QMA/qpoly PSPACE/poly: De-Merlinizing Quantum Protocols ⊆

Scott Aaronson∗ University of Waterloo

Abstract But what if Alice is a quantum advisor, who can send Bob a quantum state ψf ? Even in that case, Ambainis This paper introduces a new technique for removing ex- et al. [4] showed that Alice| i has to send Ω (2n/n) qubits for istential quantifiers over quantum states. Using this tech- Bob to succeed with probability at least 2/3 on every x. nique, we show that there is no way to pack an exponential Subsequently Nayak [11] improved this to Ω (2n), mean- number of bits into a polynomial-size quantum state, in such ing that there is no quantum improvement over the classical a way that the value of any one of those bits can later be bound. Since 2n qubits is too many for Alice to communi- proven with the help of a polynomial-size quantum witness. cate during her weekly meetings with Bob, it seems Bob is We also show that any problem in QMA with polynomial- out of luck. size quantum advice, is also in PSPACE with polynomial- So in desperation, Bob turns for help to Merlin, the star size classical advice. This builds on our earlier result that student in his department. Merlin knows f as well as x, BQP/qpoly PP/poly, and offers an intriguing counter- and can thus evaluate f (x). The trouble is that Merlin point to the recent⊆ discovery of Raz that QIP/qpoly = ALL. would prefer to take credit for evaluating f (x) himself, so Finally, we show that QCMA/qpoly PP/poly and that he might deliberately mislead Bob. Furthermore, Merlin QMA/rpoly = QMA/poly. ⊆ (whose brilliance is surpassed only by his ego) insists that all communication with lesser students be one-way: Bob is to listen in silence while Merlin lectures him. On the 1. Introduction other hand, Merlin has no time to give an exponentiallylong lecture, any more than Alice does. With “helpers” like these, Bob might ask, who needs ad- Let Bob be a graduatestudent, and let x be an n-bit string versaries? And yet, is it possible that Bob could play Al- representing his thesis problem. Bob’s goal is to learn ice and Merlin against each other—cross-checking Merlin’s f (x), where f : 0, 1 n 0, 1 is a function that maps specific but unreliable assertions against Alice’s vague but every thesis problem{ to} its→ binary { } answer (“yes” or “no”). reliable advice? In other words, does there exist a random- Bob knows x (his problem), but is completely ignorant of f ized protocol satisfying the following properties? (how to solve the problem). So to evaluate f (x), he’s go- ing to need help from his thesis advisor, Alice. Like most (i) Alice and Merlin both send Bob poly (n) bits. advisors, Alice is infinitely powerful, wise, and benevolent. But also like most advisors, she’s too busy to find out what (ii) If Merlin tells Bob the truth about f (x), then there problems her students are working on. Instead, she just exists a message from Merlin that causes Bob to accept doles out the same advice s to all of them, which she hopes with probability at least 2/3. will let them evaluate f (x) for any x they might encounter. (iii) If Merlin lies about f (x) (i.e., claims that f (x)=1 The question is, how long does s have to be, for Bob to be when f (x)=0 or vice versa), then no message from able to evaluate f (x) for any x? Merlin causes Bob to accept with probability greater Clearly, the answer is that s has to be 2n bits long— than 1/3. since otherwise s will underdetermine the truth table of f. Indeed, let g (x, s) be Bob’s best guess as to f (x), given x It is relatively easy to show that the answer is no: if Alice and s. Then even if Alice can choose s probabilistically, sends a bits to Bob and Merlin sends w bits, then for Bob and we only require that g (x, s) = f (x) with probability to succeed we must have a (w +1)= Ω(2n). Indeed, this at least 2/3 for every x, still one can show that s needs to is basically tight: for all w 1, there exists a protocol in n be Ω (2 ) bits long. ≥ 2n which Merlin sends w bits and Alice sends O w + n bits. ∗ Of course, even if Merlin didn’t send anything, it would Email: [email protected]. Supported by ARDA, CIAR, and
IQC. Part of this work was done at Caltech. suffice for Alice to send 2n bits. At the other extreme,

1 if Merlin sends 2n bits, then it suffices for Alice to send Aaronson [1] showed that BQP/qpoly PP/poly, an Θ (n)-bit “fingerprint” to authenticate Merlin’s message. where BQP/qpoly is the class of problems solvable⊆ in BQP But in any event, either Alice or Merlin will have to send an with polynomial-size quantum advice. He also gave an or- exponentially-long message. acle relative to which NP BQP/qpoly. Together, these On the other hand, what if Alice and Merlin can both results seemed to place strong6⊂ limits on the power of quan- send quantum messages? Our main result will show that, tum advice. even in this most general scenario, Bob is still out of luck. However, recently Raz [14] reopened the subject, by Indeed, if Alice sends a qubits to Bob, and Merlin sends showing that in some cases quantum advice can be ex- w qubits, then Bob cannot succeed unless a (w +1) = traordinarily powerful. In particular, Raz showed that Ω 2n/n2 . Apart from the n2 factor (which we conjec- QIP (2) /qpoly = ALL, where QIP (2) is the class of prob- ture can be removed), this implies that no quantum protocol lems that admit two-round quantum interactive proof sys- is asymptotically
better than the classical one. It follows, tems. Raz’s result was actually foreshadowed by an obser- then, that Bob ought to drop out of grad school and send his vation in [1], that PostBQP/qpoly = ALL. Here PostBQP resume to Google. is the class of problems solvable in quantum polynomial time, if at any time we can measure the computer’s state 1 1.1. Banishing Merlin and then “postselect” on a particular outcome occurring. These results should make any complexity theorist a lit- tle queasy, and not only because jumping from QIP or But why should anyone care about this result, apart from (2) PostBQP to ALL is like jumping from a hilltop to the edge Alice, Bob, Merlin, and the Google recruiters? One reason of the universe. A more serious problem is that these is that the proof introduces a new technique for removing existential quantifiers over quantum states, which might be results fail to “commute” with standard complexity inclu- sions. For example, even though PostBQP is strictly con- useful in other contexts. The basic idea is for Bob to loop tained in BQEXPEXP, notice that BQEXPEXP qpoly is over all possible messages that Merlin could have sent, and / (very) strictly contained in PostBQP qpoly! accept if and only if there exists a message that would cause / him to accept. The problem is that in the quantum case, the number of possible messages from Merlin is doubly- 1.3. The Quantum Advice Hypothesis exponential. So to loop over all of them, it seems we’d first need to amplify Alice’s message an exponential num- On the other hand, the same pathologies would occur ber of times. But surprisingly, we show that this intuition with classical randomized advice. For neither the result of is wrong: to account for any possible quantum message Raz [14], nor that of Aaronson [1], makes any essential use from Merlin, it suffices to loop over all possible classical of quantum mechanics. That is, instead of saying that messages from Merlin! For, loosely speaking, any quan- QIP (2) /qpoly = PostBQP/qpoly = ALL, tum state can eventually be detected by the “shadows” it casts on computational basis states. However, turning this we could equally well have said that insight into a “de-Merlinization” procedure requires some work: we need to amplify Alice’s and Merlin’s messages in IP (2) /rpoly = PostBPP/rpoly = ALL, a subtle way, and then deal with the degradation of Alice’s message that occurs regardless. where IP (2) and PostBPP are the classical analogues of QIP (2) and PostBQP respectively, and /rpoly means “with polynomial-size randomized advice.” 1.2. QMA With Quantum Advice Inspired by this observation, here we propose a gen- eral hypothesis: that whenever quantum advice behaves like In any case, the main motivation for our result is that it exponentially-long classical advice, the reason has nothing implies a new containment in quantum complexity theory: to do with quantum mechanics. More concretely: namely that The Quantum Advice Hypothesis: For any “natural” QMA/qpoly PSPACE/poly. • complexity class , if /qpoly = ALL, then /rpoly = ⊆ ALL as well. C C C Here QMA is the quantum version of MA, and /qpoly 1Here is the proof: given a Boolean function f : {0, 1}n → {0, 1}, means “with polynomial-size quantum advice.” Previously, take it was not even known whether QMA qpoly ALL, where 1 / = |ψ i = |xi|f (x)i n n/2 ALL is the class of all languages! Nevertheless, some con- 2 0 1 n x∈{X, } text might be helpful for understanding why our new con- as the advice. Then to evaluate f (x) on any x, simply measure |ψni in tainment is of more than zoological interest. the standard basis, and then postselect on observing |xi in the first register.

