arXiv:1804.06105v1 [quant-ph] 17 Apr 2018 fteiptt h optto hneecetby efficient size The (hence the complexity). computation computational in in the notions polynomial standard to a input most, the at run- of is, a ca- that have quantum time computations no ning parties’ has verifier Both the ex- pabilities). (as communication can other classical In verifier each of with the rounds verification. and multiple of prover change the the sort so generality, and some output, full perform prover’s might the will but trust verifier to computer, able quantum be prover’s not the use wishes verifier to The computation. quantum universal uain n nuntrusted an and putation, a [2]. out com- carried quantum was a putation whether no verifying is of simulating means there the as efficient multiply system) (such just quantum problems computer? can other a classical we for a but factoring, with factors, of simulate case to the hard For is answer correct it the weif producing is can it device how the computing, particular, that In in check use problems. other great classi- raise of efficiently worst does be be the can to simulated inability (in cally the time While we [1]. quantum superpolynomial that case) a in algorithm with classical runs found best know be the can but problem computer, a so- to time) (polynomial lution efficient an is where algorithm their example factoring one by Shor’s efficiently counterparts. simulated classical be cannot computers ob i oeepii,teseai sta of that is scenario the explicit, more verifier bit a be To quantum that evidence substantial now is There ipepooo o al oeatvrfiaino quantum of verification tolerant fault for protocol simple A ftepooo,fraoeqbtcmuain n n h err the code. find Steane and the as computation, in well one-qubit as its a and code for computation repetition quantum protocol, desired the the of know to prover the xr supin.Ti rtcli ae on th based prover’ in is the computations, protocol on quantum This noise verifying the assumptions. for with extra as protocol errors uncorrelated extra simple be to adding a to by prone device this is the address device in protocols devi quantum existing quantum this often small when and a by However, and verified computation claims qubits. classical his to Specifically have access can problem. has t computations this within quantum addressing computation for perform computati quantum fruitful quantum of been these verification has of the correctness to the approach testing of means iheprmna unu optn ehooisnwi th in now technologies computing quantum experimental With htcnd rbblsi lsia com- classical probabilistic do can that .INTRODUCTION I. lxnr Gheorghiu, Alexandru 3 NSLP,UiestePer tMreCre ai,France Paris, Curie, Marie et Universit´e Pierre LIP6, CNRS prover nvriyo xod ak od X P,UK 3PJ, OX1 Road, Parks Oxford, of University 1 2 colo nomtc,Uiest fEdinburgh, of University Informatics, of School 0Ciho tet dnug H A,UK 9AB, EH8 Edinburgh Street, Crichton 10 lrno aoaoy eateto Physics, of Department Laboratory, Clarendon priori a h slmtdto limited is who classically 1 at .Hoban, J. Matty othoc post n otoln ti n ftegetcalne nde- in challenges great the of noise one im- is this it Reducing computation controlling prover. and a honest into an ver- by noise a plemented so introduce and could noise, to ifier quantum susceptible realistically, highly But are malicious devices prover. of the the result which a of are in behaviour occur setting can that ideal “errors” an only proto- assume existing quan- typically approach, prover’s this cols the In pro- of quantum part computation. integral tum this an and becomes basis, could cess particular device a quantum approach measure- in make this ments the or – states – quantum paper particular approach this prepare in former take the we In entan- non- share multiple glement. that introduce provers or quantum between verifier, communicating and communication device prover quantum quantum the some some been allow verifier have and the setting give server com- single considered: extra client, no of classical modifications with the main setting, Two verifica- this assumptions. whether in survey putational problem possible a open is for an tion still [3] is (see It protocols paper). verification of ment reject and dishonest being output. is his prover verification prob- a high of when (with goal catch ability) to The is in the computation deviate fit. if quantum or of deem hand, lie they other could manner the they any On then dishonest verifier. is the prover perform for can task they the computer, quantum and a honest is has prover actually the the if to Clearly, task prover. efficient the untrusted any delegating perform by to computation able quantum be to like would verifier hr a enalto rgesi h develop- the in progress of lot a been has There ehiusfrvrfiain hc lo for allow which verification, for techniques nututdaet(rvr leigto alleging (prover) agent untrusted an , 2 upin,sc srqiigtenoise the requiring as such sumptions, n la Kashefi Elham and rsneo os eie,wt no with devices, noisy of presence e n sbcmn oepesn.An pressing. more becoming is ons efrpeaigo esrn single measuring or preparing for ce eie.I hsppr epresent we paper, this In devices. s rtrsod hnuigtequbit the using when thresholds or efaeoko neatv proofs interactive of framework he u.W lopromasimulation a perform also We put. eicto eoe challenging becomes verification , i nac,tesac o efficient for search the infancy, eir nte gn vrfir h only who (verifier) agent another ,3 1, computation 2

