Verification of Quantum Computing

Elham Kashefi

University of Edinburgh Oxford Quantum Technology Hub Paris Centre for Quantum Computing Laboratoire traitement et communication de l'information Google Martinis Lab Motivation

Bristol QET Lab Quantum Machines EraTU Delft Quantum Tech Lab

Lockheed Martin/NASA/Google Artificial Intelligence lab Oxford NQIT Hub

These devices become relevant at the moment they are no longer classically simulatable

Existing methods of Testing/Validation/Simulation/Monitoring/Tomography ... all become IRRELEVANT

2 What is Quantum Computer ? Is it a Quantum ComputerBOX ? Should we pay $10000000 for a quantum computer

That kind of tests work only for a specific problem.

We don’t know if all the questions that quantum computer can solve are classically testable

Simple test: We ask the box to factor a big number Complexity Picture

BQP NP

BPP Jone’s Polynomial Quantum Simulation Trace Approximation Graph Isomorphism Boson Sampling Instantaneous QC

Factoring/Discrete-log/Pell's Equation TestingBlind outcome Computation correctness ? Target

Efficient verification methods for realistic pseudo quantum computers

Correctness of the outcome - - Architectural constraints None-universal: Operation monitoring - - Experimental imperfections D-Wave machine - Quantum property testing Quantum Simulator

How do we do it?

7 Verification of Classical Computing

business buy computing from a service provider

outsourcing complex computing to larger servers ➡ Cloud Computing

➡ Small Devices

➡ Large Scale Computation

Network-based computation

8 Methodology

Formalising the Question Combat the complexity

➡ Interactive Proof System

➡ Cryptographic Toolkit

➡ Classically controlled QC

Implementation Platform

9 + = 1 ( 0 + 1 ) | ⌦ ⇥2 | ⌦ | ⌦ ⇧ | ⌦

|±⌦ X

Z

H

J( + ⇥ + r⇤)

r ⌅ + | ⇥⌦

|±+⇥+r⇤⌦ + IP for Quantum Computing{| ⇥⌦} X =(U,˜ ⌅ ) { x,y}

X sx,y Z ⌅x,y =( 1) ⌅x,y + sx,y⇤ Classical Verifier Quantum Classical Computer Poly (input size) rx,y R 0, 1 ⌥ Quantum{ Computer} is not trusted Yes X satisfies some property ⇥ 0, , 7⇤/4 x,y ⌥R { ··· }

sx,y := sx,y + rx,y

0 , 1 | ⌦ | ⌦ BPP QNC ⇧ NC2 QNC1 ⇧ + , | ⇥⌦ |⇥⌦ 0 , 1 | ⌦ | ⌦ M ⇥ + s =0 | ⇥⌦ ⌃ M ⇥ s =1 |⇥⌦ ⌃

3 IP for Quantum Computing

Rahul Jain, Zhengfeng Ji, Sarvagya Upadhyay, and John Watrous, FOCS 2008

IP =IP PSPACE = PSPACE = QIP

BQP

Quantum Prover NP

P

QuantumClassical Verifier + = 1 ( 0 + 1 ) | ⌦ ⇥2 | ⌦ | ⌦ ⇧ | ⌦

|±⌦ X

Z

H

J( + ⇥ + r⇤)

r ⌅ + | ⇥⌦

|±+⇥+r⇤⌦ + IP for Quantum Computing{| ⇥⌦} X =(U,˜ ⌅ ) { x,y}

X sx,y Z ⌅x,y =( 1) ⌅x,y + sx,y⇤ Classical Verifier Quantum Computer r 0, 1 x,y ⌥R { } Yes X satisfies some property ⇥x,y R 0, , 7⇤/4 Gottesman (04) - Vazirani (07)- Aaronson⌥ {$25 Challenge··· (07) } Does BQP admit an interactive protocol where the prover is in BQPsx,y and:= thes verifierx,y + is rinx,y BPP?

D. Aharonov and U. Vazirani, arXiv:1206.3686 (2012). 0 , 1 | ⌦ | ⌦ BPP QNC ⇧ NC2 QNC1 ⇧ + , | ⇥⌦ |⇥⌦ 0 , 1 | ⌦ | ⌦ M ⇥ + s =0 | ⇥⌦ ⌃ M ⇥ s =1 |⇥⌦ ⌃

3 Yes we can but with

Semi Classical Verifier

Classical & Quantum Communication Classical Verifier Quantum Prover

+ Trusted random single qubit generator

Broadbent, Fitzsimons and Kashefi, FOCS 2009 Fitzsimons and Kashefi, arXiv:1203.5217 2012 Yes we can but with

Entangled non-communicating Provers

Quantum Prover Quantum Prover

Classical Communication Classical Communication

Classical Verifier

Reichardt, Unger and Vazirani, Nature 2012 Gheorghiu, Kashefi, Wallden, NJP, 2015 Cryptographic Toolkit

Classical World Quantum World

Gentry 09 Broadbent, Fitzsimons and Kashefi 09 A Lattice-based cryptosystem Blind Quantum Computing that is fully homomorphic QKD + Teleportation

Enables arbitrary computation on encrypted data without decrypting

15 10101010 1010 1 1 10101 1 ib⇡/2 ia⇡/2 i(a b)⇡/2 = = i(a b)⇡ 0 e 0 eib⇡/2 0 0e eia⇡/2 00 eei(a b)⇡/2 1 1 0 e i(0a b)⇡e ^1 1 ✓ ✓ ◆✓◆✓ ◆✓◆✓ ◆✓◆✓ ◆ ✓◆ ✓ ^ ◆✓ ◆ ◆✓ ◆ Z HolyZ Grail of Cryptography since 1987 10 10 10 1 10 1 10 10ib⇡/2 10ia⇡/2 i(a b)1⇡/2 10= i(a b)⇡1 0 e 0 e 0 e = 1 0 e ^ 1 10 10 10 1 ib⇡/210✓ ia⇡◆✓/2 1 ◆✓i(a b)⇡/2 ◆✓ ◆ ✓i(a b)⇡ ◆✓ ◆ Rivest, Adleman10 and Dertouzos10 100 e =1 010e 01 e 1 0 e ^ 1 ib⇡/2 ia⇡/2 i(a b)⇡/2 ✓ 2 = f(r◆✓1=,r2,i✓(a2,b)⇡2) ◆✓ ◆✓ ◆ ✓ ◆✓ ◆ Can0 we eprocess encrypted00 ee ibdata⇡/2 without00 edecryptingiae⇡/2 0it e i(a b)⇡/12 1 0 e0 e^ i(a b)⇡ 1 1 ✓ ◆✓✓ ◆✓◆✓ ◆✓ ◆✓Z 2◆◆✓=f✓◆(r1✓,r2,✓2^◆✓, ◆✓2)◆◆ Z Z mZ = f(r ,r , ✓ , ) m (m) 2 1 2 2 2 2 = f(r1,r2, ✓2, 2) = f(r ,r , ✓ , ) E 2 = f(r1,r2, ✓2, 2) 2 1 2 2 2 f( (m)) m Limited(m) ClientmE Untrusted Server m E m (m) (f(m() (m))) = f(m) E f( (m))DE E (m) f( (m)) (m) f( (m)) E E E E E f( (m(f))( (m)))(f( =(mf)))( =mf)(m) f( (m)) (f( (m))) = f(m) E D E E D E (fD( (m)))E = f(m) D E (f( (m))) = f(m) D E

1

1 1 1

1

1 Measurement-based classical computation

1 1 Janet Anders∗ and Dan E. Browne† 1Department of Physics and Astronomy, University College London, Gower Street, London WC1E 6BT, United Kingdom. (Dated: May 8, 2008) We study the intrinsic computational power of entangled states exploited in measurement-based quantum computation. By focussing on the power of theBlindclassical cQuantumomputer that con Computingtrols the mea- surements, we develop a classification of computational resource power, leading naturally to a notion of resource states for measurement-based classical computation. Surprisingly, the Greenberger- Horne-Zeilinger and Clauser-Horne-Shimony-Holt problems emerge naturally as optimal examples. Our work exposes an intriguing relationship between the violation of local realProgramistic mod eisls encodedand the in the classical control computer computational power of entangled resource states. Computation Power is encoded in the entanglement

PACS numbers: 03.67.Lx, 03.65.Ud

control computer Introduction.– Measurement-based quantum computa- control computer Hide tion is an approach to computation radically different to Angles of measurements conventional circuit models. In a circuit model, infor- Verifier • Results of Measurements mation is manipulated by a network of logical gates. In • measurement-based quantum computation (also known measurmeasurementement site sites as “one-way” quantum computation) information is pro- resresourourcece sstatetate cessed by a sequence of adaptive single-qubit mea- surements on a pre-prepared multi-qubit resource state FIG. 1: The control computer provides one bit of classical [1, 2, 3]. A classical computer controls all measurements information (downward arrows) to eachQuantumsite (cir Computercles in the re- (see Fig. 1) by keeping track of the outcomes of previous source state) determining the choice of measurement basis. measurements and determining the bases for the mea- After the measurement, one bit of classical information (up- ward arrow), such as the outcome of the binary measurement, surements to come. The separation of entangling and is sent back to the control computer. single-qubit operations leads to significant experimental advantages in a number of different systems [4]. Notably, the classical control computer is the only part of the model where active computation takes place. A strik- power what are resource states that enable determinis- ing implication of the measurement-based model is that tic universal classical computation? Here we show that entangled resource states can possess an innate computa- such resource states exist and that an unlimited supply tional power. Merely by exchanging single bits with each of three-qubit Greenberger-Horne-Zeilinger (GHZ) states of the measurement sites of the resource state (see Fig. implements this task in an optimal way. Moreover, our 1), the control computer is enabled to compute problems model provides a unifying picture drawing together some beyond its own power. For example, by controlling mea- of the most important results in the study of quantum surements on the cluster states the control computer is non-locality. Specifically, we show that the GHZ prob- promoted to full quantum universality. lem [7] and the Clauser-Horne-Shimony-Holt (CHSH) construction [8] emerge as closely related to tasks in Impressive characterization of the necessary properties measurement-based classical computation (MBCC), as of resource states that enable a computational “boost” does the Popescu-Rohrlich non-local box [9]. to universal quantum computation has already been Framework for measurement-based computation.– First achieved [5, 6], however, little is known about the re- we need to cast measurement-based quantum computa- arXiv:0805.1002v1 [quant-ph] 7 May 2008 quirements for a resource state to increase the power of tion in a framework which assumes as little as possible the classical control computer at all. In this paper, we de- about the physical properties of the computational re- velop a framework which allows us to classify the compu- source. The model consists of the following components tational power of resource states for a control computer (see Fig. 1): 1) a control computer, with a specified com- of given power. By doing so, a natural classical ana- putational power; 2) n measurement-sites, which may logue of measurement-based computation emerges: con- share pre-existing entanglement, or correlation, but may sidering a control computer of restricted computational not communicate during the computation 3) limited com- munication between control computer and sites - during the computation each measurement site receives a single ∗[email protected] bit from the control computer and sends back a single †d.browne@ucl.ac.uk bit in return. It is emphasized that we place no restric- 10 10 10 1 10 1 = 0 eib⇡/2 0 eia⇡/2 0 e i(a b)⇡/2 1 0 e i(a b)⇡ 1 ✓ ◆✓ ◆✓ ◆✓ ◆ ✓ ^ ◆✓ ◆ 10 10 10 1 10 1 10 =10 10 1 10 1 0 eib⇡/2 0 eia⇡/2 0 e i(a b)⇡/2 1 0 e i(a b)⇡ 1 = Z ✓ ◆✓ ◆✓ 0 eib◆✓⇡/2 ◆ 0✓ eia⇡/2^ ◆✓0 e◆ i(a b)⇡/2 1 0 e i(a b)⇡ 1 ✓ ◆✓ ◆✓ ◆✓ ◆ ✓ ^ ◆✓ ◆ Z 2 = f(r1,r2, ✓2, 2) Z

