Fault-Tolerant Preparation of Stabilizer States for Quantum CSS Codes by Classical Error-Correcting Codes

Fault-tolerant Preparation of Stabilizer States for Quantum CSS Codes by Classical Error-Correcting Codes

Ching-Yi Lai,1, ∗ Yi-Cong Zheng,2, 3 and Todd A. Brun4 1Institute of Information Science, Academia Sinica, Taipei, Taiwan 11529 2Centre for Quantum Technology, National University of Singapore, Singapore 117543 3Yale-NUS College, Singapore 138614 4Electrical Engineering Department, University of Southern California, Los Angeles, California, USA 90089. (Dated: March 10, 2017) Stabilizer states are extensively studied in quantum information theory for their structures based on the Pauli group. Calderbank-Shor-Steane (CSS) stabilizer states are of particular importance in their application to fault-tolerant quantum computation (FTQC). However, how to fault-tolerantly prepare arbitrary CSS stabilizer states for general CSS stabilizer codes is still unknown, and their preparation can be highly costly in computational resources. In this paper, we show how to prepare a large class of CSS stabilizer states useful for FTQC. We propose distillation protocols using syndrome encoding by classical codes or quantum CSS codes. Along the same lines, we show that classical coding techniques can reduce the ancilla consumption in Steane syndrome extraction by using additional transversal controlled-NOT gates and classical computing power. In the scenario of a ﬁxed ancilla consumption rate, we can increase the frequency of quantum error correction and eﬀectively lower the error rate.

I. INTRODUCTION of CSS stabilizer states—codewords of the CSS code that are eigenstates of some set of logical operators—for the Quantum states are inherently susceptible to noise, purpose of error correction or computation. and physical devices that process quantum information CSS stabilizer states can be prepared by using Clifford are themselves generally faulty. Reliable quantum com- encoding circuits (with faulty gates) [8]. However, this putation is still possible, however, with the help of quan- is not fault-tolerant, so the generated states need to be tum error-correcting codes. Quantum stabilizer codes verified. Basic CSS stabilizer states, such as the logical are an especially important class of quantum codes that states |0iL or |+iL, are usually fault-tolerantly generated are similar to classical linear block codes [1], in which by specific quantum circuits in FTQC schemes [9–18]. quantum information is encoded in the eigenstates— For general CSS codes, it is not known how to produce codewords—of a set of commuting Pauli operators called arbitrary stabilizer states that are “clean” enough for stabilizer generators. quantum computation, especially when the code length Fault-tolerant quantum computation (FTQC) is the is large. task of accomplishing quantum computation with arbi- In other contexts (e.g., entanglement purification [19, trary accuracy using imperfect quantum circuits. Pro- 20] or magic state distillation [21]), this problem is tack- tected by one or more stabilizer codes, a code-based led by distillation: making a bunch of imperfect states, FTQC scheme computes in the codespace of a stabi- and then carrying out a protocol to produce a smaller lizer code, interspersed with repeated error corrections. number of better states. In this paper we show how clas- A fault-tolerant procedure has the property that if only sical error-correcting codes, together with the Steane syn- one component (or more generally, a small number of drome extraction, can be applied to distill a large class of components) of the procedure fails, the errors produced useful CSS stabilizer states (Distillation Protocol I), by by this failure are correctable, and are not transformed actively correcting errors on a fraction of the imperfect by the procedure into an uncorrectable error of the un- stabilizer states that are produced by non-fault-tolerant arXiv:1605.05647v4 [quant-ph] 9 Mar 2017 derlying error-correcting code. Threshold theorems have (or fault-tolerant) methods. shown that it is possible to realize quantum compu- If we have clean ancillas, we can use the Steane syn- tations of arbitrary size with arbitrary accuracy, pro- drome extraction to learn information about the errors— vided that the errors are sufficiently local and their rates the error syndrome [22]. A transversal circuit is applied fall below a threshold [2–5]. Currently, most FTQC between the codeword and two clean ancillas, and bit- schemes use Calderbank-Shor-Steane (CSS) type stabi- wise qubit measurements are applied to the ancillas and lizer codes [6, 7], where every stabilizer generator can be the error syndrome is obtained by computing the parities chosen to be the tensor products of identity and either of the corresponding measurement outcomes. However, X or Z Pauli operators, and so can the logical opera- this would obviously consume more clean ancillas than tors. Most such FTQC schemes require the preparation it produces. Since in our scenario only noisy stabilizer states are available, we combine Steane extraction with classical coding. After performing a transversal circuit on a set of noisy CSS stabilizer states, a subset of the ∗ [email protected] states are measured bitwise and a set of parities is cal- 2 culated, and classical decoding is then applied to this set A. Classical Codes, Stabilizer Codes, and CSS of parities to learn the error syndromes of the remain- Codes ing stabilizer states. Quantum error correction can be applied accordingly to obtain clean ancillas. Along the Error-correcting codes protect digital information from way, we also develop a distillation protocol using quan- noise by adding redundancy. The encoded informa- tum CSS codes rather than classical codes (Distillation tion has to satisfy some mathematical relations—parity Protocol II). checks—so that errors can be detected if any of the parity The only operations needed in the two protocols checks are violated. Let H be an (m − k) × m binary ma- are transversal controlled-NOT (CNOT) gates, bitwise trix with full rank. Then an [m, k, d] linear binary code C single-qubit measurements, classical decoding, and cor- associated with parity-check matrix H is a k−dimensional rection by applying Pauli gates (see Sec. III). These fea- subspace of all binary ordered m−tuples (row vectors) in m tures for fault-tolerance are similar to the constraint of Z2 such that local operations and classical communication (LOCC) in some multipartite protocols, where each qubit is consid- vHT = 0, ered as a single party. Therefore our distillation protocols naturally apply to the task of multipartite entanglement for all v ∈ C, where HT is the transpose of H and the purification for CSS stabilizer states by LOCC [23–28]. addition is modulo 2. Such row vectors v are called code- T m For simplicity, we only consider CSS codes that encode words of C. If Hv˜ 6= 0 for somev ˜ ∈ Z2 , we know that one logical qubit in this paper. Our results, however, can some error occurred. Hence, the rows of H are called be generalized easily to multi-qubit codes. parity-checks and Hv˜T is called the error syndrome of v˜. The parameter d is called the minimum distance of C The methods used for distilling ancillas—combining so that any two codewords of C differ in at least d bits. Steane syndrome extraction with classical error d−1 This code can correct arbitrary b 2 c-bit errors. Since correction—can also solve a different (but related) the code is linear, C can also be defined as the row space problem. Steane syndrome extraction is used for quan- of an k × m generator matrix G, which satisfies tum CSS codes with high-weight stabilizer generators. However, each error-correction step requires two clean GHT = 0. ancillas per (quantum) codeword, which are of the same size as the underlying CSS codes and are expensive, That is, G and H are orthogonal. The dual code C⊥ of especially when the code length is large. We therefore C is the row space of H. For more properties of classical would like to use as few ancillas as possible during codes, please refer to [29]. syndrome measurement without seriously degrading the Now we consider the quantum case. We focus on the performance of error correction. To achieve this, we two-level quantum system—the qubit. A pure qubit state propose an ancilla saving protocol using classical codes. is a unit vector in the two-dimensional complex vector Rather than using two ancillas for each code block, a space C2 with the usual inner product and an (ordered) smaller number of ancillas is shared among multiple code orthonormal basis {|0i, |1i}. The n-qubit state space is n blocks, and classical decoding is used to separate out the 2 . Let G = G⊗n denote the n-fold Pauli group, where error syndromes of the different blocks. Assuming that C n 1 the error rate is low enough, this can reduce the rate of G1 = {±I, ±iI, ±X, ±iX, ±Y, ±iY, ±Z, ±iZ}, (1) ancilla consumption for a given rate of error correction without seriously reducing its accuracy. and The paper is organized as follows. We provide prelimi- 1 0 0 1 I = ,X = , nary material in the Sec. II, including the basics of stabi- 0 1 1 0 lizer codes, CSS codes, and Steane syndrome extraction. The distillation protocols by classical codes and quantum CSS codes are given in Subsec. III A and Subsec. III B, 1 0 Z = ,Y = iXZ. respectively. Following that, we describe the ancilla sav- 0 −1 ing protocol in Sec. IV. We conclude in Sec. V. ⊗j−1 ⊗n−j We use the notation Xj to denote I ⊗ X ⊗ I where the underlying length n is clear from the context, and similarly for Yj and Zj. We also use the notation Xe n n ei for e = e1 ··· en ∈ Z2 (row vector) to denote ⊗i=1X , II. PRELIMINARIES and similarly for Ze. In general, an n-fold Pauli operator can be expressed as