veloping scalable quantum computers. The thresh- importantly we can still verify if the logical ground old theorem shows that as long the error rate per state was indeed prepared by the prover. quantum gate is below a constant threshold, it is Finally, we consider a simple example of this pro- always possible to perform a fault tolerant quantum tocol in the honest prover scenario. That is, using computation with only a polylogarithmic increase in the repetition code and the Steane code, we can sim- overhead [4]. ulate and characterise the protocol’s behaviour un- We would like to avoid the verifier’s quantum de- der bit-flip errors and depolarizing noise. vice becoming too powerful, even being polylogarith- Paper outline — In Section II we give some ba- mic in the size of the input to the computation would sic complexity theoretic notions to formalize what be too powerful [5]. Therefore, we want to restrict it we mean by verifying efficient quantum computa- to having a quantum register that is constant-size. tions. We also outline post hoc quantum verifica- Even if the errors of the verifier’s device can be sup- tion, which is the basis for our approach. Next, in pressed, it still needs to be proven that this is not Section III we give our protocol for fault tolerant detrimental for the verification of a quantum com- verification of quantum computation, and also prove putation. To wit, we want that a malicious prover its correctness; we also describe our simulation of the does not exploit these errors in order to successfully protocol, with various degrees of noise and outline trick the verifier into accepting incorrect results. the obtained results. We then conclude, in Section For protocols in which the verifier is fully classical, IV, with some discussions and open problems. fault tolerance is not a concern since one can assume Let us first comment on approaches that have also that the provers are performing their quantum op- addressed the aforementioned problem of fault tol- erations on top of a quantum error correcting code. erant verification. Since provers are assumed to have universal quan- Related work — For protocols in which the veri- tum computing power, we naturally have to assume fier has a small quantum device, the question of fault that they are capable of fault tolerant quantum com- tolerance has been addressed in [9–12]. In [9–11] putation between themselves. We emphasise that the authors proposed protocols in which a classical discussions about fault tolerance only make sense in client possessing either a single qubit preparation or the setting in which the verifier possesses a quantum measurement device, susceptible to noise, could ver- device. ifiably delegate quantum computations to a prover. Thus, we are faced with the following problem: All these protocols are computationally blind, mean- Problem statement: Can a verifier with a ing that the delegated computation is kept secret constant-size and imperfect quantum device verifi- from the prover. We will return to this issue in de- ably delegate a quantum computation to a single tail in Section IV. Moreover, blindness is required for prover? achieving verifiability. However, this requirement of blindness introduces new difficulties when consider- We show that this is indeed possible. Further- ing fault tolerant computation. To circumvent these more, it is possible even if the verifier’s device is difficulties, extra (potentially unrealistic) assump- an imperfect single-qubit measurement device. Our tions were made about the noise, which rule out the approach is based on that of post hoc verification possibility of the prover utilising the noise to deceive [6–8], where a prover sends quantum systems to a the verifier. A discussion of the general difficulty in verifier that should be the ground state of a Hamil- realizing a verifiable, blind, fault tolerant protocol is tonian. This ground state encodes the desired quan- provided in [12]. tum computation and can be used to “read off” the outcome of that computation. If the verifier can in- deed certify that this is the ground state, then the II. PRELIMINARIES computation is verified. In our protocol we encode the qubits of this ground state into a logical ground state where each qubit of the original state is en- A. Complexity theory coded into a larger number of physical qubits via a quantum error correction code. This logical state is Complexity theory classifies computational prob- then the ground state of a logical Hamiltonian de- lems as sets of “yes/no” decision problems that are scribed by the quantum computation. In the proto- solvable by a particular model of computation, under col, the physical qubits in this logical state are then certain constraints. Decision problems are modeled measured one at a time, and appropriate classical as sets of binary strings, known as languages. The corrections are made on the outcomes of these mea- input to the problem is a bit string and the output is surements in post-processing if errors are detected. yes or no, depending on whether the string belongs An honest prover’s probability of successful compu- to the language or not. The primary class that is of tation will be boosted by this error correction, but interest to us, is that of decision problems decidable 3

efficiently by a quantum computer, which is denoted when x L, there exists a quantum state ψ BQP. By “efficiently” we always mean in a number • having at∈ most p(n)-many qubits, such that| i of time steps that scales as some polynomial in the (x, ψ ) accepts with probability at least a, size of the input to the problem. For completeness Vand | i we reproduce the definition of this class. when x L, for all quantum states ψ hav- ∗ • ing at most6∈ p(n)-many qubits, (x, |ψi) ac- Definition 1. A language L 0, 1 belongs to V | i BQP iff there exist a polynomial⊆ {p, and} a uniform cepts with probability at most b, quantum circuit family Cn n, such that for any x where a b 1/p(n). 0, 1 n the following is{ true:} ∈ − ≥ { } Clearly, BQP QMA, since the BQP verifier can ⊆ when x L, Cn(x) accepts with probability at simply ignore the proof state from the prover. It • ∈ least a, and is believed that the containment is strict, since, in principle, the prover can produce proof states that when x L, Cn(x) accepts with probability at cannot be generated by the poly-time quantum veri- • 6∈ most b, fier. In fact, it was shown in [13] that the “quantum overhead” of the verifier can be reduced to simply where a b 1/p(n) and Cn p(n). − ≥ | |≤ performing single-qubit measurements, while main- taining the ability to correctly decide all problems If we replace quantum circuits with classical in QMA. This is achieved by instructing the prover boolean circuits, having access to random bits, we to prepare special states that satisfy two properties: obtain the class BPP, of problems that can be de- cided efficiently on a classical computer. We will Any BQP computation can be performed frequently refer to machines that can solve either • through suitable single-qubit measurements of BPP problems or BQP problems as BPP machines these states. or BQP machines, respectively. Any such state of a given size can be tested Another class of interest is MA which consists of • decisions problems for which the “yes” instances can through single-qubit measurements. be checked by a BPP machine, when given access to If one adds a further condition, namely that these a polynomial-sized bitstring known as a proof. More special states can be prepared by a BQP machine formally, MA is defined as follows: (essentially restricting the prover to BQP), then one obtains a scheme for verifying an arbitrary ∗ Definition 2. A language L 0, 1 belongs to BQP ⊆ { } computation using only single-qubit measure- MA iff there exist a polynomial p, and a BPP ma- ments. This is precisely what Fitzsimons, Hajduˇsek chine (known as verifier), such that for any x and Morimae have done in their post hoc verifica- 0, 1 nVthe following is true: ∈ { } tion protocols [6–8]. One could ask whether this merely allows the verifier to check the “yes” in- when x L, there exists a string w stances of BQP problems, however BQP is closed un- • 0, 1 ≤p(n∈) such that (x, w) accepts with prob-∈ { } V der complement[14] meaning that the “no” instances ability at least a, and can also be verified. when x L, for all strings w 0, 1 ≤p(n), • (x, w) accepts6∈ with probability at∈ {most}b, V B. Post hoc verification where a b 1/p(n). − ≥ As mentioned, the core idea of post hoc verifica- Essentially, one can view problems in MA as those tion is to have a BQP prover (or provers) prepare a for which a computationally powerful prover can quantum proof state that the verifier can check using convince a BPP verifier that the answer is “yes”, single-qubit measurements. To explain how the pro- with high probability, by providing a proof string tocol works, we first define a problem known as the that the verifier can check. There is a quantum k-local Hamiltonian problem, which was introduced analogue of this known as QMA, in which the proof by Kitaev in [15]. A k-local Hamiltonian, acting on string is a quantum state. Specifically: a system of n qubits, is a hermitian operator H that can be expressed as H = i Hi, where each Hi is ∗ Definition 3. A language L 0, 1 belongs to a hermitian operator whichP acts non-trivially on at QMA iff there exist a polynomial⊆ { p,} and a BQP most k qubits. The k-local Hamiltonian problem, machine (known as verifier), such that for any for which we have taken the definition from [16], is x 0, 1 Vn the following is true: then the following: ∈{ } 4

