Information Theoretically Secure Hypothesis Test for Temporally Unstructured Quantum Computation

TL;DR

This paper introduces a secure protocol enabling clients with limited quantum capabilities to verify that a server performs quantum sampling from a restricted class of quantum machines, ensuring security through information-theoretic principles.

Contribution

It presents a novel, composable, information-theoretically secure verification protocol for non-universal quantum sampling using measurement-based blind quantum computing.

Findings

Protocol achieves security against malicious servers

Enables certification of quantum supremacy without universal quantum computers

Utilizes properties of measurement-based blind quantum computing

Abstract

We propose a new composable and information-theoretically secure protocol to verify that a server has the power to sample from a sub-universal quantum machine implementing only commuting gates. By allowing the client to manipulate single qubits, we exploit properties of Measurement based Blind Quantum Computing to prove security against a malicious Server and therefore certify quantum supremacy without the need for a universal quantum computer.

Equations

$$\mathbb{P}\left(X=\tilde{x}\right)={\left|⟨\tilde{x}|\exp \left(\sum _{i=1}^{n_a}i\theta \underset{j:{\mathbf{Q}}_{ij}=1}{⨂}{X}_j\right)|0^{n_p}⟩\right|}^2$$

$$\exp \left(\sum _{i=1}^{n_a}i\theta \underset{j:{\mathbf{Q}}_{ij}=1}{⨂}{X}_j\right)=H_{n_p}\left(\prod _{i=1}^{n_a}\exp \left(i\theta \underset{j:{\mathbf{Q}}_{ij}=1}{⨂}{Z}_j\right)\right)H_{n_p}$$

$$\mathbb{P}\left(X=\tilde{x}\right)={\left|\left(⟨\tilde{x}|H_{n_p}\right)\left(\prod _{i=1}^{n_a}\exp \left(i\theta \underset{j:{\mathbf{Q}}_{ij}=1}{⨂}{Z}_j\right)\right)|{+}^{n_p}⟩\right|}^2$$

$$\exp \left(i\theta \underset{j:{\mathbf{Q}}_{ij}=1}{⨂}{Z}_j\right)$$

$$\cos \theta {\mathbb{I}}_{n_p}+i\sin \theta \underset{j:{\mathbf{Q}}_{ij}=1}{⨂}{Z}_j$$

$$\left(\cos \theta \pm i\sin \theta \right)|p⟩=e^{\pm i\theta }|p⟩$$

$$\left\{|0_{\theta }⟩,|1_{\theta }⟩\right\}=\left\{\frac{1}{\sqrt{2}}\left(e^{-i\theta }|+⟩+e^{i\theta }|-⟩\right),\frac{1}{\sqrt{2}}\left(e^{-i\theta }|+⟩-e^{i\theta }|-⟩\right)\right\}$$

$$\prod _{k=1}^{n_b}{\left(S_{p_j}^{(-1{)}^{s_k^b+r_k^b}}\otimes S_{a_i}^{(-1{)}^{s_k^b+r_k^b}}\right)}^{d_k^b}{\left(Z_{p_j}^{r_k^b}\otimes Z_{a_j}^{r_k^b}\right)}^{1-d_k}{E}_{\mathbf{Q}}|\varphi ⟩$$

$${\Pi }_j^z$$

$${\Pi }_j^s$$

$$A_i^z$$

$$A_i^s$$

$$S^{-A_i}\left\{|0_{\theta }⟩,|1_{\theta }⟩\right\}\text{ and }{S}^{-{\Pi }_j}\left\{|+⟩,|-⟩\right\}$$

$${\tilde{x}}_j=s_j^p+\sum _{i:{\mathbf{Q}}_{ij}=1}{s}_i^a(\mathrm{mod}2)$$

$${\pi }_A\mathcal{R}\equiv \mathcal{S}\sigma$$

$$d_j^p$$

$$d_i^a$$

$${\tilde{x}}_j=\left(s_j^p+r_j^p\right)+\sum _{i:{\mathbf{Q}}_{ij}=1}\left(s_i^a+r_i^a\right)$$

$$\mathbb{P}\left(X\cdot {\mathbf{s}}^T=0\right)={\mathbb{E}}_{\mathbf{c}\sim {\mathcal{C}}_{\mathbf{s}}}\left[{\cos }^2\left(\theta \left(n_s-2\cdot \#\mathbf{c}\right)\right)\right]$$

$${\mathbf{A}}_{i,j}=\{\begin{array}{ll}1& \text{if }i=j\\ 0& \text{if }i\ne j\text{ and }j<n_p\\ {\hat{\mathbf{s}}}_i& \text{if }j=n_p\text{ and }i<n_p\end{array}$$

$$E_{\tilde{\mathbf{Q}}}|\psi ⟩=c{Z}_{a_i,b_1}c{Z}_{p_j,b_1}{E}_{\mathbf{Q}}|\varphi ⟩|b_1⟩$$

$$E_{\tilde{\mathbf{Q}}}|\psi ⟩=Z_{a_i}^{r_1^b}{Z}_{p_j}^{r_1^b}{E}_{\mathbf{Q}}|\varphi ⟩|b_1⟩$$

$$E_{\tilde{\mathbf{Q}}}|\psi ⟩=c{Z}_{a_i,b_1}c{Z}_{p_j,b_1}c{Z}_{a_i,p_j}{E}_{\mathbf{Q}}|\varphi ⟩|b_1⟩$$

$$\frac{1}{\sqrt{2}}|0⟩\otimes {\mathbb{I}}_{a_i}\otimes {\mathbb{I}}_{p_j}+{\left(-1\right)}^{r_1^b}\frac{1}{\sqrt{2}}|1⟩\otimes Z_{a_i}\otimes Z_{p_j}$$

$$\frac{1}{\sqrt{2}}{\mathbb{I}}_{a_i}\otimes {\mathbb{I}}_{p_j}+(-1{)}^{1-s_1^b}{\left(-1\right)}^{r_1^b}i\frac{1}{\sqrt{2}}{Z}_{a_i}\otimes Z_{p_j}$$

$$\left(\frac{1}{\sqrt{2}}{\mathbb{I}}_{a_i}\otimes {\mathbb{I}}_{p_j}+(-1{)}^{1-s_1^b}{\left(-1\right)}^{r_1^b}i\frac{1}{\sqrt{2}}{Z}_{a_i}\otimes Z_{p_j}\right)c{Z}_{a_i,p_j}{E}_{\mathbf{Q}}|\varphi ⟩$$

