Learning Quantum Circuits of Some T Gates Ching-Yi Lai and Hao-Chung Cheng

1 Learning quantum circuits of some T gates Ching-Yi Lai and Hao-Chung Cheng

Abstract In this paper, we study the problem of learning quantum circuits of a certain structure. If the unknown target is an n-qubit Clifford circuit, we devise an algorithm to reconstruct its circuit representation by using O(n2) queries to it. It is unknown for decades how to handle circuits beyond the Clifford group for which the stabilizer formalism cannot be applied. Herein, we study quantum circuits of T -depth one given the all-zero state as an input. We show that their output states can be represented by some stabilizer pseudomixtures. By analyzing the algebraic structure of the stabilizer pseudomixture, we can reconstruct the output state of an unknown T -depth one quantum circuit on input |0ni from the outcomes of Pauli measurements and Bell measurements. If the number of T gates is of the order O(log n), our algorithm requires O(n2) queries. Our results greatly extend the previous known facts that stabilizer states can be efﬁciently identiﬁed based on the stabilizer formalism. Hence, the proposed expanded stabilizer formalism and our analysis might pave the way towards learning quantum circuits beyond the Clifford structure.

I.INTRODUCTION Consider a quantum circuit U that is accessible to us but its inner working or the mathematical description are unknown. Then, given a quantum state |ψi as an input, what do we know about the circuit output? The goal of this paper is to find a circuit representation that resembles the functioning of U so that we are able to predict the output U|ψi given an arbitrary input |ψi. Moreover, we would like to use as few queries to U as possible. We term such a problem learning an unknown quantum circuit. If we focus on only the output state U|ψi for a particular input state |ψi, the problem boils down to determining the state U|ψi. This is also called quantum state tomography, known as one of the most crucial tasks in quantum information sciences [1], [2], [3], [4]. Its goal is to infer an unknown quantum state (assuming several copies of it are available) through a sequence of quantum measurements in a way so that a proposed candidate state performs well in future predictions. However, this is a non-trivial task. In order to identify an unknown n-qubit quantum state, one would require exponentially many copies (in the number n) of the state during the tomography process to determine a full description of the state. This makes the task of tomography intractable in practice. To mitigate such difficulties, at least two possible approaches were proposed as follows. Firstly, instead of fully characterizing the mathematical description of the unknown state, one might come up with a state that is Probably Approximately Correct (PAC) [5] when only a particular set of measurements is of interest in future predictions. In this case, Aaronson formulated the state tomography as a learning problem, and proved that only O(n) copies of the state are sufficient to obtain a good hypothesis state [6] (see also [7], [8], [9], [10], [11] for the related works). Secondly, one can focus on restricted states with a certain specific structure. For example, stabilizer states are a class of states that play an substantial role in quantum error-correcting codes and other computational tasks [12]. Aaronson and Gottesman provided a procedure to identify an unknown n-qubit stabilizer state with only O(n) copies of it if collective measurements are possible [13]. Later, Montanaro proposed an efficient algorithm via Bell sampling that consumes O(n) copies of the state and runs in time of order O(n3) [14]. Rocchetto cast the problem into the PAC learning model, and showed that stabiliser states are efficiently PAC learnable in the sense that the running time is polynomial in n [15]. (Note that the O(n) number of copies is optimal by Holevo’s theorem [16].) If now one aims to infer an unknown quantum evolution with certain known input states, this is called quantum process tomography. Once we completely know the underlying evolution, we can determine the final states for arbitrary initial states. This is the target problem we want to study in this paper. Nevertheless, this problem is much more challenging than quantum 3n arXiv:2106.12524v1 [quant-ph] 23 Jun 2021 state tomography. The amount of resources needed for identifying an arbitrary n-qubit quantum circuit is 4 , which is also practically formidable [17], [18], [19], [20]. When considering a restricted class of Clifford circuits Cn [21], Low showed that an n-qubit Clifford circuit Cn is determined (up to a global phase) given 2n + 1 queries to Cn and 2n queries to its conjugate † 2 Cn in time O(n ) [22]. Moreover, a converse result showed that at least n queries is required for such the task [22]. However, no concrete algorithms for reconstructing the circuit representation of the target Cn are provided and one is not capable of predicting the output state of Cn when sending an arbitrary state as input. The first main contribution of this paper is to fulfill this gap. Specifically, we propose a constructive algorithm to efficiently produce the circuit representation of the target circuit 2 Cn by using O(n ) queries to it. (See Theorem 9 and Algorithm 1 in Section III.)

Theorem 1. [Learning unknown Clifford circuits] Given access to an unknown Clifford circuit Cn, one can learn a circuit 2 3 description using 2n + 10n + 4 queries to it in time O(n ), so that the produced hypothesis circuit is equivalent to Cn with probability at least 1 − 2−n+1.

CYL is with the Institute of Communications Engineering, National Yang Ming Chiao Tung University, Hsinchu 30010, Taiwan. email:[email protected] HCC is with the Department of Electrical Engineering, Graduate Institute of Communication Engineering, National Taiwan University (NTU), Taipei 10617, Taiwan, and with the Department of Mathematics, Institute of Applied Mathematical Sciences, NTU, Taipei 10617, Taiwan, and also with Hon Hai (Foxconn) Quantum Computing Centre, New Taipei City 236, Taiwan. 2

† Let us emphasize that our approach does not rely on accessing the conjugate circuit Cn (as it was required in [22]) since implementing such the conjugate circuit might incur exponential overhead [23], hence compromising the efficiency of the learning process. The problem of learning an unknown Clifford circuit is closely related to that of learning stabilizer states since the output of a Clifford on input |0ni is a stabilizer state. In the proposed Algorithm 1, we adopt Montanaro’s Bell sampling algorithm for learning stabilizer states [14] as a subroutine. Moreover, we employ the stabilizer formalism [12], [24], exploiting the desirable structure of the Pauli group to learn the output stabilizers states. Lastly, by showing that a set of evolved Pauli basis can be identified by changing the input basis state appropriately, we determine the circuit representation of the unknown Clifford circuit Cn via a circuit synthesis procedure. In the aforementioned task, we heavily rely on the stabilizer formalism. However, it is unknown for a long time whether one can efficiently identify a quantum state that is produced from a quantum device beyond the class of Clifford circuits. In this work, we aim to provide an algorithm to identify the unknown quantum state output produced from a quantum circuit consisting of Clifford gates and a non-Clifford gate T = |0ih0|+eiπ/4|1ih1|. This Clifford+T gate set is universal for quantum computation and receives great attention in fault-tolerant quantum computation [25], [26], compiling quantum circuits [27], [28], [29], and quantum circuit simulations [30], [31]. Namely, an arbitrary quantum circuit can be approximately decomposed as a sequence of Clifford stages and T stages, alternatively. Here, a Clifford stage is simply a Clifford circuit. In a T stage, either a T gate or the identity is applied to each qubit1. The number of T stages in a circuit is called the T -depth of the circuit. A slightly related work is that the quantum circuits in the Clifford hierarchy can be distinguished by some POVM measurements [22, Theorem 8]. However, no exact construction of the POVMs is given, other than the first level of Clifford hierarchy, namely the Pauli group, which can be identified using the idea of superdense coding [32]. We note that quantum circuits of T -depth one have been studied in [33]. Our second main contribution is as follows. Suppose that U is an unknown n-qubit T -depth one quantum circuit with O(log n) T gates. We show that it requires at most O(n2) queries to efficiently learn the output of U on input |0ni. Theorem 2. [Learning unknown T -depth one output states] Given access to an unknown T -depth one quantum circuit U, one can learn a circuit description using O(3kn) queries to the unknown circuit U with time complexity O(n3 + 3kn), where k ≤ n is the number of T gates, so that the produced hypothesis circuit Uˆ is equivalent to U with probability at least 1 − 3e−n when the input states are restricted to the computational basis. The explicit procedure is provided in Algorithm 2 of Section V. The reason why learning quantum circuits U of some T gates is a much more technical-demanding problem is elaborated in the following. Since the T gate dose not belong to the Clifford group, Pauli operators are not preserved by the evolution of the quantum circuit U, and hence the stabilizer formalism or the Gottesman–Kitaev theorem [24] does not work for circuits with T gates. To circumvent such challenges, we need to conceive a scenario such that the Gottesman–Kitaev theorem can be leveraged for our purpose. Since a T gate can be implemented by a T gadget with the magic state |+Tih+T|, it yields two corresponding stabilizer pseudomixture representations. Hence, a T -depth one quantum circuit can be transformed to a Clifford circuit with postselection and some ancillary magic states |+Tih+T| (see Proposition 11 of Section IV). We remark that the stabilizer pseudomixtures have been studied in some contexts, such as robustness of magic [34], classical and quantum simulation [30], [35]. In this work we will exploit the structure of stabilizer pseudomixtures in learning quantum circuits. We propose an expanded stabilizer formalism, which serves as a crucial and convenient tool to analyze quantum circuits of some T gates (see Section IV). A T -depth one circuit can be represented by the expanded stabilizer formalism (Lemma 12 of Section IV). In particular, this expanded stabilizer formalism can be generated by at most 2n primary symplectic stabilizers. By using such technique in the learning problem, we are able to analyze the outcomes of Pauli and Bell measurements on copies of its output state on input |0ni (Lemmas 13 and 14 of Section V). As a result, we recover a set of basis output states, which in turn recovers the target circuit representation (Theorem 17 of V). We remark that no conjugate oracle to U is required in our algorithm as well. This is done after we carefully analyze the structure of such T -depth one output state (Lemma 16 of Section V). Our results are summarized in Table I. This paper is organized as follows. We provide preliminaries in Section II. Section III is devoted to learning unknown Clifford circuits. In Section IV, we propose an expanded stabilizer formalism for analyzing quantum circuits of some T gates. The learning algorithm for quantum circuits of T -depth one output state is given in Section IV-B. Then we conclude in Section VI.