Definition 4 (The k-local Hamiltonian (LH) prob- which we shall refer to as XZ-term, such that:

lem). n S = Pj (1) Input: H ,...,H , a set of m Hermitian ma- 1 m Oj=1 • trices each acting on k qubits out of an n-qubit system and satisfying Hi 1. Each matrix with P I,X,Z , where X and Z are the Pauli k k ≤ j entry is specified by poly(n)-many bits. Apart X and Z∈operators { } and I is the identity. Denote from the Hi we are also given two real num- wX (S) as the X-weight of S, representing the total bers, a and b (again, with polynomially many number of j’s for which Pj = X. Similarly denote bits of precision) such that a b> 1/poly(n). w (S) as the Z-weight for S. An XZ-Hamiltonian − Z is then a 2-local Hamiltonian of the form: Output: Is the smallest eigenvalue of H = • H = aiSi (2) H1 + H2 + ... + Hm smaller than b or are all its eigenvalues larger than a? Xi

where the ai’s are real numbers and the Si’s are Kitaev showed that this problem is complete for XZ-terms having wX (Si) 1 and wZ (Si) 1. Es- the class QMA. In other words, the problem is in sentially, as the name suggests,≤ an XZ-Hamiltonian≤ QMA and any problem in QMA can be reduced to is one in which each local term has at most one X it, in (classical) polynomial time [15]. The idea is operator and one Z operator. essentially this: for some language L QMA, and We can now explain the post hoc protocol of ∈ given a and b, one can construct a k-local Hamilto- [8]. The protocol relies on the observation that nian such that, whenever x L, its smallest eigen- BQP QMA. This means that any problem in ∈ value is less than b and whenever x L, all of its BQP can⊆ be viewed as an instance of the 2-local 6∈ eigenvalues are greater than a. The proof state, ψ , Hamiltonian problem. Therefore, for any language | i when x L, is the eigenstate of H corresponding L BQP there exists an XZ-Hamiltonian, H, and ∈ to its lowest eigenvalue (or a state that is close, in a polynomial-time∈ quantum verifier which can mea- trace distance, to this state), known as the ground sure a local term of H on the quantum witness sent state. The verifier receives the state from the prover by the prover and decide the problem correctly, with and measures one of the local terms Hi (which is high probability. But since the local terms of an an observable) on that state. One can prove that XZ-Hamiltonian have at most one X operator and this can be done with a polynomial-sized quantum one Z operator, the verifier will essentially have to circuit. This yields an estimate for measuring H measure at most two qubits, one in the standard ba- itself. Therefore, when x L and the prover sends sis ( 0 , 1 ) and the other in the Hadamard basis ∈ ψ , with high probability the verifier will obtain the ( + ,| i |).i | i corresponding eigenvalue of ψ which will be smaller | Wei |−i now restrict attention to L BQP. As | i than b. mentioned, when x L, the proof state∈ that the If the prover is malicious then it would have to prover should send to∈ the verifier should be close convince the verifier to accept when x L. However, to the ground state of the XZ-Hamiltonian. When when this is the case, all the eigenvalues6∈ of H will L BQP, the Hamiltonian can be chosen so that be larger than a and so, no matter what state the the∈ ground state is close to a particular type of state prover sends, when the verifier measures the local known as a Feynman-Kitaev clock state (also known term Hi it will, with high probability, obtain a value as history state), which can be prepared by a BQP greater than b and will therefore reject. We will refer prover [15]. To describe this state, consider a quan- to a b as the promise gap of the local Hamiltonian. tum circuit = UT UT − ...U , with classical input − C 1 1 The constant k in the definition of the k-local x , where T = poly( x ), for testing whether x L. | i | | ∈ Hamiltonian problem is not arbitrary. In the ini- Denoting U0 = I, the Feynman-Kitaev state associ- tial construction of Kitaev, k had to be larger than ated to and x is the following: C | i 5 for the problem to be QMA-complete. Subsequent T work has shown that even with k = 2 the problem 1 t T −t ψ = UtUt−1...U0 x 1 0 (3) remains QMA-complete [17]. In fact, H can be a | i √T +1 | i Xt=0 particular type of 2-local Hamiltonian known as an XZ-Hamiltonian and this is the type of Hamilto- There exists an XZ-Hamiltonian, H, such that when nian used in the post hoc protocol of Morimae and x L, we have that ψ H ψ < a, and when x L Fitzsimons [6, 8]. we∈ have that for any hφ|, |φ iH φ >b, for some6∈a,b To define an XZ-Hamiltonian, we introduce some such that a b > 1/poly| i h( x| ).| i The exact form of helpful notation. Consider an n-qubit operator S, H is not important− for understanding| | the protocol. 5