$$c{Z}_{1,2}=\frac{1}{2}\left({\mathbb{I}}_1\otimes {\mathbb{I}}_2+Z_1\otimes {\mathbb{I}}_2+{\mathbb{I}}_1\otimes Z_2+Z_1\otimes Z_2\right).$$

$$c{Z}_{1,2}=\left(S_1\otimes S_2\right)\left(\frac{1}{\sqrt{2}}{\mathbb{I}}_1\otimes {\mathbb{I}}_2+i\frac{1}{\sqrt{2}}{Z}_1\otimes Z_2\right)$$

$$c{Z}_{1,2}=\left(S_1^{-1}\otimes S_2^{-1}\right)\left(\frac{1}{\sqrt{2}}{\mathbb{I}}_1\otimes {\mathbb{I}}_2-i\frac{1}{\sqrt{2}}{Z}_1\otimes Z_2\right)$$

$$\begin{gathered} c{Z}_{a_i,p_j}=\left(S_{a_i}^{(-1{)}^{1-s_1^b}\left(-{\left(-1\right)}^{r_1^b}\right)}\otimes S_{p_j}^{(-1{)}^{1-s_1^b}\left(-{\left(-1\right)}^{r_1^b}\right)}\right) \\ \left(\frac{1}{\sqrt{2}}{\mathbb{I}}_{a_i}\otimes {\mathbb{I}}_{p_j}-(-1{)}^{1-s_1^b}{\left(-1\right)}^{r_1^b}i\frac{1}{\sqrt{2}}{Z}_{a_i}\otimes Z_{p_j}\right) \end{gathered}$$

$$\left(S_{a_1}^{(-1{)}^{s_1^b+r_1^b}}\otimes S_{p_j}^{(-1{)}^{s_1^b+r_1^b}}\right)E_{\mathbf{Q}}|\varphi ⟩$$

$${\tilde{x}}_j=s_j^p+\sum _{i:{\mathbf{Q}}_{ij}=1}{s}_i^a(\mathrm{mod}2)$$

Full text

1 Introduction

Quantum computers are believed to be efficient for simulating quantum systems [1, 2] and have been shown to have many other applications [3]. Protocols demonstrating the power of quantum computers include Shor’s algorithm for prime factorisation [4], Grover’s algorithm for unstructured search [5], and the BB84 protocol for public key exchange [6].

That said, it may be some time before a large scale universal quantum computer capable of demonstrating the computational power of these protocols is built. In the meantime several intermediate, non-universal models of quantum computation, like the one clean qubit model [7, 8] and the boson sampling model [9], have been developed and may prove easier to implement. The Instantaneous Quantum Poly-time (IQP) machine [10] is another such non-universal model with significant practical advantages [11, 12]. In spite of the fact that IQP uses only commuting gates (in contrast to the non-commuting gate set needed for universal computations), it is believed to remain hard to classically simulate [13, 14] even in a noisy environment [15]. Hence, providing evidence that a machine can perform hard IQP computations would be a proof of its quantum supremacy.

In [10], the authors present a hypothesis test that can be passed only by devices capable of efficiently simulating IQP machines, providing the aforementioned evidence of the capability to perform hard IQP computations. The client in that work is purely classical, however computational assumptions (conjecturing the hardness of finding hidden sub-matroids) were required for the security of the test against a malicious server. In the present work, by providing a suitable implementation of the IQP machine in the setting of Measurement Based Quantum Computing (MBQC) [16, 17], we are able to use tools from quantum cryptography (e.g. blind quantum computing [18, 19]) to develop an information-theoretically secure hypothesis test. To do so, we need to empower the client with minimal quantum capabilities such as those required in standard Quantum Key Distribution schemes.

The structure of this work is as follows. In Section 2, we formally introduce the IQP machine and develop an implementation of it in MBQC that is more suitable for our blind delegated setting than previous ones [10, 20]. In Section 3 we derive a delegated protocol for IQP computations that keeps the details of the computation hidden from the device performing it, and prove information-theoretic security in a composable framework. Finally in Section 4 we develop our hypothesis test for quantum supremacy, which a limited quantum client can run on an untrusted Server.

2 Preliminaries

2.1 X-programs

The IQP machine introduced in [10], is defined by its capacity to implement $X$-programs.

Definition 2.1**.**

An $X$-program consists of a Hamiltonian comprised of a sum of products of $X$ operators on different qubits, and $\theta\in[0,2\pi]$ describing the action for which it is applied. The $i$-th term of the sum has a corresponding vector $\mathbf{q}_{i}$, called a program element, which defines on which of the $n_{p}$ input qubits, the product of $X$ operators, which constitute that term, act. $\mathbf{q}_{i}$ has 1 in the $j$-th position when $X$ is applied on the $j$-th qubit.

As such, we can describe the $X$-program using $\theta$ and a poly-size list of $n_{a}$ vectors $\mathbf{q}_{i}\in\left\{0,1\right\}^{n_{p}}$ or, if we consider the matrix $\mathbf{Q}$ which has as rows the program elements $\mathbf{q}_{i},i=1,\dots,n_{a}$, simply by the pair $\left(\mathbf{Q},\theta\right)\in\left\{0,1\right\}^{n_{a}\times n_{p}}\times\left[0,2\pi\right]$.

Applying the $X$-program discussed above to the computational basis state $\ket{0^{n_{p}}}$ and measuring the result in the computational basis allows us to see an $X$-program as a quantum circuit with input $\ket{0^{n_{p}}}$, comprised of gates diagonal in the Pauli-X basis, and classical output. Using the random variable $X$ to represent the distribution of output samples, the probability distribution of outcomes $\widetilde{x}\in\{0,1\}^{n_{p}}$ is:

[TABLE]

Note that the $i$ not used as an index is the imaginary unit.

Definition 2.2**.**

Given some X-program, an IQP machine is any computational method capable of efficiently returning a sample $\widetilde{x}\in\{0,1\}^{n_{p}}$ from the probability distribution (1).

2.2 IQP In MBQC

We present an implementation of a given $X$-program in MBQC that will be used later in our protocol design. First notice that using the equality below:

[TABLE]

equation (1) can be rewritten as:

[TABLE]

For any given $i$, we now show the following lemma.

Lemma 2.1**.**

The circuit of Figure 1 implements the unitary:

[TABLE]

Proof.

To prove this statement, we will prove that the effect of Figure 1 and expression (3) is the same on all inputs. Without loss of generality, we can consider only computational basis input states $\ket{p}=\ket{p_{1}}\dots\ket{p_{n_{p}}}$, $p_{j}\in\left\{0,1\right\}$. Since the operation that we perform is linear, the result then follows for all inputs.

