Magic State Distillation with Low Space Overhead and Optimal Asymptotic Input Count

TL;DR

This paper introduces a family of magic state distillation protocols with low space overhead and asymptotically optimal input count, scalable to target error, without concatenation, and adaptable to other gates.

Contribution

The authors develop a novel distillation protocol using weakly self-dual CSS codes that achieves optimal asymptotic input scaling and low space overhead, with flexible injection steps.

Findings

Asymptotically constant space overhead for distillation.

Linear scaling of input states and circuit depth with log of target error.

Protocols adaptable to other gates in the Clifford hierarchy.

Abstract

We present an infinite family of protocols to distill magic states for $T$-gates that has a low space overhead and uses an asymptotic number of input magic states to achieve a given target error that is conjectured to be optimal. The space overhead, defined as the ratio between the physical qubits to the number of output magic states, is asymptotically constant, while both the number of input magic states used per output state and the $T$-gate depth of the circuit scale linearly in the logarithm of the target error $\delta$ (up to $\log \log 1/\delta$). Unlike other distillation protocols, this protocol achieves this performance without concatenation and the input magic states are injected at various steps in the circuit rather than all at the start of the circuit. The protocol can be modified to distill magic states for other gates at the third level of the Clifford hierarchy, with the same asymptotic performance. The protocol relies on the construction of weakly self-dual CSS codes with many logical qubits and large distance, allowing us to implement control-SWAPs on multiple qubits. We call this code the "inner code". The control-SWAPs are then used to measure properties of the magic state and detect errors, using another code that we call the "outer code". Alternatively, we use weakly-self dual CSS codes which implement controlled Hadamards for the inner code, reducing circuit depth. We present several specific small examples of this protocol.

Figures

Tables

Table 1. Table A.1: Parameters of small hyperbolic weakly self-dual CSS codes  [ 46 ] . The code [ [ 20 , 2 , 6 ] ] delimited-[] 20 2 6 [[20,2,6]] can be constructed from the five-qubit code [ [ 5 , 1 , 3 ] ] delimited-[] 5 1 3 [[5,1,3]] by going through the Majorana operators  [ 35 ] , while the others cannot be constructed in this way.

$n_{\text{inner}}$	16	20	24	28	30	20	28	30
$k_{\text{inner}}$	6	8	12	14	16	2	4	6
$d$	4	4	4	4	4	6	6	6

Equations

$$X=\left(\begin{array}{cc}0& 1\\ 1& 0\end{array}\right),Y=\left(\begin{array}{cc}0& -i\\ i& 0\end{array}\right),Z=\left(\begin{array}{cc}1& 0\\ 0& -1\end{array}\right),$$

$$H=\frac{1}{\sqrt{2}}\left(\begin{array}{cc}1& 1\\ 1& -1\end{array}\right),T=e^{-i\pi Y/8}=\left(\begin{array}{cc}\cos \frac{\pi }{8}& -\sin \frac{\pi }{8}\\ \sin \frac{\pi }{8}& \cos \frac{\pi }{8}\end{array}\right).$$

$$\displaystyle\begin{tabular}[]{ccccccc}I&I&I&X&X&X&X\\ I&X&X&I&I&X&X\\ X&I&X&I&X&I&X\end{tabular},\quad\begin{tabular}[]{ccccccc}I&I&I&Z&Z&Z&Z\\ I&Z&Z&I&I&Z&Z\\ Z&I&Z&I&Z&I&Z\end{tabular},$$

$$\displaystyle\begin{tabular}[]{ccccccc}Z&Z&Z&Z&Z&Z&Z\end{tabular},\quad\begin{tabular}[]{ccccccc}X&X&X&X&X&X&X\end{tabular}$$

$$H=TZ{T}^{†}=e^{-i\pi Y/8}\text{leavevmode}Z\text{leavevmode}{e}^{i\pi Y/8}$$

$$|0⟩⟨0|\otimes I+|1⟩⟨1|\otimes e^{-i\pi Y/8}Y\text{leavevmode}Z\text{leavevmode}Y{e}^{i\pi Y/8}$$

$$=(Z\otimes I)\left(|0⟩⟨0|\otimes I+|1⟩⟨1|\otimes e^{-i\pi Y/8}\text{leavevmode}Z\text{leavevmode}{e}^{i\pi Y/8}\right).$$

$$\{\begin{array}{cccc}{\bar{X}}_1=X& X& I& I\\ {\bar{Z}}_1=I& Z& Z& I\end{array}\{\begin{array}{cccc}{\bar{X}}_2=Z& Z& I& I\\ {\bar{Z}}_2=I& X& X& I\end{array}$$

$${[}^C{\mathrm{Swap}}_{12}]H_1{[}^C{\mathrm{Swap}}_{12}]={[}^C(H_1\otimes H_2)]H_1$$

$${[}^C{\mathrm{Swap}}_{12}]{[}^C{\mathrm{Swap}}_{34}]H_1{H}_3{[}^C{\mathrm{Swap}}_{12}]{[}^C{\mathrm{Swap}}_{34}]={[}^C(H_1\otimes H_2\otimes H_3\otimes H_4)]H_1{H}_3.$$

$$|\psi ⟩=\text{leavevmode}\underset{U}{\underbrace{{}^{CC}Z}}\underset{|\varphi ⟩}{\underbrace{{\left(\frac{|0⟩+|1⟩}{\sqrt{2}}\right)}^{\otimes 3}}}.$$

$$W(a)\equiv US(a)U^{†},\text{ for }a=1,\dots ,q.$$

$${[}^C({\mathrm{Swap}}_{12}{\mathrm{Swap}}_{34}{\mathrm{Swap}}_{56})](W(a{)}_{135}\otimes I_{246}){[}^C({\mathrm{Swap}}_{12}{\mathrm{Swap}}_{34}{\mathrm{Swap}}_{56})]$$

$$={[}^C(W(a{)}_{135}\otimes W(a{)}_{246})](W(a{)}_{135}\otimes I)$$

$${\Lambda }^{ab}=v^{(a)}\cdot v^{(b)}.$$

$$I_n=\left(\begin{array}{ccc}1& & \\ & \ddots & \\ & & 1\end{array}\right),{\lambda }_n=I_{n/2}\otimes \left(\begin{array}{cc}0& 1\\ 1& 0\end{array}\right).$$

$$\left(\begin{array}{ccc}1& 1& 1\\ 1& 1& 0\\ 1& 0& 1\end{array}\right)\left(\begin{array}{ccc}1& & \\ & 1& \\ & & 1\end{array}\right)\left(\begin{array}{ccc}1& 1& 1\\ 1& 1& 0\\ 1& 0& 1\end{array}\right)=\left(\begin{array}{ccc}1& 0& 0\\ 0& 0& 1\\ 0& 1& 0\end{array}\right)$$

$$X(v)Z(w)=(-1{)}^{v\cdot w}Z(w)X(v).$$

$$k={\dim }_{{\mathbb{F}}_2}{\mathcal{S}}^{\perp }/\mathcal{S}=n-2{\dim }_{{\mathbb{F}}_2}\mathcal{S}.$$

$$\{\begin{array}{ll}{\tilde{X}}^{(i)}& =X(v^{(i)})\\ {\tilde{Z}}^{(i)}& =Z(v^{(i)})\end{array}$$

$$\{\begin{array}{ll}{\tilde{X}}^{(p+2j-1)}& =X(w^{(2j-1)})\\ {\tilde{Z}}^{(p+2j-1)}& =Z(w^{(2j)})\end{array}\{\begin{array}{ll}{\tilde{X}}^{(p+2j)}& =Z(w^{(2j-1)})\\ {\tilde{Z}}^{(p+2j)}& =X(w^{(2j)})\end{array}$$

$${\tilde{X}}^{(a)}{\tilde{Z}}^{(b)}=(-1{)}^{{\delta }_{ab}}{\tilde{Z}}^{(b)}{\tilde{X}}^{(a)}.$$

$$n_T=d(1+o(1))n_{\text{outer}}.$$

$$\gamma ={\log }_d(n_T/n_{\text{outer}}).$$

$$n_T/n_{\text{outer}}=O(d)\cdot n_{\text{init}}=O(\log (1/\delta )(\log \log 1/\delta {)}^{\gamma })$$

$$n_T$$

$$=n_{\text{outer}}(d+(d-1)(n_{\text{inner}}/k_{\text{inner}}-1)).$$

$$\mathrm{Pr}[w_j\cdot v=0|v\notin V_{j-1}]=\frac{1}{2},$$

$$\mathrm{Pr}[v\in V_k^{\perp }\mathrm{and}v\notin V_k]\le \prod _{j=2}^k\frac{1}{2}=2^{-k+1}.$$

$$\mathrm{Pr}[v\in V_c^{\perp }\mathrm{and}v\notin V_c]\le 2^{-c+1}.$$

$$\mathrm{Pr}[v\in V_c^{\perp }\mathrm{and}v\in V_c]\le \sum _{j=2}^c\mathrm{Pr}[v\in V_j\mathrm{and}v\in V_{j-1}^{\perp }\mathrm{and}v\notin V_{j-1}].$$

$$\mathrm{Pr}[v\in V_j\mathrm{and}v\in V_{j-1}^{\perp }\mathrm{and}v\notin V_{j-1}]$$

$$=\mathrm{Pr}[v\in V_{j-1}^{\perp }\mathrm{and}v\notin V_{j-1}]\cdot \mathrm{Pr}[v\in V_j\text{leavevmode}|\text{leavevmode}v\in V_{j-1}^{\perp }\mathrm{and}v\notin V_{j-1}]$$

Full text

The possibility of a large scale quantum computer relies on fault-tolerant architectures, in which errors are corrected faster than they are created [1, 2, 3]. The standard approach is to use stabilizer codes to protect logical qubits from noise [4, 5], and perform quantum gates at the encoded level. The overhead of the fault-tolerance is only polynomial in the logarithm of the desired accuracy, but in practice the overhead is estimated to be overwhelmingly large [6, 7]. Particularly expensive operations are non-Clifford gates such as the $\pi/4$-rotation (T-gate) and Toffoli gate. A compelling approach is to inject a special state, called a magic state, into a Clifford-only circuit, and pass the cost of implementing the non-Clifford operation to the preparation of the magic states, which are distilled from noisy ones [8, 9, 10].

There exist several distillation protocols for the magic state ($T$-state) using specialized quantum error correcting codes [8, 10, 11, 12]. Each code can provide a fixed degree of fidelity improvement that is given by the code distance. In order to achieve arbitrary good fidelity, one typically concatenates small routines. In terms of the number of input magic states of low fidelity per one output magic state of high fidelity, the best protocols to date are those in Refs. [12, 13]. However, these protocols require a large batch of thousands of magic states to be useful.

In this paper, we introduce an infinite family of distillation protocols, extending one of the very first protocols by Knill [8], and another by Meier, Eastin, and Knill [11]. Our protocol produces $n$ $T$-magic states using at most $cn$ qubits and achieves at least $c^{\prime}n$-th order error suppression under the assumption that the sole noise source is the $T$ gate, where $c,c^{\prime}$ are small universal constants. Since the degree of error suppression is high, there is no need to concatenate small routines, reducing the space overhead significantly.

Our protocol is also asymptotically superior (conjectured to be optimal) in terms of noisy $T$ count. For any fixed odd $d\geq 5$, we show that the number of noisy $T$ gates per one output magic state with error suppressed to $d$-th order converges to $d$ exactly in the large code length limit.

Beyond the magic states for $T$ gates, our protocol can distill magic states for rotation by $\pi/2^{k}$ for $k=3,4,\ldots$ adapting the idea of Ref. [14], and any gate in the third level of Clifford hierarchy [15]. (See also Ref. [16] for smaller angle ($k\geq 3$) rotations, though we do not use ideas there.) For the latter, the asymptotic performance is similar to the $T$ gate case.

Small instances of our family demonstrates reduction of space overhead, with a modest input $T$ count. If noisy $\pi/4$ rotations can be directly done on qubits, an instance of our family operates on 34 qubits including measurement ancillas, produces 15 $T$-magic states with 5th order error suppression, and requires 29 noisy $T$ gates per output. In comparison, to the authors’ knowledge, any previous protocol that can operate on less than 50 qubits have either have lower order of error suppression, or requires more non-Clifford gates per output.

Recent innovations show that the $\pi/4$-rotation and Toffoli gate can be implemented fault-tolerantly on a class of error correcting codes [17, 18, 19, 20, 21, 22, 23, 24, 25]. These schemes achieve computational universality through local operations while circumventing no-go theorems [26, 27] by going back and forth between two code spaces. This approach removes the need for magic states, but, it is not a simple question to tell which approach is better. This question depends on an architecture and underlying physical qubits’ characteristic, and thus we leave the realistic cost analysis and comparison to future work.

The organization of the present paper is as follows. We start in Section 1 with a basic explanation of our ideas by exhibiting examples of small sizes. Section 2 explains how to convert magic state distillation protocols for $T$ gates into those for Toffoli gates. In Section 3 we show that any weakly self-dual CSS code can be used in distillation protocols by implementing measurement of Clifford operators. In Section 4, we give asymptotic constructions of the codes, in the limit of either large distance or large code length. In Section 5, we give results of numerical simulations; in this section we also present some specific additional small size protocols that are not described elsewhere in the paper. We conclude with discussion in Section 6. In Appendix A, we give details, including stabilizer checks, for some of the specific codes used in the paper. Appendix B gives circuits for some of the protocols used. Appendix C describes unexpected relations among different distillation protocols. Appendix D explains an extension to qudits, using classification of symmetric forms over finite fields in Appendix E.

Throughout this paper, all classical codes that we consider will be linear codes over the binary field $\mathbb{F}_{2}$ and all quantum codes will be qubit stabilizer codes (except for Appendix D). Given a bit vector $v$, we use $|v|$ to denote its Hamming weight. Our magic state is the $(+1)$-eigenstate $\ket{H}=\cos\frac{\pi}{8}\ket{0}+\sin\frac{\pi}{8}\ket{1}$ of the Hadamard operator $H$. We use matrices

[TABLE]

A self-orthogonal subspace of some vector space is a subspace such that the inner product of any two vectors in the subspace vanishes. A weakly self-dual CSS code is a quantum code whose stabilizer group is invariant under conjugation by the product of the Hadamard operator on all qubits; we call this product a “transversal Hadamard".

1 Basic Distillation Protocols

Distillation protocols for magic states to date can be put roughly into three classes. Those in the first class implement a non-Clifford $\pi/4$-rotation to a stabilizer state such as $\ket{+}$ or $\ket{0}$ [10, 12, 16]. The non-Clifford rotation must be done fault-tolerantly, so the protocols in this class focus on finding error correcting codes that admits a transversal non-Clifford rotation. This requires the underlying code to have a special symmetry, which is rather rare. The protocols in the second class [8, 9, 11, 13, 14, 28] implement measurements of “stabilizers” of the magic state, based on the fact that a magic state in the third level of Clifford hierarchy [15] is an eigenstate of a Clifford operator. To measure a Clifford operator one needs a non-Clifford operation which has been implemented fault-tolerantly by a distance-two code. The third class uses yet different symmetries of codes [10, 29], and has high threshold for distillation, but the success probability does not reach 1 even with perfect input magic states.