0 c n ei fi c We begin with a brief review of classical codes, quan- i ⊗i=1 X Z = i XeZf (2) tum stabilizer codes, CSS codes, and Steane syndrome 0 n extraction. for c, c ∈ {0, 1, 2, 3} and e, f ∈ Z2 . Thus (e, f) is called 3

c the binary representation of the Pauli operator i XeZf . bilizer generators all commute. For example, I ⊗ X ⊗ I ⊗ I ⊗ Z = X2Z5 = X01000Z00001. The check matrix of an [[n, n − l]] stabilizer code is ⊗n The identity I will be denoted by id. Let Ci(Xj) an l × 2n binary matrix whose rows are the binary repre- denote the CNOT gate with control qubit i and target sentations (Eq. (2)) of the stabilizer generators g1, . . . , gl. ⊗n−1 qubit j. For example, C1(X2) = |0ih0| ⊗ I + |1ih1| ⊗ For the CSS code defined by HZ and HX , its check matrix X ⊗ I⊗n−2. The quantum circuits in this paper consist is only of CNOT gates, together with single-qubit measure- H 0 ments in the X or Z basis. Z . (6) 0 HX Suppose S is an Abelian subgroup of Gn with a set of l independent generators {g , . . . , g }, and S does not 1 l The error syndrome of a Pauli error is the string of include −I. Every element in G has eigenvalues ±1. n binary outcomes of measuring the stabilizers g , . . . , g . An [[n, n − l]] quantum stabilizer code C(S) is defined as 1 l Since a Pauli error can be expressed as a product of X the 2n−l-dimensional subspace of the n-qubit state space n and Z operators, error correction can be done by treat- ( 2 ) fixed by S, which is the joint-(+1) eigenspace of C ing Pauli X and Z errors separately. For CSS codes, g1, . . . , gl. Then for a codeword |ψi ∈ C(S), the eigenvalues of g1, . . . , grZ (respectively, grZ +1, . . . , gl) g|ψi = |ψi correspond to the error syndrome of X (resp. Z) errors. Suppose a Pauli error XeZf occurs on a codeword, where n rZ for all g ∈ S. When l = n, C(S) has only one eigenstate e, f ∈ Z2 . Then its (binary) X error syndrome sX ∈ Z2 , (up to a phase) and this state is called a stabilizer state. which corresponds to the eigenvalues of g1, . . . , grZ , is The error operators in this paper are assumed to be given by Pauli errors (i.e., operators in G ). This is not actually n s = eHT , (7) as restrictive as it sounds: since the Pauli operators form X Z a basis, the ability to correct a set of Pauli errors implies and the Z error syndrome is defined similarly: the ability to correct a large class of general errors. If a Pauli error occurs on |ψi, some eigenvalues of g , . . . , g T 1 l sZ = eH . (8) may be flipped. Therefore, we gain information about the Z error by measuring the stabilizer generators g1, . . . , gl, In addition to the stabilizer elements, there will in gen- and the measurement outcomes (in bits) of g1, . . . , gl are eral also be Pauli operators that commute with all the called error syndrome. (If the eigenvalue of a stabilizer stabilizer generators without being in the stabilizer them- is +1 or −1, its corresponding syndrome bit is 0 or 1, selves. We call these logical operators. For a CSS code, respectively.) Then a quantum decoder has to choose it is always possible to find a subset of logical opera- a good recovery operation based on the measured error tors involving only the identity and either X or Z op- syndromes. erators, which generate all other logical operators up to CSS codes are a class of stabilizer codes whose stabi- multiplication by a stabilizer element. Moreover, these lizer generators consist of the tensor products of identity logical generators can be chosen in anticommuting pairs, and either X or Z operators [6, 7]. Let [M]i,j denote usually denoted X¯j, Z¯j, where each pair corresponds to the (i, j) entry of a matrix M. (We may also use [v]i logical qubit j in the code. For simplicity, in the rest to denote the ith entry of a vector v.) A CSS code can of this paper we consider the preparation of stabilizer be defined by two matrices that are orthogonal to each states of CSS codes Q that encode one logical qubit (or other. Suppose HZ and HX are rZ × n and rX × n matri- rZ + rX = n − 1). Our results can be directly generalized ces (rZ + rX ≤ n) with full rank rZ and rX , respectively, to the case of [[n, n − rZ − rX ]] multiple-qubit CSS codes such that (n − rZ − rX > 1). Let X¯ and Z¯ denote the logical X and Z operators of Q. A quantum state with L in the T HX HZ = 0. (3) subscript refers to an encoded state. For example, the 1 encoded |0i, |+i = √ (|0i + |1i) are denoted by |0iL and Then we can define an [[n, n − r − r ]] CSS code with 2 Z X |+i , respectively. Z stabilizer generators L

n O [HZ ]i,j gi = Z , i = 1, . . . , rZ , (4) B. CSS Stabilizer States and Steane Syndrome j=1 Extraction and X stabilizer generators Steane suggested a method to extract error syndromes n for CSS codes [22], as shown in Fig. 1. Two clean ancil- O [HX ]i,j las |+i and |0i in the logical states of the underlying grZ +i = X , i = 1, . . . , rX . (5) L L j=1 CSS code Q are used to measure the X and Z error syndromes, respectively. Each CNOT gate in Fig. 1 rep- The condition in Eq. (3) implies that the X and Z sta- resents transversal CNOT gates, and the measurements 4

