A Simple Proof of Vyalyi's Theorem and Some Generalizations

Electronic Colloquium on Computational Complexity, Report No. 131 (2019)

A Simple Proof of Vyalyi’s Theorem and some Generalizations

Lieuwe Vinkhuijzen Andre´ Deutz Universiteit Leiden Universiteit Leiden Email: l [email protected].nl Email: [email protected]

Abstract—In quantum computational complexity the- Vyalyi’s proof of Theorem 1 introduces a new ory, the class QMA models the set of problems effi- complexity class called A0 PP and uses Gap func- ciently verifiable by a quantum computer the same tions to show that QMA ⊆ A0 PP ⊆ PP; then way that NP models this for classical computation. it uses Gap functions and a strong version of Vyalyi proved that if QMA = PP then PH ⊆ QMA. Toda’s Theorem to show that if A0 PP = PP then In this note, we give a simple, self-contained proof PH ⊆ PP. Specifically, it uses the version of #P[1] of the theorem, using only the closure properties Toda’s Theorem which states that PH ⊆ P : of the complexity classes in the theorem statement. all languages in the polynomial hierarchy can be We then extend the theorem in two directions: solved with only one query to a counting oracle. (i) we strengthen the consequent, proving that if PP Our new proof is, in our view, simpler. It has QMA = PP then QMA = PH , and (ii) we weaken three ingredients: (i) the usual version of Toda’s the hypothesis, proving that if QMA = CO-QMA Theorem [4] (namely PH ⊆ PPP), (ii) that PP is then PH ⊆ QMA. Lastly, we show that all the closed under complement [3] and (iii) that QMA∩ above results hold, without loss of generality, for the CO-QMA is closed under Turing reductions. The class QAM instead of QMA. We also formulate a third ingredient is, to the best of our knowledge, “Quantum Toda’s Conjecture”. new. 1. Introduction We anticipate the objection that our proof still uses Toda’s Theorem and that therefore the com- A major open question in quantum computa- plexity of the original proof is not eliminated, tional complexity theory is to find the relationships but merely outsourced. Our response is to give between quantum complexity classes and classical a second, wholly self-contained elementary proof, ones. In particular, we do not know how QMA whose ideas we immediately use to improve The- relates to the polynomial hierarchy or to PP. For orem 1 in two ways. First, we strengthen the the first problem, no containment is known in consequent, as follows: either direction. While it is known that QMA is PP contained in PP, it is open whether the inclusion is Theorem 2. If QMA = PP then QMA = PH . strict. Progress in this direction was made in 2003 when Vyalyi showed that the two questions are in That is, the hypothesis implies that the poly- fact related: nomial hierarchy collapses relative to a counting oracle. Second, we weaken the hypothesis of Theorem 1 (Vyalyi [1]). If QMA = PP then Vyalyi’s Theorem from QMA = PP to merely PH ⊆ PP. QMA = CO-QMA: For the proof, see page 6. Vyalyi took this as evidence that QMA 6= PP because otherwise Theorem 3. If QMA = CO-QMA then PH ⊆ PH ⊆ QMA, which seems unlikely. PP.