2 = f(r1,r2, ✓2, 2) m m 2 = f(r1,r2, ✓2, 2) (m)=(m + ✓ + r⇡ , 0 + ei✓ 1 ) E | i | i (m)=(m + ✓ + r⇡ , 0 + ei✓ 1 ) E | i | i (m2)=m + PR2 + ✓2 (m )=m + PR + ✓ m E E 2 2 2 (m1) (m2)= (m1 m2) UBQC(m1) based(m2)= (m on1 m no-cloning2) (m1)=m + assumptionPR1 + ✓1 E ⇤ E E ⇤ E ⇤ E E ⇤ E 10 10 10 1 10 1 (m)=m m/P P ✓ ib⇡/2 ia⇡/2 i(a b)⇡/2 = i(a b)⇡ (m)=m m/P P ✓ (m )=m0 +e PR +0✓ e 0 e 1 0 e ^ 1 D b e D b e 2 ✓ 102◆✓ 2 10◆✓ 10◆✓ ◆ ✓1 10◆✓ ◆ 1 given random single qubit E = i✓ ib⇡/2 ia⇡/2 i(a b)⇡/2 i(a b)⇡ Z (m1) (m02)=+ e0 1e(m1 m20) e 0 e 1 0 e ^ 1 0 + ei✓ 1 E ⇤ E | i ✓ E|Ati most⇤◆✓ one-bit of information◆✓ ◆✓ ◆ ✓ ◆✓ ◆ | i | i ✓ R 0, ⇡/4, 2⇡/4, , 7⇡/4 (Zm)=m m/P aboutP ✓ could be leaked 2 { ··· }D b e ✓ 0, ⇡/4.2⇡/4, , 7⇡/4 2 = f(r1,r2, ✓2, 2) 2R { ··· }

m Xi = PRi + ✓i Ri 2R=ZfQ(r✓1,r2R, ✓[A2, Suitably2) Small Range] 2 2 (m)=(m + ✓ + r⇡ , 0 + ei✓ 1 ) E m | i | i (m2)=m + PR2 + ✓2 E (munconditionally)=m + PR secure+ ✓ E 1 1 1 (m1) (m2)= (m1 m2) E ⇤(mE 2)=mE+ PR⇤2 + ✓2 (m)=E m m/P P ✓ D (m b) (me)= (m m ) E 1 ⇤ E 2 E 1 ⇤ 2 enables perfect removal of at each step (m)=m Xm/P= PRP +✓✓ R Z ✓ [A Suitably Small Range] D b i e i i i 2R Q 2R

X = PR + ✓ R Z ✓ [A Suitably Small Range] i i i i 2R Q 2R

1

1

1

1

1 Pi Pi 1 ( 0 + ei 1 ) ⇤2 | | P 1 ( 0 + ei 1 ) i ⇤2 | | , 1 2 ··· 1 ( 0 + ei 1 ) ⇤2 1, 2 | | 0 ··· := ( 1, 2 , 1 , 2 ,P1 E12N2) H { } { } { } 1, 2 0 ··· := ( 1, 2 , 1 , 2 ,P1 E12N2) P 0 H { } { } { } 1 1 ((a + b) 0 +(a b) 1 ) ⇤2 0 ⌅ | 0 | := ( 1, 2 , 1 , 2 ,P1 E12N2) P1 1 H { } { } { } ⇥ ⇤ ((a + b) 0 +(a b) 1 ) |⌅ 2 | | P 0 11 1 1 ⇥1 1 ((a + b) 0 +(a b) 1 ) ⌅| ⇤2 | | 1 11 1 Z = 1 ⇤ 11⌅ 1 1 ⌥ 2 11 11 ⇥ 10 1 1110 1| 10 1 10 1 ⌥1 1Z =11 ⇤ 1 ⌅ ⌥ ⌥ 2 ib11⇡/2 11ia11⇡/2 1 1 i(a b)⇡/2 = i(a b)⇡ Latex Template ⇧ 0 e ⌃ 100 e 100 e 101 0 e1 ^ 101 1 1 1 11 1 1 11✓ ⌥1 ◆✓1Z = 1 ⇤ 1 ◆✓ ⌅ ◆✓ ◆ ✓ = ◆✓ ◆ H = ⌥ ⌥ 02 eib11⇡/2 011eia⇡/2 0 e i(a b)⇡/2 1 0 e i(a b)⇡ 1 Latex Template⇤2 1 1 ⇧ ⌃ 10 10 10 1 ^ 10 1 Z ⇥ 1 11✓ ⌥1 ◆✓1 1 1 ◆✓ ◆✓ ◆ ✓ ◆✓ ◆ H = ⌥ ib⇡/2 ia⇡/2 i(a b)⇡/2 = i(a b)⇡ 01Latex Template10⇤2 1 1 ⇧ 0 e ⌃ 0 e 0 e 1 0 e ^ 1 September 15, 2008X = ZZ = ⇥ ✓ ◆✓ ◆✓ ◆✓ ◆ ✓ ◆✓ ◆ 10 0 1 1 11 ⇥ 01 ⇥ H10= ⇤ September 15, 2008X = Z = 2 1 1 10 Z 0 1 ⇥2 = f(r1,r2, ✓2, 2) + = 1 (Local0 + Cli1 )ord Group H, S,⇥ I ⇥ 2 September{15, 2008} 01 10 ⇥2 = Tr1,2,3,4,6[ ( ⇤ ⇤| 1⇥ ⇥2 +| ⇥+ 3,|4,5⇥,6) †] X = Z = 2 = f(r1,r2, ✓2, 2) P | ⌥⌃ | ⇤ ⇤ | ⌥⌃ | P m[[ 1 2]] =1Local [[ 2 Cli]][[ 1ord]] Group10H, S, I 0 1 P P + = ( 0P+ 1P) { ⇥ } ⇥ ⇥2 = T⇤r1,2,3,4,6[i( ⇤ ⇤ 1 | ⇥2 +2 |+⇥ 3,4,|5,6⇥) †] = f(r ,r , ✓ , ) 1 1 eP | ⌥⌃ | ⇤ ⇤ | ⌥⌃ | P 2 1 2 2 2 J() = | ⇥ m[[ 1 2]] =1 [[ 2]][[ 1]] i✓ ⇤2 1 ei [[ (1m):=(2]] == [[ m2]]++ ✓[[=+1]]Localr(⇡0 ,+ Cli+1)ord= Group0 + H,e S,1 I) P P 2 P P✓ { } ⇥2⇥E=PTr⇥1,2P⌅,3,4,6[i( ⇤ ⇤P 1 |⇥⇥⇥2 P + |+⇥3,4|,5|,6)⇥ i†] | i | i 1 |1 ⇥ eP | ⌥⌃ | ⇤ ⇤ | ⌥⌃ | P i✓ |±⇥ J() = ⇤ i [[ 1 2]] =1 [[ 2]][[ 1]] c 2 1 c e [[ (1m):=(2]] =m= [[ m2]] + [[✓ +1]] r⇡ , +✓ = 0 + e 1 ) ⇥out = PO EG (⇥in + + V Ia)(EmGA,2P)=O a⇥m P+l(PRa):⌅2a

