ ∈ Z 4 while calculating the weight distribution.
Given P ∈ P DG (m, r), we scale the common eigenvectors of E([I m | P ]) by √ N to obtain a set V (P ) of length-N vectors of quaternary phases. (Note the similarity to the notation V (S) used in Section III, and observe that here we consider all eigenvectors, albeit unnormalized, and not just the +1 eigenspace.) Therefore, if we can compute the Hermitian inner products between these unnormalized stabilizer states then we can use Lemma 10 to calculate the weight distribution of Kerdock and Delsarte-Goethals codes. Note that despite being non-linear codes the weight and distance distributions of these codes coincide, as shown in [24, Chapter 15] (which follows from Z 4 -linearity and Gray isometry).
Lemma 15: Let P 1 , P 2 ∈ P DG (m, r) be distinct. Fix v ∈ V (P 2 ) and let u run through V (P 1 ). If rank(P 1 + P 2 ) = k then | u, v | 2 = 2 2m−k for 2 k eigenvectors u, 0 for 2 m − 2 k eigenvectors u. Since v is fixed, using (14), there are fixed f i , t j ∈ {±1} such that and since the only constraint for u is to be from V (P 1 ), where e i , s i ∈ {±1} are variable. Since | u, v | 2 = Tr(uu † vv † ) it only remains to calculate Tr(uu † vv † ). If e i = f i ∀ i, then so that Expanding the right hand side, the only term with nonzero trace is the identity with trace 2 m . Hence in this case Tr(uu † vv † ) = 2 2m−k . The k eigenvalues s j can be freely chosen, so there are 2 k eigenvectors in this case.
If e i = f i for some i, then and Tr(uu † vv † ) = 0. There are 2 m − 2 k such eigenvectors. Finally, if k = m then Tr(uu † vv † ) = Tr(I N ) = 2 m ∀ u. Corollary 16: For P 1 , P 2 ∈ P K (m), since rank(P 1 + P 2 ) ∈ {0, m} the inner products are This result is the primary tool that allowed us to simplify the derivation of the weight distribution of Kerdock codes in Theorem 1. Note that Theorem 1 is the only result in this section that is restricted to Kerdock codes but not general Delsarte-Goethals codes (and requires m to be odd).

V. MUTUALLY UNBIASED BASES FROM P K (m)
In this section, we will organize the columns of I N (i.e., the common eigenbasis of Z N ) and all stabilizer states determined by P z ∈ P K (m) into a matrix to form mutually unbiased bases, and analyze its symmetries. This symmetry group will eventually lead to the construction of the unitary 2-design. We first state a result that holds for stabilizer states determined by matrices from general Delsarte-Goethals sets.
Definition 17: Given a collection M of unit vectors in C N (Grassmannian lines) the chordal distance chor(S) is given by It follows from Lemma 15 that the Delsarte-Goethals set P DG (m, r) determines 2 m(r+2) complex lines (stabilizer states) in C N with chordal distance √ 1 − 2 −(m−2r) (cf. [61]). Definition 18: Two N ×N unitary matrices U and V are said to be mutually unbiased if | u, v | = N − 1 2 for all columns u of U , and all columns v of V . Each matrix is interpreted as an orthonormal basis and collections of such unitary matrices that are pairwise mutually unbiased are called mutually unbiased bases (MUBs). Vectors in each orthonormal basis look like noise to the other bases (due to the small inner product).
Corollary 16, when applied to normalized eigenvectors, shows that the N eigenbases determined by the Kerdock set P K (m) are mutually unbiased (also see Remark 13). Let B K (m) denote the collection of these N eigenbases (of E([I m | P ]) for all P ∈ P K (m)) along with the eigenbasis ). This is a set of N + 1 mutually unbiased bases and they determine an ensemble of N (N + 1) complex lines (stabilizer states) that is extremal [34]. In this section, we provide an elementary description of their group of Clifford symmetries.

A. The Kerdock MUBs
Recollect from Section IV-A that the Kerdock matrices are P z = A z W , where W is a symmetric Hankel matrix with binary entries that satisfies Tr(xy) = xW y T and A z represents multiplication by z, both in F 2 m . Using the result of Lemma 11, define N mutually unbiased bases where is a maximal collection of mutually unbiased bases [34].

