A Hybrid Quantum–Classical Algorithm for k-SAT via Grover-Enhanced Local Search

1. Introduction

The k-SAT problem ($k\ge 3$) is a canonical NP-complete problem [1], and no polynomial-time algorithm for it is known. Classical algorithms for k-SAT fall broadly into two categories: deterministic and probabilistic. Deterministic approaches typically rely on divide-and-conquer, exhaustive search, or backtracking, while probabilistic methods often employ local search heuristics. The worst-case time complexity of state-of-the-art algorithms in both categories is generally $O\left({\alpha }^n\right)$, where n is the number of Boolean variables and $\alpha >1$ is a constant base. Since a smaller $\alpha$ implies lower computational complexity, much research [2,3,4] has focused on minimizing this exponential base.

On the probabilistic side, Paturi, Pudlák, and Zane [2] introduced the PPZ algorithm in 1997, achieving a randomized upper bound significantly below $2^n$. Schöning [3] subsequently proposed a simple local search algorithm with expected running time ${\left(2(1-1/k)\right)}^n$, yielding $O\left({(4/3)}^n\right)$, which improved upon the earlier PPZ bound of Ref. [2]. Hofmeister et al. [5] later refined Schöning’s approach, reducing the 3-SAT complexity to $O(1.{3302}^n)$. Meanwhile, Paturi et al. [6] enhanced the original PPZ framework into the PPSZ algorithm, achieving $O(1.{308}^n)$ for unique 3-SAT (the variant with exactly one satisfying assignment). Hertli [7] subsequently extended this analysis, proving that the PPSZ bound under the uniqueness assumption applies equally to general 3-SAT. More recently, Hansen et al. [8] introduced a biased variant of PPSZ, further improving the unique 3-SAT bound to $O(1.{307}^n)$.

Parallel to these randomized advances, significant effort has been devoted to derandomization and deterministic algorithm design. Dantsin et al. [9] showed how to simulate Schöning’s random walk deterministically, at the price of a mildly larger base: their Hamming-ball local search runs in time $O\left({(2-2/(k+1))}^n\right)$, i.e., $1.5^n$ for $k=3$. For 3-SAT specifically, they introduced a tailored local search strategy that further reduced the bound to $O\left({\left(1.481\right)}^n\right)$. Moser and Scheder [10] later completed the full derandomization of Schöning’s algorithm using limited independence. Brueggemann and Kern [4] refined the local search strategy of Dantsin et al., reducing the 3-SAT complexity to $O(1.{473}^n)$. Scheder [11] further improved this bound to $O(1.{465}^n)$. To the best of our knowledge, the current best deterministic algorithm for 3-SAT remains that of Kutzkov and Scheder [12], achieving $O(1.{439}^n)$. Despite over a decade of effort, no improvement has been found, highlighting the need for fundamentally new paradigms.

Quantum algorithms have demonstrated advantages over classical counterparts in several computational tasks, including integer factorization, unstructured search, and search on graphs [13,14,15], and they are by now a standard tool in application areas such as machine learning and combinatorial optimization [16,17,18]. Motivated by these developments, we investigate the application of quantum computation to the k-SAT problem. Prior quantum approaches to k-SAT largely accelerate an existing classical solver while keeping its structure inside a black-box oracle. Grover’s algorithm alone yields $O\left(2^{n/2}\right)=O(1.{414}^n)$ [14]. Combining Grover search with the then best classical 3-SAT algorithm ($O(1.{3302}^n)$ [5]) lowers the exponent to $O(1.{153}^n)$ [19], and applying amplitude amplification [20] to the PPSZ algorithm [6,7,8] gives $O(1.{143}^n)$ for 3-SAT. These are, to our knowledge, the strongest known exponents for worst-case k-SAT in the gate model. Inspired by the classical algorithm in [3], we propose a hybrid quantum-classical algorithm that employs Grover’s algorithm as a local search subroutine for solving k-SAT. The proposed algorithm is a hybrid quantum-classical procedure: its outer loop classically samples local search spaces, while its inner loop performs quantum search. It proceeds in t outer iterations. In each iteration, a problem-dependent superposition state is constructed over a local search space—specifically, a Hamming ball of radius r centered at a randomly generated assignment—by exploiting the problem structure. Grover’s algorithm is then applied to this state in its amplitude-amplification form—the number of solutions inside a ball is not known in advance, so the exponential-search variant is used—to search for a satisfying assignment. Because the outer loop is a classical repetition over independently sampled balls, the number of outer iterations is governed by the classical success probability, and the resulting running time is ${(2-2/(1+\sqrt{k}))}^n$ (with the optimal radius $r=n/(1+\sqrt{k})$), which improves upon the classical local-search bounds for k-SAT [3,9] and, at $k=3$, upon the best known classical algorithm [8] ($1.{268}^n$ versus $1.{307}^n$; see Section 3.6 for the general-k comparison). These gains are over classical solvers: black-box amplification of a stronger classical solver yields smaller quantum exponents [6,8,19,20].

The contributions of this work can be summarized as follows.

• An explicit, gate-level construction. Both the problem-dependent superposition over the Hamming ball and the k-SAT oracle are decomposed into elementary gates, so that no black-box oracle is left in the complexity and the polynomial overhead is fixed at $O\left(nmk\right)$ gates in total.
• A hybrid framework with a re-optimized ball radius. Because the center of each ball is measured, the outer loop is a classical repetition over independently sampled balls and contributes the inverse success probability rather than its square root; balancing this factor against the quadratic speedup of the inner search shifts the optimal radius from the classical $r=n/(k+1)$ to $r=n/(1+\sqrt{k})$, so that the classical repetition does not simply reproduce the classical Hamming-ball exponent.
• A complete accounting and a numerical verification. The qubit and gate costs of the whole construction are counted, and the two bounds on which the exponent rests—the success probability of a ball and the marked amplitude of the constructed state—are checked numerically for $k=3$ on small planted instances (Section 4).

The remainder of this paper is organized as follows. Section 2 introduces the k-SAT problem, defines quantum analogues of the three fundamental classical logic gates involved, and reviews Grover’s algorithm. Section 3 presents the proposed algorithm, beginning with an overview of the framework, followed by the construction of the problem-dependent state and the decomposition of the Grover oracle for k-SAT into elementary quantum gates. The section concludes with an analysis of the algorithm’s feasibility and time complexity and with a comparison against prior quantum algorithms. Section 4 reports the numerical verification of the two bounds entering the exponent; Section 5 offers concluding remarks, and the Appendix details the gate-level implementation of the conditional neighborhood expansion.