ISSN 1433-8092 A Simple Proof of Vyalyi’s Theorem and some Generalizations

2. Preliminaries The class PP, or Probabilistic Polynomial time, was defined by Gill [3], who showed that PP is We assume that the reader is familiar with the closed under complement. Toda’s Theorem states basics of Computational Complexity, in particular that PH ⊆ PPP [4]. the polynomial hierarchy (see Arora and Barak [5]) and with quantum computing (see Nielsen and Chuang [6] or Kitaev, Shin and Vyalyi [7]). 3. Closure properties of QMA We work with languages over the binary alphabet {0, 1}. In this section, we show that the class QMA ∩ A Turing reduction from a language L to a CO-QMA is closed under polynomial-time Turing language K is an algorithm with oracle access to reductions. That is, K which solves L. If L Turing-reduces to K, we ∩CO Theorem 4.QMA ∩ CO-QMA = PQMA -QMA write L ≤T K. If the reduction algorithm runs in polynomial time, we say that there is a polynomial- For the proof, see page 4. The ideas in the time deterministic Turing reduction from L to K proof are best illustrated by recalling two other p K and write L ≤T K or L ∈ P . A class C is closed theorems: (i) the class NP∩CO-NP is closed under under polynomial-time Turing reductions, written Turing reductions (Theorem 5), and (ii) the class C p C = P , if L ≤T K implies L ∈ C for every QMA is closed under intersection (Theorem 7). To language K ∈ C and L ⊆ {0, 1}∗. A class is closed streamline the proof of Theorem 7, we introduce under complement, i.e. C = CO−C, if L ∈ C ⇐⇒ the Entanglement Independence Lemma, (Lemma L ∈ C for all L ∈ C, where L = {0, 1}∗ \ L. 6). ∩CO The class QMA was defined by Kitaev et al. The result NP ∩ CO-NP = PNP -NP is clas- [7] (they called it BQNP): sic, and the idea of the Entanglement Independence Definition 1 (The class QMA: Quantum Mer- Lemma is simply the technique Kitaev et al. used lin-Arthur games). A language L ⊆ {0, 1}∗ is in for error amplification when they defined QMA QMA if there are polynomials m(n), w(n) and [7]. a polynomial-time constructible family of quantum Theorem 5.NP ∩ CONP is closed under circuits {Ux}x∈{0,1}∗ receiving an m(n)-qubit in- polynomial-time deterministic Turing reductions: ∩CO put and using w(n) qubits of workspace, possess- PNP NP = NP ∩ CONP. ing completeness and soundness: • Completeness: If x ∈ L then the circuit Proof. The trivial direction is NP ∩ CO-NP ⊆ NP∩CO-NP Ux accepts some input state |ψi with P , so we will only show the other direc- m(n) NP∩CO-NP probability at least 1 − 2−n tion, P ⊆ NP ∩ CO-NP. To this end, it is sufficient to show that PNP∩CO-NP ⊆ NP because • Soundness: If x 6∈ L then the circuit Ux rejects all input states with probability at P is closed under complement. NP∩CO-NP least 1 − 2−n Let K ∈ P be a language decided by the polynomial-time (say O(t(n))-time) Turing The circuit family is called a protocol for L. Machine M L, with access to an oracle language The class QMA is often studied as a set of L ∈ NP ∩ CO-NP. Because L ∈ NP ∩ CO-NP, promise problems (which are pairs (Lyes,Lno), there are non-deterministic Turing Machines Y and where the algorithm is allowed to behave arbitrar- N recognizing the languages L and L, respectively, 0 ily on inputs outside of Lyes∪Lno), because in that both running in time O(t (n)). If we manage to context it allows for complete problems, notably simulate M L with a non-deterministic machine, the Local Hamiltonian Problem [7]. For us it will we will have proved the theorem. be more natural to consider QMA simply as a set Clearly if we manage to obtain the answers to of languages, because in this context the operation all the queries M L makes, then we can faithfully of using a language as an oracle is cleaner, but simulate M L. The central insight is that we can we stress that this decision is without loss of obtain the answers by guessing and then verifying generality. them. Therefore the algorithm will be as follows.