B. Symmetries of Kerdock MUBs
Let M be the N × N (N + 1) matrix given by Note that M ∞ = I N and M 0 = H N . Definition 19: A symmetry of M is a pair (U, G) such that U M G = M , where U is an N × N unitary matrix, and G is a generalized permutation matrix, i.e., G = ΠD where Π is a permutation matrix and D is a diagonal matrix of quaternary phases.
Observe that for any such symmetry, G can undo the action of U if and only if U induces a (generalized) permutation on the columns of M . Moreover, since U is unitary it has to preserve inner products, so Corollary 16 implies that U can only permute the bases M z and permute columns within each basis, or equivalently permute the corresponding maximal commutative subgroups and permute elements within each subgroup, respectively, by conjugation.
Lemma 20: For any symmetry (U, G) of M , the unitary matrix U is an element of the Clifford group Cliff N .
Proof: A Pauli matrix E(a, b) ∈ E([I m | P z ]) that fixes M z can be written as E(a, b) = v∈Mz ǫ v vv † , where ǫ v = ±1 for all v. Since U permutes the eigenbases M z , it follows that U v ∈ M z ′ , for some z ′ ∈ F 2 m ∪ {∞}, is fixed by U E(a, b)U † which must again be a Pauli matrix. Hence U is a Clifford element.
We first observe the symmetries induced by elements of HW N .
The projective linear group PΓL(2, 2 m ) is the group of all transformations Now we analyze the symmetries induced by elements of the binary symplectic group Sp(2m, F 2 ).
2) Clifford Symmetries of M : The group PSL(2, 2 m ) is generated by the transformations z → z + x, z → zx, and z → 1/z. The group PΓL(2, 2 m ) is PSL(2, 2 m ) enlarged by the Frobenius automorphisms z → z 2 −i ≡ zR −i discussed in Section IV-A. We realize each of these transformations as a symmetry of M . We recall that A z W A T z = A 2 z W from part (c) of Lemma 4, and for convenience we work with maximal commutative subgroups E([I m | A 2 z W ]), i.e., the Kerdock matrices are P z = A 2 z W . Note that every field element β ∈ F 2 m is a square, so this is equivalent to Note that if we start with z = 0, i.e., the subgroup Let P K,m be the group of symplectic transformations generated by (i), (ii) and (iii) above, and let P * K,m be the group P K,m enlarged by the generators (iv). Thus, using notation in Table I, we have Although T 2 W = I 2m , in the unitary group we have t 2 W = E(0, d W ). Therefore the corresponding Clifford elements will generate a group larger than PSL(2, 2 m ) and PΓL(2, 2 m ). Each symplectic matrix in the above groups can be transformed into a quantum circuit (or simply a unitary matrix) by expressing it as a product of standard symplectic matrices from Table I (see [42, Section II]).
Remark 22: Note that Ω / ∈ P K,m but ΩL W −1 ∈ P K,m , which means H N does not permute columns of M but H N ℓ W −1 does. Hence, for example, to map [0, a] to [a, 0] one sequence would be ( This does not force A −1 b = W . Lemma 23: Any element of P K,m can be described as a product of at most 4 basis symplectic matrices given in Section V-B2.
Proof: Using the results in this Section, a general block It can be verified that the above is a valid symplectic matrix and satisfies all conditions in (10). We now show that this matrix can be decomposed as a product of 4 basis matrices.
We use the results in Lemma 4 and observe the following: ; Hence we set x c, w a c , y d c so that wxy + x −1 = ad+1 c = b and the resultant matrix matches the general symplectic matrix given above.
Corollary 24: Let a, b, c, d ∈ F 2 m be such that ad + bc = 1. The isomorphism τ : PSL(2, 2 m ) → P K,m can be defined as Observe that this provides a systematic procedure to sample from the group P K,m . By choosing α, β, δ ∈ F 2 m uniformly at random, a symmetry element can be constructed as The first two factors provide transitivity on the Hermitian matrices of all maximal commutative subgroups except Z N = E([0 | I m ]), and the last factor enables exchanging any Lemma 31). We complete this section by observing that the symmetry group can be enlarged by including the Frobenius automorphisms R from Section IV-A.
Lemma 25: An arbitrary element from P * K,m specified by a, b, c, d ∈ F 2 m and i ∈ {0, . . . , m − 1} takes the form with ad + bc = 1, and realizes the block permutation Proof: See Appendix A.

