Short random circuits define good quantum error correcting codes

Winton Brown Omar Fawzi Departement´ de Physique Institute for Theoretical Physics Universite´ de Sherbrooke, Canada ETH Zuerich, Switzerland Email: [email protected] Email: [email protected]

Abstract—We study the encoding complexity for quantum codes that are as good as the codes defined by completely error correcting codes with large rate and distance. We prove random Clifford unitaries. that random Clifford circuits with O(n log2 n) gates can be used to encode k qubits in n qubits with a distance d provided k d d n < 1 − n log2 3 − h( n ). In addition, we prove that such circuits 3 typically have a depth of O(log n). A. Results I.INTRODUCTION We prove that random quantum circuits with O(n log2 n) Error-correcting codes are fundamental objects with many gates can be used to encode k qubits in n qubits with a distance theoretical and practical applications. In the context of d provided k < 1 − d log 3 − h( d ). This is asymptotically quantum information, quantum error correcting codes allow n n 2 n the same as the distance of a code defined by a random unitary the preservation of quantum data in the presence of noise; from the complete Clifford group, which is known to achieve see [12] for a reference. In addition to their application the quantum Gilbert-Varshamov bound [5], [12]. But a typical to reliable communication and computation, quantum error Clifford unitary is only known to be computable using a circuit correcting codes have found applications in cryptography such with Ω(n2) gates. as quantum key distribution [18] and secret sharing [7]. In this paper, a quantum error correcting code is a subspace of the We also study another complexity measure for circuits Hilbert space associated with an n-qubit space. Such a code which is the depth. The depth is simply the number of time has two important parameters: the number of qubits k that steps needed to evaluate the circuit, keeping in mind that gates can be encoded in this subspace and the distance d which acting on disjoint qubits can be executed simultaneously. By quantifies the number of errors that can be corrected by the parallelizing the random quantum circuit mentioned in the code. It is desirable to have both k and d as large as possible. previous paragraph, we prove the existence of codes achieving 3 Our objective here is to understand how efficient the the same parameters with an encoding of depth O(log n) and 2 encoders of good quantum error correcting codes can be. size O(n log n). We remark that it was proved in [15] that the This question has been studied for classical codes in several encoding and decoding operation of any stabilizer code can be computation models, see e.g., [1], [11]. In this paper, we work implemented with quantum circuits of depth O(log n) using 2 in the circuit model with a gate set composed of all two-qubit O(n ) qubits of ancilla, i.e., qubits in some fixed state that are gates. In this model it is simple to see that to obtain a linear restored to their original state at the end of the computation. distance, a linear number of gates are needed and the depth In contrast, random quantum circuits do not use any ancilla has to be at least Ω(log n). On the other hand, it is known qubits. that a large family of quantum error correcting codes known We say here a brief word on the proof. The first step of as stabilizer codes, which include many good codes, can have the proof is to relate the property of interest, which is the an encoder using only O(n2) gates [6]. distance of the code, to the second moment operator of the Specifically, the encoders we consider here are constructed random quantum circuit. This operator can then be studied by choosing a circuit at random with a given number of as a Markov chain and the distance of the code translates to