2. Preliminaries

2.1. Definition of the k-SAT Problem

The k-SAT problem in conjunctive normal form (CNF) is defined as follows. Let $X=\{x_1,x_2,\dots ,x_n\}$ be a finite set of n Boolean variables, and let $\mathcal{C}=\{c_1,c_2,\dots ,c_m\}$ be a set of m clauses. Each clause is given by $c_i=l_{i,1}\vee l_{i,2}\vee \dots \vee l_{i,k}$, where each $l_{i,j}\in \{x_p,\neg x_p\mid 1\le p\le n\}$ is called a literal; for simplicity, the k literals of a clause are assumed to involve k distinct variables, so that no clause contains both $x_p$ and $\neg x_p$. This is the case considered throughout, and it is what makes the k branches generated by $F_{c_i}$ [Equation (5)] distinct. The k-SAT problem asks whether there exists an assignment$a=\{a_1,a_2,\dots ,a_n\}$, such that the formula $\mathcal{F}=c_1\wedge c_2\wedge \dots \wedge c_m$ is satisfied. If $\mathcal{F}$ is satisfied by a, then a is called a satisfying assignment of $\mathcal{F}$.

Note that for fixed n and m, each distinct set of clauses defines a unique instance of the k-SAT problem. Throughout, m is taken to be polynomially bounded in n, so that the clause count contributes only a polynomial factor to all running times reported below. In classical computation, a Boolean variable takes a binary value of either 0 (false) or 1 (true), and logical operations act on one or more such variables. By analogy, a quantum truth value can be defined as a superposition of the basis states 0 and 1. A quantum logical variable assumes such a quantum truth value and is naturally represented by a qubit, whose state encodes this value. Consequently, a quantum logical operation is defined as a quantum gate acting on one or more qubits, transforming their joint quantum state.

The k-SAT problem involves n Boolean variables, each taking a value in $\{0,1\}$. Consequently, there are $2^n$ possible assignments, which constitute the search space ${\mathcal{H}}_n={\{0,1\}}^n$. Each assignment $a=\{a_1,a_2,\dots ,a_n\}$ can be encoded as a computational basis state $a=a_1{a}_2\dots a_n$, where $a_i\in \{0,1\}$. In the remainder of this paper, we identify each classical assignment with its corresponding computational basis state.

2.2. Quantum Realizations of Logic Gates: NOT, AND, and OR

As shown above, the k-SAT problem is built upon three basic logical operations: $\mathrm{AND}$ (∧), $\mathrm{OR}$ (∨), and $\mathrm{NOT}$ (¬). Their quantum analogues, denoted as $\mathrm{QAND}$, $\mathrm{QOR}$, and $\mathrm{QNOT}$, are defined as follows.

The classical $\mathrm{NOT}$ operation maps $0\mapsto 1$ and $1\mapsto 0$. Its quantum analogue, $\mathrm{QNOT}$, is defined by its action on the computational basis:

$$\mathrm{QNOT}x=\neg x,x\in \{0,1\}.$$

This operator is equivalent to the single-qubit Pauli-X gate, which flips $0\leftrightarrow 1$.

The classical $\mathrm{AND}$ gate ($x_1\wedge x_2$) embeds into a reversible three-qubit operator $\mathrm{QAND}$:

$$\mathrm{QAND}{x}_1,x_2,x_3=x_1,x_2,x_3\oplus (x_1\wedge x_2).$$

This is precisely the Toffoli gate, which applies a bit-flip to the third qubit if and only if the first two qubits are both 1.

The classical $\mathrm{OR}$ operation acts on two Boolean variables, yielding 0 if and only if both inputs are 0. Its reversible quantum analogue, $\mathrm{QOR}$, is defined on three qubits as:

$$\mathrm{QOR}{x}_1,x_2,x_3=x_1,x_2,x_3\oplus (x_1\vee x_2),$$

where ⊕ denotes addition modulo 2. This operation flips the target qubit $x_3$ conditioned on at least one of the control qubits $x_1$ or $x_2$ being 1. The $\mathrm{QOR}$ gate can be implemented via $\mathrm{QNOT}$ and $\mathrm{QAND}$. Specifically, one applies $\mathrm{QNOT}$ to each of the first two qubits, then $\mathrm{QAND}$ to all three qubits, and finally $\mathrm{QNOT}$ to each of the three qubits.

2.3. Grover’s Algorithm

In Grover’s algorithm, the Grover iteration is applied $O\left(\sqrt{N/M}\right)$ times to the system state, where $N=2^n$ is the search space size (n being the number of qubits) and M is the number of solutions. The qubits are then measured in the computational basis, which returns a solution with probability $\Omega \left(1\right)$; repeating the whole procedure $O(log(1/\delta \left)\right)$ times raises the success probability to at least $1-\delta$.

The Grover iteration consists of the following four steps:

• Apply the oracle O: $x\mapsto {(-1)}^{f\left(x\right)}x$, where $f\left(x\right)=1$ if x is a solution and $f\left(x\right)=0$ otherwise. This marks the solution states by flipping their phases.
• Apply the Hadamard transform $H^{\otimes n}$.
• Apply the diffusion operator $D_0=2⟩⟨00-I$, which reflects the state about |0⟩ (equivalently, flips the phase of all non-zero computational basis states).
• Apply the Hadamard transform $H^{\otimes n}$.

Using the identity $H^{\otimes n}(2⟩⟨00-I)H^{\otimes n}=2\psi \psi -I$, where $\psi =H^{\otimes n}0$ is the equal superposition state, the Grover iteration simplifies to

$$G=(2\psi \psi -I)O,$$

(1)

where O is the oracle defined in Step 1.

If an oracle is available that marks the solution states of a given problem, Grover’s algorithm can solve it without exploiting additional problem-specific structure beyond the oracle itself. In particular, for the k-SAT problem, assuming such an oracle exists and the instance has a unique solution ($M=1$), Grover’s algorithm achieves a time complexity of $O\left(\sqrt{2^n}\right)\approx O(1.{414}^n)$. This provides a quadratic speedup over exhaustive classical search and outperforms the best known classical deterministic algorithms for k-SAT, though it remains slower than state-of-the-art probabilistic solvers. Nevertheless, incorporating problem structure into the quantum algorithm can further reduce the complexity, as demonstrated in the subsequent analysis.