What is important is that for any L BQP, the a constant rate of noise on these devices will lead verifier can efficiently compute the description∈ of H. to the failure of the protocol for sufficiently large The post hoc protocol then works as follows: computations. This is because the gap between ac- ceptance and rejection, defined by a b, is inverse 1. The verifier computes the terms ai of the XZ- polynomial in the size of the input.− As a result of Hamiltonian, H = i aiSi, corresponding to noisy devices, the acceptance threshold is shifted to L and input x. TheyP then send the description a c, and the rejection threshold is shifted to b + c, of H and x to the prover. where− c is some positive constant that depends on 2. The prover responds by preparing the ground the noise rate of the devices. We can see that as long as c< (a b)/2, the verifier can still distinguish re- state of H (the Feynman-Kitaev state, de- − scribed above), denoted ψ , and sends it to the liably between acceptance and rejection. However, it is clear that for a sufficiently long input, we will verifier. This constitutes| i the quantum proof state for the statement that x L (if x L, have that c (a b)/2. At this point, the protocol no longer satisfies≥ − the correctness nor the soundness the same procedure is performed∈ for the com-6∈ plement of L, denoted Lc, which is also in criteria. In fact, this is common to all other verifi- cation protocols in the single-prover setting [3]. To BQP). address this issue we now give a fault tolerant version 3. The verifier chooses one of the XZ-terms Si, of the post hoc protocol that works in the presence according to the normalized probability distri- of quantum devices subject to local noise having a bution ai i, and measures it on ψ . They constant error-rate. {| |} | i accept on outcome sgn(ai) of the measure- ment. − A. The fault tolerant protocol The protocol is correct, in that when the prover aims to convince the verifier that x L (or x Lc, ∈ ∈ Our construction is simple: we ask the prover to respectively) and sends the correct state (for the encode the history state in a CSS (Calderbank-Shor- c Hamiltonian corresponding to L or to L , respec- Steane) error-correcting code [18] and send it to the tively), the verifier will accept with probability: verifier. The verifier will then perform a transversal measurement of the X and Z operators. Transver- 1 b pacc 1 (4) sality results in the logical operators being expressed ≥ 2  − ai  i | | as tensor products of physical X and Z operators, P i.e.: Additionally, the protocol is sound in that when the prover aims to convince the verifier that x L (or m m ˜ ˜ x Lc, respectively), irrespective of the state6∈ that X = Xi Z = Zi (6) the6∈ prover sends, the verifier will accept with prob- Oi=1 Oi=1 ability: where X˜ and Z˜ are the logical (or encoded) X and Z 1 a operators. In effect, the original Hamiltonian is re- pacc 1 (5) placed with an encoded Hamiltonian by substituting ≤ 2  − ai  i | | each XZ-term with its corresponding logical form. P Since ai is a constant and a b > 1/poly( x ), CSS codes are transversal and this ensures that i | | − | | the gapP between the two probabilities is inverse poly- the verifier needs to perform only single-qubit mea- nomial in the size of the input. surements. We also require an additional property, that is possessed by CSS codes, namely that the out- comes for the transversal measurements (of the X III. FAULT TOLERANT VERIFICATION and Z operators) are encoded in a classical error- OF QUANTUM COMPUTATION correcting code. This is because the verifier will not perform any quantum correction on the state sent The protocol described above works assuming an by the prover. Instead, this state will be measured ideal setting in which the quantum devices of both and the measurement outcomes are classically post- the prover and the verifier are perfect. Of course, processed. this is an unrealistic assumption since any imple- To clarify, consider the following simple example. mentation of the protocol will be subject to noise Assume that the CSS code is a repetition code in ˜ ⊗m ˜ ⊗m stemming from an imperfect isolation of the quan- which 0 = 0 and 1 = 1 , for some odd m> 1.| Thisi | codei can correct| i |mi bit-flip errors. If tum systems from the environment, and the use of ⌊ 2 ⌋ faulty devices. It is straightforward to show that the verifier wishes to measure the Z˜ observable on an 6