Our scheme in the present paper belongs to the second class, and is an extension of the idea of Knill [8]. There are two levels of error correcting codes in our scheme, which we call inner and outer codes. Roughly speaking, the outer codes specify a certain set of measurements of Clifford operators on a set of input magic states, and the inner codes specify how to implement these measurements. We illustrate aspects of our ideas by two examples. They are not the best protocols in regards to e.g. the total number of non-Clifford gates and states, but will be simple to explain. A more general class of protocols is presented in later sections.

Without loss of generality, by a standard Clifford twirling argument, we can assume that each $\pi/4$ rotation and undistilled magic state suffers from independent $Y$ errors with probability $\epsilon$. We refer to this error model as the stochastic error model.

1.1 Trivial outer code

If we could implement the control-Hadamard, then the distillation is trivial: Prepare an ancilla qubit in $\ket{+}$ state, apply the control-Hadamard with the control on the ancilla and the Hadamard on an arbitrary target qubit, and measure the ancilla in $X$-basis to accept $+1$ outcome. The accepted target qubit is projected onto the magic state.

The control-Hadamard belongs to the third level of Clifford hierarchy, and thus cannot be implemented with Clifford operations. To obtain an approximate control-Hadamard with noisy non-Clifford rotations, we must use an error correcting code that can implement $H$ on the logical qubits fault-tolerantly.

1.1.1 $[[7,1,3]]$ inner code

To this end, we observe that the Steane code [30] admits a transversal Hadamard [8, Sec. IX]. The stabilizers are

[TABLE]

the group generated by which is fixed under the $H^{\otimes 7}:X_{i}\leftrightarrow Z_{i}$, and the logical operator pair is

[TABLE]

which are interchanged by the transversal Hadamard. Using an identity

[TABLE]

we see that the logical control-Hadamard is possible by replacing the middle $Z$ by the control-$Z$. The $T$ gate can be noisy as they act on the physical qubits of the Steane code.

This way, we have built a Hadamard measurement routine that is fault-tolerant. Then, a magic state distillation protocol is as follows:

Prepare a noisy magic state in the “data” register, and $\ket{0}$ in $6$ check registers, and embed them into the Steane code 2. 2.

Prepare an ancilla in $\ket{+}$ and implement control-$H^{\otimes 7}$ using Eq. (1.11), where the control is the ancilla and the targets are the physical qubits of the Steane code. 3. 3.

Inverse the embedding of the Steane code. 4. 4.

Measure the ancilla in the $X$ basis, the check qubits in the $Z$ basis. 5. 5.

Upon $+1$ outcome in all 7 measurements, a distilled magic state is in the data qubit.

Let us examine the pattern of errors that may go undetected. There are two possibilities.

• •

The initial magic state is faulty, and this is undetected due to malfunction of the control-Hadamard.

• •

The noisy $\pi/4$ rotations induce a logical error.

The first possibility is because a pair of simultaneous errors sandwiching the control-$Z$ can alter the ancilla measurement:

[TABLE]

Thus, the first possibility occurs with probability $\epsilon^{3}$ to leading order. One can easily see that this is the only possibility for weight 2 errors from the control-Hadamard to escape. The second possibility occurs at order $\epsilon^{3}$ since Steane’s code has distance 3. Overall, the protocol operates on $8$ qubits (assuming $T$ gates are applied in place), consuming $14$ $T$-gates and $1$ state of error rate $\epsilon$, producing $1$ output $T$-state whose error rate is $O(\epsilon^{3})$.

It is useful to think of the above protocol as a Hadamard measurement ($H$-measurement) routine that introduces a new error of order $\epsilon^{3}$ to the target, and another error of order $\epsilon^{2}$ to the control. The error on the control is easy to fix; repeat the measurement.111This corresponds to having redundant checks in the outer code. The error on the target is inherent to the choice of the inner quantum code, and should thus be overcome by another quantum code.

1.1.2 $[[17,1,5]]$ inner code

There exists a distance 5 code on 17 qubits with $H^{\otimes 17}$ being the logical Hadamard. It is an instance of the color code [31, 21]. We include the binary matrix for this code in Appendix A. In a similar way as above, this $H$-measurement routine has error rate $O(\epsilon^{5})$ on the target, and $O(\epsilon^{2})$ on the control. By repeating the $H$-measurement twice using this inner code, the control’s error rate becomes $O(\epsilon^{4})$. The control error goes undetected only if the initial magic state is faulty. Overall, only weight 5 errors may be undetected. This protocol consumes $17\times 4+1=69$ noisy $T$’s.

In fact, we can pipeline the two $H$-measurement routines: First, $H$-measure a noisy magic state using $[[7,1,3]]$ code, and then $H$-measure the outcome using $[[17,1,5]]$ code.222 Interestingly, the protocol using Steane code, and the pipelined protocol appear to have deep relation with triply even codes. See Appendix C. Hence, we have obtained a distillation routine with fifth order error suppression that operates on 18 qubits in total, consuming $1+7\times 2+17\times 2=49$ noisy $T$’s. It is worth comparing this with the $69\to 1$ protocol in the preceding paragraph. By using codes of smaller distance in the early stage of the protocol, we obtain a more efficient protocol. We loosely call this modification as a pipelined protocol. The circuit is in Fig. B.2 in Appendix B.

1.2 Repetition outer code

Imagine we have ${n_{\text{\rm outer}}}$ noisy magic states that are to be distilled. Under the stochastic error model, we can think of the noisy magic states as an probabilistic ensemble of ${n_{\text{\rm outer}}}$-bit strings where [math] denotes a good magic state, and $1$ denotes a bad one. The protocol in the previous subsection examines one qubit at a time, and in terms of the bit strings, this amounts to checking individual bits. If our goal is to suppress the overall error to $d$-th order where $d<{n_{\text{\rm outer}}}$, the bit-wise check might be overkill. A better way is to devise a measurement routine that can check the parity of several bits.

1.2.1 $[[4,2,2]]$ inner code

The simplest case is when ${n_{\text{\rm outer}}}=2$ and the desired error suppression is quadratic. If we can measure $H^{\otimes 2}$, then by postselecting on $+1$ outcome the noisy state is projected to the even parity subspace, which is $O(\epsilon^{2})$ away from the pair of perfect magic states. We can describe the situation by saying that we have a repetition code on ${n_{\text{\rm outer}}}=2$ bits with one parity check. This is an outer code.

A corresponding inner code should implement control-$H^{\otimes 2}$ to accuracy $O(\epsilon^{2})$, both in the target and the control. Meier, Eastin, and Knill have designed such a measurement routine [11]. The four qubit code $[[4,2,2]]$ whose stabilizers are $X^{\otimes 4}$ and $Z^{\otimes 4}$ admits the transversal Hadamard $\bar{H}=H^{\otimes 4}$ as a logical operator. If we choose the logical operators as

[TABLE]

then the transversal Hadamard swaps the two logical qubits. Using Eq. (1.11), this means that we can implement control-${\rm Swap}$ to accuracy $O(\epsilon^{2})$. Now, a trick is to use the control-${\rm Swap}$ twice sandwiching the Hadamard:

[TABLE]

where the superscript $C$ denotes the control that is common for both control-${\rm Swap}$s, and the subscripts $1$ and $2$ denote the qubits the operator acts on. The extra $H_{1}$ does no harm since the magic state is its eigenstate. The obtained control-$H^{\otimes 2}$ is accurate up to error $O(\epsilon^{2})$ on the target since the distance of the four-qubit code is 2, and also $O(\epsilon^{2})$ on the control due to Eq. (1.12). This is a quadratic distillation protocol operating on 5 qubits, consuming 18 noisy $T$’s to produce $2$ outputs.333Meier, Eastin, and Knill [11] compresses the circuit for the control-$H^{\otimes 2}$ to reduce the number of $T$’s of the protocol from 18 to 10, but we do not explain it here. See also Campbell and O’Gorman [28].

1.2.2 $[[16,6,4]]$ inner code and pipelining

The classical Hadamard code $[16,5,8]$ has a property that every code word has even overlap with any other code word. By the CSS construction, using these classical codewords as stabilizers, we obtain a $[[16,6,4]]$ code; see Appendix A.1.2 for the stabilizers. We will later show that there is a choice of logical operators such that the transversal Hadamard $H^{\otimes 16}$ implements simultaneous pairwise swaps on the three pairs of logical qubits. This implies that we can measure any even product $\tilde{H}^{\otimes 2}$, $\tilde{H}^{\otimes 4}$, or $\tilde{H}^{\otimes 6}$ of Hadamards on ${k_{\text{\rm inner}}}=6$ magic states. For example, we can generalize Eq. (1.14) to

[TABLE]

The $H$-measurement routine puts quadratic error to the control and quartic error to the target.

Imagine that ${n_{\text{\rm outer}}}=6$ magic states are laid on a ring. We measure $H^{\otimes 2}$ on every nearest neighboring pair of the magic states. There are six checks in total. The measurement pattern follows the parity checks of the classical repetition code; there is a redundancy in the checks, which turns out to be necessary. Let us see how this achieves quartic error suppression. In order for an error on one of ${n_{\text{\rm outer}}}$ magic states to pass the measurement routines, the two checks that involve that input state must both be faulty. This process gives an $O(\epsilon^{5})$ error, i.e., the probability of both checks being faulty is $O(\epsilon^{4})$, so including the error on the input magic state the error is $O(\epsilon^{5})$. Note that if we did not have a redundancy in the checks of the outer code, using only $5$ checks, one qubit would be checked only once and we would achieve only third order error suppression. More generally, any process involving one or more input magic state errors gives an error which is at most $O(\epsilon^{5})$. The dominant error after all the $H$-measurements is then from the logical error by the $H$-measurement routine, which happens with probability $O(\epsilon^{4})$. Overall, the protocol consumes $6+6\times(16\times 4)=390$ $T$’s to produce $6$ outputs.

We can pipeline the $[[4,2,2]]$ code routine in front of the $[[16,6,4]]$ code routine to lower the complexity of the distillation circuit. For instance, we can run the three $H$-measurement routines by the $[[4,2,2]]$ code on pairs of magic states $(12)$, $(34)$, and $(56)$, and then run the three $H$-measurement routines by $[[16,6,4]]$ code on pairs of magic states $(23)$, $(45)$, and $(61)$. The number of $T$’s consumed is now $6+3\times(4\times 4)+3\times(16\times 4)=246$, while the number of outputs is still $6$. It is left to the readers to show that the modified version also achieves quartic error suppression. We have simulated the modified version, and the results can be found in Section 5. The circuit is in Fig. B.1 in Appendix B.

2 Third level of Clifford hierarchy

The protocol above can be straightforwardly generalized to distilling other magic states to implement gates at the third level of the Clifford hierarchy. Consider a state $\ket{\psi}$ on $q$ qubits such that $\ket{\psi}=U\ket{\phi}$ where $U$ is a gate at the third level of the Clifford hierarchy [15], and $\ket{\phi}$ is a stabilizer state. Here we show that any such state $\ket{\psi}$ can be distilled. An example of such a state $\ket{\psi}$ is the magic state to produce a CCZ gate, which is equivalent to the Toffoli gate up to a Hadamard on the target [1].

[TABLE]

As $\ket{\phi}$ is a stabilizer state, we can identify $q$ operators, $S(1),S(2),\ldots,S(q)$, which are products of Paulis, generating the stabilizer group of $\ket{\phi}$, so that $\ket{\phi}$ is the unique (up to global phase) $+1$ eigenstate of those operators. For the CCZ, we see $S(1)=X_{1}$, $S(2)=X_{2}$, and $S(3)=X_{3}$. Then, the state $\ket{\psi}$ is the unique $+1$ eigenstate of the operators

[TABLE]

These operators $W(a)$ commute with each other by construction, and belong to the second level of the hierarchy, the Clifford group. For the CCZ, we see $W(1)=X_{1}(^{C}Z)_{23}$, $W(2)=X_{2}(^{C}Z)_{13}$, and $W(3)=X_{3}(^{C}Z)_{12}$.

Here is an example protocol for CCZ state distillation using three copies of the $[[4,2,2]]$ code, comprising a $[[12,6,2]]$ code. We regard the three copies as a single $[[12,6,2]]$ code and index the logical qubits by $1,\ldots,6$. We encode one CCZ state stabilized by $W(a)$ into logical qubits $1,3,5$ and another stabilized by $W^{\prime}(a)$ into logical qubits $2,4,6$, where $a=1,2,3$. Consider a variant of Eq. (1.14)

[TABLE]

where the control qubit is common for every gate. The simultaneous control-${\rm Swap}$s are implemented by the control-$H^{\otimes 12}$ on the $[[12,6,2]]$ code, where the control-$H^{\otimes 12}$ in turn is implemented by noisy $T$ gates. Thus, we obtain a measurement routine for $W(a)\otimes W^{\prime}(a)$.444 Since $W(1),W(2),W(3)$ are the same up to permutations of qubits, the measurement routine can in fact measure any product $W(a)\otimes W^{\prime}(b)$ for $a,b=1,2,3$ on the pair of CCZ states.

Then the protocol is to measure $W(1)W^{\prime}(1)$, $W(2)W^{\prime}(2)$, and $W(3)W^{\prime}(3)$. Overall, this protocol takes 2 noisy CCZ states and $3\times(12\times 4)=144$ noisy $T$ gates to produce 2 CCZ states at a lower error rate. Note that this explicit example protocol performs worse than existing ones in terms of non-Clifford gate count [32, 33, 34].

By applying the Clifford stabilizers $W$ uniformly at random to a noisy magic state for CCZ, it becomes a mixture of eigenstates of $W$’s. Hence we may assume an error model where an error flips at least one of $W(1),W(2),W(3)$ with probability $\epsilon$. Since the measurement routine puts measurement error at rate $O(\epsilon^{2})$ and logical error at rate $O(\epsilon^{2})$, the protocol achieves quadratic error reduction for CCZ state. For higher order reduction, one should use inner and outer code of higher distances.

A related discussion on the error model for the $T$ state is given in Section 5.1.

In passing, we note that the Clifford unitary $V_{123}=\leavevmode\nobreak\ (^{C_{1}}Z_{2})(^{C_{1}}X_{2})X_{2}X_{3}$ on three qubits $1,2,3$ is a stabilizer of the CCZ state $\ket{\text{CCZ}}=\frac{1}{\sqrt{8}}\sum_{a,b,c=0,1}(-1)^{abc}\ket{abc}$. Since the CCZ state is permutation invariant, we obtain six such stabilizers. They do not commute, but any triple of them uniquely determines the CCZ state. The controlled version can be implemented with only four $T$ gates [32] (See also [33]): ${}^{C_{0}}V_{123}=T_{2}(^{C_{1}}Z_{2})T_{2}(^{C_{0}}Z_{2})T_{2}^{\dagger}(^{C_{1}}Z_{2})T_{2}^{\dagger}(^{C_{0}}X_{3}).$ It might be possible to use these stabilizers with normal codes such as $[[7,1,3]]$ and $[[17,1,5]]$, but because they do not commute the resulting measurement routine rejects faulty inputs with a probability less than 1, even in the limit $\epsilon\to 0$.

