Efficient verification of Boson Sampling
Ulysse Chabaud1, Fr´ed´eric Grosshans1, Elham Kashefi1,2, and Damian Markham1,3
1Sorbonne Universit´e, CNRS, LIP6, F-75005 Paris, France 2School of Informatics, University of Edinburgh, 10 Crichton Street, Edinburgh, EH8 9AB 3JFLI, CNRS, National Institute of Informatics, University of Tokyo, Tokyo, Japan
The demonstration of quantum speedup, compelling evidence of quantum speedup, the ex- also known as quantum computational perimental requirements associated with such a supremacy, that is the ability of quan- demonstration preclude its realisation in the near tum computers to outperform dramati- future [9]. For that reason, various sub-universal cally their classical counterparts, is an im- models of quantum computing, such as Boson portant milestone in the field of quan- Sampling [10], have been introduced [11, 12, 13, tum computing. While quantum speedup 14, 15]. Beyond their conceptual relevance, these experiments are gradually escaping the models, although not believed to possess the regime of classical simulation, they still full computational power of a universal quantum lack efficient verification protocols and rely computer, enable the possibility of a demonstra- on partial validation. Here we derive tion of quantum speedup in the near term, under an efficient protocol for verifying with certain complexity-theoretic assumptions. Each single-mode Gaussian measurements the of these sub-universal models is associated with output states of a large class of continuous- a computational problem that the model solves variable quantum circuits demonstrating efficiently, but which is hard to solve for classical quantum speedup, including Boson Sam- computers. These computational problems are pling experiments, thus enabling a convinc- sampling problems, for which the task is to draw ing demonstration of quantum speedup random samples from a target probability distri- with photonic computing. Beyond the bution fixed by the model. In practice, any exper- quantum speedup milestone, our results imental implementation would suffer from noise also enable the efficient and reliable cer- and imperfections and would sample from an tification of a large class of intractable imperfect probability distribution which approx- continuous-variable multimode quantum imates the target one. Hence, the fact that even states. an approximate version of the sampling problem associated with a sub-universal model is hard for classical computers is crucial for an experimen- 1 Introduction tal demonstration of quantum speedup. For all models, such an approximate sampling hardness, Quantum information promises many technolog- which corresponds to the fact that a probabil- ical applications beyond classical information [1, ity distribution which has a small constant to- 2,3,4]. Shor’s famous factoring algorithm [5] has tal variation distance with the target probabil-
arXiv:2006.03520v4 [quant-ph] 23 May 2021 highlighted the possibility of spectacular quan- ity distribution is still hard to sample classically, tum advantages over classical computing. The comes at the cost of assuming some additional ability of quantum computers to greatly outper- reasonable—though unproven—conjectures. form their classical counterparts is referred to as “quantum computational supremacy” [6,7], or The experimental demonstration of quantum quantum speedup [8]. We use the latter termi- speedup thus involves: (i) a quantum device nology in this article. solving efficiently a sampling task which is prov- While a universal quantum computer factor- ably hard to solve for classical computers un- ing large products of primes would provide a der reasonable theoretical assumptions, together with (ii) a verification that the quantum de- Ulysse Chabaud: [email protected] vice indeed solved the hard task [7]. While
1 the former has been recently achieved with ran- concentrating probability distribution over an ex- dom superconducting circuits [16] and Gaussian ponentially large sample space. In particular, any Boson Sampling [17], the latter is still incom- efficient non-interactive verification of current plete and relying on various questionable assump- quantum speedup experiments with a verifier re- tions [18, 19, 20], and verification is a crucial stricted to classical computations requires addi- missing point for a convincing demonstration of tional cryptographic assumptions [25]. Existing quantum speedup. verification protocols for quantum speedup with a classical verifier either rely on little-studied as- The setting of verification involves two parties, sumptions [12, 26, 27], or induce an overhead for which in the language of interactive proof sys- the prover [24, 28, 29] which prevents a near-term tems are referred to as the prover and the verifier. use for an experimental demonstration of quan- The prover is conceived as a powerful, untrusted tum speedup. party, while the verifier is a trusted party with re- stricted computational power. The verifier asks Weaker but more resource-efficient methods of the prover to perform a computational task and verification with a classical verifier, which are verifies its correct behaviour, with possibly mul- sometimes referred to as validation [30], consist in tiple rounds of interaction. While this setting performing a partial verification where only spe- corresponds to a cryptographic scenario between cific properties of the experimental probability two parties, e.g., in the case of delegated comput- distribution are tested. For example, the verifier ing, it also embeds the notion of certification of may perform statistical tests using experimental a physical experiment, where the experiment be- samples [14, 16], compare the experimental prob- haves as the prover and the experimenter as the ability distribution with specific mock-up distri- verifier. Assumptions can be made on the prover, butions [31], or benchmark the individual compo- such as restricting its computational capabilities nents of the experimental setup. Ultimately, val- or assuming that it follows a specific behaviour. idation relies on making additional assumptions In the physical picture, this corresponds for exam- about the inner functioning of the quantum de- ple to choosing a noise model for an experiment. vice [32]. A common assumption is the so-called indepen- In order to avoid relying on such undesirable as- dently and identically distributed (i.i.d.) assump- sumptions, while keeping verification within near- tion, i.e., assuming that the output of the quan- term experimental reach, another way for per- tum experiment is the same at each run. Assum- forming verification is to allow the verifier to have ing i.i.d. behaviour for the prover leads to more minimal quantum capabilities. In that context, efficient verification protocols, and this assump- the purpose of the verifier is to obtain a reliable tion can usually be removed using cryptographic bound on the trace distance between the output techniques at the cost of an increased number of state produced by the prover and the ideal target runs in the protocol [21, 22]. We use the language state, which in turn implies a bound on the dis- of interactive proof systems in what follows, but tance between the tested and target probability we emphasise that our results are not restricted distributions of the samples [33]. This can done to that particular context and are relevant espe- by obtaining, e.g., an estimate of the fidelity with cially in experimental scenarios. There has been the target state, or a fidelity witness, i.e., a tight much work done on verification of universal quan- lower bound on the fidelity [34]. tum computation [23, 22, 24], much less when In the context of quantum computing in finite- the verification is limited to sub-universal mod- dimensional Hilbert spaces [33], this minimal els. We now briefly review the state of affairs in quantum capability corresponds to being only this direction. able to prepare single-qubit or qudit states or A verification protocol for a quantum speedup to perform local measurements. Protocols for experiment should guarantee the closeness in to- verification of Instantaneous Quantum Polyno- tal variation distance between the experimental mial time circuits [12] with these minimal require- probability distribution and the target probabil- ments have been derived under the i.i.d. assump- ity distribution [7]. Such a verification is espe- tion with single-qubit states [35] or with local cially difficult because of the nature of the compu- measurements [36] and more recently without the tational task at hand, i.e., sampling from an anti- i.i.d. assumption with single-qubit states [37] or
2 with local measurements [38].
↵
pling and related sub-universal models [10, 40, ⇢
3 distance between the experimental and target probability distributions for any observable, ef- - ficiently in the number of modes and input pho- tons, thus enabling a convincing demonstration of quantum speedup with photonic quantum com- puting. Moreover, the verification protocol is im- plemented within the same experimental setup, LO simply by replacing the output detectors by bal- anced heterodyne detection. We also optimise ⇠
⇢
4 (p) the unbalalancing parameter is related to the op- The functions z 7→ gk,l (z, η) are polynomials mul- T tical setup by r = | log R |, where T and R are tiplied by a converging Gaussian function and are the reflectance and transmittance of the unbal- thus bounded over C. Using these functions, we anced beam splitter, respectively, with θ being derive the following result: the phase of the local oscillator [43]. Lemma 1. Let p ∈ N∗, let k, l ∈ N and let 0 < With these properties of heterodyne detection p+1 P+∞ η ≤ √ . Let ρ = ρij |iihj| be laid out, we detail in the following section our p (k+p+1)(l+p+1) i,j=0 single-mode fidelity estimation protocol based on a single-mode density operator. Then, heterodyne detection. v u ! ! (p) pu k + p l + p ρkl − E [gk,l (α, η)] ≤ η t , α←Qρ k l 4 Single-mode fidelity estimation (7) (p) Normalised single-mode pure quantum states where the function gk,l is defined in Eq. (6). with bounded support over the Fock basis are re- We give a proof in AppendixA. In particular, ferred to as core states [61, 62]. In what follows, since heterodyne detection corresponds to sam- we introduce a protocol for estimating the fidelity pling from the Husimi Q function of the mea- of any single-mode continuous-variable (mixed) sured state, this result enables estimating an el- quantum state with any target core state using ement k, l of the density matrix from samples of heterodyne detection, by generalising heterodyne heterodyne detection by computing the mean of fidelity estimates from [57, 58]. We give two ver- (p) the function z 7→ g (z, η) over these samples. sions of our protocol, with and without the i.i.d. k,l These heterodyne estimates generalise both the assumption. ones introduced in [57], which we retrieve in the We denote by E [f(α)] the expected value α←D limit η → 1 and for which an assumption on the of a function f for samples drawn from a dis- size of the support of the measured state is nec- tribution D. Let us introduce for k, l ≥ 0 the essary, and the ones introduced in [58], which we polynomials retrieve by setting p = 1 and which yield less
k+l k+l efficient estimates. zz∗ (−1) ∂ −zz∗ Lk,l(z) = e √ √ e Additionnally, for any core state |Ci = k! l! ∂zk∂z∗l Pc−1 ∗ ∗ n=0 cn |ni where c ∈ N , defining for all p ∈ N , min (k,l) √ √ k! l!(−1)p all 0 < η < 1 and all z ∈ C, = X zl−pz∗k−p, p!(k − p)!(l − p)! p=0 (p) X ∗ (p) gC (z, η) := ckcl gk,l (z, η), (8) (4) 0≤k,l≤c−1 for z ∈ C, which are, up to a normalisation, the Laguerre 2D polynomials appearing in the ex- computing the mean of the function z 7→ (p) pression of quasiprobability distribution of Fock gC (z, η) over samples from heterodyne detection states [63]. Following [58], for all k, l ∈ N, we of a state allows us to estimate the fidelity of the introduce with these polynomials the functions measured state with the core state |Ci. Based on this result, we now present the ver- ! 1 1− 1 zz∗ z sion of our single-mode fidelity estimation proto- fk,l(z, η) = e η Ll,k √ , (5) 1+ k+l η 2 η col under i.i.d. assumption and discuss afterwards its version without i.i.d. assumption: for all z ∈ C and all 0 < η < 1. Now let us define, for all p ∈ N∗, all z ∈ C and all 0 < η < 1, the Protocol 1 (Single-mode fidelity estimation). ∗ Pc−1 generalised functions: Let c ∈ N and let |Ci = n=0 cn |ni be a core state. Let also N,M ∈ N∗, and let p ∈ N∗ and p−1 0 < η < 1 be free parameters. Let ρ⊗N+M be (p) X j j gk,l (z, η) := (−1) η fk+j,l+j(z, η) N +M copies of an unknown single-mode (mixed) j=0 quantum state ρ. v (6) u ! ! u k + j l + j × t . 1. Measure N copies of ρ with heterodyne detec- k l tion, obtaining the samples α1, . . . , αN ∈ C.