2

1

1

1

3

3 3

3

1

1 1 Appendix A. Appendix B contains a universality proof of the brickwork states that is lengthy due to its figures, while Appendix C contains modified versionsofthemainprotocoltodealwith quantum inputs or outputs. 2 Main Protocol Suppose Alice has in mind a unitary operator U that is implemented with a pattern on a brickwork state n m (Figure 1) with measurements given as multiples of π/4. This pattern could have been G × designed either directly in MBQC or from a circuit construction. Each qubit ψx,y n m is indexed by a column x 1,...,n and a row y 1,...,m . Thus each qubit| is⟩∈ assigned:G × a ∈ { } ∈ { } measurement angle φx,y,asetofX-dependencies Dx,y [x 1] [m], and a set of Z-dependencies Appendix A. Appendix B contains a universality proof of the brickwork states that is lengthy ⊆ − × due to its figures, while Appendix C contains modifiedDx,y′ version[softhemainprotocoltodealwithx 1] [m]. Here,weassumethatthedependencysets Xx,y and Zx,y are obtained via the Appendix A. Appendix B contains⊆ − a universality× proof of the brickwork states that is lengthy quantum inputs or outputs. Appendixflow A. construction Appendix B contains [DK06]. a universality During the proof execution of the brickwork of the states patter thatn, is the lengthy actual measurement angle φx,y′ due to its figures,due while to its Appendix figures, while C contains Appendix modified C contains version modifiedsofthemainprotocoltodealwith versionsofthemainprotocoltodealwith 2 Main Protocol quantum inputs or outputs.is a modification of φx,y that depends on previous measurement outcomes in the following way: quantum+ = inputs1 ( 0X+ or1 outputs.) Suppose Alice has in mind a unitary operator U that| ⇧ islet implemented2 s|x,y⇧ |=⇧ i withDx,y as patterni be the on a parity brickwork of all measurement outcomes for qubits in Xx,y and similarly, 2 Main Protocol2 Main Protocol1 ∈ state (Figure 1) with measurements given as multiplesZ+ = ⇥ of π( /04.⊕+ This1 ) pattern could have been n m s| ⌥ = 2 | ⌥ ′ | s⌥ i be the parity of all measurement outcomes for qubits in Zx,y.Thenφ = G × Suppose AliceSuppose has in⇧ mindOur Alicex,y a protocol unitary has ini mind is operatorD describedx,y a unitaryU inthat terms operator is implemented of theU measurement-basedthat is with implemented a patternmodel with on for a a brickwork quantum pattern oncomputation a brickwork x,y′ designed either directly in MBQC or from a circuit| ⇧ constructX ⊕ion.∈ Each qubit ψx,y n m is Our protocol is described in terms of the measurement-basedstate n m (Figuremodelstate for 1)(MBQC) with quantum(Figure measurementssx,y [RB01, computation 1) with RBB03]. measurements givenZ While as multiples| the computational⟩∈ givenG of as×π/ multiples4. This power pattern of ofπ this/4. couldmodel This patternhave is the been same could as have in the been indexed by a column x 1,...,n Gand× a row y n( m⇧1,...,m1) φ.x,y Thus+ s eachx,yπ qubit. Protocol is assigned: 1 aimplements a blind quantum computation for U.Notethat (MBQC) [RB01, RBB03]. While the computational∈ { designed} power either of this directlymodelG∈quantum×{ is in the MBQC same circuit} as or model in from the [Deu89] a circuit (and construct our protocolion. could Each be qubit completelyψ recast into thisis model), it measurement angle φx,y,asetofX-dependenciesdesigned|±Dx,y⇧ −| either⌥[x directly1] [m], in and MBQC a set or of Z from-dependencies a circuit construction. Eachx,y qubitn m ψx,y n m is quantum circuit model [Deu89] (and our protocolindexed could be by com apletelycolumn recasthaswex⊆ proven into assume1−,...,n this to× model), be conceptually thatand it a Alice’srow enlighteningy input1,...,m to to reason. the Thus about computation each the qubit distributed| is⟩∈ assigned: is task builtG × of| blind a into⟩∈ quantumUG.Inotherwords,Alicewishesto× Dx,y′ [x 1] [m]. Here,weassumethatthedependencysetsindexed by a columnXx,yx and1Z,...,nx,y areand obtained⌫ a row viay the1,...,m . Thus each qubit is assigned: a has proven to be⊆ conceptually− × enlightening to reason about the distributedX computationcompute task∈ { of blind usingU quantum} 0∈ this,herinputisclassicalandthefirstlayersof{ approach.⌫ p(⌫) }Tr∈( TheP{ incorrect noveltyB}(⌫ of∈)){ our✏ approac} h is in using the uniqueU may feature depend on it. flow construction [DK06]. Duringmeasurement the execution anglemeasurement ofφ thex,y,asetof patter anglen,X theφ-dependenciesx,y actual,asetof measurementX-dependenciesDx,y [x angle1] Dφx,y[m], and[x a1] set[ ofm],Z-dependencies and a set of Z-dependencies computation using this approach. The novelty of our approach is in usingof|± MBQC the⌥+ unique= that1 ( 0 separates feature|+ ⟩1 ) the classical⊆ and− quantum× x,y′ ⊆ parts− of a× computation, leading to a generic Dx,y′ [x 1] D[x,y′m]. Here,weassumethatthedependencysets[x 1] [m⇥2]. Here,weassumethatthedependencysetsXx,y and Zx,y Xarex,y obtainedand Zx,y viaare the obtained via the of MBQCis that a modification separates the classical of φx,y andthat quantum depends parts⊆ on of− a previous co×mputation,Z⊆scheme measurement− leading| for⌥× blind to a| generic computation⌥ outcomes| ⌥P in of anythe circuit follow withouting way: requiring any quantum memory for Alice. This scheme for blindX computation of any circuit withoutflow requiri constructionng any quantumflow [DK06]. constructionis memoryProtocol fundamentallyX During for [DK06]. Alice. the 1 di This executionffUniversalerent During1 from of the previously the Blind execution patter known Quantumn, of the the classical actual patter Computationor measurementn, quantum the actual schemes. angle measurement Ourφx,y′ protocol angle canφx,y′ let sx,y = i Dx,y si be the parity of all measurement outcomes⇧ for qubits in Xx,y and similarly, is fundamentally different⊕ ∈ from previously knownis classical a modificationor quantumis a of modificationschemes.φbex,y viewedthat| Our⌥ as depends protocol of a distributedφx,y can onthat previous depends version of measurement on an MBQCprevious computation outcomes measurement (wh in theere outcomes Alice follow preparesing in way: the the follow individualing way: Z ′ H 1. Alice’s preparation1 be vieweds asx,y a distributed= i Dx,y versionsi be of the an MBQC parity computation of allX measurement (where AliceX prepares outcomes the individual for qubits in✓ Z+x,y↵ +.Thenr⇡ φx,y′ = let s = i Dlet ssi bequbits,= thei Bob parityDx,y doessi ofbe the all the entanglement0 measurement parity1 of andall outcomes measurement measurements, for qubits outcomes and Alice in computesX forx,y qubitsand the similarly, in classicalXx,y feedforwardand similarly, X ⊕ ∈ x,y x,y x,y Z 1 qubits, Bob doessx,y the entanglementZ and measurements, and Alice⊕ computes∈ Z the classical⊕For∈ each feedforward column x =1,...,n ( 1) φx,y + s π . ProtocolZ 1 implements′ a blindmechanism), quantum|±′ ⌥ on top computation of which randomness for U.Notethat is added in order to obscure the computation from Bob’s x,y s = i D ssx,yi be= thei D parityx,y si be of allthe measurement parity of all outcomesmeasurement for outcomesqubits in Z forx,y qubits.Then inφZ′ x,y=.Thenφx,y′ = mechanism),− on top of which randomness is addedx,y in order to obx,yscure theJ( computation+ ⇥∈+ r⇤) from Bob’sB 1C x,y we assume that Alice’s input to the computationX ⊕ ∈ isXpoint built⊕ ofFor into view. eachU The.Inotherwords,Alicewishesto family row ofy graph=1,...,m states called cluster states [RB01] is universal for MBQC (graph s Z sx,y X Z B C point of view. The family of graph states called cluster( 1) statesx,y φ [RB01]+(s is1)π universal. φProtocolx,y + fors MBQCx,yπ 1. implements (Protocolgraph 1 aimplements blind quantum a blind computation quantum for computationU.Notethat for U.Notethat compute U 0 ,herinputisclassicalandthefirstlayersofx,y −x,y statesH areU initialmay depend entangled@ onA states it. required for the computation inMBQC).However,themethod1 iθx,y states are initial entangled states required for the− computation inMBQC).However,themethodwe assumer that1.1 Alice’s Alice input prepares to thei↵ computationψx,y R is! built+θi↵x,y into" =U.Inotherwords,Alicewishesto( 0 + e 1 ) θx,y =0, π/4,...,7π/4 and sends | ⟩ we assume that Alice’s⇥ that input allowsZ to arbitrary the computation computation1 e is builton the into cluster1U.Inotherwords,Alicewishesto statee consists in√2 first tailoring the cluster state that allows arbitrary computation on the cluster state consists incompute first tailoringU 0 the,herinputisclassicalandthefirstlayersof cluster state1 | 1 ⟩∈ {! U may depend| ⟩ on it. | ⟩ | } Protocol 1 compute U 0 ,herinputisclassicalandthefirstlayersofto the specificthe computation qubits2 i↵ by to performing Bob.+ 2 U somemayi↵ computationa depend onlbasismeasurements.Ifwewereto it. to the specific computationUniversal by performing Blind some Quantum computationa Computationlbasismeasurements.Ifwewereto| ⟩ + J(|⟩+ ⇥ + r⇤) e 1 e 1 ⇥use thisH principle for blind✓ quantum◆ computing,✓ Alice would◆ have to reveal information about the use this principle1. Alice’s for blind preparation quantum computing, Alice would haveProtocol to reveal| ⇧ information 1 Universal about Blind the Quantum Computation structure of the underlying graph state. We introduceProtocol a new 1 familyUniversal of statesstructure2. Blind called Bob’s Quantum of the thebrickwork preparation underlying Computation graph state. We introduce a new family of states called the brickwork For each column x =1,...,n 1. Alice’sstates+⇥+r⇤ preparation(Figure 1) which are universal for X Y plane measurements and thus do not require the states (Figure 1) which are universal for X Y 1.plane Alice’s measurements preparation and|± thusr doJ⇧ ( not+ ⇥ require+ r⇤) the s+r 1 For each row y =1,...,m− initial⇤ computational2.1 Bob createss basis0, measurements.1 ; anX entangledJ(↵) − Other universa statel from graph states all received for that do not qubits, require according to their indices, by initial computational basis measurements. Other universaFor eachl graph column statesForUniversalx each for=1 that,...,n column do Blind notx require=1 Quantum,...,n2 { } Computings1 1 +initialiθx,y computational basisctrl measurements⌫ have appeared in [CLN05]. initial computational1.1 Alice basis prepares measurementsψx,y have appearedR !+θ in"[CLN05].= ( 0For+⇥ e each rowr1 ) yapplyingθ=1x,y,...,m=0, π⌫/4p(,...,⌫) Tr-7Z(πP/incorrect4gatesand✓ B◆ between sends(⌫)) ✏ the qubits in order to create a brickwork state n m (see Forx,y each√ row2 y{|=1⇧,...,m}+⇥⇤  × To the best of our knowledge, this is| the⟩∈ first time{! that a new functionality| ⟩ To the has| ⟩ best been| of achieved our knowledge, this is} thei↵1 first timeiθ thatx,y a new functionality has been achieved G the qubits to Bob. 1.1 Alice| ⌥ preparesDefinitionψx,y R 1).!+θ 1(" =e ( 0 + e 1 ) θx,y =0, π/4,...,7π/4 and sends thanks to MBQC (other theoretical advances due to MBQC appearin[RHG06,MS08]).Fromthanks˜ + to MBQC (otherP theoretical1 x,y i advancesθx,y √2 due to MBQC appearin[RHG06,MS08]).From 1.1 Alice preparesX =(U,ψx,y⌅⇥x,y R) !+θx,y| " =⟩∈1 √ ({0! + e i1↵ )| ⟩θx,y =0, |π/⟩4,...,| 7π/4 and sends } a conceptual2. Bob’s point of view, preparation our contribution shows that MBQC has tremendousathe conceptual| {| qubits potential⟩∈⌥ } { point to! for Bob. of the view,2 our| ⟩ contribution1 e| ⟩ shows| that MBQC has tremendous} potential for the the qubits to Bob.3. Interaction+⇥+r⇤ 1 and measurement✓ ◆ development of new protocols, and maybe even of algorithms. development|± +⇥+r of⇤⌥ new protocols,0 1 ✓ and✓ maybe even of algorithms. 2.1 Bob creates an entangled state from2. all Bob’s received preparation|±For qubits, each⌥ according column1 x to=1 their0 ,...,n indices, by 1.3 Outline of Protocols 2. Bob’s preparation1.3 Outline of Protocols applying ctrl-Z gates between the qubits2.1 in Bob order creates to create an entangled aB brickwork1C state state fromn allm received(see qubits, according to their indices, by +⇥For+⇥ each rowB Cy =1,...,m The outline of the main protocol is as follows. Alice has2.1 in Bob mind creates a quantum an computation entangledctrl given state as from all receivedG qubits,× according to their indices, by Definition 1). Therandomapplying{| outline{ single| ⌥}⌥ }qubit of the generator- mainZ @gates protocolA between is as the follows. qubits Alice in has order in mi tond create a quantum a brickwork computation state givenn m as(see ctrl i↵ iX↵ Z × a measurement pattern on a brickwork state. There are twoapplying stages: preparationa measurement-Z gatesand3.1computation between Alice pattern computes the. on1 qubits a brickworke inφ order′ state.where to1 There creates aree a two brickwork= stages:s =0. statepreparationn mand(seecomputationG . DefinitionX =(U,˜ 1).