3 Inner Codes

In this section, we find a general class of inner codes that can be used in distillation protocols. On the first read, a reader may wish to skip the discussion on symmetric forms, noting only the magic basis in Definition 3.3, and the construction of codes in Theorem 3.5.

3.1 Symmetric forms over $\mathbb{F}_{2}$

We consider finite dimensional vector spaces over the binary field $\mathbb{F}_{2}$. The space $\mathbb{F}_{2}^{n}$ is equipped with a symmetric dot product $v\cdot w=\sum_{i}v_{i}w_{i}\in\mathbb{F}_{2}$. This dot product on $\mathbb{F}_{2}^{n}$ is non-degenerate, i.e., for any nonzero vector $v\in\mathbb{F}_{2}^{n}$ there is a vector $w\in\mathbb{F}_{2}^{n}$ such that $v\cdot w\neq 0$. Let $\mathcal{S}$ be a null (self-orthogonal) subspace of $\mathbb{F}_{2}^{n}$, on which the dot product identically vanishes. Since $\mathcal{S}$ is null, the dot product of $\mathbb{F}_{2}^{n}$ canonically induces a dot product on the quotient space $\mathbb{F}_{2}^{n}/\mathcal{S}$ by $[v]\cdot[w]:=v\cdot w$ where $[v]$ and $[w]$ denote the equivalence classes (members of the quotient space) represented by $v$ and $w$, respectively. Let $\mathcal{S}^{\perp}$ denote the orthogonal complement of $\mathcal{S}$ with respect to the dot product.

Lemma 3.1**.**

The induced dot product on $\mathcal{S}^{\perp}/\mathcal{S}$ is non-degenerate.

Proof.

First, we claim that $(\mathcal{S}^{\perp})^{\perp}=\mathcal{S}$. It is clear by definition that $\mathcal{S}\subseteq(\mathcal{S}^{\perp})^{\perp}$. Interpreting the orthogonal complement as the solution space of a system of linear equations, we see that the claim holds by dimension counting. For $[v]\in\mathcal{S}^{\perp}/\mathcal{S}$, if $[v]\cdot[w]=0$ for any $w$, then $v$ belongs to $(\mathcal{S}^{\perp})^{\perp}=\mathcal{S}$, implying that $[v]=0\in\mathcal{S}^{\perp}/\mathcal{S}$. ∎

For any basis $\{[v^{(1)}],\ldots,[v^{(k)}]\}$ of $\mathcal{S}^{\perp}/\mathcal{S}$, we consider the symmetric matrix $\Lambda$ representing the dot product:

[TABLE]

Lemma 3.1 is equivalent to saying that the matrix $\Lambda$ is non-singular. Any basis change of $\mathcal{S}^{\perp}/\mathcal{S}$ induces a congruent transformation $\Lambda\to M^{T}\Lambda M$ where $M$ is the invertible matrix of the basis change. We consider equivalence classes of $\Lambda$ under the congruent transformations.

Lemma 3.2** (Classification of symmetric forms over $\mathbb{F}_{2}$).**

*A non-degenerate symmetric form over $\mathbb{F}_{2}$ is equivalent to one of the two non-equivalent choices:555 Any finite dimensional symmetric forms over the binary field is the intersection form of a closed topological surface $X$, defined by the cup product $H^{1}(X;\mathbb{F}_{2})\times H^{1}(X;\mathbb{F}_{2})\to H^{2}(X;\mathbb{F}_{2})\cong\mathbb{F}_{2}$ of cohomology. Indeed, $I_{n}$ corresponds to the connected sum of $n$ copies of $\mathbb{R}P^{2}$, and $\lambda_{n}$ the connected sum of $n/2$ copies of 2-torus. The classification in the lemma is the orientability of a given surface, and Eq. (3.3) is expressing the fact that two $\mathbb{R}P^{2}$’s can be turned into a torus in the presence of another $\mathbb{R}P^{2}$. We thank Michael Freedman for pointing this out. *

[TABLE]

Proof.

The two options are not equivalent since $\lambda_{n}$ means that the every vector is self-orthogonal, whereas $I_{n}$ implies that not every vector is self-orthogonal. For completeness, we give an elementary algorithmic proof by manipulating symmetric matrices.

First, we claim that any symmetric matrix can be brought to a direct sum of $I_{p}$ and $\lambda_{q}$ for some $p\geq 0$ and $q\geq 0$, where $q$ is even. If there is a nonzero diagonal element one can bring this to the top-left by permutation. Gaussian elimination on the first column and row reveals that $I_{1}$ is a direct summand. Induction gives a direct summand $I_{p}$, and we are left with a symmetric matrix $\Lambda^{\prime}$ with the zero diagonal. Any column cannot be zero since $\Lambda^{\prime}$ is non-singular, and thus some permutation brings $1$ to $(2,1)$ and $(1,2)$ entries of $\Lambda^{\prime}$. Gaussian elimination on the first and second columns and rows reveals a direct summand $\lambda_{2}$. By induction, our first claim is proved.

The second claim is that $I_{p+2}\oplus\lambda_{q-2}\cong I_{p}\oplus\lambda_{q}$ whenever $p,q>0$, whose proof is immediate:

[TABLE]

Therefore, whenever $p>0$, we have $I_{p}\oplus\lambda_{q}\cong I_{p+q}$. If $p=0$, there is nothing more to prove. ∎

The classification motivates the following notion of bases.

Definition 3.3**.**

Given a null subspace $\mathcal{S}\subseteq\mathbb{F}_{2}^{n}$, a basis of $\mathcal{S}^{\perp}/\mathcal{S}$ is called $(p,q)$-magic if the symmetric matrix $\Lambda$ representing the dot product on $\mathcal{S}^{\perp}/\mathcal{S}$ among the basis vectors is equal to $I_{p}\oplus\lambda_{q}$ for some $p\geq 0$ and $q\geq 0$. We call a magic basis normal if $q=0$, or hyperbolic if $p=0$.

We summarize the results of this section into a theorem.

Theorem 3.4**.**

For any self-orthogonal subspace $\mathcal{S}\subseteq\mathbb{F}_{2}^{n}$, there exists a $(p,q)$-magic basis for $\mathcal{S}^{\perp}/\mathcal{S}$, where $p+q=\dim_{\mathbb{F}_{2}}\mathcal{S}^{\perp}/\mathcal{S}$. If $p>0$ and $q>0$, then a $(p+2,q-2)$-magic basis exists.

3.2 CSS codes from self-orthogonal matrices

It is standard to associate a bit string $v=(v_{1},\ldots,v_{n})$ to a Pauli operator: $X(v)=X_{1}^{v_{1}}\cdots X_{n}^{v_{n}}$ where $X_{j}$ is the Pauli $\sigma^{x}$ on qubit $j$, and $Z(v)=Z_{1}^{v_{1}}\cdots Z_{n}^{v_{n}}$ where $Z_{j}$ is the Pauli $\sigma^{z}$ on qubit $j$. The commutation relation is that

[TABLE]

The CSS construction of quantum codes applies to a self-orthogonal (null) subspace $\mathcal{S}\subseteq\mathbb{F}_{2}^{n}$: For every vector $v\in\mathcal{S}$, we define an $X$-stabilizer $X(v)$, as well as $Z$-stabilizer $Z(v)$. The set of equivalence classes of $X$-type ($Z$-type) logical operators is then in one-to-one correspondence with $\mathcal{S}^{\perp}/\mathcal{S}$. The number of logical qubits is thus

[TABLE]

We encode logical qubits by choosing a complete set of logical operators $\tilde{X}^{(j)}$ and $\tilde{Z}^{(j)}$ as follows. Choose a $(p,q)$-magic basis $\{v^{(1)},\ldots,v^{(p)},w^{(1)},\ldots,w^{(q)}\}$ of $\mathcal{S}^{\perp}/\mathcal{S}$.666 Here we have abused notation to denote an equivalence class (a member of the quotient space) by a representative.

Then, we define

[TABLE]

By definition of the magic basis, these logical operators obey the canonical commutation relation of Pauli operators on $k$ qubits:

[TABLE]

Note that the commutation relation can be realized with arbitrary signs $\pm$ in the choice of the logical operators, but induced Clifford logical operators will depend on the signs. We enforce (3.6) in order for the transversal Hadamard $\bar{H}=H^{{n_{\text{\rm inner}}}}$ to be the logical Hadamard $\prod_{a=1}^{{k_{\text{\rm inner}}}}\tilde{H}^{(a)}$.

We have defined CSS codes based on self-orthogonal subspaces over $\mathbb{F}_{2}$:

Theorem 3.5**.**

Let $\mathcal{S}\subseteq\mathbb{F}_{2}^{n}$ be a self-orthogonal subspace with a $(p,q)$-magic basis of $\mathcal{S}^{\perp}/\mathcal{S}$. Then, there exists a CSS code on $n$ qubits with $p+q$ logical qubits and a choice of logical operators such that transversal Hadamard $H^{\otimes n}$ implements the logical Hadamards for the logical qubits $1,\ldots,p$, and simultaneously the swaps between the logical qubit $p+2j-1$ and $p+2j$ where $j=1,\ldots,q/2$.

We will call a weakly self-dual CSS code normal if a normal magic basis exists, and hyperbolic otherwise. It is possible for a normal code to have an even number of logical qubits, an even number of physical qubits, and an even distance. Every hyperbolic code, however, must have an even number of logical qubits, an even number of physical qubits, and an even distance. For instance, in Sec. 1, the Steane code $[[7,1,3]]$ and the $[[17,1,5]]$ color code are normal. The $[[4,2,2]]$ code and the $[[16,6,4]]$ are hyperbolic. We have used $(0,2)$-magic basis for $[[4,2,2]]$, and $(0,6)$-magic basis for $[[16,6,4]]$. The “$H$-code” by Jones [13] is a normal code with parameters $[[k+4,k,2]]$ where $k$ is even. Below, we will mostly use normal codes with $(p,0)$-magic basis for distillation protocols.

We note that the CSS codes derived from a self-orthogonal matrices are not too restrictive. By representing each qubit in any stabilizer code of parameters $[[n,k,d]]$ by Majorana modes, we obtain a weakly self-dual CSS code of parameters $[[4n,2k,2d]]$ [35]. We will briefly review this mapping in Section 4.2, where we will also present other families of such codes with improved rate.

4 Coding Theory and Asymptotic Performance

4.1 Asymptotic Performance

In this section we consider the asymptotic properties of the class of protocols defined above, for appropriate choice of inner and outer codes. We ignore all possibilities of pipelining, and use only a single inner and outer code to define each protocol; this will reduce the question of asymptotic properties to the question of the existence of code families with certain properties.

“Asymptotic" will refer to one of two limits. In the first limit, we consider a family of protocols parametrized by $d$, the order of reduction in error. An instance in the family reduces error probability from $\epsilon$ to a constant times $\epsilon^{d}$ in the limit of small $\epsilon$. We prove that

Theorem 4.1**.**

There is a family of protocols parametrized by an integer $d\geq 1$ to obtain a $d$-th order reduction in error, using a total of $\Theta(d)$ physical qubits, producing ${n_{\text{\rm outer}}}=\Theta(d)$ magic states. The total number of $T$ gates used is $n_{T}=\Theta(d^{2})$, so that the number of $T$ gates per magic state is $\Theta(d)$. The $T$-gate depth of the circuit is also $\Theta(d)$, where the $T$-gate depth refers to the circuit depth assuming that an arbitrary Clifford can be executed in depth $1$.

In the second limit, we fix $d$ and consider a family of protocols parametrized by ${n_{\text{\rm outer}}}$, the number of magic states produced. We prove that

Theorem 4.2**.**

For any odd $d\geq 5$, there is a family of protocols using ${n_{\text{\rm outer}}}\cdot(1+o(1))$ physical qubits, producing ${n_{\text{\rm outer}}}$ magic states with a $d$-th order reduction in error. The total number of $T$ gates used is

[TABLE]

The reason $d$ is odd is that the minimal weight of an error that is not caught in the protocol due to wrong $H$-measurement outcomes is always odd.

Given one particular protocol with $\epsilon_{\text{out}}=C\epsilon_{\text{in}}^{d}$ consuming $n_{T}/{n_{\text{\rm outer}}}$ $T$ gates per output, an infinite family of protocols can be defined by concatenation with itself. For this concatenated family, the number of $T$ gates to achieve an arbitrarily small error rate $\delta$ in output magic states scales like $O((\log 1/\delta)^{\gamma})$ where the scaling exponent [10, 12] is

[TABLE]

Smaller values of $\gamma$ reflect asymptotically more efficient distillation protocols. The triorthogonal codes [12] achieve $\gamma\rightarrow\log_{2}(3)$, and “multilevel” protocol [13] achieves $\gamma\to 1^{+}$. We will comment on this multilevel protocol in Discussion 6. It was conjectured that no protocol could achieve $\gamma<1$ [12]. Both families in Theorems 4.1 and 4.2 achieve $\gamma\to 1^{+}$.

We note that the measure $\gamma$ slightly underestimates the $T$-count efficiency of the family in Theorem 4.1. In order to achieve an arbitrary small final error rate $\delta$ from a fixed initial error rate, say, $\epsilon=0.01$, we can pick a member $P_{d}$ of the family of error reduction degree $d$ such that $\delta>C_{d}(\epsilon/2d^{2})^{d}$. Here $C_{d}$ is the leading coefficient of the output error probability of the protocol $P_{d}$, which is at most the number of ways that weight $d$ errors occur among $n_{T}=O(d^{2})$ $T$ gates; $C_{d}\leq\alpha d^{2d}$ for some $\alpha>0$ independent of $d$. For the condition $\delta>C_{d}(\epsilon/d^{2})^{d}$, it suffices that $d>(\log(1/\delta)+\log\alpha)/\log(1/\epsilon)$. We initially distill magic states to suppress the error rate from $\epsilon$ to $\epsilon^{\prime}=\epsilon/d^{2}$, by using a concatenated protocol $P_{\text{init}}$. This takes $n_{\text{init}}=O(\log d)^{\gamma}$ input magic states per output magic states for some $\gamma>1$. We can then feed $P_{d}$ with the outputs from $P_{\text{init}}$ at error rate $\epsilon^{\prime}$. It follows that

[TABLE]

magic states at error rate $\epsilon$ suffice to achieve final accuracy $\delta$. Thus, the scaling of $n_{T}/{n_{\text{\rm outer}}}$ is linear in $\log(1/\delta)$ up to a logarithmic correction. (One can iterate the argument recursively to further slow down the dependency on $1/\delta$.)