5 2. Compute the mean FC (ρ) of the function verifier may want to use some copies of the state (p) to perform fidelity estimation of the remaining z 7→ gC (z, η) (defined in Eq. (8)) over the samples α1, . . . , αN ∈ C. M copies, before using these remaining states for subsequent quantum information processing. In M 3. Compute the fidelity estimate FC (ρ) . that context, the i.i.d assumption may no longer M be justified: the quantum state sent by the prover The value FC (ρ) obtained is an estimate of the ρN+M over N + M subsystems may no longer be fidelity between the M remaining copies of ρ and of the form ρ⊗N+M , as all subsystems can pos- M copies of the target core state |Ci. The effi- sibly be entangled with each other (as well as ciency of the protocol is summarised by the fol- with other quantum systems on the side of the lowing result: prover). Hence, we extend Protocol1 to a ver- Theorem 1. Let , δ > 0. With the notations of sion which does not make the i.i.d. assumption, M Protocol1, the estimate FC (ρ) is -close to the using a de Finetti reduction from [65, 58]. The fidelity F (|Ci⊗M , ρ⊗M ) with probability 1 − δ for non-i.i.d. version of Protocol1 obtained is nearly identical, up to slight differences in the classical 2+ 2c ! M p 1 post-processing: a small fraction of the measured N = O log . (9) δ subsystems have to be discarded at random and another fraction of the samples are used for an en- We give a detailed version of the theorem to- ergy test. This comes at the cost of an increased gether with its proof in AppendixB, which com- number of measurements which corresponds how- bines Lemma1 with Hoeffding’s inequality [64]. ever to a polynomial overhead for a polynomial ∗ Since the parameter p ∈ N may vary freely, precision and confidence. We give a detailed anal- the scaling can be brought arbitrarily close to ysis in AppendixC. M 2 1 N = O(( ) log( δ )). In practice, since the con- stant prefactor increases with p, an optimisation yields the optimal choice for p which minimises N 5 Multimode fidelity witness estima- when M, and δ are fixed. Moreover, the choice tion of the other free parameter 0 < η < 1 contributes to minimising the constant prefactor and the effi- In this section, we extend our single-mode fidelity ciency of Protocol1 can also be refined by taking estimation protocol from the previous section to into account the expression of the single-mode the multimode case, and we show that being target core state in the Fock basis. able to estimate single-mode fidelities with het- Hence, Protocol1 gives a reliable and efficient erodyne detection is sufficient to estimate tight way of estimating the fidelity of an unknown fidelity witnesses, i.e., tight lower bounds on the single-mode continuous-variable quantum state fidelity, for the large class of multimode states in with any target core state. These core states Eq. (1). play an important role in the characterisation Note that the transformation in Eq. (1) can al- of single-mode non-Gaussian states [62]. Addi- ways be expressed as Sˆ(ξ)Dˆ(β) Uˆ, where ξ, β ∈ tionnally, they form a dense subset (for the trace Cm, since single-mode Gaussian unitaries can be norm) of the set of normalised single-mode pure decomposed as a displacement and a squeezing quantum states. Hence, given any target nor- with complex parameter [60]. Note also that an malised single-mode pure state |ψi, we can use m-mode passive linear transformation Uˆ is asso- our fidelity estimation protocol by targeting in- ciated with an m × m unitary matrix U which stead a truncation of the state |ψi in the Fock describes its action on the creation and annihila- basis in order to estimate the fidelity of any tion operators of the modes [48]. single-mode continuous-variable quantum state Our extension to the multimode case is based with the state |ψi using heterodyne detection. on two observations (Lemmas2 and3 hereafter). In an experimental scenario, one may set M = Firstly, if all the single-mode subsystems ρi of 1 in Protocol1 and deduce information about a multimode quantum state ρ are close enough the output state of a single run of the exper- to single-mode pure states, then ρ is close to the iment. In a cryptographic scenario, where the tensor product of these single-mode pure states. state ρ is provided by an untrusted prover, the Formally:
6 Lemma 2. Let ρ be a state over m subsys- homomorphic encryption of linear optics quan- tems. For all i ∈ {1, . . . , m}, we denote by tum computation [66], which allows one to ap- ρi = Tr{1,...,m}\{i}(ρ) the reduced state of ρ over ply a unitary symmetrization at the level of th the i subsystem. Let |ψ1i ,..., |ψmi be pure the classical samples rather than directly on the states. For all i ∈ {1, . . . , m}, we write quantum state [67]. In particular, for such a transformation Vˆ , if a multimode pure product m Nm X state i=1 |ψii can be efficiently verified using W := 1 − (1 − F (ρi, ψi)), (10) i=1 balanced heterodyne detection, then the state ˆ Nm V i=1 |ψii can be efficiently verified using unbal- where F is the fidelity, and |ψi = |ψi1⊗· · ·⊗|ψim. anced heterodyne detection by post-processing Then, classically the samples obtained. This leads us to our multimode fidelity witness 1 − m(1 − F (ρ, ψ)) ≤ W ≤ F (ρ, ψ). (11) estimation protocol. Like for Protocol1, we give the version of our protocol under i.i.d. assump- We give a proof in AppendixD. This result shows tion, and discuss afterwards its version without that W is a tight lower bound on the fidelity. Im- i.i.d. assumption: portantly, this fidelity witness is only a function of the single-mode fidelities. In particular, being Protocol 2 (Multimode fidelity witness esti- ∗ able to estimate single-mode fidelities with single- mation). Let c1, . . . , cm ∈ N . Let |Cii = Pci−1 mode pure states using balanced heterodyne de- n=0 ci,n |ni be a core state, for all i ∈ tection is enough to estimate fidelity witnesses {1, . . . , m}. Let Uˆ be an m-mode passive lin- with pure product states using balanced hetero- ear transformation with m × m unitary ma- dyne detection. trix U, and let β, ξ ∈ Cm. We write |ψi = ˆ ˆ ˆ Nm At this point, we can estimate tight fidelity wit- S(ξ)D(β) U i=1 |Cii the m-mode target pure ∗ ∗ nesses for pure product states using Protocol1 state. Let N,M ∈ N , and let p1, . . . , pm ∈ N for each of the single-mode subsystems in paral- and 0 < η1, . . . , ηm < 1 be free parameters. Let lel. We make use of the properties of heterodyne ρ⊗N+M be N + M copies of an unknown m-mode detection in order to further extend the class of (mixed) quantum state ρ. target states for which a tight fidelity witness can be efficiently obtained. 1. Measure all m subsystems of N copies Secondly, a passive linear transformation fol- of ρ with unbalanced heterodyne detec- lowed by single-mode Gaussian unitary opera- tion with unbalancing parameters ξ = tions before unbalanced heterodyne detection is (ξ1, . . . , ξm), obtaining the vectors of samples (1) (N) m equivalent to performing balanced heterodyne de- γ ,..., γ ∈ C . tection directly, then post-processing efficiently 2. For all k ∈ {1,...,N}, compute the vec- the classical samples. Formally: tors α(k) = U † γ(k) − β . We write α(k) = m Lemma 3. Let β, ξ ∈ C and let Vˆ = (k) (k) m (α , . . . αm ) ∈ C . Sˆ(ξ)Dˆ(β) Uˆ, where Uˆ is an m-mode passive lin- 1 ear transformation with m × m unitary matrix U. 3. For all i ∈ {1, . . . , m}, compute the mean For all γ ∈ Cm, let α = U †(γ − β). Then, F (ρ) of the function z 7→ g(pi)(z, η ) Ci Ci i (defined in Eq. (8)) over the samples ξ ˆ 0 ˆ † Πγ = V ΠαV . (12) (1) (N) αi , . . . , αi ∈ C. We give a proof in AppendixE. A striking con- 4. Compute the fidelity witness estimate Wψ = sequence is that a certain class of quantum op- Pm M 1 − i=1 (1 − FCi (ρ) ). erations before a balanced heterodyne measure- ment can be inverted efficiently by unbalanc- The value Wψ obtained is an estimate of a tight ing the detection and perfoming classical oper- lower bound on the fidelity between the M re- ations on the samples instead. This result gen- maining copies of ρ and M copies of the m-mode ˆ ˆ ˆ Nm eralises a technique used in continuous-variable target state |ψi = S(ξ)D(β) U i=1 |Cii. The quantum key distribution protocols based on het- efficiency and completeness of the protocol are erodyne detection, as well as in a scheme for summarised by the following result:
7 Theorem 2. Let , δ > 0. With the notations such as the output states of Boson Sampling ex- of Protocol2, for all i ∈ {1, . . . , m}, let ni be periments, as we detail in the next section. the number of indices j ∈ {1, . . . , m} such that cj = ci. Then,
⊗M ⊗M ⊗M ⊗M 1−m(1−F (|ψi , ρ )−≤Wψ ≤F (|ψi , ρ )+, 6 Verification of Boson Sampling (13) with probability 1 − δ, for The setup of Boson Sampling with input single- 2c 2+ i photons consists in n single-photon states fed into Mm pi 1 N = Omax log(ni) log . an interferometer over m modes, together with i δ the vacuum state over m − n modes, and mea- (14) sured either with single-photon threshold detec- In particular, if the tested state is perfect, i.e., tion [10] or with unbalanced heterodyne detec- ⊗N+M ⊗N+M ρ = |ψihψ| , then Wψ ≥ 1 − with tion [43, 44] (Fig.3). The output probabilities probability 1 − δ. are related to permanents of complex matrices, which are hard to compute [69] and even to ap- We give a detailed version of the theorem to- proximate [10]. A striking consequence is that gether with its proof in AppendixF, which com- classical computers cannot sample exactly from bines Theorem1 with Lemmas2 and3. the corresponding probability distributions un- Note that Protocol2 uses Protocol1 as less the polynomial hierarchy collapses, contra- a subroutine. Writing p = mini pi and dicting a widely believed conjecture from com- c = maxi ci, with ni ≤ m we obtain N = plexity theory. Aaronson and Arkhipov impor- 2c Mm 2+ p 1 O(( ) log(m) log( δ )). In particular, com- tantly showed that even an approximate version pared to the single-mode case, the overhead for of their model is still hard to sample for classical 2+ 2c certifying m-mode states is only O(m p log m), computers, provided two additional conjectures which is a huge improvement compared to, e.g., on the permanent of random Gaussian matrices the exponential scaling of tomography [68]. Since hold true [10]. More precisely, they showed un- the parameter p ∈ N∗ may vary freely, the scal- der these conjectures that sampling from a prob- ing can be brought arbitrarily close to N = ability distribution that has small constant total Mm 2 1 variation distance with an ideal Boson Sampling O(( ) log(m) log( δ )). The constant prefactor increases with p, and optimisation can yield the distribution is classically hard√ in the so-called an- optimal choice for p which minimises N when M, tibunching regime n = O( m) (in fact they used 6 2 m, and δ are fixed. Moreover, the choice of the m = Ω(n ) and conjectured that m = Ω(n ) was other free parameters 0 < ηi < 1 also contributes sufficient, as it was later shown [70]). to minimising the constant prefactor. The output state of a Boson Sampling experi- Without the i.i.d. assumption, we obtain an ment with n photons fed into an interferometer equivalent protocol by using the version of our over m modes, described by an m-mode passive single-mode fidelity estimation protocol which linear transformation Uˆ reads Uˆ |1 ... 10 ... 0i. does not assume i.i.d. state preparation for esti- This state is of the form of Eq. (1), with Gˆi = 1 mating the single-mode fidelities. Like for Proto- for all i ∈ {1, . . . , m}, |Cii = |1i for i ∈ {1, . . . , n} col1, the final protocol is nearly identical, up to and |Cji = |0i for j ∈ {n+1, . . . , m}. Our fidelity slight differences in the classical post-processing. witness estimation protocol from the previous sec- Removing the i.i.d. assumption then comes at tion can thus be applied to certify efficiently the the cost of an increased number of measurements fidelity of the output state of a Boson Sampling necessary for a polynomial witness precision and experiment with the ideal target output state, us- confidence interval, corresponding to a polyno- ing only balanced heterodyne detection. Then, mial overhead. We give a detailed analysis in our protocol yields a certificate of the total vari- AppendixG. ation distance with the target probability distri- The class of states for which fidelity witnesses bution for any observable by the Fuchs–Van de can be efficiently estimated using Protocol2 Graaf inequality [34] and standard properties of includes classically intractable quantum states, the trace distance [33]. Indeed, for any observ-