2 A Simple Proof of Vyalyi’s Theorem and some Generalizations

Before we compute anything, (i) we non- |ψi deterministically guess that the queries that M L is m U going to make are the strings s1, . . . , st(n), (ii) we |0i guess the answers a1, . . . , at(n) to all the queries w that M L makes, and lastly (iii) we guess certificate strings y1, . . . , yt(n) and z1, . . . , zt(n) for the |φim 1 machines Y and N, respectively. The remainder V of the computation is deterministic. The algorithm |0i checks that its guesses were correct: for each i, it w checks that Y (s , y ) = a and N(s , z ) = ¬a i i i i i i Figure 1. The circuits U and V receive inputs that may be (meaning that, for example, if a2 = 1 then Y entangled. accepts the certificate y2 we guessed for s2 and N rejects z2). If any of these checks fail, we have evidently guessed incorrectly, and we reject on this Lemma 6 (Entanglement Independence Lemma). computation path. Let U, V be two quantum circuits as in Figure 1, Lastly, we simulate M L. When it makes the i- both receiving an m-qubit input and a w-qubit ? workspace, with measurement operators ΠU , ΠV . th query, we check that it queries si ∈ L; if so, we Suppose that U and V accept with probability at feed it the answer ai and continue the simulation, most a and b, respectively, regardless of their m- but if not, we immediately reject, because we qubit input. Then the probability that both U and have incorrectly guessed which strings M L would L V accept when they are implemented jointly, and query. When M halts and accepts, we accept; when their inputs may be entangled, is at most a·b. otherwise we reject. L If M accepts, then our machine accepts. The Proof. The proof uses a trick by Marriot and Wa- accepting paths are exactly those that correctly L trous [8]. They are able to express the probability guessed which strings M was going to query, that a circuit accepts an m-qubit input in terms what the answers were, and what certificates would m m L of the eigenvalues of a 2 × 2 matrix, as in satisfy Y and N. If M rejects, then our machine Equation 1. Equation 1 follows from the equality rejects too, because even the paths that obtained (I⊗m ⊗ |0i) · |ψi = |ψi ⊗ |0i. correct answers for the oracle queries still reject m m when M L halts and rejects. P [U accepts |ψi] (1) † = hψ| h0| U ΠU U |ψi |0i ⊗m † ⊗m The next lemma, the Entanglement Indepen- = hψ| · (I ⊗ h0|) · U ΠU U · (I ⊗ |0i) |ψi dence Lemma, says that if two QMA protocols possess soundness individually, then soundness is Let preserved when they are combined in a single U˜ =(I⊗m ⊗ h0|) · U †Π U · (I⊗m ⊗ |0i) circuit and their inputs are entangled, as long as U ˜ ⊗m † ⊗m they are implemented and measured independently, V =(I ⊗ h0|) · V ΠV V · (I ⊗ |0i) as in Figure 1. This is not obvious a priori, because Clearly these operators are Hermitian, so their oftentimes quantum circuits behave in surprising eigenvalues are real, so their “largest” eigenvalue ways when clever use is made of entanglement. is well-defined. The result of the Lemma, then, is that in this Using Equation 1, we can express the probabil- case, no such clever use is possible for Merlin: ity that U and V both accept an m+m-qubit quan- entangling the two certificates for the two circuits P ˜ ˜ tum state |φi = i yi |aii |bii as hφ| (U ⊗ V ) |φi. gives him no advantage. This probability is maximized at the largest eigenvalue of U˜ ⊗ V˜ . But the eigenvalues of U˜ ⊗ V˜ are exactly the products of the eigenvalues of U˜ and 1. All these strings are polynomially-bounded: The strings si ˜ are not longer than t(n) bits, because M L runs in time t(n) V . More precisely, for every pair of eigenvalues 0 bits. The certificates yi, zi are not longer than t (t(n)) bits. λ, µ of U and V , λ · µ is an eigenvalue of U˜ ⊗ V˜ .

3 A Simple Proof of Vyalyi’s Theorem and some Generalizations

By assumption, the largest eigenvalues of U |ψLip and V are at most a and b, so the largest eigenvalue U of U˜ ⊗ V˜ is at most a · b. |0iw • The approach of Marriot and Watrous has the |ψ i advantage that the qubits of the workspace are K q V encapsulated by the operator U˜, which allows us |0i • to express acceptance of U, and in turn express w perfect play by Merlin, in terms of the eigenvalues of U˜: |0i1

Figure 2. A circuit which receives two certificates |ψLip and |ψ i P [U accepts | Perfect play by Merlin] K q, possibly entangled, and executes the protocols for languages L and K on them. = max hψ| U˜ |ψi |ψi 9 /10. Therefore both circuits accept with probabil- 2 This quantity is maximized at an eigenvalue ity at least 9/ ≥ 2/ , which suffices to show ˜ 10 3 of U, and the message that Merlin will send to that the protocol has completeness. maximize Arthur’s probability of acceptance is a Part 2: Soundness. Suppose that x 6∈ L ∩ K, corresponding eigenvector. The significance is that e.g. because x 6∈ L. Then Merlin may send us any one of the maximizing eigenvectors is an untangled arbitrary, possibly highly entangled state. If U is state. This gives us exactly what we wanted: while implemented alone, then it accepts any certificate Merlin has the ability to entangle his certificates, 1 with probability at most /3. Here, we provide U he gains no advantage from doing so compared to with a well-initialised workspace of |0iw, so by the sending unentangled certificates. Entanglement Independence Lemma, U will also 1 Next, we use the Entanglement Independence accept with low probability, at most /3, regardless Lemma to show that QMA is closed under inter- of how Merlin entangles its input register with the section. rest of the certificate. Therefore the probability that 1 Theorem 7. If L, K ∈ QMA then L∩K ∈ QMA. the circuit as a whole accepts is also ≤ /3, so That is, QMA is closed under intersection. the protocol has soundness. By a similar argument, QMA is closed under Proof. Let L ∈ QMA and K ∈ QMA. For union. Lastly, we need the union bound in the ∗ a particular input string x ∈ {0, 1} , we now following form. design a simple QMA protocol for membership in L ∩ K. Let U and V be amplified circuits of Lemma 8 (Union Bound). If t(n) ∈ Ω(1) is a the QMA protocols for the languages L and K, polynomial then respectively. We ask Merlin for two certificates lim (1 − 2−n)t(n) = 1 n→∞ |ψLip and |ψK iq, feed them to the circuits and measure the outcomes, like in Figure 2. We accept iff both circuits accept. The difficulty is that Merlin can entangle the two certificates, but we will show We are now ready to prove Theorem 4. that he gains no advantage from doing so. Proof of Theorem 4. It suffices to give a QMA Part 1: Completeness. Suppose that x ∈ L ∩ protocol for a language in PQMA∩CO-QMA, because K. Then Merlin can be honest and send us the state P is closed under complement. So let M L be a |ψLip ⊗ |ψK iq. These are two unentangled certifi- polynomial-time (say t(n)-time) Turing Machine cates for membership of L and K, so the two sub- with oracle access to a language L ∈ QMA ∩ circuits U and V can be analyzed independently: U CO-QMA and let {Ys}s∈{0,1}∗ and {Ns}s∈{0,1}∗ 2 9 will accept with probability |ΠU U |ψLi| ≥ /10 be the circuit families corresponding to the QMA 2 and V will accept with probability |ΠV V |ψK i| ≥ protocols for L and L, respectively.