⌅x,yiθ ) 1 x,y1 0,y 0,y In the preparation3. Interaction stage, Alice and prepares measurement single qubits chosen randomly from 1/√2 ˜0 + e 1 2 i↵ + 2 i↵ G × iθ Definition 1).InX the=( preparation!U, {⌅x,y} stage,)" e Alice prepares1 singlee qubits1 chosen randomly from 1/√2 ! 0 + e 1 " 3. Interaction{ 3.2| and⟩ Alice measurement| ⟩ chooses| rx,y R 0, 1 and computes δx,y = φ + θx,y + πrx,y . θ =0, π/4, 2πFor/4,..., each7π/ column4 and sendsx =1 them,...,n to Bob. After receiving all the qubits, Bob{ entanglesX } ✓ ◆ ✓ ◆ { | x,y′⟩ | ⟩ | } θ =0, π/4, 2π/4,...,sx,y 7π/4 Zand sends them to Bob. After receiving all the qubits, Bob entangles them according to the brickwork state. Note that3. this Interaction unavoidably and revealsFor each measurement upper⌅ columnx,y bounds=( 1)x on=1⌅ thex,y,...,n+ }sx,y⇤ ∈ { } For each row y =1,...,m them according3.3 Alice toX the transmits brickwork state.δx,y Noteto1 Bob. that this Bob unavoi measuresdably reveals in upper the... bounds basis on! the+ , ! . For each column x =1,...,n sx,y Z s δx,y " δx,y " dimensions of Alice’s underlying graph state, that correspX ond toZ the lengthFor each of⌅ thex,y row input=(y and1)=1 depth,...,m⌅sx,y +0,s1x,y;⇤X J(↵) ... {! !− } 3.1 Alice computes φ′ where s = s =0. dimensions of Alice’s underlying2 { } graph state,1 that correspond to the length of the input and depth of the computation. However, due to universalityx,y ofFor the0,y each brickwork0,y row state,y =1 it,...,m doesrx,y3.4 notR Bobreveal0, 1 any transmitsX the resultZ✓ ◆ sx,y 0, 1 to Alice. ... 3.1of Alice the computation. computes⌅ { } φx,y′ However,where dues ,y to= universalitys ,y =0. of the brickwork state, it does not reveal any additional information3.2 Alice on choosesAlice’s computation.r 0 The, 1 computand computesation stageδ involves= φ interaction:+ θ + forπr . 0 0i↵ ∈ { } ... x,y R 3.1 Alice computesadditionalx,y φ 3.5x,y′where information If x,ysrXx,y==1above,Aliceflipss onZx,y Alice’s=0. computation.1(e The computsx,y;otherwiseshedoesnothing.ation stage involves interaction: for each layer of the brickwork state, for each∈ qubit,{ Alice} sendsaclassicalmessagetoBobtotellhim3.2 Alicerx,yx,y′ choosesR 0, 1r0,yx,y R0,y0, 1 and computes δx,y = φx,y′ + θx,y + πrx,y . ... 3.3 Alice transmits δx,y to Bob. Bob measures in the basis !+δ "∈, !{ δ }" . 1 ei↵ in which basis of the X Y plane he should measure the3.2 qubit. Alice Bob chooses performseachr the layer measurem⌅ of0{, the1 ent brickwork}andx,y and computes state,x,y δ for each= φ qubit,+. θ Alice+ sendπr saclassicalmessagetoBobtotellhim. . 3.3 Alicex,y R transmits{! δx,y to!− Bob.}✓ Bobx,y measuresx,y′ ◆ . x,y in the basisx,y !+δx,y " , ! δx,y " . . communicates3.4 the outcome; Bob− transmits Alice’s choice the of result anglessx,y in futur0eroundswilldependonthesevalues., 1 to Alice.in which∈ basis{ of} the X Y plane he should measure the qubit. Bob{! performs!− the measurem} ent and 3.3∈ Alice{ } transmits3.4 Bobδx,y transmitsto Bob. Bob the− result measuressx,y in the0, 1 basisto Alice.!+δ " , ! δ " . ... Importantly, Alice’s3.5 If quantumrx,y =1above,Aliceflips states and classical messagesx,ysareastutelychosensothat,nomatter;otherwiseshedoesnothing.communicatessx,yThe:= universalitysx,y the+ r outcome;x,y Alice’s of Protocol∈ choice{ } of angles{ 1! follows inx,y futur!−eroundswilldependonthesevalues. fromx,y } the universality of brickwork state (defined below) 3.4 Bob transmits3.5 If therx,y result=1above,Aliceflipssx,y 0, 1 to Alice.sx,y;otherwiseshedoesnothing. ... what Bob does, he cannot infer anything about her measurementpattern.IfAliceiscomputingImportantly, Alice’s∈ quantum{ } states and classical messagesareastutelychosensothat,nomatter 3.5 If rx,y =1above,Aliceflipsfor measurement-basedsx,y;otherwiseshedoesnothing. quantum computing. a classical function, the protocol finishes when all qubits are measured.what If she Bob is does, computing he cannot a inferFigure anything 1: The brickwork about state, her measuremenn m.Qubitstpattern.IfAliceiscomputingψx,y (x =1,...,n,y =1,...,m)arearranged quantum function,The universality Bob returns to of herProtocol the final qubits. 1 follows A modifi fromcation the of universalitya the classical protocol function, also of brickwork allows the protocolaccording state finishes (defined to layer x whenand be rowlow) ally,correspondingtotheverticesintheabovegraph,andareor qubitsG × are measured.| ⟩ If she is computing a iginally The universalityDefinition of Protocol 1. Abrickworkstatein 1 thefollows+ = 1 from0 + the1 1 universalitystate.n Controlled-m,where ofZ brickworkgatesm are then state performed5(mod8) (defined between, be qubits islow) which an entangled state of n m quantum function, Bob returns to her the√2 final√2 qubits. A modification of the protocol also allows Alice’s inputsfor measurement-based to be quantum. quantum computing. for measurement-based quantum computing.| ⟩ | ⟩ | ⟩ G × ≡ × We give an authentication technique which enablesThe Alice universality to detect an of interferingAlice’sProtocolqubits inputs Bob constructed 1 with tofollows be over- quantum. from asare the joined follows universality by an edge. (see of also brickwork Figure state 1): (defined below) Definition 1. Abrickworkstate ,wherem 5(mod8), is an entangled state of n m whelming probability (strictly speaking, either Bob’sfor int measurement-basednerferencem isDefinition correctedWe and quantum give he 1. isAbrickworkstate an not computing. authentication detected, techniquen m,where which enablesm 5(mod8) Alice to detect, is an an interfering entangled Bob state with of over-n m G × ≡1. Prepare all qubitsThe in proof state of the following+ ×and theorem assign is relegated to to each Appendix qubit B due to an lack of index space. (i, j), i being a column (i [n]) or his interferencequbits constructed is detected with as follows overwhelming (see probabil also Figureity). The 1):qubits authentication constructedwhelming probability requires as follows that (strictly (see speaking, alsoG × Figure either 1): Bob’s≡ interference is corrected and he is not detected,× Definition 1. Abrickworkstate n m,wherem 5(mod8)| ⟩ , is an entangled state of n m ∈ Alice encode1. her input into an error correction code and choose an appropriateor hisand fault-tolerantinterferencej being is im- detected a rowTheorem with (j overwhelming 1 (Universality)[m]). . The probabil brickworkity). state Then m authenticationis universal for quantum requires computation. that Fur- Prepare all qubits in state + and assign to1. eachPrepare qubit all an qubits indexG in(×i, state j), i +beingthermore,and a≡ assign column we only to require ( eachi single-qubit[n qubit]) an measurements indexG(i,× under j), ithebeing angles× a column0, π/4, π (/i2 , and[n]) mea- plementation of her desired computation. She| also⟩qubits uses some constructedqubits as astraps follows;theyarepreparedin (see also Figure 1): ∈ ∈ ctrl { ± ± } and j being a row (j [m]). andAlice2.j being encodeFor a roweach her ( inputj row,[m into]|). apply⟩ ansurements error the can correction be operator done layer-by-layer. code and choo-seZ anon appropriate qubits ( fault-toleranti, j) and im-(∈i, j +1) where 1 j m 1. the eigenstates of the Pauli operators X∈, Y and Z1.. Prepare all qubitsplementation in state + and of her assign∈ desired to computation. each qubit an She index also uses(i, j) some, i beingqubits a column as traps;theyarepreparedin (i [n]) ≤ ≤ − 2. For each row, apply the operator ctrl-Z on2. qubitsFor each3.(i,For row, j) and each apply(i, j the column+1) operatorwhereInj thisctrl1 work,3(mod8)j-Z weonm only qubits consider1. and( approximatei, j) eachand ( universality.i, odd j +1) rowwhere Thisi,applytheoperator allows1 usj to restrictm the1. angles ctrl-Z on qubits (i, j) The remainder of the paper is structured as follows:and thej being main aprotocol rowthe (j is eigenstates given3[m]|). in⟩ Section of the 2, Pauli operators≤X,≤Y and−Z. ∈ where correctness3. For and each blindness column arej proven.3(mod8) Section 3and discu eachsses extensions odd3. For row each toi,applytheoperator the column case of quantumj 3(mod8)ctrlof preparationand-≡Z on each and qubits odd measurement row(i, ji),applytheoperator to a finite set and hence simplctrlify the-Z description≤on qubits≤ of the−(i, protocol. j) ≡ 2. For each row, applyThe the∈ and remainder operator(i +1≡ctrl of,j the)-Z paperandonHowever qubits is also structured one( oncani, j) easily qubitsand as extend follows:(i, j( our+1)i, protocol j the+2)where main to achieveand1protocolj exact(i +1m is universality given,j1. +2) in as Section well,. provided 2, Alice inputs or outputs;and authentication(i +1,j) and techniques also on that qubits are used(i, jto+2) detectand anand interfering(i where+1(i +1,j correctness+2) Bob,j) andand. perform also and on blindness qubitscan communicate are(i, j proven.+2) realand Section numbers(i +1 3 to,j discu Bob.+2)ssesctrl. extensions≤ ≤ to the− case of quantum ctrl fault-tolerant computations are in Section 4, while3. SectioForn5presentsthetwo-serverprotocolwith each column j 4.3(mod8)For eachand column each oddctrlCorrectnessj row 7(mod8)i,applytheoperatorrefers to the factand that each the outcome even-Z ofon the row qubits protocolctrli,applytheoperator(i, is j the) same as the outcome -Z on qubits (i, j) 4. For each column j 7(mod8)and each even4. For rowinputs each≡i,applytheoperator column or outputs;j authentication7(mod8)and- techniquesZ eachon qubits even that row( arei, j)i used,applytheoperatorto detect an interfering Bob-Z on and qubits perform(i, j) apurelyclassicalAlice.ThereaderunfamiliarwithMBQCis≡ and (i +1referred,j) and to also a short on introduction qubits (≡i, j in+2) andif Alice(≡i +1 has run,j +2) the pattern. herself. The fact that Protocol 1 correctly computes U 0 follows and (i +1,j) and also on qubits (i, j +2) andand(i +1(i +1,jand+2),j) and.(i +1 also3 ,j on) qubitsandfrom also the(i, commutativity j +2) onand qubits of(i Alice’s+1(i,,j rotations j+2)+2). and Bob’sand measu(i rements+1,j in the+2) rotated. bases.| ⟩ This is 4. For each column jfault-tolerant7(mod8) computationsand each even are in row Sectioni,applytheoperator 4, while Section5presentsthetwo-serverprotocolwithctrl-Z on qubits (i, j) apurelyclassicalAlice.ThereaderunfamiliarwithMBQCisformalized below. referred to a short introduction in and (i +1,j) and also≡ on qubits (i, j +2) and (i +1,j +2). 3 Theorem 2 (Correctness). Assume Alice and Bob follow the steps of Protocol 1. Then the 4 outcome is correct. 4 4 Proof. Firstly, since ctrl-3Z commutes with Z-rotations, steps 1 and 2 do not change the underlying graph4 state; only the phase of each qubit is locally changed, and it is as if Bob had done the Z- rotation after the ctrl-Z.Secondly,sinceameasurementinthe +φ , φ basis on a state ψ is | ⟩ |− ⟩ | ⟩ the same as a measurement in the +φ θ , φ θ basis on Z(θ) ψ (see Appendix A), and since | + ⟩ |− + ⟩ | ⟩ δ = φ′ + θ + πr,ifr =0,Bob’smeasurementhasthesameeffect as Alice’s target measurement; if 3 r =1,allAliceneedstodoisfliptheoutcome. We now define and prove the security of the protocol. Intuitively, we wish to prove that whatever Bob chooses to do (including arbitrary deviations from the protocol), his knowledge on Alice’s quantum computation does not increase. Note, however that Bob does learn the dimensions of the brickwork state, giving an upper bound on the size of Alice’s computation. This is unavoidable: asimpleadaptationoftheproofofTheorem2from[AFK89],confirms this. We incorporate this notion of leakage in our definition of blindness.Aquantum delegated computation protocol is a protocol4 by which Alice interacts quantumly with Bob in order to obtain the result of a computation, U(x), where X =(U,x˜ )isAlice’sinputwithU˜ being a description of U. Definition 2. Let P be a quantum delegated computation on input X and let L(X) be any function of the input. We say that a quantum delegated computation protocol is blind while leaking at most L(X) if, on Alice’s4 input X, for any fixed Y = L(X), the following two hold when given Y : 1. The distribution of the classical information obtained by Bob in P is independent of X.