2 The evidence for this hypothesis is simply that we have Given a complexity class , we write /poly, /rpoly, not been able to refute it. In particular, in Appendix and /qpoly to denote withC polynomial-sizeC determin-C 7 we will show that QMA/rpoly = QMA/poly. So if istic,C randomized, and quantumC advice respectively.3 So QMA/qpoly contained all languages—which (at least to us) for example, BPP/rpoly is the class of languages decid- seemed entirely possible a priori—then we would have a able by a BPP machine, given a sample from a distribu- clear counterexample to the hypothesis. In our view, then, tion n over polynomial-size advice strings which depends the significance of the QMA/qpoly PSPACE/poly re- onlyD on the input length n. It is clear that BPP/rpoly = sult is that it confirms the quantum advice⊆ hypothesis in the BPP/poly = P/poly. However, in other cases the state- most nontrivial case considered so far. ment /rpoly = /poly is harder to prove or is even false. C C To summarize, the quantum advice hypothesis has been Admittedly, the /rpoly and /qpoly operators are not confirmed for at least four complexity classes: BQP, QMA, always well-defined: for example, P/qpoly is just silly, PostBQP, and QIP (2). It remains open for other classes, and AM/rpoly seems ambiguous (since who gets to sam- such as QMA (2) (QMA with two unentangled yes-provers) ple from the advice distribution?). For interactive proof p and QS2 (QMA with competing yes-prover and no-prover). classes, the general rule we adopt is that only the verifier gets to “measure” the advice. Inotherwords, theprover(or provers) knows the advice distribution n or advice state 1.4. Outline of Paper D ψn , but not the actual results of sampling from n or mea- | i D suring ψn . Inthecase of /rpoly, the justification for this Section 2 surveys the complexity classes, communi- | i • rule is that, if the prover knew the sample from n, then we cation complexity measures, and quantum information would immediately get /rpoly = /poly for allD interactive notions used in this paper. proof classes , which isC too boring.C In the case of /qpoly, the justificationC is that the verifier should be allowed to mea- Section 3 states our “De-Merlinization Theorem,” and • sure ψn at any time and in any basis it likes, and it seems then proves three of its implications: (i) a lower perverse| i to require the results of such measurements to be bound on the QMA communication complexity of ran- relayed instantly to the prover. dom access coding, (ii) a general lower bound on In a private-coin protocol, the verifier might choose to QMA communication complexity, and (iii) the inclu- reveal some or all of the measurement results to the prover, sion QMA/qpoly PSPACE/poly. ⊆ but in a public-coin protocol, the verifier must send a uni- form random message that is uncorrelated with the advice. Section 4 proves the De-Merlinization Theorem itself. • Indeed, this explains how it can be true that IP (2) /rpoly = AM/rpoly (the former equals ALL, while the latter equals6 Section 5 concludes with some open problems. • NP/poly), even though Goldwasser and Sipser [5] famously showed that IP (2) = AM in the uniform setting. Appendix 7 proves a few other complexity results, in- • For the complexity classes that appear in this paper, cluding QCMA/qpoly PP/poly and QMA/rpoly = it should generally be obviousC what we mean by /rpoly QMA poly ⊆ / . or /qpoly. But to fix ideas, let us now formallyC define QMAC /qpoly. 2. Preliminaries Definition 1 QMA/qpoly is the class of languages L 0, 1 ∗ for which there exists a polynomial-time quantum⊆ 2.1. Complexity Classes { } verifier , together with quantum advice states ψn , Q {| i}n≥1 such that for all x 0, 1 n: We assume familiarity with standard complexity classes ∈{ } like BQP, P/poly, and MA. The class QMA (Quantum (i) If x L, then there exists a quantum witness ϕ ∈ | i Merlin-Arthur) consists of all languages for which a ‘yes’ such that accepts with probability at least 2/3 given Q answer can be verified in quantum polynomial time, given x ψn ϕ as input. | i | i | i a polynomial-size quantum witness state . The com- ϕ 4 pleteness and soundness errors are 1/3. The| i class QCMA (ii) If x / L, then for all pure states ϕ of the witness register,∈ accepts with probability| ati most 1/3 given (Quantum Classical Merlin-Arthur) is the same as QMA, Q x ψn ϕ as input. except that now the witness must be classical. It is not | i | i | i 2 known whether QMA = QCMA. See the Complexity Zoo 3We can also write C/rlog (for C with logarithmic-size randomized for more information about these and other classes. advice), C/qlog, and so on. 4By linearity, this is equivalent to quantifying over all mixed states of 2http://qwiki.caltech.edu/wiki/Complexity Zoo the witness register.