3. The Proposed Algorithm

3.1. Algorithm Framework

The proposed algorithm is a hybrid quantum-classical procedure whose outer loop performs t classically repeated iterations, each consisting of the following three steps:

• Random assignment generation. Prepare the uniform superposition state by applying $H^{\otimes n}$ to n qubits initialized in $0^{\otimes n}$, then measure all qubits in the computational basis to obtain a random assignment $a\in {\mathcal{H}}_n$.
• Subspace state preparation. Construct a problem-dependent quantum state ${\psi }_a$ starting from the randomly generated assignment a.
• Grover search within subspace. Apply Grover’s algorithm to ${\psi }_a$ to search for a solution to the k-SAT instance.

3.2. Construction of the Problem-Dependent State

The problem-dependent state ${\psi }_a$ is constructed by applying the following two procedures iteratively r times, starting from the randomly generated assignment a; throughout this section, ${\psi }_a$ denotes the state of the round being considered.

• Clause evaluation (E). This procedure computes the quantum truth value of each clause in the k-SAT instance. For a clause $c_i=l_{i,1}\vee l_{i,2}\vee \dots \vee l_{i,k}$, we introduce $(k-1)$ auxiliary qubits ${\alpha }_{i,1},\dots ,{\alpha }_{i,k-1}$, all initialized to 0. Let $l_{i,j}$ denote the qubit corresponding to literal $l_{i,j}$. The quantum OR operation ($\mathrm{QOR}$) is applied sequentially: first to $l_{i,1}$, $l_{i,2}$, and ${\alpha }_{i,1}$; then to $l_{i,3}$, ${\alpha }_{i,1}$, and ${\alpha }_{i,2}$; and so on, until finally to $l_{i,k}$, ${\alpha }_{i,k-2}$, and ${\alpha }_{i,k-1}$. The final result is stored in ${\alpha }_{i,k-1}$. Across all m clauses, this requires $m(k-1)$ auxiliary qubits, with the truth values of clauses $c_1,\dots ,c_m$ stored in ${\alpha }_{1,k-1},\dots ,{\alpha }_{m,k-1}$, respectively.
  The full clause-evaluation operator is defined as

  $$E={\mathrm{QOR}}_{c_m}{\mathrm{QOR}}_{c_{m-1}}\dots {\mathrm{QOR}}_{c_1},$$

  (2)

  where ${\mathrm{QOR}}_{c_i}$ denotes the sequence of $(k-1)$$\mathrm{QOR}$ gates applied to clause $c_i$, as described above. After applying E, the state of the current round becomes entangled with each clause register ${\alpha }_{i,k-1}$ as

  $${\psi }_a,{\alpha }_{i,k-1}={\psi }_a^{c_i,0},0+{\psi }_a^{c_i,1},1,$$

  where ${\psi }_a^{c_i,0}$ and ${\psi }_a^{c_i,1}$ are the (unnormalized) components of that state supported on the subspaces in which clause $c_i$ evaluates to false and true, respectively.
• Conditional neighborhood expansion (F). This procedure applies a conditional transformation to each computational basis state in the superposition ${\psi }_a$, expanding the neighborhood of one unsatisfied clause. Let $i\left(a\right)=min\{i\mid c_i\mathrm{is}\mathrm{false}\mathrm{under}a\}$ be the index of the first clause that is false under a, and let $C_i(·)$ denote conditioning on the clause-register pattern in which clauses $c_1,\dots ,c_{i-1}$ are true and clause $c_i$ is false, i.e., the multiply-controlled unitary that acts as the identity unless the clause registers ${\alpha }_{1,k-1},\dots ,{\alpha }_{m,k-1}$ hold that pattern and that applies the operation in its argument whenever they do. The conditional expansion operator is defined as the product of these controlled unitaries,

  $$F={\displaystyle \prod _{i=1}^m}{C}_i\left(F_{c_i}\right),$$

  (3)

  where $F_{c_i}$ is the expansion operator associated with clause $c_i$. The m control patterns are mutually exclusive—no assignment can have two first-false clauses—and the expansion $F_{c_i}$ changes only the assignment and label registers, so the clause registers are left untouched while a factor acts and, on any computational basis state, at most one factor of Equation (3) differs from the identity; the factors therefore commute. Equivalently, on a basis state of the clause registers F reduces to the direct sum of the unitaries $F_{c_1},\dots ,F_{c_m}$, one summand for each sector in which clause $c_i$ is the first clause that is false, together with the identity on the sector in which all clauses are true: an individual summand is only a partial isometry, and it is the completeness of the mutually exclusive sectors that makes the operator F unitary. Each factor is a controlled unitary, and hence unitary, by construction, and so is their product. On a computational basis state whose clause registers hold the values $({\eta }_1,\dots ,{\eta }_m)$, exactly one sector is selected—the expansion of the first clause that is false, i.e., of clause $c_{i\left(a\right)}$—whereas if a satisfies every clause no expansion takes place, in which case F acts as the identity on the assignment and label registers. Thus F performs a single k-way branching per round instead of a simultaneous expansion of all m clauses. This mirrors the branching step of a classical local search, in which a single unsatisfied clause is selected and each of its k literals is tried in turn; applying instead the expansion of every false clause—each $F_{c_i}$ controlled by the single clause $c_i$—would generate $k^{m_f}$ branches in a single round for an assignment with $m_f$ false clauses and would not correspond to the classical search tree. The circuit implementation of F is illustrated in Figure 1.
  Each block $F_{c_i}$ acts on the assignment register and on an auxiliary label register s of $q=\lceil {log}_{2}k\rceil$ qubits, initialized to $0^{\otimes q}$: a unitary W first prepares a uniform superposition over k basis states of s, which then controls a Pauli-$\mathrm{X}$ flip of the corresponding literal,

  $$F_{c_i}=\left({\displaystyle \sum _{j=1}^k}{X}_{p(i,j)}\otimes j{j}_s+{\mathbb{1}}_a\otimes {\displaystyle \sum _{j=k+1}^{2^q}}j{j}_s\right)W,$$