Notice that, representing the $n_{p}$-qubit identity operator by $\mathbb{I}_{n_{p}}$, we can rewrite Expression (3) as:

[TABLE]

The above operator on $\ket{p}$ has two possible outcomes:

For the $j\in\left\{1,\dots,n_{p}\right\}$ such that $\mathbf{Q}_{ij}=1$, if the number of $\ket{p_{j}}=\ket{1}$ is even, then there will be a phase change of $\cos{\theta}+i\sin{\theta}$, as the $\bigotimes_{j:\mathbf{Q}_{ij}=1}Z_{j}$ operator will extract an even number of negatives. 2. 2.

For the $j$’s ($j=1,\dots,n_{p}$) such that $\mathbf{Q}_{ij}=1$, if the number of $\ket{p_{j}}=\ket{1}$ is odd, then the phase change will be $\cos{\theta}-i\sin{\theta}$.

Hence, depending on the parity of $\ket{p}$ in the positions where $\mathbf{Q}_{ij}=1$, the effect is to produce one of the two states:

[TABLE]

We now show the effect of the circuit in Figure 1 is the same as the operator in expression (4). For ease of readability, in Figure 1 we consider a permutation of the states $\ket{\tilde{p}_{1}},\dots,\ket{\tilde{p}_{\#i}},\dots,\ket{\tilde{p}_{n_{p}}}$ such that the first $\#i$ qubits are the ones for which the value in the corresponding position in the program element is 1.

The action of the controlled-Z gates is to check the parity of $\ket{1}$’s in the input as each appearance of a $\ket{1}$ will flip the bottom ancillary qubit between the states $\ket{+}$ and $\ket{-}$. After the action of all controlled-Z operators, we have the state $\ket{p}\ket{+}$ if there is an even number of $\ket{\tilde{p}_{k}}=\ket{1}$ for $k=1,\dots,\#i$ and $\ket{p}\ket{-}$ if this number is odd. Making a measurement of the ancillary qubit in the basis:

[TABLE]

leaves us with one of the two states $\pm e^{-i\theta}\ket{p}$ in the odd parity case and with the state $e^{i\theta}\ket{p}$ in the even parity case. The negative sign preceding the exponential term in the odd parity case comes from measuring the state $\ket{1_{\theta}}$ (a measurement outcome of $1$) and the positive sign comes from measuring $\ket{0_{\theta}}$.

In the case of a measurement outcome $1$, we then apply $Z$ operators to all unmeasured qubits to ensure that the resulting states are as in expression (5) and with the same dependency of the sign on the parity of $\ket{p}$. ∎

We now consider generating the full distribution of equation (2) using measurement based quantum computing [16, 17]. An MBQC computation consists of a graph describing the pattern of entanglement amongst the qubits in a state, a measurement pattern describing the order of measurements of qubits in that state, and a set of corrections on later measurements which can depend on the outcomes of previous ones. We now identify all of these components of an MBQC computation in the case of an IQP computation.

Lemma 2.2**.**

A graph and measurement pattern can always be designed to simulate an $X$-program efficiently.

Proof.

Producing the distribution in Eq. (2) can be achieved by inputting the state $\ket{+^{n_{p}}}$ into a circuit made from composing circuits like the one in Figure 1 (one for each term of the product in Eq. (2)) and measuring the result in the Hadamard basis. The $Z$ corrections commute with the controlled-$Z$ operations and therefore they can be moved to the end of the new, larger circuit.

Because there is no dependency between the measurements, they can be performed in any order or even simultaneously. The $Z$ corrections, conditional on the measurement outcomes of the ancillary bits, can then be implemented via bit flips. ∎

A formal description of the protocol described in these proofs can be found in Algorithm 4 of the Appendix. We introduce some further terminology which is used in that algorithm and in the remainder of this work.

The reader will notice that the entanglement pattern used in Algorithm 4 and implicit in the proof of Lemma 2.2 is that of an undirected bipartite graph, which we will refer to as an IQP graph.

Definition 2.3**.**

An undirected bipartite graph, which we refer to as an IQP graph, consists of a bipartition of vertices into two sets $P$ and $A$ of cardinality $n_{p}$ and $n_{a}$ respectively. We may represent such a graph by $\mathbf{Q}\in\left\{0,1\right\}^{n_{a}\times n_{p}}$. An edge exists in the graph when $\mathbf{Q}_{ij}=1$, for $i=1,\dots,n_{a}$ and $j=1,\dots,n_{p}$. We call the set $P$ primary vertices and the set $A$ ancillary vertices.

By referring to the bottom qubit of Figure 1 as the ancillary qubit and the others as primary qubits we understand why this type of graph is relevant and how the $X$-program matrix $\mathbf{Q}$, interpreted and a bipartite graph, exactly describes the entanglement pattern. Throughout this work, we refer to $\mathbf{Q}$ interchangeably as a matrix corresponding to an $X$-program and a graph and the reader may wish to direct their attention to Figure 2 for an example.

3 Blind Delegated IQP Computation

The next step towards our method for verifying IQP machines is to build a method for blindly performing an IQP computation in a delegated setting. We consider a Client with limited quantum power delegating an IQP computation to a powerful Server. The novel method that we use in this work is to keep the $X$-program secret by not revealing the quantum state used. The intuition behind the method used to perform this hiding is that the Client will ask the Server to produce a quite general quantum state and then move from that one to the one that is required for the computation. If this is done in a blind way then the Server only has some knowledge of the general starting state from which any number of other quantum states may have been built. Hence, there are two key problems that to be addressed in the following subsections:

How to move from a general quantum state to a specific one representing an IQP computation. 2. 2.

How to do so secretly in a delegated setting.

3.1 Break and Bridge

The break and bridge operations on a graph $\widetilde{G}=(\widetilde{V},\widetilde{E})$, with vertex set $\widetilde{V}$ and edge set $\widetilde{E}$, which were introduced in [19, 21], are exactly those necessary to solve the ‘how to move’ element of problem 1.

Definition 3.1**.**

The break operator acts on a vertex $v\in\widetilde{V}$ of degree 2 in a graph $\widetilde{G}$. It removes $v$ from $\widetilde{V}$ and also removes any edges connected to $v$ from $\widetilde{E}$.

The bridge operator acts also on a vertex $v\in\widetilde{V}$ of degree 2 in a graph $\widetilde{G}$. It removes $v$ from $\widetilde{V}$, removes any edges connected to $v$ from $\widetilde{E}$ and adds a new edge between the neighbours of $v$.