5 Verification

• Correctness: in the absence of any interference, client accepts and the output is correct

• Soundness: Client rejects an incorrect output, except with probability at most exponentially small in the security parameter

Fitzsimons and Kashefi, arXiv:1203.5217, 2012 Verification

p (incorrect AND accept) < ε 5

trapification

Blind Computation

trapification

FIG. 4: Schematic of a quantum computation with verification sub-routines. Blind Computation Whereas the laws of physics havewith been tested BPP* in vari- Alice AUTHOR CONTRIBUTION ous limits - small or large scales, high or low energies - the boundary of high computational complexity is mostly unexplored. So, it is even imaginable that quantum S.B. designed and performed the experiments, acquired mechanics might break down at some scale of complex- the experimental data, carried out theoretical calcula- ity [22]. tions and the data analysis, and wrote the manuscript. On the experimental side, current quantum comput- E.K. and J.F. carried out theoretical calculations, con- ers [23] are limited to the processing of a few qubits, tributed the proofs, and edited the manuscript. C.B. which does not allow yet to solve problems which are in- provided theoretical analysis and wrote the manuscript. tractable using classical computers. In the future when P.W. edited the manuscript and supervised the project. large-scale quantum computers might be available [24– 27], the verification of quantum computations and quan- tum simulations will be a crucial task [28]. Thus, our demonstration might have implications for [1] D. Deutsch, Proc. R. Soc. A 400,97(1985), new quantum computing experiments as well as on the http://rspa.royalsocietypublishing.org/content/400/1818/97.full.pdf+html, foundations of quantum physics. URL http://rspa.royalsocietypublishing.org/ content/400/1818/97.abstract. Add Caslav’s statement: In our implementation, we [2] D. Deutsch and R. Jozsa, Proc. R. Soc. A 439,553 assume the correctness of quantum mechanics for (1992). the verification of quantum resources. Without this [3] L. K. Grover, in Proceedings of the 28th Annual ACM assumption, a full demonstration would require the Symposium on the Theory of Computing (1996), pp. 212– two entangled photons to be sent far apart from each 219. other in two distant laboratories of the prover where [4] P. W. Shor, SIAM J. Comput. 26, 1484 (1997), first pub- only in the very last instant of the computation the lished in 1995. [5] A. W. Harrow, A. Hassidim, and S. Lloyd, Phys. Rev. verifier gives the measurement instructions to the Lett. 103,150502(2009). prover. By this means, no classical computers could [6] D. Aharonov, M. Ben-Or, and E. Eban, arXiv:0810.5375 mimic the output of the computation. (2008). [7] D. Aharonov and U. Vazirani, arXiv:1206.3686 (2012). [8] A. Broadbent, J. Fitzsimons, and E. Kashefi, in Proceed- ings of the 50th Annual Symposium on Foundations of ACKNOWLEDGEMENTS Computer Science (2009), pp. 517–526. [9] S. Barz, E. Kashefi, A. Broadbent, J. Fitzsimons, A. Zeilinger, and P. Walther, Science 335,303(2012). Please add Acknowledgements [10] R. Feynman, Int. J. Theor. Phys. 21,467(1982),URL http://dx.doi.org/10.1007/BF02650179. The authors are grateful to D. Aharonov and S. Aaron- [11] J. Watrous, arXiv:0804.3401 (2008). son for discussions. We acknowledge support from... [12] L. Babai, in Proceedings of the seventeenth annual ACM ε-Verification Alice accepting an incorrect outcome density operator. Any outcome density operator either results in s = r or is contained within the subspace of correct and incorrect outcome states, which could t 6 t be then probabilisticallyAlice projected intoBob a correct or anFor incorrect any server’s state. strategy Hence the intuitively, a protocol is defined to be verifiable⌫ if the corresponding outcomeprobability state of client is far accepting from anany incorrect outcome .⌫ incorrect outcome density random⌫ pparameters(⌫) Tr (Pincorrect. B(⌫)) ✏ 9 states. Following the approach. of [28], we first define theoperator notion is bounded of correctness by ε: . P ⌫ Definition 8. Let Pincorrect beB the(⌫) projection onto the subspace of all the possible incorrect outcome density operator for the fixeddensity choice operator of of classical Alice’s and randomquantum output variables denoted with ⌫,thatisthefollowing projection

⌫ ⌫ ⌫ ⌫ ⌫ P =(I ) r r incorrect | idealih ideal| ⌦ | t ih t | ⌫ ⌫ Accept Key where ideal ideal = Tri O t (B0(⌫)). Let p(⌫) be the probability of Alice choosing random | ih | 62{ [{ }} variables parameterized by ⌫, that is the probability of choosing a position i among all possible vertices of the graph to be the trap positionp(⌫) Tr (P (denoted⌫ B as(⌫)) a random✏ variable t) and the probability ⌫ incorrect  of choosing random variables ,r,x,✓ (as defined in Definition 6). Given 0 ✏ < 1, we define a P  protocol to be ✏-verifiable, if for any choice ofB Bob’s(⌫) strategy (denoted by j) the probability of Alice accepting an incorrect outcome density operator is bounded by ✏:

Tr( p(⌫) P ⌫ B (⌫)) ✏. incorrect j  ⌫ X Theorem 9. Protocol 6 is (1 1 )-verifiable in general, and in the special case of purely classical 2m output the protocol is also (1 1 )-verifiable, where m is the total number of qubits in the protocol. m Proof. At the beginning of the protocol, Alice prepares the input qubits in the following form:

e = Xx1 Z(✓ ) ... Xxl Z(✓ ) I | i 1 ⌦ ⌦ l | i and positions them among the first n qubits. She then prepares the remaining qubits in the following form (where D is the index of the dummy qubits)

i D d 8 2 | ii i D Zdj + = + j NG(i) D ✓i ✓i+ j N (i) D dj ⇡ 8 62 2 \ | i 2 G \ P E Q and sends all m qubits in the order of the labelling of the vertices of the graph, we represent the whole m qubit state as M . We can treat all the measurement angels as orthogonal quantum | i i states . Note that for Protocol 6 all the random variables t, x, r, ✓ are independent and uniform. | ii For a fixed choice of Alice’s random variables and Bob’s strategy denoted indexed by ⌫ and j respectively, the outcome density operator Bj(⌫) can be written in the form of the output of a circuit computation as depicted in Figure 3. While in the actual protocol, at step i, Alice computes i as a function of s

9Recall that for simplicity we have assumed that the computation is deterministic and the input is in a pure state, and hence the ideal output will necessarily4 be a pure state. This restriction to pure states mirrors the approach of [28].