Theorem 4.2 will use normal codes. The reduced number of $T$ gates required to implement checks with a normal code is essential to obtaining the number of $T$ gates in the theorem (we would need roughly twice as many using hyperbolic codes). This explains why $d$ is chosen odd. The case of $d=1$ is of course trivial: no codes are needed. Thus, the reader may wonder why the case $d=3$ is not used; this is explained further below.

Theorems 4.1, 4.2 will follow almost immediately given certain families of inner and outer codes obeying certain properties of the codes that we define below. We will prove these theorems given these properties in this subsection and we construct families of inner and outer codes with these properties in subsections 4.2, 4.3.

Consider first the inner code. This code will have ${k_{\text{\rm inner}}}$ logical qubits and ${n_{\text{\rm inner}}}$ physical qubits. The distance of the inner code will be at least $d$. Consider then the effect of errors in the $T$ gates inside the inner code; i.e., in the $T$ gates acting on the encoded state. To obtain $d$-th order reduction in error, it suffices to consider the case that fewer than $d$ errors occur in such $T$ gates. Since the inner code distance is at least $d$, these errors cannot produce a logical error. There is one way, however, in which these errors can have an effect without being detected by the inner code. It is possible that a pair of errors act inside the inner code, both on $T$ gates acting on the same qubit. The effect of these errors is to cause an error in the check being measured by the inner code, i.e., if the check was measuring a given product of $W$ operators specified by the outer code, we instead measure the opposite sign; we call this a “measurement error".

The possibility of measurement errors affects some of the properties that we require of the outer code. Of course we need the outer code to have distance at least $d$, as otherwise a pattern of fewer than $d$ errors in the input magic states could cause an undetectable error, but this is not sufficient. It is necessary that a pattern of fewer than $d$ errors causes enough checks to be violated so that even a small number of measurement errors will lead to an error detected by the code. This is defined by the property of “sensitivity" that we now define.

The outer code will have $m$ parity checks, encoded in an $m$-by-${n_{\text{\rm outer}}}$ parity check matrix $M$, where each row of the matrix indicates a given check. We can measure rows of this matrix with even weight using an hyperbolic inner code and rows with odd weight using a normal inner code. For simplicity we will either have all rows have even weight or have all rows use odd weight so that we can use the same inner code for all checks. (More generally, one could use both a hyperbolic and a normal code.) Then, this inner code must have ${k_{\text{\rm inner}}}$ greater than or equal to the maximum row weight of $M$. The difference between the row weight of $M$ and ${k_{\text{\rm inner}}}$ must be an even number. In this case, we say that the inner code can implement the checks of the outer code.

Definition 4.3**.**

An $m$-by-${n_{\text{\rm outer}}}$ parity check matrix $M$ for a classical linear code is said to be $(\tilde{d},s)$-sensitive if any nonzero bit vector $v$ of length ${n_{\text{\rm outer}}}$ with $|v|\leq\tilde{d}$, we have $|Mv|\geq s$. That is, for any such vector, the number of violated parity checks is at least $s$.

We emphasize that sensitivity is a property of the check matrix of the outer code, rather than the codewords of the outer code, and in some examples the rows of the check matrix may be linearly dependent. A $(\tilde{d},s)$-sensitive parity check matrix is $(\tilde{d}-1,s)$-sensitive by definition.

Lemma 4.4**.**

Given an $m$-by-${n_{\text{\rm outer}}}$ parity check matrix $M$ such that $2|Mv|+|v|\geq d$ for any nonzero $v$ (e.g. $(d-1,\frac{d-1}{2})$-sensitive $M$), and given an inner code of parameters $[[{n_{\text{\rm inner}}},{k_{\text{\rm inner}}},d]]$ that can implement the checks defined by $M$, the protocol yields $d$-th order reduction in error. The protocol overall takes ${n_{\text{\rm outer}}}$ noisy magic states, $2{n_{\text{\rm inner}}}m$ noisy $T$ gates when the inner code is normal, or $4{n_{\text{\rm inner}}}m$ when hyperbolic, and outputs ${n_{\text{\rm outer}}}$ magic states.

Proof.

Any error pattern inside the inner codes with weight less than $d$ cannot cause a logical error. Thus, if an error pattern inside the inner code does not violate a stabilizer of the inner code, it either has no effect or it leads to an error in measurement of a check of the outer code; the latter possibility requires at least two errors inside the inner code. Any input state with $|v|\geq 1$ errors will violate at least $|Mv|\geq(d-|v|)/2$ checks of the outer code. If no violation of these checks is detected, there must be at least $2|Mv|$ errors on $T$ gates inside the inner code. Thus, there must be at least $d$ errors in total.

The input $T$ gate and state count is clear from Section 1. ∎

We now define some asymptotic properties of the codes needed.

Definition 4.5**.**

A family of quantum error correcting codes with increasing number of qubits $n$ has good rate if the number of encoded qubits $k$ is $\Theta(n)$ and has good distance if the distance $d$ is $\Theta(n)$.

Definition 4.6**.**

Given a family of outer codes with increasing ${n_{\text{\rm outer}}}$, we say that this family has good sensitivity if each code in the family is $(\tilde{d},s)$-sensitive for $\tilde{d}=\Theta({n_{\text{\rm outer}}})$ and $s=\Theta({n_{\text{\rm outer}}})$.

Definition 4.7**.**

Given a family of outer codes with increasing ${n_{\text{\rm outer}}}$, we say that this family has good check rate if the parity check matrix is $m$-by-${n_{\text{\rm outer}}}$ with $m=\Theta({n_{\text{\rm outer}}})$.

Proof of Theorem 4.1.

In subsection 4.2, we show that families of both hyperbolic and normal inner codes with good rate and distance exist and in subsection 4.3 we show that families of outer codes with good check rate, good sensitivity, and even row weight exist. Combining these results with Lemma 4.4, Theorem 4.1 follows. ∎

Proof of Theorem 4.2.

In subsection 4.2, we show that, for any $d$, there exist families of both hyperbolic and normal inner codes with increasing ${n_{\text{\rm inner}}}$ such that ${k_{\text{\rm inner}}}/{n_{\text{\rm inner}}}\rightarrow 1$. To prove this theorem, we will only need the result for normal inner codes. Consider some code from this family with given ${k_{\text{\rm inner}}},{n_{\text{\rm inner}}}$. In subsection 4.3 we show Lemma 4.15 which we reproduce here:

Lemma**.**

Given integers $\tilde{d},w\geq 1$ and $s\geq 2$, there exists an $m\times{n_{\text{\rm outer}}}$ parity check matrix $M$ that is $(\tilde{d},s)$-sensitive where $m={n_{\text{\rm outer}}}\cdot s/w$ and every row of $M$ has weight $w$ exactly.

Choose $w={k_{\text{\rm inner}}}$. Choosing $\tilde{d}\geq d-1$ and $s=(d-1)/2$, this gives us an outer code such that the checks can be performed by the given inner code and we need to perform ${n_{\text{\rm outer}}}(s/w)={n_{\text{\rm outer}}}(s/{k_{\text{\rm inner}}})$ checks with the inner code. Each such check with the inner code requires using $2{n_{\text{\rm inner}}}$ $T$ gates, so that the total number of $T$ gates needed to perform the checks with the inner code is equal to $2{n_{\text{\rm outer}}}s({n_{\text{\rm inner}}}/{k_{\text{\rm inner}}})$. Additionally, we need to perform ${n_{\text{\rm outer}}}$ $T$ gates to create the input magic states to the outer code. Thus, the total number of $T$ gates is

[TABLE]

Taking ${n_{\text{\rm inner}}}$ large so ${n_{\text{\rm inner}}}/{k_{\text{\rm inner}}}\rightarrow 1$, we conclude $n_{T}\rightarrow{n_{\text{\rm outer}}}d$. ∎

We can now see better why we needed $d\geq 5$ in Theorem 4.2. This is because for $d=3$, we have $s=1$ and Lemma 4.15 does not apply. The reader will see later why the case $s=1$ is excluded from that lemma; roughly, this is because in this case, each bit participates in only a single check and we would lack certain expansion properties for a certain graph defined later.

4.2 Inner Codes

In this subsection, we give asymptotic constructions of inner codes. There are at least two constructions of weakly self-dual codes with good rate and distance in the literature. We review these, before giving an alternative probabilistic proof which has some advatanges.

First, in Ref. [36], it is shown that given any ratio $d/n$, one can find a family of weakly self-dual CSS codes with $n$ qubits and distance $d$ and given ratio $d/n$ achieving a rate $k/n\rightarrow 1-2H_{2}(d/n)$, where $H_{2}$ is the binary entropy function. The codes found in that paper all are hyperbolic codes. However, we can obtain normal codes from them by a “puncturing procedure" (see also [37, Sec. 3.5]):

Definition 4.8**.**

Given a hyperbolic weakly-self-dual CSS code $C$ on $n$ qubits with $k$ logical qubits, define a “punctured code" $C^{\prime}$ as follows. Choose a qubit $i$ (the code $C^{\prime}$ may depend upon the choice of $i$). Write the stabilizer generators of $C$ such that only one $X$-type and one $Z$-type generator is supported on $i$. Define $C^{\prime}$ by removing qubit $i$ and removing the stabilizer generators support on $i$. Then $C^{\prime}$ has $n^{\prime}=n-1$ qubits and $k+1$ logical qubits. The code $C^{\prime}$ is a normal code by construction.

If $C$ is non-degenerate with distance $d$, then $C^{\prime}$ has distance $d^{\prime}\geq d-1$. More generally, $d^{\prime}+1$ is greater than or equal to the minimum weight of an operator which commutes with the stabilizer group of $C$, because given an $X$-type logical operator $O$ in $C^{\prime}$ then either $O$ or $OX_{i}$ must commute with the stabilizer group of $C$. Indeed, one may show that puncturing the codes of Ref. [36] reduces the distance by at most $1$.

The only disadvantage of this proof is that it is a greedy proof that we not know how to implement efficiently. While it would be desirable to find an explicit family of codes achieving this rate, we do not know how to do this. However, another construction in the literature is a randomized construction which allows us to give codes which, with high probability, have the desired distance. Unfortunately, this construction will only achieve $k/n\rightarrow 1/2-H_{2}(2d/n)$. This construction uses a general method to construct weakly self-dual CSS codes in Ref. [35].

Consider a stabilizer code $C_{qubit}$ which acts on $n$ physical qubits and has $k$ logical qubits and distance $d$. From this code, one can derive a code for Majorana fermions $C_{Majorana}$ which acts on $4n$ Majorana modes and has $k$ logical qubits and distance $2d$, where now the distance refers to minimum weight of a product of Majorana operators that is a logical operator. The code $C_{Majorana}$ is derived in the following way: For each physical qubit of $C_{qubit}$, one introduces four Majorana modes, $\gamma_{0},\gamma_{1},\gamma_{2},\gamma_{3}$, and declares that the product $\gamma_{0}\gamma_{1}\gamma_{2}\gamma_{3}$ is a stabilizer of $C_{Majorana}$. For each stabilizer of $C_{qubit}$, one defines a stabilizer of $C_{Majorana}$ by replacing an operator $X$ on a qubit by $i\gamma_{0}\gamma_{1}$, $Y$ by $i\gamma_{0}\gamma_{2}$, and $Z$ by $i\gamma_{0}\gamma_{3}$. The stabilizer generators of $C_{Majorana}$ are given by bit strings of length $4n$ such that the dot product over $\mathbb{F}_{2}$ of any pair of such bit strings is [math]. Thus, from $C_{Majorana}$, one can define a weakly self-dual CSS code $C_{wsd}$ with $4n$ physical qubits, $2k$ logical qubits and distance $2d$. Since a randomized construction (see, for example, Eq. 7.200 of Ref. [38]) gives stabilizer codes $C_{qubit}$ with $k/n\rightarrow 1-H_{2}(d/n)-(d/n)\log_{2}(3)$, mapping these stabilizer codes $C_{qubit}$ to weakly-self dual codes $C_{wsd}$ gives $k/n\rightarrow(1/2)[1-H_{2}(2d/n)-(2d/n)\log_{2}(3)]$. Since the randomized construction gives a lower bound to the weight of any operator commuting with the stabilizer group, we can puncture these codes and reduce the distance by at most $1$.

Here we give another proof of the existence of such good weakly self dual-codes. This will lead to rate $k/n\rightarrow 1-2H_{2}(d/n)$. For any fixed distance $d$, one can obtain families of stabilizer codes with $n$ physical qubits and $k$ logical qubits with the ratio $k/n\rightarrow 1$ as $n\rightarrow\infty$. While this improvement is only by constant factors over the construction via Majorana codes, it will lead to nice asymptotic expressions for the number of $T$-gates, $n_{T}$, required to attain $d$-th order suppression in error. It is also a randomized construction, showing that codes in a certain ensemble have the desired properties with high probability.

Define a random ensemble of $c$-by-$n$ self-orthogonal matrices as follows, where a matrix $M$ is defined to be self-orthogonal if $MM^{T}=0$. Choose the first row of the matrix to be the all $1$s vector $\vec{1}$. Choose the second row uniformly at random subject to the constraint that it have vanishing dot product with the first row. Continue in this fashion, choosing the $j$-th row uniformly at random subject to the constraint that it have vanishing dot product with the first $j-1$ rows. (Remark: the requirement that the first row be the all $1$s vector is simply chosen to simplify some notation, so that we do not need to add the requirement that each row have even weight.)

Lemma 4.9**.**

Consider a fixed $n$-component vector $v$, with $v\neq 0$ and $v\neq\vec{1}$. For a random $c$-by-$n$ self-orthogonal $M$, the probability that $Mv=0$ is at most $2^{-c+1}+2^{-n+c+1}$.

Proof.

Let $w_{1},\ldots,w_{c}$ be the rows of $M$. Let $V_{j}$ be the self-orthogonal subspace which is the span of the first $j$ rows of $M$. We will estimate the desired probability by a union bound, considering separately the event that $v\in V_{c}^{\perp}$ and $v\not\in V_{c}$, and the event that $v\in V_{c}^{\perp}$ and $v\in V_{c}$.

Consider the first event. Let $j>1$. Then

[TABLE]

because the constraint that $(v,w_{j})=0$ is independent of the constraints on the vector $w_{j}$. Thus, for any $k$,

[TABLE]

For $k=c$, we find in particular that

[TABLE]

Now we estimate the probability of the second event. Note that if $v\in V_{c}$, there is a least $j$ such that $v\in V_{j}$. So,

[TABLE]

We have

[TABLE]

where we used Eq. (4.6).

