A Quantum Interpretation of Bunched Logic for Quantum Separation Logic Li Zhou Gilles Barthe Max Planck Institute for Security and Privacy Max Planck Institute for Security and Privacy; IMDEA Software Institute Justin Hsu Mingsheng Ying University of Wisconsin–Madison University of Technology Sydney; Institute of Software, Chinese Academy of Sciences; Tsinghua University Nengkun Yu University of Technology Sydney Abstract—We propose a model of the substructural logic of Quantum computation is another domain where the ideas Bunched Implications (BI) that is suitable for reasoning about of separation logic seem relevant. Recent work [10], [11] quantum states. In our model, the separating conjunction of suggests that reasoning about resources (in particular, entan- BI describes separable quantum states. We develop a program glement – a resource unique in the quantum world) can bring logic where pre- and post-conditions are BI formulas describing similar benefits to quantum computing and communications. quantum states—the program logic can be seen as a counter- Motivated by this broad perspective, we propose a quan- part of separation logic for imperative quantum programs. We tum model of BI and develop a novel separation logic for exercise the logic for proving the security of quantum one-time quantum programs. Our development is guided by concrete pad and secret sharing, and we show how the program logic examples of quantum algorithms and security protocols. can be used to discover a flaw in Google Cirq’s tutorial on the Motivating Local Reasoning for Quantum Programs: Variational Quantum Algorithm (VQA). Quantum Machine Learning [12], [13] and VQAs (Vari- ational Quantum Algorithms) [14], [15] are new classes 1. Introduction of quantum algorithms that emerged in recent years as a leading application of quantum computing. These algo- The logic of Bunched Implications (BI) of O’Hearn rithms solve problems by training parameterized quantum and Pym [1], [2], [3] is a substructural logic that fea- circuits. The trained circuits are usually very large in terms tures resource-aware connectives. One such connective is ∗, of both their size and the required quantum resources, known as separating conjunction: informally, an assertion i.e., the number of involved quantum bits (qubits). This φ ∗ holds with respect to a resource R if the resource makes them particularly challenging to verify with exist- R can be split into resources R0 and R00 such that φ ing techniques such as quantum Hoare logic [16], [17] holds with respect to R0 and holds with respect to R00. and verification based on operational semantics [18], since This interpretation is particularly well suited for reasoning the dimension of the matrices used to represent assertions about programs in settings where computations can have increases exponentially w.r.t. the number of qubits. Fortu- arXiv:2102.00329v1 [cs.LO] 30 Jan 2021 interfering effects. In particular, BI has found success as an nately, these algorithms can benefit from local reasoning, assertion language for Separation Logic [4], [5], [6], a pro- since each of their operations is performed locally on a gram logic for reasoning about programs with mutable state, small number of qubits. Consider for instance the quantum and Concurrent Separation Logic [7], [8], a program logic circuit shown in Figure 1, that implements a VQA circuit for reasoning about shared-memory concurrent processes. with 2 × 2 grid qubits. Instead of reasoning about the Recent works seek to extend the separation logic frame- circuit as a whole, we would like to reason about sub- work beyond memory-manipulating programs by consider- circuits ProcC(1); ProcC(2); Proc(R)(1); ProcR(2) sepa- ing other notions of resources and other models of com- rately, and then combine the results to establish the correct- putation. Broadly speaking, separation logics are a good fit ness of the whole program. This is precisely the kind of whenever programs manipulate resources in a local fashion: reasoning enabled by Quantum Separation Logic (QSL for that is, there is a natural notion of two resources being short). separate, and a program can operate on the first resource without affecting the second. This idea underlies recent sep- Technical Challenges and Contributions: QSL will be aration logics for probabilistic programs, where separation developed by first developing a model of BI, where formulas is probabilistic independence [9]. describe quantum states and then building a separation logic 1 Reynolds [19] in the context of standard separation logic. This extra bit of freedom seems to be particular to the quantum setting, and we crucially use this feature when using the frame rule to establish uniformity. The soundness proof of our quantum frame rule requires a nontrivial calculation based on purification, a fun- damental technique used in quantum information for transforming mixed states to pure states by introducing reference systems [20]. Figure 1: VQA(2) with parameters taken in Sec. 5.3. 