21

4

4 + = 1 ( 0 + 1 ) | ⌦ ⇥2 | ⌦ | ⌦ ⇧ | ⌦ + = 1 ( 0 + 1 ) | ⌦ ⇥2 | ⌦ | ⌦ |±⌦ ⇧ 1 +| ⌦= ( 0 + 1 ) X | ⌦ ⇥2 | ⌦ | ⌦ ⇧|±⌦ Z | X⌦

H |±Z⌦ XH J( + ⇥ + r⇤) ZJ( + ⇥ + r⇤) r r ⌅ H⌅

+ +⇥ ⇥ | ⌦ | ⌦ J( + ⇥ + r⇤) +⇥+r⇤ +⇥+r⇤ |± ⌦ |± ⌦ r + ⌅{| ⇥⌦} +⇥ {| ⌦} +X⇥ =(U,˜ ⌅x,y ) | ⌦ { } ˜ X X =(U, ⌅x,y ) sx,y Z { }⌅x,y =( 1) ⌅x,y + sx,y⇤ |±+⇥+r⇤⌦ X sx,yrx,y R 0,Z1 ⌅x,y =( 1) +⌅x,y⌥ +{sx,y}⇤ {| ⇥⌦} ⇥x,y R 0, , 7⇤/4 r 0, 1 ⌥˜ { ··· } x,y ⌥R { }X =(U, ⌅x,y ) sx,y := sx,y{ + rx,y} X ⇥x,y R 0, , 7⇤/4 sx,y Z ⌅x,y 0 ,=(1 1) ⌅x,y + sx,y⇤ ⌥ { ···| ⌦ | ⌦ } Adding Traps BPP QNC sx,y := sx,y +rrx,y 0, 1⇧ x,y RNC2 QNC1 ⌥ { ⇧} 0 , 1 ⇥ +⇥ ,0, ⇥ , 7⇤/4 | ⌦ | ⌦ x,y ⌥|TrapR ⌦{ Measurements|···⌦ } M ⇥ + s =0 BPP s QNC:= s| ⇥⌦ +⌃r 2 ⇧x,y 1 x,y x,y NC QNC⇥ ⇧ M ⇥ s =1 0 , 1 | ⌦ ⌃ + , | ⌦ | ⌦ | ⇥⌦ |⇥⌦ BPP QNC ⇧ Trap positions and 0 , 1 NC2 QNC1 | ⌦ | ⌦ ⇧ Measurement angles 3 remain hidden M ⇥ + +s⇥=0, ⇥ | ⇥⌦ ⌃ | ⌦ | ⌦ ⇥ ⇥ M +⇥ s =0 M ⇥ s =1| ⌦ ⌃ | ⌦ ⌃ M ⇥ s =1 |⇥⌦ ⌃ 3

3 Verification with single trap

Theorem. Protocol is (1 − 1/2N)-verifiable in general, and in the case of purely classical output it is (1 − 1/N)-verifiable, where N is the total number of qubits in the protocol. A:22 J. F. Fitzsimons and E. Kashefi

interact with anything until after the corresponding bi has been generated. This will allow us to reorder all the operators Ui to the end to obtain the new circuit shown in Figure 4. Note that Figure 4 is not an actual run of the protocol, it is a mathematical equivalent of Figure 3 where the values of bi have been fixed to permit us to commute the operators as depicted. However in the following proof we have considered any general deviation performed by Bob, that is to say we consider any arbitrary Ui operators.

Z( ) H b1 1 Unconditionally Verifiable Blind Computation A:21

1 TheoremZ(6.4) . HProtocol 6 is (1 )-verifiable in general, and in the specialb case of k 2m k purely classical output the protocol is also (1 1 )-verifiable, where m is the total number m ⌫ of qubits in the protocol. |M EG i Z( ) H b Proof. At the beginningm-n of the protocol,U’ Alice chooses the independent andm-n uniform random variables for ⌫. Next Alice prepares1 the input qubits in the following form:

⌫ x1 xl e = X Z(✓1) ... X Z(✓l) I Quantum | i ⌦ ⌦ | i U’ Output { and positions them among the first n qubits. Recall thatk n> I and hence the} trap qubit might be among this set of qubits. She then prepares the remaining| | qubits in the following B form (where D is the index of the dummy qubits) |0 ⌦ i U’ i D di m-n |1 8 2 | i i i D Zdj + = + j NG(i) D ✓i ✓i+ j N (i) D dj ⇡ 8 62 2 \ | i 2 G \ and sends all m qubits in theQ order of the labeling of the verticesP of the graph,E we represent | ki the whole m qubit state as M ⌫ . We can treat all the measurement angles as orthogonal | i i quantum states i . For a fixed choice of Alice’s random variables (⌫) and Bob’s strategy (j), Bob’s output| fromi the computation can be written in the form of the output of a circuit

|m n computation as depicted in Figure 3. Note this is the state of the system before the relevant ε-Verification i corrections for Alice’s secret key have been applied to yield the outcome density operator B (⌫). Fig. 4.ThefactthatanyjUj in Figure 3 is independent of all i

to the end of the circuit as shown above. Hence we can rewrite Bob’s deviation as Ui0 = iUi i†,where Z( ) H b P P i = i+1 j m n Hj Zj (j ). 1 1 P   N b Z(k) H k

In the rest of this proof⌫ we will use t to represent both the random variable and also |M EG i Z( ) H b the position of the trap qubit. We denote by ⌦ = U 0 U 0 ...U k0 the overall actionm-n U1 m n m n 1 1 of Bob’s deviation and by = H Z ( ) E the action of the exact protocol 1 i m n i i i G Quantum P   { Uk Output prior to measurement. Here, and in Figure 4, we have taken U 0 = iUi †,where} i = N i P Pi P H Z ( ).B Further we denote by i+1 j m n j j j |0 ⌦   i Um-n | ⌫,b 1i ⌫ b N = 1 i m M 1 j m n j   | i   | the joint state of the initial (input,↵ N dummy andNki prepared) qubits↵ sent by Alice to Bob b and the classical angles i ,whereb represents a possible branch of the computation as parameterized by the measurement results bi sent by Bob to| Alice.m n Finally, in line with { } i Definition 6.3, we define C⌫ ,b to be the Pauli operator which maps the final quantum Fig. 3.ArunofprotocoltogetherwithBob’sdeviationrepresentedasC Ui operators. The entangling op- output state to the correcterator, EG,isthecollectionofalltherequired one depending on the randomctrl-Z operators variable corresponding⌫C and to the computation graph edges. Note branch b. Hence we havethat in Definition 6.1 we also considered an operator U0 representing Bob’s initial deviation. In the figure, for simplicity, we have commuted U0 and combined it with U1.Trivially,ifalltheUi operators are set to be identity the above circuit converges to the exact run of the protocol, where a measurement in the basis is implemented using theB controlled Z-rotation⌫,b followed⌫,b by a Hadamard gate and finally a Pauli Z Bj(⌫)=TrB b +ci r b C⌫ ,b⌦ (( 0 0 ) ) †⌦†C† b b + cr . b basis± (computationC basis) measurement on the corresponding qubits. ⌫C ,b | ↵ ih | P ⌦ | ih | ⌦ P | ih | ⇣P ↵⌦ ⌘ where (cr)i = ri for all i = t and (cr)t = 0, and the subscript B denotes that the partial While6 in the actual protocol, at step i, Alice computes i as a function of s

ACM Journal Name, Vol. V, No. N, Article A, Publication date: January YYYY. A:26 J. F. Fitzsimons and E. Kashefi

As all Pauli matrices other than the identity are traceless, any terms in the sum which are non-zero necessarily have i = j everywhere except for = t and the corresponding delta register. We then consider| the| two cases corresponding to whether the trap is located in the quantum output or not separately. If t O then the delta register does not exist, ⌫T ⌫T 2 ⌫T ⌫T and using the fact that ✓ ,r Tr ⌘t i ⌘t ⌘t j ⌘t = 0, unless i t = j t,we t t h | | ih | | i | | arrive at the conclusion that the only terms which contribute to pincorrect are those where P i = j. If, on the other hand, t/O, then averaging over rt alone is sucient to give ⌫T ⌫T ⌫T ⌫T 2 Tr ⌘t i ⌘t ⌘t j ⌘t = 0, and hence i t = j t. In this case, averaging over ✓ h | | ih | | i | | yields the t register in the maximally mixed state, and hence as before i and j must act identically on these qubits too, in order to avoid contributing zero to the value of pincorrect. Consequently the only terms which contribute are those for which i = j. Using this Unconditionally Verifiable Blind Computation A:21 identity with our previous expression for pincorrect, we obtain 1 Theorem 6.4. Protocol 6 is (1 2m )-verifiable in general, and in the special case of 1 purely classical output the protocol is also (1 m )-verifiable, where m is the total number of qubits in the protocol. ⌫T ⌫T ⌫T I ⌫T pincorrect ↵ik↵ik⇤ p(⌫T )Tr ⌘t i Proof.⌘t At the⌘ beginningt of thet protocol,t Alice chooses the independenti ⌘t and uniform  h | random| variablesih for ⌫. Next| ⌦ Alice| preparesih | the⌦ inputTr( qubitsI) in the following| i form: k,⌫T i Ei ✓ ◆ ! 2 e⌫ = Xx1 Z(✓ ) ... Xxl Z(✓ ) I X X | i 1 ⌦ ⌦ l | i 2 ⌫T and positions⌫T them⌫T among the first⌫Tn qubits. Recall that n> I and hence the trap qubit = ↵ik p(⌫T )Tr ⌘t i mightt ⌘t be among⌘t this set ofi t qubits.⌘t She then prepares the remaining| | qubits in the following | | h | |form| (whereihD is the| index| of| the dummyi qubits) k,⌫T i Ei 2 i D d X X 8 2 | ii 2 ⌫ ⌫ 2 i D Zdj + = + T T j NG(i) D ✓i ✓i+ j N (i) D dj ⇡ = ↵ik p(⌫T ) ⌘ i t ⌘ 8 62 2 \ | i 2 G \ t t P E | | h | | | and sendsi all m qubits in theQ order of the labeling of the vertices of the graph, we represent k,⌫T i Ei the whole m qubit state as M ⌫ . We can treat all the measurement angles as orthogonal 2 | i i X X quantum states i . For a fixed choice of Alice’s random variables (⌫) and Bob’s strategy A:261 (j), Bob’s output|2 fromi the computation can J. be F. written Fitzsimons in the form and of the E. output Kashefi of a circuit A:262 ⌫T computation⌫T as depicted in Figure 3. Note this J. is F. the Fitzsimons state of the system and before E. the Kashefi relevant = ↵ki ⌘t i t ⌘t corrections| for Alice’s secret key have been applied to yield the outcome density operator 16m | | h | B (⌫).| i As all Paulik i matricesEi othert,rt,✓t than the identityj are traceless, any terms in the sum which are As all PauliX X2 matrices otherX than the identity are traceless, any terms in the sum which are non-zero necessarily have i = j everywhereZ( ) exceptH for b = t and the corresponding non-zero necessarily have | = | everywhere1 except for 1 = t and the corresponding delta1 register. We then2 consideri thej two cases⌫T corresponding⌫T 2 to whether the trap⌫T is located⌫T 2 = ↵ | | ⌘ ⌘ + ⌘ ⌘ delta register. Weki then consider the two casest i correspondingt t Z( to ) whetherH theb trapt isi t locatedt in16 them quantum| output| or not separately.h If| t | O| theni the deltak register doesk h not| | exist,| i ε-Verification ⌫T ⌫T 2 ⌫T ⌫T ! in the quantumk i Ei outputt orm notn, separately.✓t,rt ⌫ IfE t O then them deltan

ACM Journal Name, Vol. V, No. N, Article A, Publication date: January YYYY. Probability Amplification

To increase the probability of any local error being detected

O(N) many traps in random locations

To increase the minimum weight of any operator which leads to an incorrect outcome Fault-Tolerance 1. 1. 5. 5.