8 able Oˆ and any states ρ and σ, Theorem 3. Let δ > 0. We use the notations of Protocol3. With probability 1 − δ, either the Oˆ Oˆ q (1) (M) kPρ − Pσ k ≤ D(ρ, σ) ≤ 1 − F (ρ, σ), (15) protocol aborts or the samples s ,..., s are drawn from√ a probability distribution which has where the left hand side is the total variation dis- less than λ total variation distance with the ideal tance between the probability distributions cor- Boson Sampling probability distribution, for responding to a measurement of the observable ! ˆ Mm2 1 O for the states ρ and σ, D is the trace distance N = O log(m) log . (16) and F the fidelity. δ We give the version of our Boson Sampling ver- Moreover, if the tested state is perfect, i.e., ification protocol under i.i.d. assumption and dis- ρ⊗N+M = |ψihψ|⊗N+M , then Protocol3 accepts cuss afterwards its version without i.i.d. assump- with probability 1 − δ. tion. We give a proof of the theorem in AppendixH, Protocol 3 (Boson Sampling verification). Let which follows from optimising the efficiency of √ ˆ n = O( m). Let U be an m-mode passive linear Protocol2 for Boson Sampling output states, to- transformation with m × m unitary matrix U. gether with Eq. (15). The choice of the free pa- ˆ Let |ψi = U |1 ... 10 ... 0i be the m-mode Boson rameters p ∈ N∗ even and 0 < η < 1 contributes Sampling target state, with n input photons over to minimising the constant prefactor. Addition- ∗ ∗ m modes. Let N,M ∈ N , and let p ∈ N even, nally, the choice of between 0 and λ can be 0 < η < 1 and λ > > 0 be free parameters. Let made to ensure robustness of the protocol with ⊗N+M ρ be N + M copies of an unknown m-mode Eq. (13): if is closer to 0 then the protocol will (mixed) quantum state ρ. reject a good state with less probability. On the 1. Measure all m subsystems of N copies of ρ other hand, this increases the number of samples with balanced heterodyne detection, obtaining needed with Eq. (16). the vectors of samples γ(1),..., γ(N) ∈ Cm. Protocol3 allows one to verify a Boson Sam- pling experiment efficiently, by trusting only 2. For all k ∈ {1,...,N}, compute the vec- single-mode Gaussian measurements. Compared tors α(k) = U †γ(k). We write α(k) = to other experimental platforms, the assumption (k) (k) m (α1 , . . . αm ) ∈ C . of trusted measurements is especially relevant in the case of photonic quantum computing, where 3. For all i ∈ {1, . . . , n}, compute the mean the measurement apparatus can be easily brought (p) Fi,|1i(ρ) of the function z 7→ g|1i (z, η) apart from the rest of the experiment, allowing to (defined in Eq. (8)) over the samples treat the latter as an untrusted black-box. More- (1) (N) over, we obtain a version of Protocol3 without αi , . . . , αi ∈ C, and for all j ∈ {n + the i.i.d. assumption by using the version of Pro- 1, . . . , m}, compute the mean Fj,|0i(ρ) of the (p) tocol2 which does not assume an i.i.d. behaviour function z 7→ g (z, η) over the samples |0i for the prover from the previous section. This (1) (N) αj , . . . , αj ∈ C. slightly modifies the classical post-processing, re- quiring the verifier to discard at random a small 4. Compute the fidelity witness estimate fraction of the samples and perform an energy W = 1 − Pn (1 − F (ρ)M ) − ψ i=1 i,|1i test using another fraction of the samples. This Pm (1 − F (ρ)M ). j=n+1 j,|0i comes at the cost of a polynomial overhead for the number of measurements needed for a poly- 5. Abort if Wψ < 1 − λ + . Otherwise, accept and measure all m subsystems of the remain- nomial confidence, and we refer to AppendixG ing M copies of ρ with unbalanced heterodyne for the detailed derivation. detection (resp. single-photon threshold de- By simply changing the unbalancing of het- tection), obtaining the M vectors of samples erodyne detection of the output modes of a (s(1),..., s(M)) ∈ Cm (resp. ∈ Nm). Boson Sampling interferometer, one can switch between verification of Boson Sampling output The efficiency and completeness of the protocol states and demonstration of quantum speedup are summarised by the following result: with continuous-variable measurements within
9 We have generalised heterodyne estimates With this fidelity estimation protocol for single Applying our fidelity witness estimation pro- 7 Discussion In this work,ods we have for introduced efficiently varioussingle-mode retrieving meth- and information multimodequantum about continuous-variable states. both from] [57 both and worlds: [58], amation obtaining reliable protocol with single-mode the heterodyne fidelity detection bestdoes which esti- not of make an assumption offor bounded the support measured state, while remaining efficient subsystems, we have derived atimation fidelity witness protocol es- with heterodynea large detection class for of quantumsystems states (Protocol2). over multiple This sub- resultobservations: stems from on two the onetems of hand, a if quantum allthen state the are this subsys- close quantum toproduct pure state states, of is the closea pure large to states; class the onerodyne of tensor the detection quantum other operations canpost-processing. hand, before be het- reversed via classical tocol to theshown case how to of verifyexperiments Boson efficiently using Sampling, Boson heterodyne we Sampling col3). detection have Our (Proto- verification applies toson the Sampling original Bo- proposal [10],giving where rise the to quantum sampling ing speedup single-photon is threshold performed detectors,to us- as related well proposals as [43, is44], where performed the sampling usingtection unbalanced instead. heterodynecation In de- and the theby latter computational the case, unbalancing runsdetection. the of only the verifi- differ Using verifier’smeans a heterodyne that tunable Boson beam Samplingcan be splitter, and implemented its within this the verification however same that setup. approximate sampling Note hardness has not yet been demonstrated for Bosona Sampling crucial pointstration. before any experimental Itconcentration demon- will and average-case likely hardnesstures require conjec- for extending the anti- loop permanent hafnian or [72, thecan73 ]. hafnian already On to performtum the the a speedup other with demonstration hand, Boson of Sampling one and quan- discrete variable measurements, by using balanced het- with continuous-variable measurements, which is (Protocol1). 10 , n 6= 0 = 0 ξ with ξ ...... U . The detectors ξ ˆ
. . . poly modes and heterodyne detection with − i i i i m 1 0 0 1
We thank Tom Douce, Anthony Leverrier, [11] B. M. Terhal and D. P. DiVincenzo, Saleh Rahimi-Keshari, Gana¨el Roeland, Mat- “Adptive quantum computation, constant tia Walschaers, Nicolas Treps and Valentina Pa- depth quantum circuits and arthur-merlin Quantum Information & rigi for interesting discussions. We acknowledge games,” Computation 4 support of the European Union’s Horizon 2020 , 134–145 (2004), Research and Innovation Program under Grant arXiv:0205133. Agreement No. 820445 (QIA), and the ANR [12] D. Shepherd and M. J. Bremner, through the ANR-17-CE24-0035 VanQuTe. “Temporally unstructured quantum
11 computation,” Proceedings of the Royal subsystems,” Nature Physics 3, 645–649 Society A: Mathematical, Physical and (2007). Engineering Sciences 465, 1413–1439 [22] A. Gheorghiu, T. Kapourniotis, and (2009). E. Kashefi, “Verification of quantum [13] M. J. Bremner, R. Jozsa, and D. J. computation: An overview of existing Shepherd, “Classical simulation of approaches,” Theory of Computing Systems commuting quantum computations implies 4, 715–808 (2019). collapse of the polynomial hierarchy,” Proceedings of the Royal Society A: [23] A. Broadbent, J. Fitzsimons, and Mathematical, Physical and Engineering E. Kashefi, “Universal blind quantum Sciences 467, 459–472 (2011). computation,” in 2009 50th Annual IEEE Symposium on Foundations of Computer [14] S. Boixo, S. V. Isakov, V. N. Smelyanskiy, Science, pp. 517–526, IEEE. 2009. R. Babbush, N. Ding, Z. Jiang, M. J. Bremner, J. M. Martinis, and H. Neven, [24] U. Mahadev, “Classical verification of “Characterizing quantum supremacy in quantum computations,” in 2018 IEEE near-term devices,” Nature Physics 14, 59th Annual Symposium on Foundations of 595–600 (2018). Computer Science (FOCS), pp. 259–267, [15] R. Mezher, J. Ghalbouni, J. Dgheim, and IEEE. 2018. D. Markham, “Efficient approximate [25] D. Hangleiter, M. Kliesch, J. Eisert, and unitary t-designs from partially invertible C. Gogolin, “Sample complexity of universal sets and their application to device-independently certified “quantum quantum speedup,” arXiv:1905.01504. supremacy”,” Physical Review Letters 122, [16] F. Arute, K. Arya, R. Babbush, D. Bacon, 210502 (2019). J. C. Bardin, R. Barends, R. Biswas, [26] G. D. Kahanamoku-Meyer, “Forging S. Boixo, F. G. Brandao, D. A. Buell, et al., quantum data: classically defeating an “Quantum supremacy using a IQP-based quantum test,” programmable superconducting processor,” arXiv:1912.05547. Nature 574, 505–510 (2019). [17] H.-S. Zhong, H. Wang, Y.-H. Deng, M.-C. [27] M.-H. Yung and B. Cheng, “Anti-Forging Chen, L.-C. Peng, Y.-H. Luo, J. Qin, Quantum Data: Cryptographic Verification D. Wu, X. Ding, Y. Hu, et al., “Quantum of Quantum Cloud Computing,” computational advantage using photons,” arXiv:2005.01510. Science 370, 1460–1463 (2020). [28] Z. Brakerski, P. Christiano, U. Mahadev, [18] S. Aaronson and L. Chen, U. Vazirani, and T. Vidick, “A “Complexity-theoretic foundations of cryptographic test of quantumness and quantum supremacy experiments,” in certifiable randomness from a single Proceedings of the 32nd Computational quantum device,” in 2018 IEEE 59th Complexity Conference, pp. 1–67. 2017. Annual Symposium on Foundations of arXiv:1612.05903. Computer Science (FOCS), pp. 320–331, IEEE. 2018. [19] A. M. Dalzell, A. W. Harrow, D. E. Koh, and R. L. La Placa, “How many qubits are [29] Z. Brakerski, V. Koppula, U. Vazirani, and needed for quantum computational T. Vidick, “Simpler Proofs of supremacy?,” Quantum 4, 264 (2020). Quantumness,” arXiv:2005.04826. [20] B. Barak, C.-N. Chou, and X. Gao, [30] N. Spagnolo, C. Vitelli, M. Bentivegna, “Spoofing Linear Cross-Entropy D. J. Brod, A. Crespi, F. Flamini, Benchmarking in Shallow Quantum S. Giacomini, G. Milani, R. Ramponi, Circuits,” arXiv:2005.02421. P. Mataloni, et al., “Experimental [21] R. Renner, “Symmetry of large physical validation of photonic Boson Sampling,” systems implies independence of Nature Photonics 8, 615 (2014).