VI. UNITARY 2-DESIGNS FROM THE KERDOCK MUBS
In this section, we show that the unitary transformations determined by P K,m , along with Pauli matrices D(a, b) ∈ HW N , form a unitary 2-design. We first define a graph on Pauli matrices, where Clifford elements act as graph automorphisms. We then show that a group of automorphisms that acts transitively on vertices forms a unitary 2-design. Finally we show that a group of automorphisms that acts transitively on vertices, on edges, and on non-edges forms a unitary 3-design. To see that Aut(H N ) = Sp(2m, F 2 ), determine a symplectic matrix to reduce an arbitrary graph automorphism to an automorphism π that fixes [e i , 0], [0, e i ], i = 1, . . . , m, then show that π fixes every vertex. This essentially amounts to solving for a symplectic matrix satisfying a linear system. Definition 28 ([62,Def. 2.4]): A strongly regular graph with parameters (n, t, λ, µ) is a graph with n vertices, where each vertex has degree t, and where the number of vertices joined to a pair of distinct vertices x, y is λ or µ according as x, y are joined or not joined respectively.
Lemma 29: The Heisenberg-Weyl graph H N is strongly regular with parameters  Proof: Part (a) is well-known in symplectic geometry, and can also be proven by direct calculation using symplectic matrices.
(b) Since P K,m acts transitively on maximal commutative subgroups E([0 | I m ]), E([I m | P z ]), z ∈ F 2 m (see (34) and (36)), we need only show that P K,m is transitive on a particular subgroup, say E([I m | 0]). If a, b ∈ F 2 m then there exists c ∈ F 2 m such that b = ac, and it follows from (35) that the symplectic matrix Remark 32: The groups P K,m and P * K,m are not transitive on edges of H N because they cannot mix type-1 and type-2 edges.
Definition 33 ([12] [63,Chap. 7]): Let k be a positive integer. An ensemble E = {p i , U i } n i=1 , where the unitary matrix U i is selected with probability p i , is said to be a unitary k-design if for all linear operators X ∈ (C N ) ⊗k where η(·) denotes the Haar measure on the unitary group U N . The linear transformations determined by each side of (45) are called k-fold twirls. A unitary k-design is defined by the property that the ensemble twirl coincides with the full unitary twirl.
We define the Kerdock twirl to be the linear transformation of (C N ) ⊗2 determined by the uniformly weighted ensemble consisting of φ −1 (P K,m ) along with Pauli matrices D(a, b), where φ : Cliff N /HW N → Sp(2m, F 2 ) (from Section III). Similarly, we define the 2-fold action (in (45)) of the ensemble determined by P * K,m as the enlarged Kerdock twirl. Definition 34: Proof: Transitivity means a single orbit so that random sampling from G results in the uniform distribution on vertices, edges, or non-edges. Hence transitivity on vertices implies E is Pauli mixing and transitivity on vertices, edges and non-edges implies E is Pauli 2-mixing. It now follows from [12] or [17] that Pauli mixing (resp. Pauli 2-mixing) implies E is a unitary 2-design (resp. unitary 3-design). Sampling uniformly from the groups P K,m can be achieved using the systematic procedure shown in (41). The resultant symplectic matrix can be transformed into a quantum circuit (or simply a unitary matrix) by expressing it as a product of standard symplectic matrices from Table I (see [42, Section II]). Although our unitary 2-design is equivalent to that discovered by Cleve et al. [17], the methods we use to translate design elements to circuits are very different and much simpler. While they use sophisticated methods from finite fields to propose a circuit translation that is tailored for the design, our algorithm from [36] (whose details are discussed in [  source implementation 1 allows one to construct the design for a specified number of qubits, and we use this utility to calculate worst-case gate complexities on up to 16 qubits. In our sampling procedure (41) we have three elementary forms T AαW , L A β , and Ω, which translate to phase and controlled-Z gates, permutations and controlled-NOT gates, and Hadamard gates on all qubits, respectively (see [42, Appendix I]). Note that L W −1 has the same elementary form as L A β , although W is fixed for a given m. The Hadamard gates add only O(m) complexity. Figures 2, 3, and 4 plot the worst-case complexities of the gates T AαW , L A β , and L W −1 obtained using our procedure. The only form that seems to grow faster than O(m log m log log m) is L A β , and we are currently investigating methods to calculate this gate complexity via analytical arguments that leverage results in the classical computation literature. A curious data point is m = 15 in Fig. 4, where the matrix W has zeros everywhere except the anti-diagonal, which translates to a single permutation of the qubits. Since the decomposition in (41) involves a constant number of factors, the overall complexity is that of the factor with largest order term. We will also investigate if our circuits can always be organized to give a depth of O(log m) just as Cleve et al.