P 1 P1 P H P H = = P2 P MComp MComp 2 Probability Amplification Challenge: Traps break the graph 2. 1. 1. 5. 2. 5. Y Y Y Y ˜ P3 P K15 K˜ Z Z P1 3 15 P H P1 P Z H Y Z Y = 6. 6. ˜ ˜ Z Z Z = Z P K5 K5 MComp Z Z MReduce Z Z MReduce 2 Comp ˜ P2 M K5 K˜ Y 5 Y P1 P1 ˜ K5 K˜5 P2 P2 2. 3. 3. 2. Y Y Z Z Z Z ˜ M M Y Y P3 K15 P ˜ P Z Z Z P3 K15 Z Y ZZ Z Z Z Z Y 6. ˜ Z Z Z Z Z Z 6. K5 Z Z MReduceZ Z ZZ MP Z Z MP K˜ Z Z Reduce 5 M K˜5 ˜ ˜ P3 P3 ˜ K5 K5 Y Z P1 Z K5 ˜ Y P1 K5 ˜ 7. 7. K4.5 4. P2 3. P2 Required 3D lattice for Raussendorf,3. Z Z HarringtonZ and GoyalZ Topological MP error-correcting code with defect Z Z Z Z Z Z Z MP ZthicknessZ d Z Z Z Z Z A MA Z Z MP M Z Z M M Z Z P Z Z M P Z Z K˜5 Z 3 ˜ P3 K5 Z 7. 4. 7. Z 4. Z Z Z Figure 5: A graphicalFigure depiction 5: A graphical of Protocol depiction 8. In this of Protocol figure we 8. replace In this the figure Raussendorf-Harrington- we replace the Raussendorf-Harrington- Z Z MA Goyal encoding in theGoyal first encoding step with in the a simpler first step computation, with a simpler as to computation, include a full as encoding to include yields a full encoding yields M MA graphs too large to reasonably draw. Z Z graphs too large to reasonably draw. M Z Z

Proof. First we note that it is always possible to choose measurement patterns M by Lemma 2 and Proof. First we note that it is always possible to choose measurement patterns M by Lemma 2 andP by Lemma 1. Further, by the universality of the Raussendorf-Harrington-GoyalP encoding, MReduce by LemmaM 1.Reduce Further, by the universality of the Raussendorf-Harrington-Goyal encoding, it is always possible to choose . As the measurements composing , , and Figure 5: A graphicalit depiction is always of possible Protocol to 8. choose In thisM figureComp. we As replace the measurements theMComp Raussendorf-Harrington- composing M , MReduce, MPMandMMReduceA MP MA P P Goyal encoding inFigure theare first composed 5: Astep graphical with entirely a simpler depictionare of composed Pauli computation, of basisProtocol entirely measurements, 8.as of In to Pauli this include basis figure there a measurements, full we is replace encoding no partial the yields there time Raussendorf-Harrington- is ordering no partial imposed time ordering on imposed on graphs too large toGoyal reasonablythe encoding sequence draw. of in measurements, thethe first sequence step with and of measurements, a so simpler the times computation, at and which so the these as times to measurements include at which a these full are encoding measurements made have yields no are made have no graphse↵ect too on large the outcome to reasonablye↵ect of the on theprotocol. draw. outcome Thus of the for any protocol. honest Thus run for of the any protocol, honest run the of result the protocol, will be the the result will be the same as if the measurements from were made first. By construction this measurement pattern same as if the measurements from M were made first.M By construction this measurement pattern Proof. First we note that it is always possible to choose measurementP patternsPM by Lemma 2 and˜ splits the graph state into three separate˜ P graph states N . by LemmaProof. 1.splits Further,First the wegraph by notethe state universality that into it is three always of the separate possible Raussendorf-Harrington-Goyal graph to choose states measurementN . encoding, patternsK by Lemma 2 and MReduce The dummy qubits in P and KA correspond to breakM operations in their respective graphs The dummy qubits in MP and MA correspondM toM break operations in theirP respective graphs it is always possibleM toReduce choosebyM LemmaComp. As 1. Further, the measurements by the universality composing ofM the, M Raussendorf-Harrington-GoyalReduce, MP and MA encoding, by Lemma 4 and henceby Lemma after the 4 and initial hence step after all the initialtrapP qubits step all remain the trap unentangled qubits remain from unentangled the rest. from the rest. are composed entirelyit is alwaysof Pauli possible basis measurements, to choose MComp there. As is theno partial measurements time ordering composing imposedM on, MReduce, MP and MA Recall that for these trap qubits i = 0, and since theP qubit is prepared in the state +✓i and Recall that for these trap qubits i = 0, and since the qubit is prepared in the state +✓i and | i the sequence of measurements,are composed and entirely so themeasured of times Pauli at in basis which basis measurements, these+ measurements, , there the measurement is are no made partial have result time no communicated ordering imposed| toi Alice on is s = r for all measured in basis + , , the measurement✓i ✓i result communicated to Alice is s = r for all i i e↵ect on the outcomethe of sequence the protocol. of measurements, Thus{| for✓i i any|✓ honesti andi} so run the{| of timesi the| protocol, ati} which the these result measurements will be the are madei havei no such qubits. Thus, Alicesuch qubits. always Thus, accepts, Alice satisfying always accepts, the first satisfying criterion. the first criterion. same as if the measurementse↵ect on the from outcomeM were of the made protocol. first. By Thus construction for any honest this measurement run of the protocol, pattern the result will˜ be the P By definition MReduce transforms the graph state corresponding˜ to KN to the resource state splits the graph state intoBy three definition separateMReduce graphtransforms states ˜ . the graph state corresponding to KN to the resource state same as if the measurementsnecessary from to implementMN were madeMComp first.. Lastly, By construction measuring according this measurement to MComp yields pattern the correct output of necessary to implement MComp. Lastly,KP measuring according to MComp yields the correct output of The dummy qubitssplits in theM graphP and stateMA correspond intoby three the correctness separateto break operationsgraph of the Raussendorf-Harrington-Goyal states in˜ theirN . respective graphs protocol. by the correctnessC of the Raussendorf-Harrington-GoyalK protocol. by Lemma 4 and henceCThe after dummy the initial qubits step in allMP theand trapM qubitsA correspond remain unentangled to break operations from the in rest. their respective graphs Recall that for theseby Lemma trap qubits 4 andi hence= 0, and after since the initial the qubit step is all prepared the trap in qubits the state remain+✓i unentangledand from the rest. 32| i measured in basis Recall+✓i , that✓i for, the these measurement trap qubits resulti = communicated 0, and since32 the to Alice qubit is issi prepared= ri for all in the state +✓ and {| i | i} | i i such qubits. Thus,measured Alice always in basis accepts,+ satisfying✓ , ✓ the, the first measurement criterion. result communicated to Alice is si = ri for all {| i i | i i} ˜ By definition MsuchReduce qubits.transforms Thus, Alicethe graph always state accepts, corresponding satisfying to theKN firstto criterion. the resource state necessary to implement . Lastly, measuring according to yields the correct output˜ of ByM definitionComp MReduce transforms the graphMComp state corresponding to KN to the resource state by the correctness of the Raussendorf-Harrington-Goyal protocol. C necessary to implement MComp. Lastly, measuring according to MComp yields the correct output of by the correctness of the Raussendorf-Harrington-Goyal protocol. C 32 32 What can we do with 4-qubits

2

FIG. 1: Concept of a quantum prover interactive proof system based on blind quantum computing. The verifier wants to find out if the prover can indeed perform quantum computations. While the question if a classical verifier can test a quantum system is still open, it was shown that a verifier that has access to certain quantum resources can verify quantum computations. Here, in the framework of blind quantum computing, the verifier needs the ability to generate single qubits and to transmit them to the prover. After the transmission of the qubits, the verifier and the prover exchange two-way classical communication. main private. In detail, the verifier prepares single qubits In measurement-based quantum computing, a computation in the state is correct if the measurements are performed properly. Here 1 we use a verification procedure based on the creation of ✓ = 0 + ei✓j 1 (1) trap qubits as in [14] to verify the correctness of the mea- | ji p | i | i 2 surements performed by the server. with ✓ 0, ⇡/4,...,7⇡/4 chosen uniformly at random Point out di↵erences? j 2 { } and only known to the verifier. The qubits are then These qubits are blindly prepared in a well-defined transmitted to a prover that entangles them to create state, which is known to the verifier. If they are mea- a blind cluster state [9]. The actual computation is sured in their eigenbasis, the verifier knows the expected measurement-based [16, 17]. The verifier calculates for measurement outcome and can detect a wrong result. In each blind qubit measurement instructions according to more detail, the verifier chooses measurement settings on the four-qubit cluster state such that a trap qubit is pre- = ✓ + + ⇡r (2) j j j j pared in a state ✓ . If the trap qubit is then measured | ji in the basis ✓j , the outcome is always known to the where ✓j is the blind phase of the qubit, j is the rotation | i that the verifier wants to perform including any Pauli by- verifier (see Figure 2). This preparation of traps works for any qubit in the products, and rj =0, 1 is a randomly chosen value to hide the measurement outcome. The prover performs cluster state. The position and the state of the trap measurements in the basis qubit remains blind to the prover. Without having any information, the prover can only guess the measurement 1 ij result randomly. Thus, the probability of producing the = 0 e 1 , (3) |± j i p2 | i ± | i right result is bounded to 1/2 and delivers the results to the verifier. Without the Need new statement knowledge of the underlying rotation and the random . phase, the prover cannot find out anything about the ac- tual rotation j — the computation remains blind. The verifier, in contrast, knows the initial rotation and is able ENTANGLEMENT VERIFICATION to interpret the results. Having verified the measurement outcome, we also test the prover’s entangling capabilities and its ability to create cluster MEASUREMENT VERIFICATION states. Commonly, quantum correlations are confirmed by well-established tests of Bell’s inequality (Fig. [? Blind Verification of Entanglement