12 [31] S. Aaronson and A. Arkhipov, “Boson same complexity class as Boson Sampling,” Sampling is far from uniform,” Physical Review A 91, 022317 (2015). arXiv:1309.7460. [42] C. S. Hamilton, R. Kruse, L. Sansoni, [32] S. Ferracin, T. Kapourniotis, and A. Datta, S. Barkhofen, C. Silberhorn, and I. Jex, “Accrediting outputs of noisy “Gaussian Boson Sampling,” Physical intermediate-scale quantum computing review letters 119, 170501 (2017). devices,” New Journal of Physics 21, [43] U. Chabaud, T. Douce, D. Markham, 113038 (2019). P. Van Loock, E. Kashefi, and G. Ferrini, [33] M. A. Nielsen and I. L. Chuang, “Quantum “Continuous-variable sampling from Computation and Quantum Information: photon-added or photon-subtracted 10th Anniversary Edition,”. Cambridge squeezed states,” Physical Review A 96, University Press, New York, NY, USA, 062307 (2017). 10th ed., 2011. [44] L. Chakhmakhchyan and N. J. Cerf, [34] C. A. Fuchs and J. Van De Graaf, “Boson Sampling with Gaussian “Cryptographic distinguishability measures measurements,” Physical Review A 96, for quantum-mechanical states,” IEEE 032326 (2017). Transactions on Information Theory 45, [45] A. Lund, S. Rahimi-Keshari, and T. Ralph, 1216–1227 (1999). “Exact Boson Sampling using Gaussian [35] D. Mills, A. Pappa, T. Kapourniotis, and continuous-variable measurements,” E. Kashefi, “Information Theoretically Physical Review A 96, 022301 (2017). Secure Hypothesis Test for Temporally Unstructured Quantum Computation,” in [46] G. Adesso, S. Ragy, and A. R. Lee, EPTCS 266, 2018, pp. 209-221, vol. 266, “Continuous variable quantum information: Open pp. 209–221, EPTCS. Gaussian states and beyond,” Systems & Information Dynamics 21, [36] D. Hangleiter, M. Kliesch, M. Schwarz, and 1440001 (2014). J. Eisert, “Direct certification of a class of quantum simulations,” Quantum Science [47] S. D. Bartlett, B. C. Sanders, S. L. and Technology 2, 015004 (2017). Braunstein, and K. Nemoto, “Efficient classical simulation of continuous variable [37] T. Kapourniotis and A. Datta, quantum information processes,” Physical “Nonadaptive fault-tolerant verification of Review Letters 88, 097904 (2002). quantum supremacy with noise,” Quantum 3, 164 (2019). [48] A. Ferraro, S. Olivares, and M. G. Paris, “Gaussian states in continuous variable [38] Y. Takeuchi and T. Morimae, “Verification quantum information,” of many-qubit states,” Physical Review X 8, arXiv:quant-ph/0503237. 021060 (2018). [49] S. Yokoyama, R. Ukai, S. C. Armstrong, [39] S. L. Braunstein and P. van Loock, C. Sornphiphatphong, T. Kaji, S. Suzuki, “Quantum information with continuous J.-i. Yoshikawa, H. Yonezawa, N. C. variables,” Reviews of Modern Physics 77, Menicucci, and A. Furusawa, 513–577 (2005). “Ultra-large-scale continuous-variable [40] A. P. Lund, A. Laing, S. Rahimi-Keshari, cluster states multiplexed in the time T. Rudolph, J. L. O’Brien, and T. C. domain,” Nature Photonics 7, 982 (2013). Ralph, “Boson Sampling from a Gaussian [50] J.-i. Yoshikawa, S. Yokoyama, T. Kaji, Phys.ical Review Letters 113 State,” , C. Sornphiphatphong, Y. Shiozawa, 100502 (2014). K. Makino, and A. Furusawa, “Invited [41] J. P. Olson, K. P. Seshadreesan, K. R. article: Generation of one-million-mode Motes, P. P. Rohde, and J. P. Dowling, continuous-variable cluster state by “Sampling arbitrary photon-added or unlimited time-domain multiplexing,” APL photon-subtracted squeezed states is in the Photonics 1, 060801 (2016).
13 [51] F. Flamini, N. Spagnolo, and F. Sciarrino, quantum information,” Reviews of Modern “Photonic quantum information processing: Physics 84, 621–669 (2012). a review,” Reports on Progress in Physics [61] D. Menzies and R. Filip, 82, 016001 (2018). “Gaussian-optimized preparation of [52] I. Agresti, N. Viggianiello, F. Flamini, non-Gaussian pure states,” Physical Review N. Spagnolo, A. Crespi, R. Osellame, A 79, 012313 (2009). N. Wiebe, and F. Sciarrino, “Pattern [62] U. Chabaud, D. Markham, and recognition techniques for Boson Sampling F. Grosshans, “Stellar representation of validation,” Physical Review X 9, 011013 non-Gaussian quantum states,” Physical (2019). Review Letters 124, 063605 (2020). [53] D. J. Brod, E. F. Galv˜ao,A. Crespi, [63] A. W¨unsche, “Laguerre 2D-functions and R. Osellame, N. Spagnolo, and F. Sciarrino, their application in quantum optics,” “Photonic implementation of Boson Journal of Physics A: Mathematical and Sampling: a review,” Advanced Photonics General 31, 8267 (1998). 1, 034001 (2019). [64] W. Hoeffding, “Probability inequalities for [54] H. Wang, J. Qin, X. Ding, M.-C. Chen, sums of bounded random variables,” S. Chen, X. You, Y.-M. He, X. Jiang, Journal of the American statistical L. You, Z. Wang, et al., “Boson Sampling association 58, 13–30 (1963). with 20 Input Photons and a 60-Mode [65] R. Renner and J. I. Cirac, “de Finetti Interferometer in a 1014-Dimensional representation theorem for Hilbert Space,” Physical Review Letters infinite-dimensional quantum systems and 123, 250503 (2019). applications to quantum cryptography,” [55] M. Walschaers, “Signatures of Physical Review Letters 102, 110504 (2009). Journal of many-particle interference,” [66] Y. Ouyang, S.-H. Tan, J. Fitzsimons, and Physics B: Atomic, Molecular and Optical P. P. Rohde, “Homomorphic encryption of Physics 53 , 043001 (2020). linear optics quantum computation on [56] H. Yuen and J. Shapiro, “Optical almost arbitrary states of light with communication with two-photon coherent asymptotically perfect security,” Physical states–Part III: Quantum measurements Review Research 2, 013332 (2020). realizable with photoemissive detectors,” [67] A. Leverrier, R. Garc´ıa-Patr´on,R. Renner, IEEE Transactions on Information Theory and N. J. Cerf, “Security of 26, 78–92 (1980). continuous-variable quantum key [57] M. G. Paris, “Quantum state measurement distribution against general attacks,” by realistic heterodyne detection,” Physical Physical Review Letters 110, 030502 (2013). Review A 53, 2658 (1996). [68] G. M. D’Ariano, M. G. Paris, and M. F. [58] U. Chabaud, T. Douce, F. Grosshans, Sacchi, “Quantum tomography,” Advances E. Kashefi, and D. Markham, “Building in Imaging and Electron Physics 128, Trust for Continuous Variable Quantum 206–309 (2003), arXiv:quant-ph/0302028. States,” in 15th Conference on the Theory [69] L. G. Valiant, “The complexity of of Quantum Computation, Communication computing the permanent,” Theoretical and Cryptography. 2020. computer science 8, 189–201 (1979). [59] L. Aolita, C. Gogolin, M. Kliesch, and [70] T. Jiang and Y. Ma, “Distances between J. Eisert, “Reliable quantum certification of random orthogonal matrices and photonic state preparations,” Nature independent normals,” Transactions of the communications 6, 8498 (2015). American Mathematical Society 372, [60] C. Weedbrook, S. Pirandola, 1509–1553 (2019). R. Garc´ıa-Patr´on, N. J. Cerf, T. C. Ralph, [71] R. A. Abrahao and A. P. Lund, J. H. Shapiro, and S. Lloyd, “Gaussian “Continuous-variables Boson Sampling:
14 scaling and verification,” Sampling in lossy architectures,” Quantum arXiv:1812.08978. 3, 169 (2019). [72] R. Kruse, C. S. Hamilton, L. Sansoni, S. Barkhofen, C. Silberhorn, and I. Jex, [76] P. Clifford and R. Clifford, “Faster classical “Detailed study of Gaussian Boson Boson Sampling,” arXiv:2005.04214. Sampling,” Physical Review A 100, 032326 (2019). [77] C. Huang, F. Zhang, M. Newman, J. Cai, [73] N. Quesada, “Franck-Condon factors by X. Gao, Z. Tian, J. Wu, H. Xu, H. Yu, counting perfect matchings of graphs with B. Yuan, et al., “Classical Simulation of loops,” The Journal of chemical physics Quantum Supremacy Circuits,” 150, 164113 (2019). arXiv:2005.06787. [74] A. Neville, C. Sparrow, R. Clifford, E. Johnston, P. M. Birchall, A. Montanaro, [78] J. Eisert, D. Hangleiter, N. Walk, I. Roth, and A. Laing, “Classical Boson Sampling D. Markham, R. Parekh, U. Chabaud, and algorithms with superior performance to E. Kashefi, “Quantum certification and near-term experiments,” Nature Physics 13, benchmarking,” Nature Reviews Physics 2, 1153–1157 (2017). 382–390 (2020). [75] R. Garc´ıa-Patr´on,J. J. Renema, and V. Shchesnovich, “Simulating Boson
15 Appendix
In this appendix we provide the proofs for the results stated in the main text.
A Proof of Lemma1
We recall notations from the main text. Let us introduce for k, l ≥ 0 the polynomials
k+l k+l zz∗ (−1) ∂ −zz∗ Lk,l(z) = e √ √ e k! l! ∂zk∂z∗l min (k,l) √ √ (17) k! l!(−1)p = X zl−pz∗k−p, p!(k − p)!(l − p)! p=0 for z ∈ C, which are, up to a normalisation, the Laguerre 2D polynomials. For all k, l ∈ N, we give with these polynomials the functions [58]
! 1 1− 1 zz∗ z fk,l(z, η) = e η Ll,k √ , (18) 1+ k+l η 2 η for all z ∈ C and all 0 < η < 1. The function z 7→ fk,l(z, η), being a polynomial multiplied by a converging Gaussian function, is bounded over C. Now let us define, for all p ∈ N∗, all z ∈ C and all 0 < η < 1, the more general bounded functions
v p−1 u ! ! (p) X u k + j l + j g (z, η) := (−1)jηjf (z, η)t . (19) k,l k+j,l+j k l j=0
We start by showing the following result, which generalises Lemma 3 of [58]:
∗ P+∞ Lemma 4. Let p ∈ N , let k, l ∈ N and let 0 < η < 1. Let ρ = i,j=0 ρij |iihj| be a density operator. Then, v +∞ !u ! ! (p) p+1 X q q − 1 u k + q l + q E [g (α, η)] = ρkl + (−1) ρk+q,l+qη t , (20) α←Q k,l ρ q=p p − 1 k l where the function gk,l is defined in Eq. (6).
Proof. We prove the lemma by induction on p ∈ N∗. By Lemma 3 of [58], with E = +∞, we have, for P all single-mode (mixed) state ρ = i,j≥0 ρij |iihj|, for all k, l ∈ N
v +∞ u ! ! X qu k + q l + q E [fk,l(α, η)] = ρkl + ρk+q,l+qη t . (21) α←Qρ k l q=1
With Eq. (19), this gives
v +∞ u ! ! (1) X qu k + q l + q E [gk,l (α, η)] = ρkl + ρk+q,l+qη t , (22) α←Qρ k l q=1
q−1 hence the lemma is proven for p = 1 since 0 = 1.