Figure 3 gives an example of multiple applications of the bridge and break operators. Once this is translated from a graph theoretic idea to an operation on quantum states, we will have address the ‘how to move’ component of problem 1.

The extended IQP graphs, which we define now, is the ‘general quantum state’ also mentioned in problem 1.

Definition 3.2**.**

An extended IQP graph is represented by $\widetilde{\mathbf{Q}}\in\left\{-1,0,1\right\}^{n_{a}\times n_{p}}$. The vertex set contains $A=\left\{a_{1},...,a_{n_{a}}\right\}$ and $P=\left\{p_{1},...,p_{n_{p}}\right\}$ while $\widetilde{\mathbf{Q}}_{ij}=0$ and $\widetilde{\mathbf{Q}}_{ij}=1$ has the same implications, regarding the connections between these vertices, as in IQP graphs.

We interpret $\widetilde{\mathbf{Q}}_{ij}=-1$ as the existence of an intermediary vertex $b_{k}$ between vertices $p_{j}$ and $a_{i}$, and denote with $n_{b}$ the number of -1s in $\widetilde{\mathbf{Q}}$. As such the vertex set also includes the bridge and break vertices $B=\left\{b_{1},...,b_{n_{b}}\right\}$ and the edge set includes edges between $b_{k}$ and $a_{i}$ as well as $b_{k}$ and $p_{j}$ when $\widetilde{\mathbf{Q}}_{ij}=-1$. To keep track of these connections we define the surjective function $g$ for which $g\left(i,j\right)=k$ where $b_{k}$ is the intermediate vertex connected to $a_{i}$ and $p_{j}$.

An extended IQP graph $\widetilde{\mathbf{Q}}$ can be built from an IQP graph $\mathbf{Q}$ by replacing any number of the entries of $\mathbf{Q}$ with $-1$. Throughout the remainder of this work we will use the tilde notation to represent an extended IQP graph $\widetilde{\mathbf{Q}}$ build from an IQP graph $\mathbf{Q}$ in this way.

Figure 4 displays an example of an extended IQP graph. By applying a bridge operator to $b_{1}$ and a break operation to $b_{2}$ in $\widetilde{\mathbf{Q}}$ of Figure 4 we arrive at $\mathbf{Q}$ of Figure 2. It is in this sense that an extended IQP graph is ‘more general’ that an IQP graph.

It is convenient to now introduce the following definition which allows us to use the graphs defined above to describe the entanglement pattern of quantum states.

Definition 3.3**.**

Consider a matrix $\mathbf{G}\in\left\{-1,0,1\right\}^{n_{a}\times n_{p}}$ and use function $g\left(i,j\right)=k$ to define index $k=1,\dots,n_{b}$ for the elements $\mathbf{G}_{ij}=-1$. The circuit $E_{\mathbf{G}}$ on $(n_{a}+n_{p}+n_{b})$ qubits applies controlled-$Z$ operations between qubits $p_{j}$ and $a_{i}$ if $\mathbf{G}_{ij}=1$ and, between qubits $b_{g(i,j)}$ and $a_{i}$, and, $b_{g(i,j)}$ and $p_{j}$, when $\mathbf{G}_{ij}=-1$.

Using the above notation, the state built in Lemma 2.2 is $E_{\mathbf{Q}}\ket{+}^{n_{a}+n_{p}}$. We refer to such a state, or $Z$ rotations there of, as an IQP state. We will call states of the form $E_{\mathbf{Q}}\ket{+}^{n_{a}+n_{p}}$ or, again, their $Z$ rotations, as IQP extended state

We can now state Lemma 3.1 which teaches us how to translate bridge and break operations from graph theoretical ideas into practical operations on quantum states. A similar lemma can be found in [19].

Lemma 3.1**.**

Consider a quantum state $E_{\mathbf{Q}}\ket{\phi}$ where $\ket{\phi}$ is arbitrary. If $\widetilde{\mathbf{Q}}$ is an extended IQP graph built from $\mathbf{Q}$ then there exists a state $E_{\widetilde{\mathbf{Q}}}\ket{\psi}$, which can be transformed into the state $E_{\mathbf{Q}}\ket{\phi}$ through a sequence of Pauli-$Y$ basis measurements on qubits and local rotations around the Z axis on the unmeasured qubits through angles $\left\{0,\frac{\pi}{2},\pi,\frac{3\pi}{2}\right\}$.

The detailed proof of Lemma 3.1, which can be found in Appendix A.1, shows us that we can create the following state.

[TABLE]

where $p_{j}$ and $a_{i}$ are the primary and ancillary qubits connected to $b_{k}$ respectively.

The operations performed to achieve this are measurements of the qubits corresponding to bridge and break vertices (which we call bridge and break qubits) of $E_{\widetilde{\mathbf{Q}}}\ket{\psi}$ in the Pauli $Y$ basis. The quantity $s_{k}^{b}$ is the outcome of this measurement on qubit $b_{k}$ while the quantities $r^{b}_{k}$ and $d^{b}_{k}$ tell us that said qubit was initialised in the state $\ket{b_{k}}=Y^{r^{b}_{k}}\sqrt{Y}^{d^{b}_{k}}\ket{0}$.

It is possible to perform an IQP computation using this method. Although the quantum state generated using this method would equal $E_{\mathbf{Q}}\bigotimes_{1}^{n_{a}+n_{p}}\ket{+}$ up to some $S$ corrections, these corrections may be accounted for by making corrections to the primary and ancillary measurement bases (see also the circuits in Figures 14 and 15 in Appendix A.3). Algorithm 5 of the Appendix uses the methods discussed to build an IQP state.

3.2 The Protocol

We can now address problem 2 of the introduction to this section. To do so we use the tools of the previous section to blindly create an IQP state at the Server side. What we wish is to construct the Ideal Resource of Figure 5 which takes as input from the Client an IQP computation, $\left(\mathbf{Q},\theta\right)$, and in return gives a classical output $\widetilde{x}$. If the Server is honest, then $\widetilde{x}$ comes from the distribution corresponding to $\left(\mathbf{Q},\theta\right)$. If the Server is dishonest, then they can input some quantum operation $\mathcal{E}$ and some quantum state $\rho_{B}$ and force the output to the Client into the classical state $\mathcal{E}\left(\mathbf{Q},\theta,\rho_{B}\right)$. We would like for the Server only to receive a IQP extended graph $\widetilde{\mathbf{Q}}$ which can be built from $\mathbf{Q}$, the distribution $\mathcal{Q}$ over the possible $\mathbf{Q}$ from which $\widetilde{\mathbf{Q}}$ could be built and $\theta$. Let us assume that this is public knowledge.