Now we estimate the probability $\Pr[v\in V_{j}\leavevmode\nobreak\ |\leavevmode\nobreak\ v\in V_{j-1}^{\perp}\,{\rm and}\,v\not\in V_{j-1}]$. This is possibly nonzero only if $v\cdot v=0$. Consider the space of all $n$-component vectors modulo vectors in $V_{j-1}$; this quotient space has dimension at least $n-(j-1)$. Let $\pi$ be the natural map from the space of all vectors to this quotient space. The vector $\pi v$ is nonzero by assumption. The vector $w_{j}$ is subject to at most $j-1$ independent constraints from $V_{j-1}$. Consider the space of possible $\pi w_{j}$, given that $w_{j}$ obeys those constraints; this space has dimension at least $n-2(j-1)$ and so the probability that a random vector in this space is equal to $\pi v$ is at most $2^{-(n-2j+2)}$. Hence, $\Pr[v\in V_{j}\leavevmode\nobreak\ |\leavevmode\nobreak\ v\in V_{j-1}^{\perp}\,{\rm and}\,v\notin V_{j-1}]\leq 2^{-(n-2j+2)}$, so $\Pr[v\in V_{j}\,{\rm and}\,v\in V_{j-1}^{\perp}\,{\rm and}\,v\notin V_{j-1}]\leq 2^{-n+j}$. So by Eq. (4.8),

[TABLE]

By a union bound, adding probabilities in Eqs. (4.7,4.10), the lemma follows. ∎

Lemma 4.10**.**

Let $n,c,d$ be such that

[TABLE]

Then, there exists a $c$-by-$n$ matrix $M$ such that $MM^{T}=0$ and such that $Mv\neq 0$ for any $v\neq 0$ with $v$ having Hamming weight at most $d$.

Proof.

This follows from Lemma 4.9 and by a first moment bound. For a random $M$ from the above ensemble, the expected number of vectors $v\neq 0$ with Hamming weight at most $d$ such that $Mv=0$ is at most $(\sum_{w=1}^{d}\binom{n}{w})\cdot(2^{-n+c+1}+2^{-c+1})$. ∎

Lemma 4.11**.**

For any fixed $d$, one can find a family of $M$ with increasing $n$ such that the ratio $c/n$ tends asymptotically to zero and such that Eq. (4.11) is obeyed. Hence, for any distance $d$, one can find a family of hyperbolic or normal weakly self-dual CSS codes such that the ratio ${k_{\text{\rm inner}}}/{n_{\text{\rm inner}}}\rightarrow 1$ as ${n_{\text{\rm inner}}}\rightarrow\infty$.

Proof.

Immediate for the hyperbolic case. Since the lemma 4.9 upper bounds the probability that an operator commutes with the stabilizer group one can also puncture these codes to obtain a normal code. ∎

4.3 Outer Codes

In this subsection, we construct families of outer codes with good check rate and sensitivity. We begin with a randomized construction, and then show how to construct explicit families using previous results in coding theory.

Lemma 4.12**.**

There exist families of outer codes with good check rate and sensitivity and even row weight. Similarly, there exist families of outer codes with good check rate and sensitivity and odd row weight.

Proof.

We only give a proof for check matrices of even row weight. The proof for odd row weight case is completely analogous.

Consider a random $m$-by-${n_{\text{\rm outer}}}$ parity check matrix $M$. Let $\tilde{d}={n_{\text{\rm outer}}}-1$. Choose each row independently but with the constraint that it should be of even weight. For any vector $v$ with $|v|\leq\tilde{d}$, the syndrome vector $Mv$ has independent entries from the uniform distribution. Thus, the probability that $|Mv|\leq s$ for $s\leq m/2$ is bounded by

[TABLE]

where $H(p)=-p\log_{2}(p)-(1-p)\log_{2}(1-p)$ is the binary entropy function, and ${\cal O}^{*}$ hides polynomial factors. The number of such vectors $v$ is bounded by $2^{{n_{\text{\rm outer}}}}$. By a union bound, the probability that there is an error vector $v$ of weight less than $\tilde{d}$ such that the syndrome has weight less than $s$ is bounded by

[TABLE]

For sufficiently large ratio $m/{n_{\text{\rm outer}}}$ and sufficiently small ratio $s/m$, this quantity is exponentially small in ${n_{\text{\rm outer}}}$. ∎

The above randomized construction is very similar to randomized constructions of classical codes with good rate and distance, where we define

Definition 4.13**.**

A family of classical error correcting codes with increasing number of bits $n$ has good rate if the number of encoded bits $k$ is $\Theta(n)$ and has good distance if the distance $d$ is $\Theta(n)$.

That is, even though we are considering very different properties (number of violated checks rather than distance of the code), the first moment argument above is very similar to standard first moment arguments to construct such codes with good rate and distance, with some additional technicalities required to ensure even weight of the parity checks. This is not a coincidence. As we now show, given a family of codes with good rate and distance, one can construct a family of codes with good check rate and sensitivity.

Lemma 4.14**.**

Let $C$ be a classical error correcting code that encodes $k$ bit messages into $n$ bit codewords. Let $C$ have distance $d$. Let $v_{1},\ldots,v_{k}$ be a basis for the codewords of $C$. Let $M$ be the $n$-by-$(k+1)$ matrix whose columns are the vectors $v_{1},\ldots,v_{k},w$ where $w=v_{1}+\ldots+v_{k}$. Then, all rows of $M$ have even weight and $M$ is a parity check matrix for a code with ${n_{\text{\rm outer}}}=k+1$ bits which is $(\tilde{d},s)$ sensitive with $s=d$ and $\tilde{d}={n_{\text{\rm outer}}}-1$. Thus, the code with parity checks encoded by $M$ has only two codewords (the all [math] vector and the all $1$ vector) and any message which is not a codeword will violate at least $d$ checks.

Proof.

For any $(k+1)$-bit vector $v$, the vector $Mv$ is a codeword of $C$. If $v$ is nonzero and is not equal to the all $1$ vector, then $Mv$ is a nonzero codeword of $C$ and hence has weight at least $d$. ∎

Since ${n_{\text{\rm outer}}}=k+1$, in order to obtain an even ${n_{\text{\rm outer}}}$, if $C$ has $k$ even, we can simply define a new code $C^{\prime}$ which encodes $k-1$ bit messages into $n$ bit codewords by using any $(k-1)$-dimensional subspace of the codewords of $C$, in this way obtaining a parity check matrix for a code with ${n_{\text{\rm outer}}}=k-1+1=k$.

Using lemma 4.14, we can construct explicit families of codes with good check rate and good sensitivity given any explicit family of codes with good rate and good distance. As an example of such a code family, we can use the expander codes of Ref. [39].

Lemma 4.15**.**

Given integers $\tilde{d},w\geq 1$ and $s\geq 2$, there exists an $m\times{n_{\text{\rm outer}}}$ parity check matrix $M$ that is $(\tilde{d},s)$-sensitive where $m={n_{\text{\rm outer}}}\cdot s/w$ and every row of $M$ has weight $w$ exactly.

Proof.

A parity check matrix $M$ defines a bipartite graph $G$, often called a Tanner graph. One set of vertices of the graph (which we call $B$ labeled by the columns of $M$) corresponds to bits of the code and the other set (which we call $C$ labeled by the rows of $M$) corresponds to checks, with an edge between a pair of vertices if $M$ is nonzero in the corresponding entry. Equivalently, given such a bipartite graph $G$, this defines a parity check matrix. We claim that given a bipartite graph with all vertices in $B$ having degree $s$ and all vertices in $C$ having degree $w$ and with girth $>2\tilde{d}$, the corresponding parity check matrix defines a code with the desired properties. Once we have shown this, the lemma follows, since Ref. [40] shows the existence of such graphs.

Note first that the degree of vertices in $C$ corresponds to the row weight of $M$. Next, note that if all vertices in $C$ have degree $w$ and all in $B$ have degree $s$, then $m=|C|={n_{\text{\rm outer}}}\frac{s}{w}$ with ${n_{\text{\rm outer}}}=|B|$.

To prove the claim, let $V\subseteq B$ be a nonempty set of erroneous bits. By assumption, $1\leq|V|\leq\tilde{d}$. Consider a subgraph $H$ of $G$ defined by all vertices of $V$ and its neighbors. By the girth condition on $G$, the subgraph $H$ has to be a collection of disjoint trees. Thus, it suffices to prove the claim in case where $H$ is connected. If $|V|=1$, then the error violates $s$ checks, and we are done. If $|V|\geq 2$, let $v_{1},v_{2}\in V$ be a pair that are the furthest apart. The choice of the pair ensures that each of $v_{1}$ and $v_{2}$ has $s-1$ leaves attached to it. Therefore, $V$ violates at least $2s-2\geq s$ checks. ∎

Note that the ratio $m/{n_{\text{\rm outer}}}=s/w$ in lemma 4.15 is the best possible, because each bit must participate in at least $s$ checks (i.e., every column of the parity check matrix must have weight at least $s$). Note also that though the existence of desired graphs is guaranteed, they might be too large in practice; $w^{s}\leq{n_{\text{\rm outer}}}\leq\mathrm{poly}(w^{s})$ [40]. However, one does not have to be too strict on the biregularity of the graph in practice. If small violation of the biregularity gives a much smaller graph, then it might be more useful.

5 Numerical Simulation

In this section, we give results of numerical simulations. We begin by explaining the error model we used for simulations. We then explain two protocols that we simulate that are not explained previously; one of these protocols uses a $[[21,3,5]]$ code. Then we give the simulation results. One interesting result of the simulation is how little effect the subleading terms have, even at fairly large noise values.

5.1 Magic state fidelity

When we inject a magic state $\mu$ for a $\pi/4$ rotation into a quantum circuit, there is a probability for correction $K$ by angle $\pi/2$ to be applied. If we represent the overall procedure by a quantum channel $\mathcal{C}_{\mu}$, it is $\mathcal{C}_{\mu}(\rho)=\Pi_{+}(\rho\otimes\mu)\Pi_{+}+K\Pi_{-}(\rho\otimes\mu)\Pi_{-}K^{\dagger}$, where $\Pi_{\pm}$ denotes the measurement combined with a control-Pauli on the magic state and a target data qubit. Let $\ket{\mu_{0}}$ be the ideal magic state, and $\ket{\mu_{0}^{\perp}}$ be the orthogonal state. Then, it is straightforward to calculate that $\mathcal{C}_{\ket{\mu_{0}}\bra{\mu_{0}^{\perp}}+\ket{\mu_{0}^{\perp}}\bra{\mu_{0}}}(\rho)=0$.

This implies that for any initial approximate magic state $\mu$, the result of the injection is the same as if $\mu$ had been through a twirling channel $\mathcal{E}$ that dephases the magic state in the basis $\{\ket{\mu_{0}},\ket{\mu_{0}^{\perp}}\}$:

[TABLE]

The twirled state is $\epsilon$ away from the ideal state in the trace distance,777The trace distance is defined as $T(\rho,\sigma)=\frac{1}{2}\|\rho-\sigma\|_{1}$. resulting in error at most $\epsilon$ to the quantum circuit’s outcome. The error $\epsilon$ can be expressed by the squared fidelity888The fidelity is defined as $F(\rho,\sigma)=\|\sqrt{\rho}\sqrt{\sigma}\|_{1}$, which is equal to $|\braket{\rho}{\sigma}|$ for pure $\rho$ and $\sigma$. as

[TABLE]

This formula is convenient in that it yields the same answer regardless of whether or not twirling is applied to $\mu$ (this is the last equality in the above formula). When a state $\mu_{n}$ that approximates $\mu_{0}^{\otimes n}$ is injected, the error from this multi-qubit magic state is given by $1-F^{2}(\mu_{0}^{\otimes n},\mu_{n})$. Note that $F^{2}(\mu_{0},\mu)$ is linear in $\mu$. Below, we use $1-F^{2}$ as the probability of error to report our simulation results.

5.2 Error Models

The typical model to analyze distillation protocols is the stochastic error model. In typical distillation protocols, one has only a single output magic state, and so one is interested in the probability that the output magic state has an error as a function of the input, conditioned on no error being detected by the code; the error probability is a ratio of polynomials in $\epsilon$, with the leading term being of order $\epsilon^{d}$ for some $d$, with an integer coefficient.

For our purposes, since the codes used are fairly large, enumeration of all possible error patterns becomes difficult, especially if one wishes to go beyond leading order in $\epsilon$. For this reason, we use numerical simulation. One could simulate a mixed state, using a quantum channel to describe an approximate $T$-gate; however, this is numerically prohibitive and so we prefer to use an approach that involves only pure states. One could numerically simulate pure states using the stochastic error model by choosing errors to occur with probability $p$, and sampling the output error probability. However, this simulation also becomes difficult, precisely because the codes lead to a high suppression in the error. For example, if the target error probability is $10^{-10}$, one would require $\sim 10^{10}$ samples, with a fairly large number of qubits needed to be simulated in each run, to determine the output error probability accurately.

While there may be ways to overcome this sampling issue using importance sampling, we use another method. Instead of rotating by either $\pi/4$ or by $5\pi/4$ as in the stochastic error model, each $T$ gate rotates by an angle chosen uniformly in the interval $[\pi/4-\theta,\pi/4+\theta]$, for some angle $\theta>0$. Then, conditioned on the code not detecting an error, we determine the error in the output state.

In fact, the model with input angles $[\pi/4-\theta,\pi/4+\theta]$ and the stochastic error model describe the same average input state, assuming an appropriate choice of $\epsilon$ and $\theta$.

[TABLE]

Hence, one wants $\epsilon\approx\theta^{2}/12$. (We emphasize that this is in a notation where $\theta$ is the rotation angle in the Bloch sphere; the $T$-gate is a rotation by $\pi/4$, not by $\pi/8$.) In the stochastic error model with small $\epsilon$, one must do roughly $1/\epsilon$ runs to obtain meaningful statistics, while here, one needs only a constant number of runs. The reason is as follows. Since $\theta$ is small, the simulated circuit can be approximated by an analytic series in $\theta$, and the linear term amounts to a single error, which is projected out by the post-selection on measurement outcomes as our protocol always has $d\geq 2$. Thus, in our post-selected simulation, a circuit with $\rho_{x\in[-\theta,\theta]}$ is equivalent at leading order to a circuit with $\rho^{\prime}_{x}$ where $\rho^{\prime}_{x}$ is $\rho_{x}$ with the linear term in $x$ dropped. Then, the distance from $n$-sample average of $\rho^{\prime}_{x}$ to $\mu$ is $O(\epsilon/\sqrt{n})$, whereas the distance from $n$-sample average of $\mu_{i}$ ($i=0,1$) to $\mu$ is $O(\sqrt{\epsilon/n})$. The acceptance probability depends on the fidelity to the ideal magic state $\mu_{0}$, which is $1-O(\epsilon)=1-O(\theta^{2})$ in any case.

