D=−H⊗nU0H⊗nU0
U0∣∣0⊗n⟩=−∣∣0⊗n⟩,U0|x⟩=|x⟩for|x⟩≠∣∣0⊗n⟩.
U0U0=I−2|0⊗n⟩⟨0⊗n|, giving
D=2|+⟩⟨+|−I,
where
|+⟩=2−n/2(|0⟩+|1⟩)⊗n.
Writing a state |ψ⟩=α|+⟩+β∣∣+⊥⟩ where ∣∣+⊥⟩ is orthogonal to |+⟩ (i.e. ⟨+⊥∣+⟩=0) gives that D|ψ⟩=α|+⟩−β∣∣+⊥⟩.
This gives2 that the diffusion operator is a reflection about |+⟩
As the other part of Grover's algorithm is also a reflection, these combine to rotate the current state closer to the 'searched-for' value x0. This angle decreases linearly with the number of rotations (until it overshoots the searched-for value), giving that the probability of correctly measuring the correct value increases quadratically.
Bennet et. al. showed that this is optimal. By taking a classical solution to an NP-problem, Grover's algorithm can be used to quadratically speed this up. However, taking a language LA={y:∃xA(x)=y} for a length preserving function A (here, an oracle), any bounded-error oracle based quantum turing machine cannot accept this language in a time T(n)=o(2n/2).
This is achieved by taking a set of oracles where |1⟩⊗n has no inverse (so is not contained in the language). However, this is contained in some new language LAy by definition. The difference in probabilities of a machine accepting LA and a different machine accepting LAy in time T(n) is then less than 1/3 and so neither language is accepted and Grover's algorithm is indeed asymptotically optimal.3
Zalka later showed that Grover's algorithm is exactly optimal.
1 In Grover's algorithm, minus signs can be moved round, so where the minus sign is, is somewhat arbitrary and doesn't necessarily have to be in the definition of the diffusion operator
2 alternatively, defining the diffusion operator without the minus sign gives a reflection about ∣∣+⊥⟩
3 Defining the machine using the oracle A as MA and the machine using oracle Ay as MAy, this is a due to the fact that there is a set S of bit strings, where the states of MA and MAy at a time t are ϵ-close4, with a cardinality <2T2/ϵ2. Each oracle where MA correctly decides if |1⟩⊗n is in LA can be mapped to 2n−Card(S) oracles where MA fails to correctly decide if |1⟩⊗n is in that oracle's language. However, it must give one of the other 2n−1 potential answers and so if T(n)=o(2n/2), the machine is unable to determine membership of LA.
4 Using the Euclidean distance, twice the trace distance