1We remark that T † can also be used here but T and T † are equivalent up to a Clifford gate (T † = TS†). For our purpose, we only have to consider T gates. 3

Target Sample complexity Time complexity Stabilizer states 5n + 2 [14] O(n3) Clifford circuits 2n2 + 10n + 4 (Algorithm 1) O(n3) T -depth one states O(3kn) (Algorithm 2) O(n3 + 3kn) T -depth one circuits ? ? T -depth hierarchies ? ?

TABLE I COMPARISON OF VARIOUS n-QUBIT TARGETS (AND k T GATES).WE ONLY LIST THE BEST UPPER BOUNDS SO FAR.

II.PRELIMINARIES A. Pauli operators and Clifford gates A pure quantum state, denoted by |vi, is a unit vector in a certain Hilbert space. Let {|0i, |1i} be an ordered basis (computational basis) for pure single-qubit states in C2. The Pauli matrices 1 0 0 1 σ = I = , σ = X = , 00 0 1 01 1 0 1 0 0 −i σ = Z = , σ = Y = = iXZ 10 0 −1 11 i 0 form a basis of the space of linear operators L(C2). An important fact is that X,Y, and Z anticommute with each other. Note that we may sometimes refer to I as the identity matrix of appropriate dimension without ambiguity. The states |0i and |1i√are the eigenvectors of√Z and thus {|0i, |1i} is also called Z basis. Similarly, the eigenvectors of√X are {|+i = (|0i + |1i)/√ 2, |−i = (|0i + |1i)/ 2}, called X basis, and the eigenvectors of Y are {| + ii = (|0i + i|1i)/ 2, | − ii = (|0i − i|1i)/ 2}, called Y basis. n Associated with an n-qubit quantum system is a complex Hilbert space C2 . A standard basis for linear operators on the n-qubit state space is the n-fold Pauli group, denoted by

Pn = {cE1 ⊗ · · · ⊗ En : c ∈ {±1, ±i},Ej ∈ {I,X,Y,Z}}.

All the elements in Pn are unitary with eigenvalues ±1 and they either commute or anticommute with each other. For convenience, we may sometimes omit the symbol of tensor product ⊗. An n-fold Pauli operator admits a binary representation that is irrelevant to its phase. For w = w1 ··· wn, v = v1 ··· vn ∈ {0, 1}n, deﬁne n O σw:v , σwj vj , j=1 where w : v denote the concatenation of the two vectors w and v. Consequently, Pn can be generated by 2n independent Pauli operators up to a phase in {±1, ±i}. The set of n-qubit Clfford circuits, denoted by Cln, consists of unitary operators that preserve the n-fold Pauli group under conjugation n 2n † o Cln = V ∈ U(C ): V PnV = Pn . 1 1 1 0 Clifford circuits are composed of Hadamard H = √1 , phase S = , and controlled-NOT CNOT = |0ih0| ⊗ 2 1 −1 0 i I + |1ih1| ⊗ X (see, for example, [12]) and these gates are called Clifford gates. We may use the notation Xj to denote an operator that applies an X to the jth qubit but trivially operates on the others. n v Qn v v For v ∈ {0, 1} , let X = i=1 Xvi . Other operators, such as Yj, Y , Sj, and S , are similarly deﬁned. Thus any g ∈ Pn can be expressed as g = cZwXv for some c ∈ {±1, ±i} and w, v ∈ {0, 1}n. Without loss of generality, a basis of Pn can be represented as follows: † † g1 = UX1U , h1 = UZ1U , † † g2 = UX2U , h2 = UZ2U , . . (1) . . † † gn = UXnU , hn = UZnU , 4

where U ∈ Cln is a Clifford unitary. They satisfy the following commutation relations: g g = g g , h h = h h , i j j i i j j i (2) gihj = hjgi for i 6= j, gihi = −higi. 0 0 0 0 0 0 For a set of operators {g1, . . . , gn, h1, . . . , hn} satisfying the commutation relations (2), the operators gi and hi are called symplectic partners of each other.

III.LEARNINGUNKNOWN CLIFFORD CIRCUITS A Clifford circuit can be decomposed into Clifford gates in many ways. This section is devoted to providing an efﬁcient algorithm for ﬁnding a circuit representation of an unknown Clifford circuit. In subsection III-A, we recall how to retrieve information about an unknown stabilizer state by measurements. In subsection III-B, we describe a circuit synthesis method for Clifford circuits. Lastly, in subsection III-C, we add up the introduced tools to achieve our goal of learning an unknown Clifford circuit (Algorithm 1 and Theorem 9).

A. Stabilizer states and measurements

An n-qubit stabilizer state |φi is the joint eigenvector of an Abelian group S = hg1, g2, . . . , gni ⊂ Pn that does not contain ⊗n −I , where gi ∈ Pn are independent generators. Any element g in S satisfies that g|φi = |φi and is called a stabilizer of n |φi. Suppose that gi = ciσwi:vi , where ci ∈ {±1} and wi, vi ∈ {0, 1} , for i = 1, . . . , n. Then a Pauli frame of the n-qubit stabilizer state |φi is given by   sgn(c1) w11 w12 ··· w1n v11 v12 ··· v1n  sgn(c2) w21 w22 ··· w2n v21 v22 ··· v2n    ,  ......   ......  sgn(cn) wn1 wn2 ··· wnn vn1 vn2 ··· vnn where sgn(ci) = ± for ci = ±1. √ − 0 0 1 1 Example 1. The two-qubit state (|00i − |11i) / 2 has a Pauli frame . (The plus sign is omitted.) 2 1 1 0 0 Definition 3. A Pauli frame [c W |V ], where c ∈ {+, −}n, W, V ∈ {0, 1}n×n is said to have X-rank k if the binary matrix V is of rank k.. It is known that the evolution of a Clifford circuit on a stabilizer state can be simulated by tracking the transformation of its Pauli frame according to the Gottesman–Kitaev theorem [24]. Measuring a Pauli operator g ∈ Pn on a stabilizer state |φi can also be tracked in a Pauli frame [12]. An n-qubit stabilizer state |φi and its stabilizer group S have a one-to-one correspondence. Hence |φi can be identified by its stabilizer group S. A stabilizer group can be described by a set of independent Pauli generators. Assuming that many copies of |φi are available, we can perform certain measurements on |φi and obtain a representation of S. A naive method is to measure each Pauli operator g ∈ Pn on a copy of |φi. The measurement returns outcome +1 with probability 1 if g stabilizes |φi and returns outcome +1 (−1) with probability 1/2 (1/2), otherwise. This requires O(4n) copies of the state for Pauli measurements. Montanaro showed that Bell sampling on two copies of a stabilizer state returns one of its stabilizer, up to a Pauli operator that relates the stabilizer state and its conjugate state [14, Lemma 2]. Consequently O(n) outcomes of Bell sampling on pairs of the stabilizer state return O(n) stabilizers of the state, which can then be used to determine a set of independent stabilizer generators with high probability. P 2n For an arbitrary quantum state |ψi = i∈{0,1}n ai|ii ∈ C , its conjugate state is defined by

∗ X ∗ |ψ i = ai |ii. (3) i Inspired by Montanaro’s Bell sampling [14, Lemma 2], we reformulate the following lemma.

n Lemma 4. Suppose that |ψi ∈ C2 is an n-qubit pure state. Then a joint Bell measurement on |ψ∗i ⊗ |ψi returns outcome r ∈ {0, 1}2n with probability |hψ|σ |ψi|2 r . 2n 5

∗ Proof. The outcome of a joint Bell measurement on |ψ i ⊗ |ψi is σr with probability 2

⊗n ⊗n ∗ 2 1 X ⊗n X ∗ hΦ+| (I ⊗ σr)|ψ i|ψi = hi| ⊗ hi|(I ⊗ σr) α |ji ⊗ |ψi 2n j i∈{0,1}n j∈{0,1}n 1 = |hψ|σ |ψi|2 . 2n r

Therefore, we can learn a stabilizer of a stabilizer state |φi by performing a joint Bell measurement on |φ∗i ⊗ |φi. If copies of the conjugate state are not available, stabilizers can be still learned by Bell measurements on |φi ⊗ |φi as in the following corollary. 2n 2n Corollary 5. Suppose that |φi ∈ C is an n-qubit stabilizer state. Then there exists r0 ∈ {0, 1} such that a joint Bell measurement on |φi ⊗ |φi returns outcome r with probability |hφ|σ |φ∗i|2 |hφ|σ |φi|2 r = r⊕r0 . 2n 2n

Proof. Suppose that |φi is stabilized by independent stabilizer generators g1, . . . , gn ∈ Pn. It is straightforward to see that the ∗ ∗ ∗ ∗ ∗ conjugate state |φ i is stabilized by g1 , . . . , gn, where gi = gi if the number of its Pauli component Y is even, and gi = −gi, ∗ ∗ otherwise. If gi = gi for all i = 1, . . . , n, then |φ i = |φi and the statement holds trivially. ∗ ∗ Now assume that gi = −gi for some gi, say g1 for convenience, and gi = gi for i = 2, . . . , n. This can be done because ∗ 0 0 ∗ 0 ∗ that if gj = −gj for gj 6= g1, we can replace it by gj = g1gj such that (gj) = gj. Hence, the conjugate state |φ i is stabilized 2n by −g1, g2, . . . , gn. Suppose that h1 = σr0 , for some r0 ∈ {0, 1} , is a symplectic partner of g1 such that the commutation relations (2) hold. Then ∗ |φ i = h1|φi, since they are both stabilized by −g1, g2, . . . , gn. Consequently, a Bell measurement on |φi ⊗ |φi returns outcome r with probability

⊗n ⊗n 2 1 ∗ 2 hΦ+| (I ⊗ σr)|φi|φi = |hφ|σr|φ i| 2n 1 = |hφ|σ |φi|2 . 2n r⊕r0

s Remark: This corollary is slightly weaken than [14, Lemma 2], where the Pauli operator σr0 is shown to be Z for some s ∈ {0, 1}n by exploiting the mathematical structure of a stabilizer state [36], [37]. This can be understood as |φi = SsV |0ni for some s ∈ {0, 1}n and a unitary V consisting of H, X, CNOT , and CZ gates [37, Theorem 2]. However, Corollary 5 is sufﬁcient for our purpose of learning stabilizer states so that we have a self-contained proof here. Moreover, this idea will be exploited in learning T -depth one output states later.