5.3 Other Protocols

5.3.1 $[[16,2,4]]$ Inner Code

In subsubsection 1.2.2 we explained a protocol using a $[[16,6,4]]$ inner code. This required using a total of $17$ physical qubits, namely $16$ for the code and one ancilla. We can also modify this inner code to a $[[16,2,4]]$ inner code, by turning some of the logical operators into checks. This inner code suffices to implement the $H$-measurements on pairs of states $(23),(45),(61)$ and so it can implement the checks of the outer code used in subsubsection 1.2.2. Using a $[[16,2,4]]$ inner code, if we want to have ${n_{\text{\rm outer}}}=6$, we need a total of $21$ physical qubits, since we need $16$ for the code, plus $4$ for the logical qubits not encoded in the code, plus one ancilla. Thus, this requires additional physical qubits compared to the $[[16,6,4]]$ code. The reason for considering the $[[16,2,4]]$ code in numerics is to see if it reduces the prefactor in the error, since the $[[16,2,4]]$ code has fewer logical operators than the $[[16,6,4]]$ code. The number of $T$ gates in the protocol using $[[16,2,4]]$ is the same as that using $[[16,6,4]]$. We pipeline the protocol with the $[[16,2,4]]$ inner code in the same way as we did with the $[[16,6,4]]$ inner code. See Fig. B.3 in Appendix B.

5.3.2 $[[21,3,5]]$ Inner Code

Another inner code that we used is a $[[21,3,5]]$ inner code, described in Appendix A. This allows us to obtain fifth order reduction in error. We used ${n_{\text{\rm outer}}}=4$ with the outer code having check matrix

[TABLE]

It uses $4$ checks for $4$ qubits. This matrix is not $(4,2)$-sensitive, but is sufficient to achieve fifth order reduction in error since $2|Mv|+|v|\geq 5$ for every nonzero $v$. This protocol consumes $4+4\times(21\times 2)=172$ $T$’s to produce $4$ outputs $T$ states. See Fig. B.4 in Appendix B.

A simple pipelining can reduce the noisy $T$ gate count compared to this protocol. Distill three independent magic states using $[[7,1,3]]$ inner code. (The outer code is trivial in this case.) The three distilled magic states is then pipelined into the $[[21,3,5]]$ inner code. This produces 3 magic states with error $O(\epsilon^{5})$, consuming, per output, $28$ $T$ gates and one $T$ state with error $\epsilon$.

Without the pipelining in the preceding paragraph, but using weight $3$ checks from $[[21,3,5]]$, we can find an outer code that is $(4,2)$ sensitive using $(2/3){n_{\text{\rm outer}}}$ checks. This produces ${n_{\text{\rm outer}}}$ magic states with fifth order error suppression, consuming $42\cdot 2/3=28$ $T$ gates and one $T$ state, per output. The smallest such outer code is explained in the appendix, where it is called the Petersen graph code. For this outer code, ${n_{\text{\rm outer}}}=15$, so the overall protocol consumes $435$ $T$’s to produce $15$ outputs. It is possible to further reduce the number of input $T$’s, by replacing some of the early checks with a smaller code e.g. $[[15,7,3]]$ code, which can be obtained by puncturing $[[16,6,4]]$ code.

5.3.3 $[[23,1,7]]$ Inner Code

In the appendix, we give a $[[23,1,7]]$ inner code. Pipelining this code with a $[[7,1,3]]$ and a $[[17,1,5]]$ inner code gives us ${n_{\text{\rm outer}}}=1$ with error $O(\epsilon^{7})$. This protocol consumes $1+7\times 2+17\times 2+23\times 2=95$ $T$’s, to produce 1 output magic state. We could also apply this code to each of the output bits of any of the other fifth order protocols of section 5.3.2 to obtain error $O(\epsilon^{7})$; we do not show results for this here.

5.4 Results

The results of the simulations are shown in Fig. 5.1. Note that the plots are close to linear on a log-log plot, with only small deviations at high error rate. Each data point represents the average of at least $10^{4}$ runs, with statistical flucutations negligible on the scale of the plot. The asymptotic behavior is within statistical error of that given by an enumeration of minimum weight error patterns.

The protocol using $[[16,2,4]]$ inner code has a slightly reduced output error, compared to the protocol using the $[[16,6,4]]$ inner code.

We emphasize that $\epsilon_{out}$ indicates the probability that there is any error in the output state which is a multi-qubit state. Suppose that two protocols give the same value of $\epsilon_{out}$ for a given $\epsilon_{in}$, but one protocol has a large ${n_{\text{\rm outer}}}$. If the total number of magic states needed in our computation is large compared to ${n_{\text{\rm outer}}}$, the number of times we need to call the protocol is inversely proportional to ${n_{\text{\rm outer}}}$, and so the protocol with the larger ${n_{\text{\rm outer}}}$ for the given $\epsilon_{out}$ is less likely to produce an error.

The probability that no error is detected by the protocol is roughly $(1-\epsilon_{in})^{n_{T}}$. This result would be exact if any error in an input $T$ gate led to the protocol detecting an error. Instead, some high weight error patterns do not lead to any error detected by the code, leading to slight corrections to this formula.

6 Discussion

We have given a general scheme to construct distillation protocols using inner and outer codes. If desired, our protocols can be concatenated with other protocols. However, on their own, they achieve asymptotic behavior which is conjectured to be optimal, as well as having small size examples which perform well. The concatenation can be useful in an architecture where Clifford gates are performed at a logical level so that one can tune the fidelity of Clifford gates to match the relatively low fidelity of output magic states from early stages of concatenation [41, 42, 43]. In contrast, our schemes without concatenation can be useful if Clifford gates are already of high fidelity.

One of the major advantages of our protocols is the small number of qubits that they use, as they maintain a constant ratio of physical to logical qubits in the asymptotic limit. It is interesting to consider the asymptotics of this overhead between physical and logical qubits. Note that given any distillation protocol, there is a trivial way to define a new protocol with a fixed ratio of physical to logical qubits. Suppose, for example, that some protocol uses $n_{\text{\rm phys}}$ qubits to produce $1$ output magic state. Here $n_{\text{\rm phys}}$ includes all physical qubits used in the protocol, not only initial noisy $T$ states. Call this protocol $P$. One can define a new protocol $P^{\prime}$ that works on $2n_{\text{\rm phys}}$ qubits to produce $n_{\text{\rm phys}}$ output magic states: First, by working on $n_{\text{\rm phys}}$ qubits, leaving other $n_{\text{\rm phys}}$ inactive, we obtain $1$ output, which is put away. Next, we use $n_{\text{\rm phys}}$ qubits out of $2n_{\text{\rm phys}}-1$ qubits to obtain the second output, which is put away. Next, we use $n_{\text{\rm phys}}$ qubits out of $2n_{\text{\rm phys}}-2$ qubits to obtain the third output, which is put away. Continuing, we apply $P$ a total of $n_{\text{\rm phys}}$ times sequentially. However, the circuit depth of $P^{\prime}$ now is proportional to $n_{\text{\rm phys}}$ times the depth of $P$.

In contrast, in Theorem 4.1, we obtain $d$-th order error reduction at fixed ratio of physical to logical with a $T$-gate depth proportional to $d$. That is, the protocols we have constructed are space and time efficient in terms of $T$-gates. It should be noted that we have ignored all Clifford gates, and thus the $T$-efficiency claim is meaningful when $T$-gates are much more costly than Clifford gates.

Including Clifford gates, the entire circuit of Theorem 4.1 has depth $O(d^{2}\log d)$ if geometric locality of the gate is ignored. Indeed, an $n$-qubit stabilizer code’s encoding circuit can be constructed in depth $O(n\log n)$. It is essentially Gauss elimination of a binary symplectic matrix. The Gauss elimination for a single column can be done by a circuit of depth $O(\log n)$, and hence the entire Gauss elimination can be done by a circuit of depth $O(n\log n)$. Since we are using a good family of codes, the circuit depth of an encoding circuit is $O(d\log d)$, and there are $O(d)$ encoding/decoding steps. The total gate count (spacetime) per output is $O(d^{2}\log d)$.

Jones [13] constructed a family of protocols giving $\gamma\rightarrow 1$. (For the definition of $\gamma$, see the discussion below Theorem 4.1.) This protocol builds upon Knill’s [8], and is in fact a subclass of ours. Implicitly in Ref. [13], the inner code is obtained by concatenating a $[[k+4,k,2]]$ code $\nu$ times where $k$ is even, yielding $[[k^{\nu}+4(k^{\nu}-1)/(k-1),k^{\nu},2^{\nu}]]$ normal weakly self-dual codes. (For the definition of normal and hyperbolic codes, see 3.) The outer code is a hypercubic grid with checks along coordinate axes. The dimension of the grid is proportional to $\nu\cdot 2^{\nu}$, since a check using an inner code of distance $2^{\nu}$ has to be implemented $2^{\nu-1}$ times along $2^{\nu-1}$ independent axes, and the concatenation for the inner codes is also performed on a grid. For a given $\nu$, in the large $k$ limit, one obtains a protocol that consumes $2^{\nu}+1=d+1$ noisy $T$ gates per output at $d$-th order of reduction in error. The asymptotic performance of this family is similar to our Theorem 4.2. If we worked with normal codes of even distance in Theorem 4.2, then we would have concluded that the input $T$ count per output is $d+1$. Note that the space requirement of Jones’ scheme is much larger than that of Theorem 4.1, as the grid outer code used by Jones would require roughly $k^{\nu 2^{\nu}}=k^{O(d)}$ qubits. This exponential dependence on $d$ also holds for the protocols in the proof of Theorem 4.2. In contrast, Theorem 4.1 requires only $O(d)$ qubits.

In comparison with Jones’ scheme, our main technical contribution is to explicitly separate inner and outer codes with general criteria for them to be useful in distillation. The criteria are that inner codes have to be weakly self-dual, and outer codes have to be sensitive (i.e., the parity check matrix $M$ should satisfy $2|Mv|+|v|\geq d$ for any nonzero error vector $v$). These requirements are rather simple, so we were able to consider random constructions for them. In fact, a large pool of existing codes can be incorporated. In particular, we note that there are quantum BCH codes [44], some of which have encoding rate greater than $1/2$ with code distances 5 and 7 at modest code lengths.

For Theorem 4.2 we have resorted to a graph theoretic construction of outer codes from Ref. [40]. This is sufficient for the proof, but one may wish to have more concrete examples. In fact, a hypercubic grid of dimension $D\geq 3$ yields an outer code of desired sensitivity for $d=2D+1$, which will be analyzed in detail elsewhere [45].

Appendix A Specific Small Inner and Outer Codes

In this appendix, we give some specific inner and outer codes, either giving the stabilizers or referring to the literature. Some of these codes are explained in the basic distillation section 1 or in numerical simulations 5 in the body of the paper. Other codes have other useful properties that we describe for specific codes.

When we give stabilizers for an inner code, each row gives one stabilizer generator. Each row consists of a binary string, of length equal to the number of qubits, with a $1$ indicating that that stabilizer acts on that qubit, i.e., we give the parity check matrix.

A.1 Inner Codes

A.1.1 $[[4,2,2]]$ Inner Code

This is explained in Section 1.

A.1.2 $[[16,6,4]]$ Inner Code

This is from Ref. [46]. The stabilizer matrix is the classical Hadamard code $[16,5,8]$.

[TABLE]

A.1.3 $[[7,1,3]]$ Inner Code

This is explained in Section 1.

A.1.4 $[[17,1,5]]$ Inner Code

This is an instance of color code [31, 21]. It is the smallest normal code that we found with ${k_{\text{\rm inner}}}=1$ and distance $5$. The stabilizers are:

[TABLE]

A.1.5 $[[21,3,5]]$ and $[[23,1,7]]$ Inner Codes

The (extended) Golay code is a classical self-dual code which has parameters $[24,12,8]$. Puncturing a bit by collecting all code words that has zero on that bit, we obtain a self-orthogonal $[23,11,7]$. From this, we obtain a weakly self-dual CSS code which is $[[23,1,7]]$. (Reichardt has used this code in a very different distillation protocol [29].) There are many positions to puncture, but due to high symmetry of the Golay code, the resulting codes have the same weight enumerators. One can pipeline the $[[23,1,7]]$ code after the protocol of section 1.1.2 to give a protocol with one output magic state and seventh order suppression in error.

By puncturing the $[[23,1,7]]$ code twice, we obtain a $[[21,3,5]]$ code. In a numerical search, we did not find any smaller normal code with ${k_{\text{\rm inner}}}=3$ and distance $5$. The stabilizers of the $[[21,3,5]]$ code are:

[TABLE]

A.1.6 Other Inner Codes

Some other examples of inner codes can be found in Ref. [46], from which we reproduce optimal ${k_{\text{\rm inner}}}$ found for given distance and ${n_{\text{\rm inner}}}$ in Table A.1. For stabilizers, see Ref. [46].

A.2 Outer Codes

A.2.1 Petersen Graph Code

The outer code in section 5.3.2 has $4$ qubits uses $4$ checks of weight $3$. However, from Lemma 4.15, we know that there is some ${n_{\text{\rm outer}}}$ such that there is a code which is $(4,2)$ sensitive with weight-$3$ checks, which has only $(2/3){n_{\text{\rm outer}}}$ checks. We now explain this code. The proof of Lemma 4.15 reduces the problem of finding such a code to finding a bipartite graph $G$. Since the set $B$ of that lemma has degree $2$, we can equivalently define the code by a graph $H$ such that the vertices of the graph $H$ correspond to checks and the edges correspond to bits; i.e., in the case that $B$ has degree $2$, the possible bipartite graphs $G$ are in one-to-one correspondence with degree-$3$ graphs $H$. Then, from the proof of Lemma 4.15 we know that if $H$ has girth at least $5$, then the corresponding code is $(4,2)$ sensitive. The smallest such graph $H$ is known to be the Petersen graph. This is a degree-$3$ graph with $15$ vertices and $10$ edges. This graph can be thought of as the dodecahedron with antipodes identified. Note that the girth being 5 is optimal in this case, because if $H$ has girth $4$, then there is a weight $4$ error that violates no checks.

Appendix B Circuits

In this section we give circuits for some of the protocols above. Boxes labelled $Enc$ or $Enc^{\prime}$ denote encoding and decoding circuits, which are Cliffords. The number in the box indicates what code is used. $H$ denotes Haamard, $M$ denotes measurement in $Z$ basis, $JM_{x}$ denotes measurement in $X$ basis, $Czs$ denotes control-$Z$ operations.

Appendix C Coincidence among protocols

The Steane code has 7 $Y$-logical operators of weight 3. In the distillation protocol using the Steane code as the inner code, each logical error may appear in 4 different ways in the column that implements control-$H^{\otimes 7}$ [8]. The measurement error at the lowest order can happen in 7 ways. Overall, the cubic error can happen in $7\cdot 4+7=35$ ways. This number matches the number of logical operators of weight 3 in the Bravyi-Kitaev 15-to-1 protocol [10]. Reichardt [29] has noted this equivalence.