16 Assuming the lemma holds for some p ∈ N∗,
v +∞ !u ! ! (p) p+1 X q q − 1 u k + q l + q E [g (α, η)] = ρkl + (−1) ρk+q,l+qη t α←Q k,l ρ q=p p − 1 k l v u ! ! u k + p l + p = ρ + (−1)p+1ρ ηpt (23) kl k+p,l+p k l v +∞ !u ! ! X q − 1 u k + q l + q + (−1)p+1 ρ ηq t . k+q,l+q p − 1 k l q=p+1
Now by Eq. (21), with k = k + p and l = l + p, we have
v +∞ u ! ! X qu k + q + p l + q + p E [fk+p,l+p(α, η)] = ρk+p,l+p + ρk+q+p,l+q+pη t , (24) α←Qρ k + p l + q q=1 so that v u ! ! h (p+1) i (p) p pu k + p l + p E gk,l (α, η) = E gk,l (α, η) + (−1) η t fk+p,l+p(α, η) α←Qρ α←Qρ k l v u ! ! u k + p l + p = ρ + (−1)p+1ρ ηpt kl k+p,l+p k l v +∞ !u ! ! X q − 1 u k + q l + q + (−1)p+1 ρ ηq t k+q,l+q p − 1 k l q=p+1 v u ! ! u k + p l + p + (−1)pηpt ρ k l k+p,l+p v v u ! ! +∞ u ! ! u k + p l + p X u k + q + p l + q + p + (−1)pηpt ρ ηqt k l k+q+p,l+q+p k + p l + p q=1 v +∞ !u ! ! X q − 1 u k + q l + q = ρ + (−1)p+1 ρ ηq t kl k+q,l+q p − 1 k l q=p+1 v v u ! ! +∞ u ! ! u k + p l + p X u k + q + p l + q + p + (−1)pηpt ρ ηqt k l k+q+p,l+q+p k + p l + p q=1 v +∞ !u ! ! X q − 1 u k + q l + q = ρ + (−1)p+1 ρ ηq t kl k+q,l+q p − 1 k l q=p+1 v v u ! ! +∞ u ! ! u k + p l + p X u k + q l + q + (−1)pt ρ ηqt k l k+q,l+q k + p l + p q=p+1 +∞ p+2 X q = ρkl + (−1) ρk+q,l+qη q=p+1 v v u ! ! ! ! !u ! ! u k + p l + p k + q l + q q − 1 u k + q l + q × t − t . k l k + p l + p p − 1 k l (25)
17 We have ! ! ! ! k + p l + p k + q l + q (k + p)!(l + p)!(k + q)!(l + q)! = k l k + p l + p k!p!l!p!(k + p)!(q − p)!(l + p)!(q − p)! (k + q)!(l + q)! = (26) k!(k + p)!p!2(q − p)!2 !2 ! ! q k + q l + q = , p k l so the last expression in Eq. (25) simplifies as v +∞ u ! ! " ! !# h (p+1) i p+2 X qu k + q l + q q q − 1 E gk,l (α, η) = ρkl + (−1) ρk+q,l+qη t − α←Qρ k l p p − 1 q=p+1 v (27) +∞ !u ! ! X q − 1 u k + q l + q = ρ + (−1)p+2 ρ ηq t , kl k+q,l+q p k l q=p+1 which completes the proof of Lemma4.
An immediate application of Lemma4 gives v +∞ !u ! ! (p) X q q − 1 u k + q l + q E [g (α, η)] − ρkl ≤ ρk+q,l+qη t α←Q k,l ρ q=p p − 1 k l v !u ! ! +∞ q q − 1 u k + q l + q X ≤ max η t ρk+q,l+q (28) q≥p p − 1 k l q=p v !u ! ! q q − 1 u k + q l + q ≤ max η t . q≥p p − 1 k l
This last bound is tight: if q0 ≥ p is the integer achieving the maximum in the last equation, then the inequality is an equality for ρ = |q0ihq0|. We have v v !u ! ! !u ! ! q u k + q + 1 l + q + 1 q − 1 u k + q l + q ηq+1 t ηq t p − 1 k l Q p − 1 k l s q − p + 1 q + 1 q + 1 ⇔ η (29) Q q k + q + 1 l + q + 1 s s p − 1 k l ⇔ η 1 − 1 − 1 − , Q q k + q + 1 l + q + 1 where the right hand side in the last line is an increasing function of q. Hence, for η ≤ √ p+1 , p (k+p+1)(l+p+1) which corresponds to q = p in the above equation, we have v v !u ! ! !u ! ! q u k + q + 1 l + q + 1 q − 1 u k + q l + q ηq+1 t ≤ ηq t (30) p − 1 k l p − 1 k l for all q ≥ p, so that v v !u ! ! u ! ! q q − 1 u k + q l + q pu k + p l + p max η t = η t , (31) q≥p p − 1 k l k l
18 for η ≤ √ p+1 . With Eq. (28) we finally obtain p (k+p+1)(l+p+1)
v u ! ! (p) pu k + p l + p E [gk,l (α, η)] − ρkl ≤ η t . (32) α←Qρ k l
p+1 Note that for η < 1 but η > √ , we can find the first integer q0 such that η ≤ p (k+p+1)(l+p+1) √(q0−p+1)(q0+1) by incrementing q, since √(q−p+1)(q+1) in an increasing function of q which q0 (k+q0+1)(l+q0+1) q (k+q+1)(l+q+1) goes to 1 when q goes to +∞. The bound above then gives
!v ! ! q − 1 u k + q l + q (p) q0 0 u 0 0 E [gk,l (α, η)] − ρkl ≤ η t . (33) α←Qρ p − 1 k l
While this can be useful to optimise further the efficiency of the protocol, we will assume for the sake of obtaining closed analytical expressions that η ≤ √ p+1 . p (k+p+1)(l+p+1)
B Proof of Theorem1
In this section, we prove the efficiency of Protocol2, which we recall below:
∗ Pc−1 Protocol 1 (Single-mode fidelity estimation). Let c ∈ N and let |Ci = n=0 cn |ni be a core state. Let also N,M ∈ N∗, and let p ∈ N∗ and 0 < η < 1 be free parameters. Let ρ⊗N+M be N + M copies of an unknown single-mode (mixed) quantum state ρ.
1. Measure N copies of ρ with heterodyne detection, obtaining the samples α1, . . . , αN ∈ C.
(p) 2. Compute the mean FC (ρ) of the function z 7→ gC (z, η) (defined in Eq. (43)) over the samples α1, . . . , αN ∈ C.
M 3. Compute the fidelity estimate FC (ρ) .
M The value FC (ρ) obtained is an estimate of the fidelity between the M remaining copies of ρ and M copies of the target core state |Ci. Defining
1 p c p + 1 1 η := min , , , (34) C,p 2 c−1 q n+p p(p + c) 2 (c + p) P |c | n=0 n n the efficiency of the protocol is summarised by the following result:
Theorem 4. Let > 0. With the notations of Protocol1 and η ≤ ηC,p, we have
⊗M ⊗M M F (|Ci , ρ ) − FC (ρ) ≤ , (35)
iid with probability greater than 1 − PC , where
2+ 2c N p P iid = 2 exp − , (36) C 2+ 2c M p KC,p where KC,p is a constant independent of ρ given in Eq. (59).
19 Proof. Let us prove the theorem for M = 1. The general case is then an immediate corollary by ⊗M ⊗M M replacing by M , since F (C , ρ ) = F (C, ρ) and by Lemma 2 of [58]:
|a − b| ≤ ⇒ |aM − bM | ≤ M, (37)
∗ for all M ∈ N , all > 0 and all a, b ∈ [0, 1] (note that when the estimate FC (ρ) obtained is bigger than 1 we may replace it by 1 instead without loss of generality). The proof combines Lemma1 with Hoeffding inequality. The latter is expressed as follows:
Lemma 5. (Hoeffding) Let λ > 0, let n ≥ 1, let z1, . . . , zn be i.i.d. complex random variables from a probability density D over R, and let g : C 7→ R be a bounded function and let G ≥ maxz g(z)−minz g(z). Then " N # " 2 # 1 X 2Nλ Pr g(zi) − E [g(z)] ≥ λ ≤ 2 exp − . (38) N z←D G2 i=1 (p) In order to apply Lemma5, we first derive an analytical bound for the functions gk,l : ∗ 1 Lemma 6. For all k, l ∈ N, all z ∈ C, all p ∈ N and all η ≤ 2 , v !u ! (p) 1 max (k, l) + p u max (k, l) |g (z, η)| ≤ t2|l−k| . (39) k,l 1+ k+l η 2 p − 1 min (k, l)
Proof. By Lemma 6 of [58], we have
v u ! 1 u |i−j| max (i, j) |fi,j(z, η)| ≤ t2 , (40) 1+ i+j η 2 min (i, j)
1 for all i, j ∈ N, all z ∈ C and all η ≤ 2 . Hence, with Eq. (19), for all k ≤ l ∈ N, v p−1 u ! ! (p) X u k + i l + i |g (z, η)| ≤ |f (z, η)|ηit k,l k+i,l+i i i i=0 √ v p−1 u ! ! ! 2l−k X u l + i k + i l + i ≤ t 1+ k+l k + i i i η 2 i=0 v √ p−1 u !2 ! 2l−k X u l + i l = t (41) 1+ k+l i k η 2 i=0 v u ! p−1 ! 1 u l X l + i = t2l−k 1+ k+l k i η 2 i=0 v !u ! 1 l + p u l = t2l−k , 1+ k+l η 2 p − 1 k
1 for all z ∈ C and all η ≤ 2 . The same reasoning holds for l ≤ k ∈ N and we obtain v !u ! (p) 1 max (k, l) + p u max (k, l) |g (z, η)| ≤ t2|l−k| , (42) k,l 1+ k+l η 2 p − 1 min (k, l)
∗ 1 for all k, l ∈ N, all z ∈ C, all p ∈ N and all η ≤ 2 .