3 Here ψn and ϕ both consist of p (n) qubits for some (i) If f (X, Y )=1, then there exists a ϕ such that Bob | i | i | i fixed polynomial p. Also, can accept with arbitrary prob- accepts Y ψX ϕ with probability at least 2/3. Q | i | i | i ability if given a state other than ψn in the advice register. | i (ii) If f (X, Y ) = 0, then for all ϕ , Bob accepts | i Y ψX ϕ with probability at most 1/3. One other complexity class we will need is PostBQP, or | i | i | i BQP with postselection. Call a protocol “(a, w)” if Alice’s message consists of a qubits and Merlin’s consists of w qubits. Then for all inte- Definition 2 PostBQP is the class of languages L gers w 0, we let QMA1 (f) denotethe “QMA one-way ∗ ⊆ w w 0, 1 for which there exists a polynomial-time quantum communication≥ complexity” of f: that is, the minimum a algorithm{ } such that for all x 0, 1 n, when the algorithm ∈{ } for which there exists an (a, w) protocol such that Alice and terminates: 1 1 Bob succeed. Clearly QMAw (f) Q (f), with equality when w =0. ≤ (i) The first qubit is 1 with nonzero probability. | i 2.3. Quantum Information (ii) If x L, then conditioned on the first qubit being 1 , the second∈ qubit is 1 with probability at least 2/3|. i | i Here we review some basic facts about mixed states. (iii) If x / L, then conditioned on the first qubit being 1 , Further details can be found in Nielsen and Chuang [13] the second∈ qubit is 1 with probability at most 1/3|. i for example. | i Given two mixed states ρ and σ, the fidelity F (ρ, σ) is One can similarly define PostBQPSPACE, the maximum possible value of ψ ϕ , where ψ and ϕ h | i | i | i PostBQEXP, and so on. We will use a result of are purifications of ρ and σ respectively. Also, given a Aaronson [2], which characterizes PostBQP as simply the measurement M, let M (ρ) be the probability distribution D classical complexity class PP. over measurement outcomes if M is applied to ρ. Then the trace distance ρ σ equals the maximum, over all k − ktr possible measurements M, of M (ρ) M (σ) , where 2.2. Communication Complexity kD − D k N N M 0 1 0 Let f : 0, 1 0, 1 0, 1 be a Boolean = pi pi kD − D k 2 | − | { } × { } → { } i=1 function. Suppose Alice has an N-bit string X and Bob X has an -bit string . Then 1 is the determinis- M Y D (f) is the variation distance between = (p1,...,pN ) and tic one-way communication complexity of f: that is, the 0 0 0 D = (p1,...,pN ). For all ρ and σ, we have the following minimum number of bits that Alice must send to Bob, for relationD between fidelity and trace distance: Bob to be able to output f (X, Y ) with certainty for any (X, Y ) pair. If we let Alice’s messages be randomized, and 2 ρ σ tr 1 F (ρ, σ) . only require Bob to be correct with probability , then k − k ≤ − 2/3 q we obtain 1 , the bounded-error randomized one-way Throughout this paper, we use N to denote N- R (f) H communication complexity of f. Finally, if we let Alice’s dimensional Hilbert space. One fact we will invoke re- messages be quantum, then we obtain 1 , the bounded- peatedly is that, if I is the maximally mixed state in N , Q (f) H error quantum one-way communication complexity of f.5 then N Clearly Q1 (f) R1 (f) D1 (f) for all f. See Klauck 1 ≤ ≤ I = ψj ψj [7] for more detailed definitions of these measures. N | i h | j=1 Now suppose that, in addition to a quantum message X where ψ1 ,..., ψN is any orthonormal basis for N . ψX from Alice, Bob also receives a quantum witness {| i | i} H |ϕ ifrom Merlin, whose goal is to convince Bob that |f (iX, Y )=1.6 We say Alice and Bob succeed if for all 3. De-Merlinization and Its Applications X, Y , Our main result, the “De-Merlinization Theorem,” al- 5We assume no shared randomness or entanglement. Also, we assume 1 lows us to lower-bound QMAw (f) in terms of the ordi- for simplicity that Alice can only send pure states; note that this increases 1 the message length by at most a multiplicative factor of 2 (or an additive nary quantum communication complexity Q (f). In this factor of log N, if we use Newman’s Theorem [12]). section we state the theorem and derive its implications for 6For convenience, from now on we assume that Merlin only needs to random access coding (in Section 3.1), one-way communi- prove statements of the form f (X,Y ) = 1, not f (X,Y ) = 0. For our cation complexity (in Section 3.2), and complexity theory actual results, it will make no difference whether we adopt this assumption (corresponding to the class QMA), or the assumption in Section 1 (corre- (in Section 3.3). The theorem itself will be proved in Sec- sponding to QMA ∩ coQMA). tion 4.

4 Theorem 3 (De-Merlinization Theorem) For all Boolean with constant probability, by cross-checking the kth bit of th 0 functions f (partial or total) and all w 2, g (Y ) against the k bit of Yj as sent by Alice. ≥ Using a straightforward amplification trick, we can show Q1 (f)= O QMA1 (f) w log2 w . that the protocol of Theorem 4 is essentially optimal. w ·
1 Theorem 5 If there exists a randomized (a, w) protocol for Furthermore, given an algorithm for the QMAw protocol, Bob can efficiently generate an algorithm for the Q1 pro- RAC, then a (w +1)=Ω(N) and a = Ω (log N). tocol. If the former uses C gates and S qubits of mem- Proof. We first show that a (w +1)=Ω(N). First Alice ory, then the latter uses C SO(S) gates and O S2 log2 S amplifies her message to Bob by sending W = O (w + 1) qubits of memory. ·
independent copies of it. For any fixed message of Mer- lin, this reduces Bob’s error probability to at most (say) 3.1. Application I: Random Access Coding 2−2(w+1). So nowBob can ignoreMerlin,and loop overall 2w messages z 0, 1 w that Merlin could have sent, ac- Following Ambainis et al. [4], let us define the random cepting if and only∈ { if there} exists a z that would cause him access coding (or RAC) problem as follows. Alice has to accept. This yields an ordinary protocol for the RAC an N-bit string X = x ...xN and Bob has an index i problem in which Alice sends aW bits to Bob. But Ambai- 1 ∈ 1,...,N . The players’ goal is for Bob to learn xi. nis et al. [4] showed that any such protocol requires Ω (N) { } In our setting, Bob receives not only an a-bit message bits; hence a (w +1)=Ω(N). from Alice, but also a w-bit message from Merlin. If xi = That Alice needs to send Ω (log N) bits follows by a sim- 1, then there should exist a message from Merlin that causes ple counting argument: let X be Alice’s message distri- D Bob to accept with probability at least 2/3; while if xi =0, bution given an input X. Then X and Y must have then no message from Merlin should cause Bob to accept constant variation distance for all XD = Y , ifD Bob is to dis- with probability greater than 1/3. We are interested in the tinguish X from Y with constant bias.6 minimum a, w for which Alice and Bob can succeed. Together, Theorems 4 and 5 provide the complete story For completeness, before stating our results for the quan- for the classical case, up to a constant factor. In the quan- tum case, let us first pin down the classical case—that is, tum case, the situation is no longer so simple, but we can the case in which Alice and Merlin both send classical mes- give a bound that is tight up to a polylog factor. sages, and Alice’s message can be randomized. Obviously, if Merlin sends 0 bits, then Alice needs to send Θ (N) bits; Theorem 6 If there exists a quantum (a, w) protocol for this is just the ordinary RAC problem studied by Ambainis RAC, then N et al. [4]. At the other extreme, if Merlin sends the N-bit a (w +1)=Ω . log2 N message X, then it suffices for Alice to send an O (log N)-   bit fingerprint of X. For intermediate message lengths, we Proof. If w = 0 or w = 1 then clearly a = Ω (N), so can interpolate between these two extremes. assume w 2. By Theorem 3, ≥ 1 1 2 Theorem 4 For all a, w such that aw N, there exists Q (RAC) = O QMAw (RAC) w log w ≥ · a randomized (a + O (log N) , w) protocol for RAC—that 2 = O aw log N .
is, a protocol in which Alice sends a + O (log N) bits and · Merlin sends w bits. But Nayak [11] showed that Q1 (RAC)
= Ω (N), and hence aw =Ω N/ log2 N . Proof. The protocol is as follows: first Alice divides her Clearly Theorem 6 can be improved when w is very
string X = x1 ...xN into a substrings Y1,...,Ya, each at small or very large. For when w =0, we have a = Ω (N); most w bits long. She then maps each Yj to an encoded while for any w, a simple counting argument (as in the clas- 0 w W substring Yj = g (Yj ), where g : 0, 1 0, 1 is a sical case) yields a = Ω(log N). We believe that Theorem constant-rate error-correcting code{ satisfying} →W { =}O (w). 6 can be improved for intermediate w as well, since we do Next she chooses k 1,...,W uniformly at random. not know of any quantum protocol that beats the classical Finally, she sends Bob∈k {(which requires} O (log N) bits of protocol of Theorem 4. th 0 communication), together with the k bit of Yj for every j 1,...,a . 3.2. Application II: One-Way Communica- ∈{Now if Merlin} is honest, then he sends Bob the substring tion w Yj 0, 1 of X containing the xi that Bob is interested ∈ { } in. This allows Bob to learn xi. Furthermore, if Merlin Theorem 3 yields lower bounds on QMA communica- cheats by sending some Y = Yj , then Bob can detect this tion complexity, not only for the random access coding 6