4 A Simple Proof of Vyalyi’s Theorem and some Generalizations

In the proof of Theorem 5, we fed M L truthful all queries, of which there are at most t(n). The answers to all its oracle queries. Here we will settle probability that all oracle queries proceed this way for something which suffices for our purposes: is at least either (i) if x ∈ L, then with very high probability we will give M L truthful answers to its queries, (1 − 2−n)2t(n) (2) or else (ii) if x 6∈ L, with very high probability we will detect any attempt of Merlin to fool us, Because t(n) is a polynomial, this quantity tends and reject. To this end, we assume that the circuits to 1 for large n, by Lemma 8, meaning that with Ys and Ns are amplified such that if s ∈ L, then probability tending to 1, we obtain correct answers there is a state that Ys accepts with probability for all queries. After that, simulating M L is a −n ≥ 1−2 , whereas if s 6∈ L, then Ys rejects every deterministic computation and we copy its answer, state with probability ≥ 1 − 2−n. so we output the correct answer with probability In this protocol, we expect that Merlin’s mes- tending to 1. L sage contains (i) the (classical) strings s1, . . . , st(n) Part 2: Soundness. Suppose that M rejects. L that M queries, (ii) their answers a1, . . . , at(n) Then Merlin will send us a possibly very compli- and (iii) quantum states |ψ1i ,..., |ψt(n)i and cated entangled state. We start by measuring all |φ1i ,..., |φt(n)i which will serve as the certifi- the registers which we expect to be classical in cates to Y and N. This is the same strategy as the computational basis, so that these registers are pursued in the proof of Theorem 5, except now now truly classical bits and are not entangled with the certificates are quantum states. The certificates the rest of the certificate. The certificates to the are the only parts of Merlin’s message that need to queries remain quantum. The fact that the various be quantum, because parts (i) and (ii) are simply certificates may be entangled with one another classical bit strings. presents the principal hurdle in this proof, which Before we simulate M L, we measure all the we overcome by the Entanglement Independence qubits which we expect to be classical bits (the Lemma. answers and the query strings) in the computational Suppose that in our simulation we feed M L basis. Then we compute, for each i, whether Ysi only correct answers. Then we will certainly reject. accepts |ψii and whether Nsi accepts |φii. We So in order to make us accept, Merlin must make reject if Ysi does not output ai or Nsi does not us compute the wrong answer for at least one output ¬ai, just as before. Lastly, we simulate query, which happens when s ∈ L but Ys rejects L L M just as in Theorem 5, rejecting if M queries and Ns accepts. But according to the Entanglement a string we did not anticipate or if M L rejects. Independence Lemma, and because the protocol Otherwise, we accept. Ns possesses soundness, the probability that Ns The only part where we use quantum com- accepts any certificate state, no matter how the puting is in the evaluation of the certificates, and state is entangled with other parts of the circuit that −n we have to argue that this does not influence the Ns does not touch, is at most 2 . (Our assymetric soundness of the protocol. focus here on the protocol Ns instead of Ys is L Part 1: Completeness. Suppose that M ac- because it is easy enough for Merlin to make Ys cepts. Then Merlin can be honest and simply send reject by sending a bad certificate. In the classical us good, unentangled certificates for the algorithms case he might send a non-satisfying assignment to Ys and Ns. In particular, for any query s, if the Satisfiability problem, for example). s ∈ L, then Ys will accept the good certificate Above we have described the “good event” that −n |ψii with probability at least 1 − 2 and Ns will the circuit Ns rejects a single bad certificate. For reject its certificate |φii with at least the same our simulation to succeed, each query must be a probability. Because these circuits are implemented “good event”, that is, it must happen t(n) times. independently of one another and the state |ψii By Lemma 8, this probability tends to 1. is not entangled with |φii, these two events are independent, so the probability that both happen The following corollary is immediate. is at least (1 − 2−n)2. This needs to happen for