20 Pc−1 Let |Ci = n=0 cn |ni be a core state. Recalling the definition
(p) X ∗ (p) gC (z, η) := ckcl gk,l (z, η), (43) 0≤k,l≤c−1 from the main text, with Lemma6 we obtain: v !u ! (p) 1 X c−1− k+l max (k, l) + p u max (k, l) |g (z, η)| ≤ |c c |η 2 t2|l−k| C ηc k l p − 1 min (k, l) 0≤k,l≤c−1 (44) B(p) = C , ηc
∗ 1 for all z ∈ C, all p ∈ N and all η ≤ 2 , where v !u ! (p) X c−1− k+l max(k, l) + p u max(k, l) B := |c c |η 2 t2|l−k| . (45) C k l p − 1 min(k, l) 0≤k,l≤c−1 ∗ P Let N ∈ N , let ρ = k,l≥0 ρkl |kihl| be a density matrix and let α1, . . . , αN be i.i.d. samples from balanced heterodyne detection of N copies of ρ. Let us write
1 N F (ρ) = X g(p)(α , η). (46) C N C i i=1 With Lemma5, for all λ > 0, 2Nλ2η2c (p) Pr FC (ρ) − E [gC (α, η)] ≥ λ ≤ 2 exp − 2 α←Qρ (p) RC (47) Nλ2η2c ≤ 2 exp − , (p)2 2 BC for all z ∈ C, all p ∈ N∗, where we defined
(p) c c R := max [η gC (z, η)] − min [η gC (z, η)], (48) C z z
c (p) (p) 1 the range of the function z 7→ η gC (z, η) and where we used Eq. (44) and RC ≤ 2BC for η ≤ 2 in the second line. For η ≤ p+1 , we have η ≤ √ p+1 for all 0 ≤ k, l ≤ c − 1. Hence, for p(p+c) p (k+p+1)(l+p+1) n p+1 1 o η ≤ min p(p+c) , 2 ,
(p) X ∗ (p) F (C, ρ) − E [g (α, η)] = ckcl ρkl − E [g (α, η)] α←Q C α←Q k,l ρ 0≤k,l≤c−1 ρ
X (p) ≤ |ckcl| ρkl − E [g (α, η)] α←Q k,l 0≤k,l≤c−1 ρ v u ! ! X u k + p l + p (49) ≤ ηp |c c |t k l k l 0≤k,l≤c−1 v 2 c−1 u ! p X u n + p = η |cn|t n n=0 p (p) = η AC ,
21 where we used Eq. (43) in the first line, Lemma1 in the third line for all 0 ≤ k, l ≤ c − 1, and where we defined v 2 c−1 u ! (p) X u n + p A := |cn|t . (50) C n n=0
n p+1 1 o For η ≤ min p(p+c) , 2 , combining Eqs. (47) and (49) yields
(p) (p) |F (C, ρ) − FC (ρ)| ≤ E [gC (α, η)] − FC (ρ) + F (C, ρ) − E [gC (α, η)] α←Qρ α←Qρ (51) p (p) ≤ λ + η AC ,
iid with probability greater than 1 − PC , where
Nλ2η2c P iid = 2 exp − . (52) C (p)2 2 BC
p (p) We now optimise over the choice of λ and η for a given precision > 0. Namely, fixing λ + η AC = we maximise λ2η2c. Writing p (p) η AC = µ, (53)
2c this amounts to maximising λ2µ p , with λ + µ = . The optimal choice is given by:
p c λ = and µ = . (54) c + p c + p
This in turn gives " # 1 p c p λ = and η = . (55) c + p (p) AC (c + p)
n p+1 1 o With this choice for η, for small enough we will always have η ≤ min p(p+c) , 2 . To ensure that this is always the case independently of the value of , we may fix instead
" # 1 p c p p + 1 1 λ = and η = min , , . (56) c + p (p) p(p + c) 2 AC (c + p)
Then, plugging these expressions in Eq. (52) we finally obtain
|F (C, ρ) − FC (ρ)| ≤ , (57)
iid with probability greater than 1 − PC , where
2+ 2c " # " # N p N2 N2 P iid = max 2 exp − , 2 exp − , 2 exp − C (p) (p)0 (p)00 K K K C C C (58) 2+ 2c N p = 2 exp − , KC,p
22 where 2c 2c (p) p (p)2 2+ 2 A B (c + p) p (p) C C KC = 2c c p p2 (p)2 2c 2c−2 2+ p 0 2p BC (c + p) K(p) = C (p + 1)2c (59) 2 2c+1 (p) 2 00 2 BC (c + p) K(p) = C p2 n (p) (p)0 (p)00 o KC,p = max KC ,KC ,KC ,
(p) (p) and where the constants BC and AC are defined in Eqs. (45) and (50), respectively. Hence, the number of samples needed for a precision > 0 and a failure probability δ > 0 scales as ! 1 1 N = O log . (60) 2+ 2c p δ
Note that, as indicated in Eq. (33), the choice of η in Eq. (34) is not optimal in general, and an optimisation depending on the expression of the target core state leads to a better prefactor in Eq. (60).
C Removing the i.i.d. assumption for Protocol1
In this section, we derive a version of Protocol1 which does not assume i.i.d. state preparation. The protocol is as follows:
∗ Pc−1 Protocol 4 (General single-mode fidelity estimation). Let c ∈ N and let |Ci = n=0 cn |ni be a core state. Let also N,M ∈ N∗, and let p ∈ N∗, E,S ∈ N and 0 < η < 1 be free parameters. Let ρN+M be an unknown quantum state over N + M subsystems. We write N = N 0 + K + Q, for N 0,K,Q ∈ N.
1. Measure N = N 0 + K + Q subsystems of ρN+M chosen at random with heterodyne detection, M obtaining the samples α1, . . . , αN 0 , β1, . . . , βK , γ1, . . . γQ ∈ C. Let ρ be the remaining state over M subsystems.
2. Discard the Q samples γ1, . . . γQ.
2 3. Record the number R of samples βi such that |βi| + 1 > E, for i ∈ {1,...,K}. The protocol aborts if R > S.
(p) 4. Otherwise, compute the mean FC (ρ) of the function z 7→ gC (z, η) (defined in Eq. (8)) over the samples α1, . . . , αN 0 ∈ C.
M 5. Compute the fidelity estimate FC (ρ) .
Note that this protocol differs from Protocol1 by two additional classical post-processing steps, steps 2 and 3. These steps are part of a de Finetti reduction for infinite-dimensional systems [65] detailed in [58]. In particular, step 3 is an energy test, and the energy parameters E and S should be chosen to guarantee completeness, i.e., if the perfect core state is sent then it passes the energy test with high probability. M M The value FC (ρ) obtained is an estimate of the fidelity between the remaining state ρ over M subsystems and M copies of the target core state |Ci. The efficiency of the protocol is summarised by the following result:
23 Theorem 5. Let > 0. With the notations of Protocol4 and η ≤ ηC,p, defined in Eq. (34),
⊗M M M deFinetti F (|Ci , ρ ) − FC (ρ) ≤ 2 + PC , (61)
support deFinetti choice Hoeffding or the protocol aborts in step 3, with probability greater than 1−(PC +PC +PC +PC ), where " # K Q 2S 2 P support = 8K3/2 exp − − C 9 4(N 0 + M + Q) K 2 QE /2 Q(Q + 4) P deFinetti = exp − C 4 8(N 0 + M + Q) (62) M(Q + M − 1) P choice = C N 0 + M ! 1+ c 1+ c !2 N 0 + M N 0 + M − Q p 2QM p P Hoeffding = 2 exp − − , C 2+ 2c 0 Q 2M p GC,p N where GC,p is a constant independent of ρ given in Eq. (71). In particular, setting
7+ 2c M p N 0 = O 4+ 2c p 4+ c ! M p Q = O 2c 2+ p (63) 7+ 2c M p K = O 4+ 2c p E = O(log M) S = o(Q), yields
⊗M M M F (|Ci , ρ ) − FC (ρ) = O() (64) or the protocol aborts in step 3, with probability greater than 1 − PC , where ! 1 PC = O 1 , (65) poly(M, ) for 7+ 2c M p N = O . (66) 4+ 2c p
Proof. Theorem5 is an optimised version of Theorem 5 of [ 58], where the heterodyne estimates fk,l(z, η) (p) defined in Eq. (5) are replaced by the more efficient generalised estimates gk,l (z, η), with an additional free parameter p. The proof thus is nearly identical, and amounts to replacing occurences of the (p) estimates fk,l(z, η) by the estimates gk,l (z, η). In particular, we use our Lemmas1 and6 instead of Theorem 1 and Lemma 6 of [58]. In particular, the constants used in the proof of [58] are mapped as:
1 v 2 p 1 c−1 u ! (p) p X u n + p Kψ 7→ A = |cn|t C n n=0 (67) v !u ! (p) X c−1− k+l max (k, l) + p u max (k, l) M 7→ B = |c c |η 2 t2|l−k| . ψ C k l p − 1 min (k, l) 0≤k,l≤c−1
24 Note that we also adapt the notations from [58] for the global coherence of this work as: n 7→ N 0 + M + Q k 7→ K q 7→ Q/4 m 7→ M E 7→ E − 1 (68) s 7→ S r 7→ R 7→ 0 7→ . With these mappings, following the proof of [58] we obtain:
⊗M M M deF inetti F (|Ci , ρ ) − FC (ρ) ≤ 2 + PC , (69)
support deF inetti or R > S, i.e., the protocol aborts in step 3, with probability greater than 1 − (PC + PC + choice Hoeffding PC + PC ), where " # K Q 2S 2 P support = 8K3/2 exp − − C 9 4(N 0 + M + Q) K 2 QE /2 Q(Q + 4) P deFinetti = exp − C 4 8(N 0 + M + Q) (70) M(Q + M − 1) P choice = C N 0 + M ! 1+ c 1+ c !2 N 0 + M N 0 + M − Q p 2QM p P Hoeffding = 2 exp − − , C 2+ 2c 0 Q 2M p GC,p N where c−1− k+l 2 v c !u ! (p) p X max (k, l) + p u |l−k| max (k, l), Cψ 7→ GC,p = A |ckcl| t2 C 1 p − 1 min (k, l) 0≤k,l≤c−1 (p) p M AC (71) is a constant independent of ρ (the expression of GC,p used here depends on M and without loss of generality, since is upper bounded by its value for /M = 1). Setting
7+ 2c M p N 0 = O 4+ 2c p 7+ 2c M p K = O 4+ 2c p (72) 4+ c ! M p Q = O 2+ 2c p E = O(log M) S = o(Q), with Eq. (69) we obtain
⊗M M M F (|Ci , ρ ) − FC (ρ) = O(), (73)
25 with probability 1 − PC , where ! support deFinetti choice Hoeffding 1 PC = PC + PC + PC + PC = O 1 , (74) poly(M, ) for 7+ 2c M p N = N 0 + K + Q = O . (75) 4+ 2c p
Since the parameter p ∈ N∗ may vary freely, the asymptotic scaling of the number of samples N M 7 needed for a precision > 0 and a polynomial confidence thus is given by N = O( 4 ).
D Proof of Lemma2
In this section, we prove a generalised version of Lemma2 for tensor product of Hilbert spaces. Setting M = 1, we retrieve the Lemma in the main text:
m×M ⊗M ⊗M Lemma 7. Let ρ be an m × M-mode state in H = H1 ⊗ · · · ⊗ Hm . For all i ∈ {1, . . . , m}, M m×M ⊗M we denote by ρi = Tr ⊗M (ρ) the M-mode reduced state of ρ over the Hilbert space Hi . Let H\Hi |ψ1i ,..., |ψmi be pure states in H1,..., Hm. Then,
m !! m m ! m×M O ⊗M X M ⊗M m×M O ⊗M 1 − m 1 − F ρ , ψi ≤ 1 − 1 − F ρi , ψi ≤ F ρ , ψi . (76) i=1 i=1 i=1
Proof. Since |ψ1i ,..., |ψmi are pure states,
m ! m×M O ⊗M m×M ⊗M ⊗M F ρ , ψi = Tr [ρ |ψ1ihψ1| ⊗ · · · ⊗ |ψmihψm| ], (77) i=1 and M ⊗M M ⊗M F (ρ , ψ ) = Tr[ρ |ψiihψi| ] i i i (78) m×M ⊗M = Tr[ρ (1 ⊗ |ψiihψi| ⊗ 1)], for all i ∈ {1, . . . , m}, where 1 is the identity operator. The right hand side of Eq. (76) is obtained by m×M Nm ⊗M writing F (ρ , i=1 ψi ) as a telescopic sum:
m×M ⊗M ⊗M m×M Tr [ρ |ψ1ihψ1| ⊗ ... ⊗ |ψmi hψm|] = Tr [ρ 1] m×M ⊗M − Tr [ρ (1 − |ψ1ihψ1| ) ⊗ 1] m×M ⊗M ⊗M − Tr [ρ |ψ1ihψ1| ⊗ (1 − |ψ2ihψ2| ) ⊗ 1] m×M ⊗M ⊗M ⊗M − Tr [ρ |ψ1ihψ1| ⊗ |ψ2ihψ2| ⊗ (1 − |ψ3ihψ3| ) ⊗ 1] − ... m×M ⊗M ⊗M ⊗M − Tr [ρ |ψ1ihψ1| ⊗ |ψ2ihψ2| ⊗ · · · ⊗ (1 − |ψmihψm| )] m X m×M ⊗M ≥ 1 − Tr[ρ (1 ⊗ (1 − |ψiihψi| ) ⊗ 1)] i=1 m X m×M ⊗M = 1 − 1 − Tr[ρ (1 ⊗ |ψiihψi| ⊗ 1)] , i=1 (79)
26 by linearity of the trace, where we used Tr (ρm×M ) = 1. This gives
m ! m m×M O ⊗M X M ⊗M F ρ , ψi ≥ 1 − 1 − F ρi , ψi , (80) i=1 i=1 with Eqs. (77) and (78). The left hand side of Eq. (76) is obtained using:
m ! m×M O ⊗M m×M ⊗M ⊗M F ρ , ψi = Tr [ρ |ψ1ihψ1| ⊗ · · · ⊗ |ψmihψm| ] i=1 m×M ⊗M (81) ≤ Tr [ρ (1 ⊗ |ψiihψi| ⊗ 1)] M ⊗M = F ρi , ψi , for all i ∈ {1, . . . , m}, and summing over i.