  (4)

  where $W{0}^{\otimes q}=k^{-1/2}{\sum }_{j=1}^{k}j$ prepares the uniform superposition in s, the label values being understood cyclically, $2^q\equiv 0^{\otimes q}$, so that the $2^q$ basis states of s are indexed by $j=1,\dots ,2^q$; the second sum then acts as the identity on the unused label values $j>k$, which for $k=2^q-1$ is the single all-zero label $0^{\otimes q}$ (cf. Appendix A) and is empty when $k=2^q$, so that it completes the first factor to a unitary on the whole register space. $X_{p(i,j)}$ flips the variable $x_{p(i,j)}$ to which the literal $l_{i,j}$ refers. Acting on an assignment a that falsifies $c_i$, this block gives

  $$a{0}_s\stackrel{F_{c_i}}{\to }{\displaystyle \frac{1}{\sqrt{k}}}{\displaystyle \sum _{j=1}^k}{g}_{l_{i,j}}\left(a\right)j_s,$$

  (5)

  where $g_{l_{i,j}}\left(a\right)$ denotes the assignment obtained by flipping the bit corresponding to literal $l_{i,j}$ in a. Each $g_{l_{i,j}}\left(a\right)$ differs from a in exactly one bit position and satisfies $c_i$, so $F_{c_i}$ maps a to a uniform, coherent superposition over its k Hamming-distance-1 neighbors that satisfy $c_i$, with the chosen branch recorded in the label register s. This label is retained rather than uncomputed, and no unitary can do otherwise: the corresponding map on the assignment register alone, $T_{\mathrm{bf}}a=k^{-1/2}{\sum }_{j=1}^k{g}_{l_{i,j}}\left(a\right)$, is not an isometry—for $k=2$ and $\left\{p\right(i,1),p(i,2\left)\right\}=\{1,2\}$ it gives $T_{\mathrm{bf}}00=T_{\mathrm{bf}}11=(10+01)/\sqrt{2}$, and the obstruction persists for $k\ge 3$ inside the sector where $F_{c_i}$ is active: were the label reset, the falsifying input 000 would keep a component of amplitude $1/\sqrt{k}$ on $1000^{\otimes q}$, the very state that the control leaves untouched for the orthogonal input 100—so no unitary that generates Equation (5) can also return s to $0^{\otimes q}$. Consequently each of the r rounds of the construction employs its own label register $s_1,\dots ,s_r$ (and, in the case $k=2^q-1$, its own copy of the auxiliary register w of Appendix A), and each round keeps its own copy of the clause registers as well, since these cannot be uncomputed either (see the discussion of Equation (6)). We provide an implementation scheme of $F_{c_i}$ using elementary quantum gates in Appendix A.

The full construction procedure can then be written as

$$C=F_r{E}_r\dots F_2{E}_2{F}_1{E}_1,$$

(6)

where $E_i$ denotes the clause-evaluation operator [Equation (2)] acting on the i-th copy of the clause registers, which starts in $0^{\otimes m(k-1)}$, and $F_i$ the conditional neighborhood expansion [Equation (3)] controlled by those registers and acting on the label register $s_i$ of the i-th round. In each round the quantum truth values of all clauses are first computed by $E_i$ for the assignment currently held in the assignment register, and the conditional neighborhood expansion $F_i$ is then applied on the basis of these truth values. Unlike the oracle of Equation (9), the expansion changes the assignment register, so the clause registers of a round cannot be uncomputed by $E_i^{†}$: applying $E_i^{†}$ after the expansion computes the clause values of the new assignment on top of those of the previous one, and the registers return to 0 only when the assignment register is left unchanged—which holds for the oracle but not here. Like the branch label of F [Equation (5)], they are therefore retained rather than uncomputed and reused. This iterative process leverages the clause structure of the k-SAT instance to transform the initial random assignment into a problem-dependent superposition. The resulting state is supported on basis states of the form $x{s}_1\dots s_r$, tensored with the retained clause registers, in which x lies in the Hamming ball $B(a,r)$ and the labels record the k-way choices taken along the corresponding branch of the search tree, so that the state forms a local search subspace tailored to the problem instance.

Remark on unitarity. All the operators employed above are unitary: $\mathrm{QNOT}$, $\mathrm{QAND}$, $\mathrm{QOR}$ and $\mathrm{CNOT}$ act as permutations of the computational basis (and are self-inverse); the Hadamard transform H and $D_0=2|0⟩⟨0|-I$ are Hermitian and satisfy $H^2=D_0^2=\mathbb{1}$; W is a state-preparation unitary [Equation (4) and Appendix A]; E [Equation (2)], $\mathcal{T}$ [Equation (7)], $F_{c_i}$ [Equation (4)] and F [Equation (3)] are products of multiply-controlled unitaries, each control condition being a computational-basis pattern on the clause registers (so that the operator reduces to a direct sum of unitaries over the mutually exclusive sectors), and the same holds for the construction C [Equation (6)], the oracle O [Equation (9)] and the Grover iteration G [Equation (1)]. Within the construction, the only non-unitary object in the analysis is the branch-and-forget map $T_{\mathrm{bf}}$ introduced below Equation (5), which is not an executed operation but the shortcut of discarding the branch labels: its failure to be an isometry is precisely why the label registers—and, as explained above, the clause registers of each round—are retained and never discarded, so that every step of the construction is a unitary gate. Non-unitary operations occur only where the algorithm measures—in generating the random assignment in Step 1, in the intermediate checks performed by the exponential-search variant of amplitude amplification in Step 3, and in the final readout—and it is the measurement in Step 1 that keeps the outer loop over balls a classical repetition.

3.3. Oracle for the k-SAT Problem

In this subsection, we decompose the oracle O into elementary quantum operations. As previously described, the oracle O identifies solution states and flips their phases. To detect these states, we first apply the clause-evaluation operator E [Equation (2)] to compute the quantum truth values of all m clauses. Subsequently, the quantum AND operation ($\mathrm{QAND}$) is applied sequentially $(m-1)$ times to evaluate the entire formula $\mathcal{F}$. This formula-evaluation procedure is defined as

$$\mathcal{T}={\mathrm{QAND}}_{{\alpha }_{m,k-1},{\beta }_{m-2},{\beta }_{m-1}}\dots {\mathrm{QAND}}_{{\alpha }_{3,k-1},{\beta }_1,{\beta }_2}·{\mathrm{QAND}}_{{\alpha }_{1,k-1},{\alpha }_{2,k-1},{\beta }_1},$$

(7)

where ${\beta }_1,\dots ,{\beta }_{m-1}$ are auxiliary qubits initialized to 0, and ${\mathrm{QAND}}_{x,y,z}$ denotes the $\mathrm{QAND}$ gate acting on qubits x, y, and z. This step requires $(m-1)$ auxiliary qubits in total, with the final truth value of $\mathcal{F}$ stored in ${\beta }_{m-1}$.