B. A Circuit Synthesis Method In this section, we describe a circuit synthesis approach for Clifford circuits and it will be used later in Section III-C for finding the circuit representation of an unknown target Clifford circuit. An n-qubit state is described by a 2n × 2n density matrix. The n-fold Pauli operators are a basis for 2n × 2n matrices. To understand the evolution of a density operator under a unitary operator U, it suffices to know how U operates on the n-fold † P † P Pauli operators. Namely, UρU = i αiUσiU with ρ = i αiσi. Since the Pauli matrices are related by Y = iXZ and the n-fold Pauli group has 2n independent generators, one has the following lemma. † † † Lemma 6. Suppose U is a Clifford operator. Given UXiU and UYjU (or UZjU ) for i, j = 1, . . . , n, U can be uniquely determined up to a global phase. † † Remark 7. Lemma 6 shows that only one Clifford U satisfies the pair constraints (Xi,UXiU ) and (Yj,UYjU ) (or † (Zj,UZjU )) for i, j = 1, . . . , n. However, it is computationally difficult to find the circuit representation for U. (For example, using Gaussian elimination would take time O(43n).) In a learning task, the goal is usually to predict the output state U|ψi or the measurement outcome on U|ψi. Given knowledge † † of UXiU and UYjU for i, j = 1, . . . , n, it is still not easy to do this prediction. If we know the mathematical description of P † P † |ψi, we can find a Pauli decomposition of ρ = |ψihψ| = i βiσi, and then evaluate the combination UρU = i βiUσiU . 6

Since there are 4n basis matrices, this decomposition would require O(4n) inner products. On the other hand, if a circuit description of U is available, we can simply apply U to the input quantum state for predicting the output state. In the following, we describe a crucial step—a circuit synthesis method—for ﬁnding a circuit representation for the unknown Clifford U. Clifford circuits are composed of controlled-NOT (CNOT), Hadamard, and phase gates. A tableau description of a Clifford † † unitary U is a binary matrix with rows corresponding to UXiU and UYjU for i, j = 1, . . . , n. Given the tableau of U, Aaronson and Gottesman provided a circuit synthesis algorithm that decomposes U to a circuit that contains 11 stages of computation in the sequence -H-C-P-C-P-C-H-P-C-P-C- [38], where -H-, -P-, and -C- stand for stages composed of only Hadamard, Phase, and CNOT gates, respectively. (This is further improved to a nine-stage circuit by Maslov and Roetteler [39], which can be utilized in fault-tolerant quantum computation [40].) Consequently, any Clifford circuit can be decomposed into O(n2/ log n) Clifford gates with circuit depth O(n) [41] or O(n2) Clifford gates with circuit depth O(log n) [42]. When the input to a Clifford circuit is restricted to |0ni, Van den Nest showed that the output state is equal to a Clifford circuit of ﬁve stages -H-C-X-P-CZ- on input |0ni [37], where -X- and -CZ- stand for stages of only X, and controlled phase gates, respectively. In the following Lemma 8, we show that if one only has access to an incomplete tableau, it is still possible to apply the above Clifford synthesis algorithm with additional steps. This is similar to the encoding circuit decomposition for entanglement- assisted quantum stabilizer codes [43] and its proof is omitted. † † Lemma 8. Suppose that U is a Clifford circuit. Given UXiU for i = 1, . . . , n and UZjU for j = 1, . . . , t with t ≤ n, † † we can construct a unitary operation C composed of O(n(n + t)/ log(n)) Clifford gates such that CXiC = UXiU for † † 3 i = 1, . . . , n and CZjC = UZjU for j = 1, . . . , t. Moreover, such C can be found in time O(n ). † † † † † † Similarly, given UXiU ,UYjU for some i, j, one can derive a circuit C such that CXiC = UXiU ,CYjC = UYjU .

C. Learning algorithm for unknown Clifford circuits

In this section, we show how to learn a circuit representation for an unknown Clifford circuit U ∈ Cln. Our idea is similar to that of learning an unknown stabilizer state. For example, Montanaro proposed an algorithm for learning unknown stabilizer state via identifying its stabilizer group [14]. However, identifying an unknown Clifford circuit is more complicated. One would † † need to determine UZiU and UXiU for i = 1, . . . , n simultaneously. Our key ingredient is to apply Lemma 8 to ﬁnd a Clifford circuit decomposition for U as described as follows. Our learning algorithm for unknown Clifford circuits is given in Algorithm 1. We brieﬂy explain how it works. According n to Corollary 5, the set {ri ⊕ r0 : i = 1,..., 2n} obtained in step 2) is a set of stabilizers for |0 i, from which we can obtain n n n † n n a stabilizer group description of U|0 i. Let |0 i = U|0 i with stabilizers UZiU , i = 1, . . . , n and |+ i = U|+ i with † n stabilizers UXiU , i = 1, . . . , n. If we use Motanaro’s algorithm with 5n + 2 copies of |0 i, we can determine an independent −n set of generators g1, . . . , gn with probability at least (1 − 2 ) such that † † hg1, . . . , gni = hUZ1U ,...,UZnU i.

n Similarly, using 5n + 2 copies of |+ i, we can determine an independent set of generators h1, . . . , hn with probability at least (1 − 2−n) such that † † hh1, . . . , hni = hUX1U ,...,UXnU i. n n Consequently, there exist bi ∈ {0, 1} , for i = 1, . . . , n, and aj ∈ {0, 1} , for j = 1, . . . , n, such that

bi † gi =UZ U ,

aj † hj =UX U . † † Once bi and aj are known, UXiU and UZjU can be uniquely determined by Lemma 8. 3 Finding a basis for {ri ⊕ r0 : i = 1,..., 2n} requires a Gaussian elimination, which takes time O(n ) in reality. Similarly, Gaussian elimination is also needed in Lemma 8 and to find the inverse of an matrix using augmented matrices. To sum up we have the following theorem. Theorem 9. Given access to an oracle OU , one can identify U using 2n2 + 10n + 4 queries to OU in time O(n3) with probability at least 1 − 2−n+1. In the special case of learning simply an unknown stabilizer state |ψi = U|0ni, applying steps 1) to 4) in Algorithm 1 is sufficient to find a set of stabilizer generators.

IV. CHARACTERIZING QUANTUM CIRCUITSOF SOME T GATES A. Expanded stabilizer formalism 1 0 The Clifford gates together with a non-Clifford gate, say T = i π , are universal for quantum computation [12]. We 0 e 4 will focus on quantum circuits composed of Clifford +T gates in this paper. An arbitrary quantum circuit can be approximated 7

Algorithm 1: Learning an unknown Clifford circuit U Input: An oracle O , where U ∈ Cln. Output: A circuit description of U. n 1) Prepare 5n + 2 copies of |0ni = U|0ni ∈ C2 using the oracle OU . n n 2n 2) For i = 0,..., 2n, perform a Bell measurement on |0 i ⊗ |0 i and denote the outcomes by ri ∈ {0, 1} . 0 0 0 3) Determine a basis for {σri⊕r0 : i = 1,..., 2n} and denote the basis by {g1, . . . , gn}, where gi ∈ Pn. 4) For i = 1, . . . , n, do the following: 0 n - Measure the Pauli operator gi on |0 i. 0 n 0 n - If the outcome is +1, then gi = gi is a stabilizer of |0 i; otherwise, gi = −gi is a stabilizer of |0 i. n Then {g1, . . . , gn} is a stabilizer basis for |0 i. 5) For j = 1, . . . , n, do the following: - prepare n copies of |0j−110n−ji using the oracle OU . j−1 n−j - For i = 1, . . . , n, measure gi on |0 10 i. If the outcome is +1, set bi,j = 0; otherwise, bi,j = 1. −1 6) Find the inverse of B = [bi,j] and denote it by B = [di,j], using augmented matrices and Gaussian elimination. Then n † Y di,j UZiU = gj j=1 for i = 1, . . . , n. 7) Repeat Steps 1) to 5) but with |0i, |1i, gj, and bi,j replaced by |+i, |−i, hj and ai,j, respectively. −1 8) Find the inverse of A = [ai,j] and denote it by A = [ei,j], using augmented matrices and Gaussian elimination. Then n † Y ei,j UXiU = hj j=1 for i = 1, . . . , n. † † 9) Apply Lemma 8 to {UZiU ,UXjU : i, j = 1, . . . , n} and output the obtained Clifford circuit. by Clifford and T gates and this approximation can be decomposed as a sequence of Clifford stages and T stages, alternatively. Deﬁnition 10. The number of T stages in a circuit is called the T -depth of the circuit. The output state of a T -depth one circuit on input |0ni will be called a T -depth one output state. For example, Figure 1 provides a quantum circuit of T -depth one.