The proposed real communication protocol is described in detail by Algorithm 1 and graphically shown in Figure 6. The element of blindness is added to the work of Section 3.1 and Algorithm 5 by introducing some random rotations on the primary and ancillary qubits. These rotations are such that they can be corrected by rotating, in the same way, the measurement bases of those qubits, and therefore ensuring that the original IQP computation is being performed.

During the execution of the protocol of Algorithm 1, the Server sends two classical bit strings to the Client that correspond to the measurement outcomes of the sent qubits. If the Server wants to deviate from the protocol, he will again use some quantum map $\mathcal{E}$ on the information received so far together with the state $\rho_{B}$ he has in his own register. At the final step of the protocol the Server may output some quantum state $\rho_{B}^{\prime}$.

To prove composable security of the proposed protocol we drop the notion of a malicious Server for that of a global distinguisher that has a view of all inputs and outputs of the relevant resources. To recreate the view of a malicious Server, we develop a simulator $\sigma$ interfacing between the ideal resource $\mathcal{S}$ of Figure 5 and the distinguisher in such a way that the latter cannot tell the difference between an interaction with the ideal resource and the real protocol. We employ the Abstract Cryptography framework introduced in [22, 23] and teleportation techniques inspired by [24] to prove security in the case of a malicious Server. We will prove that:

[TABLE]

where $\mathcal{R}$ is the communication channel (quantum and classical) used by the Client and the Server in the protocol.

Theorem 3.1**.**

The protocol described by Algorithm 1 is information theoretically secure against a dishonest Server.

For the sake of brevity, we give only an intuitive proof here and leave a thorough proof to Appendix A.1.

Proof.

The proof consists of a pattern of transformations of the real protocol of Algorithm 1, into the ideal resource plus simulator setting of Algorithm 2. These transformations leave the computation unchanged, therefore ensuring the indistinguishability of the two settings and so the security of the protocol. As the computation itself is not changed by the transformations we also ensure that we are still sampling from the original IQP distribution, providing evidence for the correctness of Algorithm 2.

Line 2 of Algorithm 1 generates at random one of the four states $\ket{+}$, $\ket{+^{Y}}$, $\ket{-}$ and $\ket{-^{Y}}$. The same effect is achieved by measuring an EPR pair with equal probability in one of the bases $\left\{\ket{+},\ket{-}\right\}$ and $\left\{\ket{+^{Y}},\ket{-^{Y}}\right\}$. The application of the $\left(\sqrt{Y}\right)^{d^{b}_{k}}$ operation in line 4 of Algorithm 1 decides, according to the graph to be created, if the bridge and break qubit will be drawn from the set $\left\{\ket{+},\ket{-}\right\}$ or $\left\{\ket{0},\ket{1}\right\}$. Using the same information to choose between the measurement bases $\left\{\ket{+},\ket{-}\right\}$ and $\left\{\ket{0},\ket{1}\right\}$ on one half of an EPR pair has the same effect. The random rotation $Y^{r^{b}_{k}}$ then has the same effect of the randomness that is intrinsic to the EPR pair measurement. This may be visualised in Figure 7 which presents a simple rearrangement of the Real Resource of Figure 6 in order to isolate the state generation phase $\pi_{A}^{1}$ and to examine an equivalent circuit based on teleportation.

The next transformation is to delay the first measurement of the EPR pairs as implied in Figure 8. Since information about the measurement outcome $r$ is not yet available to define $\Pi$ and $A$, the Client chooses random $\Pi$ and $A$ which will then corrected for by using these values to compute the measurement bases for the Client’s half of the primary and ancillary EPR pairs.

Finally, Figure 9 simply involves a rearrangement of the players in Figure 8 to match those in the simulator/distinguisher setting. The formal description of the protocol displayed by Figure 9 is seen in Algorithm 2.

∎

We can now be sure that our communication protocol is indistinguishable from an ideal resource (defined in Figure 5) which performs an IQP computation without communicating any information to the Server which is not already public. This means that the communication protocol does not reveal any information about the computation to the Server. Furthermore, this is proven in a composable framework [22, 23, 24] and so can be used as part of future protocols as we will in section 4.

4 The Hypothesis Test

4.1 Previous work

We now have all the tools to form a test for a Server to run in order to prove to a Client that they are capable of solving classically non-simulatable problems. Specifically, we ask the Server to perform an IQP computation that we believe is classically hard, but whose solution can easily be checked by a classical Client.

The general idea of our Hypothesis Test, building on the work of [10], is that there is some hidden structure in the program elements, $\mathbf{q}_{i}$, of the $X$-program that results in some structure in the distribution of the outputs, known only to the Client. The Client can use this structure to check the Server’s reply. A Server possessing an IQP machine can reproduce this structure by implementing the $X$-program. A Server not in possession of an IQP machine cannot generate outputs obeying the same rules.

We summarise this discussion by three conditions that a hypothesis test using this method must meet.

1. 1.1

The Client asks the Server to perform an IQP computation that is hard to classically simulate. 2. 1.2

The Client can check the solution to this computation because they know some secret structure that makes this checking processes efficient. 3. 1.3

The Server must be unable to uncover this structure in polynomial time.

A particular ‘known structure’ of the output which is used in [10] to satisfy condition 1.2 is its bias.

Definition 4.1**.**

If X is a random variable taking values in $\left\{0,1\right\}^{n_{p}}$ and $\mathbf{s}\in\left\{0,1\right\}^{n_{p}}$ then the bias of $X$ in the direction $\mathbf{s}$ is $\mathbb{P}\left(X\cdot\mathbf{s}^{T}=0\right)$ where the product is performed modulo 2. Hence, the bias of a distribution in the direction $\mathbf{s}$ is the probability of a sample from the distribution being orthogonal to $\mathbf{s}$.

To calculate the bias of $X$ in direction $\mathbf{s}\in\left\{0,1\right\}^{n}$, we form the linear code $\mathcal{C}_{\mathbf{s}}$ by selecting all rows, $\mathbf{q}_{i}$ of the X-program, $\left(\mathbf{Q},\theta\right)\in\left\{0,1\right\}^{n_{a}\times n_{p}}\times\left[0,2\pi\right]$, such that $\mathbf{q}_{i}\cdot\bf{s}^{T}=1$ and forming, from them, a new matrix, $\mathbf{Q}_{\mathbf{s}}$, which is the generator matrix of $\mathcal{C}_{\bf{s}}$. Defining $n_{\bf{s}}$ to be the number of rows of $\mathbf{Q}_{\bf{s}}$ allows us to understand the following expression. The derivation can be found in [10].