Thus we can, ideally, have a perfect stabilizer state |0iL. In reality we are in a situation where the ancillas for syndrome measurements are also imperfect, and we will       address this issue in this section. Suppose we are given a bunch of imperfect ancillas in some CSS stabilizer state, e.g., |0iL or |+iL, and we wish FIG. 1. Quantum circuit for Steane syndrome extraction. to purify them. Our approach is to determine the correct error syndromes of a subset of the ancillas by measuring the rest. More precisely, we will use a transversal quan- in the Z or X basis are bitwise. In the circuit, X and Z tum circuit to couple m noisy ancillas according to a errors on the data qubit will propagate, respectively, to classical error-correcting code, measure m − k of them, the ancillas |+iL and |0iL through the CNOTs, so that and then extract the error syndromes of the remaining k we learn error information by measuring the two ancillas. ancillas. This procedure is called ancilla distillation by Suppose the measurement outcomes of |+iL and |0iL classical codes and will be detailed in the first subsec- are mX and mZ (in bits), respectively. Then the (ob- tion. In the second subsection, we generalize the idea to T served) X and Z syndromes are computed by mX HZ , distill the noisy ancillas by using an arbitrary quantum T CSS code. and mZ HX , respectively. We can perform error correction according to these syndromes or just keep track of For now, we neglect any errors in the CNOTs or mea- them. surements used in the quantum circuit for distillation. We discuss the issue of noisy distillation circuits in Sec- The two ancillas |+iL and |0iL are actually stabilizer states of Q by including logical operator X¯ or Z¯ tion V. in with the stabilizer generators. That is, |+iL is stabilized by hg1, . . . , gn−1, X¯i, and |0iL is stabilized by A. Distillation by Classical Codes hg1, . . . , gn−1, Z¯i. These two stabilizer states can be produced by Clifford encoding circuits with CNOT gates only, together with the ability to prepare physical qubits The key observation is that classical binary linear codes in |0i and |+i [30]. If imperfect quantum gates are used can be encoded or decoded by circuits using only CNOTs. in the encoding circuit, the states must be verified. Suppose CD is an [m, k, d] binary linear block code that d−1 We can use Steane syndrome extraction to correct er- can correct t = b 2 c errors. Such a code has r = m − k T rors on a noisy ancilla, but it requires us already to have parity checks. Let HD = [A Ir] be the parity-check two clean ancillas, which is clearly impractical. In the matrix of CD in systematic form, where Ik is the k × k following section, we will introduce a protocol for distill- identity matrix and A is k × r. We define a quantum ing a number of CSS stabilizer states from a larger set of distillation circuit UD by imperfect ones by using classical error-correcting codes and quantum CSS codes, and demonstrate how to distill k r Y Y [A]i,j UD = Ci(Xk+j) . (9) the states |0iL or |+iL. A simple example of a CSS stabilizer state is the i=1 j=1 Einstein-Podolsky-Rosen (EPR) pair: That is, Ci(Xk+j) is applied if [A]i,j = 1, and id is ap- m |00i + |11i plied, otherwise. Consider Xe|0 i = |ei, where e = √ , e ··· e ∈ m and 2 1 m Z2 0m = 0 ··· 0 . which is stabilized by X ⊗ X and Z ⊗ Z. Córcoles et al. | {z } recently experimentally demonstrated error correction on m an EPR pair [31]. EPR pairs were the first states for Then which a distillation protocol was proposed [19, 20].

UD|ei = |e1 ··· eki ⊗ |sei,

T T III. ANCILLA DISTILLATION where se = HDe is the classical error syndrome of e with respect to CD. Then we can use a decoder of CD m Suppose we are using an [[n, 1]] CSS code Q defined by to find the most probable error vectore ˜ ∈ Z2 and then correct the bit-flip errors in |e1 ··· eki. This decoding matrices HZ , HX with rZ + rX = n − 1 as in the previous procedure is the main conceptual tool of our distillation section. Given a noisy stabilizer state, e.g., Xe|0iL, we can perform quantum error correction and restore the protocol. state up to some logical operator if we know the actual Distillation of CSS stabilizer states by classical codes error syndrome. Now, measuring the logical operator Z¯ involves two rounds of error correction: one for X errors will tell us whether there is a logical error or not, and and one for Z errors. additional logical correction can be applied if necessary. Distillation Protocol I: 5

1) Using an encoding circuit, we prepare many noisy  copies of an n-qubit CSS stabilizer state. Divide the    noisy ancillas up into groups of m. 

2) (Round 1: X errors) In each group of m ancillas,   choose the last r of the ancillas to hold the parity  checks, and apply UD transversally: that is, apply UD to the ﬁrst qubits of all m ancillas in the group, to the FIG. 2. The circuit for distilling |0iL by the classical [3, 1, 3]

second qubits, and so forth. This unitary UD applies repetition code, where |f0iL are imperfect logical states. The transversal CNOTs according to the pattern of 1s in last two |f0iL serve as parity-check ancillas. the binary matrix A.

3) Measure every qubit in the r parity-check ancillas (the for the ancilla state |0i of an n-qubit quantum CSS code. last r ancillas in each group of m) in the Z basis. L (1) (r) n We now demonstrate the above protocol by distilling the Let the binary row vectors ν , . . . , ν ∈ Z2 be the ancillas of the [[7, 1, 3]] Steane code [32], with stabilizer outcomes of these measurements. generators (i) (i) T 4) Calculate σ , ν HZ for i = 1, . . . , r. For j = (1) (r) g1 = Z1Z4Z5Z7, 1, . . . , rZ , use [σ ]j ··· [σ ]j as a classical error syn- g = Z Z Z Z , drome of CD and use a decoder of CD to ﬁnd the most 2 2 4 6 7 (1) (m) probable error vectors ˜j ··· s˜j with this error syn- g3 = Z3Z5Z6Z7, (i) (i) g4 = X1X4X5X7, drome. Thens ˜1 ··· s˜rZ is the estimated X error syndrome of the ith target ancilla. Correct the X errors, g5 = X2X4X6X7, if any (or just keep track of them). g6 = X3X5X6X7, 5) If the distillation target is |0i or |1i , calculate the L L and logical operators X¯ = X X X , Z¯ = Z Z Z . parity of Z¯ from ν(i) and estimate the syndrome bits 1 2 4 1 2 4 Suppose the [3, 1, 3] repetition code is used for distill- for the logical operators as in the previous step. Cor- ing several noisy codewords of the Steane code. First, the rect the logical errors X¯, if any (or just keep track). noisy codewords are divided in to groups of m = 3. Con- 6) Of our original large number of ancillas, a fraction sider one group with the three noisy Steane codewords k/m are left. Again, divide them up into groups of m. E1|0iL,E2|0iL, and E3|0iL prepared independently with ¯ It is very important that ancillas that were grouped errors E1,2,3, where E1 = X1X2X4 = X, E2 = X3, and together in the ﬁrst round are not grouped together in E3 = X6X7. Note that E1 and E3 are uncorrectable the second round, because their errors are correlated. errors for the Steane code. The X error syndromes are