Fig. 1. A quantum circuit of T -depth 1.

i π |0i+e 4 |1i A T gate can be implemented by the gadget shown in Figure 2 with a magic state |+Ti = √ . In addition, this T 2 gadget is, conditioned on the measurement outcome, equivalent to one of the postselected T gadgets as shown in Figure 3 [31], where only Clifford gates are required. Hence we have the following proposition. Proposition 11. Any n-qubit Clifford+T quantum circuit of k T gates can be reduced to an (n + k)-qubit Clifford circuit of depth O(log(n + k)) if postselection is possible and magic sates |+Ti are available. It can be further reduced to a quantum circuit of constant depth if, in addition, large ancillary state preparation is possible. Proof. Using the gadget in Figure 3 [31], a quantum circuit of k T gates can be implemented by an equivalent Clifford circuit with k ancillary magic states conditioned on outcome 0k in the gadgets. (Both postselected T gadgets work here, and for simplicity, we use only the postselected gadget conditioned on outcome 0 in the following.) Then the equivalent circuit has n + k qubits and only Clifford gates, followed by some postselection measurements at the end. Since a Clifford circuit can be implemented with depth logarithmic in the number of qubits [42], we have the ﬁrst statement. 8

Fig. 2. T gadget with a magic state |+Ti.

Fig. 3. Postselected T gadgets.

As for the second statement, we simply use the gate teleportation technique [44], [40] to implement a Clifford circuit with a corresponding ancillary state. If this ancillary state can be prepared ofﬂine, the teleportation part can be done in constant depth.

For example, the quantum circuit in Figure 1 can be implemented by Figure 4 with two postselected gadgets.

Fig. 4. An equivalent circuit of Figure 1 with postselected T gadgets.

Recently, it is shown that computations with larger quantum depth are strictly more powerful (with respect to an oracle) and not every quantum algorithm can be implemented in logarithmic depth [45], [46]. We remark that the above proposition does not violate the depth constraint since it assumes that postselection is available. P A quantum state ρ can be represented as a stabilizer pseudomixture ρ = αiσi, where σi are stabilizer states and αi P i are real numbers such that i αi = 1. Note that this representation is not unique and αi can be negative. The magic state |+Tih+T| has the following two stabilizer pseudomixtures:

|+Tih+T| =α1|+ih+| + α2|−ih−| + α3| + iih+i| (4)

=α1| + iih+i| + α2| − iih−i| + α3|+ih+|, (5) √ √ 1 1− 2 2 where α1 = 2 , α2 = 2 , and α3 = 2 . In Eq. (4), the stabilizers of the component stabilizer states are X, −X, and Y , respectively, while in Eq. (5), the stabilizers are Y , −Y , and X, respectively. In this work we will exploit the structure of stabilizer pseudomixtures√ in learning quantum circuits. We will provide algorithms to learn Clifford +T circuits of some T gates, speciﬁcally O(2 log n). We propose the following expanded stabilizer formalism for simulating a quantum circuit U of k T gates when the input is a stabilizer state. First we replace the k T gates in the target quantum circuit U by postselected T gadgets, which leads to a Clifford circuit with input a pseudomixture of 3k stabilizer states. Then the evolution of the input stabilizer state under U can be done by tracing the 3k corresponding Pauli frames in the remaining Clifford circuit and then combining the resulting states appropriately. We say that these 3k Pauli frames constitutes an expanded Pauli frame. Clearly, this method can efﬁciently handle k = O(log n) T gates. 9

Example 2. Consider a T gate operating on |+i, which is stabilized by X. The output is |+Ti = T |+i and the expanded Pauli frame evoles from X to (X, −X,Y ) as follows: +00 10 +00 10 +00 10 , , +00 01 −00 01 +01 01 CNOT1,2 +00 11 +00 11 +00 11 −→ , , +00 01 −00 01 +11 01 +00 10 −00 10 +11 10 = , , +00 01 −00 01 +11 01 I ⊗ h0|2 +00 10 −00 10 +11 10 −→ , , +01 00 +01 00 +01 00 discard the ancilla −→ +0 1 , −0 1 , +1 1 . 2 In general, we can start with an n-qubit Pauli frame. Each time when a T gate is applied, we consider the n + 1 qubit Pauli frames, expand the number of Pauli frames by three, do CNOTs, measure the ancilla with postselected outcome 0, and then discard the ancilla qubit. Continuing this process, we end with 3k n-qubit Pauli frames. Remark: in the task of classical simulation in [30, Theorem 3], knowledge of Eq. (4) is sufficient so that classical measurement outcomes can be linearly combined. However, we need both Eqs. (4) and (5) to develop our expanded stabilizer formalism as shown in the following. The transformations of single Pauli operators under T in the expanded Pauli frame are summarized in Table II. A triplet such as (X, −X,Y ) means that the state is a pseudomixture of the three states stabilized by X, −X, and Y , and with coefficients α1, α2, and α3, respectively. Note that Z commutes with T so ±Z remains unchanged. The two triplets in an entry correspond to the expressions (4) and (5), respectively. In each triplet, the second operator is always equal to the first, multiplied by −1. Observe that these two triplets have the same first and third operators in the opposite order. Therefore, we will call the first and third operators as the primary symplectic stabilizers (they are also symplectic partners to each other). For example, we say that X and Y are the primary symplectic stabilizers of |+Ti. Another reason is that when√ measuring each of these primary +1 2+ 2 −1 symplectic√ stabilizers on the output state, we obtain outcome with probability 4 and outcome with probability 2− 2 4 . These ideas naturally extend to n-fold Pauli operators.

input output primary symplectic stabilizers X (X,−X, Y )(Y ,−Y , X) X,Y −X (−X,X, −Y )(−Y ,Y , −X) −X, −Y Y (Y ,−Y , −X)(−X,X, Y ) −X,Y −Y (−Y ,Y , X)(X,−X, −Y ) X, −Y ±Z ±Z NA

TABLE II EXPANDED STABILIZER FORMALISM OF SINGLE PAULI OPERATORS UNDER THE OPERATION T .

B. Quantum circuits of T -depth one An expanded Pauli frame of an n-qubit quantum circuit has exponentially many Pauli frames in the number of T gates and this seems intractable when k goes large. For T -depth one quantum circuits, we show that it sufﬁces to trace the evolution of at v most 2n primary symplectic stabilizers. Without loss of generality, we consider a T -depth one quantum circuit U = C2T C1, n v where C1 and C2 are Clifford operators in Cln, and v ∈ {0, 1} of Hamming weight k. Here T applies a T gate to qubit i if vi = 1, and operates trivially, otherwise. Figure 1 illustrates such an example. v n Lemma 12. Suppose that U = C2T C1 is a T -depth one circuit, where C1,C2 ∈ Cln and v ∈ {0, 1} is of Hamming weight k ≤ n. Then U|0ni has a pseudomixture of 3kˆ orthogonal stabilizer states, where kˆ ≤ k, and its expanded Pauli frame has 2k primary symplectic stabilizers and the other n − k stabilizer generators that stabilize all the component stabilizer states. n Proof. Recall the deﬁnition of X-rank in Def. 3. In the following we consider the two cases of whether C1|0 i has a Pauli frame of full X-rank. 10

n (a) Assume that C1|0 i has a Pauli frame of full X-rank. Without loss of generality, we may assume that the Pauli frame of n C1|0 i has the following form:   sgn(c1) w11 w12 ··· w1n 1 0 ··· 0  sgn(c2) w21 w22 ··· w2n 0 1 ··· 0    ,  ......   ......  sgn(cn) wn1 wn2 ··· wnn 0 0 ··· 1 n×1 where c ∈ {+1, −1} and wij ∈ {0, 1}. This can be done by appropriate row multiplications. Assume wnn = 0. The case that wnn = 1 is similar. Now we simulate the evolution of a postselected gadget (conditioned n on outcome 0) operating on the last qubit of U1|0 i, that is, applying a T gate to the last qubit. By Eq. (4), we start with three Pauli frames (of dimension (n + 1) × (2(n + 1) + 1)):     sgn(c1) w11 ··· w1n 0 1 ··· 0 0 sgn(c1) w11 ··· w1n 0 1 ··· 0 0  ......   ......   ......   ......    ,    sgn(cn) wn1 ··· 0 0 0 ··· 1 0   sgn(cn) wn1 ··· 0 0 0 ··· 1 0  ± 0 ··· 0 0 0 ··· 0 1 0 ··· 0 1 0 ··· 0 1