When we pipelined $[[7,1,3]]$ to $[[17,1,5]]$, there are 48 $T$ gates and 1 $T$ states. The number of logical operators of weight 5 in $[[17,1,5]]$ is 51. Each logical operator can appear in 16 different configurations in the column that implements control-$H^{\otimes 17}$. The measurement error from the 17-qubit code routine occurs in 17 ways at the leading order. Thus, the output error probability has leading term $(51\cdot 16+35\cdot 17)\epsilon^{5}=1411\epsilon^{5}$. The coefficient matches the number of $Z$-logical operators of weight 5 in the $[[49,1,5]]$ code, as reported in [12, App. B].

Bravyi and Cross [21] gave a recursive construction for triply even codes. They showed how to convert a pair of a (classical) triply even code of length $n_{t-1}$ with dual distance $2t-1$ and some (classical) self-orthogonal code of length $m_{t}$ with dual distance $2t+1$ into a triply even code of length $n_{t}=2m_{t}+n_{t-1}$ with dual distance $2t+1$. The formula gives another coincidence with our pipeline. $n_{t-1}$ is the number of $T$ gates/states, sitting before the final $H$-measurement routine in the pipeline, and $m_{t}$ is the code length of the final $H$-measurement routine. Thus, the recursive formula $n_{t}=2m_{t}+n_{t-1}$ correctly counts the number of $T$ gates/states used in the pipeline.

A similar coincidence was observed by Jones [13], where the leading error probabilities of the distillation protocols by a family of weakly self-dual $[[k+4,k,2]]$ codes with $(k,0)$-magic basis and those by a family of triorthogonal codes [12] are shown to be the same as $(3k+1)\epsilon^{2}$. The total number of $T$ gates/states were also the same as $3k+8$.

Appendix D Qudits

In this section, we consider an extension to qudits with local Hilbert space dimension $p>2$, with $p$ a prime. Previously, Reed-Muller codes over prime fields were used [47, 48], but our approach is more efficient. In terms of the scaling exponent $\gamma$ (see Sec. 4), previous schemes for a fixed $p$ did not achieve $\gamma\to 1$, whereas our protocols below will.999 In Ref. [48], it is shown that $\gamma$ can be arbitrary close to $1$ in the limit of large $p$.

Specifically, we consider outer codes defined by binary parity check matrices $M$ that are sensitive enough. Those from biregular bipartite graph can be used. The parity check matrices being binary is for technical simplicity, and is not conceptually crucial ingredient, though relaxing this condition might involve complicated calculation. The main difference from the qubit protocols is in inner codes. We only consider analogs of normal codes, where transversal $S$ gates become logical $S$ gates. We show that measurement in the eigenbasis of $SX$ can be implemented fault-tolerantly on an inner code of parameters $[[{n_{\text{\rm inner}}},{k_{\text{\rm inner}}},d]]_{p}$ using $4{n_{\text{\rm inner}}}$ $T$ gates if $p>3$, or $2{n_{\text{\rm inner}}}$ $T$ gates if $p=3$. Therefore, the Lemma 4.4 generalizes to odd prime dimensional qudits, where input $T$ count is ${n_{\text{\rm outer}}}+4{n_{\text{\rm inner}}}m$ if $p>3$ where $m$ is the number of checks in the outer code, or ${n_{\text{\rm outer}}}+2{n_{\text{\rm inner}}}m$ if $p=3$. We complement the construction in this section with a probabilistic existence proof for a good family of inner codes in the sense of Section 4; see Lemma E.4 and combine it with the proof of Lemma 4.10. We also point out that quantum Reed-Muller code gives a family whose encoding rate approaches 1 for a given distance. Hence, the statement of Theorem 4.1 remains unchanged in either case where $p=3$ or $p>3$, but that of Theorem 4.2 for $p>3$ becomes that, for odd $d\geq 5$ the number of input magic states per output approaches $1+4(d-1)/2=2d-1$ in the large code length limit. The input $T$ count per output is still $d(1+o(1))$ if $p=3$. If one wishes to improve the asymptotic input count for $p>3$, then one has to solve an equation analogous to (D.19).

Consider a basis of states $\ket{j}$, where $j=0,1,\ldots,p-1$ is periodic mod $p$. We use the following operators and phase factor

[TABLE]

which generate the Clifford group. It holds that $ZX=\omega XZ$.

We will work with a generalization of normal codes throughout this section, ignoring hyperbolic codes. One reason is that we cannot achieve control-Swap in the same way as we could previously. The general method in the qubit case was to use some non-Clifford operation such as a $T$ gate, conjugating controlled Pauli to obtain control-Swap on the code space of some code. However, Swap is of order 2 while control-$Z$ is of order $p$. One might hope to obtain a control-permutation of order $p$, but we do not consider this possibility. For normal codes, we do not try to implement the control-Hadamard as was done before, because Hadamard is of order $4$ for $p>2$, and hence is not conjugate to control-$Z$.

D.1 Preliminary

Let us first define a $T$-gate [47]. The cases $p=3$ and $p>3$ are going to be different. Define

[TABLE]

where the second line is because $6$ is invertible in $\mathbb{F}_{p>3}$, and ensures that $g$ is a well defined function on $\mathbb{F}_{p>3}$. All arithmetic in the exponent of $\omega$, $Z$, $X$, and $S$ will be over $\mathbb{F}_{p}$ for both $p=3$ and $p>3$. Define the $T$-gate as

[TABLE]

These show that in both cases the $T$ gate is at the third level of the generalized Clifford hierarchy. More generally, we find

[TABLE]

For both $p=3$ and $p>3$, define $\ket{\psi_{m}}$ for $m=0,1,\ldots,p-1$ be the $(+1)$-eigenstate of $T^{m}XT^{-m}$:

[TABLE]

Any state $\ket{\psi_{m}}$ for $m=1,\ldots,p-1$ will be a “magic state.”

How would one use these magic states? Suppose $p>3$. Consider a pair of qudits in a state $\sum_{j}a_{j}\ket{j}\otimes\ket{\psi_{m}}$. Apply a control-$X$ operation with the first qudit as source and the second qudit as target. This maps the state to

[TABLE]

Now measure the second qudit in the computational basis, obtaining a result $\ell$. This gives a state on the first qudit $\sum_{j}a_{j}\omega^{mg(\ell-j)}\ket{j}$. Thus, the transformation implemented on the first qudit is $\sum_{j}\omega^{mg(\ell-j)}\ket{j}\bra{j}$. Expanding the exponent, we have

[TABLE]

The first term on the right-hand side of Eq. (D.9) corresponds to an irrelevant global phase factor. The second term, $-mg(j)$, corresponding to implementing transformation $T^{-m}$ on the first qudit. The third term gives a phase factor that can be corrected by applying a power of the $S$ gate and the last term gives phase factors that can be corrected by a power of the $Z$ gate. Thus, the state injection procedure works, in that we can use a magic state $\ket{\psi_{m}}$ to produce a transformation $T^{-m}$ up to Clifford corrections.

When $p=3$, we use the same state injection, with $m=1$. One finds after some calculation that if the measurement outcome is $\ell=0$, the implemented operations is $T^{-1}$ to the source, if $\ell=1$, it is $e^{-2\pi i/9}ST^{-1}$, and if $\ell=2$, it is $e^{2\pi i/9}Z^{-1}S^{-1}T^{-1}$. Thus, in all cases, the implemented operation is $T^{-1}$ up to a Clifford correction.

The injected $T$ gates together with Cliffords form a universal gate set [47, App. D]. This is a corollary of [49, Thm. 7.3] that says the Clifford group is a maximal finite subgroup of $U(p^{n})$ up to global phase factors, and [50, Cor. 6.8.2] that says any infinite subgroup (even after quotienting out phase factors) containing the Clifford group is dense in $U(p^{n})$.

Note that $T^{m}$ and $T^{-m}$ are interconvertible by Cliffords. More generally, it is possible to use Clifford operations to convert a gate $T^{m}$ into another gate $T^{m^{\prime}}$ with $m^{\prime}=mn^{3}$ for $n\neq 0$, by $U=U(n)=\sum_{j}\ket{nj}\bra{j}$ gate. For $p>3$, we have $U^{\dagger}T^{m}U=\sum_{j}\omega^{mg(nj)}\ket{j}\bra{j}$ where

[TABLE]

Thus $U^{\dagger}T^{m}U=T^{mn^{3}}Z^{m\frac{n^{3}-n}{6}}$, and so indeed $T^{m}=C_{1}T^{m^{\prime}}C_{2}$ for some Cliffords $C_{1},C_{2}$. For $p=3$, we see $T=U(-1)T^{-1}U(-1)$. Now, for which pairs $m,m^{\prime}$ can we find an $n$ such that $m^{\prime}=mn^{3}$? The multiplicative group $\mathbb{F}_{p}^{\times}$ is cyclic of order $p-1$. Therefore, when $p-1$ is not a multiple of $3$, then $\mathbb{F}_{p}^{\times}\ni n\mapsto n^{3}\in\mathbb{F}_{p}^{\times}$ is a bijection, and any $T^{m}$ can be interconverted into any other $T^{m^{\prime}}$. If $p-1$ is a multiple of $3$, there are three distinct classes of $T$ gates. Since $-1=(-1)^{3}$, $T^{m}$ and $T^{-m}$ are always interconvertible.

D.2 Inner codes

For arbitrary vector $v\in\mathbb{F}_{p}^{{n_{\text{\rm inner}}}}$ we write $X(v)=X^{v_{1}}\otimes\cdots\otimes X^{v_{n_{\text{\rm inner}}}}$, and $Z(v)=Z^{v_{1}}\otimes\cdots\otimes Z^{v_{n_{\text{\rm inner}}}}$. As in the weakly self-dual CSS code construction for qubits, it is straightforward to define a stabilizer code starting from a self-orthogonal subspace $\mathcal{S}\subset\mathcal{S}^{\perp}\subset\mathbb{F}_{p}^{{n_{\text{\rm inner}}}}$: The stabilizer group is generated by $X(v)$ and $Z(v)$ where $v\in\mathcal{S}$. The quotient space $\mathcal{S}^{\perp}/\mathcal{S}$ is in one-to-one correspondence with the set of $X$-type ($Z$-type) logical operators, and the induced dot product on $\mathcal{S}^{\perp}/\mathcal{S}$ is non-degenerate. In Section E below, we show that there is a basis $\{v^{(1)},\ldots,v^{({k_{\text{\rm inner}}})}\}$ of $\mathcal{S}^{\perp}/\mathcal{S}$ such that $v^{(i)}\cdot v^{(j)}=\alpha_{j}\delta_{ij}$ where the scalars $\alpha_{j}$ are all $1$ possibly except the last one. For simplicity we restrict ourselves to cases where

[TABLE]

i.e., the second condition is that all scalars $\alpha_{j}$ are equal to $1$. The first condition demands that ${n_{\text{\rm inner}}}$ to be a multiple of $p$. The second is a mild restriction, since $(\mathcal{S}\oplus\mathcal{S})^{\perp}/(\mathcal{S}\oplus\mathcal{S})$ always has a basis such that (D.12) holds. Given a basis $\{v^{(j)}\}$ satisfying (D.12), we define logical operators of the inner code as

[TABLE]

which indeed obey the commutation relation

[TABLE]

of the generalized Pauli operators on ${k_{\text{\rm inner}}}$ qudits. Thus, this is a generalization of the normal codes in the qubit case. Due to (D.11), the transversal gate $\bar{S}=S^{\otimes{n_{\text{\rm inner}}}}$ is a logical operator:

[TABLE]

where in the second equation the phase factor vanishes when $v\in\mathcal{S}$.

We will implement the measurement of the stabilizer $T^{m}XT^{-m}$ of the magic state $\ket{\psi_{m}}$ using the inner codes. The measurement becomes feasible if ${}^{C}(T^{m}XT^{-m})$ can be implemented for logical qudits. We begin searching for its fault-tolerant implementation by observing an identity ${}^{C}(T^{m}XT^{-m})=T^{m}(^{C}X)T^{-m}$ that enables us to implement some controlled Clifford on logical qudits. The actual action on logical qubits depends on the inner code, but our conditions (D.11, D.12) will make it uniform across all logical qudits.

Recall $T^{m}XT^{-m}=\eta^{-1}S^{m}X$ where $\eta=1$ if $p>3$ and $\eta=e^{2\pi i/9}$ if $p=3$. The action of the transversal gate $\bar{T}^{m}\bar{X}\bar{T}^{-m}$ can be deduced by looking at the logical operators and phase. The answer is

[TABLE]

because

[TABLE]

Suppose $p>3$. In order to implement ${}^{C}(\tilde{S}^{m}\tilde{X})$, we consider an equation and a solution

[TABLE]

where the control is common for every gate, and $u,x,y,z,s,t$ are variables. (Using ${}^{C}A=\sum_{j}\ket{j}\bra{j}\otimes A^{j}$, one can evaluate matrix elements on both sides.) Note that the operators in the brackets are powers of ${}^{C}(S^{m}Z^{m/2})$. This implies that indeed simultaneous ${}^{C}(\tilde{S}^{m}\tilde{X})$ on all logical qudits can be implemented using $\bar{T}^{m}(^{C}\bar{X}^{3m/4})\bar{T}^{-m}$, $\bar{T}^{m}(^{C}\bar{X}^{m/4})\bar{T}^{-m}$, controlled Pauli logical operators, and a power of $Z$ on the control.

When $p=3$ it suffices to consider $m=1$. To remove the phase factor $\eta^{{k_{\text{\rm inner}}}-{n_{\text{\rm inner}}}}$ we require that the ${k_{\text{\rm inner}}}$ is a multiple of 3. This can be achieved by considering three copies of a given code if necessary. ${n_{\text{\rm inner}}}$ is already a multiple of $3$ due to (D.11). We can implement $\prod_{a=1}^{k_{\text{\rm inner}}}\leavevmode\nobreak\ {}^{C}(\eta^{-1}\tilde{S}^{(a)}\tilde{X}^{(a)})$ by an identity

[TABLE]

We have shown that it is possible to build a fault-tolerant routine to measure $\tilde{T}^{m}\tilde{X}\tilde{T}^{-m}$.

We have not yet shown how to construct such inner codes. It is possible to generalize Lemma 4.9 to the case of matrices over a field $\mathbb{F}_{p}$ for $p>2$; however, the generalization is more difficult since the self-orthogonality constraint implies a nonlinear constraint on the rows of the matrix so that each row is null; see Lemma E.4. Let us give an alternative construction which achieves the scaling similar to Lemma 4.11, namely that for any distance $d$, one can find a family of normal weakly self-dual qudit CSS codes with $X(\vec{1})$ in the stabilizer group such that the ratio ${k_{\text{\rm inner}}}/{n_{\text{\rm inner}}}\rightarrow 1$ as ${n_{\text{\rm inner}}}\rightarrow\infty$. This construction is derived from Reed-Muller codes. Let $C=RM_{\mathbb{F}_{p}}(r,m)$ be a classical Reed-Muller code over $\mathbb{F}_{p}$; the codewords have length $p^{m}$. The dual code is $C^{\perp}=RM_{\mathbb{F}_{p}}(m(p-1)-r-1,m)$; see Theorem 5.4.2 of Ref. [51]. For any fixed $r$, for large enough $m$, $C\subset C^{\perp}$, so the codespace of $C$ is self-orthogonal, and $\vec{1}$ is in the codespace of $C$. We use the codespace of $C$ as the space $\mathcal{S}$, and use the CSS construction to define a weakly self-dual code. For fixed $r$, the rate of $C$ tends to zero at large $m$, so the rate of the resulting weakly self-dual tends to $1$. See Ref. [52] for weakly self-dual qubit codes derived from Reed-Muller codes. To make (D.12) hold, it may be necessary to use $\mathcal{S}\oplus\mathcal{S}$ instead of $\mathcal{S}$.