Note that this result is not restricted to a particular protocol for fidelity estimation nor to the continuous-variable regime: if the fidelities of the single subsystems of a quantum state over m sub- λ systems with some target pure states are higher than 1 − m , for some λ > 0, then by Lemma2 the general state has fidelity at least 1 − λ with the tensor product of the m pure states.
E Proof of Lemma3
In this section, we prove Lemma3 from the main text which we recall below: Lemma 8. Let β, ξ ∈ Cm and let Vˆ = Sˆ(ξ)Dˆ(β) Uˆ, where Uˆ is an m-mode passive linear transforma- tion with m × m unitary matrix U. For all α ∈ Cm, let γ = Uα + β. Then,
ξ ˆ 0 ˆ † Πγ = V ΠαV . (82) Proof. Recall that the POVM elements for a tensor product of unbalanced heterodyne detections with unbalancing parameters ξ ∈ Cm are given by 1 Πξ = |α, ξihα, ξ| , (83) α πm for all α, ξ ∈ Cm, where |α, ξi = Sˆ(ξ)Dˆ(α) |0i is a tensor product of squeezed coherent states. The POVM elements of a tensor product of single-mode balanced heterodyne detection are given by 0 m Πα, for all α ∈ C , and we have ξ ˆ 0 ˆ† Πα = S(ξ)ΠαS (ξ). (84) In particular, a single-mode squeezing followed by a single-mode balanced heterodyne detection can be simulated by performing directly an heterodyne detection unbalanced according to the squeezing parameter. One retrieves balanced heterodyne detection by setting the unbalancing parameter to 0 and homodyne detection by letting the modulus of the unbalancing parameter go to infinity. Passive linear transformations correspond to unitary transformations of the creation and annihilation operators of the modes. These transformations, which may be implemented by unitary optical interferometers, map coherent states to coherent states: if Uˆ is a passive linear transformation and U is the unitary matrix describing its action on the creation and annihilation operators of the modes, an input coherent state |αi is mapped to an output coherent state Uˆ |αi = |Uαi, where Uα is obtained by multiplying the vector α by the unitary matrix U. Hence, the POVM elements of a passive linear transformation followed by a product of single-mode balanced heterodyne detections are given by
ˆ 0 ˆ † 0 UΠαU = ΠUα, (85)
27 for all α ∈ Cm. This implies that the passive linear transformation Uˆ † followed by a tensor product of single-mode balanced heterodyne detections can be simulated by performing the heterodyne detections first, then multiplying the vector of samples obtained by U. A similar property holds with single-mode displacements: since displacements map coherent states to coherent states, up to a global phase, by displacing their amplitude, a single-mode displacement followed by a single-mode heterodyne detection can be simulated by performing the heterodyne detection first, then translating the sample obtained according to the displacement amplitude. In particular we have
ˆ 0 ˆ † 0 D(β)ΠαD (β) = Πα+β, (86)
m for all α, β ∈ C , where α + β = (α1 + β1, . . . , αm + βm). Combining the properties of heterodyne detection in Eqs. (84), (85) and (86), we have:
0 † 0 UˆΠ Uˆ = Π , α Uα ˆ 0 ˆ † 0 D(β)ΠαD (β) = Πα+β, (87) ˆ 0 ˆ† ξ S(ξ)ΠαS (ξ) = Πα, for all α, β, ξ ∈ Cm and all m-mode passive linear transformations Uˆ with m × m unitary matrix U. Writing Vˆ = Sˆ(ξ)Dˆ(β)Uˆ, we obtain
ˆ 0 ˆ † ˆ ˆ ˆ 0 ˆ † ˆ † ˆ† V ΠαV = S(ξ)D(β)UΠαU D (β)S (ξ) ˆ ˆ 0 ˆ † ˆ† = S(ξ)D(β)ΠUαD (β)S (ξ) (88) ˆ 0 ˆ† = S(ξ)ΠUα+βS (ξ) ξ = ΠUα+β.
F Proof of Theorem2
In this section, we prove the efficiency of Protocol2, which we recall below:
∗ Pci−1 Protocol 2 (Multimode fidelity witness estimation). Let c1, . . . , cm ∈ N . Let |Cii = n=0 ci,n |ni be a core state, for all i ∈ {1, . . . , m}. Let Uˆ be an m-mode passive linear transformation with m × m m ˆ ˆ ˆ Nm unitary matrix U, and let β, ξ ∈ C . We write |ψi = S(ξ)D(β) U i=1 |Cii the m-mode target pure ∗ ∗ ⊗N+M state. Let N,M ∈ N , and let p1, . . . , pm ∈ N and 0 < η1, . . . , ηm < 1 be free parameters. Let ρ be N + M copies of an unknown m-mode (mixed) quantum state ρ.
1. Measure all m subsystems of N copies of ρ with unbalanced heterodyne detection with unbalancing (1) (N) m parameters ξ = (ξ1, . . . , ξm), obtaining the vectors of samples γ ,..., γ ∈ C . 2. For all k ∈ {1,...,N}, compute the vectors α(k) = U † γ(k) − β . We write α(k) = (k) (k) m (α1 , . . . αm ) ∈ C .
3. For all i ∈ {1, . . . , m}, compute the mean F (ρ) of the function z 7→ g(pi)(z, η ) (defined in Ci Ci i (1) (N) Eq. (8)) over the samples αi , . . . , αi ∈ C. Pm M 4. Compute the fidelity witness estimate Wψ = 1 − i=1 (1 − FCi (ρ) ).
The value Wψ obtained is an estimate of a tight lower bound on the fidelity between the M remaining ˆ ˆ ˆ Nm copies of ρ and M copies of the m-mode target state |ψi = S(ξ)D(β) U i=1 |Cii. The efficiency and completeness of the protocol are summarised by the following result:
28 Theorem 6. Let > 0. With the notations of Protocol2,
h ⊗M ⊗M i ⊗M ⊗M 1 − m 1 − F (|ψi , ρ ) − ≤ Wψ ≤ F (|ψi , ρ ) + , (89)
iid with probability 1 − PW , where
2ci m 2+ p iid X N i PW = 2 exp − 2c , (90) 2+ i i=1 pi M KCi,pi where for all i ∈ {1, . . . , m}, KCi,pi is a constant independent of ρ, defined in Eq. (59). Moreover, if ⊗N+M ⊗N+M iid the tested state is perfect, i.e., ρ = |ψihψ| , then Wψ ≥ 1 − with probability 1 − PW . Proof. We use the notations of the protocol above and we first prove the theorem in the case where the target state is a tensor product of single-mode pure states, i.e., Sˆ(ξ)Dˆ(β) Uˆ = 1 and α(k) = γ(k) for all k ∈ {1,...,N}. Nm We thus consider for the target state a tensor product |ψi = i=1 |Cii of core states. For all Pci ∗ i ∈ {1, . . . , m} we write |Cii = n=0 ci,n |ni, where ci ∈ N , and ρi = Tr{1,...,m}\{i}(ρ) the reduced th state of ρ over the i mode. Let > 0. For all i ∈ {1, . . . , m}, with ηi ≤ ηCi,pi , defined in Eq. (34), we have by Theorem4, with m : F (|C i⊗M , ρ⊗M ) − F (ρ)M ≤ , (91) i i Ci m with probability higher than 1 − P iid, where Ci
2ci 2+ p iid N i PC = 2 exp − 2c 2c , (92) i 2+ i 2+ i pi pi M m KCi,pi where KCi,pi is a constant independent of ρ given in Eq. (59). Hence, taking the union bound of the failure probabilities P iid, we obtain Ci
m m 1 − X 1 − F (|C i⊗M , ρ⊗M ) − W = X F (|C i⊗M , ρ⊗M ) − F (ρ)M i i ψ i i Ci i=1 i=1 m (93) ≤ X F (|C i⊗M , ρ⊗M ) − F (ρ)M i i Ci i=1 ≤ ,
iid with probability higher than 1 − PW , where
2ci m 2+ p iid X N i PW = 2 exp − 2c 2c . (94) 2+ i 2+ i i=1 pi pi M m KCi,pi
m×M ⊗M By Lemma7, with ρ = ρ and |ψii = |Cii, " # m 1 m 1 − X 1 − F (|C i⊗M , ρ⊗M ) ≤ F (|ψi⊗M , ρ⊗M ) ≤ exp − X 1 − F (|C i⊗M , ρ⊗M ) . (95) i i m i i i=1 i=1 Hence,
m h ⊗M ⊗M i X ⊗M ⊗M ⊗M ⊗M 1 − m 1 − F (|ψi , ρ ) ≤ 1 − 1 − F (|Cii , ρi ) ≤ F (|ψi , ρ ). (96) i=1
29 With Eq. (93) we obtain
h ⊗M ⊗M i ⊗M ⊗M 1 − m 1 − F (|ψi , ρ ) − ≤ Wψ ≤ F (|ψi , ρ ) + , (97)
iid with probability 1 − PW , where
2ci m 2+ p iid X N i PW = 2 exp − 2c 2c , (98) 2+ i 2+ i i=1 pi pi M m KCi,pi where for all i ∈ {1, . . . , m}, KCi,pi is a constant independent of ρ, defined in Eq. (59). Moreover, if the tested state is perfect, i.e., ρ⊗N+M = |ψihψ|⊗N+M , then F (|ψi⊗M , ρ⊗M ) = 1. In that case, by Eq. (97), Wψ ≥ 1 − , (99) iid with probability 1 − PW . We now generalise the previous proof to the case where the target state is of the form m O |ψi = Sˆ(ξ)Dˆ(β) Uˆ |Cii , (100) i=1
Pci−1 ˆ where for all i ∈ {1, . . . , m} each of the states |Cii = n=0 ci,n |ni is a core state, where U is an m-mode passive linear transformation with m × m unitary matrix U and where ξ, β ∈ Cm. To that end, we make use of the properties of heterodyne detection: by Lemma8, writing Vˆ = Sˆ(ξ)Dˆ(β) Uˆ, ˆ 0 ˆ † ξ † the POVM {V ΠαV }α∈Cm can be simulated with the POVM {Πγ }γ∈Cm by computing α = U (γ − β), i.e., translating the vector of samples γ by the vector of complex amplitudes −β and multiplying the vector obtained by the m × m unitary matrix U †. Formally, let ρ be an m-mode (mixed) state, then, † ˆ 0 ˆ 0 † Tr (V ρV Πα) = Tr (ρ V ΠαV ) ξ (101) = Tr (ρ ΠUα+β).