m ˜ ˜ encoded state, they will instead measure i=1 Zi. where H = i aiSi is the encoded XZ-Hamiltonian. The m-bit outcome corresponds to the outcomeN of Thus, sincePH˜ and H′ are unitarily related, they Z˜ encoded in a classical repetition code. Thus, the will also have the same eigenvalues. Moreover, if verifier will simply take the majority bit as the out- ˜ ⊗n ˜ ψ = E ψ anc is the encoded version of some come of Z. E | i| i For our protocol, the verifier will measure a lo- n-qubit state ψ , for a suitably chosen ancilla state anc , it is clear| i that for any such ψ we have that: cal term of the encoded Hamiltonian, in a transver- | i | i sal way, and perform the classical post-processing of the results in order to extract the corrected mea- ψ H ψ = ψ˜ H˜ ψ˜ (11) surement outcome. With this corrected outcome, h | | i D E the acceptance condition is the same as in the “un- encoded” case (i.e. if the outcome for the measure- Therefore, if ψ is a ground state of H, ψ˜ will be ment of term S˜ is sgn(a )). | i E i i a ground state of H˜ . To guarantee that− this construction works, we show the following: This proves property (1), since it shows that the encoded Hamiltonian will have the same promise gap (1) The encoded Hamiltonian preserves the a b as the original Hamiltonian. − promise gap of the original Hamiltonian. This To prove property (2), we first need to describe is equivalent to showing that the encoded what we mean by noisy measurements. The verifier ground state of the original Hamiltonian is a makes X and Z measurements, but with probabil- ground state of the encoded Hamiltonian hav- ity ǫm there is an error in the measurement. The ing the same energy. probability of error is independent between uses of (2) A polylogarithmic number of concatenations the measurement devices, i.e. there are no corre- of the CSS code is sufficient to maintain an lated errors[19]. To be a bit more precise, for ideal inverse polynomial acceptance-rejection gap in measurement operator Mx for outcome x, we ap- ply a unital map to Mx, where with probability the presence of noise. E 1 ǫm, Mx is unchanged, and with probability ǫm, − Having these properties guarantees that the fault Mx is changed to something else. Alternatively, if we tolerant post hoc protocol is both correct and sound, measure an n-qubit state ρ one qubit at a time, the even in the presence of noisy devices. In other words: noisy measurement is equivalent to transforming ρ to ( †)⊗n(ρ), and then making an ideal measurement Theorem 1. The post hoc protocol of Morimae and E † Fitzsimons can be made fault tolerant by encoding on each qubit individually, where is the channel that is dual to . E the XZ-Hamiltonian of the protocol in a CSS code E and having the verifier perform the X and Z mea- This error model of the measurement device is ex- surements in a transversal fashion. actly how errors are traditionally modelled in quan- tum computation, where they are identically and in- ˜ ˜ Proof. Let X and Z be the logical X and Z operators dependently distributed on the qubits. So if each in the chosen CSS code. We have that X,˜ Z˜ = { } qubit in the Hamiltonian is encoded in a block of 0 and we will assume that these operators act on qubits, then due to the error-correcting code, the m> 0 qubits. Since these are operators for an error probability of obtaining an incorrect outcome (after correcting code, there exists an encoding unitary, classical post-processing) has been suppressed from denoted E, such that: 2 ǫm on the original qubit to at most αǫm on the whole E(X I⊗m−1)E† = X˜ (7) block, for some constant α (determined by the code). ⊗ Here we have implicitly used the fact that the mea- surement outcome for the logical qubit in one block E(Z I⊗m−1)E† = Z˜ (8) ⊗ is obtained through classical error correction (post- processing) of the outcomes of measuring the block Now let H = i aiSi be an XZ-Hamiltonian acting ′ n(m−1) qubits. Concatenating k times then results in prob- k k on n> 0 qubits,P and let H = H I . Clearly, (2 −1) 2 H and H′ have the same eigenvalues.⊗ But note that ability α ǫm of there being an error upon mea- using Equations 7 and 8 we have that: suring an encoded qubit. The verifier will make two logical qubit measure- ⊗n n(m−1) ⊗n ˜ E Si I E = Si (9) ments, so to achieve a final error rate η, we must ⊗ have the error for each logical qubit after k concate- ˜ ˜ k k where Si is obtained by replacing X, Z and I by X, (2 −1) 2 η ˜ ⊗m nations be α ǫm 2 . Provided that α is be- Z and I , respectively. This then implies that: ≤ −1 low the threshold probability pth = α of the code, E⊗nH′E⊗n = H˜ (10) then if each block consists of b qubits with k levels 7

of concatenation, for each qubit we have |xi X D(π/8) log(2/αη) logb bk = , (12) log(1/αǫm)  FIG. 1. Example computation.