5 problem, but for other problems as well. For Aaronson [1] proof of Savitch’s theorem that NPSPACE = PSPACE. An showed the following general relationship between D1 (f) obviousdifficulty is that the numbers of paths could be dou- 1 and Q2 (f): bly exponential, and therefore take exponentially many bits to store. But we can deal with that by computing each bit N Theorem 7 ([1]) For all Boolean functions f : 0, 1 of the numbers separately. Here we use the fact that there { } × 0, 1 M 0, 1 (partial or total), exist NC1 circuits for addition, and hence addition of 2n-bit { } →{ } integers is “locally” in PSPACE. 1 1 1 D (f)= O M Q2 (f)logQ2 (f) . If each path is weighted by a complex amplitude, then it is easy to see that the same idea lets us sum the amplitudes Combining Theorem 7 with Theorem 3, we
obtain the 1 1 over all paths. We can thereby simulate BQPSPACE and following relationship between D (f) and QMAw (f). PostBQPSPACE PSPACE N M in as well. For all f : 0, 1 0, 1 0, 1 (partial or total) In particular, Lemma 10 implies that and all w {2, } ×{ } → { } ≥ PostBQPSPACE/poly = PSPACE/poly. (For note that unlike randomized and quantum advice, determin- D1 (f)= O M w log3 w QMA1 (f) log QMA1 (f) . · · w w istic advice commutes with standard complexity class
inclusions.) 3.3. Application III: Upper-Bounding Putting it all together, we obtain: QMA/qpoly Theorem 11 QMA/qpoly PSPACE/poly. ⊆ We now explain why the containment QMA/qpoly As a final remark, let QAM be the quantum analogue of PSPACE/poly follows from the De-Merlinization Theo-⊆ AM, in which Arthur sends a public random string to Mer- rem. The first step is to observea weaker result that follows lin, and then Merlin respondswith a quantum state. Marriott from that theorem: and Watrous [10] observed that QAM = BP QMA. So · Lemma 8 QMA qpoly BQPSPACE qpoly. / / QAM/qpoly = BP QMA/qpoly = QMA/qpoly, ⊆ · Proof. Given a language L QMA/qpoly, let Ln : since we can hardwire the random string into the quantum 0, 1 n 0, 1 be the Boolean∈ function defined by { } → { } advice. Hence QAM/qpoly PSPACE/poly as well. Ln (x)=1 if x L and Ln (x)=0 otherwise. Then if we ⊆ ∈ This offers an interesting contrast with the result of Raz [14] interpret Alice’s input as the truth table of Ln, Bob’s input that QIP (2) /qpoly = ALL. as x, and S as the numberof qubits used by the QMA/qpoly machine, the lemma follows immediately from Theorem 3. 4. Proof of The De-Merlinization Theorem Na¨ıvely, Lemma 8 might seem obvious, since it is well- known that QMA PSPACE. But remember that even if We now proceed to the proof of Theorem 3. In Sec- tion 4.1 we prove several lemmas about damage to quantum , it need not⊆ follow that /qpoly /qpoly. C ⊆The D next step is to replace theC quantum⊆ Dadvice by classi- states, and in particular, the effect of the damage caused by earlier measurements of a state on the outcomes of later cal advice. measurements. Section 4.2 then gives our procedure for Lemma 9 BQPSPACE/qpoly PostBQPSPACE/poly. amplifying Bob’s error probability, after explaining why the ⊆ more obvious procedures fail. Finally, Section 4.3 puts to- Proof. Follows from the same argument used by Aaronson gether the pieces. [1] to show that BQP/qpoly PostBQP/poly. Allwe need to do is replace polynomial⊆ time by polynomial space. 4.1. Quantum Information Lemmas

Finally, we observe a simple generalization of Watrous’s In this section we prove several lemmas that will be theorem [15] that BQPSPACE = PSPACE. needed for the main result. The first lemma is a simple variant of Lemma 2.2 from [1]; we include a proof for com- Lemma 10 PostBQPSPACE = PSPACE. pleteness.

Proof Sketch. Ladner [9] showed that PPSPACE = Lemma 12 (Almost As Good As New Lemma) Suppose PSPACE. Intuitively, given the computation graph of a a 2-outcome POVM measurement of a mixed state ρ yields PPSPACE machine, we want to decide in PSPACE whether outcome 1 with probability ε. Then after the measurement, the number of accepting paths exceeds the number of reject- and assuming outcome 0 is observed, we obtain a new state ing paths. To do so we use divide-and-conquer, as in the ρ such that ρ ρ √ε. 0 k − 0ktr ≤