arXiv:1312.7646v1 [quant-ph] 30 Dec 2013 gates. Random quantum circuits have been well studied in the a property of the Markov chain. The convergence times of quantum information literature. Random quantum circuits of such Markov chains arising from the second order moments polynomial size are meant to be efficient implementations that have been previously studied in [17], [13]. However, these inherit many useful properties of “uniformly” chosen unitary convergence times are not sufficient to prove the result we are transformations, which are typically very inefficient. Most of aiming for and can only give useful bounds when Ω(n2) gates the work has been in analyzing convergence properties of are applied. Instead, we analyze the Markov chain in a finer the random circuit model [10], [9], [17], [13], [4]. In some way without using the spectral gap and bound the probabilities sense, we are here also interested in the convergence properties of going from a state ` to state m within O(n log2 n) steps as because our aim is to show that short random circuits define a function of ` and m. II.PRELIMINARIES for some real numbers Cµ depending only on µ and not on x, y [2], [14]. Here, δ = 1 if x = y and zero otherwise. A A. Generalities xy code with minimum distance 2e + 1 can correct e errors. The state of a pure quantum system is represented by a We can describe a unitary transformation (and more unit vector in a Hilbert space. Quantum systems are denoted generally any superoperator) by describing how it acts on † n A, B, C . . . and are identified with their corresponding Hilbert the Pauli basis, i.e., Uσν U for all ν ∈ {0, 1, 2, 3} . spaces. The Hilbert spaces we consider here will be n-qubits This is especially convenient when talking about stabilizer spaces of the form (C2)⊗n. A density operator is a Hermitian codes for which the encoding operation U belongs to positive semidefinite operator with unit trace. The density the Clifford group. The Clifford group Cn is defined operator associated with a pure state is abbreviated by omitting as the set of unitary transformation U under which the the ket and bra ψ def= |ψihψ|. For an introduction to quantum Pauli basis remains invariant up to phases. More precisely  † n information, we refer the reader to [16], [19]. Cn = U : Uσν U ∈ ±{σµ, µ ∈ {0, 1, 2, 3} } . Note that Throughout the paper, we use the Pauli basis to decompose any unitary in Cn can be implemented using Hadamard gates, operators. The 2 × 2 Pauli operators can be represented as phase gates and CNOT gates. When the encoding unitary follows: U ∈ Cn, the minimum distance can be simply characterized as shown by the following proposition.  1 0   0 1  σ0 = σ1 = 0 1 1 0 Proposition II.1. A unitary U ∈ Cn defines a quantum error correcting code of distance at least d + 1 if and only if d is     k 0 −i 1 0 the largest integer such that for all νA ∈ {0, 1, 2, 3} − {0} σ2 = σ3 = . n−k n i 0 0 −1 and νB ∈ {0, 3} and all µ ∈ {0, 1, 2, 3} of weight 1 ≤ w(µ) ≤ d n For a string ν ∈ {0, 1, 2, 3} , we define σν = σν ⊗· · ·⊗σν . 1 n † The support supp(ν) of ν is simply the subset {i ∈ [n] : νi 6= tr[σµUσνA ⊗ σνB U ] = 0. (2) 0} and the weight w(ν) = |supp(ν)|. Any operator acting on Proof: We start by proving the “if” part. We have (C2)⊗n can be represented as hx¯|σ |y¯i = hx| ⊗ h0| U †σ U|yi ⊗ |0i 1 X µ A B µ A B T = tr[σ T ]σ .  † 2n ν ν = tr σµU|yihx| ⊗ |0ih0|U (3) ν∈{0,1,2,3} But B. Quantum error correcting codes δxy 1 X |yihx| = σ + tr[σ |yihx|]σ , As we are interested in the encoding complexity of quantum 2k 0 2k νA νA k error correcting codes, we describe codes using the encoding νA∈{0,1,2,3} ,νA6=0 operation. The encoding operation is a unitary transformation 1 X |0ih0|⊗n−k = σ . (4) on an n-qubit space that we decompose as A ⊗ B. It takes as 2n−k νB n−k input a k-qubit state |ψi ∈ A (the state to be encoded) and the νB ∈{0,3} remaining input qubits are set to |0i⊗n−k ∈ B. Such a code Plugging these expressions into (3), this shows that if is called an [n, k] quantum error correcting code. See Figure condition (2) holds, then condition (1) holds with Cµ =  σ0 † 1 for an illustration. tr σµU 2k ⊗ |0ih0|U . For the “only if” part, assume U satisfies the condition (1). Write X σνA = σνA (x, y)|xihy|. x,y∈{0,1}k Thus, if 1 ≤ w(µ) ≤ d,