Writing the collection of labels produced by the construction as l, the problem-dependent state ${\psi }_a$ can be decomposed into two orthogonal components based on the value of $f\left(x\right)$:

$${\psi }_a={\psi }_a^0+{\psi }_a^1=\sum _{x:f\left(x\right)=0}\sum _l{A}_{x,l}xl+\sum _{x:f\left(x\right)=1}\sum _l{B}_{x,l}xl,$$

(8)

where ${\psi }_a^0$ and ${\psi }_a^1$ are unnormalized and span the subspaces corresponding to unsatisfying and satisfying assignments, respectively (the label and clause registers of the construction are spectators: the oracle below acts as the identity on them and uses its own clause and formula registers, initialized to 0, so the marking condition depends only on the assignment). After applying the clause-evaluation operator E [Equation (2)] and the formula-evaluation operator $\mathcal{T}$ [Equation (7)], the system becomes entangled with the ancilla qubit ${\beta }_{m-1}$:

$${\psi }_a,{\beta }_{m-1}={\psi }_a^0,0+{\psi }_a^1,1.$$

Finally, a controlled-NOT ($\mathrm{CNOT}$) gate is applied to the ancilla qubits ${\beta }_{m-1}$ (control) and ${\beta }_m$ (target), where ${\beta }_m$ is initialized to $-=(0-1)/\sqrt{2}$. This operation transforms the entangled state into

$${\psi }_a,{\beta }_{m-1},{\beta }_m={\psi }_a^0,0,--{\psi }_a^1,1,-.$$

The complete oracle for the k-SAT problem is then given by

$$O=E^{†}{\mathcal{T}}^{†}{\mathrm{CNOT}}_{{\beta }_{m-1},{\beta }_m}\mathcal{T}E,$$

(9)

where $E^{†}$ and ${\mathcal{T}}^{†}$ are the inverses of the clause-evaluation operator E [Equation (2)] and the formula-evaluation operator $\mathcal{T}$ [Equation (7)], respectively. These uncomputation steps restore the clause and formula registers to their initial states, ensuring that the oracle acts as a pure phase oracle on the computational basis; it is the identity on the label and clause registers of the construction.

3.4. Reachability within Hamming Balls

Suppose $a^{*}\in B(a,r)$ is a satisfying assignment. We now show that after r iterations of the construction procedure [Equation (6)], the state ${\psi }_a$ has amplitude at least $k^{-r/2}$ on the marked subspace, i.e., on the components of Equation (8) whose assignment register holds a satisfying assignment. The Hamming distance between two assignments x and y, denoted $d(x,y)$, is the number of bit positions in which they differ. The set of all assignments within Hamming distance r from a center assignment a is called a Hamming ball, denoted $B(a,r)=\{x\mid d(x,a)\le r\}$.

By construction [Equation (6)], each literal-flip operator $g_{l_{i,j}}$ satisfies $d(a,g_{l_{i,j}}\left(a\right))=1$. Consequently, all assignments reachable via the state-generation procedure lie within $B(a,r)$. For any clause $c_i=l_{i,1}\vee l_{i,2}\vee \dots \vee l_{i,k}$ that is unsatisfied by a, at least one literal $l_{i,j}$ in $c_i$ must evaluate to true under $a^{*}$. Flipping the corresponding variable in a yields an assignment $g_{l_{i,j}}\left(a\right)$ such that

$$d\left(g_{l_{i,j}}\left(a\right),a^{*}\right)=d(a,a^{*})-1.$$

Thus, after r rounds of the construction procedure [Equation (6)], the state ${\psi }_a$ necessarily contains a component whose assignment register holds a satisfying assignment: at every round the selected clause contains at least one literal that is true under $a^{*}$ (which satisfies every clause), so a distance-decreasing flip is always available, and the path that applies such a flip in each of the r rounds ends at $a^{*}$ unless it meets another satisfying assignment after $d<r$ rounds, in which case no further expansion takes place and the path ends there. More quantitatively, every branch of the expansion carries the same amplitude $k^{-1/2}$ [Equation (5)], so the distance-decreasing path carries the amplitude $k^{-r/2}$, or the larger amplitude $k^{-d/2}$ if it ends after $d<r$ rounds. Distinct paths are recorded by distinct label configurations and are therefore mutually orthogonal, so their contributions add in quadrature, with no interference and hence no cancellation; the squared overlap, i.e., the probability, of ${\psi }_a$ with the marked subspace is thus at least $k^{-r}$, since the distance-decreasing path alone has an amplitude of magnitude no less than $k^{-r/2}$ on that subspace. Moreover, once the assignment register reaches a satisfying assignment it is no longer modified: every clause is satisfied there, hence none of the control patterns of Equation (3) holds and F acts as the identity on the assignment and label registers, so the amplitude of the component that ends there is preserved. The amplitude of ${\psi }_a$ on the marked subspace is therefore at least $k^{-r/2}$, so amplitude amplification locates a satisfying assignment within $O\left(k^{r/2}\right)$ iterations. Since the number of satisfying assignments inside the ball is not known in advance, we use the exponential-search variant of amplitude amplification [20], which preserves this scaling up to a constant factor.

3.5. Time Complexity

Throughout, running times are counted as the number of elementary gates; the depth of a single run is of the same order as its gate count, since the $O\left(k^{\rho n/2}\right)$ amplitude-amplification iterations are sequential, and the t classically repeated runs multiply both quantities by the same factor.

The size of the Hamming ball $B(a,r)$ satisfies the following bounds [9]:

$${\displaystyle \frac{2^{nh\left(\rho \right)}}{\sqrt{8n\rho (1-\rho )}}}\le \left|B(a,r)\right|\le 2^{nh\left(\rho \right)},$$

where $\rho =r/n$ and $h\left(\rho \right)=-\rho {log}_2\rho -(1-\rho ){log}_2(1-\rho )$ is the binary entropy function.