7) (Round 2: Z errors) Similarly to step 2 above, do a E1 : 000 1 H E : 001 0 transversal UD , where 2 E3 : 110 0 k r H Y Y [A]i,j ¯ UD = Ck+j(Xi) . (10) with respect to g1, g2, g3, and Z, respectively. After i=1 j=1 the (perfect) distillation circuit UD by the [3, 1, 3] code 0 0 (Fig. 2), the errors become E1 = E1, E2 = E1E2 = 0 (The control and target qubits of UD are switched to X1X2X3X4, and E = E1E3 = X1X2X4X5X6. Then H 3 obtain UD .) measuring bitwise the second and the third codewords, and calculating the parities of g , g , g and Z¯, we have 8) Measure the r parity-check ancillas in the X basis. 1 2 3 their syndrome bits Then repeat steps 3–5, but with X and Z switched everywhere, and with |0i, |1i replaced by |+i, |−i, re- σ(1) : 001 1, spectively. 2 σ(2) : 110 1. This procedure is somewhat technical, so we will demonstrate the distillation protocol with a detailed ex- Now we can use the parity check matrix of the [3, 1, 3] ample. repetition code to recover the four syndrome bits of the first codeword: Example 1. Fig. 2 illustrates the quantum circuit for (1) distillation by the [3, 1, 3] repetition code with a parity- s˜ : 000 1. check matrix Since the fourth bit is 1, we apply logical operator X¯ 1 1 0 to the first codeword to correct the logical error and the HD = , (11) 1 0 1 final state is |0iL. Thus we have fault-tolerantly prepared 6 an ancilla |0iL. 2 After round 1, the remaining k ancillas from the group will have lower rates of X errors than they started with. Now we carry out protocol I for general CSS codes as However, Z errors on the parity-check ancillas can propa- follows. Suppose the X errors on the m ancillas are Xe(1) , gate via the CNOTs back onto these k ancillas, increasing (j) (j) (j) n (1) ...,Xe(m) , where e = e1 ··· en ∈ Z2 . Let s = the rate of Z errors (and also correlating the errors across (1) T (m) (m) T e HZ , . . . , s = e HZ . The decoding operator UD the ancillas). How do these changes compare? Assume will transform Xe(1) ⊗ Xe(2) ⊗ · · · ⊗ Xe(m) to that the original rates of Z and X errors are both p. j j j The rate of Z errors on the remaining k ancillas will increase to ∼ (β +1)p, where β ≤ r is the number of parity Xe(1) ⊗ · · · ⊗ Xe(k) ⊗ Xsj j j X checks that each qubit is included in (or the number of 1s in each row of A). The rate of X errors goes from p to for j = 1, . . . , n, where sj ∈ r is the error syndrome X Z2 cpt+1, where c is a constant that depends on the details (1) (m) m of ej ··· ej ∈ Z2 with respect to HD. If we could of the codes. If p is not too big, the rate of Z errors has j i measure sX , we could decode ej directly and then obtain grown roughly by a constant factor, while the rate of X k clean ancillas. errors has been substantially reduced. However, the measurement outcomes ν(1), . . . , ν(r) of After round 2, we are left with a fraction ( k )2 of our j m step 3 are actually a disturbed version of sX : original ancillas. The rate of Z errors will go from (β+1)p to c((β + 1)p)t+1 = c0pt+1, and the rate of X errors will  1  t+1 t+1 00 t+1 sX go from cp to (β + 1)cp = c p . (So the rate T T t+1 ν(1) ··· ν(r) =  .  + cT ··· cT , of an arbitrary Pauli error is roughlycp ˜ for somec ˜.)  .  1 r These constants will not generally be equal to each other sn X (and indeed, the starting rates for X and Z might not (1)T (m)T T T T have been equal ); one might use two different classical = e ··· e HD + c1 ··· cr , error-correcting codes in the two rounds so that the final (12) rates both end up below some desired fraction. To reach a desired target error rate, this procedure could be iterated; where the row vectors {c } are unknown codewords of j or one could just vary the distances of the classical codes the classical code with parity check matrix H . Since we Z used depending on the original error rates and the desired do not know the codewords, we cannot learn sj . X final error rates. On the other hand, we still can learn the quantum error syndrome Example 2. In addition to the [3, 1, 3] repetition code above, we simulated distillation by the [5, 1, 5] repetition (1) (1) T (m) (m) T s = e HZ , . . . , s = e HZ code and the [7, 4, 3] Hamming code [29]. The results are shown in Fig. 3. The simulations begin with preparation (1) (r) from ν , . . . , ν . Multiplying (12) from the right by of noisy ancillas by the CSS encoding circuit. We as- T HZ , we have sume that during the ancilla preparation each individual qubit suffers independent depolarizing errors with rate  (1)   (1) T   (1) s ν HZ σ p. Noisy CNOTs in the encoding circuit are modeled as  .   .   .  a perfect CNOT, followed by no error (with probability HD  .  =  .  ,  .  . (13) 1 − p) or one of the nonidentity two-fold Paul operators s(m) ν(r)HT σ(r) Z (e.g., X ⊗ Y , I ⊗ Z, X ⊗ I, ...) with equal probabilities p/15. For our initial analysis, we assume that the dis- Then we can choose any decoder of CD to recover the k error syndromess ˜(i) of the target ancillas as in step 4. tillation circuit does not itself contain errors; the issue That is, we are retrieving a particular syndrome bit j of imperfect distillation circuits will be addressed in the discussion section. of every ancillas ˜(1),..., s˜(m) in one classical decoding j j We define the final error rate to be the probability procedure. From that, we can correct all the X errors in of any Pauli error left in the target ancillas after two the target k ancillas (and also any logical X errors if we rounds of distillation. This estimate is pessimistic, since are distilling |0i ). L it ignores the likelihood that the residual errors are cor- d−1 rectable in the next error correction cycle. Remark 1. As long as fewer than b 2 c of the m syn- (1) (m) After the noisy encoding circuit, the error rate on each drome bits sj , . . . , sj are 1s, they can be recovered by the classical decoding, assuming that the quantum gates qubit will increase to ∼ (α + 1)p, where α is the num- in the distillation circuit are perfect. ber of stabilizer generators each qubit is involved. If p is small enough, the distillation protocol will work. As can Remark 2. The distillation protocol depends only on be seen in the logarithmic plot in Fig. 3, each curve ap- the error-correcting power of the classical code CD, and pears linear with slope t + 1 and the “threshold” for each 1 not on the error-correcting ability of the stabilizer states code is specified by log pth = − t logc ˜. (By “threshold,” being distilled. If n = 1, this procedure reduces to the we mean the crossing point of a curve with the dashed standard classical decoding of CD. line. That is, the point where the distillation error rate 7 and the physical rate p are equal.) Thus, we say that a rate classical codes. stabilizer state can be fault-tolerantly prepared if the error rate is below the threshold for the classical code used in distillation. 2 B. Distillation by Quantum CSS Codes For these simple examples, we can see that the [5,1,5] code with higher distance has asymptotically better be- Instead of using classical codes in two steps to correct havior in the low physical error rate regime but the yield both X and Z errors, we can similarly use an [[m, k]] rate is low. On the other hand, the [7,4,3] code has a quantum CSS code QD to distill the desired ancillas of larger yield rate but worse performance. Since there are an [[n, 1]] code. For simplicity, suppose QD is defined by 0 0 0 0 many efficient classical codes with high rate and good HZ and HX of dimension rZ × m and rX × m matrices 0 0 0 0 error-correcting ability, we can certainly find better can- (k = m − (rZ + rX ) > 0) with full rank rZ and rX 0 0T 0 0 didates for the protocol with extra cost. and HX HZ = 0. QD has rZ Z generators, and rX X generators. The check matrix of an [[m, k]] CSS code can be written in the following form [8]: ì 0.01 ì æ 0 HZ 0 Ir0 AB 0 0 0 0 = Z , ì æ à 0 H 0 0 0 DIr0 F 0.001 ì X X ì æ æ ì à -4 æ where A, B, D, and F are binary matrices of appropri- rate 10 ì æ ate dimensions. We use a particular encoding circuit as ì à 0 ì æ -5 à follows: to the k information qubit state |φi, append rZ Error 10 ì æ à 0 æ ancilla qubits in the state |0i and rX ancilla qubits in the 0 à state |+i, which will correspond to the r Z generators -6 æ Z ì 10 0 and rX X generators, respectively, after encoding. That à is, we apply an encoding circuit to the initial state 10-7 2 ´ 10-5 5 ´ 10-5à1 ´ 10-4 2 ´ 10-4 5 ´ 10-4 0.001 0.002 ⊗r0 ⊗r0 à p |0i Z ⊗ |+i X ⊗ |φi,

