In Mike and Ike's "Quantum Computation and Quantum Information", Grover's algorithm is explained in great detail. However, in the book, and in all explanations I have found online for Grover's algorithm, there seems to be no mention of how Grover's Oracle is constructed, unless we already know which state it is that we are searching for, defeating the purpose of the algorithm. Specifically, my question is this: given some f(x) such that for some x value, f(x)=1, but for all others, f(x)=0, how does one construct an oracle that will get us from our initial, arbitrary state |x>|y> to |x>|y+f(x)>? As much explicit detail as possible (perhaps an example?) would be greatly appreciated. If such a construction for any arbitrary function is possible with Hadamard, Pauli, or other standard quantum gates, a method for construction with these would be appreciated.

  • $\begingroup$ "here seems to be no mention of how Grover's Oracle is constructed, unless we already know which state it is that we are searching for, defeating the purpose of the algorithm. " ... "Grover's Oracle" is the problem to be solved. You don't construct it. You're given (oracle access to) it and asked to perform computation to uncover the value. If it helps, pretend that I construct the oracle, and then ask you to solve the problem. (Also, note that reading/writing/preparing a database of $N$ items takes longer than running Grover's $\sqrt{N}$-time algorithm.) $\endgroup$ Commented Jul 4, 2017 at 16:38
  • 2
    $\begingroup$ But what if instead of being given the oracle, we are given some f(x)? Imagine we are solving a 3-SAT problem and want to use Grover's to provide a speedup to the solution. We know the f(x) in question (the 3-SAT truth clauses), but don't necessarily know which bit string x will yield a true result when plugged into the 3-SAT. Mustn't there be a way to construct an oracle from the 3-SAT function to find the correct bit string? If there isn't, and it is as you suggest, something to be provided by someone else, Grover's algorithm seems rather artificial, merely an exercise given to you. $\endgroup$
    – Will
    Commented Jul 5, 2017 at 18:11
  • $\begingroup$ I'm confused and would appreaciate any help I can get from you. ![please look at my setup](i.sstatic.net/TTTJw.jpg) I have q0 and q1 passing an "H" gate then the toffoli with an !0> - switching !0> + !11> to !111> Same with the next gate When running I see the expected results. But what drives me nuts: From the explaination in the article I would understand my setting also as a ^(q0 & q1) Then the result should show me "00" as solution for q0 and q1. What's wrong with me idea??? Thanks a lot! -Jerry $\endgroup$
    – jerry
    Commented Jun 28, 2021 at 12:57

3 Answers 3


The oracle is basically just an implementation of the predicate you want to search for a satisfying solution to.

For example, suppose you have a 3-sat problem:

(¬x1 ∨ ¬x3 ∨ ¬x4) ∧
    (x2 ∨ x3 ∨ ¬x4) ∧
    (x1 ∨ ¬x2 ∨ x4) ∧
    (x1 ∨ x3 ∨ x4) ∧
    (¬x1 ∨ x2 ∨ ¬x3)

Or, in table form with each row being a 3-clause, x meaning "this variable false", o meaning "this variable true", and space meaning "not in clause":

1 2 3 4
x   x x
  o o x
o x   o
x o x

Now make a circuit that computes whether the input is a solution, like this:

solution checker

Now, to turn your circuit into an oracle, hit the output bit with a Z gate and uncompute any garbage you made (i.e. run the compute circuit in reverse order):

oracle circuit

That's all there is to it. Compute the predicate, hit the result with a Z, uncompute the predicate. That's an oracle.

Iterate diffusion steps with oracle steps, and you've got yourself a grover search:

grover search

... although you should probably pick an example with fewer solutions, so the progress is gradual (instead of rotating along the start-state-solution-state plane by more than 90 degrees per step as my example is).

  • $\begingroup$ Thanks, this was immensely helpful. Incredibly clear, answered everything I asked (and even used common quantum gates!) Is there any reason you decide to change all of your starting qubits to the |1> state before putting them in superposition with Hadamard gates instead of just putting the |0> state qubits through Hadamards (i.e. is there an advantage to this)? Also, what operation is that for your diffusion steps? Looks like controlled X, but are you using |1>'s or |0>'s as controls? $\endgroup$
    – Will
    Commented Jul 6, 2017 at 18:03
  • $\begingroup$ @Will I used a different starting state. You can do that as long as you also change the state negated by the diffusion operator (they have to match). All starting/diffusion states that have equal angle-distance to every computational basis state work equally well. The little circled-plus control in my diagram is an "X-axis control", which is equivalent to a normal control surrounded by Hadamard gates. It looks like a NOT because they're interchangeable. My starting/diffusion state is $(\frac{1}{\sqrt{2}} |0\rangle - \frac{1}{\sqrt{2}} |1\rangle)^{\otimes n}$. $\endgroup$ Commented Jul 6, 2017 at 18:43
  • $\begingroup$ Fantastic answer, and thanks for the link to algassert.com/quirk ! $\endgroup$ Commented Jul 11, 2017 at 13:17
  • $\begingroup$ In addition to this great answer, you can get rid of the last qubit by directly using a multi-controlled Z gate having as target the last but one qubit link $\endgroup$
    – tigerjack
    Commented Sep 15, 2020 at 15:12
  • $\begingroup$ @tigerjack89 You need to conjugate that Z gate with X gates to make it act like an off control instead of an on control. $\endgroup$ Commented Sep 15, 2020 at 19:29

You can also get a solution which uses only one ancillary qubit (but relies on NOT gates with multiple controls), by getting your input to algebraic normal form (e.g. with Mathematicas BooleanConvert).

For example let us use the 2x2 "Sudoku" example in the Qiskit book (i.e. a 2x2 grid of 1bit numbers where in each column and row there should be no duplicates). Numbering the entries like

$$ \begin{matrix} x_0 & x_1 \\ x_2 & x_3 \end{matrix} $$

our function is

$$ f(x_0, x_1, x_2, x_3) = (x_0\oplus x_1)\land(x_2\oplus x_3)\land(x_0\oplus x_2)\land(x_1\oplus x_3) $$

Either by hand or with computer help, we arrive at

$$ f(x_0, x_1, x_2, x_3) = (x_0\land x_3)\oplus (x_1\land x_2)\oplus (x_0\land x_1\land x_2)\oplus (x_0\land x_1\land x_3)\oplus (x_0\land x_2\land x_3)\oplus (x_1\land x_2\land x_3) $$

As you are looking for an operation that gives you $|x,y\rangle\to|x,f(x)\oplus y\rangle$, we can just apply the terms one after the other. And as each term is just an AND between multiple variables, this can be written as a controlled not gate, where the not operates on $y$ and has a control for each appearing $x_i$. For our example, this looks as follows (q is $x$ and o is $y$)


Implementing one Grover iteration, we see that it yields the two solutions

$$ \begin{matrix} 0 & 1 \\ 1 & 0 \end{matrix}\quad\text{and}\quad \begin{matrix} 1 & 0 \\ 0 & 1 \end{matrix} $$

as expected.




For many famous NP-complete problems, the Grover oracle can be constructed with quantum annealing: https://arxiv.org/abs/2304.10488 . The time to realize this oracle scales only polynomially with the memory size, and no change to the leading order scaling for the Grover algorithm.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.