5 A Simple Proof of Vyalyi’s Theorem and some Generalizations

Theorem 9.QMA is closed under complement if is, it is a PQMA∩CO-QMA computation. By Theorem and only if it is closed under Turing reductions. In 4, this can be simulated in QMA. symbols: CO QMA Theorem 11. If QMA = -QMA then QMA = CO-QMA ⇐⇒ QMA = P (3) QMA = PHQMA.

Proof. Suppose that QMA = CO-QMA. Then QMA QMA∩CO-QMA Proof. The non-trivial direction is PH ⊆ QMA = QMA ∩ CO-QMA = P = QMA QMA. The proof is by induction. For the base P by Theorem 4. In the other direction, if QMA QMA P QMA = P , then it is closed under comple- case, we prove that Σ1 = QMA, using The- ment, because P is closed under complement. orem 10: QMA ΣP =NPQMA 4. A simple proof 1 =NPQMA∩CO-QMA ⊆ QMA If = then Theorem 1 (Vyalyi [1]). QMA PP The last inclusion is Theorem 10. The induction PH ⊆ PP. PQMA step assumes that Σi = QMA and derives P QMA Proof. Suppose that QMA = PP. Since PP is Σi+1 = QMA: closed under complement [3], now QMA is also closed under complement, so by Theorem 9 it is PQMA Σi =QMA Induction hypothesis closed under Turing reductions. By assumption, QMA P QMA P Σi then, PP is closed under Turing reductions, i.e. Σi+1 =NP By deﬁnition PP = PPP. Toda’s Theorem completes the proof: =NPQMA Induction hypothesis PP P ⊇ PH. ∩CO =NPQMA -QMA QMA = CO-QMA 5. Stronger statements by assumption ⊆QMA Theorem 10

In this section, we improve Vyalyi’s Theorem QMA in two directions. First we strengthen the conse- We have shown that PH ⊆ QMA, i.e. relative quent from PH ⊆ PP to PP = PHPP (Theorem to a QMA oracle, every level of the polynomial 2), and second, we weaken the hypothesis from hierarchy is contained in the unrelativized version of QMA. For the opposite inclusion, we note that QMA = PP to merely QMA = CO-QMA (The- QMA QMA orem 3). Both proofs build on one more ingredient: QMA ⊆ P ⊆ PH is unconditional. Theorem 10.NP QMA∩CO-QMA ⊆ QMA. All goals set out in the introduction are immediate corollaries of Theorem 11, using the facts Proof. We ask Merlin for (i) a certificate for the that PP is closed under complement [3] and that NP machine that we are simulating and (ii) for QMA ⊆ PP (see [1]). 2 the queries and their answers similar to how we asked them in Theorem 4. The first thing the QMA Theorem 2. If QMA = PP then QMA = PHPP. machine does is measure the certificate in the computational basis. Merlin is supposed to send a Proof. If QMA = PP, then QMA = CO-QMA classical string, so if he is honest, nothing happens. since PP is closed under complement [3]. So by If he is dishonest, then the certificate collapses to Theorem 11, QMA = PHQMA = PHPP. some classical string, and the NP machine will reject this if it receives correct answers to its Theorem 3. If QMA = CO-QMA then PH ⊆ queries. PP. After measuring the certificate Merlin gave for NP 2. We cite [1] for the result QMA ⊆ PP, because it is the the machine, the remaining computation is earliest published proof known to the authors. However, it is a simulation of a deterministic Turing Machine mentioned earlier, in the text that defines QMA [7], where it which makes queries to QMA ∩ CO-QMA, that is left as an excercise to the reader.