† tr[σµUσνA ⊗ |0ih0|U ] Fig. 1. Encoding the state |ψi using the encoder U X  † = σνA (x, y) tr σµU|xihy| ⊗ |0ih0|U x,y∈{0,1}k X For an encoding unitary U, the code space is defined = σνA (x, y)Cµδxy ⊗n−k 2 ⊗k as the vector space {U|ψi|0i : |ψi ∈ (C ) }. By x,y∈{0,1}k considering a basis {|xi : x ∈ {0, 1}k} of A, we obtain a = 0, basis {|x¯i = U|xi ⊗ |0i⊗n−k : x ∈ {0, 1}n−k} of the code P space. A code has distance at least d + 1 if we have for all because tr[σνA ] = x σνA (x, x) = 0. Moreover, recall (4) x, y ∈ {0, 1}k and all µ ∈ {0, 1, 2, 3}n with 1 ≤ w(µ) ≤ d and note that U transforms Pauli operators to Pauli operators. † As a result, we have that tr[σµUσνA ⊗ |0ih0|U ] = 0 implies n−k † hx¯|σµ|y¯i = Cµδxy (1) that for all νB ∈ {0, 3} , tr[σµUσνA ⊗ σνB U ] = 0. Consider a Pauli string νAνB of weight for example 1.A transformation defined by the circuit and thus can be computed two-qubit gate can increase the weight of this Pauli string by from the second moment operator. This means that these at most 1 and thus any code should have at least as many properties can be completely reduced to studying the evolution gates as its distance. Also as the weight of a Pauli string can of the Markov chain defined by Q. be multiplied by at most two by a set of two-qubit gates acting III.ENCODINGUSINGRANDOMQUANTUMCIRCUITS on disjoint qubits, the depth of the encoding should be at least the logarithm of the distance. A. Sequential circuit The objective of this section is to prove the main result C. Random quantum circuits 2 of the paper: a typical circuit with t = O(n log n) gates We consider the following simple model for a quantum defines an encoding into a quantum error correcting code circuit acting on n qubits. In a sequential random quantum with distance that is basically as good as for random Clifford circuit, a random two-qubit gate is applied to a randomly unitaries. Let h be the binary entropy function defined by chosen pair of qubits in each time step. Here, the random h(x) = −x log2 x − (1 − x) log2(1 − x). two-qubit gate is going to be a random Clifford gate in C2 acting on two qubits. Theorem III.1 (Good codes with almost linear-size circuits). For any δ > 0, there exists a constant c such that a random A model of random circuits of a certain size defines a 2 measure over unitary transformations on n qubits that we call quantum circuit with cn log n gates defines an [n, k] quantum error correcting code with distance at least d + 1 with pcirc. The second-order moment operator will play an important role in all our proofs. The second-order moment operator is a probability at least superoperator acting on two copies of the space of operators 1 k−n(1−h(d/n)−log (3)d/n−3δ) 1 − − 2 2 . acting on the ambient Hilbert space, which is an n-qubit space n8 in our setting. For a measure p over the unitary group, we can Proof: We prove this result by using Proposition II.1. define the second moment operator Mp as Let Ut denote the random unitary computed by choosing t  † † random gates. We can bound the probability that Ut fails to Mp[X ⊗ Y ] = E UXU ⊗ UYU . U∼p satisfy condition (2). Even though we do not use the notion unitary designs here, n † o P ∃νA, νB, µ : w(µ) ∈ [1, d], tr[σµUtσνA ⊗ σνB Ut ] 6= 0 it is worth pointing out that a distribution p over unitary X X n † o transformations is called a two-design if Mp = Mclifford where ≤ P tr[σµUtσνA ⊗ σνB Ut ] 6= 0 . clifford is the uniform distribution