3) Reasoning about entangled predicates:1 The structural rules FRAME and CONST enable us to lift local rea- soning to global correctness of quantum algorithms using these assertions as pre- and post-conditions, introduc- only when no entanglement occur in the pre- and ing proof rules to reason about quantum programs. post-conditions. However, entangled predicates play an BI and Its Quantum Interpretation: To characterize the essential role in revealing the non-local (global) proper- properties of quantum systems, we first identify a quantum ties of a composite quantum system; for instance, some interpretation of BI appropriate for our target applications. entangled predicates are used when reasoning about the We choose to interpret our separating conjunction ∗ as (in)correctness of VQA (see Sec. 5.3). With the help separability of quantum states. Roughly speaking, φ1 ∗ φ2 of auxiliary variables, we set up a new rule UNCR holds in a quantum state ρ if ρ can be factored into two which enables us to prove the correctness of large quantum states ρ1 and ρ2 over disjoint registers satisfying quantum algorithms with respect to entangled pre- and φ1 and φ2, respectively. post-conditions. Intuitively, when the program (as the Proof System for Program Logic: next, we define principal system) combined with auxiliary variables (as a program logic for a quantum while-language [16] (for ancillary systems), modification can be used to create simplicity, we do not consider classical variables). Our (mathematically rather than physically) entanglement language follows the “classical control and quantum data” and rule UNCR is used to preserve correctness under paradigm. We develop a set of proof rules that are effective the modification on the auxiliary variables in the pre- for verifying quantum programs over a large set of qubits. and post-conditions (but not in the program). The key Our proof system has several novel ingredients: idea behind was first proposed in [21] for reasoning 1) Modification on BI formulas. The basic rule for assign- about parallel quantum programs; UNCR is its gener- ments in classical program logics is defined using the alization tailored for our purpose. syntactic notion of substitution. Due to the non-cloning Applications: To demonstrate the breadth of the applica- law of quantum information, the role of assignments tion range of our logic QSL, we present several case studies has to be played by initialization q := j0i and unitary from two very different areas: transformations q := U[q], and inference rules for these operations involve a quantum operation (e.g., • Our first example given in Section 5 is formal verifi- [16], [17]). Unfortunately, the rules for initialization cation of Variational Quantum Algorithm (VQA) [14], and unitary transformations are not simple adaptations [15] for finding the ground state of a quantum system, of the rule for assignment, because a quantum gen- which has potential applications in quantum chemistry eralization of substitution is not straightforward. For for designing new materials and drugs. A typical VQA atomic predicates, substitutions are not always defined. can be split into different subprograms that are suited For composite formulas, a straightforward definition of to locally reasoning. Then the frame rules together substitution is too weak for applications. We overcome with UNCR are used to derive global correctness with this hurdle by introducing a modification operation for entangled pre- and post-conditions. In particular, an atomic formulas (see Definition 3.4), which is essen- analysis based on QSL reveals that the VQA presented tially a quantum version of substitution. Extending this in the tutorial of Google’s Cirq [22] is incorrect. operation to composite formulas requires some care • In Section 6, we use QSL to verify the security of (see Definition 3.5). quantum one-time pad (QOTP) [23], [24] and quantum 2) Frame rule: The frame rule is one of the most char- secret sharing (QSS) [25], [26]. Unlike previous work, acteristic structural rules in separation logic. QSL also the QSL verification of QOTP and QSS is scalable: in- enjoys a frame rule FRAME that is similar in spirit creasing the number of registers that algorithms employ to frame rules from standard separation logics, but does not complicate the verification. In particular, rule our new interpretation of separating conjunction means FRAME with the supported assertion (SP) enables us to that the meaning of the rule is different. Furthermore, avoid the very complicated