6 A Simple Proof of Vyalyi’s Theorem and some Generalizations

Proof. If QMA = CO-QMA then by Theorem Soundness: If x 6∈ L then for every collection QMA 11, PH ⊆ PH = QMA. The Theorem fol- of quanum states {|ψyi}y∈{0,1}∗ , lows from the inclusion QMA ⊆ PP [1]. 1 X Pr [U accepts |ψ i |yi] ≤ 2−n Note that we have fulfilled our promise of 2s(n) x y giving a self-contained proof of Vyalyi’s Theorem y∈{0,1}s(n) that does not depend on Toda’s Theorem, as each Marriot and Watrous showed that the complete- of Theorem 2 and 3 implies Vyalyi’s Theorem. 2−n We feel that these proofs go some way towards ness and soundness parameter may be re- 2−r(n) illustrating why Vyalyi’s Theorem is true, namely: placed by a constant or by for a polynomial r(n) for the same reason as in the classical case, if we , without loss of generality. rephrase the classical case as follows. In this Section, we follow the same setup as above. We will establish that AM ∩ CO-AM and Theorem 12. If NP = CO-NP then PH ⊆ NP. QAM ∩ CO-QAM are closed under Turing re- QAM∩CO-QAM The idea, of course, is that if the unsatisfiability ductions, and then that NP ⊆ QAM of a SAT formula always has a short certificate, (Theorem 16). Using these results, the two new P versions of Vyalyi’s Theorem will be easy to ob- then that enables one to check Σ2 predicates and, by induction, the whole polynomial hierarchy. In tain. All Theorems are analogues of their QMA our quantum case, quantum unsatisfiability has a counterpart, and the proofs are set up so as to short quantum certificate, but the idea is the same. deviate minimally from the corresponding proof above. For the sake of exposition, the theorems are 6. Generalization to AM and QAM first proven in the classical setting, for the class AM, after which the theorem is reproven in the The techniques developed to give the simple quantum setting. ∩CO proof of Vyalyi’s Theorem also apply to the classes Theorem 13.P AM -AM = AM ∩ CO-AM. AM and QAM. In particular, we reprove all the theorems with QAM in lieu of QMA. The fol- Proof. Let K a language decided by deterministic lowing definition of QAM is due to Marriot and O(t(n))-time oracle Turing Machine with oracle Watrous [8]. The class captures languages solvable access to a language L ∈ AM ∩ COAM. If we by a two-round public-coin interactive proof in find an AM protocol to simulate M L, we will have which Arthur sends a classical message to Merlin, proved the theorem. who responds with a quantum state, which Arthur Since L ∈ AM ∩ COAM, there are determin- may use in a quantum computation. istic Turing Machines Y and N which execute the AM protocols for L and L, respectively, using Definition 2 QAM . A language L ⊆ (The class ) r(n) random bits, running in time t(n) and erring {0, 1}∗ is in QAM if there are polynomials with probability ≤ 2−n. m(n), s(n) and a polynomial-time uniform family Again, of course, if we obtain the answers to {U } ∗ of quantum circuits acting on three x x∈{0,1} all the queries M L makes, then we can simulate collections on qubits: Arthur’s workspace qubits, M L. We obtain those answers by running the m(n) qubits sent by Merlin and s(n) classical machines Y and N, just as in the proof of Theorem bits, corresponding to a sequence of coin-flips sent 5, with two differences: (i) the protocol starts by Arthur to Merlin, on which Merlin’s message with Arthur generating some appropriate number may depend. The family must satisfy the follow- of random bits and communicating those to Merlin, ing completeness and soundness conditions for all and (ii) the protocol may err with some small x ∈ {0, 1}∗: probability conditioned on those random bits. Completeness: If x ∈ L then there is a collec- The protocols starts with Arthur flipping 2t(n)· tion of quantum states {|ψ i} s such that y y∈{0,1} r(t(n)) coins and sending the result to Merlin. 1 X This number, 2t(n) · r(t(n)), is an upper bound Pr [U accepts |ψ i |yi] ≥ 1 − 2−n 2s(n) x y on the number of random coins all the upcoming y∈{0,1}s(n) protocols need, as M L makes at most t(n) queries,