    sgn(c1) w11 ··· w1n 0 1 ··· 0 0 sgn(c1) w11 ··· w1n 0 1 ··· 0 0  ......   ......  CNOT  ......   ......  −→   ,    sgn(cn) wn1 ··· 0 0 0 ··· 1 1   sgn(cn) wn1 ··· 0 0 0 ··· 1 1  ± 0 ··· 0 0 0 ··· 0 1 0 ··· 1 1 0 ··· 0 1     sgn(c1) w11 ··· w1n 0 1 ··· 0 0 sgn(c1) w11 ··· w1n 0 1 ··· 0 0  ......   ......   ......   ......  =   ,    sgn(±cn) wn1 ··· 0 0 0 ··· 1 0   sgn(cn) wn1 ··· 1 1 0 ··· 1 0  ± 0 ··· 0 0 0 ··· 0 1 0 ··· 1 1 0 ··· 0 1

    sgn(c1) w11 ··· w1n 0 1 ··· 0 0 sgn(c1) w11 ··· w1n 0 1 ··· 0 0 ...... h0|  ......   ......   ......   ......  −→   ,   .  sgn(±cn) wn1 ··· 0 0 0 ··· 1 0   sgn(cn) wn1 ··· 1 1 0 ··· 1 0  0 ··· 0 1 0 ··· 0 0 0 ··· 0 1 0 ··· 0 0 Since the ancila stays in |0i and can be discarded, the three n-qubit Pauli frames become     sgn(c1) w11 ··· w1n 1 ··· 0 sgn(c1) w11 ··· w1n 1 ··· 0  ......   ......   ......  ,  ......  . (6) sgn(±cn) wn1 ··· 0 0 ··· 1 sgn(cn) wn1 ··· 1 0 ··· 1 Note that the ﬁrst two Pauli frames only differ by a sign on the last row. Each of these three frames has an identity on the right half. Repeating this process on different qubits, we end up with 3k Pauli frames. Clearly these Pauli frames are different and they correspond to orthogonal stabilizer states. After each T gate, we have one additional primary symplectic stabilizer. Therefore, these 3k Pauli frames share n + k independent generators up to a phase −1 or the expanded Pauli frame of v n T C1|0 i has 2k primary symplectic stabilizers and the other n − k stabilizer generators that stabilize all the components stabilizer states. Finally these Pauli frames evolve according to the Clifford unitary C2, which preserves the expanded Pauli frame structure. n 0 (b) Assume that C1|0 i has a Pauli frame of X-rank k < k. Without loss of generality, we may assume that the Pauli frame 11

n of C1|0 i has the following form:

 n−k0+1  z }| {  sgn(c1) w11 ··· w1k0 w1(k0+1) ··· w1n 1 ··· 1 0 ··· 0     sgn(c2) w21 ··· w2k0 w2(k0+1) ··· w2n 0 ··· 0 1 ··· 0     ......   ......     sgn(c 0 ) w 0 ··· w 0 0 w 0 0 ··· w 0 0 ··· 0 0 ··· 1   k k 1 k k k (k +1) k n  ,  sgn(c 0 ) 1100 ··· 0 0 ··· 0 0 ··· 0 0 ··· 0   k +1   sgn(c 0 ) 0110 ··· 0 0 ··· 0 0 ··· 0 0 ··· 0   k +2   ......   ......     sgn(cn) 0 ··· 0011 0 ··· 0 0 ··· 0 0 ··· 0  | {z } n−k0+1 where we assume that the first row has n − k0 + 1 ones on the X part for simplicity and the last n − k0 rows are restricted to this form because of the commutation relations. (The case that more than one rows have multiple ones on the X part can be treated similarly.) Now if a T gate operates on one of the last k0 − 1 qubits, the situation is similar to the previous case and the number of Pauli frames triples. However, it is more complicated if many T gates operate on the first k0 + 1 qubits. We observe that when there are r T gates on the first k0 + 1 qubits, it is equivalent to apply T r on the first qubit. Since T 2 = S and T 4 = Z, the effect of these T gates on the first k0 + 1 qubits is equivalent to at most one T gate followed by a Clifford gate, and consequently the number of Pauli frames either remains the same or triples.

Remark: The above lemma says that the output state |ψi of a T -depth one quantum circuit on input a computational basis vector can be represented by a pseudomixture of 3k stabilizer states (k ≤ n), which share n + k independent Pauli generators up to a phase −1. Among the n + k independent Pauli generators, 2k of them are symplectic partners, say gn−k+1, hn−k+1, . . . , gn, hn, and are primary symplectic stabilizers. The remaining n−k operators, say g1, . . . , gn−k, stabilize all the component stabilizer states and will be called isotropic stabilizers. Note that two primary symplectic stabilizers are equivalent up to a product of the isotropic stabilizers. The following is the set of all the stabilizers of the 3k stabilizer states up to a phase −1: ⊗n ⊗n ⊗n hg1, . . . , gn−ki × {I , gn−k+1, hn−k+1} × {I , gn−k+2, hn−k+2} × · · · × {I , gn, hn}.

Here the set product is defined by {x1, . . . , xm} × {y1, . . . , yl} = {x1y1, x1y2, . . . , x1yl, x2y1, . . . , xmyl}. Without loss of generality, the T -depth one output state |ψi admits the following stabilizer pseudomixture X |ψihψ| = βj|φjihφj|, (7) j∈{1,2,3}k Qk where βj = i=1 αji and φj is stabilized by gn−k+i if ji = 1, −gn−k+i if ji = 2, or hn−k+i if ji = 3, for i = 1, . . . , k. √ Example 3. T ⊗ I(|00i + |11i)/ 2 has an expanded Pauli frame generated by two primary symplectic stabilizers {XX,XY } and an isotropic stabilizer ZZ. 2 n Example 4. If C1|0 i is a graph state, then its Pauli frame has full X-rank. 2 √ √ Example 5. T ⊗ T ⊗ I(|000i + |111i)/ 2 = S ⊗ I ⊗ I(|000i + |111i)/ 2, which is a stabilizer state. 2 Example 6. The single-qubit state THT |+i is not a T -depth one output state, and it has a pseudomixture of five stabilizer 2 states: α1|0ih0| + α2|1ih1| + α3α1| + iih+i| + α3α2| − iih−i| + α3|−ih−|. 2 For classical simulation of such a quantum circuit, it can be done by simulating each stabilizer state and linearly combining the 3k outputs [30]. The central idea of our learning method is to reverse the above simulation process. However, the task of identifying states is more difficult since we do not have the 3k Pauli frames to start with, but only with several copies of the final state. In the following section we will provide an algorithm to derive an effective quantum circuit that maps the all-zero state to the state corresponding to the unknown 3k Pauli frames for k = O(plog(n)).

V. LEARNING QUANTUM CIRCUITS OF CERTAIN MAGIC A. Efficiently Learning T -depth one output states with input computational basis states In this section we study learning of the output of an unknown quantum circuit U of some T gates, given oracle access ∗ to OU , on input a computational basis state |0ni. We make an additional assumption that the conjugate oracle OU is also 12 available since this will simplify the learning task. In the next section, we will show that this assumption can be removed at an additional cost. Suppose U is a T -depth one quantum circuit. Let |ψi = U|0ni be the target quantum state. Lemma 12 indicates that the state |ψi = U|0ni is a pseudo mixture of at most 3k stabilizer states, which have at most 2n primary symplectic stabilizers. Consequently, one can identify |ψi by finding its primary symplectic stabilizers. Lemma 4 says that one can learn a stabilizer, up to a phase, of a stabilizer state by a Bell measurement. In the following Lemma 13, we analyze the outcomes of Bell measurements on T -depth one output states. P 2n Lemma 13. Suppose |ψihψ| = j∈{1,2,3}k βj|φjihφj| is a T -depth one output state as defined in Eq. (7). Let r ∈ {0, 1} be the outcome of a joint Bell measurement on |ψ∗i ⊗ |ψi.

1) If (±)σr is not a stabilizer of any of the |φjihφj|, the Bell measurement returns r with zero probability. n 2) If (±)σr is an isotropic stabilizer, the Bell measurement returns outcome r with probability 1/2 . 1 3) If (±)σr is a primary symplectic stabilizer, the Bell measurement returns outcome r with probability 2n+1 . 1 4) if (±)σr is a product of m primary symplectic stabilizers, the Bell measurement returns outcome r with probability 2n+m . Proof. The outcome of a joint Bell measurement on |ψ∗i ⊗ |ψi is r ∈ {0, 1}2n with probability 2

⊗n ∗ 2 1 X hΦ+| (I ⊗ σr)|ψ i|ψi = βjhφj|σr|φji . 2n j

1) If (±)σr is not a stabilizer of any |φjihφj|, then for each |φji, there exists a stabilizer g ∈ Pn of |φji such that gσr = −σrg I⊗n+g I⊗n−g and thus hφj|σr|φji = hφj|σr 2 |φji = hφj| 2 σr|φji = 0. Therefore, the Bell measurement returns r with zero probability. 2) If (±)σr is an isotropic stabilizer, hφj|σr|φji = 1 for all j and then the Bell measurement returns outcome r with probability 1/2n. 3) If (±)σr is a primary symplectic stabilizer, say hn−k+1, then it will stabilize exactly 1/3 of the states; σr’s symplectic partner, say gn−k+1, will stabilize another 1/3; and −gn−k+1 will stabilize the other 1/3. Only the terms stabilized by σr have contribution to the probability and they sum to α3. Thus 2 2

1 X 1 X 1 2 1 βjhφj|σr|φji = βjhφj|σr|φji = α = > 0. 2n 2n 2n 3 2n+1 k k j∈{1,2,3} j∈{1,2,3} ,j1=3

4) Similarly, if (±)σr is a product of m primary symplectic stabilizers, say hn−k+1hn−k+2 ··· hn−k+m, then 2 2