FIG. 3. (Color online.) Ancilla distillation by 1) the [7, 4, 3] which corresponds to a check matrix Hamming code (green diamonds); 2) the [3, 1, 3] repetition Ir0 0 0 0 0 0 code (red dots); 3) the [5, 1, 5] repetition code (blue squares). Z . 8 0 0 0 0 I 0 0 The dashed line is the rate without distillation. Up to 7 × 10 rX iterations are used for each point. 0 The encoding circuit UD, which is a unitary operator, will Finally we briefly discuss candidates for large quan- then consist only of CNOT gates [30]. It can be verified tum codes whose raw ancilla state preparation by noisy that this works for any CSS codes. and we postpone this Clifford circuits will have sufficiently low error rates. It justification to Appendix A. is known that quantum CSS codes built from classical Suppose an error operator E ∈ Gm occurs on a code- doubly-even codes allow transversal Clifford gates [33, word of QD. We decode by running the above encoding 34]: such codes as the Steane code, the [[23, 1, 7]] quan- circuit backwards, so that the error syndrome informa- tum Golay code, or other quantum quadratic-residue tion will be contained in the ancilla qubits. After the 0 † codes [35]. We can concatenate a large quantum block decoding circuit UD , we have the following transformed ⊗r0 ⊗r0 code with, for example, the quantum Golay code, whose error operating on the initial state |0i Z ⊗|+i X ⊗|φi: Clifford operations can be done transversally, and these 0 † 0 ancillas can be prepared fault-tolerantly [12]. With quan- UD EUD , XsX ⊗ ZsZ ⊗ LE, tum Golay code blocks at the bottom level, the Clif- r0 r0 ford encoding circuit for the large quantum code can be Z X where sX ∈ Z2 , sZ ∈ Z2 are the syndrome vectors transversally implemented, and quantum error correction (hence X ∈ G 0 , Z ∈ G 0 ) and L ∈ G is an logical sX rZ sZ rX E k by the quantum Golay code can be inserted into the cir- error operator. cuit, if necessary. Therefore, the error rate of the raw 0 We then measure the first rZ ancillas in the Z basis, ancillas can be suppressed to below the “threshold” of 0 which gives the X error syndrome sX , and the other rX distillation. If we constantly apply quantum error cor- ancillas in the X basis, which gives the Z error syndrome rection by the Golay code, the output should be very sZ . From that, we can figure out what corrections, if any, good, but the overhead will be large. need to be applied to the k information qubits. This leads Another intriguing possibility is to perform distillation to the following distillation scheme: steps at several points during the encoding circuit for the ancillas, to remove errors before they can spread widely. Distillation Protocol II: Efficient distillation would require the use of very high- Suppose we want to distill a CSS stabilizer state of the 8

[[n, 1]] code Q deﬁned at the beginning of this section.     1) Start with m imperfect copies of a stabilizer state of  0 †   Q. Do a transversal UD on the m copies of the n- qubit system.   0 0 2) For the rZ (respectively rX ) systems in the positions  corresponding to the Z (resp. X) ancillas, we mea-  sure all the qubits in the Z (resp. X) basis and let (1) (r0 ) m (1) (r0 ) m FIG. 4. The circuit for syndrome measurement of three data ν , . . . , ν Z ∈ Z2 (resp. ν , . . . , ν X ∈ Z2 ) be blocks with two ancilla blocks by the [3, 1, 3] repetition code. the outcomes.

(i) (i) T 0 3) Calculate σX , νZ HZ for i = 1, . . . , rZ . For 0 following, we show that classical coding can also reduce (1) (rZ ) j = 1, . . . , rZ , use [σX ]j ··· [σX ]j as a classical er- ancilla consumption in Steane syndrome extraction; it ror syndrome with respect to the parity-check matrix turns out that this problem is equivalent to the distilla- 0 HZ and use a corresponding decoder to ﬁnd the most tion problem in Sec. III A. We assume that the quantum (1) (m) probable error vectors ˜j ··· s˜j with this error syn- circuits for error correction are perfect, and the ancillas (i) (i) are assumed to be clean in the following discussion. drome. Thens ˜ ··· s˜ is the estimated X error syn- 1 rZ Suppose we have m codewords |ψ i,..., |ψ i of the drome of the ith target ancilla. We can correct the X 1 m [[n, 1]] CSS code Q deﬁned by H and H . Let X (j) Z (j) errors, if any, (or just keep track of them). Z X e f be the error corrupting |ψji for j = 1, . . . , m. If Steane 4) Repeat 3) but with X and Z switched everywhere. syndrome extraction is used, m (perfect) ancillas |+iL (j) T are required to measure the X error syndromes e HZ . 5) If the distillation target is |0iL or |1iL (resp. |+iL or Our goal here is to estimate the X error syndromes by ¯ ¯ |−iL), then calculate the parity of Z (resp. X) from using only r (< m) clean ancillas |+iL. The treatment (i) (i) νZ (resp. νX ) and estimate the syndrome bits for for Z error is similar. the logical operators as in the previous step. Correct Let CD be an [m, k = m − r, d] classical code with ¯ ¯ T the logical error X (resp. Z), if any, (or just keep parity-check matrix HD = [A Ir]. Assume we have r track of them). clean ancillas |+iL and r clean ancillas |0iL. Ancilla Saving Protocol:

This protocol is very similar to Distillation Protocol I. 1) Apply transversal CNOTs from |ψji to the j-th |+iL Thus we omit the explanation of how it works. We end up for j = k + 1, . . . , m. with k much cleaner copies of the n-qubit CSS stabilizer states of Q. Again, this procedure could be iterated, 2) Apply a transversal CNOT from |ψii to the j-th |+iL or we can use a good enough [[m, k]] code. This is like if [A]i,j = 1. a concatenation of the n-qubit code Q with the [[m, k]] 3) Do steps 3 and 4 of Distillation Protocol I. code QD, but only the decoding on the second level, QD, is applied. 4) Apply transversal CNOTs from the j-th |0iL to |ψji Protocol I by classical codes is more ﬂexible than Pro- for j = k + 1, . . . , m. tocol II, since any classical codes can be used in Protocol I and the codes can be diﬀerent in two rounds of distilla- 5) Apply a transversal CNOT from the j-th |0iL to |ψii tion; whereas only dual-containing codes can be applied to if [A]i,j = 1. in Protocol II. On the other hand, dual-containing codes 6) Do steps 3 and 4 of Distillation Protocol I, but with used in Protocol II can also be applied in Protocol I, X and Z switched everywhere. and the number of CNOTs for correcting both X and Z errors are roughly the same in the two protocols. Basi- cally, the performance of these two protocols are strongly Fig. 4 demonstrates the circuit for the X syndrome related to the performance of the classical codes, so we extraction of three data blocks with two ancilla blocks omit simulations of Protocol II here. by the [3, 1, 3] repetition code. Observe that this circuit is essentially equivalent to the circuit in Fig. 2. We can combine the X errors from the second and third encoded IV. ANCILLA SAVING states with the two clean ancillas |+iL, respectively, and then remove those two encoded states. As a consequence, Clean ancillas |0iL and |+iL in Steane syndrome ex- our ancilla saving protocol is equivalent to the distillation traction are expensive resources. We would like to use as protocol by classical codes. few of them as possible during syndrome measurement, We may compare the error correction performance of as long as errors do not accumulate seriously. In the this ancilla saving protocol by CD on codewords of Q, say 9