2 which is O(polylog( η )). So if the total number of qubits in the ground state of the original Hamilto- where: nian is n, after k levels of encoding in blocks of size b, the total number of qubits in the encoded ground D(φ)= cos(φ)Z + sin(φ)X (13) state is O(n polylog( 2 )). η Note that D(φ) is universal for single-qubit quantum If the probability of acceptance (rejecting) in the computations[21]. The computation has two time original protocol (without noisy measurements) is 1 steps, hence T = 2. Consider the case x = 0. The pacc (prej ) and we have that pacc prej . − ≤ poly(n) input state starts out as 0 , it is then flipped to 1 Now with noisy measurements, we have that the new and upon application of the| i D(π/8) gate it becomes| i probability of acceptance (with error correction) is sin(π/8) 0 cos(π/8) 1 . If we designate output | i− | i p˜acc pacc η andp ˜rej prej + η. Therefore, 1 as acceptance, then this circuit will accept x =0 ≥ − ≤ to maintain a polynomial gap between acceptance with| i probability cos(π/8)2. The history state, for and rejection we must have that η is sufficiently x = 0, will be: smaller than an inverse polynomial, which only in- curs a polylogarithmic overhead. Note that only a 1 ψx=0 = ( 0 00 + 1 10 + polynomial overhead is required if we wish for η to | i √3 | i| i | i| i be exponentially small. (sin(π/8) 0 cos(π/8) 1 ) 11 ) | i− | i | i The idea of encoding the proof state in an error- correcting code while maintaining a single-qubit measurement device for the verifier has also been where we have separated the computation register considered, in the context of general QMA problems, from the clock register. For the x = 1 case, the in [20]. In that case, however, the proof state is a history state will be: graph state that is used by the verifier to perform a 1 fault tolerant measurement-based quantum compu- ψx=1 = ( 1 00 + 0 10 + tation. The verifier is also required to test that this | i √3 | i| i | i| i state corresponds to the correct graph state and this (cos(π/8) 0 + sin(π/8) 1 ) 11 ) | i | i | i is achieved through a stabilizer test. In our case, by restricting to BQP computations, we simply require the verifier to measure the his- We now need to consider an XZ-Hamiltonian such tory state associated to the quantum computation. that the ground state is close to ψx=0 . Since the 2- | i By showing that the encoded Hamiltonian has the local construction is fairly involved and we are only same promise gap as the original Hamiltonian it is interested in a simple example, we will instead con- therefore sufficient to request that the prover encode sider a 3-local Hamiltonian. This, of course, does not the history state in a CSS code. change the protocol in any way and the verifier will still perform single-qubit X and Z measurements. Following the works of [17, 22], the Hamiltonian will B. Example have the following form:

H = Hin + Hclock + Hprop + Hout Let us consider a toy example of our protocol in the case of an honest prover, for which we will give where: numerical results when using the repetition code and Hin penalizes terms in which the input is not the Steane code, respectively. To start with, we • should consider a quantum computation for which of the correct form, at the start of the compu- we want to construct a history state. Given that tation (T = 0). the Steane code will encode one logical qubit as 7 Hclock penalizes terms in which the clock reg- physical qubits, this computation needs to be small • ister is not of the correct form, throughout the enough so that we are able to perform multiple runs computation. of the protocol, in a reasonable amount of time. For this reason, we will choose the following one-qubit Hprop penalizes terms that do not correspond computation: • to the chosen computation. 8

1 Hout penalizes terms for which the output of outcome 1 for this measurement, since 2 sin(π/8) • the computation register is not 1 (i.e. non- is positive.− accepting computations). | i For the x = 1 case, the situation is similar. In this case, the prover will inform the verifier that the In our case, we have: computation rejects (with high probability) and so the verifier will change the Hout term of the Hamil- Hin = (I x x ) 0 0 I − | ih | ⊗ | ih |⊗ tonian to:

Hout = 1 1 I 1 1 (15) Hclock = I 01 01 ⊗ | ih | | ih |⊗ ⊗ | ih | and otherwise proceed as in the x = 1 case.

Hprop = Hprop1 + Hprop2 where: C. Numerical results 1 Hprop1 = (I 0 0 I X X I + I 10 10 ) To simulate the above protocol, we considered 2 ⊗ | ih |⊗ − ⊗ ⊗ ⊗ | ih | two error-correcting codes: the repetition code and the Steane code. In both instances, we wanted to 1 compare how the verifier’s probability of acceptance Hprop2 = (I I 1 1 D(π/8) I X+I 10 10 ) 2 ⊗ ⊗| ih |− ⊗ ⊗ ⊗| ih | changes as we increase the amount of noise applied to the history state. Before showing the results, we and finally: should first ask: what is the probability of accep- tance, for x = 0, when there is no noise in the sys- Hout = 0 0 I 1 1 | ih |⊗ ⊗ | ih | tem? One can show that:

It should be noted that ψx is the ground state of 1 ψx H ψx | i p = 1 h =0| | =0i (16) Hin +Hclock +Hprop, but not the ground state of H. acc 2  − i ai  It is the Hout term that singles out ψx and makes | | | =0i P the ground state of H be close, in trace distance, to and in our case ψx H ψx 0.0488. We there- h =0| | =0i≈ the history state for the x = 0 case. This is because fore find that pacc 0.4949. in that case, the output of the computation will be The first case we≈ considered is the repetition code, 1 , with high probability. with 3 physical qubits per logical state. This code | iWe now write H in XZ form: can only correct for X errors. We therefore consid- ered the noise channel: 7 1 1 H = III + (1 ( 1)x)ZII ( 1)xZZI 4 4 − − − 4 − (ρ)=(1 p)ρ + pXρX F − 1 1 1 1 IZZ XXI XXZ sin(π/8)XIX acting independently on each individual qubit. The − 4 − 2 − 2 − 2 1 1 results are shown in Figure 2. + sin(π/8)XZX cos(π/8)ZIX As we can see, the point where the encoded state 2 − 2 yields the same acceptance probability as the unen- 1 1 + cos(π/8)ZZX ZIZ (14) coded state is p =0.5. The acceptance probabilities 2 − 4 for the unencoded state were determined by apply- ing the channel to each qubit in ψx , resulting The protocol proceeds as follows. The verifier will F | =0i inform the prover that they wish to perform the com- in a state ρ, and then computing: putation from Figure 1, for input x = 0. The prover 1 T r(Hρ) reports that the computation accepts (with high pacc = (17) 2 − 2 ai probability) and prepares the history state ψx=0 , i | | | i P encoded in a CSS code. This state is sent qubit by The same is true for the encoded state, except that qubit to the verifier. The verifier, will choose one logical Z operators are replaced with: of the terms from Equation 14, with its correspond- ing probability, and perform the transversal mea- ZM = M0 M1 surement of the state. For instance, the term XZX − 1 where: will be chosen with probability 2K sin(π/8), where K = i ai 4.8. The verifier measures the X | | ≈ M0 = 000 000 + 001 001 + 010 010 + 100 100 and ZPoperators, performs classical post-processing | ih | | ih | | ih | | ih | on their results and combines them so as to recover the outcome of measuring XZX. She accepts on M = 111 111 + 110 110 + 101 101 + 011 011 1 | ih | | ih | | ih | | ih | 9

qubit is subject to depolarizing noise, characterised 0.5 by the channel: Unencoded state 0.48 Encoded state (ρ)=(1 3p/4)ρ + p/4(XρX + Y ρY + ZρZ) 0.46 D −