1 X 1 X 1 2m 1 βjhφj|σr|φji = βjhφj|σr|φji = α = > 0. 2n 2n 2n 3 2n+m k k j∈{1,2,3} j∈{1,2,3} ,j1=···=jm=3

Remark: the Bell measurement returns a primary symplectic stabilizer, up to a phase, with higher probability than a product of some primary symplectic stabilizers. In the previous discussion, we assumed the availability of copies of the conjugate state |ψ∗i of a T -depth one output state |ψi of U on input |0ni. If copies of the conjugate state |ψ∗i are not available, it can be very expensive to construct |ψ∗i using OU [23]. In the following, we prove a lemma for Bell measurement on two copies of a T -depth one output state, which is similar to Corollary 5 for stabilizer states. P Lemma 14. Suppose |ψihψ| = j∈{1,2,3}k βj|φjihφj| is a T -depth one output state as deﬁned in Eq. (7). Then there exists 2n r0 ∈ {0, 1} such that a joint Bell measurement on |ψi ⊗ |ψi returns outcome r with probability |hψ|σ |ψ∗i|2 |hψ|σ |ψi|2 r = r⊕r0 . 2n 2n ∗ Proof. Suppose that |ψi has an expanded Pauli frame generated by g1, . . . , gn, hn−k+1, . . . , hn ∈ Pn. Thus |ψ i has an ∗ ∗ ∗ ∗ ∗ expanded Pauli frame generated by g1 , . . . , gn, hn−k+1, . . . , hn, where gi = gi if the number of its Pauli component Y is ∗ ∗ even, and gi = −gi, otherwise. Similarly, hi = ±hi. We consider two cases that whether there exists an isotropic stabilizer that is equal to its conjugate. First, suppose that one ∗ ∗ ∗ isotropic stabilizer g1 is such that g1 = −g1. We may assume that gi = gi for i = 2, . . . , n and hi = hi for i = n−k+1, . . . , n. ∗ ⊗n ⊗n Therefore, |φj i is stabilized by operators in h−g1, g2, . . . , gn−ki × {I , gn−k+1, hn−k+1} × {I , gn−k+2, hn−k+2} × · · · × 13

⊗n ∗ 2n {I , gn, hn}. Consider |φ11···1i, which is stabilized by −g1, g2, . . . , gn. Let h1 = σr0 for some r0 ∈ {0, 1} be a symplectic partner of g1 such that the commutation relations (2) hold. Then we have ∗ |φ11···1i = h1|φ11···1i since h1|φ11···1i is also stabilized by −g1, g2, . . . , gn. Similarly, we can show that ∗ ∗ † k |φj ihφj | = h1|φjihφj|h1 for all j ∈ {1, 2, 3} . This implies that ∗ ∗ † |ψ ihψ | = h1|ψihψ|h1. Consequently, a joint Bell measurement on |ψi ⊗ |ψi returns outcome r ∈ {0, 1}2n with probability

⊗n 2 1 ∗ ∗ † hΦ+| (I ⊗ σr)|ψi|ψi = hψ|σr|ψ ihψ |σ |ψi 2n r 1 = tr(|ψihψ|σ |ψ∗ihψ∗|σ ) 2n r r 1 = tr |ψihψ|σ h |ψihψ|h†σ 2n r 1 1 r |hψ|σ |ψi|2 = r⊕r0 . 2n ∗ ∗ Now suppose that gi = gi for i = 1, . . . , n − k. Let G = {i : n − k + 1 ≤ i ≤ n, gi = −gi} and H = {i : n − k + 1 ≤ ∗ i ≤ n, hi = −hi}. Let Y Y σr0 = hi gl. (8) i∈G l∈H ∗ Consider |φj i with j = j1j2 ··· jk. We have    † ∗ ∗ (a) Y Y Y Y |φj ihφj | =  hi gl |φjihφj|  hi gl

i∈G, ji=1,2 l∈H, jl=3 i∈G, ji=1,2 l∈H, jl=3 (b) =σ |φ ihφ |σ† j ∈ {1, 2, 3}k. r0 j j r0 for all Equality (a) is because that the Pauli operator Q h Q g is used to modify the phases of the stabilizers i∈G, ji=1,2 i l∈H, jl=3 l ∗ of |φji so that the modiﬁed state has the same stabilizers as |φj i. Next, for i ∈ G and ji = 3, hi is a stabilizer of |φji and similarly, for l ∈ H and jl = 1, 2, ±gl is a stabilizer of |φji. Hence equality (b) holds. Following the same steps as above, we 2 2n |hψ|σr⊕r0 |ψi| can show that a joint Bell measurement on |ψi ⊗ |ψi returns outcome r ∈ {0, 1} with probability 2n .

Lemma 4 and Lemma 14 suggests that a Bell measurement on |ψi ⊗ |ψi returns an outcome that corresponds to a stabilizer of its component states, up to a phase, times a fixed Pauli operator. Therefore, we can find a set of generators 0 0 0 0 0 0 ∗ g1, g2, . . . , gn, hn−k+1, hn, . . . , hk by Bell sampling on |ψi ⊗ |ψ i for sufficiently many times according to Lemma 13 and 0 0 0 0 0 Lemma 14 so that the 2k target primary symplectic stabilizers can be generated from g1, g2, . . . , gn, hn−k+1, . . . , hn. P Lemma 15. Suppose |ψihψ| = j∈{1,2,3}k βj|φjihφj| is a T -depth one output state as defined in Eq. (7). Performing a Bell measurement on |ψi ⊗ |ψi and repeating 8n + 1 times, one can identify a set of n + k independent generators with probability at least 1 − 4−n.

Proof. Suppose the expanded Pauli frame has 2k primary symplectic stabilizers gn−k+1, . . . , gn, hn−k+1, . . . , hn and n − k isotropic stabilizers g1, . . . , gn−k. Since the joint Bell measurement on |ψi ⊗ |ψi does not reveal the correct phase of a stabilizer, we do not have to discuss this phase. The Bell measurement returns an outcome corresponding to a Pauli operator ⊗n ⊗n ⊗n in σr0 × hg1, . . . , gn−ki × {I , gn−k+1, hn−k+1} × {I , gn−k+2, hn−k+2} × · · · × {I , gn, hn}. Setting the ﬁrst outcome as a reference, the remaining 8n samples lie in ⊗n ⊗n ⊗n hg1, . . . , gn−ki × {I , gn−k+1, hn−k+1} × {I , gn−k+2, hn−k+2} × · · · × {I , gn, hn}. k n−k k−1 n−k These outcomes have a total of 3 × 2 possibilities, of which 3 × 2 outcomes are related to hn, that is, each of the outcome is a product of hn and some other generators, such as hn, hngn−1, hnhn−2, . . . , hnhn−1 ··· hn−k+1. The probability 14 of obtaining these outcomes in the modiﬁed outcome is n−1 X n − 1 1 1 2i = . i 2n+1+i 4 j=0 8n k n−k n Thus the probability that 8n Bell measurement outcomes are not related to hn is (3/4) . Since there are 3 × 2 ≤ 3 distinct Pauli outcomes and the probability of obtaining each outcome is no larger than 1/4, the probability that the 8n outcomes do not have n + k independent generators is upper bounded by 3n × (3/4)8n ≤ 4−n.

From Lemma 15, one can find a generating set that contains the 2k primary symplectic stabilizers and n − k isotropic stabilizers. Unfortunately, we do not know any efficient method to find these 2k primary symplectic stabilizers and n − k k 2 2k 3 < 32k isotropic stabilizers. The number of possibilities√ of primary symplectic stabilizers is bounded by 2k . This seems to suggest that we can handle only O( log n) T gates by brute force. However, in the following we will show that k = O(log n) T gates can be handled. Before we show how to determine whether a set of 2k symplectic partners are our target primary symplectic stabilizers, we need the following lemma, which generalizes the idea of measuring a Pauli operator on a stabilizer state. P Lemma 16. Suppose |ψihψ| = j∈{1,2,3}k βj|φjihφj| is a T -depth one output state as defined in Eq. (7). Then 1) If g ∈ Pn is not a stabilizer of any of the |φjihφj|, then measuring g on |ψi returns outcome +1 (−1) with probability 1/2 (1/2).

2) If g is an isotropic stabilizer, then measuring g on |ψi returns outcome +1 with probability 1. √ g g |ψi +1 2+ 2 3) If is a primary symplectic√ stabilizer, then measuring on returns outcome with probability 4 and outcome 2− 2 −1 with probability 4 . 4) If g is a product of m primary symplectic stabilizers, then measuring g on |ψi returns outcome +1 with probability 1 −m/2 1 −m/2 2 (1 + 2 ) and outcome −1 with probability 2 (1 − 2 ).