over the Clifford group [8]. νA,νB µ:w(µ)∈[1,d] We denote by M the moment operator for the distribution circ Note that because U ∈ C , we have tr[σ U σ ⊗ σ U †] = obtained by applying one step of the random circuit. It is t n µ t νA νB t ±2n when it is non-zero. This means that possible to compute M explicitly when a random Clifford circ n o gate is applied to a randomly chosen pair i, j of qubits, see † P tr[σµUtσνA ⊗ σνB Ut ] 6= 0 e.g., [13, Section 3.2]. We have 1 n o = E tr[σ U σ ⊗ σ U †] 1 X 2n µ t νA νB t Mcirc = mij, n(n − 1) 1 n h † io i6=j = E tr σ⊗2U ⊗2(σ ⊗ σ )⊗2(U )⊗2 22n µ t νA νB t where mij only acts on qubits i and j and is defined by 1  ⊗2 t  ⊗2 = tr σµ Mcirc (σνA ⊗ σνB )  0 4n 0 if µ 6= µ t  0 = Q (ν, µ), σ0 ⊗ σ0 if µ = µ = 0 m [σ ⊗σ 0 ] = ij µ µ 1 P 0  15 σν ⊗ σν if µ = µ 6= 0 where ν = νAνB is the concatenation of νA and νB. As a  2 ν∈{0,1,2,3} ,ν6=0 result, the probability that condition (2) fails to hold can be for all µ, µ0 ∈ {0, 1, 2, 3}2. We can thus represent the operator bounded by M in the Pauli basis using the following 4n × 4n matrix X X circ Qt(ν, µ) 1 k n−k νA∈{0,1,2,3} ,νB ∈{0,3} µ:w(µ)∈[1,d] Q(µ, ν) = tr [σν ⊗ σν Mcirc[σµ ⊗ σµ]] . 4n n d X X X X P = Qt(ν, µ) In fact, it is simple to verify that ν∈{0,1,2,3}n Q(µ, ν) = 1 k n−k m=1 for all µ and so Q can be seen as a transition matrix for a `=1 νA∈{0,1,2,3} ,νB ∈{0,3} µ:w(µ)∈[1,d] Markov chain over the Pauli strings of length n. w(νAνB )=` n ` d Now for a random circuit with t independent random gates X X k n − k X = 3p P t(`, m), (5) applied sequentially, the second moment operator is simply p ` − p t `=1 p=0 m=1 Mcirc and the corresponding matrix in the Pauli basis is also P the t-th power of Q. The properties we are interested in can where we defined the matrix P (`, m) = µ:w(µ)=m Q(ν, µ) be expressed as quadratic functions of the entries of unitary for any ν of weight `. It is not hard to see that this expression is independent of ν. P can be considered as the transition matrix ratio of a Markov chain on {1, . . . , n} and in fact, the probabilities k
p+1 n−k
3 (k − p)(` − p) P (`, m) can be computed exactly (see [13]): p+1 `−p−1 = 3 k
pn−k
(p + 1)(n − k + p − ` + 1) p 3 `−p  1 − 2`(3n−2`−1) if m = `  5n(n−1) is a decreasing function of p. Moreover, if we plug p = λ`  2`(`−1)  if m = ` − 1 λ = 3k P (`, m) = 5n(n−1) (6) with n+2k in this expression, we obtain 6`(n−`)  if m = ` + 1  5n(n−1) 6k2` − 9k`2 + 3k`n  0 otherwise. ≤ 1. 4k2 − 2k` + 6k2` − 3k`2 + 4kn − `n + 3k`n + n2

In order to evaluate the expression in (5), we analyze the This means that the maximum occurs for some pmax ≤ dλ`e. behaviour of the Markov chain when it runs for O(n log2 n) As a result, we can bound the sum by steps. One possible route to bounding this expression would ` X k n − k  k  n − k  be to compute the mixing time of the chain defined by P . The 3p ≤ (` + 1) · 3pmax p ` − p p ` − p stationary distribution for this chain is quite simple and it is p=0 max max defined as ` n   
m λ`+1 X k n − k m 3 ≤ (` + 1) · 3 Pclifford(m) = n . p ` − p 4 − 1 p=0 n The problem with this approach is that it only gives a useful = (` + 1) · 3λ`+1 . bound whenever t = Ω(n2). In fact, this is what is done in ` 2 [13], which proves that random Clifford circuits with O(n ) Note that if k > (1−δ)n, there is nothing to prove because the gates are approximate two-designs. To prove our result for probability bound given by the theorem is negative. Assuming circuits of almost linear size, we need to analyze the chain k ≤ (1 − δ)n and choosing η appropriately small to apply more carefully. In short, the problem with the mixing time Theorem III.2, we obtain is that it is about the worst case starting point. For example, ` starting at the state ` = 1, it takes more time for the walk to X k n − k 1 1 1 3p ≤ . mix, whereas if you start near the state 3n/4, the distribution p ` − p (3 − η)`n