0.44

0.42 0.5 0.4 Unencoded state 0.48 Encoded state 0.38 Data points Steane code 0.46

Probability of acceptance 0.36 0.44

0.34 0.42

0.32 0.4 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 Probability of bit-flip error 0.38

0.36 Probability of acceptance FIG. 2. Comparison between encoded and unencoded 0.34 states for the 3-qubit repetition code. 0.32

0.3 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 Essentially, the +1 eigenspace of ZM is spanned Probability of depolarization error by states containing a majority of 0 and the 1 | i − eigenspace is spanned by states containing a major- FIG. 4. Comparison between encoded and unencoded ity of 1 . Measuring ZM is the same as performing a states for Steane’s code. transversal| i Z measurement and taking the majority outcome. Due to the large number of entries for the density If we increase the size of the encoded state to 5 matrix of the encoded state, we were unable to di- qubits, we obtain the results from Figure 3. As ex- rectly apply the channel . Instead, for each qubit D in ψ˜x=0 , we chose to either leave it unchanged, 0.5 E with probability (1 3p/4) or, with probability p/4, Unencoded state − 0.48 Encoded state apply either X, Y or Z. This process is repeated multiple times, and in each case the probability of 0.46 acceptance is computed using Equation 17. The 0.44 overall probability of acceptance is then estimated

0.42 by taking the average over all of these runs. The results are shown in Figure 4. 0.4

0.38 0.49

Probability of acceptance 0.36 Unencoded state Encoded state 0.48 Data points Steane code 0.34

0.32 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 0.47 Probability of bit-flip error

0.46 FIG. 3. Comparison between encoded and unencoded states for the 5-qubit repetition code. 0.45

pected, the noise threshold increases and is around Probability of acceptance 0.44 p 0.72. ≈We now consider the Steane code, which can de- 0.43 tect and correct for arbitrary errors on a single qubit, 0.05 0.06 0.07 0.08 0.09 0.1 0.11 0.12 0.13 0.14 while encoding one logical state in 7 physical qubits. Probability of depolarization error This means that the encoded state will comprise of 21 qubits. For this case, we will assume that each FIG. 5. Threshold for the Steane code. 10

We considered 12 data points, spread equally in (2) The noise rate for each quantum operation is the interval [0, 1], and for each we performed 1000 below some constant threshold. Additionally, repetitions of applying noise in order to estimate the noise on the verifier’s device can depend on pacc. The error bars represent confidence intervals whatever operations the verifier performs and for the computed values, assuming a confidence of can be correlated with the prover’s quantum 95%. Additionally, the orange curve represents the system. best fit interpolation of the given samples, when as- suming a Gaussian model. As we can see, the thresh- (3) The protocol is unconditionally blind. In other old point appears to be between 0.1 and0.2. By con- words, throughout the interaction with the sidering 12 samples in the range between 0.05 and verifier, the prover only learns the size of the 0.15, and 4000 repetitions per sample, in Figure 5, delegated quantum computation. we find that the threshold point is between 0.12 and As mentioned, previous approaches achieved con- 0.13. ditions 1 and 3 but not 2. The protocol we proposed The simulations were performed in MATLAB, on achieves conditions 1 (with a constant size device) the Eddie Mark 3 cluster of The University of Edin- and 2 but not 3. burgh. The code for our simulations is available on Recently, a protocol has been proposed in which a Github [23]. classical client can delegate and verify the computa- tions performed by a quantum server [24]. This pro- tocol, however, relies on certain computational as- IV. CONCLUSIONS sumptions about whether a quantum computer can solve a particular problem. Therefore, the verifier would not need to worry about introducing errors We have given a simple construction for a fault into the prover’s quantum computation, as was the tolerant quantum verification protocol. In a nut- concern in our work, but this comes at the cost of shell, the construction involves taking the original making these computational assumptions. Interest- post hoc verification protocol of Morimae and Fitzsi- ingly, the protocol in [24] also uses post hoc verifica- mons and encoding it in a CSS error-correcting code. tion as a primitive, except now the prover measures Since the original protocol was not blind, neither is the qubits in the history state and relays the out- its fault tolerant counterpart. A protocol being blind comes to the verifier. The preparation of the history means that the delegated computation is kept secret state is slightly more complex than in our case since from the prover, and they only learn at most the it uses cryptographic one-way functions which intro- size the computation. A major open problem that duce some overhead. remains to be addressed is whether one can achieve Returning to our results, the simulations are en- fault tolerant verification of blind quantum compu- couraging. Given that the obtained thresholds are tation without resorting to additional assumptions, higher than the error rates observed in current ex- as in [9–11]. Specifically, the protocols from [9– perimental implementations [25–27], a demonstra- 11] assumed (either implicitly or explicitly) that the tion of the protocol in the near future is likely. The noise on the verifier’s device is independent of the se- major obstacle to such a demonstration would be the cret parameters that are used to achieve blindness. production of these highly entangled history states. Additionally, the noise, on that device, should be The use of CSS codes, however, means that one can uncorrelated with the prover’s private system. encode these states in codes having even higher noise Following the discussion in [12], the authors stress thresholds than the Steane code, such as surface that, so far, there is no protocol that simultaneously codes [28]. achieves all of the following properties: Acknowledgments. We acknowledge useful cor- respondence with Thomas Vidick. This work was (1) The verifier has a preparation or measurement supported by EPSRC grants EP/N003829/1 and device whose size is at most polylogarithmic EP/M013243/1. MJH also acknowledges funding in the size of the delegated quantum computa- from the EPSRC grant Building Large Quantum tion. States out of Light (EP/K034480/1).