Hence, we have provided an alternative perspective to the quantum unitary 2-design discovered by Cleve et al. by establishing a connection to classical Kerdock codes, and simplified the description of the design as well as its translation to circuits. Since we also appear to achieve competetive Clifford-gate-complexities, and provide implementations for our methods, we believe this paves the way for employing this 2-design in several applications, specifically in randomized benchmarking [10], [52].

VII. LOGICAL UNITARY 2-DESIGNS
In this section, we apply our synthesis algorithm [42] to logical randomized benchmarking, which was recently proposed by Combes et al. [11] as a more precise protocol to reliably  estimate performance metrics for an error correction implementation, as compared to the standard approach of physical randomized benchmarking. Using this procedure, they are able to quantify the effects of imperfect logical gates, crosstalk, and correlated errors, which are typically ignored. They use the full logical Clifford group to perform benchmarking as this group forms a (logical) unitary 2-design (as well as 3-design). Our construction can be used to implement their protocol with a much smaller 2-design (P K,m ) and our synthesis algorithm can be used to realize the design at the logical level.
Consider F 16 constructed by adjoining to F 2 a root α of the primitive polynomial p(x) = x 4 + x + 1. Consider the element F abcd in P K,4 identified by the tuple (a = α 3 , b = α 8 , c = α 7 , d = 0), or equivalently (a, b, c, d, i = 0) in P * K,4 . In this case the matrices defined in Section IV-A are Then, using the isomorphism in Corollary 24 and the direct form in Lemma 23, we can express the element in P K,4 as Using the explicit decomposition in (49), we map the elementary symplectic matrices to standard Clifford gates (as discussed in [42]) and get the following circuit (CKT1  [3,4] Here the indices corresponding to 'Permute' imply the cycle permutation (1432), i.e., the first qubit has been replaced by the fourth, the fourth by the third, the third by the second, and the second by the first. (Note that we do not simplify circuits to their optimal form here but simply report the results of our synthesis algorithm.) An alternative procedure is to directly input the final symplectic matrix (51) to the symplectic decomposition algorithm in [36] (also see [42, Section II]), yielding the following circuit (CKT2  [3,4] The difference in depth of the two circuits is very small in this case, but we found that for about half of the elements in P K,4 the explicit form in Corollary 24 had smaller depth, while for those remaining, the direct decomposition was better.
Next we translate this logical circuit into its physical implementation for the [[6, 4, 2]] CSS code. We apply our synthesis algorithm [42], which can be summarized as follows.
1) Compute the action of either of the above circuits on the Pauli matrices X i , Z i , for i = 1, 2, 3, 4, under conjugation, i.e., compute gE(e i , 0)g † , gE(0, e i )g † where g represents the circuit. 2) Translate these into logical constraints on the desired physical circuitḡ ∈ Cliff 2 6 by interpreting X i , Z i above as their logical equivalentsX i ,Z i ∈ HW 2 6 . 3) Rewrite the above conditions as linear constraints on the desired symplectic matrix Fḡ using (9). Add constraints to normalize (or just centralize) the stabilizer S. 4) Solve for all symplectic solutions, compute their corresponding circuits and identify the best solution in terms of smallest depth, with respect to the decomposition in [36] (also discussed in [42, Section II]). 5) Verify the constraints imposed in step 2 and check for any sign violations (due to signs in (9)). In case of violations, identify a Pauli matrix to fix the signs. Using this algorithm, we computed the circuit with smallest depth (relative to other solutions decomposed using the same algorithm) and obtained the following solution (CKT3).  LEMMA 25 We proceed as in the proof of Lemma 23 to derive the general form of an element in P * K,m . Introducing the new generators L R −i , and using identities from Lemma 4, we calculate ; In this case the relations between a, b, c, d and x, y, z, w that will yield the desired map are unclear. Hence, we first determine the transformation on [I m | A 2 z W ] in terms of x, y, z and w. Again, we repeatedly invoke identities from Lemma 4.
, where we have simplified the last term as W. Now we have the following simplifications for the three terms.
Applying this back we get Now we define x c, w a c and y d c . Then we get Hence we have proved that F performs the permutation We note that the above definitions for x, w, y also satisfy the special case of i = 0 that corresponds to the proof in Lemma 23. We now substitute these back in F and observe the following simplifications.
T . These imply that the general form of an element in P * K,m is