In particular, computing the fidelity witness estimate Wψ in Protocol2, i.e., using samples γ from unbalanced heterodyne detection of copies of ρ post-processed as α = U †(γ − β), gives " m !# m ! O ⊗M † ⊗M O ⊗M † ⊗M 1−m 1 − F |CiihCi| , (V ρV ) − ≤ Wψ ≤ F |CiihCi| , (V ρV ) +, (102) i=1 i=1 iid with probability 1 − PW by Eq. (97). Given that m ! O ⊗M † ⊗M ⊗M ⊗M F |CiihCi| , (V ρV ) = F (ψ , ρ ), (103) i=1 we finally obtain
h ⊗M ⊗M i ⊗M ⊗M 1 − m 1 − F (|ψi , ρ ) − ≤ Wψ ≤ F (|ψi , ρ ) + , (104)
iid iid with probability 1 − PW , where PW is defined in Eq. (90).
The estimate of the fidelity witness obtained is tight when the fidelity is close to 1. Writing ni the number of indices j ∈ {1, . . . , m} such that cj = ci, for all i ∈ {1, . . . , m}, the number of samples needed for a precision > 0 of the estimate Wψ and a confidence 1 − δ scales as
2c 2+ i Mm pi 1 N = O max log(ni) log , (105) i δ with Eq. (90).
30 G Removing the i.i.d. assumption for Protocol2
In this section, we derive a version of Protocol2 which does not assume i.i.d. state preparation. ∗ For N,M ∈ N , let Hi and Kk denote single-mode infinite-dimensional Hilbert spaces, for all i ∈ {1, . . . , m} and all k ∈ {1,...,N + M}. Let H be an m × (N + M)-mode infinite-dimensional Hilbert space. We write ⊗m ⊗m H'K1 ⊗ · · · ⊗ KN+M (106) ⊗(N+M) ⊗(N+M) 'H1 ⊗ · · · ⊗ Hm . For any ρm×(N+M) ∈ H, we define
m m×(N+M) σk = Tr ⊗m (ρ ), (107) H\Kk
⊗m the m-mode reduced state over Kk , for all k ∈ {1,...,N + K + Q + M}. We also define
N+M m×(N+M) ρi = Tr ⊗(N+M) (ρ ), (108) H\Hi
⊗(N+M) the (N + M)-mode reduced state over Hi , for all i ∈ {1, . . . , m} (see Fig.4). The protocol is then as follows:
∗ Protocol 5 (General multimode-mode fidelity witness estimation). Let c1, . . . , cm ∈ N . Let Pci−1 ˆ |Cii = n=0 ci,n |ni be a core state, for all i ∈ {1, . . . , m}. Let U be an m-mode passive linear trans- m ˆ ˆ ˆ Nm formation with m × m unitary matrix U, and let β, ξ ∈ C . We write |ψi = S(ξ)D(β) U i=1 |Cii ∗ ∗ the m-mode target pure state. Let N,M ∈ N , and let p1, . . . , pm ∈ N , 0 < η1, . . . , ηm < 1, and 0 0 E1,...,Em,S1,...,Sm ∈ N be free parameters. We write N = N + K + Q, for N ,K,Q ∈ N. Let ρm×(N+M) ∈ H be an unknown quantum state over m × (N + M) subsystems.
0 m 1. Measure all the m subsystems of N = N + K + Q chosen at random m-mode reduced states σk (see Eq. (107)) of ρm×(N+M) with unbalanced heterodyne detection with unbalancing parameter ξ, obtaining the vectors of samples γ(1),..., γ(N 0+K+Q) ∈ Cm. Let ρm×M be the remaining state over m × M subsystems.
2. Discard the last Q vectors of samples. 3. For all k ∈ {1,...,N 0 + K}, compute the vectors α(k) = U † γ(k) − β . We write α(k) = (k) (k) m (α1 , . . . αm ) ∈ C .
(k) (k) 2 4. For all i ∈ {1, . . . , m}, record the number Ri of samples αi such that |αi | + 1 > Ei, for 0 0 k ∈ {N + 1,...,N + K}. The protocol aborts if Ri > Si for any i ∈ {1, . . . , m}.
5. For all i ∈ {1, . . . , m}, compute the mean F (ρ) of the function z 7→ g(pi)(z, η ) (defined in Ci Ci i (1) (N 0) Eq. (8)) over the samples αi , . . . , αi ∈ C. Pm M 6. Compute the fidelity witness estimate Wψ = 1 − i=1 (1 − FCi (ρ) ). Akin to Protocol4 compared to Protocol1, this protocol differs from Protocol2 by two additional classical post-processing steps, steps 2 and 4. These steps are part of a de Finetti reduction for infinite-dimensional systems [65] detailed in [58]. In particular, step 3 is an energy test, and the energy parameters Ei and Si should be chosen to guarantee completeness, i.e., if the perfect state is sent then it passes the energy test with high probability. The value Wψ obtained is an estimate of a tight lower bound of the fidelity between the remaining state ρm×M over m × M subsystems and M copies of the m-mode target state |ψi. The efficiency of the protocol is summarised by the following result:
31 . . .
m
. . .
m
Figure 4: The notations for the subsystems of a quantum state ρm×(N+M) over m × (N + M) modes, seen as N + M groups of m subsystems or as m groups of N + M subsystems. The red dots depict the single-mode subsystems of ρm×(N+M). The reduced state of ρm×(N+M) corresponding to the ith group of N + M subsystems is denoted N+M m×(N+M) th ρi , for all i ∈ {1, . . . , m}, and the reduced state of ρ corresponding to the k group of m subsystems m is denoted σk , for all k ∈ {1,...,N + M}.
Theorem 7. Let > 0. With the notations of Protocol4 and η ≤ ηC,p, defined in Eq. (34),
h ⊗M m×M i ⊗M m×M 1 − m 1 − F (|ψi , ρ ) − O() ≤ Wψ ≤ F (|ψi , ρ ) + O() (109) or the protocol aborts in step 3, with probability greater than 1 − PW , where ! 1 PW = O 1 , (110) poly(m, M, ) for 7+ 2c 4+ 2c M p m p N = O . (111) 4+ 2c p Proof. For the proof we only consider the case where the target state is a tensor product of core states Nm ˆ ˆ ˆ |ψi = i=1 |Cii, i.e., S(ξ)D(β) U = 1, since the generalisation to the multimode target states of the ˆ ˆ ˆ Nm form S(ξ)D(β) U i=1 |Cii using Lemma3 is identical to the i.i.d. case, detailed in sectionF. Then, the proof is similar to the one of Theorem6, using Theorem5 instead of Theorem4. m×M ⊗M ⊗M Writing ρ ∈ H1 ⊗ · · · ⊗ Hm , for all i ∈ {1, . . . , m} (see Fig.4 with N = 0), let
M m×M ρi = TrN H⊗M (ρ ), (112) j6=i j
⊗M m×M be the reduced state over Hi of the state ρ . By Theorem5,
F (|C i⊗M , ρM ) − F (ρ)M = O() (113) i i Ci
or the protocol aborts in step 3, with probability greater than 1 − PCi , where ! 1 PCi = O 1 , (114) poly(M, )
32 for 7+ 2c M p N = O . (115) 4+ 2c p Replacing by m and taking the union bound of the failure probabilities we obtain
m m X ⊗M M X ⊗M M 1 − 1 − F (|Cii , ρi ) − Wψ = F (|Cii , ρi ) − FCi(ρ) i=1 i=1 m (116) X ⊗M M ≤ F (|Cii , ρi ) − FCi(ρ) i=1 = O(), or the protocol aborts in step 3, with probability greater than 1 − PW , where ! 1 PW = O 1 , (117) poly(m, M, ) for 7+ 2c 4+ 2c M p m p N = O . (118) 4+ 2c p By Lemma7 we have
m h ⊗M m×M i X ⊗M M ⊗M m×M 1 − m 1 − F (|ψi , ρ ) ≤ 1 − 1 − F (|Cii , ρi ) ≤ F (|ψi , ρ ), (119) i=1 so with Eq. (116) we finally obtain
h ⊗M m×M i ⊗M m×M 1 − m 1 − F (|ψi , ρ ) − O() ≤ Wψ ≤ F (|ψi , ρ ) + O() (120) or the protocol aborts in step 3, with probability greater than 1 − PW , where ! 1 PW = O 1 , (121) poly(m, M, ) for 7+ 2c 4+ 2c M p m p N = O . (122) 4+ 2c p
Since the parameter p ∈ N∗ may vary freely, the asymptotic scaling of the number of samples N M 7m4 needed for a precision > 0 and a polynomial confidence thus is given by N = O( 4 ).
H Optimised verification of Boson Sampling
Using Protocol2 directly to certify the output states of a Boson Sampling experiments yields an 2 2+ p 1 efficiency N = O(m log m log δ ) for a constant error in the estimation, with a failure probability δ, where the constant prefactor scales with the free parameter p, giving an asymptotic scaling of 2 1 N = O(m log m log δ ). We show in this section that a refined version of Protocol2 using a single-mode fidelity witness as a subroutine rather than a single-mode fidelity estimate (from Protocol1) actually 2 1 yields an efficiency N = O(m log m log δ ) already in the finite regime, thus proving Theorem3.
33 We use the fact that the target core states appearing in the expressions of Boson Sampling output states are Fock states, in order to control the analytical error from Lemma4 derived in sectionA, which we recall below. ∗ P+∞ Let p ∈ N , let k, l ∈ N and let 0 < η < 1. Let ρ = i,j=0 ρij |iihj| be a density operator. Then, v +∞ !u ! ! (p) p+1 X q q − 1 u k + q l + q E [g (α, η)] = ρkl + (−1) ρk+q,l+qη t , (123) α←Q k,l ρ q=p p − 1 k l where the function gk,l is defined in Eq. (19). In particular, when k = l, for a target Fock state |kihk|, and for p even we obtain
+∞ ! ! (p) X q q − 1 k + q E [g (α, η)] = ρkk − ρk+q,k+qη . (124) α←Q k,k ρ q=p p − 1 k
(p) The sum on the right hand side is positive, so E [gk,k(α, η)] is always a lower bound on the fidelity α←Qρ between the state ρ and the Fock state |kihk| (with analytical error bounded independently of ρ by Eq. (33)). Moreover, this lower bound is tight when ρ is close to the Fock state |kihk|. Using this single-mode fidelity witness in Protocol2 instead of the fidelity estimate from Protocol1, we obtain with Hoeffding inequality an estimate of a tight multimode fidelity witness with constant 2 1 precision and failure probability δ using N = O(m log m log δ ) samples from product single-mode heterodyne detection. The constant prefactor can still be optimised by playing with the choice of p even and 0 < η < 1. Note that this optimised protocol can also be employed in the more general case of the certification of multimode quantum states of the form
m ! m ! O O Gˆi Uˆ |nii , (125) i=1 i=1 where each state |nii is a single-mode Fock state, where Uˆ is an m-mode passive linear transformation and where each Gˆi is a single-mode Gaussian unitary operation, for all i ∈ {1, . . . , m}.
34