[TABLE]

We find that the bias of an X-program in the direction $\bf{s}$ depends only on $\theta$ and the linear code defined by the generator matrix $\mathbf{Q}_{\mathbf{s}}$. One can now imagine a hypothesis test derived from these facts. Although the X-program that will be implemented, needs to be made public, the direction $\mathbf{s}$ which will be used for checking, will be kept secret. This gives a Client, with the computational power to calculate the quantity of expression (18), the necessary information to compute the bias, but does not afford the Server the same privilege.

What we want to show is that the only way for the Server to produce an output with the correct bias is to use an IQP machine. If the Server could somehow uncover $\mathbf{s}$ then they could calculate the value of expression (18) and return vectors to the Client which are orthogonal to $\mathbf{s}$ with the correct probability. We specialise the conditions mentioned at the beginning of this section to this particular method.

1. 2.1

The X-Program sent to a Server represents an IQP computation that is hard to classically simulate. 2. 2.2

It must be possible for a Client, having knowledge of a secret $\mathbf{s}$ and the X-program, to calculate the quantity of expression (18). 3. 2.3

The knowledge of the Server must be insufficient to learn the value of $\bf{s}$.

In [10] the authors develop a protocol for building an $X$-program and a vector $\mathbf{s}$ performing this type of hypothesis test. The code $\mathcal{C}_{\mathbf{s}}$ used to build the $X$-program is a quadratic residue code with $\theta=\frac{\pi}{8}$. Condition 2.1 is conjectured, by [10], to be satisfied by these X-programs. This conjecture is supported by giving a classical simulation that is believed to be optimal and achieves maximum bias value $0.75$; different from that expected from an IQP machine. A hypothesis test with X-programs, such as the random circuits of [13], for which connections to an implausible collapse in the polynomial hierarchy has been made, is an open problem. Condition 2.2 is also satisfied by the construction in [10], by proving that the bias value, which is $\cos^{2}\left(\frac{\pi}{8}\right)$ for their choice of X-program and $\mathbf{s}$, can be calculated in polynomial time.

The way in which condition 2.3 is addressed in [10] relies on the fact that the right-hand side expression of Eq.(18) is equal for all generator matrices in a matroid [25].

Definition 4.2**.**

A $i$-point binary matroid is an equivalence class of matrices with $i$ rows, defined over $\mathbb{F}_{2}$. Two matrices, $\mathbf{M}_{1}$ and $\mathbf{M}_{2}$, are said to be equivalent if, for some permutation matrix $\mathbf{R}$, the column echelon reduced form of $\mathbf{M}_{1}$ is the same as the column echelon reduced form of $\mathbf{R}\cdot\mathbf{M}_{2}$ (In the case where the column dimensions do not match, we define equivalence by deleting columns containing only [math]s after column echelon reduction).

In order to move to a new matrix within the same matroid, consider the right-multiplication with matrix $\mathbf{A}$ on $\mathbf{Q}$. Notice that $\mathbf{q}_{i}\mathbf{s}^{T}=\left(\mathbf{q}_{i}\mathbf{A}\right)\left(\mathbf{A}^{-1}\mathbf{s}^{T}\right)$. Rows which were originally non-orthogonal to $\mathbf{s}$ are now non-orthogonal to $\mathbf{A}^{-1}\mathbf{s}^{T}$, hence we can locate $\mathbf{Q}_{\mathbf{s}}$ in $\mathbf{Q}$ by using $\mathbf{A}^{-1}\mathbf{s}^{T}$.

A way to hide $\mathbf{s}$ is therefore to randomise it with such an operation $\mathbf{A}$. We now understand what to do to the $X$-program we are considering, so that the value of the bias does not change. To increase the hiding of $\mathbf{s}$, the matrix might also include additional rows orthogonal to $\mathbf{s}$, which do not affect the value of the bias. The combination of matrix randomisation and the addition of new rows makes it hard, as conjectured in [10], up to some computational complexity assumptions, for the Server to recover $\mathbf{s}$ from the matrix that it receives. It is now simply a matter for the Server to implement the $X$-program and for the Client to check the bias of the output in the direction $\mathbf{s}$. This is the approach used by [10] to address condition 2.3.

4.2 Our Protocol

The main contribution of this work is to revisit condition 2.3. By giving to the Client limited quantum capabilities, we remove the computational assumption of [10], and therefore provide unconditional security against a powerful quantum Server. In Algorithm 3 we provide a hypothesis test that uses the blind delegated IQP computation resource of the previous section to verify quantum supremacy.

Theorem 4.1**.**

Algorithm 3 presents an information-theoretically secure solution to condition 2.3.

Proof.

Let us begin by recalling that when $\mathcal{C}_{\mathbf{s}}$ in expression (18) is the quadratic residue code space then we know that the value of that expression is $\cos^{2}\frac{\pi}{8}$.

Notice that, in particular, the all one vector is in the quadratic residue code space. As such the matrix $\mathbf{Q}_{\mathbf{s}}$, introduced on line 2 of Algorithm 3, which is the quadratic code generator matrix $\mathbf{Q}_{r}$ with a column of all ones appended to it also generates the quadratic residue code.

The vector $\mathbf{s}\in\left\{0,1\right\}^{n_{p}}$ with all zero entries, with the exception of the last entry which is set to one, is non orthogonal to all rows of $\mathbf{Q}_{\mathbf{s}}$. Hence, adhering to the notation here and of Section 4.1, $\mathcal{C}_{\mathbf{s}}$ is the quadratic residue code and expression (18) is equal to $\cos^{2}\frac{\pi}{8}$. The reader may refer to Figures 10 and 11 for some intuition about the above matrices.

$\mathbf{A}$, defined in line 5 of Algorithm 3, is the operation which adds columns of $\mathbf{Q}_{s}$, chosen when $\widehat{\mathbf{s}_{i}}=1$, to the last column of $\mathbf{Q_{s}}$. We know that the resulting matrix, $\mathbf{Q}=\mathbf{Q_{s}}\mathbf{A}$, is also a generator matrix of the quadratic residue code as all the columns of $\mathbf{Q}_{s}$ are in the quadratic residue code space. We also know, from the discussion of Section 4.1, that all the rows of $\mathbf{Q}$ are non-orthogonal to $\mathbf{A}^{-1}\mathbf{s}^{T}$. As such $\mathcal{C}_{\mathbf{A}^{-1}\mathbf{s}^{T}}$, when $\mathbf{Q}$ is the $X$-program of concern, is the quadratic residue code space and hence the bias of the $X$-program $\mathbf{Q}$ in the direction $\mathbf{A}^{-1}\mathbf{s}^{T}$ is $\cos^{2}\frac{\pi}{8}$. This matrix may be visualised in Figure 12 and this fact is exploited in line 11 of Algorithm 3.