n10 n10 p=0 ` is already almost mixed. But an important point to realize is that the number of Pauli strings of low weight is small. So it Also observe that t n ` is not necessary for the bound on P (`, m) to be equally good X X k n − k 3p ≤ 2n+k − 1. for all `. And in fact by analyzing the Markov chain precisely, p ` − p one can prove the following almost optimal bounds. `=1 p=0 Combining this with (7) and plugging this into (5), we obtain Theorem III.2 ([3]). Let P be the transition matrix of the Markov chain defined in (6). For any constants δ ∈ n `     d X X k p n − k X t (0, 1/4), η ∈ (0, 1), there exists a constant c such that for 3 P (`, m) p ` − p t ≥ cn log2 n and all integers 1 ≤ ` ≤ n and 1 ≤ m ≤ 3n/4, `=1 p=0 m=1 n d n
m we have for large enough n X X 3 1 ≤ (2n+k − 1) · 4δn · m + n
m 4n − 1 n10 3 1 1 `=1 m=1 P t(`, m) ≤ 4δn · m + . (7) 4n − 1 `n
n10 d   (3 − η) ` 1 X n ≤ + n4δn2k−n 3m n8 m Let us state some remarks about this theorem. If instead of a m=1 random circuit, we were to apply a completely random Clifford 1 k−n(1−h(d/n)−log (3)d/n−3δ) ≤ + 2 2 (8) unitary on n qubits, we would have transition probabilities that n8 are independent of `: for sufficiently large n. n
3m B. Parallelizing the circuit P (`, m) = m . clifford 4n − 1 In the previous section, the complexity measure for a circuit was the number of two-qubit gates applied. Another Also the dependence in ` is close to optimal. Starting at state 1 important complexity measure for circuits is the depth. The `, there is a probability of roughly ` n to get back to the 3 ( ` ) depth is related to the time complexity, or the number of 2 state 1. And in state 1, there is a probability of 2−O(log n) of time steps needed in order to execute the circuit. Note staying there for t = O(n log2 n) steps. that two gates acting on disjoint qubits could in fact be In order to bound expression (5), we first evaluate executed simultaneously. For the problem of finding good P` k
pn−k
p=0 p 3 `−p . We bound this sum simply by finding the error correcting codes, a natural question is how small can p for which it is maximum. In order to do so, note that the the depth of encoding circuits be. In this section, we show that by parallelizing the random quantum circuits considered [2] C. H. Bennett, D. DiVincenzo, J. A. Smolin, and W. K. Wootters, in the previous section, we obtain with high probability circuits “Mixed-state entanglement and quantum error correction,” Phys. Rev. 3 A, vol. 54, no. 5, pp. 3824–3851, 1996, arXiv:quant-ph/9604024. with depth O(log n). Using Theorem III.1, this proves that [3] W. Brown and O. Fawzi, “Decoupling with random quantum circuits,” typical circuits of polylogarithmic depth define quantum error 2013, in preparation. see arXiv:1210.6644 for slightly weaker results. correcting codes that achieve a distance that is basically as [4] W. Brown and L. Viola, “Convergence rates for arbitrary statistical moments of random quantum circuits,” Phys. Rev. Lett., vol. 104, p. good as the distance of a random stabilizer code. 250501, 2010. To construct the parallelized circuit, one keeps adding gates [5] A. R. Calderbank, E. M. Rains, P. W. Shor, and N. J. A. Sloane, to the current level until there is a gate that shares a qubit “Quantum error correction and orthogonal geometry,” Phys. Rev. Lett., vol. 78, pp. 405–408, 1997, arXiv:quant-ph/9605005. with a previously added gate in that level, in which case [6] R. Cleve and D. Gottesman, “Efficient computations of encodings for create a new level and continue. In the following proposition, quantum error correction,” Phys. Rev. A, vol. 56, pp. 76–82, 1997, we prove that by parallelizing a random circuit on n qubits arXiv:quant-ph/9607030. [7] R. Cleve, D. Gottesman, and H. Lo, “How to share a quantum secret,” having t gates we obtain with high probability a circuit of