6 Proof. Let ψ be a purification of ρ. Then we can write Finally, we give a lemma that is key to our result. This ψ as √1 | εiψ + √ε ψ , where ψ is a purification lemma, which we call the “quantum OR bound,” is a sort | i − | 0i | 1i | 0i of ρ0 and ψ0 ψ1 =0. So the fidelity between ρ and ρ0 is of converse to the quantum union bound. It says that, for h | i all quantum circuits Λ and advice states ψ , if there exists | i F (ρ,ρ0) ψ ψ0 = √1 ε. a witness state such that accepts with high ≥ h | i − ϕ Λ ψ ϕ probability, then| wei can also cause Λ to| accepti | i with high Therefore probability by repeatedly running Λ on ψ j , where j is a random basis state of the witness register,| i | i and then| tak-i ρ ρ 1 F (ρ,ρ )2 √ε. k − 0ktr ≤ − 0 ≤ ing the logical OR of the outcomes. One might worry that, q as we run Λ with various j ’s, the state of the advice reg- ister might become corrupted| i to something far from ψ . The next lemma, which we call the “quantum union However, we show that if this happens, then it can only| bei bound,” abstracts one of the main ideas from [4]. because one of the measurements has already accepted with Lemma 13 (Quantum Union Bound) Let ρ be a mixed high probability. state, and let Λ1,..., ΛT be a set of 2-outcome POVM Lemma 14 (Quantum OR Bound) Let be a -outcome { } Λ 2 measurements. Suppose each Λt yields outcome 1 with POVM measurement on a bipartite Hilbert space A B. H ⊗H probability at most ε when applied to ρ. Then if we ap- Also, let 1 ,..., N be any orthonormal basis for B, {| i | i} H ply Λ1,..., ΛT in sequence to ρ, the probability that at least and for all j 1,...,N , let Λj be the POVM on A ∈ { } H one of these measurements yields outcome 1 is at most T √ε. induced by applying Λ to A j . Suppose there exists a H ⊗ | i product state ρ σ in A B such that Λ yields outcome 1 Proof. Follows from a hybrid argument, almost identi- with probability⊗ at leastH η>⊗H0 when applied to ρ σ. Then cal to Claim 4.1 of Ambainis et al. [4]. More explic- ⊗ if we apply Λj1 ,..., ΛjT in sequence to ρ, where j1,...,jT itly, by the principle of deferred measurement, we can re- are drawn uniformly and independently from 1,...,N place each measurement Λt by a unitary Ut that CNOT’s and T N/η2, the probability that at least one{ of these} the measurement outcome into an ancilla qubit. Let ρ0 = ≥ 2 ρ 0 0 0 0 be the initial state of the system plus T measurements yields outcome 1 is at least η N/T . ⊗ | · · · i h · · · | − ancilla qubits. Then by the same idea as in Lemma 12, for   Proof. Let E denote the event that one ofp the first t all t we have t measurements of ρ yields outcome 1. Also, let α := −1 2 Utρ0Ut ρ0 √ε. η N/T . Thenourgoalisto showthat Pr [Et] α − tr ≤ − ≥ for some t, where the probability is over the choice of So letting p j1,...,jT as well as the measurement outcomes. Suppose −1 −1 Pr [Et] < α for all t; we will derive a contradiction. ρt := UT UT −t+1ρ0UT −t+1 UT , · · · · · · Let ρt be the state in A after the first t measurements, H by unitarity we also have averaged over all choices of j1,...,jt and assuming Et does not occur. Suppose ρt ρ tr > √α for some t. −1 −1 k − k UT UT −tρ0UT −t UT Then interpreting the first t measurements as a single mea- ρt+1 ρt tr = · · · ·− ·1 · −1 k − k UT UT −t+1ρ0U U surement, and taking the contrapositive of Lemma 12, we − · · · T −t+1 · · · T tr −1 find that Pr [Et] > α, and we are done. So we can assume = UT −tρ0UT −t ρ0 tr − without loss of generality that ρt ρ tr √α for all t. √ ε, For all mixed states ς in k − k ,≤ let P (ς) be the ≤ A B Λ probability that Λ yields outcomeH ⊗1 when H applied to ς. By and hence ρT ρ0 tr T √ε by the triangle inequality. the definition of trace distance, we have Now letkM be− a measurementk ≤ that returns the logical OR 0 0 of the T ancilla qubits, and let (ρ) be the distribution over PΛ (ς ) PΛ (ς) ς ς ≥ −k − ktr the outcomes (0 and 1) when DM is applied to ρ. Suppose for all ς, ς0. Therefore M yields outcome 1 with probability p when applied to ρT . Then since M yields outcome 1 with probability 0 when P (ρt σ) P (ρ σ) ρt σ ρ σ Λ ⊗ ≥ Λ ⊗ −k ⊗ − ⊗ ktr applied to ρ0, the variation distance (ρT ) (ρ0) is = PΛ (ρ σ) ρt ρ tr equal to p. So by the definition of tracekD distance,− D k ⊗ −k − k η √α. ≥ − p ρT ρ T √ε. ≤k − 0ktr ≤ Hence η √α P (ρt I) − , Λ ⊗ ≥ N

7 where Lemma 15 Suppose Bob receives an a-qubit message ψ N | i 1 from Alice and a w-qubit message ϕ from Merlin, where I = j j 2 | i N | i h | w 2. Let A = O aw log w and W = O (w log w). j=1 ≥ X Then by using A qubits from Alice and W qubits from Mer- is the maximally mixed state in B. It follows that for all
−W H lin, Bob can amplify his soundness error to 5 while t, keeping his completeness error 1/3. η √α EX [PΛ (ρt j j )] − . j∈{1,...,N} ⊗ | i h | ≥ N Proof. We will actually use two layers of amplification. In the “inner” layer, we replace Alice’s message ψ by the Now notice that | i a`-qubit message ψ ⊗`, where ` = O (log w). We alsore- q | i ⊗` Pr [Et Et−1]= EX [PΛ (ρt−1 jt jt )] place Merlin’s message ϕ by the w`-qubit message ϕ . | jt∈{1,...,N} ⊗ | i h | We then run Bob’s algorithm| i ` times in parallel and| outputi for all t. Furthermore, since Et Et, the events −1 ⇒ the majority answer. By a Chernoff bound, together with qEt Et are disjoint. Therefore −1 ∧ the same observations used by Kitaev and Watrous [6] to T show amplification for QMA, this reduces both the com- 1 Pr [ET ]= Pr [qEt Et] pleteness and the soundness errors to ε = 3 , for suit- −1 ∧ 1000w t=1 able ` = O (log w). X T In the “outer” layer, we replace Alice’s message by ⊗`u = Pr [qEt ]Pr[Et qEt ] ψ , where u = O (W ). We then run the inner layer −1 | −1 t=1 | i ⊗` X u times, once for each copy of ψ , but reusing the same T register for Merlin’s message each| i time. (Also, after each (1 α) EX [PΛ (ρt−1 jt jt )] invocation of the inner layer, we uncompute everything ex- ≥ − · jt∈{1,...,N} ⊗ | i h | t=1 X cept the final answer.) Finally, we output the majority an- η √α swer among these u invocations. (1 α) T − ≥ − N Call Bob’s original algorithm , and call the amplified   Q 2 T algorithm ∗. Then our first claim is that if accepts η √α Q Q ≥ − N all w-qubit messages from Merlin with probability at most =1,
1/3, then ∗ accepts all W -qubit messages with probability at most 5−QW , for suitable u = O (W ). This follows from 2 which is certainly greater than α = η N/T . Here a Chernoff bound—since even if we condition on the first − through th invocations of the inner layer, the st in- 2 t (t + 1) we are using the fact that T N/η , and hence α 1. ⊗` ≥ p ≤ vocation will still receive a “fresh” copy of ψ , and will therefore accept with probability at most ε| i 1/3. The 4.2. Amplification st state of Merlin’s message register before the (≤t + 1) invo- cation is irrelevant. Before proceeding further, we need to decrease Bob’s Our second claim is that, if accepts some ϕ with soundnesserror (that is, the probabilitythat he accepts a dis- Q | i probability at least 2/3, then accepts ϕ ⊗` with prob- honest claim from Merlin). The simplest approach would Q∗ | i be to have Alice and Merlin both send ` copies of their mes- ability at least 2/3. For recall that a single invocation of the inner layer rejects ϕ ⊗` with probability at most ε. So sages for some `, and then have Bob run his verification | i algorithm ` times in parallel and output the majority an- by Lemma 13, even if we invoke the inner layer u times swer. However, this approach fails, since the decrease in in sequence, the probability that one or more invocations error probability is more than cancelled out by the increase reject is at most u√ε, which is less than 1/3 for suitable in Merlin’s message length (recall that we will have to loop u = O (W ). over all possible classical messages from Merlin). So then why not use the “in-place amplification” technique of Mar- 4.3. Main Result riott and Watrous [10]? Because unfortunately, that tech- nique only works for Merlin’s message; we do not know We are now ready to prove Theorem 3: that for all whether it can be generalized to handle Alice’s message as Boolean functions f and all w 2, 7 ≥ well. Happily, there is a “custom” amplification procedure Q1 (f)= O QMA1 (f) w log2 w . with the properties we want: w ·