Q + CD, with the original Steane extraction scheme. A ìæà æà æà 1.00 ò ìò ì ìæà æà æà æà æ æ æ ò ì à à à æ æ æ æ good ﬁgure of merit for comparison is the channel ﬁdelity ò ì ì à à æ ì à à ò ì à of a quantum code over a noise channel [36, 37]. For 0.99 ò ì ì ò ì simplicity, here we assume the independent single-qubit ò ì

L 0.98 ò ì noise channel is E ì H c 0.97 æ 7,1,3 ò

F à 7,1,3 + 5,1,5 ò E(ρ) = (1 − p)ρ + pXρX, @@ DD 0.96 ì 7,1,3 + 3,1,3 ò @@ DD @ D ò 7,1,3 + 7,4,3 for any single-qubit state ρ. Unquestionably the channel @@ DD @ D ò 0.95 fidelity is expected to drop with fewer ancillas in the sav- @@ DD @ D ò ing protocol, and both the encoding and decoding com- 0.94 ò plexities will increase. Thus, we have a tradeoff between 0.002 0.004 0.006 0.008 0.010 0.012 0.014 channel fidelity, gate complexity, and ancilla consump- p tion. FIG. 5. (Color online.) The average channel fidelity of the Example 3. Consider the [[7, 1, 3]] Steane code. It is Steane code without or with ancilla saving by the [3, 1, 3], known that the channel fidelity of a quantum code over a [7, 4, 3], or [5, 1, 5] code. The number of iterations for each Pauli channel is the probability of correctable errors [38]: point is up to 7 × 108. that is, the probability of a set of coset leaders and their degenerate errors. It is more complicated to calculate the drops significantly to save 4 = 57.1% ancillas. For the channel fidelity of the saving protocol. We estimate it as 7 [5, 1, 5] code, the fidelity drop at p = 0.01 is less than follows: 0.2%, while 1 = 20% of the ancillas are saved. Let F (E) be the channel fidelity of sending |ψ i 5 C i i 2 through E⊗n for i = 1, . . . , m. Then the average channel fidelity is

ìæàò æà 1.000 ìò ìæà æà æà à 1 X ò ìò æ æà à ìò æ æà à FC (E) = FC (E)i. ìò æ à m ì æ æà i ò æà ìò æà 0.999 ì æà ò æà

L ì æà Since |ψii are correlated in the saving protocol, the pre- ò æà E ì H ò æà vious result of FC (E) cannot be applied here. Thus we c 0.998 ì æà

F ò æà apply Monte Carlo methods to approximate FC (E): æ 7,1,3 ì æ ò à æ à 7,1,3 + 5,1,5 ì à æ ò 1) Fix p. Set i := 1. 0.997 ì @@7,1,3DD+ 3,1,3 ì à ò @@7,1,3DD+@7,4,3D ò ì 2) Apply Pauli X errors Xi ,...,Xi to perfect infor- @@ DD @ D e(1) e(m) 0.996 @@ DD @ D òæ ìæ i 0.002 0.004 0.006 0.008 0.010 0.012 mation states |ψ1i,..., |ψmi, where Xe(j) ∈ Pn is an n-fold Pauli X error, randomly generated according p to the probability distribution of E. 3) Use the ancilla-saving code C to recover the error syn- FIG. 6. (Color online.) The average channel fidelity of Steane dromes s , . . . , s for Xi ,...,Xi , respectively. If code with ancilla saving by the [3, 1, 3], [7, 4, 3], or [5, 1, 5] code 1 m e(1) e(m) at physical error rate p. The number of iterations for each i 8 there is no logical error on |ψji after decoding, Xe(j) point is up to 7 × 10 . is correctable. Set i := i + 1. 4) Repeat steps 2 and 3 N times. When the ancilla consumption rate is fixed, we can increase the frequency of quantum error correction with the i 5) Count the number of correctable errors in {Xe(j) }, say ancilla saving protocol, which is equivalent to lowering M M. Then FC (E) is approximated by mN . the error rate on the data qubits. Let us define the effective error rate as the (accumulated) physical error rate Fig. 5 illustrates plots on FC (E) for various ancilla sav- between two error correction steps. Here the effective er- ing protocols: the [7, 4, 3] Hamming code, and the [3, 1, 3] ror rate of an [[n, 1]] code without ancilla saving is simply and [5, 1, 5] repetition codes, together with FC (E) with- called the physical error rate. If the physical error rate is out ancilla-saving. As shown in Fig. 5, at p = 0.01, the p, then the effective error rate of an [[n, 1]]+[m, m−r] an- channel fidelity for [[7, 1, 3]] + [3, 1, 3] drops from 0.998 cilla saving protocol is rp/m, assuming that quantum er- p p to 0.988. Since only two ancilla states are used, we re- ror correction is sufficiently fast. Let Fo and Fcomb be the duce the ancilla consumption by 33.3% by using one ad- channel fidelities of the original and the [[n, 1]]+[m, m−r] ditional transversal CNOT and increased classical com- protocols at effective error rate p, respectively. Appar- 0 0 p p puting complexity. (Note that the circuit for preparing a ently we have Fo = Fcomb = 1 and Fo > Fcomb for ∗ |+iL has nine CNOTs.) For the [7, 4, 3] code, the fidelity p > 0. Thus by the continuity of fidelity, there exists p 10