7 A Simple Proof of Vyalyi’s Theorem and some Generalizations

each at most t(n) bits long. Then Y and N will case there are two uniformly generated quantum use r(t(n)) random bits each to answer a query circuit families {Ys} and {Ns} which answer L of length t(n). We expect Merlin to send us (i) and L, respectively. We exchange random bits L the strings q1, . . . , qt(n) that M will query given and certificates the same way we did in The- the random coins we just guessed, (ii) the answers orem 13. We expect Merlin to send us (i) the L a1, . . . , at(n) to those queries and (iii) (classical) strings that M is going to query, (ii) the an- certificates y1, . . . , yt(n) and z1, . . . , zt(n) for the swers to those queries and (iii) quantum certificates machines Y and N, respectively. |ψi = |ψ1i |φ1i⊗· · ·⊗|ψt(n)i |φt(n)i for the these The first step for Arthur is to check whether quantum circuits. As in the proof of Theorem 4, the certificates are good. For each i, he checks that we measure the bits that we expect to be classical Y (qi, si, yi) = ai and N(qi, si, zi) = ¬ai. Here si bits before we execute the QAM protocols. is the string of random coins Arthur flipped at the Part 1: Completeness. If M L accepts, then beginning to feed to the i-th query. If any of these Merlin will send us the correct answers and un- checks fail, he rejects. entangled quantum certificates, if they exist, but If all checks pass, then Arthur simulates M L as noted before, good certificates exist with over- as before: If the i-th query of M L is not the string whelming probability. However, even if we give L qi, he rejects; otherwise, he feeds M the answer Ys a good certificate, it may still err because it L ai and resumes the simulation. When M halts, is a quantum circuit. Fortunately, it is known that he copies its answer as his output. QAM protocols such as Ys can be amplified to err Part 1: Completeness. Suppose that M L ac- with ≤ 2−n error, so the previous completeness cepts. If good certificates to our queries exist (a argument goes through. good certificate is one that Y will accept if the Part 2: Soundness. By previous observations, answer is yes), then Merlin will send them and for Arthur to fail it is necessary that at least one Arthur will feed M L correct answers and accept. QAM protocol fails. In the classical case, the However, the probability that such certificates ex- soundness of the protocols Y and N was sufficient ist, i.e. the probability that the AM protocol for qi to reduce the probability that any query failed. The is successful, is at least 1 − 2−n, conditioned over difference in the quantum case is that Merlin can the random bits Arthur generates at the beginning. entangle the certificates. But if a quantum circuit The probability, then, that all AM protocols are Ys rejects all input states with probability ≥ p, successful, is ≥ (1 − 2−n)2t(n), which tends to then by the Entanglement Independence Lemma 1 with n → ∞ by Lemma 8 because 2t(n) is a (Lemma 6) it rejects all states regardless of how polynomial. they are entangled with other qubits that the circuit Part 2: Soundness. Suppose that M L rejects. does not touch, with probability ≥ p. In our case, If we feed M L correct answers to its queries, we p ≥ (1 − 2−n), so we have soundness by the same reject too. We only feed M L incorrect answers if argument as in Theorem 13. one of the AM protocols failed. Each AM protocol AM∩CO-AM fails with probability ≤ 2−n, and there are at most Theorem 15.NP ⊆ AM. 2t(n) of them, so with overwhelming probability, Proof. We will give an AM protocol for a lan- all of them succeed. guage A ∈ NPAM∩CO-AM accepted by nondeter- L We now show that QAM∩CO-QAM is closed ministic Turing Machine M . We generate enough under polynomial-time deterministic Turing reduc- random bits, and Merlin responds with certificates tions. to all the queries we are going to make, and with QAM∩CO-QAM the nondeterministic bits which allegedly make M Theorem 14.P = QAM ∩ accept. Since the nondeterministic bits are fixed, CO-QAM the remaining computation is simply a PAM∩CO-AM Proof. We give a QAM protocol for a language computation, which is covered in Theorem 13 K ∈ PQAM∩CO-QAM. Let M L be a determinis- The following Theorem is the QAM analogue tic Turing machine with oracle access to L ∈ of Theorem 10. QAM ∩ CO-QAM, which decides K. In this