7 Furthermore, if Bob uses C gates and S qubits
in the In any such generalization, certainly Alice will still have to send mul- 1 O(S) tiple copies of her message. The question is whether Merlin will also have QMAw protocol, then he uses C S gates and 2 1 · to send multiple copies of his message. O S2 log S qubits in the Q protocol.
8 Proof of Theorem 3. Let be Bob’s algorithm. Also, suppose Alice’s message hasQa qubits and Merlin’s message PP/rpoly = IP(2)/rpoly = ALL has w qubits. The first step is to replace by the amplified Q algorithm ∗ from Lemma 15, which takes an A-qubit ad- PSPACE/poly = PSPACE/rpoly vice state QΨ from Alice and a W -qubit witness state from Merlin, where| i A = O aw log2 w and W = O (w log w). PP/poly = PostBQP/poly From now on, we use ∗ ( Φ ) as a shorthand for ∗ run QMA/qpoly with witness Φ , togetherQ with| i an
advice register thatQ orig- | i inally contains Alice’s message Ψ (but that might become QMA/poly = QMA/rpoly QCMA/qpoly corrupted as Bob uses it). Then| i Bob’s goal is to decide whether there exists a Φ such that ( Φ ) accepts with | i Q∗ | i QCMA/poly = QCMA/rpoly high probability. BQP/qpoly To do so, Bob uses the following procedure . Given M BQP/poly = BQP/rpoly Alice’s message Ψ , this procedure runs ∗ ( z ) for 9 2W computational| i basis states z of theQ witness| i reg- ister chosen uniformly at random.| Finallyi it returns the
Figure 1. Known containments among classi- logical OR of the measurement outcomes. cal and quantum advice classes. let c be a counter initialized to 0 for|t i:= 1 to 9 2W | i choose z 0, 1 W uniformly at random ∈{
} gates and 2 2 qubits, where we have used the fact run ∗ ( z ), and let b be ∗’s output O S log S Q// |fori accept, forQ reject that w S. This completes the proof. 1 0 ≤
set c := c + b | i−1 | i run ∗ ( z ) to uncompute garbage 5. Conclusions and Open Problems next t Q | i if then return ; c =0 f (x, y)=0 Figure 1 shows the known relationships among deter- otherwise return f (x, y)=1 ministic, randomized, and quantum advice classes, in light Let us first show that is correct. First suppose that of this paper’s results. We still know remarkably little M about quantum advice, compared to other computational re- f (x, y)=0. By Lemma 15, we know that ∗ ( Φ ) ac- cepts with probability at most 5−W for all statesQ Φ| ofi the sources. But our results provide new evidence for a general | i hypothesis: that if you’restrong enough to squeeze an expo- witness register. So in particular, ∗ ( z ) accepts with probability at most 5−W for all basisQ states| iz . ByLemma nential amount of advice out of a quantum state, then you’re 13, it follows that when is finished, the| counteri c will also strong enough to squeeze an exponential amount of ad- have been incremented atM least once (and hence itself vice out of a probability distribution. will have accepted) with probability at most M We end with some open problems. 9 2W 1 Can we find a counterexample to the quantum ad- . • √ W  9 vice hypothesis? What about QMA (2), or QMA (k) 5
p for k > 2, or QS2? Currently, we do not even Next suppose that f (x, y)=1. By assumption, there exists know whether QMA (2) /rpoly = ALL; this seems re- a Φ such that ∗ ( Φ ) accepts with probability at least | i Q | i W W lated to the difficult open question of amplification for 2/3. So setting η = 2/3, N = 2 , and T = 9 2 , QMA (2) (see Kobayashi et al. [8]). Lemma 14 implies that will accept with probability at M
least Is there a class such that /rpoly = /poly but 2 2 • C C 6 C N 2 1 1 /rpoly = ALL? η = = . C 6 − T 3 − 9 9 r ! r ! Can we tighten the Ω N/ log2 N lower bound of It remains only to upper-bound ’s complexity. If • Theorem 6 to Ω (N)? One approach would be to M Bob’s original algorithm used C gates and S qubits, then tighten Lemma 15, by generalizing
the in-place QMA Q 2 clearly the amplified algorithm ∗ uses O C w log w amplification of Marriott and Watrous [10]. Q · gates and O S w log2 w qubits. Hence uses · M
Can we improve the containment QMA/qpoly O C w log2
w 2W = C SO(S) • PSPACE/poly to QMA/qpoly PP/poly? Alterna-⊆ · · · ⊆
9 tively, can we construct an oracle (possibly a ‘quan- [13] M. Nielsen and I. Chuang. Quantum Computation and tum oracle’ [3]) relative to which QMA/qpoly Quantum Information. Cambridge University Press, 2000. PostBQP/poly? This would indicate that the upper6⊂ [14] R. Raz. Quantum information and the PCP theorem. In bound of PSPACE/poly might be difficult to improve. Proc. IEEE FOCS, 2005. quant-ph/0504075. [15] J. Watrous. Space-bounded quantum complexity. J. Comput. Sys. Sci., 59(2):281–326, 1999. 6. Acknowledgments 7. Appendix: Other Complexity Results Greg Kuperberg collaborated in the research project of which this paper was an offshoot, and I am grateful to him The purpose of this appendix is to show that, in upper- for commentsand advice, as well as for several observations bounding QMA/qpoly, the computational difficulty really including Proposition 16. I also thank Oded Regev for first does arise from the need to handle quantum advice and suggesting to me the problem of proving an upper bound quantum witnesses simultaneously: if either or both are “de- on QMA/qpoly; Ashwin Nayak and Hirotada Kobayashi quantized,” then the upper bound of PSPACE/poly can be for pointing out errors in an earlier version of Section 4.1; improved. In particular, and in increasing order of nontriv- Harumichi Nishimura for helpful discussions; Jon Yard for iality, Theorem 17 will show that MA/rpoly = MA/poly pointing out a gap in an earlier version of Section 3.3; and (and likewise that QCMA/rpoly = QCMA/poly), Theorem Ronald de Wolf and the anonymousreviewers for comments 19 will show that QMA/rpoly = QMA/poly, and Theorem on the manuscript. 20 will show that QCMA/qpoly PP/poly. First, however, let us make⊆ a cautionary observation, References which illustrates why such upper bounds cannot be blithely assumed. Recall that MAEXP is the exponential-time ana- [1] S. Aaronson. Limitations of quantum advice and one-way logue of MA. communication. Theory of Computing, 1:1–28, 2005. quant- ph/0402095. Proposition 16 MAEXP/rpoly = ALL. [2] S. Aaronson. Quantum computing, postselection, and Proof. Given an arbitrary Boolean function f : 0, 1 n probabilistic polynomial-time. Proc. Roy. Soc. London, { } → A461(2063):3473–3482, 2005. quant-ph/0412187. 0, 1 , an honest Merlin’s message will consist of the truth { } [3] S. Aaronson and G. Kuperberg. Quantum versus classical table of f, while the randomized advice will consist of an proofs and advice. In preparation, 2006. O (n)-bit fingerprint of the truth table. [4] A. Ambainis, A. Nayak, A. Ta-Shma, and U. V. Vazirani. We can also “scale down” Proposition 16 by an exponen- Quantum dense coding and quantum finite automata. J. tial, to obtain MA/poly MA/rlog. More explicitly, in the ACM, 49:496–511, 2002. Earlier version in ACM STOC MA/rlog simulation, an⊆ honest Merlin’s message will con- 1999, pp. 376-383. quant-ph/9804043. tain the advice s to the MA/poly machine, while the rlog [5] S. Goldwasser and M. Sipser. Private coins versus public coins in interactive proof systems. In Randomness and Com- advice will consist of an O (log n)-bit fingerprint of s. putation, volume 5 of Advances in Computing Research. JAI We next show that MA/rpoly = MA/poly. Combined Press, 1989. with the above observation, this result has the surprising im- [6] A. Kitaev and J. Watrous. Parallelization, amplification, and plication that exponential-time simulation of quantum interactive proof systems. In Proc. ACM STOC, pages 608–617, 2000. MA/rlog = NP/poly = MA/poly = MA/rpoly. [7] H. Klauck. Quantum communication complexity. In Proc. Intl. Colloquium on Automata, Languages, and Program- In other words, for an MA machine, poly (n) bits of ran- ming (ICALP), pages 241–252, 2000. quant-ph/0005032. domized advice are no more powerful than log (n) bits. [8] H. Kobayashi, K. Matsumoto, and T. Yamakami. Quantum Merlin-Arthur proof systems: are multiple Merlins more Theorem 17 MA/rpoly = MA/poly. helpful to Arthur? In ISAAC, pages 189–198, 2003. quant- Proof. Let L be a language in MA/rpoly, and let (x, r, z) ph/0306051. A [9] R. E. Ladner. Polynomial space counting problems. SIAM be Arthur’s verification algorithm run on input x, advice J. Comput., 18:1087–1097, 1989. string r, and witness z 0, 1 w(n), for some polynomial [10] C. Marriott and J. Watrous. Quantum Arthur-Merlin games. w. (We assume without∈ { loss} of generality that Arthur is Computational Complexity, 14(2):122–152, 2005. deterministic, since the randomized advice can provide his [11] A. Nayak. Optimal lower bounds for quantum automata and coins.) Also, let be the distribution from which r is random access codes. In Proc. IEEE FOCS, pages 369–377, drawn. Then for allDx L, there exists a z such that 1999. quant-ph/9904093. ∈ [12] I. Newman. Private vs. common random bits in communi- 2 cation complexity. Inform. Proc. Lett., 39:67–71, 1991. Pr [ (x, r, z) accepts] , r∈D A ≥ 3