∗ p∗ rp /m such that Fo = Fcomb . Here we define the effective Our distillation protocol is a combination of the Steane channel fidelity of an [[n, 1]] + [m, m − r] protocol as the syndrome extraction method and classical coding so that average channel fidelity of the protocol at effective error stabilizer states can be fault-tolerantly prepared. How- rate rp/m. Hence for physical error rate p < p∗ the effec- ever, more work is needed to show that the overall scheme tive channel fidelity of the [[n, 1]] + [m, m − r] protocol is is both fault-tolerant and efficient enough to be useful at higher. Let us consider the above example again. Fig. 6 realistic error rates. In particular, noise in the distillation plots these channel fidelities. As can be seen, applying circuit will have two important effects. First, residual er- the ancilla saving protocol with the [5, 1, 5] code is better rors will be left in the ancilla by the noisy distillation than the original scheme for p < 0.00925, but there is circuit. Second, errors may degrade the performance so no fidelity gain for the other two codes. Of course, this that ancilla errors from the encoding circuit may not be fidelity gain was at the cost of some additional CNOT fully corrected. This first source of error will increase the gates and classical decoding steps. effective error rate in the computation; but because the distillation circuit is transversal, these errors should be independent across the qubits of a single ancilla. How- V. DISCUSSION ever, the second type of error would be more serious: correlated errors across an ancilla can dramatically shorten the lifetime of the quantum codes used in the computa- A straightforward approach to achieving FTQC is to tion. Thus, careful modeling and numerical simulations implement logical gates transversally, but no quantum are needed to assess and optimize the performance of dis- stabilizer code can have a universal gate set of quan- tillation in the presence of noise. tum computation that can be transversally implemented [39, 40]. As a consequence, universality is usually accom- Some methods may be used to greatly mitigate these plished by the assistance of certain ancillas, prepared by potential pitfalls. In the distillation protocol by clas- magic state distillation [21]. A large literature is devoted sical coding, error syndromes of the target ancillas are to reducing the overhead of magic state distillation [41– encoded by the coupling CNOTs and then recovered. If the transversal circuits for distillation are imperfect, the 46], since it may dominate the overall resources needed T for FTQC [47]. measured parity-check syndromes νHZ are not reliable, The current work is motivated by a different approach which compromises the efficiency of distillation. How- to fault-tolerance: the use of a set of CSS codes to store ever, this can be handled by learning more parities of and process quantum information. By teleporting logical the stabilizer generators as suggested by the method in qubits between code blocks that admit different sets of [53–55]. In particular, we can choose another classical transversal gates, it is possible to perform a universal set code C3 to encode the parity checks of HZ by appending of logical gates [48]. We have illustrated distillation with more redundant rows to the parity-check matrix. By cal- the simple example of the Steane [[7, 1, 3]] code, but the culating these additional parity checks, we can use any procedure can readily be generalized to multi-qubit CSS decoder of C3 to purify the decoding outputs of CD and codes. In particular, they can distill any CSS stabilizer obtain more reliable error syndromes about the target state which is the simultaneous +1 eigenstate of all the ancillas. To further improve the reliability of distillation, stabilizer generators and a set of commuting logical oper- we can also use a final postselection. By filtering out ators, such that each logical operator includes the iden- those noisy blocks with distinct syndromes, residual er- tity and either only X operators or only Z operators. rors of higher weight can be further reduced at only a This limitation means that it is not possible to distill small cost in yield for the protocol. completely general stabilizer states (or even general CSS We have begun to study these methods, and have stabilizer states) by the methods presented here, though found some preliminary results. A simulation of noisy generalizations of this scheme may make that possible. distillation of the [[23, 1, 7]] quantum Golay code by the However, the protocols presented in this paper can distill [3, 1, 3] repetition code, followed by the [23, 11, 7] Go- all the logical ancillas needed for the teleportation-based lay code with postselection, suggests an overall yield of FTQC scheme of [48]. 10% by our protocol at a physical error rate of about Given the ability to prepare a set of suitable CSS sta- 10−4 ∼ 10−5. Technical details and performance analy- bilizer states, only transversal circuits and single-qubit ses for some candidate classical codes and quantum codes Pauli measurements are needed for FTQC. In particular, will be addressed in a forthcoming paper [56]. magic states are not needed. (Other schemes without In [12], an ancilla verification method is proposed for magic state distillation have also been proposed, such as the quantum Golay code. This method can be regarded [46, 49–52].) The results of this paper show that in prin- as a special case of our protocol, but our distillation pro- ciple this approach to FTQC is possible. However, the tocol is potentially more efficient. In the verification overhead for distillation dominates in this scheme, and scheme, pairs of blocks are compared to check errors. we need to further analyze and quantify both the cost of If any errors are detected in either block, everything is distilling ancillas for various codes, and the performance discarded and the process starts over again. By contrast, of distillation in the presence of errors in the distillation the results of each verification (parity checks) are kept circuit. track of in our protocol, and we can take advantage of 11 their correlations by classical decoding. Since good clas- ment purification for CSS stabilizer states. Conversely, a sical codes with high rate and efficient decoders exist, we protocol for multipartite entanglement purification could expect our distillation protocol to have higher through- potentially lead to a distillation protocol of CSS stabilizer put. states in FTQC if the multipartite constraint is removed. In the simulations in this paper, we used a minimum In particular, the purification protocols I/II in [23, 24] are distance decoder of the classical code for distillation. a special case of our distillation protocol I by the [2, 1, 2] However, the error rate of each syndrome bit of an an- classical error-detecting code with parity-check matrix cilla may depend on the Clifford circuit that generates these faulty ancillas. We may be able to analyze this HD = 1 1 , dependence and employ other techniques to improve the decoding performance. This is another future research where an ancilla is discarded if the measurement out- direction. comes are nonzero. However, we can use a general classical error-correcting code to do error recovery in the Our distillation protocols are similar to magic state distillation process, and hence the efficiency can be bet- distillation, but there is an important distinction: be- ter. Distillation protocol I could be adapted to a hash- cause these ancillas are stabilizer states, they can be ing protocol for multipartite entanglement purification made using only Clifford gates, and (in principle) can as in [24–26]; however, we omit further discussion for be fault-tolerantly verified. This would suggest better the present, since the main topic of this paper is about performance here than in magic state distillation, where fault-tolerant quantum computation. Also, the protocol one cannot improve the quality of the encoded state by in [28] is very similar to our distillation protocol II. Since measuring it directly. At the very least, we should be they did not consider the problem in the fault-tolerant able to do better in this respect: with magic state distil- scenario, the eigenvalues of the stabilizers are measured lation, there is a probability of failure at each iteration directly in their protocol. By contrast, we use a transver- step, where you have to discard everything; here, if we sal decoding circuit and bitwise qubit measurements to detect an error in the logical operators, we can correct recover the eigenvalues of the stabilizers in our protocol. them. Also, only certain codes with special properties can be used for magic state distillation; while a broad range of classical error-correcting codes can be applied in our scheme. ACKNOWLEDGMENTS In this paper, we also have shown how to recover ac- curate error syndromes in Steane syndrome extraction We thank Ben Reichardt for useful discussions. We using fewer ancillas, at the cost of higher classical decod- also thank Scott Glancy for helpful comments. This ing complexity and some additional CNOTs, while sacri- work was supported in part by the IARPA QCS program; ficing a little channel fidelity. Since classical computing by HRL subcontract No. 1144-400707-DS; and by NSF power is much cheaper, in general, than expensive quan- Grant No. CCF-1421078. This work was also partially tum resources, it makes sense to exploit classical comput- funded by the Singapore Ministry of Education (Tier-1 ing to save quantum resources. The layout of additional funding), through Yale-NUS Internal Grant IG14-LR001. transversal CNOTs depends on the chosen classical code T.A.B. also acknowledges funding as an IBM Einstein and their cost may or may not be comparable to the com- Fellow at the Institute for Advanced Study. plexity saved by preparing fewer ancillas. However, the overall error-correcting power can be increased when the ancilla consumption rate is fixed. This protocol shares Appendix A: Justification of the Encoding for CSS the same structure as ancilla distillation, and should give Codes a net benefit at least in the regime of low error rates. To do quantum error correction, we can also use The encoding procedure mentioned in Subsec. III B the Shor syndrome extraction [3, 34]. (Knill syndrome can be justified as follows. The unitary encoding operator extraction [58] is essentially equivalent to the Steane can be implemented by applying a certain quantum cir- method up to qubit relocations.) For codes with low- cuit, consisting of CNOTs, Hadmard gates, phase gates weight stabilizer generators, Shor syndrome extraction and SWAP gates. (For example, Wilde gave an encoding may be preferred since it needs√ only low-weight ancillas— algorithm [57] to find such a circuit.) ⊗w ⊗w the cat states (|0i +|1i )/ 2—of size approximately The check matrix of an [[m, m − r − s]] CSS code can equal to the weights of stabilizer generators. The cat be written in the following form (see, e.g., [8]): states are also stabilizer states and thus could be prepared by our distillation protocols. We simply mentioned Ir AB 0 0 0 H = [HX |HZ ] = , this since there are already methods of verifying the cat 0 0 0 DIs F states. Finally, our distillation protocols by classical error- where Ir and Is are the r × r and s × s identity matrices, correcting codes or quantum CSS codes could also be respectively, and A, B, D, and F are r×s, r×(m−r−s), directly applied to the problem of multipartite entangle- s × r, and s × (m − r − s) binary matrices, respectively. 12

(r = s in our case.) Our goal is to apply a sequence of matrix D of HZ is altered by these CNOTs. We have CNOT gates that transform H into I 0 0 0 0 0 H0 = r . I 0 0 0 0 0 0 0 0 D0 I F r . s 0 0 0 0 Is 0 Since H0 has to satisfy the commutation relations, D0 Then the reverse of this sequence of CNOTs is our en- must be 0. Thus we have coding circuit. I 0 0 0 0 0 H0 = r . 0 0 0 0 Is F

Then we apply CNOTs to clear F. These CNOTs have control qubits on qubits number (r+s+1) to m and target qubits on qubits number (r + 1) to (r + s), respectively. HX is not aﬀected by these CNOTs and we have This process is like applying Gaussian elimination on H. We ﬁrst apply a series of CNOTs from the matrices I 0 0 0 0 0 H00 = r Ir to clear the matrices A and B. These CNOTs have 0 0 0 0 Is 0 control qubits on qubit number 1 to r and target qubits on qubit number r + 1 to m, respectively. Thus, only the as required.