a 0,1 b 0,1 Referee

Alice x 1,-1 y 1,-1 Bob Perform by an untrusted server a b A x By

AB

Figure 8.2: Alice and Bob can improve their chances of winning the game by using a quantum device. Before the game starts they create a pair of particles in the maximally entangled state ⇢AB = ,where =(00 + 11 )/p2. When the game starts, Alice and Bob each| ih bring| one| ofi these| particlesi | i with them. a Given the question a, Alice measures the POVM A x on her particle, and returns the measurement outcome x as her answer.{ Similarly,} Bob measures b If server knows he is running Bell test,the POVM By y and returns the answer y. he can create fake outcomes to violate the inequality,{ }

the trapificaiton procedure in between prevents8.1.3 A strategy this to based happen on a quantum device In the previous section we tacitly assumed that Alice and Bob are limited to classical operations, in the sense that they can only generate and share classical randomness and correlations. However, one could imagine Alice and Bob to establish a pair of entangled particles before the game starts, and each bring with them one particle in this pair (see figure 8.2). We will see that Alice and Bob can increase their chance of winning beyond the value 3/4 with a clever choice of measurements. Suppose that Alice and Bob share a quantum state ⇢AB. For each question a, Alice a measures a POVM Ax x, and outputs the measurement outcome x as the answer. Anal- { } b ogously, Bob measures the POVM By y if he gets question b, and lets the measurement outcome be his answer. The resulting{ conditional} probability distribution of this procedure is a b PX,Y a,b(x, y)=tr(Ax By⇢AB), (8.6) | ⌦ where the tensor product Aa Bb corresponds to the fact that Alice and Bob measure x ⌦ y

82 Blind Verification of Entanglement

Barz, Fitzsimons, Kashefi, Walther, Nature Physics 13 Still requires 2n parameters Summery for a classical computer to simulate it

We can test efficiently BQP But we need quantum randomness NP

BPP

Not all the problem in NP can be computed blindly Blind Computation with a BPP Alice with BPP* Alice • Abadi, Feigenbaum and Kilian 2

VUBQC extension Verification of one-pure-qubit computation

Kapourniotis, Kashefi, Datta, TQC14 Restricted Q

FIG. 1: Concept of a quantum prover interactive proof system based on blind quantum computing. The verifier wants to find out if the prover can indeed perform quantum computations. While the question if a classical verifier can test a quantum system is still open, it was shown that a verifier that has access to certain quantum resources can verify quantum computations. Here, in the framework of blind quantum computing, the verifier needs the ability to generate single qubits and to transmit them to the prover. After the transmission of the qubits, the verifier and the prover exchange two-way classical communication.

main private. In detail, the verifier prepares single qubits In measurement-based quantum computing, a computation in the state is correct if the measurements are performed properly. Here 1 we use a verification procedure based on the creation of ✓ = 0 + ei✓j 1 (1) trap qubits as in [14] to verify the correctness of the mea- | ji p | i | i 2 surements performed by the server. with ✓ 0, ⇡/4,...,7Device-independent⇡/4 chosen uniformly at random FK Point out di↵erences? Verification with minimal communicationj 2 { } and only known to the verifier. The qubits are then These qubits are blindly prepared in a well-defined Kapourniotis, Dunjko, Kashefi ASQIC15 transmitted to a prover that entangles them to create state, which is known to the verifier. If they are mea- a blind cluster state [9]. The actual computation is sured in their eigenbasis, the verifier knows the expected measurement-based [16, 17]. The verifier calculates for measurement outcome and can detect a wrong result. In each blind qubit measurement instructions according to more detail, the verifier chooses measurement settings on the four-qubit cluster state such that a trap qubit is pre- = ✓ + + ⇡r (2) j j j j pared in a state ✓ . If the trap qubit is then measured | ji in the basis ✓j , the outcome is always known to the where ✓j is the blind phase of the qubit, j is the rotation | i that the verifier wants to perform including any Pauli by- verifier (see Figure 2). This preparation of traps works for any qubit in the products, and rj =0, 1 is a randomly chosen value to hide the measurement outcome. The prover performs cluster state. The position and the state of the trap measurements in the basis qubit remains blind to the prover. Without having any Robust and Device-independent Verification information, the prover can only guess the measurement 1 ij result randomly. Thus, the probability of producing the = 0 e 1 , (3) Gheorghiu, Kashefi, Wallden NJP15 |± j i p2 | i ± | i right result is bounded to 1/2 and delivers the results to the verifier. Without the Need new statement knowledge of the underlying rotation and the random . phase, the prover cannot find out anything about the ac- tual rotation j — the computation remains blind. The verifier, in contrast, knows the initial rotation and is able ENTANGLEMENT VERIFICATION to interpret the results. Alexandru Gheorghiu, Elham Kashefi, Petros Wallden HavingRobustness verified and device the measurement independence of verifiable outcome, blind we quantum also computing test the prover’s entangling capabilities and its ability to create cluster MEASUREMENT VERIFICATION states. Commonly, quantum correlations are confirmed by well-established tests of Bell’s inequality (Fig. [?

State of Art

Single Q Device Restricted quantum verifier

[Aharonov, Ben-Or, Eban '10], [Fitzsimons, Kashefi'12] [Morimae '14], [Hayashi, Morimae '15]

Blowing Up the cost Prepare and send vs. entanglement-based

Online vs. offline

Device-independent vs. one-sided device-independent Non-communicating Entangled Q Devices Classical verifier I.I.D. states vs. general states [Reichardt, Unger, Vazirani '12] [McKague '13] From QKD to verifiable quantum internet

1-way Quantum Communication Classical Verifier Quantum Device 2-way Classical + Communication Trusted random single qubit generator TREL

Cambridge

Martlesham (BT) UCL Bristol Reading Telehouse NPL Universal for any quantum computations Minimal quantum requirements for verifier Server only learns size of computation (blindness)

Requires photonic interaction with the device Can we get ride of qubit ?

5

trapification

Quantum

trapificationObfuscation

FIG. 4: Schematic of a quantum computation with verification sub-routines. Blind Computation Whereas the laws of physics havewith been tested BPP* in vari- Alice AUTHOR CONTRIBUTIONAlagic, Fefferman, 2016 ous limits - small or large scales, high or low energies - the boundary of high computational complexity is mostly unexplored. So, it is even imaginable that quantum S.B. designed and performed the experiments, acquired mechanics might break down at some scale of complex- the experimental data, carried out theoretical calcula- ity [22]. tions and the data analysis, and wrote the manuscript. On the experimental side, current quantum comput- E.K. and J.F. carried out theoretical calculations, con- ers [23] are limited to the processing of a few qubits, tributed the proofs, and edited the manuscript. C.B. which does not allow yet to solve problems which are in- provided theoretical analysis and wrote the manuscript. tractable using classical computers. In the future when P.W. edited the manuscript and supervised the project. large-scale quantum computers might be available [24– 27], the verification of quantum computations and quan- tum simulations will be a crucial task [28]. Thus, our demonstration might have implications for [1] D. Deutsch, Proc. R. Soc. A 400,97(1985), new quantum computing experiments as well as on the http://rspa.royalsocietypublishing.org/content/400/1818/97.full.pdf+html, foundations of quantum physics. URL http://rspa.royalsocietypublishing.org/ content/400/1818/97.abstract. Add Caslav’s statement: In our implementation, we [2] D. Deutsch and R. Jozsa, Proc. R. Soc. A 439,553 assume the correctness of quantum mechanics for (1992). the verification of quantum resources. Without this [3] L. K. Grover, in Proceedings of the 28th Annual ACM assumption, a full demonstration would require the Symposium on the Theory of Computing (1996), pp. 212– two entangled photons to be sent far apart from each 219. other in two distant laboratories of the prover where [4] P. W. Shor, SIAM J. Comput. 26, 1484 (1997), first pub- only in the very last instant of the computation the lished in 1995. [5] A. W. Harrow, A. Hassidim, and S. Lloyd, Phys. Rev. verifier gives the measurement instructions to the Lett. 103,150502(2009). prover. By this means, no classical computers could [6] D. Aharonov, M. Ben-Or, and E. Eban, arXiv:0810.5375 mimic the output of the computation. (2008). [7] D. Aharonov and U. Vazirani, arXiv:1206.3686 (2012). [8] A. Broadbent, J. Fitzsimons, and E. Kashefi, in Proceed- ings of the 50th Annual Symposium on Foundations of ACKNOWLEDGEMENTS Computer Science (2009), pp. 517–526. [9] S. Barz, E. Kashefi, A. Broadbent, J. Fitzsimons, A. Zeilinger, and P. Walther, Science 335,303(2012). Please add Acknowledgements [10] R. Feynman, Int. J. Theor. Phys. 21,467(1982),URL http://dx.doi.org/10.1007/BF02650179. The authors are grateful to D. Aharonov and S. Aaron- [11] J. Watrous, arXiv:0804.3401 (2008). son for discussions. We acknowledge support from... [12] L. Babai, in Proceedings of the seventeenth annual ACM Perspective

Efficient verification methods for realistic pseudo quantum computers

Correctness of the outcome - - Architectural constraints Operation monitoring - - Experimental imperfections - Quantum property testing

39 Perspective

PRACTICAL verification methods for realistic pseudo quantum computers

Correctness of the outcome - - Architectural constraints None-universal: Operation monitoring - - Experimental imperfections D-Wave machine - Quantum property testing Quantum Simulator

Classical Verification Quantum Verification

Breakable Security Universal Machine Server’s Time Interaction

40 Thanks to My Collaborators

Theory Experiment Joe Fitzsimons (SUTD) Anne Broadbent (Ottawa) Stefanie Barz (Oxford, Vienna) Vedran Dunjko (Innsbruck) Philip Walther (Vienna) Anthony Leverrier (INREA) Ian Walmsley (Oxford) Animesh Datta (Oxford) Tomoyuki Morimae (Japan)

(Edinburgh Group) Petros Wallden Anna Pappa Theodoros Kapourniotis Alexandru Gheorghiu Danile Milles PDR positions available ekashefi@gmail.com