8 A Simple Proof of Vyalyi’s Theorem and some Generalizations

Theorem 16.NP QAM∩CO-QAM ⊆ QAM To this end, it suffices to prove what we call a Quantum Toda’s Theorem, that QMA is low for Proof. Similar to the previous three theorems, PPP: a QAM simulation of a language in NPQAM∩CO-QAM starts with sending enough Conjecture 2 (Quantum Toda’s Conjecture). QMA random bits to Merlin and receiving a quantum PPP = PPP. That is, QMA is low for PPP. state allegedly representing a classical certificate for the nondeterministic machine and quantum We can see a number of reasons to care about certificates so we can simulate the oracle Conjectures 1 and 2. First, Conjecture 1 strength- queries. We measure these certificate bits in ens Vyalyi’s Theorem “to the maximum extent the computational basis, in addition to the possible”, in the sense that it is what happens qubits containing the queries and their alleged classically. Second, it would repair a conjecture answers. The nondeterministic input is fixed of Aaronson that if QMA ⊆ BQP/qpoly then now, so the remainder of the protocol simulates QMA = CH. This appeared as a “theorem” in a deterministic machine making queries to a [9], but he later found an error in the proof [10]. language in L ∈ QAM ∩ CO-QAM, which is Third, proving Conjecture 2 would establish a covered in Theorem 14. quantum version of Toda’s Theorem, namely: QMA The QAM analogues of the main theorems of QMA ∪ QMAQMA ∪ QMAQMA ∪ · · · ⊆ PPP this paper follow immediately from Theorem 16, Gharibian et al. recently gave a result in this spirit, using the techniques used in Section 5. proving Theorem 17. If QAM = CO-QAM then QAM Theorem 21 (“Quantum-classical Toda’s Theo- QAM = PH PP rem”, Gharibian et al. [11]).QCPH ⊆ PPP Proof. This follows from Theorem 16 by induc- Here QCPH, defined in [11], is like PH, tion. The proof is exactly the same as that of except that the verifier is a uniform family of QAM QMA 11, with in lieu of . We omit the quantum circuits instead of a deterministic Turing details. Machine. Proving a Quantum Toda’s Conjecture Theorem 18. If QAM = CO-QAM then PH ⊆ was much of the motivation for the work in this QAM. article. QAM Proof. Clearly PH ⊆ PH . By Theorem 17, 8. Acknowledgements if QAM = CO-QAM then PH ⊆ PHQAM = QAM. The first author would like to thank Scott Aaronson, Dorit Aharonov, Harry Buhrman, Theorem 19. If QAM = PP then PH ⊆ PP. Mikhail Vyalyi and in particular Ralph Bottesch 7. Discussion and future work for many fruitful discussions, and the second author for his supervision of the Master thesis during which the present work was done. The classical counterpart of Vyalyi’s Theorem, obtained by substituting MA for QMA, is the following consequence of Toda’s Theorem. References Theorem 20. If MA = PP then MA = CH. [1] Vyalyi, Mikhail N. ”QMA=PP implies that PP contains PH.” In ECCCTR: Electronic Colloquium on Computa- Here CH is the counting hierarchy. The con- tional Complexity, technical reports. 2003. sequent of this statement, MA = CH, is stronger [2] Beigel, Richard. ”Perceptrons, PP, and the polynomial than the consequent we have obtained, which was hierarchy.” Structure in Complexity Theory Conference, QMA = PHPP ⊆ CH. Can we get the same result 1992., Proceedings of the Seventh Annual. IEEE, 1992. in the quantum case? [3] Gill, John. ”Computational complexity of probabilistic Turing machines.” SIAM Journal on Computing 6.4 Conjecture 1. If QMA = PP then QMA = CH. (1977): 675-695.

9 A Simple Proof of Vyalyi’s Theorem and some Generalizations

[4] Toda, Seinosuke. ”PP is as hard as the polynomial-time hierarchy.” SIAM Journal on Computing 20.5 (1991): 865-877. [5] Arora, Sanjeev, and Boaz Barak. Computational complexity: a modern approach. Cambridge University Press, 2009. [6] Nielsen, Michael A., and Isaac Chuang. ”Quantum computation and quantum information.” (2002): 558-559. [7] Kitaev, Alexei Yu, Alexander Shen, and Mikhail N. Vya- lyi. Classical and quantum computation. Vol. 47. Provi- dence: American Mathematical Society, 2002. [8] Marriott, Chris, and John Watrous. ”Quantum Arthur–Merlin games.” Computational Complexity 14.2 (2005): 122-152. [9] Aaronson, Scott. ”Oracles are subtle but not malicious.” Computational Complexity, 2006. CCC 2006. Twenty- First Annual IEEE Conference on. IEEE, 2005. [10] Aaronson, Scott. ”Yet more error in papers.” Shtetl- Optimized, 24 May 2017. Retrieved 8 January 2018. https://www.scottaaronson.com/blog/?p=3256 [11] Gharibian, Sevag, et al. ”Quantum generalizations of the polynomial hierarchy with applications to QMA (2).” arXiv preprint arXiv:1805.11139 (2018).

ECCC ISSN 1433-8092

https://eccc.weizmann.ac.il