D.3 Outer codes

If the inner code has code distance $d$, then we should use an outer code with a parity check matrix that is $(d-1,\lceil\frac{d-1}{2}\rceil)$-sensitive. In full generality, one would want to use a parity check matrix with entries in $\mathbb{F}_{p}$, where an entry $\beta\neq 0$ would mean a stabilizer $(\eta^{-1}S^{m}X)^{\beta}$. This makes it necessary to have a different logical operator choice than we have used above.

However, a check matrix that is given by the adjacency matrix of a biregular graph with large girth is sufficient for us. Such a check matrix has only 0 and 1 entries, so no other choice of logical operator is necessary beyond what we have given above. Recall that a graph with large girth is locally a tree. Hence, a bad magic state will be caught by many checks because it flips a single stabilizer in these checks, and the required sensitivity is guaranteed.

Appendix E Symmetric forms over finite fields

We have classified nondegenerate symmetric forms over the binary field $\mathbb{F}_{2}$ in Section 3. Over a field of odd characteristic, the set of all finite dimensional vector spaces with nondegenerate symmetric forms (quadratic spaces for short) constitute an abelian group under the direct sum, after identifying hyperbolic planes as the identity. This group is known as the Witt group of the field, and the group structure is well known. Here we present a self-contained and elementary treatment of the Witt group of $\mathbb{F}_{p}$, and classify the quadratic spaces over fields of odd characteristic. A square element, or a square for short, is any member of the set $\{x^{2}:x\in\mathbb{F}_{p}^{2}\}$.

It is natural to distinguish two cases depending on whether $-1\in\mathbb{F}_{p}$ is a square, since a one-dimensional quadratic space is classified by $\mathbb{F}_{p}^{\times}/(\mathbb{F}_{p}^{\times})^{2}$, where $\mathbb{F}_{p}^{\times}:=\mathbb{F}_{p}\setminus\{0\}$ and $(\mathbb{F}_{p}^{\times})^{2}:=\{x^{2}\leavevmode\nobreak\ |\leavevmode\nobreak\ x\in\mathbb{F}^{\times}\}$. Since the multiplicative group $\mathbb{F}_{p}^{\times}$ is a cyclic group of order $p-1$, the element $-1$ being the unique element of $\mathbb{F}^{\times}$ with multiplicative order 2, is a square if and only if $p=1\mod 4$.

The part of the argument in Section 3 applies here without any change where we have inductively converted any non-degenerate symmetric matrix to a direct sum of a diagonal matrix and blocks of $\begin{pmatrix}0&1\\ 1&0\end{pmatrix},$ which represents a hyperbolic plane. Below, we assume that symmetric matrices are block diagonal in this form. It is then easy to explain why quadratic spaces constitute a group:

[TABLE]

This means that the one-dimensional quadratic space with form $(-a)$ is the inverse of the space with form $(a)$. It is important here that $2$ is an invertible element of the field.

We note that the determinant of the symmetric form up to squares is a nontrivial invariant valued in the multiplicative group $\mathbb{F}_{p}^{\times}/(\mathbb{F}_{p}^{\times})^{2}$ which is isomorphic to the additive group $\mathbb{Z}/2\mathbb{Z}$. Let $\alpha\in\mathbb{F}_{p}$ be a non-square.

Case I: $p=1\mod 4$ so that $-1\in(\mathbb{F}_{p}^{\times})^{2}$. Consider a block ${\rm diag}(a,a)$ of the symmetric matrix. Since $-1$ is a square, we see ${\rm diag}(a,a)\simeq{\rm diag}(a,-a)\simeq{\rm diag}(1,-1)\simeq{\rm diag}(1,1)$ under congruent transformations. Therefore, there are four classes of symmetric matrices up to hyperbolic planes: ${\rm diag}(1)$, ${\rm diag}(\alpha)$, ${\rm diag}(1,\alpha)$, and ${\rm diag}(1,1)$. By looking at the determinant of the form and the parity of the dimension, we see that the four classes are distinct elements of the Witt group, which is hence isomorphic to $\mathbb{Z}/2\mathbb{Z}\oplus\mathbb{Z}/2\mathbb{Z}$. Given a dimension of quadratic spaces, we see there are only two exclusive possibilities:

[TABLE]

Case II: $p=3\mod 4$ so that $-1\notin(\mathbb{F}_{p}^{\times})^{2}$. In this case, we can set $\alpha=-1$. We claim that ${\rm diag}(1,1)$ is not hyperbolic. If $v=av_{1}+bv_{2}$ is a vector in this two-dimensional space, where $v_{1},v_{2}$ are basis vectors with $v_{i}^{2}=1$ and $a,b\in\mathbb{F}_{p}$, then $v\cdot v=a^{2}+b^{2}$. Since $-1$ is not a square, the equation $a^{2}+b^{2}=0$ does not have any nonzero solution, and this proves the claim. Next, we show that ${\rm diag}(1,1)\simeq{\rm diag}(-1,-1)$. To this end, we will find a solution to $a^{2}+b^{2}+1=0$ over $\mathbb{F}_{p}$. Once we have such a solution, then we see

[TABLE]

The existence of the solution follows from $(\mathbb{F}_{p}^{\times})^{2}+(\mathbb{F}_{p}^{\times})^{2}\not\subseteq(\mathbb{F}_{p}^{\times})^{2}$, which implies that $(\mathbb{F}_{p}^{\times})^{2}+(\mathbb{F}_{p}^{\times})^{2}\ni-1$. If $(\mathbb{F}_{p}^{\times})^{2}+(\mathbb{F}_{p}^{\times})^{2}\subseteq(\mathbb{F}_{p}^{\times})^{2}$, then $(\mathbb{F}_{p}^{\times})^{2}$ would be a monoid under addition contained in a finite group, and hence would be a group itself, which must contain $0\notin(\mathbb{F}_{p}^{\times})^{2}$. Therefore, quadratic spaces given a dimension are classified by the determinant of the form up to squares.

[TABLE]

The Witt group of $\mathbb{F}_{p}$ is isomorphic to $\mathbb{Z}/4\mathbb{Z}$ generated by ${\rm diag}(1)$.

Now we state and prove some facts about quadratic spaces.

Lemma E.1** (Chapter XV Theorem 10.2 of Ref. [53]).**

Let $Q$ be a nondegenerate quadratic space. If two subspaces $V$ and $U$ are isomorphic by an isometry $\sigma:V\to U$, then there exists an isometry $\bar{\sigma}:Q\to Q$ such that $\bar{\sigma}|_{V}=\sigma$.

Lemma E.2**.**

Let $N$ be a null subspace (on which the symmetric form vanishes) of a nondegenerate quadratic space $Q$ over $\mathbb{F}_{p}$. Then, $Q$ is isometric to the orthogonal sum of $N^{\perp}/N$ and a minimal hyperbolic subspace that contains $N$.

Proof.

Applying Lemma E.1 to the identity map $\sigma$, we conclude that any orthogonal set of vectors extends to an orthogonal basis. Since the form is nondegenerate, there exists a minimal hyperbolic subspace that includes $N$ (hyperbolic extension), and the symmetric form can be written as $\Lambda^{\prime}\oplus\lambda$. where $\lambda$ is hyperbolic, and $\Lambda^{\prime}$ is nondegenerate. It is then clear that $N^{\perp}/N$ has the symmetric form $\Lambda^{\prime}$. ∎

Lemma E.3**.**

Let $Q$ be a nondegenerate quadratic space of dimension $n$ over $\mathbb{F}_{p}$. Every maximal null subspace of $Q$ has the same dimension $m$. Given any null subspace $N$ of dimension $k\leq m$, the number of null vectors of $Q$ that are orthogonal to $N$ is

[TABLE]

Proof.

To prove the first claim, suppose $M,M^{\prime}$ are maximal null subspaces. If $\dim M\leq\dim M^{\prime}$, then any injection from $M$ to $M^{\prime}$ is an isometry, which can be extended to $Q$ as $\bar{\sigma}$. Then, $\bar{\sigma}^{-1}(M^{\prime})$ is a null superset of $M$, and hence is $M$ itself since $M$ is maximal. Thus, $\dim M=\dim M^{\prime}$.

Let $\mathcal{Z}(Q,N)$ be the set of all null vectors of $Q$ that are orthogonal to $N$. ($\mathcal{Z}$ is not a subspace in general.) Consider $\phi:\mathcal{Z}(Q,N)\to\mathcal{Z}(N^{\perp}/N,0)$, a restriction of the canonical projection map $Q\to Q/N$. The map $\phi$ is surjective by definition of $\zeta$. If $x,y\in\mathcal{Z}(Q,N)$ are mapped to the same element, then $x-y\in N$. This implies that $\phi$ maps exactly $\#N$ elements to one. (Here, $\#$ denotes the number of elements of the finite set.) Therefore,

[TABLE]

Due to the preceding lemma, the dimension of a maximal null subspace of $N^{\perp}/N$ is $m-k$. Thus, it remains only to prove the lemma when $k=0$ since

[TABLE]

A definite quadratic space is one in which $w\cdot w=0$ implies $w=0$.101010 A definite space corresponds to a nontrivial element of the Witt group. For example, a one-dimensional nondegenerate space is definite. If $\alpha$ is not a square, then the symmetric form ${\rm diag}(1,-\alpha)$ is definite.

To count all null vectors, we work in a basis such that the $n$-by-$n$ symmetric matrix is

[TABLE]

where $\Lambda^{\prime}$ definite, and $\Lambda_{2m}=\frac{1}{2}\begin{pmatrix}0&1\\ 1&0\end{pmatrix}\otimes I_{m}$ is an orthogonal sum of $m$ hyperbolic planes. In this basis, let us write any vector $x$ as $x^{\prime}\oplus(u,u^{\prime})$. The nullity is then expressed by a quadratic equation of coordinates

[TABLE]

The solutions of this equation are divided into two classes: $x^{\prime}\cdot x^{\prime}=0$ or $x^{\prime}\cdot x^{\prime}\neq 0$. In the former case, $x^{\prime}=0$ and $u\cdot u^{\prime}=0$. Given arbitrary $u$ there is $u^{\prime}$ such that this equation holds. The number of solutions is $p^{m}+(p^{m}-1)p^{m-1}$. In the latter case, we must have $u\neq 0$, and $u\cdot u^{\prime}=c=-x^{\prime}\cdot x^{\prime}\neq 0$ is a inhomogeneous equation in $u^{\prime}$, whose solution always exists. For any given nonzero $c$, there are thus $(p^{m}-1)p^{m-1}$ choices of $(u,u^{\prime})$. $x^{\prime}$ can be any nonzero vector, so there are $p^{n-2m}-1$ choices. In sum, the number of null vectors in an $n$-dimensional quadratic space $Q$ over $\mathbb{F}_{p}$ is

[TABLE]

∎

Lemma E.4**.**

Let $w_{1}=\vec{1}\in\mathbb{F}_{p}^{n}$ be the all-1 vector where $n$ is a multiple of $p\geq 3$. Assume $c<(n-2)/2$, and let $w_{2},\ldots,w_{c}$ be null vectors of $\mathbb{F}_{p}^{n}$ chosen inductively such that $w_{j}$ is chosen uniformly at random from $\mathcal{Z}(\mathbb{F}_{p}^{n},V_{j-1})$ where $V_{j-1}=\mathrm{span}(w_{1},\ldots,w_{j-1})$. Let $M$ be a $c$-by-$n$ matrix with rows $w_{j}$.

Consider a fixed $n$-component vector $v$, with $v\neq 0$ and $v\neq\vec{1}$. The probability that $Mv=0$ is bounded from above by

[TABLE]

Proof.

We will estimate the desired probability by a union bound, considering separately the event that $v\in V_{c}^{\perp}$ and $v\not\in V_{c}$, and the event that $v\in V_{c}^{\perp}$ and $v\in V_{c}$. The second event is possible only if $v\cdot v=0$. By the classification of symmetric forms, a maximal null space of $\mathbb{F}_{p}^{n}$ has dimension $m$ such that $n-2\leq 2m\leq n$. The assumption that $c<(n-2)/2$ implies that

[TABLE]

Consider the first event, assuming $v\cdot v=0$. Let $j>1$. Then

[TABLE]

because $w_{j}$ has to be orthogonal to $\text{span}(v)+V_{j-1}$, which is null and is a proper superset of $V_{j-1}$. Thus, for any $t$,

[TABLE]

For $t=c$, we find in particular that

[TABLE]

Now assume $v\cdot v\neq 0$. The event that $v\in V_{j}^{\perp}$ happens only if $w_{j}$ is chosen from $v^{\perp}$. We bound the decomposition $\Pr[v\in V_{c}^{\perp}]=\Pr[v\in V_{1}^{\perp}]\prod_{j=2}^{c}\Pr[v\in V_{j}^{\perp}|v\in V_{j-1}^{\perp}]$. The first term is bounded by 1 trivially. For other factors, we observe that the dimension of $v^{\perp}$ is $n-1$, and a maximal null subspace in $v^{\perp}$ has dimension $m^{\prime}\leq m$. Under the conditioning $v\in V_{j-1}^{\perp}$, the null space $V_{j-1}$ is a subspace of $v^{\perp}$, and $\#\mathcal{Z}(v^{\perp},V_{j-1})=\zeta(n-1,m^{\prime},k_{j-1})\leq\zeta(n-1,m,k_{j-1})$. Hence,

[TABLE]

where in the second inequality, we used the assumption that $k_{j-1}\leq c<(n-2)/2\leq m$.

Let us turn to the second event, assuming $v\cdot v=0$. Note that if $v\in V_{c}$, there is a least $j$ such that $v\in V_{j}$. So,

[TABLE]

We have

[TABLE]

where we used Eq. (E). The second factor is bounded as

[TABLE]

because $w_{j}$ belongs to $\text{span}(v)+V_{j-1}$. Hence, $\Pr[v\in V_{j}\,{\rm and}\,v\in V_{j-1}^{\perp}\,{\rm and}\,v\notin V_{j-1}]\leq 5(\frac{3}{5})^{n-j}$. So by Eq. (E.17),

[TABLE]

Summing the probabilities of (E.16) and (E.20), we conclude the proof. ∎