Assume the given k-SAT instance has at least one satisfying assignment, and fix one such assignment $a^{*}$. The analysis below therefore does not require the instance to have a unique solution, and the unique-solution assumption made for plain Grover search in Section 2.3 is not needed here. Under the uniform distribution over all $2^n$ assignments, the probability that a fixed solution lies in $B(a,r)$ is at least

$$p_B={\displaystyle \frac{\left|B\right(a,r\left)\right|}{2^n}}\ge {\displaystyle \frac{2^{n\left(h\right(\rho )-1)}}{\sqrt{8n\rho (1-\rho )}}}.$$

(10)

Since the initial random assignment is measured before the quantum search, different balls are sampled classically and independently, so the outer loop is a purely classical repetition. The probability that a single sampled ball contains a fixed satisfying assignment is $p_B$ [Equation (10)], so $t=O(1/p_B)=O\left(2^{n(1-h(\rho \left)\right)}\right)$ repetitions are required to locate a ball containing a solution. Within such a ball, the constructed state is spread over the reachable branches of the search tree, at most $k^r$ of them, each recorded by its own label configuration; by the amplitude bound established in Section 3.4 its amplitude on the satisfying assignments is at least $k^{-r/2}$; applying amplitude amplification [20] therefore locates a satisfying assignment in $O\left(k^{r/2}\right)=O\left(k^{\rho n/2}\right)$ iterations. Note also that the reflection is taken about the prepared state ${\psi }_a$ rather than about the equal superposition $H^{\otimes n}0$ [cf. Equation (1)]: writing ${\psi }_a=C_{a}0$, where $C_a$ denotes the construction C [Equation (6)] preceded by the Pauli-$\mathrm{X}$ layer that prepares the measured assignment |a⟩, the diffusion operator is realized as $C_a\left(2\right|0⟩⟨0|-I)C_a^{†}=2{\psi }_a{\psi }_a-I$. The total runtime (up to polynomial factors) is therefore

$$T_{\mathrm{tot}}=2^{n(1-h(\rho \left)\right)}·k^{\rho n/2}.$$

Minimizing this expression with respect to $\rho$ (equivalently, minimizing $(1-h\left(\rho \right))+{\displaystyle \frac{\rho }{2}}{log}_{2}k$) and using $h^{\prime }\left(\rho \right)={log}_2\left((1-\rho )/\rho \right)$ yields the optimal choice ${\rho }^{*}=1/(1+\sqrt{k})$, i.e., $r^{*}=n/(1+\sqrt{k})$, which gives

$$T_{\mathrm{tot}}={\left({\displaystyle \frac{2\sqrt{k}}{1+\sqrt{k}}}\right)}^n={\left(2-{\displaystyle \frac{2}{1+\sqrt{k}}}\right)}^n.$$

(11)

For comparison, the corresponding classical template performs $t·k^r$ local-search steps, since the search tree of depth r has $k^r$ leaves, and the two factors are balanced at $\rho =1/(k+1)$; the resulting exponent is ${(2-2/(k+1))}^n$, i.e., exactly the Hamming-ball local search of Dantsin et al. [9]. Replacing $k^r$ by the quadratic $k^{r/2}$ of amplitude amplification is what shifts the optimal radius to ${\rho }^{*}=1/(1+\sqrt{k})$ and yields Equation (11). In particular, when $k=3$, the time complexity is $T_{\mathrm{tot}}\approx 1.{268}^n$.

Finally, we make the polynomial overhead explicit. Each $\mathrm{QOR}$ gate is implemented by a single $\mathrm{QAND}$ (Toffoli) gate together with a constant number of single-qubit $\mathrm{QNOT}$ gates, so the clause-evaluation operator E [Equation (2)] requires $m(k-1)$$\mathrm{QOR}$ gates and $m(k-1)$ auxiliary qubits, while the formula-evaluation operator $\mathcal{T}$ [Equation (7)] requires $m-1$$\mathrm{QAND}$ gates and $m-1$ auxiliary qubits. Since the oracle [Equation (9)] consists of E, $\mathcal{T}$, their inverses, and a single $\mathrm{CNOT}$, a single oracle call costs $O\left(mk\right)$ elementary gates and uses $mk$ auxiliary qubits of its own. Together with the $r=\rho n$ rounds of state preparation [Equation (6)] and the $O\left(k^{\rho n/2}\right)$ Grover iterations performed for each of the $t=O\left(2^{n(1-h(\rho \left)\right)}\right)$ sampled balls, the total number of elementary gates over all runs is

$$O\left(nmk\right){\left(2-{\displaystyle \frac{2}{1+\sqrt{k}}}\right)}^n,$$

(12)

with $O\left(mk\right)$ auxiliary qubits for the oracle’s own clause and formula registers, which are uncomputed by $E^{†}$ and ${\mathcal{T}}^{†}$ and are therefore reused across all Grover iterations and t sampled balls. The registers of the construction, by contrast, cannot be uncomputed and are therefore retained: because both the branch label [Equation (5)] and the clause registers [Equation (6)] of a round are kept, each of the $r=\rho n$ rounds uses its own label register of $q=\lceil {log}_{2}k\rceil$ qubits, plus L qubits in the case $k=2^q-1$ (see Appendix A), and its own $m(k-1)$ clause ancillas, i.e., $O\left(r\right(logk+L\left)\right)=O(nlogn)$ and $O\left(rmk\right)$ qubits in total, respectively. Both counts are polynomial in n for $m=\mathrm{poly}\left(n\right)$ and leave the exponential scaling of Equation (11) unchanged. In summary, the explicit construction fixes the polynomial overhead of the algorithm rather than leaving it inside an unaccounted-for oracle. Table 1 collects the resulting resources for $k=3,4,5$: the optimal radius ${\rho }^{*}=1/(1+\sqrt{k})$, the number $t=O\left(2^{n(1-h\left({\rho }^{*}\right))}\right)$ of classically repeated runs, the number $O\left(k^{{\rho }^{*}n/2}\right)$ of amplitude-amplification iterations performed in each run, and the exponential base $\alpha$ of Equation (11). The two factors balance at ${\rho }^{*}$, and their product reproduces $\alpha$; note that the classical factor alone, $2^{n(1-h\left({\rho }^{*}\right))}$, is much smaller than the total cost, so that the exponent is dominated by the inner quantum search. Single-run gate counts and qubit counts are those of Equations (12) and the accompanying text, namely $O\left(nmk\right)$ elementary gates per run and $O(rmk+nlogn+mk)$ qubits in total, with $r={\rho }^{*}n$; both are polynomial in n and m and multiply the base ${\alpha }^n$.