We know, however, that from any $\mathbf{Q}$ we can make the IQP extended graph $\widetilde{\mathbf{Q}}$, which is the matrix $\mathbf{Q}_{r}$ with a column of minus ones appended to the end. Observing Figure 13 may help to visualise this. We can now use the resource of Section 3.2 to perform a blind IQP computation.

By using the blind IQP computation resource of Section 3.2 we have solved condition 2.3 but do so now with information theoretic security as opposed to the reliance on computational complexity assumptions used by [10]. This is true because, as a product of using the resource of Section 3.2, the Server learns only the distribution $\mathcal{Q}$ over the possible set of graphs $\mathbf{Q}$. By setting $\mathbf{Q}=\mathbf{Q_{s}}\mathbf{A}$, Algorithm 3 develops a bijection mapping $\widehat{\mathbf{s}}\in\{0,1\}^{n_{p}-1}$ to a unique matrix $\mathbf{Q}\in\{0,1\}^{n_{a}\times n_{p}}$. So $\mathcal{Q}$ is equivalent to the distribution from which $\widehat{\mathbf{s}}$ is drawn. In this case it is the uniform distribution over a set of size $2^{n_{p}-1}$. ∎

5 Conclusion and Future Work

We have presented a protocol that can be used by a limited quantum Client, able to prepare one-qubit Pauli operator eigenstates, to delegate the construction of IQP circuits to a powerful quantum Server. By giving the Client of the computation limited quantum abilities (i.e. manipulation of single qubits), we have managed to remove the computational restriction of the Server required in previous work [10], and therefore have proven information-theoretical security against a malicious Server. The protocol is also proven to be composable and therefore can be used to verify an IQP machine as part of a larger delegated computation.

IQP circuits are also important because they are relatively easy to implement in an experimental setup in comparison to fully fledged quantum computers needed for universal computations. Our protocol requires two layers of measurements, in order to do the appropriate corrections resulting from the blind creation of the state at the Server’s side, and for a small number of qubits, it can be implemented even with present technology. A future avenue of research would therefore be the study of this protocol under realistic experimental errors in view of a potential implementation.

6 Acknowledgements

The authors would like to thank Andru Gheorghiu and Petros Wallden for many enlightening discussions and feedback. This work was supported by grant EP/L01503X/1 for the University of Edinburgh School of Informatics Centre for Doctoral Training in Pervasive Parallelism (http://pervasiveparallelism.inf.ed.ac.uk/) from the UK Engineering and Physical Sciences Research Council (EPSRC) and by grants EP/K04057X/2, EP/N003829/1 and EP/ M013243/1, as well as by the European Union’s Horizon 2020 Research and Innovation program under Marie Sklodowska-Curie Grant Agreement No. 705194.

Appendix A Appendix

A.1 Detailed proof of Lemma 3.1

Lemma A.1**.**

Consider a quantum state $E_{\mathbf{Q}}\ket{\phi}$ where $\ket{\phi}$ is arbitrary. If $\widetilde{\mathbf{Q}}$ is an extended IQP graph built from $\mathbf{Q}$ then there exists a state $E_{\widetilde{\mathbf{Q}}}\ket{\psi}$, which can be transformed into the state $E_{\mathbf{Q}}\ket{\phi}$ through a sequence of Pauli-$Y$ basis measurements on qubits and local rotations around the Z axis on the unmeasured qubits through angles $\left\{0,\frac{\pi}{2},\pi,\frac{3\pi}{2}\right\}$.

Proof.

This proof is by construction. We will define a scheme for building the state $\ket{\psi}$ and a corresponding IQP extended graph $\widetilde{\mathbf{Q}}$ meeting the conditions of the lemma.

We begin by considering the case where $\widetilde{\mathbf{Q}}$ was built from the graph $\mathbf{Q}$ by replacing one of the entries, say $\left(i,j\right)$, of $\mathbf{Q}$ with $-1$. $\mathbf{Q}$ can be built from $\widetilde{\mathbf{Q}}$ either by applying a break operation to the vertex $b_{1=g\left(i,j\right)}$, or by applying a bridge operation to this same vertex.

We now move to consider these two separate cases.

• •

Break: $\mathbf{Q}_{ij}=0$. Define the state $E_{\widetilde{\mathbf{Q}}}\ket{\psi}$ as below.

[TABLE]

Here we set $\ket{b_{1}}=\ket{r^{b}_{1}}$ with $r^{b}_{1}\in\left\{0,1\right\}$, and $cZ_{p_{j},b_{1}}$ and $cZ_{a_{i},b_{1}}$ are the controlled operators on the respective qubits. Notice then that $cZ_{a_{i},b_{1}}cZ_{p_{j},b_{1}}E_{\mathbf{Q}}$ indeed describes the same entanglement pattern as $E_{\widetilde{\mathbf{Q}}}$.

Applying the controlled-$Z$ operations is equivalent to applying the operator $Z^{r^{b}_{1}}$ to each of the qubits $a_{i}$ and $p_{j}$. We can conclude:

[TABLE]

Measuring the qubit $b_{1}$ in the Pauli-$Y$ basis causes a collapse to either of the Pauli-$Y$ basis states with equal likelihood. It does not, however, have any other effect on the state as the qubit $b_{1}$ is disentangled. We can therefore discard it and be left with the state $Z^{r^{b}_{1}}_{a_{i}}Z^{r^{b}_{1}}_{p_{j}}E_{\mathbf{Q}}\ket{\phi}$ which differs from $E_{\mathbf{Q}}\ket{\phi}$ only by local rotations about the $Z$ axis.

• •

Bridge: $\mathbf{Q}_{ij}=1$. Define the state $E_{\widetilde{\mathbf{Q}}}\ket{\psi}$ as below.

[TABLE]

Here $\ket{b_{1}}=\frac{1}{\sqrt{2}}\left(\ket{0}+\left(-1\right)^{r^{b}_{1}}\ket{1}\right)$ with $r^{b}_{1}\in\left\{0,1\right\}$ (i.e a Hadamard basis state). Notice that $cZ_{a_{i},b_{1}}cZ_{p_{j},b_{1}}cZ_{a_{i},p_{j}}E_{\mathbf{Q}}$ describes the same operation as $E_{\widetilde{\mathbf{Q}}}$.