Phys. Rev. Lett., vol. 83, no. 3, pp. 648–651, 1999. t depth O( n log n). [8] C. Dankert, R. Cleve, J. Emerson, and E. Livine, “Exact and approximate unitary 2-designs and their application to fidelity estimation,” Phys. Rev. Proposition III.3 ([3]). Consider a random sequential circuit A, vol. 80, no. 1, p. 12304, 2009, arXiv:quant-ph/0606161. composed of t gates where t is a polynomial in n. Then [9] J. Emerson, E. Livine, and S. Lloyd, “Convergence conditions for random quantum circuits,” Phys. Rev. A, vol. 72, no. 6, p. 060302, 2005. parallelize the circuit as described above. Except with [10] J. Emerson, Y. Weinstein, M. Saraceno, S. Lloyd, and D. Cory, “Pseudo- probability n−10, the resulting circuit has depth at most random unitary operators for quantum information processing,” Science, O t log n
. vol. 302, no. 5653, pp. 2098–2100, 2003. n [11] A. Gal,´ K. Hansen, M. Koucky,` P. Pudlak,´ and E. Viola, “Tight bounds Theorem III.4 (Good codes with low-depth circuits). For on computing error-correcting codes by bounded-depth circuits with arbitrary gates,” in Proc. ACM STOC, 2012, pp. 479–494. any constant δ > 0 there exist [n, k] stabilizer codes with [12] D. Gottesman, “Stabilizer codes and quantum error correction,” Ph.D. 3 2 encoding circuits of depth O(log n) and size O(n log n) with dissertation, Caltech, 1997, arXiv:quant-ph/9705052. k [13] A. Harrow and R. Low, “Random quantum circuits are approximate a distance of d provided ≤ 1 − h(d/n) − log2(3)d/n − 4δ n 2-designs,” Comm. Math. Phys., vol. 291, pp. 257–302, 2009, and n is large enough. arXiv:0802.1919v3. [14] E. Knill and R. Laflamme, “Theory of quantum error-correcting codes,” Proof: In the proof of Theorem III.1, we saw that with Phys. Rev. A, vol. 55, no. 2, p. 900, 1997. probability at most 1/3, a random quantum circuit fails to [15] C. Moore and M. Nilsson, “Parallel quantum computation and quantum define a circuit with distance as specified in the statement. codes,” SIAM J. Comput., vol. 31, no. 3, pp. 799–815, 2002. [16] M. Nielsen and I. Chuang, Quantum computation and quantum Using Proposition III.3, the probability that a random circuit information 2 . Cambridge University Press, 2000. with t = O(n log n) gates leads to a large depth when [17] R. Oliveira, O. Dahlsten, and M. Plenio, “Generic entanglement can be parallelized is also at most 1/3. We conclude that there exists generated efficiently,” Phys. Rev. Lett., vol. 98, no. 13, p. 130502, 2007. [18] P. W. Shor and J. Preskill, “Simple Proof of Security of the BB84 a circuit for which both of these conditions hold. Quantum Key Distribution Protocol,” Phys. Rev. Lett., vol. 85, no. 2, pp. 441–444, 2000, arXiv:quant-ph/0003004. ONCLUSION IV. C [19] M. Wilde, From Classical to Quantum Shannon Theory, 2011, We have shown that good quantum error correcting codes arXiv:1106.1445. can have encoding circuits with O(n log2 n) gates and depth O(log3 n). It is simple to show that Ω(n) gates are needed as well as a depth of Ω(log n). It would be interesting to determine whether these simple lower bounds are achievable. It would also be interesting to study a random circuit model with a more restricted gate set, for example with the Hadamard, phase and CNOT gate. Can we obtain the same result for this gate set?

ACKNOWLEDGEMENTS We would like to thank Patrick Hayden and David Poulin for helpful discussions. We would also like to thank the anonymous referees for their suggestions and in particular for pointing out [15]. The research of WB is supported by the Centre de Recherches Mathematiques´ at the University of Montreal, Mprime, and the Lockheed Martin Corporation. The research of OF is supported by the European Research Council grant No. 258932.

REFERENCES [1] L. Bazzi and S. Mitter, “Endcoding complexity versus minimum distance,” IEEE Trans. Inform. Theory, vol. 51, no. 6, pp. 2103–2112, 2005.