10 whereas for all x / L and all z, R = r1,...,rp(n) be a p (n)-tuple of independent sam- ∈ ples from , for some p (n)=Θ(n + w (n)). Then there 1 D
Pr [ (x, r, z) accepts] . exists a boosted verifier ∗ such that for all x L, there r∈D A ≤ 3 exists a ϕ such that Q ∈ | i Let R = r1,...,rp(n) be a p (n)-tuple of independent 1 accepts samples from , for some p (n)=Θ(n + w (n)). Then Pr [ ∗ (x, R, ϕ ) ] 1 n 3w(n) ,
R∈Dp(n) Q | i ≥ − 2 2 there exists a boostedD verifier such that for all x L, A∗ ∈ there exists a z such that whereas for all x / L and all ϕ , ∈ | i 1 1 Pr [ ∗ (x,R,z) accepts] 1 , accepts p(n) n w(n) Pr [ ∗ (x, R, ϕ ) ] n w n . R∈D A ≥ − 2 2 R∈Dp(n) Q | i ≤ 2 23 ( ) whereas for all x / L and all z, So by a simple counting argument, there exists a fixed ad- ∈ vice string R such that for all x L, there exists a ϕ such 1 1 ∈ | i accepts that Arthur accepts with probability at least 1 2−3w(n). Pr [ ∗ (x,R,z) ] n w(n) . R∈Dp(n) A ≤ 2 2 However, we still need to handle the case x / L−. Since the number of states ϕ ⊗w(n) with small∈ pairwise inner So by a simple counting argument, there exists a fixed ad- | i ∈ H2 vice string R such that for all x L, there exists a z such product is doubly exponential, a na¨ıve counting argument that Arthur accepts; whereas for all∈ x / L and all z, Arthur no longer works. Instead, observe that there exists a fixed ∈ advice string R such that for all x / L and all computa- rejects. 0 ∈ tional basis states z with z 0, 1 w(n), Indeed, using the same techniques we can show that | i ∈{ } 1 QCMA/rlog = QCMA/qlog = QCMA/poly = QCMA/rpoly. Pr [ (x, R , z ) accepts] 2n2w(n) Q∗ 0 | i ≤ · 2n23w(n) 1 Next we want to show a somewhat harder result, that = . QMA/rpoly = QMA/poly. To do so we will need the 22w(n) following theorem of Marriott and Watrous. Now suppose by contradiction that there exists a ϕ such that | i Theorem 18 (Marriott and Watrous [10]) The error 1 Pr [ (x, R , ϕ ) accepts] > . probability in any QMA protocol can be made exponen- Q∗ 0 | i 3 tially small without increasing the size of Merlin’s quantum Then witness. 1 1 Pr [ (x, R , I) accepts] > , We can nowprovethe analogueof Theorem17 for QMA. Q∗ 0 3 · 2w(n)

QMA rpoly QMA poly where Theorem 19 / = / . 1 I = z z 2w(n) | i h | Proof. Given a language L QMA/rpoly, let be the w(n) z∈{0X,1} distribution from which Arthur’s∈ advice is drawn,D and let (x, r, ϕ ) be Arthur’s verification algorithm run on input is the maximally mixed state on w (n) qubits. But this Q | i ⊗w(n) implies that there exists a basis state z such that x, advice string r, and witness ϕ . Then forall | i | i ∈ H2 x L, there exists a ϕ such that 1 1 ∈ | i Pr [ (x, R , z ) accepts] > , ∗ 0 3 w(n) 2 Q | i · 2 Pr [ (x, r, ϕ ) accepts] , r∈D Q | i ≥ 3 which yields the desired contradiction. Finally, by a union bound, there exists a fixed advice string R that combines the whereas for all x / L and all ϕ , ∈ | i properties of R0 and R1. 1 Pr [ (x, r, ϕ ) accepts] . 7.1. Upper-Bounding QCMA/qpoly r∈D Q | i ≤ 3 Here the probability is taken over ’s internal randomness We now show that QCMA/qpoly PP/poly. Concep- Q as well as r. tually, the proof is similar to the proof⊆ that QMA/qpoly By Theorem 18, we can make the error probability ex- PSPACE/poly, but with three differences. First, since the⊆ ponentially small without increasing the size of ψ . So let witnesses are now classical, they can be provided to the | i