Applying the operations, $cZ_{a_{i},b_{1}}$ and $cZ_{p_{j},b_{1}}$ to the state $cZ_{a_{i},p_{j}}E_{\mathbf{Q}}\ket{\phi}\ket{b_{1}}$ is equivalent to applying the following operator to the state $cZ_{a_{i},p_{j}}E_{\mathbf{Q}}\ket{\phi}$.

[TABLE]

The above process followed by a measurement of qubit $b_{1}$ in the Pauli-$Y$ basis is equivalent to applying the following operator to $cZ_{a_{i},p_{j}}E_{\mathbf{Q}}\ket{\phi}$.

[TABLE]

Here we have used the notation that $s^{b}_{1}=0$ when $\ket{+^{Y}}$ is measured and $s^{b}_{1}=1$ when $\ket{-^{Y}}$ is measured. The expression results from post multiplication of expression (23) by $\frac{1}{\sqrt{2}}\bra{0}+\left(-1\right)^{1-s^{b}_{1}}i\frac{1}{\sqrt{2}}\bra{1}$, the conjugate of the Pauli-$Y$ basis states, followed by the appropriate normalisation. The original state of equation (22) is transformed, by this measurement, to the state:

[TABLE]

Notice that the controlled-$Z$ operator can be written as:

[TABLE]

Using this fact allows us to see:

[TABLE]

[TABLE]

In particular:

[TABLE]

Substituting this into (25), and with some rearranging, we realise the resulting state is actually that of equation (30).

[TABLE]

Once again this differs from the state $E_{\mathbf{Q}}\ket{\phi}$ only by local rotations around the $Z$ axis.

We now turn to the case where the number of break and bridge operations needed to move from $\widetilde{\mathbf{Q}}$ to $\mathbf{Q}$ is more than one. The state $E_{\widetilde{\mathbf{Q}}}\ket{\psi}$ can be built one step at a time by repeating the steps above (i.e. entangling the appropriate bridge and break qubits one at a time). The proof that the state resulting from measurements of the qubits $b_{1},...,b_{m}$ would result in the graph $E_{\mathbf{Q}}\ket{\phi}$ follows for the following reasoning. Since the qubits that might require corrections are never measured, all measurements and corrections commute. The entanglement operators too commute with the corrections and the measurement operations when they do not act upon the same qubits. As such all operations commute, therefore all the necessary entanglement operations, measurement operations and all the necessary corrections can be done in this order, all at once. ∎

A.2 Extended Proof of Theorem 3.1

Theorem A.1**.**

The protocol described by Algorithm 1 is secure against a dishonest Server.

Proof.

The proof consists of a pattern of transformations of the real protocol of Algorithm 1, into the ideal resource of Algorithm 2, which leaves the computation unchanged, therefore ensuring the indistinguishability of the two settings.

The first transformation we perform is of the state generation phase of the Algorithm 1. The new method we use for this phase is described in Algorithm 6 and relies on the measurement of EPR pairs to produce qubits in the correct basis, with some randomness resulting from the measurement. This may be visualised by the expansion of $\pi_{A}^{1}$ seen in Figure 8 in the main text.

While lines 1, 2 and 4 of Algorithm 1 and the lines 1, 2, 3 and 5 of Algorithm 6 differ the remainder of both algorithms is identical. We show now that the algorithms are indistinguishable.

Firstly consider the generation of $r^{p}$ and $r^{a}$. In Algorithm 1 these terms are picked uniformly at random from the set of all binary stings of the appropriate length. In the case of Algorithm 6 they are generated by measurements on EPR pairs, the result of which is entirely random. Similarly, in both cases, $r^{b}$ is picked uniformly at random from the set of all binary strings of the appropriate length.

Line 2 of Algorithm 1 generates at random one of the four states $\ket{+}$, $\ket{+^{Y}}$, $\ket{-}$ and $\ket{-^{Y}}$. Line 3 of Algorithm 6 achieves the same effect by measuring an EPR pair with equal probability in one of the basis $\left\{\ket{+},\ket{-}\right\}$ and $\left\{\ket{+^{Y}},\ket{-^{Y}}\right\}$.

Finally, the application of the $\left(\sqrt{Y}\right)^{d^{b}_{j}}$ operation in line 4 of Algorithm 1 decides, according the graph to be created, if the bridge and break qubit will be drawn from the set $\left\{\ket{+},\ket{-}\right\}$ or $\left\{\ket{0},\ket{1}\right\}$. Choosing between using the measurement basis $\left\{\ket{+},\ket{-}\right\}$ or $\left\{\ket{0},\ket{1}\right\}$ on one half of an EPR pair of course has the same effect. The random rotation $Y^{r^{b}}_{j}$ then has the same effect of the randomness that is intrinsic to the measurement performed in Algorithm 6.

Consider now the transformation from Algorithm 6 to Algorithm 7. Notice that line 3 of Algorithm 6 is identical to that of line 9 of Algorithm 7. This operation can be delayed without affecting the computation as the qubit being measured is not acted upon in any other way during the protocol.

Consider $\Pi$ and $A$. In Algorithm 7 they are generated at random from the set of all $\Pi\in\left[0,1,2,3\right]^{n_{p}}$ and $A\in\left[0,1,2,3\right]^{n_{a}}$ as stated in line 7. This is the case too for Algorithm 6 because $\Pi^{z}_{i}$, $\Pi^{s}_{i}$, $A^{z}_{k}$ and $A^{s}_{k}$ are one time padded by $r^{p}_{i}$, $d^{p}_{i}$, $r^{a}_{k}$ and $d^{a}_{k}$ respectively as seen in equations (8), (9), (10) and (11).

It remains to show that Algorithm 7 results in the same computation as Algorithm 6. This can be achieved by noting a simple rearrangement of equations (8), (9), (10) and (11) to make $d^{p}_{i}$ and $d^{a}_{k}$ the subject. In doing so we assume the $r_{p}^{i},r_{a}^{k}=0$ which is corrected for, if this is not the case, in equation (17). The reader may wish to refer to Figure 8 in the main text for a visualisation of this new resource.

Finally, Algorithm 2 simply involves a relabeling of the players in the protocol of Algorithm 7 to match those in the simulator distinguisher setting. This amounts to the transformation from Figure 8 to Figure 9 in the main text.

This series of transformations convinces us that the following relationship is true and that the resource of Algorithm 1 is composably secure against a dishonest Server.

[TABLE]

∎

A.3 Pictorial Evolution of Algorithms in This Paper