3.6. Comparison with Prior Quantum Algorithms

Table 2 collects the best known exponents for worst-case 3-SAT in the gate model together with the exponent obtained here. Table 3 lists the same comparison for general k with $3\le k\le 10$, where Schöning’s bound ${(2-2/k)}^n$ and the deterministic Hamming-ball template ${(2-2/(k+1))}^n$ are confronted with the exponent ${(2-2/(1+\sqrt{k}))}^n$ obtained here. The exponent of the present algorithm lies below both classical bounds for every $k\ge 3$, since the optimal fraction $1/(1+\sqrt{k})$ exceeds both $1/k$ and $1/(k+1)$; the gap to the Hamming-ball template that it accelerates is substantial—at $k=3$ the base falls from $1.500$ to $1.268$, a reduction of about $15\%$—and it persists over the whole range, the exponent obtained here being strictly smaller than both classical exponents.

A quantum algorithm that accelerates a classical solver as a black box achieves, up to polynomial factors, the square root of that solver’s exponent; the quality of the resulting bound is therefore determined by the quality of the underlying classical algorithm. Grover search alone gives $O(1.{414}^n)$ [14]; combining it with the best classical 3-SAT algorithm of its time ($O(1.{3302}^n)$ [5]) gives $O(1.{153}^n)$ [19]; and applying amplitude amplification [20] to the PPSZ algorithm [6,7,8] gives $O(1.{143}^n)$. The present construction, by contrast, accelerates a Hamming-ball (Dantsin-type) local search whose classical exponent is ${(2-2/(k+1))}^n$ ($1.5^n$ for $k=3$; instance-specific refinements of this Hamming-ball search reach $1.{481}^n$ [9], $1.{473}^n$ [4], and $1.{465}^n$ [11], but they modify the local search itself rather than the ball-by-ball template accelerated here), and it does so only in its inner loop: because the random assignment of Step 1 is measured, the outer loop over balls remains classical, so the exponent is ${(2-2/(1+\sqrt{k}))}^n$ rather than the square root ${(2-2/(k+1))}^{n/2}$ that a fully coherent variant would give. For general k, the classical reference points are Schöning’s local search ${(2-2/k)}^n$ [3], the deterministic Hamming-ball search ${(2-2/(k+1))}^n$ [9], and the PPSZ-type bounds [6,8]; the exponent ${(2-2/(1+\sqrt{k}))}^n$ obtained here lies below Schöning’s ${(2-2/k)}^n$ for every $k\ge 3$ (for instance $1.268<1.333$ at $k=3$ and $1.333<1.5$ at $k=4$; Table 3 extends the comparison up to $k=10$), so the improvement claimed in the abstract refers to the classical local-search bounds, while for $k=3$ it also applies to the best known classical algorithm, whose exponent is $1.{307}^n$ [8]. Consequently, the exponents obtained here do not compete with those listed above, and we make no claim of an improvement in the asymptotic exponent over previous quantum algorithms. The contribution of this work is instead an explicit, gate-level realization of a problem-structured quantum local search, in which the problem-dependent superposition over the Hamming ball and the k-SAT oracle are both decomposed into elementary quantum gates (Section 3.2 and Section 3.3). Extending this explicit construction so that its exponent becomes competitive—for example, by removing the measurement in Step 1 so that the outer loop can also be amplified—is an interesting direction for future work; for a recent study of quantum advantage for structured k-SAT that accounts for fault-tolerant overheads, see Ref. [21].

4. Numerical Verification

The exponent of Equation (11) rests on two worst-case bounds: the probability $p_B$ that a uniformly sampled ball contains a solution [Equation (10)], and the lower bound $k^{-r/2}$ on the amplitude of the constructed state on the marked subspace (Section 3.4). Both are checkable independently on small instances, and we do so here for $k=3$ on planted random instances with $m=\lfloor 4.26n\rceil$ clauses and $n=12$ to 38. The probability $p_B$ is measured by Monte Carlo sampling of the ball center, with $2\times {10}^6$ centers per point, while the marked amplitude

$$\gamma ={\left(\sum _{\ell }{k}^{-d_{\ell }}\right)}^{1/2}$$

(13)

is obtained by exact enumeration of the branch tree of Equation (6); the sum runs over those leaves ℓ whose assignment satisfies every clause and $d_{\ell }$ is the depth of ℓ. Equation (13) is precisely the amplitude of ${\psi }_a$ on the marked subspace: by Equation (5) such a leaf carries the amplitude $k^{-d_{\ell }/2}$, and distinct leaves are recorded by distinct label configurations and are therefore mutually orthogonal, so that their amplitudes combine in quadrature. The enumeration also reproduces the structural statement of Section 3.4 directly: in every run reported below, a ball containing a solution produced a satisfying leaf of the enumerated tree.

Figure 2(a) confronts the measured $p_B$ with Equation (10). Because $d(a,a^{*})$ is a sum of n independent fair bits, the probability that a uniformly random center lies within distance r of a fixed solution is exactly the binomial tail $p_B=2^{-n}{\sum }_{i\le r}\left({\displaystyle \genfrac{}{}{0pt}{}{n}{i}}\right)$, which can be evaluated without sampling error; the figure shows both this exact value and the Monte Carlo estimate. The two agree at every point to within the statistical error of the sampler, which validates the sampling of the ball center on which the amplitude measurements rely, and every point lies inside the window of Equation (10). The plotted ratio tends toward the lower end of that window rather than toward unity: the entropy factor $2^{n\left(h\right(\rho )-1)}$ taken alone overestimates $p_B$ by a root-of-n factor, and at the optimal radius the ratio to the lower bound of Equation (10) lies between $1.8$ and $2.3$ for every n studied, so that the bound is tight up to its root-of-n correction. At the other radii the ratio to the lower bound runs from $1.3$ at $\rho =0.20$ to $4.6$ at $\rho =0.50$, the increase being that of the factor $\sqrt{8n\rho (1-\rho )}$ of Equation (10).