Proof. 1) Consider g ∈ Pn but g does not stabilize any of the |φji. For each |φji, there exists gj such that ggj = −gjg. Then measuring g on |ψihψ| returns outcome +1 with probability I⊗n + g X I⊗n + g Pr(+1) = tr |ψihψ| = β tr |φ ihφ | 2 j 2 j j j=1 X I⊗n + g X I⊗n − g = β tr g |φ ihφ | = β tr |φ ihφ | , j 2 j j j j 2 j j j j which is, by deﬁnition, Pr(−1). Thus Pr(+1) = Pr(−1) = 1/2. P I+g 2) Consider g ∈ Pn and g stabilizes all of the |φji. Thus Pr(+1) = j βjtr 2 |φjihφj| = 1. If −g stabilizes all of the |φji, then measuring g on |ψihψ| returns outcome −1 with probability one and we know that −g is a stabilizer. 3) According to the assumption, we may say that g is a primary symplectic partner, say g = hn−k+1, that stabilizes exactly 1/3 of the states {|φji}, g’s symplectic partner, say gn−k+1, will stabilize another 1/3 of {|φji}, and −gn−k+1, will stabilize the other 1/3 of {|φji}. Then X I + g X I + g X I + g Pr(+1) = β tr |φ ihφ | + β tr |φ ihφ | + β tr |φ ihφ | j 2 j j j 2 j j j 2 j j j:j =3 j:j =1 j:j =2 1 1 √ 1 1 1 2 + 2 =α + (1 − α ) = α + α = . 3 2 3 1 2 3 4 4) Similarly, 1 1 Pr(+1) =αm + (1 − αm) = (1 + αm). 3 2 3 2 3

Therefore, by measuring a Pauli operator O(1/) times for some accuracy > 0, we can determine whether it is an isotropic stabilizer or a primary stabilizer from the distribution of the measurement outcomes. Given n − k isotropic stabilizers g1, . . . , gn−k and 2k primary symplectic stabilizers gn−k+1, . . . , gn, hn−k+1, . . . , hn ∈ Pn satisfying the commutation relations (2), one can ﬁnd an effective circuit decomposition that generates the corresponding T - depth one output state. The complete algorithm for learning the output state of a T -depth one quantum circuit on input |0ni 15 is given in Algorithm 2 belowe. Note that Step (6) follows from Table II. In summary, we have the following theorem of learning unknown T -depth one output states.

Algorithm 2: Learning the output state of a T -depth one quantum circuit U on |0ni Input: O(n) |0ni states, oracle U Output: a quantum circuit that generates |ψi = U|0ni on input |0ni n (1) Prepare O(3kn) copies of the unknown stabilizer state |ψi ∈ C2 by querying to U. 0 2n 0 0 (2) Do 8n + 1 Bell measurements on |ψi ⊗ |ψi and let the outcomes be ri ∈ {0, 1} for i = 0,..., 8n. Let ri = rir0 for i = 1,..., 8n. 0 0 0 0 (3) Do a Gaussian elimination on σri to ﬁnd k + n independent generators, say {g1, . . . , gn, hn−k+1, . . . , hn}, satisfying the 0 0 commutation relations (2). Then {g1, . . . , gn−k} are a set of independent generators for the isotropic stabilizers of the underlying expanded Pauli frame. ⊗n ⊗n ⊗n (4) For each operator g in {I , gn−k+1, hn−k+1} × {I , gn−k+2, hn−k+2} × · · · × {I , gn, hn}, do the following: • Measure g on |ψi 3200n times and obtain a probability distribution. • Use Lemma 16 to determine whether g is a primary symplectic stabilizer. • If a total of 2k primary symplectic stabilizers are found, halt.

We end up with 2k primary symplectic stabilizers {gn−k+1, hn−k+1, . . . , gn, hn}. † (5) Use Lemma 8 to ﬁnd a Clifford circuit C such that CXiC = gi for i = 1, . . . , n − k and † † {CXjC ,CYjC } = {gj, hj}, {gj, −hj}, {−gj, hj}, or {−gj, −hj} for j = n − k + 1, . . . , n. n (6) Let s ∈ {0, 1, 2, 3} with si = 0 for i = 1, . . . , n − k. For i = n − k + 1, . . . , n, † † • if {C giC,C hiC} = {Xi,Yi}, si = 0; † † • if {C giC,C hiC} = {−Xi,Yi}, si = 1; † † • if {C giC,C hiC} = {−Xi, −Yi}, si = 2; † † • if {C giC,C hiC} = {Xi, −Yi}, si = 3; (7) Output the circuit C ◦ I⊗n−k ⊗ T ⊗k ◦ Ss ◦ H⊗n.

Theorem 17. Given access to an unknown T -depth one quantum circuit U, one can learn a circuit description using O(3kn) queries to the unknown circuit U with time complexity O(n3 + 3kn), where k ≤ n is the number of T gates, so that the produced hypothesis circuit Uˆ is equivalent to U with probability at least 1 − 3e−n when the input states are restricted to the computational basis. Proof. By Lemma 15, we know that step (3) of Algorithm 2 fails with probability at most 4−n. In step (4) of Algorithm 2, we have to determine whether an operator g is a primary symplectic stabilizer or not. According to Lemma 16, we have to distinguish the probability distribution of measuring a primary symplectic stabilizer from the other three cases. Assume that g is a primary symplectic stabilizer for simplicity. The distribution of measuring√ the product of two primary symplectic 3 δ = 2−1 R stabilizers has mean 4 so that these two distributions have the smallest gap of 4√ . Let denote the average of the 2+ 2 3200n measurement outcomes of g (see Step (4) of Algorithm 2), hence E {R} = 4 when g is a primary symplectic stabilizer. Using the standard Chernoff bound,

−3200n×δ2/16 −2.14n Pr{|R − E {R}| ≥ δ/2} ≤ 2e = 2e . We repeat this process for at most 3k times. By the union bound, the error rate of step (4) is at most 3k2e−2.14n ≤ 2e−n. Therefore the total error rate is bounded by 4−n + 2e−n ≤ 3e−n, which completes the proof. Example 7. Consider the following T -depth one circuit:

The output state |ψi has an expanded Pauli frame generated by primary symplectic stabilizers {ZX,ZY,XZ,YZ}. Possible Bell measurement outcomes on |ψ∗i ⊗ |ψi and their respective measurement probabilities from Lemma 13 and Lemma 16 are given in the following table: 16

g II XX XY XZ YX YY YZ ZX ZY Prob. Bell meas. 1/4 1/16 1/16 1/8 1/16 1/16 1/8 1/8 1/8 √ √ √ √ 2+ 2 2+ 2 2+ 2 2+ 2 Prob. Pauli meas. with +1 1/2 3/4 3/4 4 3/4 3/4 4 4 4

Similarly, possible Bell measurement outcomes on |ψi ⊗ |ψi are given in the following table: Since (ZY )∗ = −ZY and (YZ)∗ = −YZ, by Lemma 14 and Eq. (8), the measurement outcomes are shifted by ZX · XZ = YY , as can be seen from the two tables. g YY ZZ ZI ZX IZ II IX XZ XI Prob. Bell meas. 1/4 1/16 1/16 1/8 1/16 1/16 1/8 1/8 1/8 √ √ √ √ 2+ 2 2+ 2 2+ 2 2+ 2 Prob. Pauli meas. with +1 1/2 3/4 3/4 4 3/4 3/4 4 4 4

Assume that after performing Bell measurements on |ψi ⊗ |ψi for many times, one determines two pairs of symplectic partners {YX,YZ} and {XY,ZY }. Thus we check all the operators in {II,YX,YZ} × {II,XY,ZY } = {II,YX,YZ,XY,ZZ,ZX,ZY,XZ,XX} and we can determine that {ZX,ZY } and {XZ,YZ} are primary symplectic stabilizers by using Pauli measurements as in Lemma 16. The remaining steps are straightforward and are omitted. The output circuit is shown in the following ﬁgure.

Example 8. Consider a T -depth one output state deﬁned by primary symplectic stabilizers g1 = Y Z, g2 = ZY, h1 = ∗ ∗ −Y X, h2 = −XY , where gi = −gi and hj = −hj. By Lemma 14 and Eq. (8), the outcome distribution of Bell measurements ∗ on |ψi ⊗ |ψi is shifted by σr0 = g1g2h1h2 = YY from the outcome distribution of Bell measurements on |ψ i ⊗ |ψi. 2 In fact, the output state of a circuit of T -depth n on input |0ni may be learned by Algorithm 1 as long as it is equivalent to a T -depth 1 output state. Example 9. The following circuit is of T -depth 2 and the circuit output on input |0ni can be learned by Algorithm 1. This

can be understood as the circuit on input |00i is equivalent to the circuit in the previous example. 2

VI.DISCUSSION In this paper, we studied the problem of learning unknown quantum circuits composed of Clifford circuits possibly combined with some T gates. When the underlying target circuit is an n-qubit Clifford Cn, we can identify the unknown target by using 2 O(n ) queries to Cn. The novelty of our result is that our algorithm exactly generates a circuit representation for the target, rather than demonstrating the existence of a unique circuit corresponding to the query outcomes. We emphasize this step is non-trivial since it requires a crucial method for circuit synthesis. As a result, we are able to predict the future output by sending an arbitrary input state to the proposed circuit. Furthermore, our approach does not require querying the conjugate † circuit Cn since to the best of our knowledge, no efficient way of generating such a conjugate circuit is known [23]. If the unknown target is a quantum circuit of T -depth one and at most O(log n) T gates, we show that O(n2) queries to the circuit are sufficient to reconstruct the output state when the input is given by the all-zero state. The key ingredient is a novel expanded stabilizer formalism that allows us to trace the evolution of the expanded Pauli frame. Again, we do not require accessing to the conjugate circuit. Whether any quantum circuit of T depth-one (e.g. with k ≤ n many T gates) is efficiently learnable is still open. However, from our analysis, we do not expect that will be true. Another interesting open problem is that how to obtain its circuit representation with an arbitrary input state. 17

ACKNOWLEDGEMENT CYL thanked Kai-Min Chung, Kao-Yueh Kuo, and Yingkai Ouyang for helpful discussions. CYL was supported from the Young Scholar Fellowship Program by the Ministry of Science and Technology (MOST) in Taiwan, under Grant MOST109-2636-E-009-004. HCC was supported partially from the Young Scholar Fellowship Program by the Ministry of Science and Technology (MOST) in Taiwan, under Grant MOST 109-2636-E-002-001, and partially from the Yushan Young Scholar Program of the Ministry of Education in Taiwan, under Grant NTU-109V0904.