11 simulating machine as part of the advice. Second, since different advice register each time. This yields J copies of the witnesses are provided, there is no longer any need to ρT . We then replace ∗ (x, ρT ,z) by the doubly-amplified 0 ⊗J Q try exponentially many random witnesses. Indeed, this verifier ∗ x, ρT ,z , which runs ∗ (x, ρT ,z) once for is what improves the upper bound from PSPACE/poly to each of theQ J advice registers, and returnsQ the majority out- 0
0 ⊗J PP/poly. And third, we can no longer exploit the fact that come. Let λz be the probability that ∗ x, ρT ,z ac- BQPSPACE/qpoly = PSPACE/poly, in order to split the cepts. Then by a Chernoff bound, andQ assuming the con-
proof neatly into a “de-Merlinization” part (which is new) stant in J = O (w) is sufficiently large, we have reduced and an “advice” part (which follows from earlier work of the problem to deciding whether Aaronson [1]). Instead, we need to generalize the machin- w ery from [1] to the QCMA setting. (1) there exists a z 0, 1 such that λ0 1 2−2w, or ∈{ } z ≥ − 0 −2w Theorem 20 QCMA/qpoly PP/poly. (2) λz 2 for all z. ⊆ ≤ Proof. Let L be a language in QCMA/qpoly, and let Now let 1 L (x)=1 if x L and L (x)=0 otherwise. Also, let S := λ0 . ∈ 2w z be a verifier for L, which takes a a-qubit quantum advice w z∈{X0,1} stateQ ψ and w-bit classical witness z for some polynomi- | i Then S 2−w−1 in case (1), whereas S 2−2w in case als a and w (for convenience, we omit the dependence on ≥ ≤ n). Then the first step is to replace by an amplified veri- (2). So it suffices to give a PP/poly machine with α + βS Q ⊗` accepting paths, for some positive constants α and β. Our fier , which takes an A-qubit advice state Ψ := ψ , Q∗ | i | i machine will simply do the following: where A = a` and ` = O (log a). As a result, ∗ has completeness and soundness errors 1/A4. Q Choose z uniformly at random. Let (x,ρ,z) be shorthand for run with input x, • Q∗ Q∗ advice ρ, and witness z. Then given x, our goal is to sim- Simulate a PostBQP computation that accepts with ulate , where is an optimal witness • 0 ∗ (x, Ψ ,z (x)) z (x) probability proportional to λz. for x.Q We will| i do so using a PP/poly machine . The M classical advice to will consist of a “Darwinian training The reason this works is that the probability of the T M set” (x1,z1) ,..., (xT ,zT ) for T = O (A), together with postselection steps in the ‘for’ loop all succeeding is inde- n L (xt) for every t 1,...,T . Here each xt 0, 1 pendent of z. ∈ { }w ∈ { } is an input and each zt 0, 1 is its corresponding wit- It remains only to show ’s correctness. Let p be ∈ { } t ness. Given this advice, runs the following procedure the probability that the firstMt postselection steps in the M to compute L (x). ‘for’ loop all succeed. We choose the “training inputs” x1,...,xT and witnesses z1,...,zT in such a way that let ρ := IA be the maximally mixed state on A qubits 2 for t := 1 to T (a) pt pt for all t 0,...,T 1 . +1 ≤ 3 ∈{ − } let b be a qubit initialized to 0 | i | i (b) zt is a valid witness for xt whenever xt L, meaning run ∗ (xt,ρ,zt), and CNOT the output into b ∈ Q−1 | i that ∗ (xt, Ψ ,zt) accepts with probability at least run (xt,ρ,zt) to uncompute garbage Q∗ 1 1Q/A4. | i measure b , and postselect on observing b = L (xt) | i − next t (c) There is no larger training set that satisfies (a) and (b). for all z 0, 1 w, ∈{ } let λz be the probability that (x,ρ,z) accepts Q∗ Then it suffices to prove the following two claims: if there exists a z such that λz 2/3, then accept ≥ otherwise, if λz 1/3 for all z, then reject (i) T = O (A) for all training sets that satisfy (a) and (b). ≤ Let us first see why can be simulated in PP/poly. (ii) correctly decides every input x, if we train it on M M The ‘for’ loop is just a postselected quantum computation, some (x1,z1) ,..., (xT ,zT ) that satisfies (a), (b), and and can clearly be simulated by the result of Aaronson [2] (c). that PostBQP = PP. The one nontrivial step is to decide For Claim (i), notice that we can write the maximally whether there exists a z such that λz 2/3, or whether ≥ mixed state I as a mixture of 2A orthonormal vectors λz 1/3 for all z. We do this as follows. Let ρt be ≤ the state of the advice register after the first t postselection 2A steps, conditioned on those steps succeeding. We first am- 1 I = Ψi Ψi , plify by repeating the ‘for’ loop times, using a 2A | i h | J = O (w) i=1 X 12 where Ψ1 := Ψ is the “true” advice state. We ar- gue that| thei Ψ | Ψi component must survive all T post- | 1i h 1| selection steps with high probability. For if xt / L, ∈ 4 then (xt, Ψ ,zt) accepts with probability at most 1/A , Q∗ | i while if xt L, then ∗ (xt, Ψ ,zt) rejects with probabil- ity at most∈1/A4 byQ assumption| i (b). So by Lemma 13, the probability of outputting the wrong answer on any of (x1,z1) ,..., (xT ,zT ), using Ψ as the advice, is at most T 1/A4 = T/A2. Hence | i

p 1 T pT 1 . ≥ 2A − A2   2 On the other hand, pt+1 3 pt for all t by assumption ≤ T (a), and hence pT (2/3) . Combining we obtain T = O (A). ≤ For Claim (ii), suppose by way of contradiction that rejects some x L. Then ∗ (x, ρT ,z) ac- Mcepts with probability∈ less than 2/3 forQ all z. But this implies that if we trained on the enlarged set M (x1,z1) ,..., (xT ,zT ) , (x, z) for any z, then we would get 2 pT +1 3 pT , thereby contradicting the maximality of T . Likewise,≤ suppose accepts some x / L. Then there ex- M ∈ ists a “false witness” z such that ∗ (x, ρT , z) accepts with probability greater than 1/3. SoQ if we trained on the M enlarged set (x1,z1) ,...,b (xT ,zT ) , (x, z), web would again 2 get pT pT , contradicting the maximality of T . +1 ≤ 3 b

13