Figure 2(b) shows the measured $\gamma$ in units of the guaranteed bound $k^{-r/2}$. Every point satisfies $\gamma \ge k^{-r/2}$, as required, but the bound is far from tight: at the optimal radius the ratio grows from $4.4$ at $(n,r)=(12,4)$ to 831 at $(38,14)$, in proportion to $k^{r/2}$: the measured $\gamma$ stays of order $0.1$ to $0.5$ rather than decaying, while the guaranteed bound $k^{-r/2}$ falls off exponentially. Two effects contribute. First, a leaf that satisfies the formula at depth $d<r$ carries $k^{-d/2}$ rather than $k^{-r/2}$, so every satisfying leaf reached before the last round raises $\gamma$ above the bound. Second, and more importantly, the planted instances used here are not unique-solution instances: with $m=\lfloor 4.26n\rceil$ clauses a random k-SAT instance has of order $2^n{(1-2^{-k})}^m$ satisfying assignments in expectation, about 7 at $n=16$ and about 110 at $n=38$, so a ball of radius r typically contains several solutions instead of the single one assumed in the worst case. The measured $\gamma$ therefore probes the typical instance, whereas $k^{-r/2}$ is a guarantee that must hold for the least favorable placement of a single solution, which is the situation the analysis of Section 3.4 is designed for. The number of enumerated trees per point falls with r, from 40 at $r\le 9$ to 13–20 at $r\ge 10$, because each enumeration visits $k^r$ leaves. This is the main source of the residual scatter of the points at the largest n, and it also dominates the uncertainty of the last two entries of Table 4: repeating the measurement at $(38,14)$ with a different number of trees moves $\gamma$ from $0.22$ to $0.38$, that is, the ratio to the bound from 476 to 831.

Table 4 collects the corresponding costs at ${\rho }^{*}$, with $t=1/p_B$ balls and $J=(\pi /4)/\gamma$ amplitude-amplification iterations per ball, and Figure 3 shows the total cost against n. The measured base ${\left(tJ\right)}^{1/n}$ decreases from $1.19$ at $n=12$ to $1.09$ at $n=38$, and a least-squares fit over $n\ge 20$ gives $1.075$, below the asymptotic value $2-2/(1+\sqrt{3})=1.268$ of Equation (11). This gap is not a claim of a better complexity. The measured quantities are averages over planted instances, whereas Equation (11) bounds every instance, and over the range of n accessible here the polynomial overhead alone, of order $nmk$ elementary gates as in Equation (12), is already large enough to bridge the difference: the bound exceeds the measured cost by a factor growing from 2 at $n=12$ to 290 at $n=38$, whereas a polynomial overhead of order $n^{1.5}$ in the total cost is 230 at the largest n studied and exceeds that difference at every smaller n; extrapolating a base from this window would therefore not be meaningful. What the numbers do establish is that both ingredients of the analysis are valid, and conservative in the typical case: $p_B$ obeys Equation (10) including the root-of-n correction, the amplitude bound $\gamma \ge k^{-r/2}$ of Section 3.4 holds at every point, and the inner quantum search is far cheaper than the worst-case estimate $J\lesssim (\pi /4)k^{r/2}$ on which Equation (11) is built.

5. Conclusions

The k-SAT problem is NP-complete and admits no known efficient classical solution. The best known classical algorithms for 3-SAT run in time $O(1.{307}^n)$ [6,7,8]. In this paper, we propose a hybrid quantum-classical algorithm that integrates Grover’s search as a local subroutine within a randomized framework.

Assuming the given k-SAT instance is satisfiable, the proposed hybrid algorithm requires $O\left(2^{n(1-h(\rho \left)\right)}log(1/\delta )\right)$ classically repeated iterations of the outer loop (up to polynomial factors) to find a satisfying assignment with probability at least $1-\delta$, for any constant $\delta >0$. Each round uses its own clause registers of $O\left(mk\right)$ qubits together with a label register of $O(logk+L)$ qubits; these are retained rather than uncomputed and therefore accumulate over the r rounds, whereas the oracle uses its own clause and formula registers, which are uncomputed and reused. Both counts are polynomial in n and immaterial for the exponential scaling. In each iteration, Grover’s algorithm searches within a Hamming ball of radius $r=n/(1+\sqrt{k})$ centered at a uniformly random assignment. As detailed in Section 3.2, we construct a problem-dependent superposition state that encodes all candidate solutions within this Hamming ball based on the clause structure. Subsequently, Section 3.3 presents an explicit, gate-level implementation of the oracle that identifies solution states within this superposition, built from the elementary gates $\mathrm{QNOT}$, $\mathrm{QAND}$, $\mathrm{QOR}$, and $\mathrm{CNOT}$.

The overall runtime of our algorithm is ${\left(2-{\displaystyle \frac{2}{1+\sqrt{k}}}\right)}^n$, which improves upon the classical local-search bounds for k-SAT and, at $k=3$, upon the best known classical algorithm ($1.{307}^n$). The gain over the classical Hamming-ball template comes from the inner quantum search alone: because the center of each ball is measured, the outer sampling of balls remains a classical repetition and contributes the factor $2^{n(1-h(\rho \left)\right)}$ rather than its square root, and balancing this factor against the $k^{\rho n/2}$ cost of amplitude amplification shifts the optimal radius from $\rho =1/(k+1)$ to ${\rho }^{*}=1/(1+\sqrt{k})$ (Table 1), the resulting base ${(2-2/(1+\sqrt{k}))}^n$ lying below both classical local-search bounds for every $k\ge 3$ (Table 3). The explicit constructions of Section 3.2 and Section 3.3 fix the polynomial overhead at $O\left(nmk\right)$ elementary gates in total, so that the total cost is that of Equations (11) and (12) and no unaccounted-for oracle is left in the complexity. Both bounds entering this exponent were verified numerically on small planted instances (Section 4). This exponent does not improve upon the best known quantum algorithms, which are obtained by accelerating stronger classical solvers [6,8,19,20] (Table 2). The main contribution of this work is therefore an explicit, gate-level realization of a problem-structured quantum local search rather than a new asymptotic record; eliminating the measurement in Step 1 so that the outer loop can also be amplified is a promising direction for future work.