REFERENCES [1] Z. Hradil, “Quantum-state estimation,” Physical Review A, vol. 55, no. 3, pp. R1561–R1564, mar 1997. [2] G. M. D’Ariano, M. G. Paris, and M. F. Sacchi, “Quantum tomography,” in Advances in Imaging and Electron Physics. Elsevier, 2003, pp. 205–308. [3] K. Banaszek, M. Cramer, and D. Gross, “Focus on quantum tomography,” New Journal of Physics, vol. 15, no. 12, p. 125020, dec 2013. [4] J. Haah, A. W. Harrow, Z. Ji, X. Wu, and N. Yu, “Sample-optimal tomography of quantum states,” IEEE Transactions on Information Theory, pp. 1–1, 2017. [5] L. G. Valiant, “A theory of the learnable,” in Proceedings of the sixteenth annual ACM symposium on Theory of computing - STOC ’84. ACM Press, 1984. [6] S. Aaronson, “The learnability of quantum states,” Proceedings of the Royal Society A: Mathematical, Physical and Engineering Sciences, vol. 463, no. 2088, pp. 3089–3114, dec 2007. [7] H.-C. Cheng, M.-H. Hsieh, and P.-C. Yeh, “The learnability of unknown quantum measurements,” Quantum Information and Computation, vol. 16, no. 7–8, pp. 0615–0656, 2016. [8] A. Rocchetto, S. Aaronson, S. Severini, G. Carvacho, D. Poderini, I. Agresti, M. Bentivegna, and F. Sciarrino, “Experimental learning of quantum states,” Science Advances, vol. 5, no. 3, p. eaau1946, mar 2019. [9] S. Aaronson, “Shadow tomography of quantum states,” SIAM Journal on Computing, vol. 49, no. 5, pp. STOC18–368–STOC18–394, jan 2020. [10] H.-Y. Huang and R. Kueng, “Predicting features of quantum systems using classical shadows,” 2019, arXiv:1908.08909. [11] K.-M. Chung and H.-H. Lin, “Sample efficient algorithms for learning quantum channels in PAC model and the approximate state discrimination problem,” 2018, arXiv:1810.10938. [12] M. A. Nielsen and I. L. Chuang, Quantum Computation and Quantum Information. Cambridge, UK: Cambridge University Press, 2000. [13] D. Gottesman, “Identifying stabilizer states,” 2008. [Online]. Available: http://pirsa.org/08080052 [14] A. Montanaro, Learning stabilizer states by Bell sampling, 2017. [15] A. Rocchetto, “Stabiliser states are efficiently PAC-learnable,” Quant. Inf. Comput., vol. 18, no. 7&8, pp. 541–552, 2018. [16] A. Holevo, “Bounds for the quantity of information transmitted by a quantum communication channel,” Problems of Information Transmission, vol. 9, no. 3, pp. 177—- 183, 1973. [17] I. L. Chuang and M. A. Nielsen, “Prescription for experimental determination of the dynamics of a quantum black box,” Journal of Modern Optics, vol. 44, no. 11-12, pp. 2455–2467, nov 1997. [18] J. F. Poyatos, J. I. Cirac, and P. Zoller, “Complete characterization of a quantum process: The two-bit quantum gate,” Physical Review Letters, vol. 78, no. 2, pp. 390–393, jan 1997. [19] M. Mohseni, A. T. Rezakhani, and D. A. Lidar, “Quantum-process tomography: resource analysis of different strategies,” Physical Review A, vol. 77, no. 3, mar 2008. [20] M. P. da Silva, O. Landon-Cardinal, and D. Poulin, “Practical characterization of quantum devices without tomography,” Physical Review Letters, vol. 107, no. 21, nov 2011. [21] D. Gottesman, “Theory of fault-tolerant quantum computation,” Physical Review A, vol. 57, no. 1, pp. 127–137, jan 1998. [22] R. A. Low, “Learning and testing algorithms for the clifford group,” Phys. Rev. A, vol. 80, p. 052314, Nov 2009. [23] J. Miyazaki, A. Soeda, and M. Murao, “Complex conjugation supermap of unitary quantum maps and its universal implementation protocol,” Phys. Rev. Research, vol. 1, p. 013007, Aug 2019. [24] D. Gottesman, “The Heisenberg representation of quantum computers,” in Group theoretical methods in physics. Proceedings, 22nd International Colloquium, Group22, ICGTMP’98, Hobart, Australia, July 13-17,1998, 1998, pp. 32–43. [25] A. Y. K. S. B. Bravyi, Quantum codes on a lattice with boundary, 1998. [26] S. Bravyi and A. Kitaev, “Universal quantum computation with ideal Clifford gates and noisy ancillas,” Phys. Rev. A, vol. 71, p. 022316, Feb 2005. [27] V. Kliuchnikov, D. Maslov, and M. Mosca, “Fast and efficient exact synthesis of single qubit unitaries generated by clifford and t gates,” Quantum Information and Computation, vol. 13, no. 7–8, pp. 607–630, 2013. [28] P. Selinger, “Efficient Clifford+T approximation of single-qubit operators,” Quantum Information and Computation, vol. 15, no. 1–2, pp. 159–180, 2015. [29] N. J. Ross and P. Selinger, “Optimal ancilla-free Clifford+T approximation of z-rotations,” Quantum Information and Computation, vol. 16, no. 11–12, pp. 901–953, 2016. [30] S. Bravyi, G. Smith, and J. A. Smolin, “Trading classical and quantum computational resources,” Phys. Rev. X, vol. 6, p. 021043, Jun 2016. [31] S. Bravyi and D. Gosset, “Improved classical simulation of quantum circuits dominated by clifford gates,” Phys. Rev. Lett., vol. 116, p. 250501, Jun 2016. [32] C. H. Bennett and S. J. Wiesner, “Communication via one- and two-particle operators on Einstein-Podolsky-Rosen states,” Phys. Rev. Lett., vol. 69, pp. 2881–2884, Nov 1992. [33] P. Selinger, “Quantum circuits of t-depth one,” Phys. Rev. A, vol. 87, p. 042302, Apr 2013. [34] M. Howard and E. Campbell, “Application of a resource theory for magic states to fault-tolerant quantum computing,” Phys. Rev. Lett., vol. 118, p. 090501, Mar 2017. [Online]. Available: https://link.aps.org/doi/10.1103/PhysRevLett.118.090501 [35] P. Rall, D. Liang, J. Cook, and W. Kretschmer, “Simulation of qubit quantum circuits via pauli propagation,” Phys. Rev. A, vol. 99, p. 062337, Jun 2019. [Online]. Available: https://link.aps.org/doi/10.1103/PhysRevA.99.062337 [36] J. Dehaene and B. De Moor, “Clifford group, stabilizer states, and linear and quadratic operations over GF(2),” Phys. Rev. A, vol. 68, p. 042318, Oct 2003. [37] M. V. den Nest, “Classical simulation of quantum computation, the Gottesman-Knill theorem, and slightly beyond,” Quant. Inf. Comput., vol. 10, no. 3&4, pp. 0258–0271, 2010. [38] S. Aaronson and D. Gottesman, “Improved simulation of stabilizer circuits,” Phys. Rev. A, vol. 70, p. 052328, Nov 2004. [39] D. Maslov and M. Roetteler, “Shorter stabilizer circuits via bruhat decomposition and quantum circuit transformations,” IEEE Trans. Inf. Theory, vol. 64, no. 7, pp. 4729–4738, July 2018. [40] Y.-C. Zheng, C.-Y. Lai, T. A. Brun, and L.-C. Kwek, “Constant depth fault-tolerant clifford circuits for multi-qubit large block codes,” Quantum Science and Technology, vol. 5, p. 045007, 2020. [41] K. N. Patel, I. L. Markov, and J. P. Hayes, “Optimal synthesis of linear reversible circuits,” Quant. Inf. Comput., vol. 8, no. 3&4, pp. 0282–0294, 2008. 18

[42] C. Moore and M. Nilsson, “Parallel quantum computation and quantum codes,” SIAM J. Comput., vol. 31, no. 3, pp. 799–815, 2002. [43] G.-Y. Kuo and C.-Y. Lai, “The encoding and decoding complexities of entanglement-assisted quantum stabilizer codes,” in Proc. IEEE Int. Symp. Inf. Theory, 2019, pp. 2893–2897. [44] D. Gottesman and I. L. Chuang, “Demonstrating the viability of universal quantum computation using teleportation and single-qubit operations,” Nature, vol. 402, pp. 390–393, 1999. [45] N.-H. Chia, K.-M. Chung, and C.-Y. Lai, “On the Need of Large Quantum Depth,” in Proceedings of the 52nd Annual ACM SIGACT Symposium on Theory of Computing (STOC 2020), June 2020, p. 902–915. [46] M. Coudron and S. Menda, “ Computations with greater quantum depth are strictly more powerful (relative to an oracle),” in Proceedings of the 52nd Annual ACM SIGACT Symposium on Theory of Computing (STOC 2020), June 2020, p. 889–901.