[1] D. Gottesman, Phys. Rev. A 57, 127 (1998). 722 (1996). [2] D. Aharonov and M. Ben-Or, in Proceedings of the [21] S. Bravyi and A. Kitaev, Phys. Rev. A 71, 022316 (2005). twenty-ninth annual ACM symposium on Theory of com- [22] A. M. Steane, Phys. Rev. Lett. 78, 2252 (1997). puting, STOC ’97 (ACM, New York, NY, USA, 1997) pp. [23] W. Dür,H. Aschauer, and H.-J. Briegel, Phys. Rev. Lett. 176–188. 91, 107903 (2003). [3] D. P. DiVincenzo and P. W. Shor, Phys. Rev. Lett. 77, [24] H. Aschauer, W. Dür, and H.-J. Briegel, Phys. Rev. A 3260 (1996). 71, 012319 (2005). [4] F. Gaitan, Quantum error correction and fault tolerant [25] K. Chen and H.-K. Lo, Quant. Inf. Comp. 7, 689 (2007). quantum computing (CRC Press, Boca Raton, FL, 2008). [26] E. Hostens, J. Dehaene, and B. De Moor, Phys. Rev. A [5] D. A. Lidar and T. A. Brun, eds., Quantum Error Cor- 73, 042316 (2006). rection (Cambridge University Press, 2013). [27] C. Kruszynska, A. Miyake, H. J. Briegel, and W. Dür, [6] A. R. Calderbank and P. W. Shor, Phys. Rev. A 54, 1098 Phys. Rev. A 74, 052316 (2006). (1996). [28] S. Glancy, E. Knill, and H. M. Vasconcelos, Phys. Rev. [7] A. M. Steane, Phys. Rev. Lett. 77, 793 (1996). A 74, 032319 (2006). [8] M. A. Nielsen and I. L. Chuang, Quantum Computation [29] F. J. MacWilliams and N. J. A. Sloane, The Theory and Quantum Information (Cambridge University Press, of Error-Correcting Codes (North-Holland, Amsterdam, Cambridge, UK, 2000). The Netherlands, 1977). [9] P. Aliferis, D. Gottesman, and J. Preskill, Quant. Inf. [30] M. Grassl, “Mathematics of quantum computation,” Comp. 6, 97 (2006). (Chapman and Hall/CRC, 2002) Chap. Algorithmic as- [10] E. Knill, Nature 434, 39 (2005). pects of quantum error-correcting codes. [11] P. Aliferis and A. W. Cross, Phys. Rev. Lett. 98, 220502 [31] A. Córcoles,E. Magesan, S. J. Srinivasan, A. W. Cross, (2007). M. Steffen, J. M. Gambetta, and J. M. Chow, Nature [12] A. Paetznick and B. W. Reichardt, Quant. Inf. Comp. communications 6 (2015). 12, 1034 (2012). [32] A. M. Steane, Proc. R. Soc. London A 452, 2551 (1996). [13] K. M. Svore, D. P. Divincenzo, and B. M. Terhal, Quant. [33] A. M. Steane, Nature 399, 124 (1999). Inf. Comp. 7, 297 (2007). [34] P. W. Shor, in Proceedings of the 37th Annual Symposium [14] F. M. Spedalieri and V. P. Roychowdhury, Quant. Inf. on the Theory of Computer Science (IEEE Press, Los Comp. 9, 666 (2009). Alamitos, 1996) pp. 56–65. [15] C.-Y. Lai, G. Paz, M. Suchara, and T. Brun, Quant. Inf. [35] C.-Y. Lai and C.-C. Lu, IEEE Trans. Inf. Theory 57, Comp. 14, 807 (2014). 7163 (2011) [16] A. G. Fowler, A. M. Stephens, and P. Groszkowski, Phys. . Rev. A 80, 052312 (2009). [36] B. Schumacher, Phys. Rev. A 54, 2614 (1996). [17] A. M. Steane, (2002) arXiv:quant-ph/0202036. [37] M. Reimpell and R. F. Werner, Phys. Rev. Lett. 94, [18] H. Goto, Scientific Reports 6, 19578 (2016). 080501 (2005). [19] C. H. Bennett, D. P. DiVincenzo, J. A. Smolin, and [38] C.-Y. Lai and T. A. Brun, Phys. Rev. A 86, 032319 W. K. Wootters, Phys. Rev. A 54, 3824 (1996). (2012). [20] C. H. Bennett, G. Brassard, S. Popescu, B. Schumacher, [39] B. Eastin and E. Knill, Phys. Rev. Lett. 102, 110502 J. A. Smolin, and W. K. Wootters, Phys. Rev. Lett. 76, (2009). 13

[40] B. Zeng, A. Cross, and I. Chuang, IEEE Trans. Inf. Rev. Lett. 113, 080501 (2014). Theory 57, 6272 (2011). [51] S. Bravyi, and A. Cross, (2015) arXiv:1509.03239. [41] S. Bravyi and J. Haah, Phys. Rev. A 86, 052329 (2012). [52] T. Jochym-O’Connor and S. D. Bartlett, Phys. Rev. A [42] B. Eastin, Phys. Rev. A 87, 032321 (2013). 93, 022323 (2016). [43] C. Jones, Phys. Rev. A 87, 022328 (2013). [53] A. Ashikhmin, C.-Y. Lai, and T. A. Brun, in Proc. IEEE [44] C. Jones, Phys. Rev. A 87, 042305 (2013). Int. Symp. Inf. Theory (2014) pp. 546–550. [45] C. Jones, Phys. Rev. A 87, 052334 (2013). [54] A. Ashikhmin, C.-Y. Lai, and T. A. Brun, in Proc. IEEE [46] A. Paetznick and B. W. Reichardt, Phys. Rev. Lett. 111, Int. Symp. Inf. Theory (2016) pp. 2274 - 2278. 090505 (2013). [55] Y. Fujiwara, Phys. Rev. A 90, 062304 (2014). [47] A. G. Fowler, M. Mariantoni, J. M. Martinis, and A. N. [56] Y.-C. Zheng, C.-Y. Lai, and T. A. Brun, Eﬃcient An- Cleland, Phys. Rev. A 86, 032324 (2012). cilla Distillation with Postselction by Classical Codes for [48] T. A. Brun, Y.-C. Zheng, K.-C. Hsu, J. Job, and C.-Y. Fault-tolerant Quantum Computation, (2016), in prepa- Lai, (2015)arXiv:1504.03913. ration. [49] T. Jochym-O’Connor and R. Laﬂamme, Phys. Rev. Lett. [57] M. M. Wilde, Quantum Coding with Entanglement, 112, 010505 (2014). Ph.D. thesis, University of Southern California (2008). [50] J. T. Anderson, G. Duclos-Cianci, and D. Poulin, Phys. [58] E. Knill, (2003) arXiv:quant-ph/0312190.