[1] Peter W Shor. Polynomial-time algorithms for 1999. prime factorization and discrete logarithms on a [2] Dorit Aharonov and Umesh Vazirani. Is quantum quantum computer. SIAM review, 41(2):303–332, mechanics falsifiable? A computational perspective 11

c on the foundations of quantum mechanics. Com- ment of L, denoted L and consisting of all strings putability: Turing, G¨odel, Church, and Beyond. not contained in L, is also contained in the class. MIT Press, 2013. [15] Alexei Yu Kitaev, Alexander Shen, and Mikhail N [3] Alexandru Gheorghiu, Theodoros Kapourniotis, Vyalyi. Classical and quantum computation, vol- and Elham Kashefi. Verification of quantum compu- ume 47. American Mathematical Society Provi- tation: An overview of existing approaches. arXiv dence, 2002. preprint arXiv:1709.06984, 2017. [16] Dorit Aharonov, Itai Arad, and Thomas Vidick. [4] Dorit Aharonov and Michael Ben-Or. Fault- Guest column: the quantum pcp conjecture. Acm tolerant quantum computation with constant error sigact news, 44(2):47–79, 2013. rate. SIAM Journal on Computing, 38(4):1207– [17] Jacob D. Biamonte and Peter J. Love. Realizable 1282, 2008. hamiltonians for universal adiabatic quantum com- [5] For polylogarithmic size (uniform) quantum cir- puters. Phys. Rev. A, 78:012352, Jul 2008. cuits, there is no known general means of classi- [18] Michael A Nielsen and Isaac L Chuang. Quantum cally simulating them, since a brute force simulation computation and quantum information. Cambridge would run in quasipolynomial time. university press, 2010. [6] Joseph F Fitzsimons, Michal Hajduˇsek, and To- [19] Given that we use CSS codes, our construction moyuki Morimae. Post hoc verification of quantum can tolerate correlated errors as well, provided that computation. Physical review letters, 120(4):040501, these are correctable by the chosen CSS code. 2018. [20] Tomoyuki Morimae, Keisuke Fujii, and Harumichi [7] Joseph F Fitzsimons and Michal Hajduˇsek. Post hoc Nishimura. Quantum merlin-arthur with noisy verification of quantum computation. arXiv preprint channel. arXiv preprint arXiv:1608.04829, 2016. arXiv:1512.04375, 2015. [21] Additionally, {CNOT,D(φ)} is universal for gen- [8] Tomoyuki Morimae and Joseph F Fitzsimons. Post eral quantum computations. hoc verification with a single prover. arXiv preprint [22] Julia Kempe and Oded Regev. 3-local hamitonian arXiv:1603.06046, 2016. is qma-complete. Quantum Information & Compu- [9] Alexandru Gheorghiu, Elham Kashefi, and Petros tation, 3(3):258–264, 2003. Wallden. Robustness and device independence of [23] Github repository. https://bit.ly/2JSJDBA. verifiable blind quantum computing. New Journal [24] Urmila Mahadev. Classical verification of quantum of Physics, 17(8):083040, 2015. computations. arXiv preprint arXiv:1804.01082, [10] Theodoros Kapourniotis and Animesh Datta. 2018. Nonadaptive fault-tolerant verification of quan- [25] Michel H Devoret and Robert J Schoelkopf. Su- tum supremacy with noise. arXiv preprint perconducting circuits for quantum information: an arXiv:1703.09568, 2017. outlook. Science, 339(6124):1169–1174, 2013. [11] Keisuke Fujii and Masahito Hayashi. Verifiable fault [26] Maika Takita, Andrew W Cross, AD C´orcoles, tolerance in measurement-based quantum computa- Jerry M Chow, and Jay M Gambetta. Experimen- tion. Physical Review A, 96(3):030301, 2017. tal demonstration of fault-tolerant state preparation [12] Dorit Aharonov, Michael Ben-Or, Elad Eban, and with superconducting qubits. Physical review let- Urmila Mahadev. Interactive proofs for quantum ters, 119(18):180501, 2017. computations. arXiv preprint arXiv:1704.04487, [27] Google bristlecone. https://bit.ly/2FZcZwD. 2017. [28] Austin G Fowler, Matteo Mariantoni, John M Mar- [13] Tomoyuki Morimae. Two-message quantum-arthur- tinis, and Andrew N Cleland. Surface codes: To- merlin game with single-qubit measurements. Phys- wards practical large-scale quantum computation. ical Review A, 93(6):062333, 2016. Physical Review A, 86(3):032324, 2012. [14] A complexity class is closed under complement, if for all languages L contained in that class, the comple-